@stigg/agent-sdk-js 0.0.0-stage → 1.0.0

package/dist/engine/report.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.usageEntries = exports.creditConsumption = void 0;
+exports.creditResult = creditResult;
+exports.usageResult = usageResult;
+exports.reportMetrics = reportMetrics;
+exports.eventDimensions = eventDimensions;
+exports.missingEventError = missingEventError;
+exports.meterMismatchError = meterMismatchError;
+/**
+ * The shape of an ingest, which both transports share even though none of their calls do.
+ *
+ * Stigg has two ingest APIs and they are not interchangeable. The usage report takes a fixed DTO -
+ * a `featureId` and a whole-number `value` per metric - and aggregates on arrival, so the next
+ * check sees the spend. The event report takes the call as one event and lets Stigg's own meters
+ * turn it into usage seconds later, for a fraction of the latency and a far higher rate limit.
+ * Which one a run wants is a product decision - immediacy against throughput - so the caller
+ * chooses it and this file only carries the choice out.
+ *
+ * What that costs each metric:
+ *
+ * - **`'sync'`** sends one usage report per metric, batched into the one bulk call both clients
+ *   have, because a chat turn otherwise costs four round trips.
+ * - **`'async'`** sends **one event for the whole turn**, every metric on its own dimension. One
+ *   event can feed any number of meters - each picks its number with `aggregation.field` - so
+ *   fanning out per metric would buy nothing and cost a request each.
+ *
+ * A metric named after the run's own credit currency is neither: it draws the wallet directly,
+ * because a usage report takes only a `featureId` and there is no event path from a raw event to
+ * a currency. It follows the mode only in how it waits - `consumeCredits` under `'sync'`, which
+ * answers with a balance, and `consumeCreditsAsync` under `'async'`, which does not.
+ *
+ * That orchestration lives here, and with it the parts of an ingest that are the same whichever
+ * client makes it: the consumption payload, the per-metric idempotency key, and how a bulk ack is
+ * read. Each engine still passes its own calls, so a vendor method is only ever named by the file
+ * that owns that client - but the split between wallet and features, and what a turn is taken to
+ * have cost, cannot come to mean one thing over REST and another over the SDK.
+ */
+const errors_1 = require("../errors");
+const types_1 = require("../types");
+/**
+ * Keeps every metric of a turn deduping on its own - and on the same key whichever path sends it,
+ * since a metric that names the run's currency is a wallet draw here and a usage entry elsewhere.
+ */
+const metricKey = (params, featureId) => `${params.idempotencyKey}:${featureId}`;
+/** A draw on the wallet. `consume` and `consumeAsync` take it unchanged, on both transports. */
+const creditConsumption = (customerId, params, currencyId, amount) => ({
+    customerId,
+    currencyId,
+    amount,
+    idempotencyKey: metricKey(params, currencyId),
+    dimensions: params.dimensions,
+});
+exports.creditConsumption = creditConsumption;
+/** One bulk usage report, one entry per metric. REST adds its own `updateBehavior` on top. */
+const usageEntries = (customerId, params, metrics) => Object.entries(metrics).map(([featureId, value]) => ({
+    customerId,
+    featureId,
+    value,
+    dimensions: params.dimensions,
+    idempotencyKey: metricKey(params, featureId),
+}));
+exports.usageEntries = usageEntries;
+/**
+ * What a wallet draw amounts to, read the same way whichever client made it.
+ *
+ * Only the call and where the balance sits on its response differ between the transports; this is
+ * everything after that. `creditsConsumed` is the metric's own value because a draw is spent at
+ * par - no feature mapping, no rate - and `replayed` is `false` under `'sync'` rather than
+ * unknown: the response carries the wallet's running balance but not this call's own deduction,
+ * so a replayed key is indistinguishable from a fresh one. Under `'async'` nothing comes back at
+ * all, so it stays undefined.
+ */
+function creditResult(currencyId, amount, currentUsage, mode, source) {
+    return {
+        reported: { [currencyId]: amount },
+        currentUsage: currentUsage ?? undefined,
+        creditsConsumed: amount,
+        replayed: mode === 'async' ? undefined : false,
+        mode,
+        source,
+    };
+}
+/** What a bulk usage report amounts to, read the same way whichever client answered. */
+function usageResult(acks, metrics, source) {
+    const credited = acks.filter((ack) => ack.credit);
+    const last = acks[acks.length - 1];
+    return {
+        reported: metrics,
+        currentUsage: last?.credit?.currentUsage ?? last?.currentUsage ?? undefined,
+        // Absent when nothing reported was credit-backed - which is what the run needs to know.
