@solana-agent-wallet-adapter/cli 0.1.0 → 0.2.0

package/dist/index.js

@@ -6837,7 +6837,7 @@ var require_utils2 = __commonJS({
     exports.u32 = u323;
     exports.clean = clean3;
     exports.createView = createView3;
-    exports.rotr = rotr2;
+    exports.rotr = rotr3;
     exports.rotl = rotl2;
     exports.byteSwap = byteSwap2;
     exports.byteSwap32 = byteSwap322;
@@ -6901,7 +6901,7 @@ var require_utils2 = __commonJS({
     function createView3(arr) {
       return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
     }
-    function rotr2(word, shift) {
+    function rotr3(word, shift) {
       return word << 32 - shift | word >>> shift;
     }
     function rotl2(word, shift) {
@@ -7346,7 +7346,7 @@ var require_sha2 = __commonJS({
     var _md_ts_1 = require_md();
     var u64 = require_u64();
     var utils_ts_1 = require_utils2();
-    var SHA256_K2 = /* @__PURE__ */ Uint32Array.from([
+    var SHA256_K3 = /* @__PURE__ */ Uint32Array.from([
       1116352408,
       1899447441,
       3049323471,
@@ -7453,7 +7453,7 @@ var require_sha2 = __commonJS({
         let { A: A4, B: B3, C: C2, D: D3, E: E3, F: F3, G: G3, H: H5 } = this;
         for (let i = 0; i < 64; i++) {
           const sigma1 = (0, utils_ts_1.rotr)(E3, 6) ^ (0, utils_ts_1.rotr)(E3, 11) ^ (0, utils_ts_1.rotr)(E3, 25);
-          const T1 = H5 + sigma1 + (0, _md_ts_1.Chi)(E3, F3, G3) + SHA256_K2[i] + SHA256_W2[i] | 0;
+          const T1 = H5 + sigma1 + (0, _md_ts_1.Chi)(E3, F3, G3) + SHA256_K3[i] + SHA256_W2[i] | 0;
           const sigma0 = (0, utils_ts_1.rotr)(A4, 2) ^ (0, utils_ts_1.rotr)(A4, 13) ^ (0, utils_ts_1.rotr)(A4, 22);
           const T22 = sigma0 + (0, _md_ts_1.Maj)(A4, B3, C2) | 0;
           H5 = G3;
@@ -17286,7 +17286,7 @@ var require_dist2 = __commonJS({
       function isNonArrayObject(x4) {
         return isObject2(x4) && !Array.isArray(x4);
       }
-      function isPlainObject3(x4) {
+      function isPlainObject4(x4) {
         if (Object.prototype.toString.call(x4) !== "[object Object]") {
           return false;
         }
@@ -17926,7 +17926,7 @@ var require_dist2 = __commonJS({
           if (x4 === void 0) {
             return f;
           }
-          if (!options.strict && isPlainObject3(x4) && isPlainObject3(f)) {
+          if (!options.strict && isPlainObject4(x4) && isPlainObject4(f)) {
             const ret = { ...x4 };
             let changed = false;
             for (const key in f) {
@@ -63624,6 +63624,901 @@ function sleep(ms) {
 // ../mcp-server/dist/actionService.js
 var import_web3 = __toESM(require_index_cjs(), 1);
 
+// ../workflow/dist/cadence.js
+function exhaustionReason(schedule, now) {
+  if (schedule.maxOccurrences !== void 0 && (schedule.occurrencesCreated ?? 0) >= schedule.maxOccurrences) {
+    return "max_occurrences";
+  }
+  if (schedule.expiresAt) {
+    const expiry = new Date(schedule.expiresAt);
+    if (!Number.isNaN(expiry.getTime()) && now.getTime() >= expiry.getTime()) {
+      return "expired";
+    }
+  }
+  return null;
+}
+function nextFutureOccurrence(schedule, now) {
+  const startAt = recurringStartAt(schedule);
+  if (!startAt)
+    return null;
+  const candidate = nextFutureByCadence(schedule, now, startAt);
+  if (!candidate)
+    return null;
+  if (schedule.expiresAt) {
+    const expiry = new Date(schedule.expiresAt);
+    if (!Number.isNaN(expiry.getTime()) && candidate.dueAt.getTime() >= expiry.getTime()) {
+      return null;
+    }
+  }
+  return candidate;
+}
+function latestDueOccurrence(schedule, now) {
+  const startAt = recurringStartAt(schedule);
+  if (!startAt)
+    return null;
+  const candidate = latestDueByCadence(schedule, now, startAt);
+  if (!candidate || candidate.dueAt.getTime() < startAt.getTime())
+    return null;
+  if (schedule.expiresAt) {
+    const expiry = new Date(schedule.expiresAt);
+    if (!Number.isNaN(expiry.getTime()) && candidate.dueAt.getTime() >= expiry.getTime()) {
+      return null;
+    }
+  }
+  return candidate;
+}
+function previewUpcoming(schedule, now, count) {
+  if (count <= 0)
+    return [];
+  const results = [];
+  let cursorNow = now;
+  let occurrencesCreated = schedule.occurrencesCreated ?? 0;
+  for (let i = 0; i < count; i += 1) {
+    const probe = { ...schedule, occurrencesCreated };
+    if (exhaustionReason(probe, cursorNow))
+      break;
+    const next = nextFutureOccurrence(probe, cursorNow);
+    if (!next)
+      break;
+    results.push(next);
+    occurrencesCreated += 1;
+    cursorNow = new Date(next.dueAt.getTime());
+  }
+  return results;
+}
+function recurringStartAt(schedule) {
+  const value = new Date(schedule.startAt ?? schedule.createdAt);
+  return Number.isNaN(value.getTime()) ? null : value;
+}
+function parseLocalTime(value) {
+  if (!value)
+    return null;
+  const [hourRaw, minuteRaw] = value.split(":");
+  const hour = Number(hourRaw);
+  const minute = Number(minuteRaw);
+  if (!Number.isInteger(hour) || !Number.isInteger(minute) || hour < 0 || hour > 23 || minute < 0 || minute > 59) {
+    return null;
+  }
+  return { hour, minute };
+}
+function clampedMonthlyDate(year, month, dayOfMonth, hour, minute) {
+  const lastDay = new Date(year, month + 1, 0).getDate();
+  return new Date(year, month, Math.min(dayOfMonth, lastDay), hour, minute, 0, 0);
+}
+function monthlyKey(date3) {
+  const month = String(date3.getMonth() + 1).padStart(2, "0");
+  const day = String(date3.getDate()).padStart(2, "0");
+  return `${date3.getFullYear()}-${month}-${day}`;
+}
+function intervalKey(dueAt, cadence) {
+  if (cadence === "interval_days")
+    return monthlyKey(dueAt);
+  return dueAt.toISOString();
+}
+function nextFutureByCadence(schedule, now, startAt) {
+  switch (schedule.cadence) {
+    case "weekly":
+      return nextFutureWeekly(schedule, now, startAt);
+    case "monthly":
+      return nextFutureMonthly(schedule, now, startAt);
+    case "interval_days":
+      return nextFutureInterval(schedule, now, schedule.intervalDays, 24 * 60 * 60 * 1e3);
+    case "interval_hours":
+      return nextFutureInterval(schedule, now, schedule.intervalHours, 60 * 60 * 1e3);
+    case "interval_minutes":
+      return nextFutureInterval(schedule, now, schedule.intervalMinutes, 60 * 1e3);
+    default:
+      return assertNeverCadence(schedule.cadence);
+  }
+}
+function latestDueByCadence(schedule, now, startAt) {
+  switch (schedule.cadence) {
+    case "weekly":
+      return latestDueWeekly(schedule, now, startAt);
+    case "monthly":
+      return latestDueMonthly(schedule, now, startAt);
+    case "interval_days":
+      return latestDueInterval(schedule, now, schedule.intervalDays, 24 * 60 * 60 * 1e3);
+    case "interval_hours":
+      return latestDueInterval(schedule, now, schedule.intervalHours, 60 * 60 * 1e3);
+    case "interval_minutes":
+      return latestDueInterval(schedule, now, schedule.intervalMinutes, 60 * 1e3);
+    default:
+      return assertNeverCadence(schedule.cadence);
+  }
+}
+function nextFutureWeekly(schedule, now, startAt) {
+  const time3 = parseLocalTime(schedule.localTime);
+  if (!time3)
+    return null;
+  if (!Number.isInteger(schedule.dayOfWeek) || schedule.dayOfWeek === void 0)
+    return null;
+  const candidate = new Date(now.getTime());
+  candidate.setHours(time3.hour, time3.minute, 0, 0);
+  const daysForward = (schedule.dayOfWeek - candidate.getDay() + 7) % 7;
+  candidate.setDate(candidate.getDate() + daysForward);
+  if (candidate.getTime() <= now.getTime()) {
+    candidate.setDate(candidate.getDate() + 7);
+  }
+  while (candidate.getTime() < startAt.getTime()) {
+    candidate.setDate(candidate.getDate() + 7);
+  }
+  return { dueAt: candidate, key: candidate.toISOString().slice(0, 10) };
+}
+function nextFutureMonthly(schedule, now, startAt) {
+  const time3 = parseLocalTime(schedule.localTime);
+  if (!time3)
+    return null;
+  if (!Number.isInteger(schedule.dayOfMonth) || schedule.dayOfMonth === void 0)
+    return null;
