@usearete/automations 0.0.0-stage → 0.44.0

package/dist/cli.js

@@ -0,0 +1,4518 @@
+#!/usr/bin/env node
+import { mkdirSync, writeFileSync, readdirSync, readFileSync, existsSync, renameSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { deserialize, serialize } from 'node:v8';
+import { canonicalizeJson, canonicalJsonSha256, Arete, verifyWebhook, WebhookVerificationError, signWebhook, createProtocolClient } from '@usearete/sdk';
+import { base58, base64 } from '@scure/base';
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2';
+
+/**
+ * Versioned SQL migrations for the Postgres store. Every object lives in
+ * one schema (`arete_automation` by default); nothing outside it is
+ * created, altered or read. Times are milliseconds since the epoch.
+ */
+const ACTIVE_STEP_STATES$1 = "('running', 'signed', 'submitted', 'submitted_unknown')";
+const MIGRATIONS = [
+    {
+        version: 1,
+        name: 'initial',
+        sql: (s) => `
+CREATE TABLE ${s}.meta (
+  key text PRIMARY KEY,
+  value text NOT NULL
+);
+
+CREATE TABLE ${s}.deliveries (
+  id text PRIMARY KEY,
+  accepted_at bigint NOT NULL
+);
+
+CREATE TABLE ${s}.jobs (
+  id text PRIMARY KEY,
+  seq bigserial NOT NULL,
+  kind text NOT NULL CHECK (kind IN ('delivery', 'step')),
+  state text NOT NULL,
+  wallet text,
+  deployment_id text,
+  step text,
+  data jsonb NOT NULL,
+  outcome jsonb,
+  attempts integer NOT NULL DEFAULT 0,
+  not_before bigint NOT NULL,
+  lease_worker text,
+  lease_until bigint,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  CHECK (kind = 'delivery' OR wallet IS NOT NULL)
+);
+
+-- At most one active step job per wallet: the store's per-wallet serialization.
+CREATE UNIQUE INDEX jobs_one_active_step_per_wallet ON ${s}.jobs (wallet)
+  WHERE kind = 'step' AND state IN ${ACTIVE_STEP_STATES$1};
+
+CREATE INDEX jobs_claimable ON ${s}.jobs (not_before, seq)
+  WHERE state IN ('queued', 'running', 'signed', 'submitted', 'submitted_unknown');
+
+CREATE INDEX jobs_completed_steps ON ${s}.jobs (wallet, deployment_id, step, updated_at)
+  WHERE kind = 'step' AND state = 'completed';
+
+CREATE INDEX jobs_finished ON ${s}.jobs (updated_at)
+  WHERE state IN ('done', 'failed', 'completed', 'chain_failed', 'expired', 'skipped', 'rejected', 'refused');
+
+CREATE TABLE ${s}.consents (
+  wallet text NOT NULL,
+  deployment_id text NOT NULL,
+  -- '' for a grant that covers every instance.
+  instance_id text NOT NULL,
+  steps text[] NOT NULL,
+  expires_at bigint NOT NULL,
+  revoked_at bigint,
+  grant_json jsonb NOT NULL,
+  PRIMARY KEY (wallet, deployment_id, instance_id)
+);
+
+CREATE INDEX consents_active ON ${s}.consents (deployment_id, expires_at) WHERE revoked_at IS NULL;
+
+CREATE TABLE ${s}.consent_nonces (
+  nonce text PRIMARY KEY,
+  expires_at bigint NOT NULL,
+  used_at bigint
+);
+
+CREATE TABLE ${s}.ledger (
+  id bigserial PRIMARY KEY,
+  job_id text NOT NULL,
+  wallet text NOT NULL,
+  deployment_id text NOT NULL,
+  asset text NOT NULL,
+  amount numeric(39, 0) NOT NULL CHECK (amount >= 0),
+  recorded_at bigint NOT NULL,
+  voided_at bigint
+);
+
+CREATE INDEX ledger_window ON ${s}.ledger (wallet, deployment_id, asset, recorded_at) WHERE voided_at IS NULL;
+CREATE INDEX ledger_job ON ${s}.ledger (job_id);
+
+CREATE TABLE ${s}.source_state (
+  source text NOT NULL,
+  key text NOT NULL,
+  hash text NOT NULL,
+  value jsonb,
+  generation integer NOT NULL,
+  pending jsonb,
+  observed text,
+  version integer NOT NULL,
+  updated_at bigint NOT NULL,
+  PRIMARY KEY (source, key)
+);
+
+CREATE TABLE ${s}.source_cursors (
+  source text PRIMARY KEY,
+  cursor text NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE ${s}.source_leases (
+  source text PRIMARY KEY,
+  holder text NOT NULL,
+  until bigint NOT NULL
+);
+`,
+    },
+];
+MIGRATIONS[MIGRATIONS.length - 1].version;
+const DEFAULT_SCHEMA = 'arete_automation';
+/** A schema name: lower case letters, digits and underscores. */
+function validSchema(schema) {
+    if (!/^[a-z_][a-z0-9_]{0,62}$/.test(schema)) {
+        throw new TypeError(`'${schema}' is not a valid schema name (lower case letters, digits and underscores)`);
+    }
+    return schema;
+}
+/** A valid name as a quoted identifier, so reserved words (`user`, `select`) work too. */
+function quoted(name) {
+    return `"${name}"`;
+}
+/**
+ * The migrations as files for your own migration tool (Flyway, Prisma,
+ * Drizzle, Knex, Atlas): `0001_initial.sql` and so on. Each creates the
+ * schema if needed and records its version, as `migrate()` does.
+ */
+function migrationFiles(schema = DEFAULT_SCHEMA) {
+    const s = quoted(validSchema(schema));
+    return MIGRATIONS.map((migration) => ({
+        name: `${String(migration.version).padStart(4, '0')}_${migration.name}.sql`,
+        sql: [
+            `-- @usearete/automations migration ${migration.version}: ${migration.name}`,
+            `CREATE SCHEMA IF NOT EXISTS ${s};`,
+            `CREATE TABLE IF NOT EXISTS ${s}.schema_migrations (version integer PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now());`,
+            migration.sql(s).trim(),
+            `INSERT INTO ${s}.schema_migrations (version) VALUES (${migration.version});`,
+            '',
+        ].join('\n'),
+    }));
+}
+/**
+ * Grants for the runtime role: read and write rows, no DDL. Run as the role
+ * that owns the schema, after migrating.
+ */
+function runtimeRoleGrants(role, schema = DEFAULT_SCHEMA) {
+    const s = quoted(validSchema(schema));
+    if (!/^[a-z_][a-z0-9_]{0,62}$/.test(role))
+        throw new TypeError(`'${role}' is not a valid role name`);
+    role = quoted(role);
+    return [
+        `GRANT USAGE ON SCHEMA ${s} TO ${role};`,
+        `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ${s} TO ${role};`,
+        `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${s} TO ${role};`,
+        `REVOKE CREATE ON SCHEMA ${s} FROM ${role};`,
+        '',
+    ].join('\n');
+}
+
+const USAGE = `arete-automations: SQL for the @usearete/automations Postgres store, and the a4 dev runner
+
+Usage:
+  arete-automations migrations --out <dir> [--schema <name>]
+      Write the migrations as numbered SQL files for your own migration tool.
+  arete-automations grants --role <name> [--schema <name>]
+      Print the grants for a runtime role that reads and writes rows but cannot change the schema.
+  arete-automations dev
+      Run the project's automations against its dev environment. \`a4 dev up\` runs it for
+      [dev.automations] in arete.toml, with its settings in the environment.
+
+The schema defaults to ${DEFAULT_SCHEMA}.`;
+/** An option's value; throws when the option is given without one. */
+function option(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (value === undefined || value.startsWith('--'))
+        throw new Error(`${name} needs a value`);
+    return value;
+}
+/** Run the CLI; returns the exit code. */
+function main(args, out = console) {
+    const [command] = args;
+    try {
+        const schema = option(args, '--schema') ?? DEFAULT_SCHEMA;
+        if (command === 'migrations') {
+            const dir = option(args, '--out');
+            if (!dir)
+                throw new Error('migrations needs --out <dir>');
+            mkdirSync(dir, { recursive: true });
+            for (const file of migrationFiles(schema)) {
+                writeFileSync(join(dir, file.name), file.sql);
+                out.log(join(dir, file.name));
+            }
+            return 0;
+        }
+        if (command === 'grants') {
+            const role = option(args, '--role');
+            if (!role)
+                throw new Error('grants needs --role <name>');
+            out.log(runtimeRoleGrants(role, schema).trimEnd());
+            return 0;
+        }
+        out.error(USAGE);
+        return command === undefined || command === '--help' || command === '-h' ? 0 : 2;
+    }
+    catch (error) {
+        out.error(`arete-automations: ${error.message}`);
+        return 1;
+    }
+}
+/** `arete-automations dev`: run until SIGINT or SIGTERM. */
+async function dev(out = console) {
+    const { configFromEnv, runDev } = await Promise.resolve().then(function () { return runner; });
+    let runner$1;
+    try {
+        runner$1 = await runDev(configFromEnv(process.env), (line) => out.log(line));
+    }
+    catch (error) {
+        out.error(`arete-automations: ${error.message}`);
+        return 1;
+    }
+    await new Promise((done) => {
+        process.once('SIGINT', done);
+        process.once('SIGTERM', done);
+    });
+    await runner$1.stop();
+    return 0;
+}
+
+if (process.argv[2] === 'dev') {
+    dev().then((code) => {
+        process.exit(code);
+    });
+}
+else {
+    process.exitCode = main(process.argv.slice(2));
+}
+
+function encodeBase58(bytes) {
+    return base58.encode(bytes);
+}
+/** The bytes of a base58 string, or `null` when it is not base58. */
+function decodeBase58(text) {
+    try {
+        return base58.decode(text);
+    }
+    catch {
+        return null;
+    }
+}
+function encodeBase64(bytes) {
+    return base64.encode(bytes);
+}
+/** The bytes of a padded base64 string, or `null` when it is not base64. */
+function decodeBase64(text) {
+    try {
+        return base64.decode(text);
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether `value` is a base58 public key (32 bytes). */
+function isPubkey(value) {
+    return decodeBase58(value)?.length === 32;
+}
+/** A JSON object's field; `undefined` when `value` is not an object. */
+function field(value, key) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return undefined;
+    }
+    return value[key];
+}
+/** A JSON value as a non-negative integer, as serde's `as_u64` reads it. */
+function asU64(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : undefined;
+}
+function asString(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function isObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+const LAMPORTS_PER_SOL = 1000000000n;
+/** Lamports as a decimal SOL string. */
+function lamportsToSol(lamports) {
+    const sign = lamports < 0n ? '-' : '';
+    const abs = lamports < 0n ? -lamports : lamports;
+    const whole = abs / LAMPORTS_PER_SOL;
+    const fraction = abs % LAMPORTS_PER_SOL;
+    if (fraction === 0n)
+        return `${sign}${whole}`;
+    return `${sign}${whole}.${fraction.toString().padStart(9, '0').replace(/0+$/, '')}`;
+}
+/**
+ * A JavaScript number in plain decimal notation, with the digits of its
+ * shortest round-trip form (what `String(value)` uses, without an
+ * exponent).
+ */
+function plainDecimal(value) {
+    const text = String(value);
+    const match = /^(-?)(\d+)(?:\.(\d+))?e([+-]\d+)$/.exec(text);
+    if (!match)
+        return text;
+    const [, sign, whole, fraction = '', exponentText] = match;
+    const digits = `${whole}${fraction}`;
+    const point = whole.length + Number(exponentText);
+    if (point <= 0)
+        return `${sign}0.${'0'.repeat(-point)}${digits}`;
+    if (point >= digits.length)
+        return `${sign}${digits}${'0'.repeat(point - digits.length)}`;
+    return `${sign}${digits.slice(0, point)}.${digits.slice(point)}`;
+}
+
+/**
+ * Instructions that hand control of the signer's funds to someone else
+ * without moving a balance.
+ *
+ * The policy's caps measure balance changes, and some instructions change no
+ * balance yet give the funds away: a token delegation (`approve`), a new
+ * owner or authority (`setAuthority`, System `assign`), or lamports leaving
+ * an account the signer controls that is not the signer's own (a nonce or
+ * stake withdrawal). This module names those instructions in the System, SPL
+ * Token, Token-2022, upgradeable loader and stake programs when the signer
+ * takes part in them (signs, or is one of their accounts).
+ *
+ * Top-level instructions are read from the wire bytes. Inner (CPI)
+ * instructions are read from a simulation when the RPC returns them.
+ *
+ * A token account closed to an account other than the signer is not refused;
+ * its lamports count as SOL leaving the signer.
+ */
+/** Programs that own SPL token accounts. */
+const TOKEN_PROGRAMS = [
+    'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA',
+    'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb',
+];
+const SYSTEM_PROGRAM = '11111111111111111111111111111111';
+const UPGRADEABLE_LOADER = 'BPFLoaderUpgradeab1e11111111111111111111111';
+const STAKE_PROGRAM = 'Stake11111111111111111111111111111111111111';
+/** Wrapped SOL mints (SPL Token and Token-2022). */
+const NATIVE_MINTS = [
+    'So11111111111111111111111111111111111111112',
+    '9pan9bMn5HatX4EJdBwg9VgCa7Uz5HL8N1m5D3NdXejP',
+];
+/**
+ * Token instructions the signer may take part in. Everything else that
+ * involves the signer is refused, including Token-2022 extension
+ * instructions this list does not name.