+        creditsConsumed: credited.length ? credited.reduce((sum, ack) => sum + (ack.credit?.consumed ?? 0), 0) : undefined,
+        // Zero consumed against a credit-backed feature means these keys were already counted.
+        replayed: credited.length ? credited.every((ack) => ack.credit?.consumed === 0) : false,
+        mode: 'sync',
+        source,
+    };
+}
+const merge = (into, add) => ({
+    ...into,
+    reported: { ...into.reported, ...add.reported },
+    creditsConsumed: into.creditsConsumed === undefined && add.creditsConsumed === undefined
+        ? undefined
+        : (into.creditsConsumed ?? 0) + (add.creditsConsumed ?? 0),
+    currentUsage: add.currentUsage ?? into.currentUsage,
+    // Only a report where *every* metric was a replay is a replay: a partial one still spent. One
+    // half that cannot say - an event - makes the whole turn unable to say, rather than say `false`.
+    replayed: into.replayed === undefined || add.replayed === undefined ? undefined : into.replayed && add.replayed,
+});
+async function reportMetrics(params, calls) {
+    // No entitlement means no wallet, so every metric is a feature - which is exactly what a run that
+    // gates on nothing is reporting.
+    const walletId = params.entitlement && (0, types_1.entitlementKind)(params.entitlement) === 'credit'
+        ? (0, types_1.entitlementId)(params.entitlement)
+        : undefined;
+    const wallet = {};
+    const features = {};
+    for (const [featureId, value] of Object.entries(params.metrics)) {
+        // A zero reaches here only under `'async'`, where it is kept so an event's dimensions hold
+        // the same shape on a turn that measured nothing. A wallet draw has no dimensions to hold -
+        // it is a consumption, not an event - so a zero would buy the shape nothing and spend a real
+        // call and this turn's idempotency key to do it, leaving a 0 in the customer's ledger.
+        if (featureId === walletId) {
+            if (value !== 0)
+                wallet[featureId] = value;
+        }
+        else
+            features[featureId] = value;
+    }
+    let result = { reported: {}, replayed: true, mode: params.mode, source: 'rest' };
+    let reported = false;
+    if (Object.keys(features).length) {
+        result = merge(result, params.mode === 'async'
+            ? await calls.event(features, eventDimensions(params, features))
+            : await calls.usage(features).catch((err) => {
+                throw (0, errors_1.isMeterMismatchError)(err) ? meterMismatchError(features) : (0, errors_1.asEngineError)('ingest', err);
+            }));
+        reported = true;
+    }
+    for (const [featureId, value] of Object.entries(wallet)) {
+        // The features above may already be at Stigg. If the wallet draw rejects now, that spend is
+        // real and the error has to carry it, or the turn reads as though nothing was metered.
+        result = merge(result, await (params.mode === 'async' ? calls.creditsAsync : calls.credits)(featureId, value).catch((err) => {
+            throw (0, errors_1.asEngineError)('ingest', err, { reported: result.reported, replayed: result.replayed });
+        }));
+        reported = true;
+    }
+    // Nothing was sent, so nothing was replayed either - saying otherwise would read as a duplicate.
+    return reported ? result : { ...result, replayed: false };
+}
+/**
+ * What one event carries, and in which order.
+ *
+ * Three namespaces flatten into one map, so the order is the whole design. Attribution is applied
+ * last and wins outright: a gateway passes vendor fields through, and a vendor field that happened
+ * to be called `agentId` would otherwise re-attribute the bill to an entity that never ran. The
+ * raw block sits under its own prefix beneath both, where it can be metered deliberately but
+ * cannot displace anything.
+ */
+function eventDimensions(params, metrics) {
+    return { ...params.raw, ...metrics, ...params.dimensions };
+}
+/**
+ * The one thing the caller has to fix themselves, so it reads the same whichever client found it.
+ *
+ * An in-process run derives the name from the vendor call it wrapped, so this is reachable only
+ * out of process, where there is no recipe to derive it from.