+  let candidate = clampedMonthlyDate(now.getFullYear(), now.getMonth(), schedule.dayOfMonth, time3.hour, time3.minute);
+  if (candidate.getTime() <= now.getTime()) {
+    candidate = clampedMonthlyDate(candidate.getFullYear(), candidate.getMonth() + 1, schedule.dayOfMonth, time3.hour, time3.minute);
+  }
+  while (candidate.getTime() < startAt.getTime()) {
+    candidate = clampedMonthlyDate(candidate.getFullYear(), candidate.getMonth() + 1, schedule.dayOfMonth, time3.hour, time3.minute);
+  }
+  return { dueAt: candidate, key: monthlyKey(candidate) };
+}
+function nextFutureInterval(schedule, now, interval, intervalMs) {
+  if (!Number.isInteger(interval) || interval === void 0 || interval < 1)
+    return null;
+  const anchor = recurringStartAt(schedule);
+  if (!anchor)
+    return null;
+  const time3 = schedule.cadence === "interval_days" ? parseLocalTime(schedule.localTime) : null;
+  const dueAt = new Date(anchor.getTime());
+  if (time3)
+    dueAt.setHours(time3.hour, time3.minute, 0, 0);
+  const totalIntervalMs = interval * intervalMs;
+  if (dueAt.getTime() > now.getTime()) {
+    return { dueAt, key: intervalKey(dueAt, schedule.cadence) };
+  }
+  const elapsedMs = now.getTime() - dueAt.getTime();
+  const intervalsToAdvance = Math.floor(elapsedMs / totalIntervalMs) + 1;
+  dueAt.setTime(dueAt.getTime() + intervalsToAdvance * totalIntervalMs);
+  return { dueAt, key: intervalKey(dueAt, schedule.cadence) };
+}
+function latestDueWeekly(schedule, now, startAt) {
+  const time3 = parseLocalTime(schedule.localTime);
+  if (!time3)
+    return null;
+  if (!Number.isInteger(schedule.dayOfWeek) || schedule.dayOfWeek === void 0)
+    return null;
+  const candidate = new Date(now.getTime());
+  candidate.setHours(time3.hour, time3.minute, 0, 0);
+  const daysBack = (candidate.getDay() - schedule.dayOfWeek + 7) % 7;
+  candidate.setDate(candidate.getDate() - daysBack);
+  if (candidate.getTime() < startAt.getTime()) {
+    while (candidate.getTime() < startAt.getTime()) {
+      candidate.setDate(candidate.getDate() + 7);
+    }
+  } else if (candidate.getTime() > now.getTime()) {
+    candidate.setDate(candidate.getDate() - 7);
+  }
+  if (candidate.getTime() < startAt.getTime())
+    return null;
+  return { dueAt: candidate, key: candidate.toISOString().slice(0, 10) };
+}
+function latestDueMonthly(schedule, now, startAt) {
+  const time3 = parseLocalTime(schedule.localTime);
+  if (!time3)
+    return null;
+  if (!Number.isInteger(schedule.dayOfMonth) || schedule.dayOfMonth === void 0)
+    return null;
+  let candidate = clampedMonthlyDate(now.getFullYear(), now.getMonth(), schedule.dayOfMonth, time3.hour, time3.minute);
+  if (candidate.getTime() > now.getTime()) {
+    candidate = clampedMonthlyDate(candidate.getFullYear(), candidate.getMonth() - 1, schedule.dayOfMonth, time3.hour, time3.minute);
+  }
+  while (candidate.getTime() < startAt.getTime()) {
+    candidate = clampedMonthlyDate(candidate.getFullYear(), candidate.getMonth() + 1, schedule.dayOfMonth, time3.hour, time3.minute);
+  }
+  return { dueAt: candidate, key: monthlyKey(candidate) };
+}
+function latestDueInterval(schedule, now, interval, intervalMs) {
+  if (!Number.isInteger(interval) || interval === void 0 || interval < 1)
+    return null;
+  const anchor = recurringStartAt(schedule);
+  if (!anchor)
+    return null;
+  const time3 = schedule.cadence === "interval_days" ? parseLocalTime(schedule.localTime) : null;
+  const dueAt = new Date(anchor.getTime());
+  if (time3)
+    dueAt.setHours(time3.hour, time3.minute, 0, 0);
+  const totalIntervalMs = interval * intervalMs;
+  if (dueAt.getTime() > now.getTime()) {
+    return { dueAt, key: intervalKey(dueAt, schedule.cadence) };
+  }
+  const elapsedMs = now.getTime() - dueAt.getTime();
+  const intervalsElapsed = Math.floor(elapsedMs / totalIntervalMs);
+  dueAt.setTime(dueAt.getTime() + intervalsElapsed * totalIntervalMs);
+  return { dueAt, key: intervalKey(dueAt, schedule.cadence) };
+}
+function assertNeverCadence(cadence) {
+  throw new Error(`Unhandled recurring cadence: ${String(cadence)}`);
+}
+var PREVIEW_CAP = 1e4;
+function lifetimeSpendEstimate(schedule, amount, now) {
+  const isBounded = schedule.maxOccurrences !== void 0 || schedule.expiresAt !== void 0;
+  const perWeek = formatRate(amount, runsPerWeek(schedule));
+  const perMonth = formatRate(amount, runsPerMonth(schedule));
+  if (!isBounded) {
+    return { bounded: false, perWeek, perMonth };
+  }
+  const remaining = previewUpcoming(schedule, now, PREVIEW_CAP).length;
+  const totalAmount = multiplyDecimalString(amount, remaining);
+  return { bounded: true, totalRuns: remaining, totalAmount, perWeek, perMonth };
+}
+function runsPerWeek(schedule) {
+  switch (schedule.cadence) {
+    case "weekly":
+      return 1;
+    case "monthly":
+      return 7 / 30.4375;
+    case "interval_days":
+      return schedule.intervalDays && schedule.intervalDays > 0 ? 7 / schedule.intervalDays : 0;
+    case "interval_hours":
+      return schedule.intervalHours && schedule.intervalHours > 0 ? 168 / schedule.intervalHours : 0;
+    case "interval_minutes":
+      return schedule.intervalMinutes && schedule.intervalMinutes > 0 ? 10080 / schedule.intervalMinutes : 0;
+    default:
+      return 0;
+  }
+}
+function runsPerMonth(schedule) {
+  switch (schedule.cadence) {
+    case "weekly":
+      return 30.4375 / 7;
+    case "monthly":
+      return 1;
+    case "interval_days":
+      return schedule.intervalDays && schedule.intervalDays > 0 ? 30.4375 / schedule.intervalDays : 0;
+    case "interval_hours":
+      return schedule.intervalHours && schedule.intervalHours > 0 ? 730.5 / schedule.intervalHours : 0;
+    case "interval_minutes":
+      return schedule.intervalMinutes && schedule.intervalMinutes > 0 ? 43830 / schedule.intervalMinutes : 0;
+    default:
+      return 0;
+  }
+}
+function formatRate(amount, multiplier) {
+  const value = Number(amount) * multiplier;
+  if (!Number.isFinite(value))
+    return "0";
+  return value.toFixed(6).replace(/\.?0+$/, "");
+}
+function multiplyDecimalString(value, factor) {
+  if (!Number.isInteger(factor) || factor < 0)
+    return "0";
+  if (factor === 0)
+    return "0";
+  const trimmed = value.trim();
+  const match = /^(\d+)(?:\.(\d+))?$/.exec(trimmed);
+  if (!match)
+    return "0";
+  const whole = match[1];
+  const fraction = match[2] ?? "";
+  const decimals = fraction.length;
+  if (decimals === 0)
+    return (BigInt(whole) * BigInt(factor)).toString();
+  const raw = BigInt(whole + fraction) * BigInt(factor);
+  const rawStr = raw.toString().padStart(decimals + 1, "0");
+  const head = rawStr.slice(0, -decimals);
+  const tail = rawStr.slice(-decimals).replace(/0+$/, "");
+  return tail ? `${head}.${tail}` : head;
+}
+
+// ../workflow/dist/index.js
+var WorkflowValidationError = class extends Error {
+  code;
+  path;
+  constructor(code2, message, path) {
+    super(message);
+    this.code = code2;
+    this.name = "WorkflowValidationError";
+    this.path = path;
+  }
+};
+function evaluatePlanGuardrails(input) {
+  const plan = isPlainRecord(input.plan) ? input.plan : {};
+  const parameters = normalizeStringRecord(input.parameters ?? valueRecord(plan.parameters));
+  const fields = normalizePlanFields(input.fields ?? plan.fields);
+  const source = stringValue(input.source) ?? stringValue(plan.source) ?? "template";
+  const category = stringValue(input.category) ?? stringValue(plan.category) ?? "custom";
+  const actionType = stringValue(input.actionType) ?? stringValue(plan.actionType) ?? "manual_review";
+  const templateId = stringValue(input.templateId) ?? stringValue(plan.templateId) ?? "";
+  const templateTitle = stringValue(input.templateTitle) ?? stringValue(plan.templateTitle) ?? "";
+  const cluster = stringValue(input.cluster) ?? stringValue(plan.cluster) ?? "devnet";
+  const userNotes = stringValue(input.userNotes) ?? stringValue(plan.userNotes) ?? "";