+ */
+const TOKEN_ALLOWED = new Set([
+    'initializeMint',
+    'initializeMint2',
+    'initializeAccount',
+    'initializeAccount2',
+    'initializeAccount3',
+    'initializeMultisig',
+    'initializeMultisig2',
+    'initializeImmutableOwner',
+    'transfer',
+    'transferChecked',
+    'transferCheckedWithFee',
+    'mintTo',
+    'mintToChecked',
+    'burn',
+    'burnChecked',
+    'revoke',
+    'freezeAccount',
+    'thawAccount',
+    'syncNative',
+    'getAccountDataSize',
+    'amountToUiAmount',
+    'uiAmountToAmount',
+    'reallocate',
+    'createNativeMint',
+]);
+const SYSTEM_ALLOWED = new Set([
+    'createAccount',
+    'createAccountWithSeed',
+    'transfer',
+    'advanceNonce',
+    'initializeNonce',
+    'allocateWithSeed',
+    'upgradeNonce',
+]);
+const STAKE_ALLOWED = new Set([
+    'initialize',
+    'initializeChecked',
+    'delegate',
+    'split',
+    'deactivate',
+    'deactivateDelinquent',
+    'redelegate',
+    'getMinimumDelegation',
+]);
+function isTokenProgram(program) {
+    return TOKEN_PROGRAMS.includes(program);
+}
+function isNativeMint(mint) {
+    return NATIVE_MINTS.includes(mint);
+}
+const TOKEN_NAMES = {
+    0: 'initializeMint',
+    1: 'initializeAccount',
+    2: 'initializeMultisig',
+    3: 'transfer',
+    4: 'approve',
+    5: 'revoke',
+    6: 'setAuthority',
+    7: 'mintTo',
+    8: 'burn',
+    9: 'closeAccount',
+    10: 'freezeAccount',
+    11: 'thawAccount',
+    12: 'transferChecked',
+    13: 'approveChecked',
+    14: 'mintToChecked',
+    15: 'burnChecked',
+    16: 'initializeAccount2',
+    17: 'syncNative',
+    18: 'initializeAccount3',
+    19: 'initializeMultisig2',
+    20: 'initializeMint2',
+    21: 'getAccountDataSize',
+    22: 'initializeImmutableOwner',
+    23: 'amountToUiAmount',
+    24: 'uiAmountToAmount',
+    25: 'initializeMintCloseAuthority',
+    29: 'reallocate',
+    31: 'createNativeMint',
+    38: 'withdrawExcessLamports',
+};
+const SYSTEM_NAMES = [
+    'createAccount',
+    'assign',
+    'transfer',
+    'createAccountWithSeed',
+    'advanceNonce',
+    'withdrawFromNonce',
+    'initializeNonce',
+    'authorizeNonce',
+    'allocate',
+    'allocateWithSeed',
+    'assignWithSeed',
+    'transferWithSeed',
+    'upgradeNonce',
+];
+const STAKE_NAMES = [
+    'initialize',
+    'authorize',
+    'delegate',
+    'split',
+    'withdraw',
+    'deactivate',
+    'setLockup',
+    'merge',
+    'authorizeWithSeed',
+    'initializeChecked',
+    'authorizeChecked',
+    'authorizeCheckedWithSeed',
+    'setLockupChecked',
+    'getMinimumDelegation',
+    'deactivateDelinquent',
+    'redelegate',
+];
+function tokenName(data) {
+    const tag = data[0];
+    if (tag === undefined)
+        return 'emptyInstruction';
+    if (tag === 26 && data[1] === 1)
+        return 'transferCheckedWithFee';
+    return TOKEN_NAMES[tag] ?? `tokenInstruction${tag}`;
+}
+function u32Tag(data) {
+    if (data.length < 4)
+        return undefined;
+    return (data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24)) >>> 0;
+}
+function taggedName(data, names, fallback) {
+    const tag = u32Tag(data);
+    if (tag === undefined)
+        return 'emptyInstruction';
+    return names[tag] ?? `${fallback}${tag}`;
+}
+/** The instruction's name, for the programs this module checks. */
+function instructionName(program, data) {
+    if (isTokenProgram(program))
+        return tokenName(data);
+    if (program === SYSTEM_PROGRAM)
+        return taggedName(data, SYSTEM_NAMES, 'systemInstruction');
+    if (program === STAKE_PROGRAM)
+        return taggedName(data, STAKE_NAMES, 'stakeInstruction');
+    if (program === UPGRADEABLE_LOADER) {
+        const tag = u32Tag(data);
+        return tag === undefined ? 'emptyInstruction' : `upgradeableLoaderInstruction${tag}`;
+    }
+    return null;
+}
+/** Why the signer may not take part in `name` of `program`, or `null`. */
+function refusalReason(program, name) {
+    if (isTokenProgram(program)) {
+        switch (name) {
+            case 'approve':
+            case 'approveChecked':
+                return 'delegates tokens the signer controls';
+            case 'setAuthority':
+                return 'changes an authority the signer holds';
+            case 'closeAccount':
+                return null;
+            case 'withdrawExcessLamports':
+                return 'moves lamports out of an account the signer controls';
+            default:
+                return TOKEN_ALLOWED.has(name)
+                    ? null
+                    : "is a token instruction the signer's policy cannot check";
+        }
+    }
+    if (program === SYSTEM_PROGRAM) {
+        switch (name) {
+            case 'assign':
+            case 'assignWithSeed':
+                return 'changes the owner of an account the signer controls';
+            case 'allocate':
+                return "allocates data on the signer's account";
+            case 'authorizeNonce':
+                return 'changes a nonce authority the signer holds';
+            case 'withdrawFromNonce':
+            case 'transferWithSeed':
+                return 'moves lamports out of an account the signer controls';
+            default:
+                return SYSTEM_ALLOWED.has(name)
+                    ? null
+                    : "is a System instruction the signer's policy cannot check";
+        }
+    }
+    if (program === STAKE_PROGRAM) {
+        return STAKE_ALLOWED.has(name)
+            ? null
+            : 'changes the authority or withdraws from a stake account the signer controls';
+    }
+    if (program === UPGRADEABLE_LOADER) {
+        return 'changes a program or buffer the signer controls';
+    }
+    return null;
+}
+/** Check one instruction in which the signer takes part. */
+function checkOne(program, name, inner, closed, destinationIsSigner, out) {
+    if (isTokenProgram(program) && name === 'closeAccount') {
+        if (!destinationIsSigner)
+            out.closedToOthers.push(closed);
+        return;
+    }
+    const reason = refusalReason(program, name);
+    if (reason !== null) {
+        out.findings.push({ programId: program, instruction: name, inner, reason });
+    }
+}
+function emptyChecked() {
+    return { findings: [], closedToOthers: [] };
+}
+function mergeChecked(into, other) {
+    into.findings.push(...other.findings);
+    into.closedToOthers.push(...other.closedToOthers);
+}
+/**
+ * Check the top-level instructions of `decoded`. `lookupKeys` are the
+ * addresses its lookup tables load (writable entries, then read-only), where
+ * they were resolved.
+ */
+function checkTopLevel(decoded, signer, lookupKeys) {
+    const out = emptyChecked();
+    const signerIndex = decoded.staticKeys.slice(0, decoded.requiredSignatures).indexOf(signer);
+    // Not a signer of this transaction: no authority of its can be used.
+    if (signerIndex < 0)
+        return out;
+    const key = (index) => decoded.staticKeys[index] ?? lookupKeys[index - decoded.staticKeys.length] ?? null;
+    for (const instruction of decoded.instructions) {
+        const program = decoded.staticKeys[instruction.programIndex];
+        if (program === undefined)
+            continue;
+        const name = instructionName(program, instruction.data);
+        if (name === null)
+            continue;
+        if (!instruction.accounts.includes(signerIndex))
+            continue;
+        const first = instruction.accounts[0];
+        const closed = first === undefined ? null : key(first);
+        checkOne(program, name, false, closed, instruction.accounts[1] === signerIndex, out);
+    }
+    return out;
+}
+function mentions(value, signer) {
+    if (typeof value === 'string')
+        return value === signer;
+    if (Array.isArray(value))
+        return value.some((item) => mentions(item, signer));
+    if (isObject(value))
+        return Object.values(value).some((item) => mentions(item, signer));
+    return false;
+}
+/**
+ * Check the inner instructions a simulation returned (`innerInstructions` of
+ * `simulateTransaction`, in the RPC's parsed or partially decoded form).
+ * `accountKeys` resolves compiled instructions' indexes.
+ */
+function checkInner(inner, signer, accountKeys) {
+    const out = emptyChecked();
+    if (!Array.isArray(inner))
+        return out;
+    for (const group of inner) {
+        const instructions = field(group, 'instructions');
+        if (!Array.isArray(instructions))
+            continue;
+        for (const instruction of instructions) {
+            mergeChecked(out, checkInnerOne(instruction, signer, accountKeys));
+        }
+    }
+    return out;
+}
+function checkInnerOne(instruction, signer, accountKeys) {
+    const out = emptyChecked();
+    let program = asString(field(instruction, 'programId'));
+    if (program === undefined) {
+        const index = asU64(field(instruction, 'programIdIndex'));
+        program = index === undefined ? undefined : (accountKeys[index] ?? undefined);
+        if (program === undefined)
+            return out;
+    }
+    const parsed = field(instruction, 'parsed');
+    if (isObject(parsed)) {
+        const name = asString(parsed.type);
+        if (name === undefined)
+            return out;
+        const info = parsed.info;
+        if (instructionName(program, new Uint8Array()) === null || !mentions(info, signer))
+            return out;
+        const closed = asString(field(info, 'account')) ?? null;
+        checkOne(program, name, true, closed, field(info, 'destination') === signer, out);
+        return out;
+    }
+    const rawAccounts = field(instruction, 'accounts');
+    if (!Array.isArray(rawAccounts))
+        return out;
+    const accounts = rawAccounts.map((account) => {
+        if (typeof account === 'string')
+            return account;
+        if (typeof account === 'number') {
+            const index = asU64(account);
+            return index === undefined ? null : (accountKeys[index] ?? null);
+        }
+        return null;
+    });
+    const encoded = asString(field(instruction, 'data'));
+    const data = (encoded === undefined ? null : decodeBase58(encoded)) ?? new Uint8Array();
+    const name = instructionName(program, data);
+    if (name === null)
+        return out;
+    if (!accounts.includes(signer))
+        return out;
+    checkOne(program, name, true, accounts[0] ?? null, accounts[1] === signer, out);
+    return out;
+}
+
+/**
+ * What a signer may sign for a user: the static policy.
+ *
+ * The rules, their names and the refusal shape match the Arete MCP server's
+ * local signer, and both implementations run the shared vectors in
+ * `test-vectors/signer-policy/`. The caps hold per transaction, measured by
+ * simulating the exact prepared bytes. Wrapped SOL counts against
+ * `maxSolPerTransaction`, as do the lamports of a token account closed to
+ * someone else. Instructions that hand control of the signer's funds to
+ * someone else (token approvals, authority changes, System assignments) are
+ * always refused, and so is any transaction whose effect on the signer
+ * could not be simulated.
+ */
+/** Clusters a policy allows when it does not list any. */
+const DEFAULT_CLUSTERS = ['dev'];
+/**
+ * Every cluster a target can be: `dev` for a deployment in a dev environment
+ * (a fork of mainnet), `mainnet` for a published deployment.
+ */
+const KNOWN_CLUSTERS = ['dev', 'mainnet'];
+/**
+ * Names the MCP signer's earlier configs used, read the same way it reads
+ * them: `localnet` is `dev`; Arete runs on neither `devnet` nor `testnet`,
+ * so those are dropped.
+ */
+const LEGACY_CLUSTERS = {
+    localnet: 'dev',
+    devnet: null,
+    testnet: null,
+};
+/**
+ * Programs the transaction compiler adds around a step's own instructions
+ * (compute budget, memo, fee transfers, token accounts and wrapped SOL).
+ * They are always allowed; what they move is bounded by the SOL and token
+ * caps.