+ */
+function missingEventError() {
+    return new errors_1.EngineError('ingest', 'async ingest reports one event per call, and the event has to be named. Set ' +
+        "`stiggContext.eventName` to the name your Stigg meter filters on, or use `ingestMode: 'sync'`.");
+}
+/**
+ * A sync report to a feature only a meter can fill.
+ *
+ * The rejection used to be a routing signal - the engines retried it as an event and remembered.
+ * That made the transport a property of the catalog, discovered one rejection at a time, and
+ * silently moved a run onto an eventually-consistent path it never asked for. Now it says so.
+ */
+function meterMismatchError(metrics) {
+    const names = Object.keys(metrics).join(', ');
+    return new errors_1.EngineError('ingest', `${names} ${Object.keys(metrics).length > 1 ? 'are' : 'is'} backed by a raw-events meter, which the ` +
+        "usage report cannot fill. Report this run with `ingest: 'async'`, or point it at a feature " +
+        'whose value your application computes.');
+}

package/dist/engine/rest-governance-engine.d.ts

@@ -0,0 +1,47 @@
+import type { EngineCapabilities, EngineCheckParams, EngineCheckResult, EngineReportParams, EngineReportResult, EntityInput, EntityPlacement, GovernanceEngine } from './engine';
+export type RestGovernanceEngineOptions = {
+    apiKey: string;
+    baseUrl?: string;
+    timeoutMs?: number;
+};
+/** The governance check endpoint is `/api/v1-beta/` and flagged experimental. */
+export declare class RestGovernanceEngine implements GovernanceEngine {
+    /**
+     * `strictCheck: true`, and it only became true by deletion.
+     *
+     * This client holds no cache and never did - every check it serves is a live question to a
+     * fail-closed API. What made the promise weak was a decision cache above it, and with that gone
+     * there is no window in which two processes can each approve the same budget here. It
+     * implements no `preload` for the same reason: there is nothing a round trip would fill.
+     *
+     * This is the path attributed governance checks take - per-agent budgets - which is exactly
+     * where the stricter answer is worth a round trip per call.
+     */
+    readonly capabilities: EngineCapabilities;
+    private readonly client;
+    constructor(options: RestGovernanceEngineOptions);
+    /** Is governance enabled for this account? A 403 here is an account state, not a failure. */
+    probe(): Promise<'enabled' | 'not-enabled'>;
+    /**
+     * Upsert is idempotent, so this is safe to call on every sight of an agent. Placement is a
+     * second call because `parentId` lives on the assignment, not the entity - the entity upsert
+     * rejects it outright.
+     */
+    upsertEntity(customerId: string, entity: EntityInput, placement?: EntityPlacement): Promise<void>;
+    /**
+     * The `usageLimit`/`cadence` half of an assignment upsert. `usageLimit` is sent as given;
+     * `usageLimitOnCreate` is sent only when no assignment exists yet, because governance requires
+     * both fields on create and preserves both when they are omitted on update.
+     */
+    private resolveBudget;
+    check(customerId: string, { entitlement, requestedUsage, dimensions }: EngineCheckParams): Promise<EngineCheckResult>;
+    /** The four calls this client makes; `reportMetrics` decides which of them each metric is. */
+    report(customerId: string, params: EngineReportParams): Promise<EngineReportResult>;
+    /** The feature path: one bulk call, because a turn's metrics are otherwise four round trips. */
+    private reportUsage;
+    /** The credit path - no feature mapping. See the Node SDK engine's `consumeCredits`. */
+    private consumeCredits;
+    private reportAsEvent;
+    close(): Promise<void>;
+    archiveEntity(customerId: string, entityId: string): Promise<void>;
+}

package/dist/engine/rest-governance-engine.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RestGovernanceEngine = void 0;
+/**
+ * The engine half that runs on the REST client: everything governance-only.
+ *
+ * Entities, assignments and the dimensions-aware check that returns `chains` exist only here -
+ * the GraphQL SDK has no governance surface at all. This is the only file in the package that
+ * imports `@stigg/typescript`, so the beta API's drift is contained to one file.