+  const prompt2 = stringValue(input.prompt) ?? stringValue(plan.prompt) ?? "";
+  const violations = [];
+  collectForbiddenGuardrailViolations({
+    value: {
+      ...plan,
+      ...input.prompt !== void 0 ? { prompt: prompt2 } : {},
+      ...input.userNotes !== void 0 ? { userNotes } : {}
+    },
+    path: "$.plan",
+    violations
+  });
+  collectUnsafeAiClaimViolations({
+    value: {
+      intent: plan.intent,
+      route: plan.route,
+      risk: plan.risk,
+      approval: plan.approval,
+      safeguards: plan.safeguards,
+      prompt: prompt2,
+      userNotes,
+      parameters,
+      fields
+    },
+    path: "$.plan",
+    source,
+    violations
+  });
+  if (isQueueableWorkflowAction(actionType)) {
+    collectMissingConstraintViolations(actionType, parameters, violations);
+  }
+  if (source === "ai") {
+    collectAiWarningViolations(plan, actionType, parameters, violations);
+  }
+  const finalizationRequirement = finalizationRequirementForAction(actionType);
+  const constraintSnapshot = planConstraintSnapshot({
+    source,
+    category,
+    actionType,
+    templateId,
+    templateTitle,
+    cluster,
+    parameters,
+    fields,
+    userNotes
+  });
+  const constraintFingerprint = stableWorkflowFingerprint(constraintSnapshot);
+  const constraintHash = stableWorkflowHash(constraintSnapshot);
+  const verdict = violations.some((violation) => violation.severity === "block") ? "block" : violations.some((violation) => violation.severity === "warn") ? "warn" : "pass";
+  return {
+    verdict,
+    source,
+    actionType,
+    finalizationRequirement,
+    constraintFingerprint,
+    constraintHash,
+    violations,
+    summary: guardrailSummary(verdict, finalizationRequirement, violations)
+  };
+}
+function assertPlanGuardrails(input) {
+  const report = evaluatePlanGuardrails(input);
+  if (report.verdict === "block") {
+    const first = report.violations.find((violation) => violation.severity === "block");
+    throw new WorkflowValidationError("ai_guardrail_blocked", first?.message ?? "Plan is blocked by Agentic AI guardrails.", first?.path);
+  }
+  return report;
+}
+function planConstraintSnapshot(input) {
+  return {
+    source: input.source ?? "template",
+    category: input.category ?? "custom",
+    actionType: input.actionType ?? "manual_review",
+    templateId: input.templateId ?? "",
+    templateTitle: input.templateTitle ?? "",
+    cluster: input.cluster ?? "devnet",
+    parameters: normalizeStringRecord(input.parameters),
+    fields: normalizePlanFields(input.fields),
+    ...input.userNotes ? { userNotes: input.userNotes } : {}
+  };
+}
+function stableWorkflowFingerprint(value) {
+  const serialized = stableJson(value);
+  let hash = 2166136261;
+  for (let index = 0; index < serialized.length; index += 1) {
+    hash ^= serialized.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return `wf_${(hash >>> 0).toString(16).padStart(8, "0")}`;
+}
+function stableWorkflowHash(value) {
+  return sha256Hex(stableJson(value));
+}
+function isQueueableWorkflowAction(actionType) {
+  return actionType === "transfer_sol" || actionType === "transfer_spl" || actionType === "swap" || actionType === "recurring_payment";
+}
+function finalizationRequirementForAction(actionType) {
+  if (actionType === "transfer_sol" || actionType === "transfer_spl" || actionType === "swap" || actionType === "custom_transaction") {
+    return "transaction_preview";
+  }
+  if (actionType === "recurring_payment") {
+    return "wallet_decision_proof";
+  }
+  if (actionType === "manual_review") {
+    return "wallet_decision_proof";
+  }
+  return "none";
+}
+var FORBIDDEN_EXACT_KEYS = /* @__PURE__ */ new Set([
+  "seedphrase",
+  "recoveryphrase",
+  "mnemonic",
+  "privatekey",
+  "secretkey",
+  "delegatedsigner",
+  "delegatesigner",
+  "unlimitedapproval"
+]);
+function collectForbiddenGuardrailViolations(input) {
+  if (!input.value || typeof input.value !== "object") {
+    if (typeof input.value === "string") {
+      collectForbiddenTextViolations(input.value, input.path, input.violations);
+    }
+    return;
+  }
+  if (Array.isArray(input.value)) {
+    input.value.forEach((entry, index) => collectForbiddenGuardrailViolations({
+      value: entry,
+      path: `${input.path}[${index}]`,
+      violations: input.violations
+    }));
+    return;
+  }
+  for (const [key, entry] of Object.entries(input.value)) {
+    const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+    const path = `${input.path}.${key}`;
+    if (FORBIDDEN_EXACT_KEYS.has(normalized) || normalized.includes("privatekey") || normalized.includes("secretkey")) {
+      input.violations.push({
+        code: "forbidden_secret",
+        severity: "block",
+        message: `${path} is not accepted by Agentic workflow guardrails.`,
+        path
+      });
+    }
+    if ((normalized.includes("approvalauthority") || normalized.includes("signingauthority") || normalized.includes("authority")) && indicatesUnlimitedAuthority(entry)) {
+      input.violations.push({
+        code: "forbidden_authority",
+        severity: "block",
+        message: `${path} cannot grant unlimited approval authority.`,
+        path
+      });
+    }
+    collectForbiddenGuardrailViolations({ value: entry, path, violations: input.violations });
+  }
+}
+function collectForbiddenTextViolations(text, path, violations) {
+  const normalized = normalizeGuardrailText(text);
+  const secretRequest = /\b(share|send|enter|paste|provide|export|store|upload|reveal|recover)\b.{0,60}\b(seed phrase|recovery phrase|mnemonic|private key|secret key)\b/.test(normalized) || /\b(seed phrase|recovery phrase|mnemonic|private key|secret key)\b.{0,60}\b(ai|agent|server|cloud|provider)\b/.test(normalized);
+  if (secretRequest) {
+    violations.push({
+      code: "forbidden_secret_request",
+      severity: "block",
+      message: "Plans cannot request seed phrases, private keys, recovery phrases, or secret keys.",
+      path
+    });
+  }
+  const authorityRequest = /\b(grant|give|create|use|authorize|allow|enable)\b.{0,60}\b(delegated signer|delegate signer|server signer|unlimited approval|unrestricted authority|unlimited authority)\b/.test(normalized) || /\b(unlimited approval|unrestricted authority|server signer|delegated signer)\b/.test(normalized);
+  if (authorityRequest && !/\b(no|never|without|cannot|must not|do not|reject|block|forbid|forbidden|disallow)\b.{0,60}\b(unlimited approval|unrestricted authority|server signer|delegated signer)\b/.test(normalized)) {
+    violations.push({
+      code: "forbidden_authority_request",
+      severity: "block",
+      message: "Plans cannot create delegated signers, server signers, or unlimited approval authority.",
+      path
+    });
+  }
+}
+function collectUnsafeAiClaimViolations(input) {
+  if (typeof input.value === "string") {
+    if (input.source === "ai") {
+      collectUnsafeAiTextClaims(input.value, input.path, input.violations);
+    }
+    return;
+  }
+  if (!input.value || typeof input.value !== "object")
+    return;
+  if (Array.isArray(input.value)) {
+    input.value.forEach((entry, index) => collectUnsafeAiClaimViolations({
+      value: entry,
+      path: `${input.path}[${index}]`,
+      source: input.source,
+      violations: input.violations
+    }));
+    return;
+  }
+  for (const [key, entry] of Object.entries(input.value)) {
+    collectUnsafeAiClaimViolations({
+      value: entry,
+      path: `${input.path}.${key}`,
+      source: input.source,
+      violations: input.violations
+    });
+  }
+}
+function collectUnsafeAiTextClaims(text, path, violations) {
+  const normalized = normalizeGuardrailText(text);
+  const claims = [
+    {
+      code: "ai_claims_approved",
+      pattern: /\b(already|pre|auto)[-\s]?(approved|approval)\b|\bapproved automatically\b/,
+      message: "AI drafts cannot claim that wallet approval has already happened."