+ */
+const RUNTIME_PROGRAMS = [
+    'ComputeBudget111111111111111111111111111111',
+    'MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr',
+    'Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFMNo',
+    '11111111111111111111111111111111',
+    'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL',
+    'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA',
+    'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb',
+];
+const U64_MAX = (1n << 64n) - 1n;
+const U128_MAX = (1n << 128n) - 1n;
+class PolicyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PolicyError';
+    }
+}
+const POLICY_FIELDS = new Set([
+    'deployments',
+    'maxSolPerTransaction',
+    'programs',
+    'maxTokenAmounts',
+    'clusters',
+]);
+/** Parse SOL (a number or decimal string) into lamports. */
+function solToLamports(value) {
+    let text;
+    if (typeof value === 'string')
+        text = value.trim();
+    else if (typeof value === 'number' && Number.isFinite(value))
+        text = plainDecimal(value);
+    else
+        throw new PolicyError('maxSolPerTransaction must be a number of SOL');
+    const point = text.indexOf('.');
+    const whole = point < 0 ? text : text.slice(0, point);
+    const fraction = point < 0 ? '' : text.slice(point + 1);
+    if ((whole === '' && fraction === '') ||
+        !/^\d*$/.test(whole) ||
+        !/^\d*$/.test(fraction) ||
+        fraction.length > 9) {
+        throw new PolicyError('maxSolPerTransaction must be a non-negative number of SOL with at most 9 decimals');
+    }
+    const wholeValue = whole === '' ? 0n : BigInt(whole);
+    const lamports = wholeValue * 1000000000n + BigInt(fraction.padEnd(9, '0'));
+    if (wholeValue > U64_MAX || lamports > U64_MAX) {
+        throw new PolicyError('maxSolPerTransaction is too large');
+    }
+    return lamports;
+}
+function tokenAmount(value) {
+    let amount;
+    if (typeof value === 'bigint' && value >= 0n)
+        amount = value;
+    else if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0) {
+        amount = BigInt(value);
+    }
+    else if (typeof value === 'string' && /^\d+$/.test(value))
+        amount = BigInt(value);
+    if (amount === undefined || amount > U128_MAX) {
+        throw new PolicyError('maxTokenAmounts values must be non-negative integers in base units');
+    }
+    return amount;
+}
+function stringList(value, name) {
+    if (!Array.isArray(value) || !value.every((item) => typeof item === 'string')) {
+        throw new PolicyError(`policy.${name} must be a list of strings`);
+    }
+    return [...value];
+}
+/** Validate a policy. Throws {@link PolicyError} naming the field at fault. */
+function definePolicy(input) {
+    if (!isObject(input))
+        throw new PolicyError('a policy must be an object');
+    const unknown = Object.keys(input).filter((key) => !POLICY_FIELDS.has(key));
+    if (unknown.length > 0)
+        throw new PolicyError(`policy has unknown field '${unknown[0]}'`);
+    if (input.deployments === undefined)
+        throw new PolicyError('policy.deployments is required');
+    const deployments = stringList(input.deployments, 'deployments');
+    if (input.maxSolPerTransaction === undefined) {
+        throw new PolicyError('policy.maxSolPerTransaction is required');
+    }
+    if (deployments.length === 0) {
+        throw new PolicyError('policy.deployments must list at least one deployment id');
+    }
+    const maxLamportsPerTransaction = solToLamports(input.maxSolPerTransaction);
+    let programs = null;
+    if (input.programs !== undefined && input.programs !== null) {
+        programs = stringList(input.programs, 'programs');
+        const bad = programs.find((program) => !isPubkey(program));
+        if (bad !== undefined)
+            throw new PolicyError(`policy.programs: '${bad}' is not a program id`);
+    }
+    let maxTokenAmounts = null;
+    if (input.maxTokenAmounts !== undefined && input.maxTokenAmounts !== null) {
+        if (!isObject(input.maxTokenAmounts)) {
+            throw new PolicyError('policy.maxTokenAmounts must map mints to amounts');
+        }
+        maxTokenAmounts = new Map();
+        for (const mint of Object.keys(input.maxTokenAmounts).sort()) {
+            if (!isPubkey(mint)) {
+                throw new PolicyError(`policy.maxTokenAmounts: '${mint}' is not a mint address`);
+            }
+            maxTokenAmounts.set(mint, tokenAmount(input.maxTokenAmounts[mint]));
+        }
+    }
+    const clustersListed = input.clusters !== undefined && input.clusters !== null;
+    let clusters = [...DEFAULT_CLUSTERS];
+    if (clustersListed) {
+        clusters = [];
+        for (const listed of stringList(input.clusters, 'clusters')) {
+            let cluster;
+            if (KNOWN_CLUSTERS.includes(listed))
+                cluster = listed;
+            else if (Object.hasOwn(LEGACY_CLUSTERS, listed))
+                cluster = LEGACY_CLUSTERS[listed];
+            else
+                throw new PolicyError(`policy.clusters: '${listed}' is not one of ${KNOWN_CLUSTERS.join(', ')}`);
+            if (cluster !== null && !clusters.includes(cluster))
+                clusters.push(cluster);
+        }
+    }
+    return { deployments, maxLamportsPerTransaction, programs, maxTokenAmounts, clusters, clustersListed };
+}
+/** Whether the deployment and cluster are allowed, before preparing. `null` when they are. */
+function checkTarget(policy, deploymentId, cluster) {
+    if (!policy.deployments.includes(deploymentId)) {
+        return {
+            rule: 'deployments',
+            reason: `deployment ${deploymentId} is not in the signer's deployments allow-list`,
+        };
+    }
+    if (!policy.clusters.includes(cluster)) {
+        return {
+            rule: 'clusters',
+            reason: `the target cluster is ${cluster}, which the signer's clusters (${policy.clusters.join(', ')}) do not include${cluster === 'mainnet' ? '; mainnet must be listed explicitly' : ''}`,
+        };
+    }
+    return null;
+}
+function parseBigInt(value) {
+    if (typeof value !== 'string' || !/^-?\d+$/.test(value))
+        return null;
+    return BigInt(value);
+}
+/** How a JSON value prints, the way the reference implementation formats it in reasons. */
+function display(value) {
+    return value === undefined ? 'null' : JSON.stringify(value);
+}
+/**
+ * Check a prepared step against the policy: the intent's deployment, every
+ * transaction's programs, the instructions that would hand over control of
+ * the signer's funds, and the simulated SOL and token outflows of the
+ * signer, per transaction. `null` when it may be signed.
+ */
+function checkPrepared(policy, input) {
+    const { deploymentId, prepared, summary, simulates } = input;
+    const intentDeployment = asString(field(field(field(prepared, 'intent'), 'deployment'), 'deploymentId')) ??
+        deploymentId;
+    if (intentDeployment !== deploymentId || !policy.deployments.includes(intentDeployment)) {
+        return {
+            rule: 'deployments',
+            reason: `the prepared intent is for deployment ${intentDeployment}, which is not allowed`,
+        };
+    }
+    for (const transaction of summary.transactions) {
+        const index = display(transaction.index);
+        if (policy.programs !== null) {
+            for (const program of transaction.programs) {
+                const id = program.programId;
+                if (!RUNTIME_PROGRAMS.includes(id) && !policy.programs.includes(id)) {
+                    return {
+                        rule: 'programs',
+                        reason: `transaction ${index} invokes ${id}, which is not in the signer's programs allow-list`,
+                    };
+                }
+            }
+        }
+        const finding = transaction.unsafeInstructions[0];
+        if (finding !== undefined) {
+            return {
+                rule: 'authority',
+                reason: `transaction ${index} has ${finding.inner ? 'an inner' : 'a'} \`${finding.instruction}\` instruction of ${finding.programId} that ${finding.reason}; the signer never signs those`,
+            };
+        }
+        const effect = transaction.signerEffect;
+        if (effect.known !== true) {
+            let why = '';
+            if ((effect.omittedAccounts ?? 0) > 0) {
+                why = ' (it writes more accounts than the simulation reports on)';
+            }
+            else if ((effect.closedAccountLamportsOut ?? null) === null &&
+                typeof effect.solLamports === 'string') {
+                why = ' (it closes a token account the simulation could not measure)';
+            }
+            else if (!simulates) {
+                why = ' (no simulator is configured)';
+            }
+            return {
+                rule: 'maxSolPerTransaction',
+                reason: `the signer's balance change in transaction ${index} could not be simulated${why}, so the caps cannot be checked`,
+            };
+        }
+        const lamports = parseBigInt(effect.solLamports) ?? -(1n << 126n);
+        const tokens = effect.tokens ?? [];
+        // Wrapped SOL is SOL: its delta joins the lamports, so wrapping is not
+        // an outflow and spending wrapped SOL is.
+        const wrapped = tokens
+            .filter((token) => isNativeMint(token.mint))
+            .reduce((sum, token) => sum + (parseBigInt(token.amount) ?? 0n), 0n);
+        const closed = parseBigInt(effect.closedAccountLamportsOut) ?? 0n;
+        let outflow = closed - lamports - wrapped;
+        if (outflow < 0n)
+            outflow = 0n;
+        if (outflow > policy.maxLamportsPerTransaction) {
+            return {
+                rule: 'maxSolPerTransaction',
+                reason: `transaction ${index} moves ${lamportsToSol(outflow)} SOL out of the signer (wrapped SOL and closed token accounts included), over the ${lamportsToSol(policy.maxLamportsPerTransaction)} SOL cap`,
+            };
+        }
+        for (const token of tokens) {
+            if (isNativeMint(token.mint))
+                continue;
+            const amount = parseBigInt(token.amount) ?? 0n;
+            if (amount >= 0n)
+                continue;
+            const tokenOutflow = -amount;
+            const mint = token.mint;
+            if (policy.maxTokenAmounts === null) {
+                return {
+                    rule: 'maxTokenAmounts',
+                    reason: `transaction ${index} moves ${tokenOutflow} base units of ${mint} out of the signer, and the policy sets no maxTokenAmounts, so no token may leave`,
+                };
+            }
+            const cap = policy.maxTokenAmounts.get(mint);
+            if (cap === undefined) {
+                return {
+                    rule: 'maxTokenAmounts',
+                    reason: `transaction ${index} moves ${tokenOutflow} base units of ${mint} out of the signer, and that mint has no cap`,
+                };
+            }
+            if (tokenOutflow > cap) {
+                return {
+                    rule: 'maxTokenAmounts',
+                    reason: `transaction ${index} moves ${tokenOutflow} base units of ${mint} out of the signer, over the cap of ${cap}`,
+                };
+            }
+        }
+    }
+    return null;
+}
+
+/** A {@link Simulator} over a JSON-RPC URL. */
+function rpcSimulator(url, options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function') {
+        throw new TypeError('rpcSimulator needs a fetch implementation');
+    }
+    const timeoutMs = options.timeoutMs ?? 15_000;
+    return {
+        async call(method, params) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                let response;
+                try {
+                    response = await fetchImpl(url, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json', ...options.headers },
+                        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
+                        signal: controller.signal,
+                    });
+                }
+                catch {
+                    throw new Error(controller.signal.aborted
+                        ? `The RPC did not answer ${method} within ${timeoutMs}ms`
+                        : `The RPC is unreachable for ${method}`);
+                }
+                let body;
+                try {
+                    body = await response.json();
+                }
+                catch {
+                    throw new Error(controller.signal.aborted
+                        ? `The RPC did not answer ${method} within ${timeoutMs}ms`
+                        : `The RPC answered ${method} with invalid JSON`);
+                }
+                const record = (body ?? {});
+                if (record.error !== undefined && record.error !== null) {
+                    const message = typeof record.error.message === 'string' ? record.error.message : 'unknown error';
+                    throw new Error(`${method} failed: ${message}`);
+                }
+                return record.result ?? null;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+
+const UNITS = { ms: 1, s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+function durationMs(duration) {
+    if (typeof duration === 'number') {
+        if (!Number.isFinite(duration) || duration < 0)
+            throw new RangeError(`invalid duration ${duration}`);
+        return duration;
+    }
+    const match = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/.exec(duration);
+    if (!match)
+        throw new RangeError(`invalid duration '${duration}'; use for example 30s, 10m, 24h or 7d`);
+    return Number(match[1]) * UNITS[match[2]];
+}
+const systemClock = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
+
+/**
+ * Consent: what a user signs to let automations run steps for their wallet.
+ *
+ * The proof is a human-readable, domain-bound message in the style of
+ * Sign-In-With-Solana. It is built from the grant's fields, so the backend
+ * rebuilds it from the fields it is given and checks the wallet's signature
+ * over that, rather than parsing a message. Raising a limit or changing a
+ * setting needs a new signature; revoking does not.
+ *
+ * The signature is an accountability and anti-bug record. It does not
+ * protect against a compromised backend; the wallet provider's policy and
+ * the protocol's on-chain rules do.
+ */
+/** The asset key for SOL (wrapped SOL included), in lamports. */
+const SOL = 'SOL';
+const CONSENT_PROOF_VERSION = 'arete.automation-consent/v1';
+class ConsentError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ConsentError';
+        this.code = code;
+    }
+}
+function singleLine(name, value) {
+    if (typeof value !== 'string' || value.length === 0 || /[\r\n]/.test(value)) {
+        throw new ConsentError('invalid_fields', `${name} must be a non-empty single-line string`);
+    }
+    return value;
+}
+function amountText(name, value) {
+    let amount;
+    if (typeof value === 'bigint' && value >= 0n)
+        amount = value;
+    else if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)
+        amount = BigInt(value);
+    else if (typeof value === 'string' && /^\d+$/.test(value))
+        amount = BigInt(value);
+    if (amount === undefined)
+        throw new ConsentError('invalid_fields', `${name} must be a non-negative integer`);
+    return amount.toString();
+}
+function asset(name, key) {
+    if (key !== SOL && !isPubkey(key)) {
+        throw new ConsentError('invalid_fields', `${name}: '${key}' is neither SOL nor a mint address`);
+    }
+    // Outflows count wrapped SOL as SOL, so a limit keyed by the native mint
+    // would be shown to the user and never applied.