+ */
+const typescript_1 = __importDefault(require("@stigg/typescript"));
+const errors_1 = require("../errors");
+const types_1 = require("../types");
+const sdk_identity_1 = require("../sdk-identity");
+const report_1 = require("./report");
+/** The governance check endpoint is `/api/v1-beta/` and flagged experimental. */
+class RestGovernanceEngine {
+    /**
+     * `strictCheck: true`, and it only became true by deletion.
+     *
+     * This client holds no cache and never did - every check it serves is a live question to a
+     * fail-closed API. What made the promise weak was a decision cache above it, and with that gone
+     * there is no window in which two processes can each approve the same budget here. It
+     * implements no `preload` for the same reason: there is nothing a round trip would fill.
+     *
+     * This is the path attributed governance checks take - per-agent budgets - which is exactly
+     * where the stricter answer is worth a round trip per call.
+     */
+    capabilities = { strictCheck: true, chains: true, provisioning: true };
+    client;
+    constructor(options) {
+        this.client = new typescript_1.default({
+            apiKey: options.apiKey,
+            // This client sends no Stigg identity of its own - only a generic user agent - so without
+            // these the governance half of an agent-sdk process is unattributable. Attributed checks
+            // go only here, which makes it the half worth being able to see.
+            defaultHeaders: sdk_identity_1.AGENT_SDK_REST_HEADERS,
+            ...(options.baseUrl ? { baseURL: options.baseUrl } : {}),
+            // A fail-closed 503 should reach the error policy quickly, not after two backoffs.
+            timeout: options.timeoutMs ?? 3_000,
+            maxRetries: 1,
+        });
+    }
+    /** Is governance enabled for this account? A 403 here is an account state, not a failure. */
+    async probe() {
+        try {
+            await this.client.v1Beta.entityTypes.list({ limit: 1 });
+            return 'enabled';
+        }
+        catch (err) {
+            if ((0, errors_1.looksLikeGovernanceNotEnabled)(err))
+                return 'not-enabled';
+            throw (0, errors_1.asEngineError)('probe', err);
+        }
+    }
+    /**
+     * Upsert is idempotent, so this is safe to call on every sight of an agent. Placement is a
+     * second call because `parentId` lives on the assignment, not the entity - the entity upsert
+     * rejects it outright.
+     */
+    async upsertEntity(customerId, entity, placement) {
+        try {
+            await this.client.v1Beta.customers.entities.upsert(customerId, {
+                entities: [
+                    {
+                        id: entity.id,
+                        entityTypeId: entity.entityTypeId,
+                        ...(entity.displayName ? { displayName: entity.displayName } : {}),
+                        ...(entity.metadata ? { metadata: entity.metadata } : {}),
+                    },
+                ],
+            });
+            if (!placement)
+                return;
+            const capability = (0, types_1.entitlementRef)(placement.entitlement);
+            // `usageLimitOnCreate` seeds a budget without ever overwriting one. The server preserves
+            // omitted fields on update, so the only question is whether this is an update - hence the
+            // read. A budget raised by an admin between runs therefore survives the next provision.
+            const budget = await this.resolveBudget(customerId, entity.id, capability, placement);
+            await this.client.v1Beta.customers.assignments.upsert(customerId, {
+                assignments: [
+                    {
+                        entityId: entity.id,
+                        ...capability,
+                        // Tri-state: omitted leaves the parent alone, null makes it a root, an id re-homes it.
+                        ...(placement.parentId === undefined ? {} : { parentId: placement.parentId }),
+                        ...budget,
+                    },
+                ],
+            });
+        }
+        catch (err) {
+            throw (0, errors_1.asGovernanceError)('provision', err);
+        }
+    }
+    /**
+     * The `usageLimit`/`cadence` half of an assignment upsert. `usageLimit` is sent as given;
+     * `usageLimitOnCreate` is sent only when no assignment exists yet, because governance requires
+     * both fields on create and preserves both when they are omitted on update.
+     */
+    async resolveBudget(customerId, entityId, capability, placement) {
+        const cadence = placement.cadence ? { cadence: placement.cadence } : {};
+        if (placement.usageLimit !== undefined)
+            return { usageLimit: placement.usageLimit, ...cadence };
+        if (placement.usageLimitOnCreate === undefined)
+            return cadence;
+        const existing = await this.client.v1Beta.customers.assignments.list(customerId, {
+            entityId,
+            ...capability,
+            limit: 1,
+        });
+        // Already assigned: leave the limit and its window exactly as they are.