+    },
+    {
+      code: "ai_claims_signed",
+      pattern: /\b(already|pre|auto)[-\s]?(signed|signing)\b|\bsigned automatically\b/,
+      message: "AI drafts cannot claim that a wallet signature has already happened."
+    },
+    {
+      code: "ai_claims_submitted",
+      pattern: /\b(already|pre|auto)[-\s]?(submitted|executed|broadcast|sent)\b|\bsubmitted automatically\b/,
+      message: "AI drafts cannot claim that a transaction has already been submitted or executed."
+    },
+    {
+      code: "ai_bypasses_wallet",
+      pattern: /\b(no|without|skip|bypass)\b.{0,40}\b(wallet|approval|signature|signing)\b|\bdoes not require\b.{0,40}\b(wallet|approval|signature|signing)\b/,
+      message: "AI drafts cannot bypass wallet approval or signing."
+    },
+    {
+      code: "ai_claims_safe",
+      pattern: /\b(guaranteed safe|risk[-\s]?free|100%\s+safe|safe to sign|guaranteed profit|guaranteed return|cannot fail|fully reversible)\b/,
+      message: "AI drafts cannot claim that a transaction is guaranteed safe, profitable, reversible, or risk-free."
+    }
+  ];
+  for (const claim of claims) {
+    if (claim.pattern.test(normalized)) {
+      violations.push({
+        code: claim.code,
+        severity: "block",
+        message: claim.message,
+        path
+      });
+    }
+  }
+}
+function collectMissingConstraintViolations(actionType, parameters, violations) {
+  const required2 = requiredConstraintGroups(actionType);
+  for (const group of required2) {
+    if (!group.keys.some((key) => hasStringParam(parameters, key))) {
+      violations.push({
+        code: "missing_executable_constraint",
+        severity: "block",
+        message: `${group.label} is required before this plan can enter Approval Inbox.`,
+        path: `$.parameters.${group.keys[0]}`
+      });
+    }
+  }
+  const amount = firstPresentParam(parameters, ["amount", "amountSol", "inputAmount", "plannedAmount"]);
+  if (amount !== void 0 && !(Number(amount) > 0)) {
+    violations.push({
+      code: "invalid_amount_constraint",
+      severity: "block",
+      message: "Amount must be a positive number before this plan can enter Approval Inbox.",
+      path: "$.parameters.amount"
+    });
+  }
+}
+function collectAiWarningViolations(plan, actionType, parameters, violations) {
+  for (const key of ["route", "risk", "approval"]) {
+    const value = stringValue(plan[key]);
+    if (!value || value.length < 12) {
+      violations.push({
+        code: "vague_ai_review_text",
+        severity: "warn",
+        message: `AI ${key} text should be explicit before review.`,
+        path: `$.plan.${key}`
+      });
+    }
+  }
+  if (isQueueableWorkflowAction(actionType) && !firstPresentParam(parameters, ["memo", "note", "reason"])) {
+    violations.push({
+      code: "missing_context_note",
+      severity: "warn",
+      message: "A memo or reason is recommended for queueable AI plans.",
+      path: "$.parameters.memo"
+    });
+  }
+}
+function requiredConstraintGroups(actionType) {
+  if (actionType === "transfer_sol") {
+    return [
+      { label: "Recipient", keys: ["recipient", "recipientAddress"] },
+      { label: "Amount", keys: ["amount", "amountSol"] }
+    ];
+  }
+  if (actionType === "transfer_spl") {
+    return [
+      { label: "Token", keys: ["token"] },
+      { label: "Recipient", keys: ["recipient", "recipientAddress"] },
+      { label: "Amount", keys: ["amount"] }
+    ];
+  }
+  if (actionType === "swap") {
+    return [
+      { label: "Input token", keys: ["inputToken"] },
+      { label: "Output token", keys: ["outputToken"] },
+      { label: "Amount", keys: ["amount", "inputAmount"] },
+      { label: "Slippage cap", keys: ["slippageBps"] }
+    ];
+  }
+  if (actionType === "recurring_payment") {
+    return [
+      { label: "Token", keys: ["token"] },
+      { label: "Recipient", keys: ["recipient", "recipientAddress"] },
+      { label: "Amount", keys: ["amount"] },
+      { label: "Cadence", keys: ["cadence"] }
+    ];
+  }
+  return [];
+}
+function guardrailSummary(verdict, finalizationRequirement, violations) {
+  if (verdict === "block") {
+    return violations.find((violation) => violation.severity === "block")?.message ?? "Plan is blocked by guardrails.";
+  }
+  if (verdict === "warn") {
+    return violations.find((violation) => violation.severity === "warn")?.message ?? "Plan has guardrail warnings.";
+  }
+  if (finalizationRequirement === "transaction_preview") {
+    return "Plan passed guardrails and requires transaction preview before wallet approval.";
+  }
+  if (finalizationRequirement === "wallet_decision_proof") {
+    return "Plan passed guardrails and requires explicit wallet decision proof.";
+  }
+  return "Plan passed guardrails.";
+}
+function normalizeGuardrailText(value) {
+  return value.toLowerCase().replace(/\s+/g, " ").trim();
+}
+function hasStringParam(parameters, key) {
+  return Boolean(parameters[key]?.trim());
+}
+function firstPresentParam(parameters, keys) {
+  for (const key of keys) {
+    const value = parameters[key]?.trim();
+    if (value)
+      return value;
+  }
+  return void 0;
+}
+function normalizeStringRecord(value) {
+  if (!isPlainRecord(value))
+    return {};
+  const output = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry === "string")
+      output[key] = entry;
+  }
+  return output;
+}
+function normalizePlanFields(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((entry) => {
+    return Boolean(isPlainRecord(entry) && typeof entry.label === "string" && typeof entry.value === "string");
+  }).map((entry) => ({ label: entry.label, value: entry.value }));
+}
+function valueRecord(value) {
+  return isPlainRecord(value) ? value : void 0;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function isPlainRecord(input) {
+  return isPlainObject2(input);
+}
+function stableJson(value) {
+  return JSON.stringify(sortJson(value));
+}
+var SHA256_K = [
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+];
+function sha256Hex(value) {
+  const bytes = utf8Bytes(value);
+  const bitLength = bytes.length * 8;
+  bytes.push(128);
+  while (bytes.length % 64 !== 56)
+    bytes.push(0);
+  const high = Math.floor(bitLength / 4294967296);
+  const low = bitLength >>> 0;
+  for (const word of [high, low]) {
+    bytes.push(word >>> 24 & 255, word >>> 16 & 255, word >>> 8 & 255, word & 255);
+  }
+  let h0 = 1779033703;
+  let h1 = 3144134277;
+  let h2 = 1013904242;
+  let h3 = 2773480762;
+  let h4 = 1359893119;
+  let h5 = 2600822924;
+  let h6 = 528734635;
+  let h7 = 1541459225;
+  const w3 = new Array(64);
+  for (let offset = 0; offset < bytes.length; offset += 64) {
+    for (let i = 0; i < 16; i += 1) {
+      const index = offset + i * 4;
+      w3[i] = (bytes[index] ?? 0) << 24 | (bytes[index + 1] ?? 0) << 16 | (bytes[index + 2] ?? 0) << 8 | (bytes[index + 3] ?? 0);
+    }
+    for (let i = 16; i < 64; i += 1) {
+      const s0 = rotr(w3[i - 15], 7) ^ rotr(w3[i - 15], 18) ^ w3[i - 15] >>> 3;
+      const s1 = rotr(w3[i - 2], 17) ^ rotr(w3[i - 2], 19) ^ w3[i - 2] >>> 10;
+      w3[i] = w3[i - 16] + s0 + w3[i - 7] + s1 >>> 0;
+    }
+    let a = h0;
+    let b3 = h1;
+    let c = h2;
+    let d = h3;
+    let e = h4;
+    let f = h5;
+    let g2 = h6;
+    let h = h7;
+    for (let i = 0; i < 64; i += 1) {
+      const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g2;
+      const temp1 = h + s1 + ch + SHA256_K[i] + w3[i] >>> 0;
+      const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b3 ^ a & c ^ b3 & c;
+      const temp2 = s0 + maj >>> 0;
+      h = g2;