+    if (isNativeMint(key)) {
+        throw new ConsentError('invalid_fields', `${name}: wrapped SOL counts as SOL; set the limit on SOL instead of ${key}`);
+    }
+    return key;
+}
+function sortedRecord(entries) {
+    return Object.fromEntries(entries.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)));
+}
+/** Validate and normalize consent fields. Throws {@link ConsentError}. */
+function normalizeConsent(fields) {
+    const wallet = singleLine('wallet', fields.wallet);
+    if (!isPubkey(wallet))
+        throw new ConsentError('invalid_fields', 'wallet must be a public key');
+    const deploymentId = singleLine('deploymentId', fields.deploymentId);
+    const instanceId = fields.instanceId === undefined || fields.instanceId === null ? null : singleLine('instanceId', fields.instanceId);
+    if (!Array.isArray(fields.steps) || fields.steps.length === 0) {
+        throw new ConsentError('invalid_fields', 'steps must list at least one step');
+    }
+    const steps = [...new Set(fields.steps.map((step, index) => singleLine(`steps[${index}]`, step)))].sort();
+    if (steps.some((step) => /[,\s]/.test(step))) {
+        throw new ConsentError('invalid_fields', 'step names cannot contain commas or spaces');
+    }
+    const perExecution = sortedRecord(Object.entries(fields.limits?.perExecution ?? {}).map(([key, value]) => [
+        asset('limits.perExecution', key),
+        amountText(`limits.perExecution.${key}`, value),
+    ]));
+    const perWindow = sortedRecord(Object.entries(fields.limits?.perWindow ?? {}).map(([key, value]) => {
+        const windowMs = durationMs(value.window);
+        if (windowMs <= 0 || !Number.isSafeInteger(windowMs)) {
+            throw new ConsentError('invalid_fields', `limits.perWindow.${key}.window must be a positive duration`);
+        }
+        return [asset('limits.perWindow', key), { amount: amountText(`limits.perWindow.${key}.amount`, value.amount), windowMs }];
+    }));
+    // A deep snapshot: the grant stores exactly what the message states, even
+    // if the caller changes its objects while the grant is verified.
+    let params;
+    try {
+        params = JSON.parse(canonicalizeJson(fields.params ?? {}));
+    }
+    catch (error) {
+        throw new ConsentError('invalid_fields', `params must be JSON: ${error.message}`);
+    }
+    const expiresAt = fields.expiresAt instanceof Date ? fields.expiresAt.getTime() : fields.expiresAt;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt <= 0) {
+        throw new ConsentError('invalid_fields', 'expiresAt must be a date');
+    }
+    return { wallet, deploymentId, instanceId, steps, limits: { perExecution, perWindow }, params, expiresAt };
+}
+/** A window as the message shows it: the largest whole unit. */
+function windowText(windowMs) {
+    for (const [unit, size] of [
+        ['d', 86_400_000],
+        ['h', 3_600_000],
+        ['m', 60_000],
+        ['s', 1000],
+    ]) {
+        if (windowMs % size === 0)
+            return `${windowMs / size}${unit}`;
+    }
+    return `${windowMs}ms`;
+}
+function amountLine(key, amount) {
+    return key === SOL ? `${amount} lamports of SOL` : `${amount} base units of ${key}`;
+}
+/**
+ * The message a wallet signs to grant consent. Lines are joined by `\n`:
+ *
+ * ```text
+ * <domain> asks to run protocol steps for your wallet without asking each time:
+ * <wallet>
+ *
+ * Deployment: <deployment id>
+ * Instance: <instance id, or "any">
+ * Steps: <steps, sorted, comma-separated>
+ * Per run: <amount> lamports of SOL | <amount> base units of <mint>   (one line per asset, sorted)
+ * Per <window>: <amount> ...                                          (one line per asset, sorted)
+ * Setting <key as a JSON string>: <RFC 8785 JSON of the value>       (one line per key, sorted)
+ * Expires At: <ISO 8601 UTC>
+ *
+ * Nothing else may leave your wallet through these steps. You can revoke this at any time without signing.
+ *
+ * Version: arete.automation-consent/v1
+ * Nonce: <nonce>
+ * Issued At: <ISO 8601 UTC>
+ * ```
+ *
+ * Without per-run limits the message says that nothing may leave the wallet.
+ */
+function consentMessage(domain, consent, nonce, issuedAt) {
+    if (!/^[A-Za-z0-9.-]+(:\d+)?$/.test(domain)) {
+        throw new ConsentError('no_domain', `'${domain}' is not a host name`);
+    }
+    if (!/^[1-9A-HJ-NP-Za-km-z]{16,64}$/.test(nonce)) {
+        throw new ConsentError('invalid_fields', 'the nonce must be 16 to 64 base58 characters');
+    }
+    const limits = consent.limits;
+    const perRun = Object.entries(limits.perExecution);
+    const lines = [
+        `${domain} asks to run protocol steps for your wallet without asking each time:`,
+        consent.wallet,
+        '',
+        `Deployment: ${consent.deploymentId}`,
+        `Instance: ${consent.instanceId ?? 'any'}`,
+        `Steps: ${consent.steps.join(', ')}`,
+        ...(perRun.length === 0
+            ? ['Per run: nothing may leave your wallet']
+            : perRun.map(([key, amount]) => `Per run: ${amountLine(key, amount)}`)),
+        ...Object.entries(limits.perWindow).map(([key, { amount, windowMs }]) => `Per ${windowText(windowMs)}: ${amountLine(key, amount)}`),
+        ...Object.keys(consent.params)
+            .sort()
+            // Keys are JSON strings, so no key can end its line and forge another.
+            .map((key) => `Setting ${JSON.stringify(key)}: ${canonicalizeJson(consent.params[key])}`),
+        `Expires At: ${new Date(consent.expiresAt).toISOString()}`,
+        '',
+        'Nothing else may leave your wallet through these steps. You can revoke this at any time without signing.',
+        '',
+        `Version: ${CONSENT_PROOF_VERSION}`,
+        `Nonce: ${nonce}`,
+        `Issued At: ${new Date(issuedAt).toISOString()}`,
+    ];
+    return lines.join('\n');
+}
+function parse(value) {
+    return typeof value === 'string' && /^-?\d+$/.test(value) ? BigInt(value) : null;
+}
+/**
+ * What a prepared step moves out of the wallet, per asset, summed over its
+ * transactions: SOL as the policy measures it (wrapped SOL and token
+ * accounts closed to someone else included), and every mint that leaves.
+ * The summary must be complete; the policy refuses one that is not.
+ */
+function stepOutflows(summary) {
+    const out = new Map();
+    for (const { amounts } of transactionOutflows(summary)) {
+        for (const [asset, amount] of amounts)
+            out.set(asset, (out.get(asset) ?? 0n) + amount);
+    }
+    return out;
+}
+/** {@link stepOutflows}, per transaction, so a partly landed intent can be accounted exactly. */
+function transactionOutflows(summary) {
+    return summary.transactions.map((transaction) => {
+        const out = new Map();
+        const add = (key, amount) => {
+            if (amount > 0n)
+                out.set(key, (out.get(key) ?? 0n) + amount);
+        };
+        const effect = transaction.signerEffect;
+        const tokens = effect.tokens ?? [];
+        const lamports = parse(effect.solLamports) ?? 0n;
+        const wrapped = tokens
+            .filter((token) => isNativeMint(token.mint))
+            .reduce((sum, token) => sum + (parse(token.amount) ?? 0n), 0n);
+        const closed = parse(effect.closedAccountLamportsOut) ?? 0n;
+        add(SOL, closed - lamports - wrapped);
+        for (const token of tokens) {
+            if (!isNativeMint(token.mint))
+                add(token.mint, -(parse(token.amount) ?? 0n));
+        }
+        return { index: transaction.index, amounts: out };
+    });
+}
+
+class TransactionDecodeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TransactionDecodeError';
+    }
+}
+/** The version byte of a v1 transaction, which leads its wire bytes. */
+const V1_PREFIX = 0x81;
+/** Configuration mask bits a v1 message may set; each adds one 4-byte value. */
+const V1_KNOWN_CONFIG_BITS = 0b11111;
+class Reader {
+    bytes;
+    at;
+    constructor(bytes, at = 0) {
+        this.bytes = bytes;
+        this.at = at;
+    }
+    compactU16() {
+        let value = 0;
+        for (let index = 0; index < 3; index++) {
+            const byte = this.bytes[this.at];
+            if (byte === undefined)
+                throw new TransactionDecodeError('truncated transaction');
+            this.at += 1;
+            value |= (byte & 0x7f) << (7 * index);
+            if ((byte & 0x80) === 0)
+                return value;
+        }
+        throw new TransactionDecodeError('invalid compact-u16 length');
+    }
+    take(length) {
+        if (this.at + length > this.bytes.length) {
+            throw new TransactionDecodeError('truncated transaction');
+        }
+        const slice = this.bytes.subarray(this.at, this.at + length);
+        this.at += length;
+        return slice;
+    }
+    byte() {
+        return this.take(1)[0];
+    }
+}
+function writableIndexes(keyCount, required, readonlySigned, readonlyUnsigned) {
+    if (required > keyCount || readonlySigned > required || readonlyUnsigned > keyCount - required) {
+        throw new TransactionDecodeError('invalid message header');
+    }
+    const out = [];
+    for (let index = 0; index < keyCount; index++) {
+        const writable = index < required ? index < required - readonlySigned : index < keyCount - readonlyUnsigned;
+        if (writable)
+            out.push(index);
+    }
+    return out;
+}
+/** Decode a legacy, v0 or v1 wire transaction. */
+function decodeTransaction(bytes) {
+    if (bytes[0] === V1_PREFIX)
+        return decodeV1(bytes);
+    const reader = new Reader(bytes);
+    const signatureCount = reader.compactU16();
+    const signatureOffset = reader.at;
+    const signatures = [];
+    for (let index = 0; index < signatureCount; index++) {
+        signatures.push(reader.take(64));
+    }
+    const messageStart = reader.at;
+    const first = bytes[reader.at];
+    if (first === undefined)
+        throw new TransactionDecodeError('truncated message');
+    let version = null;
+    if ((first & 0x80) !== 0) {
+        reader.at += 1;
+        if ((first & 0x7f) !== 0)
+            throw new TransactionDecodeError('unsupported transaction version');
+        version = 0;
+    }
+    const header = reader.take(3);
+    const [required, readonlySigned, readonlyUnsigned] = [header[0], header[1], header[2]];
+    const keyCount = reader.compactU16();
+    const staticKeys = [];
+    for (let index = 0; index < keyCount; index++) {
+        staticKeys.push(encodeBase58(reader.take(32)));
+    }
+    const writableStatic = writableIndexes(keyCount, required, readonlySigned, readonlyUnsigned);
+    reader.take(32); // recent blockhash
+    const instructionCount = reader.compactU16();
+    const instructionPrograms = [];
+    const instructions = [];
+    for (let index = 0; index < instructionCount; index++) {
+        const programIndex = reader.byte();
+        const accounts = reader.take(reader.compactU16());
+        const data = reader.take(reader.compactU16());
+        instructions.push({ programIndex, accounts: [...accounts], data: data.slice() });
+        const program = staticKeys[programIndex];
+        if (program === undefined) {
+            throw new TransactionDecodeError("an instruction's program is not a static key");
+        }
+        instructionPrograms.push(program);
+    }
+    const lookups = [];
+    if (version !== null) {
+        const count = reader.compactU16();
+        for (let index = 0; index < count; index++) {
+            const table = encodeBase58(reader.take(32));
+            const writable = [...reader.take(reader.compactU16())];
+            const readonly = [...reader.take(reader.compactU16())];
+            lookups.push({ table, writable, readonly });
+        }
+    }
+    return {
+        version,
+        signatures,
+        signatureOffset,
+        message: { start: messageStart, end: bytes.length },
+        requiredSignatures: required,
+        staticKeys,
+        writableStatic,
+        instructionPrograms,
+        instructions,
+        lookups,
+    };
+}
+/** A v1 transaction: the version byte and message, then one signature per required signer. */
+function decodeV1(bytes) {
+    const reader = new Reader(bytes, 1);
+    const header = reader.take(3);
+    const [required, readonlySigned, readonlyUnsigned] = [header[0], header[1], header[2]];
+    const maskBytes = reader.take(4);
+    const mask = (maskBytes[0] | (maskBytes[1] << 8) | (maskBytes[2] << 16) | (maskBytes[3] << 24)) >>> 0;
+    if ((mask & ~V1_KNOWN_CONFIG_BITS) >>> 0 !== 0) {
+        throw new TransactionDecodeError('unsupported v1 transaction configuration');
+    }
+    reader.take(32); // lifetime specifier
+    const instructionCount = reader.byte();
+    const keyCount = reader.byte();
+    const staticKeys = [];
+    for (let index = 0; index < keyCount; index++) {
+        staticKeys.push(encodeBase58(reader.take(32)));
+    }
+    reader.take(popcount(mask) * 4);
+    const headers = reader.take(instructionCount * 4).slice();
+    const instructionPrograms = [];
+    const instructions = [];
+    for (let offset = 0; offset < headers.length; offset += 4) {
+        const programIndex = headers[offset];
+        const accountCount = headers[offset + 1];
+        const dataLength = headers[offset + 2] | (headers[offset + 3] << 8);
+        const accounts = reader.take(accountCount);
+        const data = reader.take(dataLength);
+        instructions.push({ programIndex, accounts: [...accounts], data: data.slice() });
+        const program = staticKeys[programIndex];
+        if (program === undefined) {
+            throw new TransactionDecodeError("an instruction's program is not an address");
+        }
+        instructionPrograms.push(program);
+    }
+    const messageEnd = reader.at;
+    const signatures = [];
+    for (let index = 0; index < required; index++) {
+        signatures.push(reader.take(64));
+    }
+    if (reader.at !== bytes.length) {
+        throw new TransactionDecodeError('trailing bytes after the transaction');
+    }
+    return {
+        version: 1,
+        signatures,
+        signatureOffset: messageEnd,
+        message: { start: 0, end: messageEnd },
+        requiredSignatures: required,
+        staticKeys,
+        writableStatic: writableIndexes(keyCount, required, readonlySigned, readonlyUnsigned),
+        instructionPrograms,
+        instructions,
+        lookups: [],
+    };
+}
+function popcount(value) {
+    let count = 0;
+    for (let bits = value >>> 0; bits !== 0; bits >>>= 1)
+        count += bits & 1;
+    return count;
+}
+/** The required signers and whether each has signed. */
+function transactionSigners(decoded) {
+    return decoded.staticKeys
+        .slice(0, decoded.requiredSignatures)
+        .map((key, index) => [key, decoded.signatures[index]?.some((byte) => byte !== 0) ?? false]);
+}
+/** The distinct programs invoked, in first-use order. */
+function transactionPrograms(decoded) {
+    return [...new Set(decoded.instructionPrograms)];
+}
+function writableStaticKeys(decoded) {
+    return decoded.writableStatic.map((index) => decoded.staticKeys[index]);
+}
+
+/**
+ * What a prepared step's transactions do, read from the transactions
+ * themselves rather than from the labels a prepare returns:
+ *
+ * - the programs each transaction invokes;
+ * - the accounts it writes (static keys, plus address lookup table entries,
+ *   resolved when a simulator is available);
+ * - the signatures it carries and the ones still required;
+ * - with a simulator, the signer's SOL and token balance changes from a
+ *   simulation of the exact bytes, the simulation error and the tail of its
+ *   logs;
+ * - the instructions that would hand control of the signer's funds to
+ *   someone else (see `authority.ts`): read from the top-level instructions
+ *   always, and from the inner instructions when the simulation returns
+ *   them.