+        if (existing.data.length > 0)
+            return {};
+        return { usageLimit: placement.usageLimitOnCreate, ...cadence };
+    }
+    async check(customerId, { entitlement, requestedUsage, dimensions }) {
+        try {
+            const response = await this.client.v1Beta.customers.entitlements.check(customerId, {
+                ...(0, types_1.entitlementRef)(entitlement),
+                requestedUsage,
+                // One dimensions map does three jobs: resolves the entity, attributes usage up every
+                // level of the tree, and selects any dimension-scoped sub-budget.
+                dimensions,
+            });
+            const data = response.data;
+            return {
+                isGranted: data.isGranted,
+                accessDeniedReason: data.accessDeniedReason,
+                usageLimit: data.usageLimit ?? null,
+                currentUsage: data.currentUsage,
+                chains: data.chains?.map((chain) => chain.map((node) => ({
+                    entityId: node.entityId,
+                    isGranted: node.isGranted,
+                    usageLimit: node.usageLimit,
+                    currentUsage: node.currentUsage,
+                    scopeEntityIds: node.scopeEntityIds,
+                }))),
+                source: 'rest',
+            };
+        }
+        catch (err) {
+            throw (0, errors_1.asEngineError)('check', err);
+        }
+    }
+    /** The four calls this client makes; `reportMetrics` decides which of them each metric is. */
+    async report(customerId, params) {
+        return (0, report_1.reportMetrics)(params, {
+            credits: (featureId, value) => this.consumeCredits(customerId, params, featureId, value),
+            creditsAsync: (featureId, value) => this.consumeCredits(customerId, params, featureId, value, 'async'),
+            event: (metrics, dimensions) => this.reportAsEvent(customerId, params, metrics, dimensions),
+            usage: (metrics) => this.reportUsage(customerId, params, metrics),
+        });
+    }
+    /** The feature path: one bulk call, because a turn's metrics are otherwise four round trips. */
+    async reportUsage(customerId, params, metrics) {
+        const response = await this.client.v1.usage.report({
+            // Explicit here and defaulted on the SDK: a report is a delta on this turn's own usage, not
+            // the running total, which is the one place these two clients could be read as disagreeing.
+            usages: (0, report_1.usageEntries)(customerId, params, metrics).map((usage) => ({ ...usage, updateBehavior: 'DELTA' })),
+        });
+        return (0, report_1.usageResult)(response.data ?? [], metrics, 'rest');
+    }
+    /** The credit path - no feature mapping. See the Node SDK engine's `consumeCredits`. */
+    async consumeCredits(customerId, params, featureId, value, mode = 'sync') {
+        // The wallet's own id. A metric only reaches this path when it names the currency the run
+        // checks, so the metric name and the currency are the same string.
+        const consumption = (0, report_1.creditConsumption)(customerId, params, featureId, value);
+        try {
+            // Same consumption either way - the amount is ours to state, so a run reporting to its own
+            // currency keeps an exact local budget in both modes. The async form just loses the balance.
+            const response = mode === 'async' ? undefined : await this.client.v1.credits.consumption.consume(consumption);
+            if (mode === 'async')
+                await this.client.v1.credits.consumption.consumeAsync({ consumptions: [consumption] });
+            return (0, report_1.creditResult)(featureId, value, response?.data.credit?.currentUsage, mode, 'rest');
+        }
+        catch (err) {
+            throw (0, errors_1.asEngineError)('ingest', err);
+        }
+    }
+    async reportAsEvent(customerId, params, metrics, dimensions) {
+        const event = params.event;
+        if (!event)
+            throw (0, report_1.missingEventError)();
+        try {
+            await this.client.v1.events.report({
+                events: [
+                    {
+                        customerId,
+                        eventName: event.name,
+                        // The turn's own key: one event, so no per-feature suffix to keep them apart.
+                        idempotencyKey: params.idempotencyKey,
+                        dimensions,
+                    },
+                ],
+            });
+            return { reported: metrics, mode: 'async', source: 'rest' };
+        }
+        catch (err) {
+            throw (0, errors_1.asEngineError)('ingest', err);
+        }
+    }
+    async close() {
+        // Nothing held open - fetch-based, no background cache. Declared so the composite can close
+        // every delegate without asking which kind it is.