+      g2 = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b3;
+      b3 = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    h0 = h0 + a >>> 0;
+    h1 = h1 + b3 >>> 0;
+    h2 = h2 + c >>> 0;
+    h3 = h3 + d >>> 0;
+    h4 = h4 + e >>> 0;
+    h5 = h5 + f >>> 0;
+    h6 = h6 + g2 >>> 0;
+    h7 = h7 + h >>> 0;
+  }
+  return [h0, h1, h2, h3, h4, h5, h6, h7].map((word) => word.toString(16).padStart(8, "0")).join("");
+}
+function rotr(value, bits) {
+  return value >>> bits | value << 32 - bits;
+}
+function utf8Bytes(value) {
+  const bytes = [];
+  for (let index = 0; index < value.length; index += 1) {
+    let codePoint = value.charCodeAt(index);
+    if (codePoint >= 55296 && codePoint <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        codePoint = 65536 + (codePoint - 55296 << 10) + (next - 56320);
+        index += 1;
+      } else {
+        codePoint = 65533;
+      }
+    } else if (codePoint >= 56320 && codePoint <= 57343) {
+      codePoint = 65533;
+    }
+    if (codePoint < 128) {
+      bytes.push(codePoint);
+    } else if (codePoint < 2048) {
+      bytes.push(192 | codePoint >> 6, 128 | codePoint & 63);
+    } else if (codePoint < 65536) {
+      bytes.push(224 | codePoint >> 12, 128 | codePoint >> 6 & 63, 128 | codePoint & 63);
+    } else {
+      bytes.push(240 | codePoint >> 18, 128 | codePoint >> 12 & 63, 128 | codePoint >> 6 & 63, 128 | codePoint & 63);
+    }
+  }
+  return bytes;
+}
+function sortJson(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJson);
+  }
+  if (value && typeof value === "object") {
+    const output = {};
+    for (const key of Object.keys(value).sort()) {
+      const entry = value[key];
+      if (entry !== void 0)
+        output[key] = sortJson(entry);
+    }
+    return output;
+  }
+  return value;
+}
+function indicatesUnlimitedAuthority(value) {
+  if (value === true)
+    return true;
+  if (typeof value === "string") {
+    const normalized = value.toLowerCase();
+    return normalized.includes("unlimited") || normalized.includes("delegate") || normalized.includes("any amount");
+  }
+  if (typeof value === "number")
+    return !Number.isFinite(value);
+  return false;
+}
+function isPlainObject2(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input))
+    return false;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === Object.prototype || prototype === null;
+}
+
 // ../mcp-server/dist/amounts.js
 function parseDecimalAmount(value, decimals, label) {
   const trimmed = value.trim();
@@ -63709,7 +64604,8 @@ function normalizeConfig(input) {
     ...DEFAULT_CONFIG.jupiter,
     ...input.jupiter ?? {}
   };
-  return { cluster, rpcUrl, mainnet, tokens, jupiter };
+  const recurring = input.recurring;
+  return { cluster, rpcUrl, mainnet, tokens, jupiter, ...recurring !== void 0 && { recurring } };
 }
 function requireMainnetEnabled(config2) {
   if (config2.cluster === "mainnet-beta" && !config2.mainnet.enabled) {
@@ -64193,6 +65089,21 @@ function buildRecurringPaymentInput(input, walletAddress, config2) {
     const rawAmount = parseDecimalAmount(amount, tokenConfig.decimals, `${tokenConfig.symbol} recurring payment amount`);
     assertMaxAmount(rawAmount, tokenConfig.maxTransfer, tokenConfig.decimals, `${tokenConfig.symbol} recurring payment amount`);
   }
+  const expiresAt = normalizeExpiresAt(input.expiresAt);
+  const notifications = normalizeNotifications(input.notifications);
+  enforceRecurringPolicy(config2.recurring, token, amount, {
+    cadence: schedule.cadence,
+    dayOfWeek: schedule.dayOfWeek,
+    dayOfMonth: schedule.dayOfMonth,
+    intervalDays: schedule.intervalDays,
+    intervalHours: schedule.intervalHours,
+    intervalMinutes: schedule.intervalMinutes,
+    localTime: schedule.localTime,
+    startAt: schedule.startAt,
+    maxOccurrences: schedule.maxOccurrences,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    expiresAt
+  });
   return {
     walletAddress,
     cluster: config2.cluster,
@@ -64200,9 +65111,83 @@ function buildRecurringPaymentInput(input, walletAddress, config2) {
     recipient,
     amount,
     ...schedule,
-    ...note !== void 0 && { note }
+    ...note !== void 0 && { note },
+    ...expiresAt !== void 0 && { expiresAt },
+    ...notifications !== void 0 && { notifications }
   };
 }
+function enforceRecurringPolicy(policy, token, amount, cadenceFields) {
+  if (!policy)
+    return;
+  const lifetime = policy.maxLifetimeAmount?.[token];
+  const perWeek = policy.maxPerWeekAmount?.[token];
+  const perMonth = policy.maxPerMonthAmount?.[token];
+  if (!lifetime && !perWeek && !perMonth)
+    return;
+  const estimate = lifetimeSpendEstimate(cadenceFields, amount, /* @__PURE__ */ new Date());
+  if (lifetime && estimate.bounded && estimate.totalAmount && compareDecimal(estimate.totalAmount, lifetime) > 0) {
+    throw new ProtocolError("invalid_request", `This schedule would spend up to ${estimate.totalAmount} ${token} total, exceeding your configured lifetime cap of ${lifetime} ${token}.`);
+  }
+  if (perWeek && compareDecimal(estimate.perWeek, perWeek) > 0) {
+    throw new ProtocolError("invalid_request", `This schedule would spend up to ${estimate.perWeek} ${token} per week, exceeding your configured cap of ${perWeek} ${token} per week.`);
+  }
+  if (perMonth && compareDecimal(estimate.perMonth, perMonth) > 0) {
+    throw new ProtocolError("invalid_request", `This schedule would spend up to ${estimate.perMonth} ${token} per month, exceeding your configured cap of ${perMonth} ${token} per month.`);
+  }
+}
+function compareDecimal(left, right) {
+  const a = Number(left);
+  const b3 = Number(right);
+  if (!Number.isFinite(a) || !Number.isFinite(b3))
+    return 0;
+  if (a < b3)
+    return -1;
+  if (a > b3)
+    return 1;
+  return 0;
+}
+function normalizeNotifications(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new ProtocolError("invalid_request", "notifications must be an object.");
+  }
+  const obj = value;
+  const result = {};
+  if (obj.inApp !== void 0) {
+    if (typeof obj.inApp !== "boolean") {
+      throw new ProtocolError("invalid_request", "notifications.inApp must be a boolean.");
+    }
+    result.inApp = obj.inApp;
+  }
+  if (obj.webhookUrl !== void 0 && obj.webhookUrl !== null && obj.webhookUrl !== "") {
+    if (typeof obj.webhookUrl !== "string") {
+      throw new ProtocolError("invalid_request", "notifications.webhookUrl must be a string.");
+    }
+    try {
+      const parsed = new URL(obj.webhookUrl);
+      if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+        throw new Error("protocol");
+    } catch {
+      throw new ProtocolError("invalid_request", "notifications.webhookUrl must be a valid http(s) URL.");
+    }
+    result.webhookUrl = obj.webhookUrl;
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function normalizeExpiresAt(value) {
+  if (value === void 0 || value === null || value === "")
+    return void 0;
+  if (typeof value !== "string") {
+    throw new ProtocolError("invalid_request", "expiresAt must be an ISO timestamp string.");
+  }
+  const trimmed = value.trim();
+  const parsed = new Date(trimmed);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new ProtocolError("invalid_request", "expiresAt must be a valid ISO timestamp.");
+  }
+  return trimmed;
+}
 function normalizeRecurringSchedule(input) {
   if (input.maxOccurrences !== void 0 && (!Number.isInteger(input.maxOccurrences) || input.maxOccurrences < 1)) {
     throw new ProtocolError("invalid_request", "maxOccurrences must be a positive integer when provided.");
@@ -64542,10 +65527,13 @@ var JsonPreparedActionStore = class {
   }