+ *
+ * Without a simulator the balance changes are reported as unavailable,
+ * never as zero.
+ */
+const LOOKUP_TABLE_HEADER = 56;
+const LOG_TAIL = 20;
+/** The most accounts one transaction's simulation reports on. */
+const MAX_SIMULATED_ACCOUNTS = 64;
+function readU64(bytes, offset) {
+    let value = 0n;
+    for (let index = 7; index >= 0; index--) {
+        value = (value << 8n) | BigInt(bytes[offset + index]);
+    }
+    return value;
+}
+// RPC lamports arrive as JSON numbers, so balances above 2^53 lamports lose
+// precision when parsed. No single account the policy measures holds that.
+function accountFacts(account) {
+    if (account === null || account === undefined)
+        return null;
+    const lamports = BigInt(asU64(field(account, 'lamports')) ?? 0);
+    const owner = asString(field(account, 'owner')) ?? '';
+    let token = null;
+    if (isTokenProgram(owner)) {
+        const data = field(account, 'data');
+        const encoded = Array.isArray(data) ? asString(data[0]) : undefined;
+        const bytes = encoded === undefined ? null : decodeBase64(encoded);
+        if (bytes !== null && bytes.length >= 72) {
+            token = {
+                mint: encodeBase58(bytes.subarray(0, 32)),
+                owner: encodeBase58(bytes.subarray(32, 64)),
+                amount: readU64(bytes, 64),
+            };
+        }
+    }
+    return { lamports, token };
+}
+/** The accounts at `addresses` and the highest slot the RPC read them at. */
+async function accountsAt(simulator, addresses) {
+    const accounts = [];
+    let slot = null;
+    for (let start = 0; start < addresses.length; start += 100) {
+        const chunk = addresses.slice(start, start + 100);
+        const result = await simulator.call('getMultipleAccounts', [
+            chunk,
+            { encoding: 'base64', commitment: 'confirmed' },
+        ]);
+        const values = field(result, 'value');
+        if (!Array.isArray(values))
+            throw new Error('getMultipleAccounts returned no accounts');
+        const read = asU64(field(field(result, 'context'), 'slot'));
+        if (read !== undefined)
+            slot = slot === null ? read : Math.max(slot, read);
+        accounts.push(...values);
+    }
+    return { accounts, slot };
+}
+function noLookups() {
+    return { writable: [], keys: [], unresolved: [] };
+}
+async function resolveLookups(simulator, decoded) {
+    const out = noLookups();
+    if (decoded.lookups.length === 0)
+        return out;
+    let accounts = [];
+    try {
+        accounts = (await accountsAt(simulator, decoded.lookups.map((lookup) => lookup.table))).accounts;
+    }
+    catch {
+        accounts = [];
+    }
+    const tableAddresses = decoded.lookups.map((_, index) => {
+        const data = field(accounts[index], 'data');
+        const encoded = Array.isArray(data) ? asString(data[0]) : undefined;
+        const bytes = encoded === undefined ? null : decodeBase64(encoded);
+        return bytes !== null && bytes.length >= LOOKUP_TABLE_HEADER
+            ? bytes.subarray(LOOKUP_TABLE_HEADER)
+            : null;
+    });
+    const entry = (table, position) => {
+        const addresses = tableAddresses[table];
+        if (!addresses)
+            return null;
+        const start = position * 32;
+        return start + 32 <= addresses.length
+            ? encodeBase58(addresses.subarray(start, start + 32))
+            : null;
+    };
+    decoded.lookups.forEach((lookup, index) => {
+        for (const position of lookup.writable) {
+            const key = entry(index, position);
+            if (key !== null)
+                out.writable.push(key);
+            else if (!out.unresolved.includes(lookup.table))
+                out.unresolved.push(lookup.table);
+            out.keys.push(key);
+        }
+    });
+    decoded.lookups.forEach((lookup, index) => {
+        for (const position of lookup.readonly)
+            out.keys.push(entry(index, position));
+    });
+    return out;
+}
+function effectKnown(effect) {
+    return (effect.solLamports !== null &&
+        effect.unresolved.length === 0 &&
+        effect.omittedAccounts === 0 &&
+        effect.closedLamportsOut !== null);
+}
+/**
+ * Simulate `transaction` (wire bytes) and measure its effect on `signer`.
+ *
+ * The pre-state is read with `getMultipleAccounts` and the simulation is
+ * asked not to run on an older slot (`minContextSlot`), but the two are
+ * separate reads: an account that changes in between skews the deltas.
+ */
+async function simulateSignerEffect(simulator, transaction, decoded, signer, lookups) {
+    const addresses = [];
+    for (const key of [signer, ...writableStaticKeys(decoded), ...lookups.writable]) {
+        if (!addresses.includes(key))
+            addresses.push(key);
+    }
+    const omittedAccounts = Math.max(0, addresses.length - MAX_SIMULATED_ACCOUNTS);
+    addresses.length = Math.min(addresses.length, MAX_SIMULATED_ACCOUNTS);
+    const accountKeys = [...decoded.staticKeys, ...lookups.keys];
+    const checked = checkTopLevel(decoded, signer, lookups.keys);
+    const { accounts: before, slot: preSlot } = await accountsAt(simulator, addresses);
+    const config = {
+        encoding: 'base64',
+        sigVerify: false,
+        replaceRecentBlockhash: true,
+        commitment: 'confirmed',
+        innerInstructions: true,
+        accounts: { encoding: 'base64', addresses },
+    };
+    if (preSlot !== null)
+        config.minContextSlot = preSlot;
+    const result = await simulator.call('simulateTransaction', [encodeBase64(transaction), config]);
+    const value = field(result, 'value');
+    const rawLogs = field(value, 'logs');
+    const logs = Array.isArray(rawLogs)
+        ? rawLogs.filter((line) => typeof line === 'string')
+        : [];
+    const logsTail = logs.slice(Math.max(0, logs.length - LOG_TAIL));
+    const err = field(value, 'err') ?? null;
+    const inner = field(value, 'innerInstructions');
+    const innerChecked = Array.isArray(inner);
+    mergeChecked(checked, checkInner(inner, signer, accountKeys));
+    const slots = [
+        preSlot,
+        asU64(field(field(result, 'context'), 'slot')) ?? null,
+    ];
+    const rawAfter = field(value, 'accounts');
+    const after = Array.isArray(rawAfter) ? rawAfter : [];
+    if (err !== null || after.length !== addresses.length) {
+        return {
+            solLamports: null,
+            tokens: new Map(),
+            closedLamportsOut: null,
+            err,
+            logsTail,
+            unresolved: lookups.unresolved,
+            omittedAccounts,
+            findings: checked.findings,
+            innerChecked,
+            slots,
+        };
+    }
+    let solLamports = null;
+    const tokens = new Map();
+    const signersSide = (facts) => facts?.token && facts.token.owner === signer ? facts.token : null;
+    for (const [index, address] of addresses.entries()) {
+        const pre = accountFacts(before[index]);
+        const post = accountFacts(after[index]);
+        if (address === signer) {
+            solLamports = (post?.lamports ?? 0n) - (pre?.lamports ?? 0n);
+        }
+        const preToken = signersSide(pre);
+        if (preToken)
+            tokens.set(preToken.mint, (tokens.get(preToken.mint) ?? 0n) - preToken.amount);
+        const postToken = signersSide(post);
+        if (postToken) {
+            tokens.set(postToken.mint, (tokens.get(postToken.mint) ?? 0n) + postToken.amount);
+        }
+    }
+    for (const [mint, delta] of tokens)
+        if (delta === 0n)
+            tokens.delete(mint);
+    let closedLamportsOut = 0n;
+    for (const closed of checked.closedToOthers) {
+        let lamports = null;
+        const index = closed === null ? -1 : addresses.indexOf(closed);
+        const facts = index < 0 ? null : accountFacts(before[index]);
+        if (facts) {
+            const wrapped = facts.token && isNativeMint(facts.token.mint) ? facts.token.amount : 0n;
+            lamports = facts.lamports > wrapped ? facts.lamports - wrapped : 0n;
+        }
+        closedLamportsOut =
+            closedLamportsOut !== null && lamports !== null ? closedLamportsOut + lamports : null;
+    }
+    return {
+        solLamports,
+        tokens,
+        closedLamportsOut,
+        err,
+        logsTail,
+        unresolved: lookups.unresolved,
+        omittedAccounts,
+        findings: checked.findings,
+        innerChecked,
+        slots,
+    };
+}
+// ---------------------------------------------------------------------------
+// Summary
+// ---------------------------------------------------------------------------
+/** The wire transactions of a prepare result, with their indexes. */
+function preparedTransactions(prepared) {
+    const transactions = field(prepared, 'transactions');
+    if (!Array.isArray(transactions))
+        throw new Error('the prepare returned no transactions');
+    return transactions.map((transaction, position) => {
+        const encoded = asString(field(transaction, 'transactionBase64'));
+        if (encoded === undefined)
+            throw new Error('a prepared transaction has no transactionBase64');
+        const bytes = decodeBase64(encoded);
+        if (bytes === null)
+            throw new Error('a prepared transaction is not base64');
+        return [asU64(field(transaction, 'index')) ?? position, bytes];
+    });
+}
+function entryFor(list, index, position) {
+    if (!Array.isArray(list))
+        return null;
+    const found = list.find((entry) => asU64(field(entry, 'index')) === index) ?? list[position];
+    return found === undefined ? null : found;
+}
+function sortedTokens(tokens) {
+    return [...tokens.keys()]
+        .sort()
+        .map((mint) => ({ mint, amount: tokens.get(mint).toString() }));
+}
+/**
+ * The summary of a prepared step for `signer` (the wallet that signs).
+ * `simulator` adds the simulated balance changes.
+ */
+async function summarizePrepared(prepared, signer, simulator) {
+    const transactions = preparedTransactions(prepared);
+    const entries = [];
+    const programsAll = [];
+    let solTotal = 0n;
+    const tokenTotals = new Map();
+    const simulationErrors = [];
+    const stillRequired = [];
+    for (const [position, [index, bytes]] of transactions.entries()) {
+        let decoded;
+        try {
+            decoded = decodeTransaction(bytes);
+        }
+        catch (error) {
+            throw new Error(`prepared transaction ${index} does not decode: ${error.message}`);
+        }
+        const anatomy = entryFor(field(prepared, 'anatomy'), index, position);
+        const serverSimulation = entryFor(field(prepared, 'simulation'), index, position);
+        const rawLabels = field(anatomy, 'instructions');
+        const labels = Array.isArray(rawLabels) ? rawLabels : [];
+        const programs = transactionPrograms(decoded).map((program) => {
+            if (!programsAll.includes(program))
+                programsAll.push(program);
+            const roles = new Set();
+            for (const label of labels) {
+                if (field(label, 'programId') !== program)
+                    continue;
+                const role = asString(field(label, 'role'));
+                if (role === undefined)
+                    continue;
+                const kind = asString(field(label, 'kind'));
+                roles.add(kind !== undefined && kind !== role ? `${role}:${kind}` : role);
+            }
+            return { programId: program, roles: [...roles].sort() };
+        });
+        const signers = transactionSigners(decoded);
+        const missing = signers.filter(([, signed]) => !signed).map(([key]) => key);
+        for (const key of missing)
+            if (!stillRequired.includes(key))
+                stillRequired.push(key);
+        // Resolve once for both the displayed write set and simulation. Even if
+        // simulation fails, the write set must not silently omit lookup keys.