+    }
+    async archiveEntity(customerId, entityId) {
+        try {
+            // Soft delete: still readable by id, and not leaf-gated - archive children yourself.
+            await this.client.v1Beta.customers.entities.archive(customerId, { ids: [entityId] });
+        }
+        catch (err) {
+            throw (0, errors_1.asGovernanceError)('archive', err);
+        }
+    }
+}
+exports.RestGovernanceEngine = RestGovernanceEngine;

package/dist/errors.d.ts

@@ -0,0 +1,78 @@
+/**
+ * A flat error hierarchy with `isX()` guards, so callers can branch without `instanceof`
+ * surviving across bundles or duplicated copies of this package.
+ */
+import type { GovernanceDecision, Metrics } from './types';
+/**
+ * Thrown only where there is no return path for a decision - inside a wrapped client method,
+ * which must hand back the vendor's own response type or nothing at all. Everywhere else a
+ * denial is a returned `GovernanceDecision`.
+ */
+export declare class AccessDeniedError extends Error {
+    readonly decision: GovernanceDecision;
+    constructor(decision: GovernanceDecision);
+}
+/** Anything the engine could not complete: transport, timeout, 4xx/5xx, bad input. */
+export declare class EngineError extends Error {
+    readonly status?: number;
+    readonly operation: string;
+    /**
+     * What the server had already accepted when this failed.
+     *
+     * An ingest is up to two calls - the features, then the wallet - so a rejection on the second
+     * leaves the first one's spend sitting at Stigg. Reporting that turn as nothing landed would
+     * understate a bill the customer is going to see, which is the one direction a meter must not
+     * be wrong in.
+     */
+    readonly reported?: Metrics;
+    /**
+     * Whether what landed was a replay. Carried with `reported`, because counting those metrics
+     * again is the one thing a caller must not do with keys Stigg had already seen - and
+     * `undefined` means here what it means everywhere: the event API could not say.
+     */
+    readonly replayed?: boolean;
+    constructor(operation: string, message: string, options?: {
+        status?: number;
+        cause?: unknown;
+        reported?: Metrics;
+        replayed?: boolean;
+    });
+}
+/** Governance is not enabled for this Stigg account. An account state, not a transient failure. */
+export declare class GovernanceNotEnabledError extends Error {
+    constructor(detail?: string);
+}
+/** Returns the decision when `err` is a governance denial - the one-liner for a binding catch. */
+export declare function isAccessDenied(err: unknown): GovernanceDecision | undefined;
+export declare const isEngineError: (err: unknown) => err is EngineError;
+export declare const isGovernanceNotEnabled: (err: unknown) => err is GovernanceNotEnabledError;
+/**
+ * True when Stigg refused a usage report because the feature is backed by a raw-events meter.
+ * Ingest forks by meter type, and this error is the definitive signal for which fork to take -
+ * `meterType` alone does not say (a raw-events feature can report `INCREMENTAL`).
+ */
+export declare function isMeterMismatchError(err: unknown): boolean;
+/** Whatever a client threw, as the seam's own error - keeping the status where there was one. */
+export declare function asEngineError(operation: string, err: unknown, partial?: {
+    reported?: Metrics;
+    replayed?: boolean;
+}): EngineError;
+/**
+ * True when a failure looks like "this transport is not answering" rather than "Stigg refused".
+ *
+ * The distinction decides whether another transport is worth trying: a 404 on the GraphQL
+ * endpoint or a refused connection says nothing about the request, while a 400 or a 403 says the
+ * request itself is wrong and would be wrong on any transport. Deliberately narrow - demoting on
+ * a business error would hide a real problem behind a silent re-route.
+ */
+export declare function isTransportFailure(err: unknown): boolean;
+/**
+ * The seam's error for an operation that only governance can serve.
+ *
+ * Entities and assignments exist nowhere else, so a 403 on one of them is the account saying the
+ * feature is off - a state the caller can act on - rather than a call that failed. Every other
+ * failure is an ordinary engine error.
+ */
+export declare function asGovernanceError(operation: string, err: unknown): Error;
+/** Recognizes the account-state 403 in whatever shape the transport surfaced it. */
+export declare function looksLikeGovernanceNotEnabled(err: unknown): boolean;