   async listRecurringPaymentViews(now = /* @__PURE__ */ new Date()) {
     const state = await this.read();
-    return state.recurringPayments.map((payment) => ({
-      ...payment,
-      ...nextRecurringOccurrence(payment, now) ? { nextDueAt: nextRecurringOccurrence(payment, now).dueAt.toISOString() } : {}
-    })).sort((left, right) => {
+    return state.recurringPayments.map((payment) => {
+      const nextDueAt = nextRecurringDueAt(payment, now);
+      return {
+        ...payment,
+        ...nextDueAt ? { nextDueAt } : {}
+      };
+    }).sort((left, right) => {
       const leftDue = left.nextDueAt ?? "9999-12-31T23:59:59.999Z";
       const rightDue = right.nextDueAt ?? "9999-12-31T23:59:59.999Z";
       return leftDue.localeCompare(rightDue);
@@ -64587,7 +65575,13 @@ var JsonPreparedActionStore = class {
         if (payment.maxOccurrences !== void 0 && (payment.occurrencesCreated ?? 0) >= payment.maxOccurrences) {
           continue;
         }
-        const occurrence = latestRecurringOccurrence(payment, now);
+        if (payment.expiresAt) {
+          const expiry = new Date(payment.expiresAt);
+          if (!Number.isNaN(expiry.getTime()) && now.getTime() >= expiry.getTime()) {
+            continue;
+          }
+        }
+        const occurrence = latestDueOccurrence(payment, now);
         if (!occurrence || occurrence.dueAt.getTime() > now.getTime())
           continue;
         const exists = state.actions.some((action2) => action2.recurringId === payment.id && action2.occurrenceKey === occurrence.key);
@@ -64679,105 +65673,13 @@ function normalizePreparedAction(action) {
     }
   };
 }
-function latestRecurringOccurrence(payment, now) {
-  const startAt = recurringStartAt(payment);
-  if (!startAt) {
-    return null;
-  }
-  let occurrence;
-  switch (payment.cadence) {
-    case "weekly":
-      occurrence = latestWeeklyOccurrence(payment, now);
-      break;
-    case "monthly":
-      occurrence = latestMonthlyOccurrence(payment, now);
-      break;
-    case "interval_days":
-      occurrence = latestIntervalOccurrence(payment, now, payment.intervalDays, 24 * 60 * 60 * 1e3);
-      break;
-    case "interval_hours":
-      occurrence = latestIntervalOccurrence(payment, now, payment.intervalHours, 60 * 60 * 1e3);
-      break;
-    case "interval_minutes":
-      occurrence = latestIntervalOccurrence(payment, now, payment.intervalMinutes, 60 * 1e3);
-      break;
-  }
-  if (!occurrence || occurrence.dueAt.getTime() < startAt.getTime()) {
-    return null;
-  }
-  return occurrence;
-}
-function nextRecurringOccurrence(payment, now) {
-  const startAt = recurringStartAt(payment);
-  if (!startAt)
-    return null;
+function nextRecurringDueAt(payment, now = /* @__PURE__ */ new Date()) {
   if (payment.status !== "active")
     return null;
   if (payment.maxOccurrences !== void 0 && (payment.occurrencesCreated ?? 0) >= payment.maxOccurrences) {
     return null;
   }
-  switch (payment.cadence) {
-    case "weekly":
-      return nextWeeklyOccurrence(payment, now, startAt);
-    case "monthly":
-      return nextMonthlyOccurrence(payment, now, startAt);
-    case "interval_days":
-      return nextIntervalOccurrence(payment, now, payment.intervalDays, 24 * 60 * 60 * 1e3);
-    case "interval_hours":
-      return nextIntervalOccurrence(payment, now, payment.intervalHours, 60 * 60 * 1e3);
-    case "interval_minutes":
-      return nextIntervalOccurrence(payment, now, payment.intervalMinutes, 60 * 1e3);
-  }
-}
-function nextWeeklyOccurrence(payment, now, startAt) {
-  if (!payment.localTime || !Number.isInteger(payment.dayOfWeek) || payment.dayOfWeek === void 0)
-    return null;
-  const time3 = parseLocalTime(payment.localTime);
-  if (!time3)
-    return null;
-  const dueAt = new Date(now);
-  dueAt.setHours(time3.hour, time3.minute, 0, 0);
-  const daysForward = (payment.dayOfWeek - dueAt.getDay() + 7) % 7;
-  dueAt.setDate(dueAt.getDate() + daysForward);
-  if (dueAt.getTime() <= now.getTime()) {
-    dueAt.setDate(dueAt.getDate() + 7);
-  }
-  while (dueAt.getTime() < startAt.getTime()) {
-    dueAt.setDate(dueAt.getDate() + 7);
-  }
-  return { dueAt, key: dueAt.toISOString().slice(0, 10) };
-}
-function nextMonthlyOccurrence(payment, now, startAt) {
-  if (!payment.localTime || !Number.isInteger(payment.dayOfMonth) || payment.dayOfMonth === void 0)
-    return null;
-  const time3 = parseLocalTime(payment.localTime);
-  if (!time3)
-    return null;
-  let dueAt = clampedMonthlyDate(now.getFullYear(), now.getMonth(), payment.dayOfMonth, time3.hour, time3.minute);
-  if (dueAt.getTime() <= now.getTime()) {
-    dueAt = clampedMonthlyDate(now.getFullYear(), now.getMonth() + 1, payment.dayOfMonth, time3.hour, time3.minute);
-  }
-  while (dueAt.getTime() < startAt.getTime()) {
-    dueAt = clampedMonthlyDate(dueAt.getFullYear(), dueAt.getMonth() + 1, payment.dayOfMonth, time3.hour, time3.minute);
-  }
-  return { dueAt, key: dueAt.toISOString().slice(0, 10) };
-}
-function nextIntervalOccurrence(payment, now, interval, intervalMs) {
-  if (!Number.isInteger(interval) || interval === void 0 || interval < 1)
-    return null;
-  const anchor = recurringStartAt(payment);
-  if (!anchor)
-    return null;
-  const totalIntervalMs = interval * intervalMs;
-  const dueAt = new Date(anchor);
-  if (dueAt.getTime() <= now.getTime()) {
-    const elapsedMs = now.getTime() - dueAt.getTime();
-    dueAt.setTime(dueAt.getTime() + (Math.floor(elapsedMs / totalIntervalMs) + 1) * totalIntervalMs);
-  }
-  return {
-    dueAt,
-    key: payment.cadence === "interval_days" ? dueAt.toISOString().slice(0, 10) : dueAt.toISOString()
-  };
+  return nextFutureOccurrence(payment, now)?.dueAt.toISOString() ?? null;
 }
 function actionReceipt(action) {
   const recipient = typeof action.params.recipient === "string" ? action.params.recipient : void 0;
@@ -64798,93 +65700,15 @@ function actionReceipt(action) {
     cluster: action.cluster,
     createdAt: action.createdAt,
     completedAt: action.confirmedAt ?? action.updatedAt,
-    ...action.error !== void 0 && { error: action.error }
+    ...action.error !== void 0 && { error: action.error },
+    ...action.recurringId !== void 0 && { recurringId: action.recurringId },
+    ...action.occurrenceKey !== void 0 && { occurrenceKey: action.occurrenceKey }
   };
 }
 function explorerUrl2(txid, cluster) {
   const clusterParam = cluster === "mainnet-beta" ? "" : `?cluster=${cluster}`;
   return `https://solscan.io/tx/${txid}${clusterParam}`;
 }
-function latestWeeklyOccurrence(payment, now) {
-  if (!payment.localTime) {
-    return null;
-  }
-  const [hourRaw, minuteRaw] = payment.localTime.split(":");
-  const hour = Number(hourRaw);
-  const minute = Number(minuteRaw);
-  if (!Number.isInteger(hour) || !Number.isInteger(minute) || hour < 0 || hour > 23 || minute < 0 || minute > 59) {
-    return null;
-  }
-  if (!Number.isInteger(payment.dayOfWeek) || payment.dayOfWeek === void 0) {
-    return null;
-  }
-  const dueAt = new Date(now);
-  dueAt.setHours(hour, minute, 0, 0);
-  const daysBack = (dueAt.getDay() - payment.dayOfWeek + 7) % 7;
-  dueAt.setDate(dueAt.getDate() - daysBack);
-  if (dueAt.getTime() > now.getTime()) {
-    dueAt.setDate(dueAt.getDate() - 7);
-  }
-  return { dueAt, key: dueAt.toISOString().slice(0, 10) };
-}
-function latestMonthlyOccurrence(payment, now) {
-  if (!payment.localTime) {
-    return null;
-  }
-  const time3 = parseLocalTime(payment.localTime);
-  if (!time3 || !Number.isInteger(payment.dayOfMonth) || payment.dayOfMonth === void 0) {
-    return null;
-  }