+        const lookups = simulator ? await resolveLookups(simulator, decoded) : noLookups();
+        const accountsWritten = writableStaticKeys(decoded);
+        const unresolvedWrites = [];
+        let offset = 0;
+        for (const lookup of decoded.lookups) {
+            for (const addressIndex of lookup.writable) {
+                const key = lookups.keys[offset] ?? null;
+                if (key !== null)
+                    accountsWritten.push(key);
+                else
+                    unresolvedWrites.push({ table: lookup.table, addressIndex });
+                offset += 1;
+            }
+        }
+        const lookupWritable = decoded.lookups.reduce((sum, lookup) => sum + lookup.writable.length, 0);
+        const dependent = field(serverSimulation, 'simulated') === false;
+        let unsafeInstructions = checkTopLevel(decoded, signer, []).findings;
+        let signerEffect;
+        let simulation;
+        if (simulator) {
+            try {
+                const effect = await simulateSignerEffect(simulator, bytes, decoded, signer, lookups);
+                unsafeInstructions = effect.findings;
+                if (effect.err !== null) {
+                    simulationErrors.push({
+                        transaction: index,
+                        err: effect.err,
+                        dependsOnEarlierTransactions: dependent,
+                    });
+                }
+                solTotal =
+                    effect.solLamports !== null && solTotal !== null ? solTotal + effect.solLamports : null;
+                for (const [mint, delta] of effect.tokens) {
+                    tokenTotals.set(mint, (tokenTotals.get(mint) ?? 0n) + delta);
+                }
+                signerEffect = {
+                    solLamports: effect.solLamports?.toString() ?? null,
+                    sol: effect.solLamports === null ? null : lamportsToSol(effect.solLamports),
+                    tokens: sortedTokens(effect.tokens),
+                    closedAccountLamportsOut: effect.closedLamportsOut?.toString() ?? null,
+                    known: effectKnown(effect),
+                    unresolvedLookupTables: effect.unresolved,
+                    omittedAccounts: effect.omittedAccounts,
+                    innerInstructionsChecked: effect.innerChecked,
+                    preStateSlot: effect.slots[0],
+                    simulatedSlot: effect.slots[1],
+                };
+                if (effect.omittedAccounts > 0)
+                    solTotal = null;
+                simulation = { err: effect.err, logsTail: effect.logsTail };
+            }
+            catch (error) {
+                solTotal = null;
+                signerEffect = { known: false, error: error.message };
+            }
+        }
+        else {
+            solTotal = null;
+            signerEffect = { known: false };
+        }
+        entries.push({
+            index,
+            version: decoded.version === null ? 'legacy' : `v${decoded.version}`,
+            feePayer: decoded.staticKeys[0] ?? null,
+            programs,
+            accountsWritten,
+            accountsWrittenComplete: unresolvedWrites.length === 0,
+            unresolvedWritableAccounts: unresolvedWrites,
+            signatures: {
+                required: signers.map(([key]) => key),
+                present: signers.filter(([, signed]) => signed).map(([key]) => key),
+                missing,
+            },
+            serverSimulation,
+            ...(lookupWritable > 0
+                ? {
+                    lookupTables: decoded.lookups.map((lookup) => ({
+                        table: lookup.table,
+                        writableEntries: lookup.writable.length,
+                        readonlyEntries: lookup.readonly.length,
+                    })),
+                }
+                : {}),
+            signerEffect,
+            ...(simulation ? { simulation } : {}),
+            unsafeInstructions,
+        });
+    }
+    for (const [mint, delta] of tokenTotals)
+        if (delta === 0n)
+            tokenTotals.delete(mint);
+    const signerBalanceChanges = simulator
+        ? {
+            available: true,
+            complete: solTotal !== null && entries.every((entry) => entry.signerEffect.known),
+            solLamports: solTotal?.toString() ?? null,
+            sol: solTotal === null ? null : lamportsToSol(solTotal),
+            tokens: sortedTokens(tokenTotals),
+            note: 'Simulated one transaction at a time against current chain state; a transaction that depends on an earlier one may not simulate on its own.',
+        }
+        : {
+            available: false,
+            reason: "no RPC URL is configured to simulate the transactions, so the signer's balance changes are unknown",
+        };
+    return {
+        signer,
+        transactions: entries,
+        programsInvoked: programsAll,
+        signerBalanceChanges,
+        simulationErrors,
+        signaturesStillRequired: stillRequired,
+    };
+}
+
+/** What the API prepares by default, then the fallback. */
+const DEFAULT_TRANSACTION_FORMATS = ['v1', 'v0'];
+/**
+ * The first format in `preferred` (the deployment's order) that the signer
+ * supports, or `null` when they share none.
+ */
+function negotiateTransactionFormat(signerFormats, preferred = DEFAULT_TRANSACTION_FORMATS) {
+    return preferred.find((format) => signerFormats.includes(format)) ?? null;
+}
+
+/**
+ * Thrown by a signer that declines to sign, for example because the wallet
+ * provider's own policy refused the transaction. The job ends `refused`
+ * with this rule instead of being retried.
+ */
+const REFUSAL_BRAND = Symbol.for('@usearete/automations/SignerRefusal');
+class SignerRefusal extends Error {
+    rule;
+    /** Recognised across entry points: each bundle has its own copy of this class. */
+    [REFUSAL_BRAND] = true;
+    constructor(message, rule = 'provider_policy') {
+        super(message);
+        this.name = 'SignerRefusal';
+        this.rule = rule;
+    }
+}
+/**
+ * Whether `error` is a {@link SignerRefusal}, including one thrown by a
+ * signer from another entry point (`@usearete/automations/privy` is a
+ * separate bundle, so `instanceof` would miss it).
+ */
+function isSignerRefusal(error) {
+    return (error instanceof SignerRefusal ||
+        (typeof error === 'object' && error !== null && error[REFUSAL_BRAND] === true));
+}
+
+/**
+ * The exact-bytes checks around a delegated signer.
+ *
+ * Before signing, the prepared transactions must be the ones the intent
+ * committed to. After signing, every message must hash to the intent's
+ * `messageSha256`, every signature slot but the wallet's must be untouched,
+ * and the wallet's slot must hold the wallet's valid signature. A signer
+ * that adds a compute-budget instruction, re-encodes, or signs something
+ * else fails here, before anything is submitted.
+ */
+function messageSha256(bytes, decoded) {
+    return bytesToHex(sha256(bytes.subarray(decoded.message.start, decoded.message.end)));
+}
+function decoded(base64) {
+    const bytes = decodeBase64(base64);
+    if (bytes === null)
+        return null;
+    try {
+        return { bytes, decoded: decodeTransaction(bytes) };
+    }
+    catch {
+        return null;
+    }
+}
+function signerSlot(transaction, wallet) {
+    const required = Math.min(transaction.requiredSignatures, transaction.signatures.length);
+    return transaction.staticKeys.slice(0, required).indexOf(wallet);
+}
+function sameBytes(left, right) {
+    return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+/**
+ * Whether the prepared transactions are what `intent` committed to, in the
+ * format that was asked for, with `wallet` as a required signer of each.
+ * `null` when they are.
+ */
+function checkPreparedAgainstIntent(input) {
+    const { wallet, intent, transactions, format } = input;
+    if (intent.wallet !== wallet) {
+        return { rule: 'intent_mismatch', reason: `the intent is for wallet ${intent.wallet}, not ${wallet}` };
+    }
+    if (intent.transactionFormat !== format) {
+        return {
+            rule: 'transaction_format',
+            reason: `the intent was prepared as ${intent.transactionFormat}, not the negotiated ${format}`,
+        };
+    }
+    if (transactions.length !== intent.transactions.length) {
+        return {
+            rule: 'intent_mismatch',
+            reason: `the prepare returned ${transactions.length} transactions for an intent of ${intent.transactions.length}`,
+        };
+    }
+    for (const [position, transaction] of transactions.entries()) {
+        const committed = intent.transactions[position];
+        if (transaction.index !== committed.index) {
+            return {
+                rule: 'intent_mismatch',
+                reason: `prepared transaction ${position} has index ${transaction.index}, the intent's has ${committed.index}`,
+            };
+        }
+        const read = decoded(transaction.transactionBase64);
+        if (read === null) {
+            return { rule: 'intent_mismatch', reason: `prepared transaction ${committed.index} does not decode` };
+        }
+        if (messageSha256(read.bytes, read.decoded) !== committed.messageSha256) {
+            return {
+                rule: 'intent_mismatch',
+                reason: `prepared transaction ${committed.index} is not the message the intent committed to`,
+            };
+        }
+        if (read.decoded.version !== (format === 'v1' ? 1 : 0)) {
+            return {
+                rule: 'transaction_format',
+                reason: `prepared transaction ${committed.index} is not a ${format} transaction`,
+            };
+        }
+        if (signerSlot(read.decoded, wallet) < 0) {
+            return {
+                rule: 'intent_mismatch',
+                reason: `the wallet ${wallet} is not a required signer of prepared transaction ${committed.index}`,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Whether `signed` is `prepared` with only the wallet's signature slot
+ * filled, by the wallet. `null` when it is.
+ *
+ * `prepared` is the baseline: pass a copy the signer never had, because a
+ * signer that can change the objects it was given could change the
+ * baseline too.
+ */
+function checkSignedTransactions(input) {
+    const { wallet, intent, prepared, signed } = input;
+    if (signed.length !== prepared.length) {
+        return {
+            rule: 'signer_modified',
+            reason: `the signer returned ${signed.length} transactions for ${prepared.length}`,
+        };
+    }
+    const walletKey = decodeBase58(wallet);
+    for (const [position, base64] of signed.entries()) {
+        const committed = intent.transactions[position];
+        const index = committed.index;
+        const after = decoded(base64);
+        const before = decoded(prepared[position].transactionBase64);
+        if (after === null || before === null) {
+            return { rule: 'signer_modified', reason: `signed transaction ${index} does not decode` };
+        }
+        if (messageSha256(after.bytes, after.decoded) !== committed.messageSha256) {
+            return {
+                rule: 'signer_modified',
+                reason: `the signer changed the message of transaction ${index}; its hash no longer matches the intent`,
+            };
+        }
+        const slot = signerSlot(after.decoded, wallet);
+        if (slot < 0 || after.decoded.signatures.length !== before.decoded.signatures.length) {
+            return { rule: 'signer_modified', reason: `the signer changed the signers of transaction ${index}` };
+        }
+        for (const [other, signature] of after.decoded.signatures.entries()) {
+            if (other !== slot && !sameBytes(signature, before.decoded.signatures[other])) {
+                return {
+                    rule: 'signer_modified',
+                    reason: `the signer changed signature ${other} of transaction ${index}, which is not the wallet's`,
+                };
+            }
+        }
+        // Nothing but the wallet's 64 signature bytes may differ, so the same
+        // message and signatures under another encoding are refused too.
+        const at = after.decoded.signatureOffset + 64 * slot;
+        const beforeSlot = signerSlot(before.decoded, wallet);
+        if (after.bytes.length !== before.bytes.length ||
+            before.decoded.signatureOffset + 64 * beforeSlot !== at ||
+            !sameBytes(after.bytes.subarray(0, at), before.bytes.subarray(0, at)) ||
+            !sameBytes(after.bytes.subarray(at + 64), before.bytes.subarray(at + 64))) {
+            return {
+                rule: 'signer_modified',
+                reason: `the signer changed bytes of transaction ${index} outside the wallet's signature`,
+            };
+        }
+        const message = after.bytes.subarray(after.decoded.message.start, after.decoded.message.end);
+        const signature = after.decoded.signatures[slot];
+        let valid = false;
+        try {
+            valid = walletKey !== null && ed25519.verify(signature, message, walletKey);
+        }
+        catch {
+            valid = false;
+        }
+        if (!valid) {
+            return {
+                rule: 'signer_signature',
+                reason: `transaction ${index} does not carry a valid signature by ${wallet}`,
+            };
+        }
+    }
+    return null;
+}
+
+/**
+ * View sources: watch a live view and dispatch a trigger when a condition
+ * becomes true.
+ *
+ * Exactly-once comes from the store, not from ids derived from the view's
+ * data (list and state views carry no cursor or version). Each source key
+ * keeps its last stable value; a change is written by compare-and-set and,
+ * when `changed(previous, next)` holds, its delivery
+ * (`view:${source}:${key}:${generation}`) is accepted in the same step. So:
+ *
+ * - replicas watching one view produce one delivery per transition;
+ * - after a restart the first snapshot is compared with the stored value,
+ *   so a crossing during downtime fires once and nothing fires twice;
+ * - every transition has its own generation, so A → B → A → B fires three
+ *   times.
+ *
+ * A value that changed and changed back while no replica was watching is
+ * not seen: list and state views hold current state, not history.
+ *
+ * Replicas whose views lag each other can still disagree about the order of
+ * values: one stores B while another, behind, still sees A. Give the source
+ * `observedAt` (for example the slot a row was updated at) so an older
+ * observation never replaces a newer one, or run it on one replica
+ * (`exclusive`).
+ *
+ * A trigger means "go and look", not the truth: handlers read live state
+ * before returning steps, and every step is checked again before signing.
+ */
+/** The stable hash of a key no value has settled on yet. */
+const NO_VALUE = '';
+/**
+ * Compare a key's new value with its stored state and move it on by
+ * compare-and-set, accepting a delivery when the change is a trigger.
+ * Returns `pending` while `stableFor` has not elapsed; evaluate again then.
+ */
+async function evaluateSignal(store, clock, source, key, value, observed = null) {
+    const json = value === undefined ? null : value;
+    const hash = canonicalJsonSha256(json);
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+        const now = clock.now();
+        const state = await store.sources.get(source.name, key);
+        const stored = state?.observed === null || state?.observed === undefined ? null : BigInt(state.observed);
+        // A lagging reader must not move the key back to an older value.
+        if (observed !== null && stored !== null && observed < stored)
+            return 'stale';
+        const order = observed === null ? stored : stored === null || observed > stored ? observed : stored;
+        const expectedVersion = state?.version ?? null;
+        const write = (next, deliver) => store.sources.advance({
+            source: source.name,
+            key,
+            expectedVersion,
+            next: { ...next, observed: order === null ? null : order.toString() },
+            now,
+            ...(deliver ? { deliver } : {}),
+        });
+        if (state && state.hash === hash) {
+            if (state.pending === null)
+                return 'same';
+            // The value went back to the stable one before the new one held.
+            if (await write({ hash, value: state.value, pending: null }))
+                return 'same';
+            continue;
+        }
+        if (source.stableForMs > 0) {
+            const pending = state?.pending;
+            if (!pending || pending.hash !== hash) {
+                const stable = state ? { hash: state.hash, value: state.value } : { hash: NO_VALUE, value: null };
+                if (await write({ ...stable, pending: { hash, value: json, since: now } }))
+                    return 'pending';
+                continue;
+            }
+            if (now - pending.since < source.stableForMs)
+                return 'pending';
+        }
+        const previous = state && state.hash !== NO_VALUE ? state.value : undefined;
+        const fire = source.changed(previous, value);
+        const payload = { source: source.name, key, value, ...(previous !== undefined ? { previous } : {}) };
+        if (await write({ hash, value: json, pending: null }, fire ? { name: source.name, payload } : undefined)) {
+            return fire ? 'delivered' : 'changed';
+        }
+    }
+    return 'contended';
+}
+
+/**
+ * Automations as a definition: the handlers and view sources, apart from the
+ * client, signer, store and secrets that run them. The same definition runs
+ * under `a4 dev` (against the project's dev environment) and in production
+ * (`automations.use(definition)`), so moving from one to the other changes
+ * configuration only.
+ */
+/** Whether `value` is a definition, from this or another copy of the package. */
+function isAutomationsDefinition(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.kind === 'automations' &&
+        typeof value.setup === 'function' &&
+        typeof value.protocol === 'object');
+}
+/** Connects with the SDK's defaults: `ARETE_API_KEY` or the `a4` login. */
+const connectStack = (stack) => Arete.connect(stack);
+
+const ACTIVE_STEP_STATES = [
+    'running',
+    'signed',
+    'submitted',
+    'submitted_unknown',
+];
+const TERMINAL_STEP_STATES = [
+    'completed',
+    'chain_failed',
+    'expired',
+    'skipped',
+    'rejected',
+    'refused',
+    'failed',
+];
+const TERMINAL_DELIVERY_STATES = ['done', 'failed'];
+/**
+ * A step job's id: `step:${deliveryId}:${step}:${wallet}`, then
+ * `:${instance}` for a step on an instance, so one trigger can run the same
+ * step for one wallet on several instances. The `step:` namespace and the
+ * encoded components keep step job ids apart from delivery ids (which start
+ * `webhook:`, `stream:`, `dispatch:` or `view:`) and from each other.
+ */
+function stepJobId(deliveryId, request) {
+    const base = `step:${encodeURIComponent(deliveryId)}:${encodeURIComponent(request.step)}:${request.wallet}`;
+    return request.instance === undefined ? base : `${base}:${encodeURIComponent(request.instance)}`;
+}
+
+/** Thrown when another worker took the job over; the current run stops quietly. */
+class LostLease extends Error {
+}
+const ACTIVE_RECONCILE_CAP_MS = 5 * 60_000;
+function randomId() {
+    const crypto = globalThis.crypto;
+    return crypto?.randomUUID?.() ?? `worker-${Math.random().toString(36).slice(2)}-${Date.now().toString(36)}`;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Where a client's deployment runs: `dev` when `a4 dev` generated it, else `mainnet`. */
+function clientCluster(client) {
+    // Read structurally: SDKs before the field carry it untyped.
+    const deployment = client.definition?.deployment;
+    return deployment?.environment === 'dev' ? 'dev' : 'mainnet';
+}
+function createAutomations(options) {
+    const { client, signer, policy, simulator, store } = options;
+    const cluster = options.cluster ?? clientCluster(client);
+    const clock = options.clock ?? systemClock;
+    const worker = options.worker ?? randomId();
+    const leaseMs = durationMs(options.lease ?? 60_000);
+    const maxAttempts = options.maxAttempts ?? 5;
+    const trackForMs = durationMs(options.trackFor ?? 30_000);
+    const trackIntervalMs = durationMs(options.trackInterval ?? 2_000);
+    const reconcileMs = durationMs(options.reconcileInterval ?? 10_000);
+    const formats = options.transactionFormats ?? DEFAULT_TRANSACTION_FORMATS;
+    const handlers = new Map();
+    const proofTtlMs = durationMs(options.consent?.proofTtl ?? 600_000);
+    const report = (error, context) => {
+        try {
+            options.onError?.(error, context);
+        }
+        catch {
+            // A failing error hook must not stop the worker.
+        }
+    };
+    const backoff = (attempts) => Math.min(reconcileMs * 2 ** Math.max(0, attempts - 1), ACTIVE_RECONCILE_CAP_MS);
+    const leaseUntil = () => ({ until: clock.now() + leaseMs });
+    // -------------------------------------------------------------------------
+    // Accepting triggers
+    // -------------------------------------------------------------------------
+    // One store serves one deployment; claims and delivery ids are not scoped
+    // by deployment, so the store refuses a second one.
+    let binding = null;
+    const bound = () => {
+        binding ??= store.bindDeployment(client.deploymentId).catch((error) => {
+            binding = null;
+            throw error;
+        });
+        return binding;
+    };
+    const accept = async (delivery) => {
+        await bound();
+        return store.deliveries.accept({ ...delivery, receivedAt: clock.now() }, clock.now());
+    };
+    const acceptWebhook = async (body, headers, webhook) => {
+        let verified;
+        try {
+            verified = verifyWebhook(webhook.secret, body, headers, {
+                ...(webhook.toleranceSeconds !== undefined ? { toleranceSeconds: webhook.toleranceSeconds } : {}),
+                now: Math.floor(clock.now() / 1000),
+            });
+        }
+        catch (error) {
+            if (error instanceof WebhookVerificationError) {
+                const status = error.code === 'invalid-signature' || error.code === 'timestamp-out-of-tolerance' ? 401 : 400;
+                return { status, body: { error: error.code } };
+            }
+            throw error;
+        }
+        const payload = verified.payload;
+        if (!isRecord(payload) ||
+            typeof payload.event !== 'string' ||
+            typeof payload.instanceId !== 'string' ||
+            (typeof payload.id !== 'string' && typeof payload.id !== 'number')) {
+            return { status: 400, body: { error: 'invalid-payload' } };
+        }
+        if (payload.deploymentId !== client.deploymentId) {
+            return { status: 200, body: { accepted: false, ignored: 'other-deployment' } };
+        }
+        if (!handlers.has(payload.event)) {
+            return { status: 200, body: { accepted: false, ignored: 'no-handler' } };
+        }
+        const event = {
+            id: String(payload.id),
+            event: payload.event,
+            deploymentId: payload.deploymentId,
+            instanceId: payload.instanceId,
+            participantId: typeof payload.participantId === 'string' ? payload.participantId : null,
+            state: typeof payload.state === 'string' ? payload.state : null,
+            occurredAt: typeof payload.occurredAt === 'string' ? payload.occurredAt : '',
+            source: 'webhook',
+        };
+        // The id comes from the signed body: the delivery-id header is not covered
+        // by the signature, so a replay under a new header id would otherwise
+        // run again.
+        const id = `webhook:${encodeURIComponent(String(payload.deploymentId))}:${encodeURIComponent(String(payload.id))}`;
+        const accepted = await accept({ id, name: payload.event, source: 'webhook', payload: event });
+        return { status: 200, body: { accepted, duplicate: !accepted } };
+    };
+    // -------------------------------------------------------------------------
+    // Step jobs
+    // -------------------------------------------------------------------------
+    /**
+     * The ledger after a chain failure, per transaction: one that landed
+     * successfully keeps everything it moved; one that failed counts the fee
+     * it was charged (all its SOL when the fee cannot be read); one that never
+     * landed counts nothing.
+     */
+    const failedLedger = async (job, state) => {
+        const saved = job.progress.outflows;
+        if (!saved) {
+            // Signed before outflows were saved per transaction: if any transaction
+            // landed, keep every entry; otherwise keep the fees, or all the SOL.
+            if (state.transactions.some((transaction) => transaction.signature !== null && !transaction.error))
+                return {};
+            const fees = await chargedFees(state.transactions.map((transaction) => transaction.signature));
+            return fees === null
+                ? { void: true, keepAssets: [SOL] }
+                : {
+                    void: true,
+                    record: fees > 0n ? [{ wallet: job.request.wallet, deploymentId: job.deploymentId, asset: SOL, amount: fees.toString() }] : [],
+                };
+        }
+        const spent = new Map();
+        const add = (asset, amount) => {
+            if (amount > 0n)
+                spent.set(asset, (spent.get(asset) ?? 0n) + amount);
+        };
+        for (const transaction of state.transactions) {
+            const amounts = saved.find((entry) => entry.index === transaction.index)?.amounts ?? {};
+            if (transaction.signature === null)
+                continue;
+            if (!transaction.error) {
+                for (const [asset, amount] of Object.entries(amounts))
+                    add(asset, BigInt(amount));
+                continue;
+            }
+            const fee = await chargedFees([transaction.signature]);
+            add(SOL, fee ?? BigInt(amounts[SOL] ?? '0'));
+        }
+        // The rebuilt entries keep the signing time, so a late failure check
+        // cannot restart the window for spending that is already ageing out.
+        const recordedAt = job.progress.signedAt;
+        return {
+            void: true,
+            record: [...spent].map(([asset, amount]) => ({
+                wallet: job.request.wallet,
+                deploymentId: job.deploymentId,
+                asset,
+                amount: amount.toString(),
+                ...(recordedAt !== undefined ? { recordedAt } : {}),
+            })),
+        };
+    };
+    /** The fees the landed transactions paid, from the chain; `null` when one cannot be read. */
+    const chargedFees = async (signatures) => {
+        let total = 0n;
+        for (const signature of signatures) {
+            if (signature === null)
+                continue; // never landed, so never charged
+            try {
+                const transaction = await simulator.call('getTransaction', [
+                    signature,
+                    { encoding: 'json', commitment: 'confirmed', maxSupportedTransactionVersion: 0 },
+                ]);
+                const fee = transaction?.meta?.fee;
+                if (typeof fee !== 'number' || !Number.isSafeInteger(fee) || fee < 0)
+                    return null;
+                total += BigInt(fee);
+            }
+            catch (error) {
+                report(error, { phase: 'fees' });
+                return null;
+            }
+        }
+        return total;
+    };
+    const outcomeOf = (job, state, outcome) => ({
+        jobId: job.id,
+        deliveryId: job.deliveryId,
+        deploymentId: job.deploymentId,
+        step: job.request.step,
+        wallet: job.request.wallet,
+        instanceId: job.request.instance ?? null,
+        state,
+        code: outcome.code,
+        ...(outcome.reason !== undefined ? { reason: outcome.reason } : {}),
+        ...(outcome.detail !== undefined ? { detail: outcome.detail } : {}),
+        executionId: job.progress.intent?.executionId ?? null,
+        signatures: job.progress.signatures ?? [],
+    });
+    const notify = async (outcome) => {
+        const hooks = [options.onOutcome];
+        if (outcome.state === 'refused')
+            hooks.push(options.onRefused);
+        if (outcome.state === 'rejected')
+            hooks.push(options.onRejected);
+        for (const hook of hooks) {
+            if (!hook)
+                continue;
+            try {
+                await hook(outcome);
+            }
+            catch (error) {
+                report(error, { jobId: outcome.jobId, phase: 'hook' });
+            }
+        }
+    };
+    /**
+     * The runners for one claim. `worker` here is the claim's own holder
+     * token, so a lapsed claim's late writes can never touch the job after
+     * another claim (even in this process) took it over.
+     */
+    const forClaim = (worker) => {
+        /** Move `job` to a final state and release it. */
+        const finish = async (job, state, outcome, progress = undefined, ledger = { void: true }) => {
+            // Spending counts against a window only when the intent landed.