-  const dueAt = clampedMonthlyDate(now.getFullYear(), now.getMonth(), payment.dayOfMonth, time3.hour, time3.minute);
-  if (dueAt.getTime() > now.getTime()) {
-    dueAt.setMonth(dueAt.getMonth() - 1);
-    const previous = clampedMonthlyDate(dueAt.getFullYear(), dueAt.getMonth(), payment.dayOfMonth, time3.hour, time3.minute);
-    return { dueAt: previous, key: previous.toISOString().slice(0, 10) };
-  }
-  return { dueAt, key: dueAt.toISOString().slice(0, 10) };
-}
-function latestIntervalOccurrence(payment, now, interval, intervalMs) {
-  if (!Number.isInteger(interval) || interval === void 0 || interval < 1) {
-    return null;
-  }
-  const anchor = new Date(payment.startAt ?? payment.createdAt);
-  if (Number.isNaN(anchor.getTime())) {
-    return null;
-  }
-  const dueAt = new Date(anchor);
-  const time3 = payment.localTime ? parseLocalTime(payment.localTime) : null;
-  if (time3 && payment.cadence === "interval_days") {
-    dueAt.setHours(time3.hour, time3.minute, 0, 0);
-  }
-  if (dueAt.getTime() > now.getTime()) {
-    return null;
-  }
-  const elapsedMs = now.getTime() - dueAt.getTime();
-  const totalIntervalMs = interval * intervalMs;
-  const intervalsElapsed = Math.floor(elapsedMs / totalIntervalMs);
-  dueAt.setTime(dueAt.getTime() + intervalsElapsed * totalIntervalMs);
-  return {
-    dueAt,
-    key: payment.cadence === "interval_days" ? dueAt.toISOString().slice(0, 10) : dueAt.toISOString()
-  };
-}
-function recurringStartAt(payment) {
-  const startAt = new Date(payment.startAt ?? payment.createdAt);
-  return Number.isNaN(startAt.getTime()) ? null : startAt;
-}
-function parseLocalTime(localTime) {
-  const [hourRaw, minuteRaw] = localTime.split(":");
-  const hour = Number(hourRaw);
-  const minute = Number(minuteRaw);
-  if (!Number.isInteger(hour) || !Number.isInteger(minute) || hour < 0 || hour > 23 || minute < 0 || minute > 59) {
-    return null;
-  }
-  return { hour, minute };
-}
-function clampedMonthlyDate(year, month, dayOfMonth, hour, minute) {
-  const lastDay = new Date(year, month + 1, 0).getDate();
-  return new Date(year, month, Math.min(dayOfMonth, lastDay), hour, minute, 0, 0);
-}
 function statusForDueAt(dueAt, now) {
   return new Date(dueAt).getTime() > now.getTime() ? "scheduled" : "ready";
 }
@@ -67204,7 +68028,7 @@ function clean(...arrays) {
 function createView(arr) {
   return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
-function rotr(word, shift) {
+function rotr2(word, shift) {
   return word << 32 - shift | word >>> shift;
 }
 var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
@@ -67758,7 +68582,7 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
 ]);
 
 // ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/sha2.js
-var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+var SHA256_K2 = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
   3049323471,
@@ -67858,15 +68682,15 @@ var SHA256 = class extends HashMD {
     for (let i = 16; i < 64; i++) {
       const W15 = SHA256_W[i - 15];
       const W22 = SHA256_W[i - 2];
-      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
-      const s1 = rotr(W22, 17) ^ rotr(W22, 19) ^ W22 >>> 10;
+      const s0 = rotr2(W15, 7) ^ rotr2(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr2(W22, 17) ^ rotr2(W22, 19) ^ W22 >>> 10;
       SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
     }
     let { A: A4, B: B3, C: C2, D: D3, E: E3, F: F3, G: G3, H: H5 } = this;
     for (let i = 0; i < 64; i++) {
-      const sigma1 = rotr(E3, 6) ^ rotr(E3, 11) ^ rotr(E3, 25);
-      const T1 = H5 + sigma1 + Chi(E3, F3, G3) + SHA256_K[i] + SHA256_W[i] | 0;
-      const sigma0 = rotr(A4, 2) ^ rotr(A4, 13) ^ rotr(A4, 22);
+      const sigma1 = rotr2(E3, 6) ^ rotr2(E3, 11) ^ rotr2(E3, 25);
+      const T1 = H5 + sigma1 + Chi(E3, F3, G3) + SHA256_K2[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr2(A4, 2) ^ rotr2(A4, 13) ^ rotr2(A4, 22);
       const T22 = sigma0 + Maj(A4, B3, C2) | 0;
       H5 = G3;
       G3 = F3;
@@ -68551,8 +69375,8 @@ function fromNumber(value, options = {}) {
       value: `${value}${suffix}`
     });
   }
-  const stringValue = (signed && value_ < 0 ? (1n << BigInt(size3 * 8)) + BigInt(value_) : value_).toString(16);
-  const hex = `0x${stringValue}`;
+  const stringValue2 = (signed && value_ < 0 ? (1n << BigInt(size3 * 8)) + BigInt(value_) : value_).toString(16);
+  const hex = `0x${stringValue2}`;
   if (size3)
     return padLeft(hex, size3);
   return hex;
@@ -76503,7 +77327,7 @@ var float32ArrayTag = "[object Float32Array]";
 var float64ArrayTag = "[object Float64Array]";
 
 // ../../node_modules/.pnpm/es-toolkit@1.44.0/node_modules/es-toolkit/dist/predicate/isPlainObject.mjs
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   if (!value || typeof value !== "object") {
     return false;
   }
@@ -76660,7 +77484,7 @@ function areObjectsEqual(a, b3, stack, areValuesEqual) {
         return a.name === b3.name && a.message === b3.message;
       }
       case objectTag: {
-        const areEqualInstances = areObjectsEqual(a.constructor, b3.constructor, stack, areValuesEqual) || isPlainObject2(a) && isPlainObject2(b3);
+        const areEqualInstances = areObjectsEqual(a.constructor, b3.constructor, stack, areValuesEqual) || isPlainObject3(a) && isPlainObject3(b3);
         if (!areEqualInstances) {
           return false;
         }
@@ -80941,6 +81765,7 @@ var BridgeAiPlanner = class {
       throw new ProtocolError("unsupported_method", "Bridge AI is not configured. Set AGENTIC_AI_API_KEY or provide a bridge session key.");
     }
     const normalizedRequest = normalizeRequest(request);
+    assertAiDraftRequestAllowed(normalizedRequest);
     if (config2.apiFormat === "anthropic") {
       return this.generateAnthropicPlan(config2, normalizedRequest);
     }
@@ -81108,7 +81933,7 @@ function normalizeStrictAiPlan(payload, request, providerLabel) {
 }
 function aiPlanFromParsed(parsed, request) {
   const parameters = request.parameters;
-  return {
+  const plan = {
     intent: stringOr(parsed.intent, `${request.template.title}: ${request.prompt}`),
     route: stringOr(parsed.route, `Draft ${request.template.actionType} request and show route details before wallet approval.`),
     risk: stringOr(parsed.risk, `Risk level ${request.template.risk}. Verify all visible fields before signing.`),
@@ -81122,6 +81947,67 @@ function aiPlanFromParsed(parsed, request) {
     fields: Object.entries(parameters).filter(([, value]) => value.trim().length > 0).map(([key, value]) => ({ label: titleCase(key), value })),
     safeguards: normalizeSafeguards(parsed.safeguards)
   };
+  return withGuardrailReport(plan, request);
+}
+function assertAiDraftRequestAllowed(request) {
+  try {
+    assertPlanGuardrails({
+      source: "ai",
+      category: request.template.category,
+      actionType: request.template.actionType,
+      templateId: request.template.id,
+      templateTitle: request.template.title,
+      parameters: request.parameters,
+      userNotes: request.userNotes,
+      prompt: request.prompt,
+      plan: {
+        source: "ai",
+        category: request.template.category,
+        actionType: request.template.actionType,
+        templateId: request.template.id,
+        templateTitle: request.template.title,
+        parameters: request.parameters,
+        prompt: request.prompt,
+        userNotes: request.userNotes,
+        intent: request.prompt,
+        route: "AI draft only. Wallet approval is required later.",
+        risk: `Requested risk level ${request.template.risk}.`,
+        approval: "Wallet approval is required before signing or submitting."
+      }
+    });
+  } catch (err) {
+    if (err instanceof Error) {
+      throw new ProtocolError("invalid_request", err.message);
+    }
+    throw err;
+  }
+}
+function withGuardrailReport(plan, request) {
+  try {
+    const report = assertPlanGuardrails({
+      plan: { ...plan },
+      source: plan.source,
+      category: plan.category,
+      actionType: plan.actionType,
+      templateId: request.template.id,
+      templateTitle: plan.templateTitle,
+      parameters: plan.parameters,
+      fields: plan.fields,
+      userNotes: plan.userNotes,
+      prompt: request.prompt
+    });
+    return {
+      ...plan,
+      guardrailReport: report,
+      constraintFingerprint: report.constraintFingerprint,
+      ...report.constraintHash ? { constraintHash: report.constraintHash } : {}
+    };
+  } catch (err) {
+    if (err instanceof Error) {
+      throw new ProtocolError("invalid_request", err.message);
+    }
+    throw err;
+  }
 }
 function isPlanJson(value) {
   return typeof value.intent === "string" && typeof value.route === "string" && typeof value.risk === "string" && typeof value.approval === "string" && Array.isArray(value.safeguards) && value.safeguards.every((entry) => typeof entry === "string");
@@ -81465,6 +82351,14 @@ async function handleRequest(req, res, backend, actionConfig, preparedActions, l
       writeJson(res, 200, { artifact: await requireLabArtifactStore(labArtifacts).upsertArtifact(artifact) });
       return;
     }
+    if (req.method === "POST" && url.pathname === "/bridge/lab-artifacts/delete") {
+      const body = await readJson(req);
+      if (!body.artifactId) {
+        throw new ProtocolError("invalid_request", "Missing artifactId.");
+      }
+      writeJson(res, 200, { deleted: await requireLabArtifactStore(labArtifacts).deleteArtifact(body.artifactId) });
+      return;
+    }
     if (req.method === "GET" && url.pathname === "/bridge/health") {
       const caps = await backend.capabilities().catch(() => null);
       const rpcWritable = actionConfig ? await checkRpcWritable(actionConfig.rpcUrl) : { ok: false, message: "Action config unavailable." };
@@ -81880,6 +82774,13 @@ var JsonLabArtifactStore = class {
     const state = await this.read();
     return sortArtifacts(state.artifacts);
   }
+  async deleteArtifact(id) {
+    return this.mutate((state) => {
+      const before = state.artifacts.length;
+      state.artifacts = state.artifacts.filter((artifact) => artifact.id !== id);
+      return state.artifacts.length !== before;
+    });
+  }
   getStoragePath() {
     return this.path;
   }
@@ -82574,7 +83475,7 @@ async function approvePreparedAction(state, idOrIndex) {
     body: JSON.stringify({ actionId: action.id })
   });
   printOk(state.options, `Approved prepared action ${action.id}.`);
-  console.log(stableJson(result));
+  console.log(stableJson2(result));
   await printInbox(state, "all").catch(() => void 0);
 }
 async function rejectPreparedAction(state, idOrIndex, reason) {
@@ -82585,7 +83486,7 @@ async function rejectPreparedAction(state, idOrIndex, reason) {
     body: JSON.stringify({ actionId: action.id, reason: reason ?? "Rejected from terminal." })
   });
   printOk(state.options, `Rejected prepared action ${action.id}.`);
-  console.log(stableJson(result));
+  console.log(stableJson2(result));
 }
 async function archivePreparedAction(state, idOrIndex) {
   const action = await resolveAction(state, idOrIndex);
@@ -82594,7 +83495,7 @@ async function archivePreparedAction(state, idOrIndex) {
     body: JSON.stringify({ actionId: action.id })
   });
   printOk(state.options, `Archived prepared action ${action.id}.`);
-  console.log(stableJson(result));
+  console.log(stableJson2(result));
 }
 async function inspectPreparedActionInteractive(state, idOrIndex) {
   const action = await resolveAction(state, idOrIndex);
@@ -82623,7 +83524,7 @@ async function runScheduleCommand(state, rl, args) {
       body: JSON.stringify({ recurringId })
     });
     printOk(state.options, `Recurring payment ${op}: ${recurringId}`);
-    console.log(stableJson(result2));
+    console.log(stableJson2(result2));
     return;
   }
   await requireWalletConnected(state);
@@ -82660,7 +83561,7 @@ async function runScheduleCommand(state, rl, args) {
     body: JSON.stringify(body)
   });
   printOk(state.options, "Recurring approval created.");
-  console.log(stableJson(result));
+  console.log(stableJson2(result));
 }
 async function runPlanCommand(state, rl, naturalLanguage) {
   printSection("Agent Plan");
@@ -82730,7 +83631,7 @@ async function runResearchCommand(state, rl, args) {
   const inlineInput = args.slice(1).join(" ");
   const input = inlineInput || await prompt(rl, "Artifact input", lab.defaultInput);
   const artifact = await buildResearchArtifact(state.options, lab, input);
-  console.log(stableJson(artifact));
+  console.log(stableJson2(artifact));
   if (await confirm(rl, "Sign this research artifact?", true)) {
     const approval = await signTextWithWallet(
       state,
@@ -82755,7 +83656,7 @@ async function runQuoteCommand(state, rl) {
     method: "POST",
     body: JSON.stringify({ amount, inputToken, outputToken, slippageBps })
   });
-  console.log(stableJson(result));
+  console.log(stableJson2(result));
 }
 async function printReceipts(state) {
   const response = await bridgeRequest(state.options, "/bridge/receipts");
@@ -83068,7 +83969,7 @@ async function handleWalletHostRequest(root, req, res) {
   }
   const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "127.0.0.1"}`);
   if (url.pathname === WALLET_HOST_HEALTH_PATH) {
-    const body2 = req.method === "HEAD" ? Buffer.alloc(0) : `${stableJson({ ok: true, service: "agentic-wallet-host" })}
+    const body2 = req.method === "HEAD" ? Buffer.alloc(0) : `${stableJson2({ ok: true, service: "agentic-wallet-host" })}
 `;
     writeStaticResponse(res, 200, "application/json; charset=utf-8", body2);
     return;
@@ -83148,7 +84049,7 @@ async function ensureRuntimeFiles(options) {
   await mkdir3(dirname3(options.preparedActionsPath), { recursive: true });
   await mkdir3(dirname3(options.labArtifactsPath), { recursive: true });
   if (!existsSync(options.configPath)) {
-    await writeFile3(options.configPath, `${stableJson(DEFAULT_CONFIG)}
+    await writeFile3(options.configPath, `${stableJson2(DEFAULT_CONFIG)}
 `, "utf8");
   }
 }
@@ -83427,7 +84328,7 @@ async function saveResearchArtifact(options, artifact) {
   await mkdir3(dir, { recursive: true });
   const existing = await readJsonFile(path).catch(() => ({ artifacts: [] }));
   const artifacts = [artifact, ...(existing.artifacts ?? []).filter((item) => item.id !== artifact.id)].slice(0, 50);
-  await writeFile3(path, `${stableJson({ artifacts })}
+  await writeFile3(path, `${stableJson2({ artifacts })}
 `, "utf8");
 }
 async function readJsonFile(path) {
@@ -83503,7 +84404,7 @@ function agentPlanSigningMessage(plan) {
     `Risk: ${plan.risk}`,
     `Constraints: ${plan.constraints.join(" | ")}`,
     `Created: ${plan.createdAt}`,
-    `Hash: ${sha2564(stableJson(plan))}`
+    `Hash: ${sha2564(stableJson2(plan))}`
   ].join("\n");
 }
 function researchSigningMessage(artifact) {
@@ -83557,7 +84458,7 @@ async function buildResearchArtifact(options, lab, input) {
     cluster,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const payloadHash = sha2564(stableJson(baseArtifact));
+  const payloadHash = sha2564(stableJson2(baseArtifact));
   return { ...baseArtifact, payloadHash };
 }
 function filterPreparedActions(actions, filter) {
@@ -83614,7 +84515,7 @@ function printPreparedActionDetail(action, row) {
     console.log(`  Error: ${action.error}`);
   }
   if (Object.keys(action.params).length > 0) {
-    console.log(`  Params: ${stableJson(action.params).replace(/\n/g, "\n    ")}`);
+    console.log(`  Params: ${stableJson2(action.params).replace(/\n/g, "\n    ")}`);
   }
 }
 function renderPreparedActionsCompact(actions) {
@@ -83711,7 +84612,7 @@ function printDoctor(options, doctor) {
   const walletHost = isRecord(doctor.walletHost) ? doctor.walletHost : {};
   console.log(`Browser wallet host: ${walletHost.reachable ? "reachable" : "offline"}`);
   if (options.json) {
-    console.log(stableJson(doctor));
+    console.log(stableJson2(doctor));
   }
 }
 function renderBanner(state) {
@@ -83788,10 +84689,10 @@ function printResult(result, options) {
     return;
   }
   if (options.json) {
-    console.log(stableJson(result));
+    console.log(stableJson2(result));
     return;
   }
-  console.log(stableJson(result));
+  console.log(stableJson2(result));
 }
 function printSection(title) {
   console.log(`
@@ -84095,16 +84996,16 @@ function stripTrailingSlash(value) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function stableJson(value) {
-  return JSON.stringify(sortJson(value), null, 2);
+function stableJson2(value) {
+  return JSON.stringify(sortJson2(value), null, 2);
 }
-function sortJson(value) {
+function sortJson2(value) {
   if (Array.isArray(value)) {
-    return value.map(sortJson);
+    return value.map(sortJson2);
   }
   if (isRecord(value)) {
     return Object.fromEntries(
-      Object.keys(value).sort().map((key) => [key, sortJson(value[key])])
+      Object.keys(value).sort().map((key) => [key, sortJson2(value[key])])
     );
   }
   return value;