+            const landed = state === 'completed';
+            const voiding = ledger;
+            const moved = await store.jobs.transition(job.id, {
+                worker,
+                from: job.state,
+                to: state,
+                now: clock.now(),
+                outcome,
+                ...(progress ? { progress } : {}),
+                ...(landed ? {} : { ledger: voiding }),
+            });
+            if (!moved)
+                throw new LostLease();
+            await notify(outcomeOf(progress ? { ...job, progress: { ...job.progress, ...progress } } : job, state, outcome));
+        };
+        /** Move `job` to another active state, keeping the lease. */
+        const advance = async (job, state, progress, ledger) => {
+            const moved = await store.jobs.transition(job.id, {
+                worker,
+                from: job.state,
+                to: state,
+                now: clock.now(),
+                keepLease: leaseUntil(),
+                ...(progress ? { progress } : {}),
+                ...(ledger ? { ledger } : {}),
+            });
+            if (!moved)
+                throw new LostLease();
+            return { ...job, state, progress: { ...job.progress, ...progress } };
+        };
+        /** Release `job` in its current state, to be claimed again later. */
+        const park = async (job, delayMs, attempts = job.attempts) => {
+            const moved = await store.jobs.transition(job.id, {
+                worker,
+                from: job.state,
+                to: job.state,
+                now: clock.now(),
+                notBefore: clock.now() + delayMs,
+                attempts,
+            });
+            if (!moved)
+                throw new LostLease();
+        };
+        const refuse = (job, refusal) => finish(job, 'refused', { code: refusal.rule, reason: refusal.reason });
+        /** The active grant for a job; instance-scoped grants end with their instance. */
+        const consentFor = async (job) => {
+            const grant = await store.consent.find({
+                wallet: job.request.wallet,
+                deploymentId: job.deploymentId,
+                step: job.request.step,
+                instanceId: job.request.instance ?? null,
+                now: clock.now(),
+            });
+            if (grant?.instanceId && client.instances) {
+                const instance = await client.instances.get(grant.instanceId);
+                if (instance.terminal) {
+                    await store.consent.revoke({
+                        wallet: grant.wallet,
+                        deploymentId: grant.deploymentId,
+                        instanceId: grant.instanceId,
+                        now: clock.now(),
+                    });
+                    return consentFor(job);
+                }
+            }
+            return grant;
+        };
+        /** The grant's limits against what this step moves, and the window spent so far. */
+        const checkLimits = async (job, grant, outflows) => {
+            for (const [asset, amount] of outflows) {
+                const limit = grant.limits.perExecution[asset];
+                if (limit === undefined) {
+                    return {
+                        rule: 'consent_limit',
+                        reason: `the step moves ${amount} of ${asset} out of the wallet, and the consent sets no per-run limit for it`,
+                    };
+                }
+                if (amount > BigInt(limit)) {
+                    return {
+                        rule: 'consent_limit',
+                        reason: `the step moves ${amount} of ${asset} out of the wallet, over the consent's per-run limit of ${limit}`,
+                    };
+                }
+                const window = grant.limits.perWindow[asset];
+                if (window) {
+                    const spent = await store.ledger.spent({
+                        wallet: job.request.wallet,
+                        deploymentId: job.deploymentId,
+                        asset,
+                        since: clock.now() - window.windowMs,
+                    });
+                    if (spent + amount > BigInt(window.amount)) {
+                        return {
+                            rule: 'consent_window',
+                            reason: `the step moves ${amount} of ${asset}; with ${spent} already moved in the window that exceeds the consent's limit of ${window.amount}`,
+                        };
+                    }
+                }
+            }
+            return null;
+        };
+        /** Prepare, check, sign and submit a `running` step job. */
+        const attempt = async (job) => {
+            const { request } = job;
+            const wallet = request.wallet;
+            if (!(await consentFor(job))) {
+                return finish(job, 'skipped', { code: 'no_consent', reason: `no active consent for ${request.step}` });
+            }
+            if (request.cooldownMs !== undefined) {
+                const last = await store.jobs.lastCompleted({ wallet, deploymentId: job.deploymentId, step: request.step });
+                if (last !== null && clock.now() - last < request.cooldownMs) {
+                    return finish(job, 'skipped', {
+                        code: 'cooldown',
+                        reason: `${request.step} completed for this wallet ${Math.round((clock.now() - last) / 1000)}s ago`,
+                    });
+                }
+            }
+            const target = checkTarget(policy, job.deploymentId, cluster);
+            if (target)
+                return refuse(job, target);
+            if (request.instance !== undefined) {
+                const availability = (await client.allowedSteps({ instance: request.instance, wallet })).find((entry) => entry.step === request.step);
+                if (!availability) {
+                    return finish(job, 'rejected', { code: 'step_not_available', reason: `${request.step} is not a step of this instance` });
+                }
+                if (!availability.allowed) {
+                    return finish(job, 'rejected', {
+                        code: availability.reason ?? 'not_allowed',
+                        ...(availability.detail !== undefined ? { detail: availability.detail } : {}),
+                    });
+                }
+            }
+            const format = negotiateTransactionFormat(signer.supportedTransactionFormats, formats);
+            if (format === null) {
+                return refuse(job, {
+                    rule: 'transaction_format',
+                    reason: `the ${signer.kind} signer supports ${signer.supportedTransactionFormats.join(', ')}, the deployment ${formats.join(', ')}`,
+                });
+            }
+            if (!(await signer.canSign(wallet))) {
+                return refuse(job, { rule: 'signer_unavailable', reason: `the ${signer.kind} signer cannot sign for ${wallet}` });
+            }
+            const stepClient = client.steps[request.step];
+            if (!stepClient) {
+                return finish(job, 'rejected', { code: 'step_not_client_callable', reason: `${request.step} cannot be prepared by this client` });
+            }
+            const result = await stepClient.prepare({ ...request.args, wallet, ...(request.instance !== undefined ? { instance: request.instance } : {}) }, { transactionFormat: format, idempotencyKey: `${job.id}:${job.progress.generation}` });
+            if (!result.ok) {
+                return finish(job, 'rejected', {
+                    code: result.rejection.rejected,
+                    ...(result.rejection.detail !== undefined ? { detail: result.rejection.detail } : {}),
+                });
+            }
+            const { intent, transactions } = result;
+            const mismatch = checkPreparedAgainstIntent({ wallet, intent, transactions, format });
+            if (mismatch)
+                return refuse(job, mismatch);
+            const summary = await summarizePrepared({ intent, transactions }, wallet, simulator);
+            const refusal = checkPrepared(policy, {
+                deploymentId: job.deploymentId,
+                prepared: { intent, transactions },
+                summary,
+                simulates: true,
+            });
+            if (refusal)
+                return refuse(job, refusal);
+            if (!(await store.jobs.renew(job.id, worker, leaseUntil().until)))
+                throw new LostLease();
+            // Consent can be revoked or changed while the step was prepared and simulated.
+            const grant = await consentFor(job);
+            if (!grant) {
+                return finish(job, 'skipped', { code: 'no_consent', reason: 'consent was revoked before signing' });
+            }
+            const outflows = stepOutflows(summary);
+            const overLimit = await checkLimits(job, grant, outflows);
+            if (overLimit)
+                return refuse(job, overLimit);
+            // The signer gets copies; the checks below compare against a baseline it never had.
+            const baseline = transactions.map(({ index, transactionBase64 }) => ({ index, transactionBase64 }));
+            let signed;
+            try {
+                signed = await signer.signTransactions({
+                    wallet,
+                    intent: structuredClone(intent),
+                    transactions: baseline.map((transaction) => ({ ...transaction })),
+                });
+            }
+            catch (error) {
+                if (isSignerRefusal(error))
+                    return refuse(job, { rule: error.rule, reason: error.message });
+                throw error;
+            }
+            const tampered = checkSignedTransactions({ wallet, intent, prepared: baseline, signed: [...signed] });
+            if (tampered)
+                return refuse(job, tampered);
+            // Recorded with the signed bytes, before submit, so a crash cannot let a
+            // step escape its window; voided if the intent never lands.
+            const perTransaction = transactionOutflows(summary).map(({ index, amounts }) => ({
+                index,
+                amounts: Object.fromEntries([...amounts].map(([asset, amount]) => [asset, amount.toString()])),
+            }));
+            const saved = await advance(job, 'signed', { format, intent, prepared: baseline, signed, outflows: perTransaction, signedAt: clock.now() }, {
+                record: [...outflows].map(([asset, amount]) => ({
+                    wallet,
+                    deploymentId: job.deploymentId,
+                    asset,
+                    amount: amount.toString(),
+                })),
+            });
+            return submit(saved);
+        };
+        /** Submit a `signed` job's saved transactions, then track the intent. */
+        const submit = async (job) => {
+            let state;
+            try {
+                state = await client.submit(job.progress.intent, job.progress.signed);
+            }
+            catch (error) {
+                // The API may have accepted it; the next claim reads the intent first.
+                report(error, { jobId: job.id, phase: 'submit' });
+                return park(job, backoff(job.attempts + 1), job.attempts + 1);
+            }
+            return track(await advance(job, 'submitted'), state);
+        };
+        /** Follow a submitted intent until it settles or this claim's time is up. */
+        const track = async (initial, first) => {
+            let job = initial;
+            const deadline = clock.now() + trackForMs;
+            let state = first;
+            for (;;) {
+                if (state === undefined) {
+                    try {
+                        state = await client.intents.get(job.progress.intent.executionId);
+                    }
+                    catch (error) {
+                        report(error, { jobId: job.id, phase: 'intent' });
+                    }
+                }
+                if (state !== undefined) {
+                    const signatures = state.transactions.map((transaction) => transaction.signature);
+                    switch (state.state) {
+                        case 'completed':
+                            return finish(job, 'completed', { code: 'completed' }, { ...job.progress, signatures });
+                        case 'chain_failed': {
+                            const ledger = await failedLedger(job, state);
+                            return finish(job, 'chain_failed', {
+                                code: 'chain_failed',
+                                detail: state.transactions.filter((transaction) => transaction.error).map(({ index, error }) => ({ index, error })),
+                            }, { ...job.progress, signatures }, ledger);
+                        }
+                        case 'rejected':
+                            return finish(job, 'rejected', { code: 'intent_rejected' }, { ...job.progress, signatures });
+                        case 'expired':
+                            return prepareAgain(job);
+                        case 'prepared':
+                            // Not submitted yet: submit the saved bytes (never signs again).
+                            if (job.state === 'signed')
+                                return submit(job);
+                            break;
+                        case 'submitted_unknown':
+                            if (job.state !== 'submitted_unknown')
+                                job = await advance(job, 'submitted_unknown', { signatures });
+                            break;
+                        default:
+                            if (job.state === 'signed')
+                                job = await advance(job, 'submitted', { signatures });
+                    }
+                }
+                if (clock.now() + trackIntervalMs > deadline) {
+                    return park(job, backoff(job.attempts + 1), job.attempts + 1);
+                }
+                await clock.sleep(trackIntervalMs);
+                if (!(await store.jobs.renew(job.id, worker, leaseUntil().until)))
+                    throw new LostLease();
+                state = undefined;
+            }
+        };
+        /** An expired intent is prepared again once, with a new idempotency key. */
+        const prepareAgain = async (job) => {
+            if (job.progress.generation >= 1) {
+                return finish(job, 'expired', { code: 'expired', reason: 'the intent expired again after preparing it a second time' });
+            }
+            const fresh = await advance(job, 'running', { generation: job.progress.generation + 1, intent: undefined, prepared: undefined, signed: undefined, signatures: undefined }, { void: true });
+            return attempt(fresh);
+        };
+        /** A job that had signed: read the intent before doing anything else. */
+        const reconcile = async (job) => {
+            let state;
+            try {
+                state = await client.intents.get(job.progress.intent.executionId);
+            }
+            catch (error) {
+                report(error, { jobId: job.id, phase: 'reconcile' });
+                return park(job, backoff(job.attempts + 1), job.attempts + 1);
+            }
+            return track(job, state);
+        };
+        const runStep = async (job) => {
+            try {
+                if (job.state === 'running') {
+                    // A lapsed claim before signing starts over: prepare is idempotent.
+                    await attempt(job);
+                }
+                else {
+                    await reconcile(job);
+                }
+            }
+            catch (error) {
+                if (error instanceof LostLease)
+                    return;
+                report(error, { jobId: job.id, phase: job.state });
+                const current = await store.jobs.get(job.id);
+                if (!current || current.kind !== 'step' || current.lease?.worker !== worker)
+                    return;
+                const attempts = current.attempts + 1;
+                if (current.state === 'running') {
+                    if (attempts >= maxAttempts) {
+                        await finish(current, 'failed', { code: 'error', reason: message(error) }).catch(() => undefined);
+                    }
+                    else {
+                        // Nothing was signed: let other jobs of the wallet run meanwhile.
+                        await store.jobs.transition(current.id, {
+                            worker,
+                            from: 'running',
+                            to: 'queued',
+                            now: clock.now(),
+                            notBefore: clock.now() + backoff(attempts),
+                            attempts,
+                        });
+                    }
+                }
+                else {
+                    // Signed or later: never fail blind; read the intent next time.
+                    await park(current, backoff(attempts), attempts).catch(() => undefined);
+                }
+            }
+        };
+        // -------------------------------------------------------------------------
+        // Delivery jobs
+        // -------------------------------------------------------------------------
+        const runDelivery = async (job) => {
+            const { delivery } = job;
+            const handler = handlers.get(delivery.name);
+            const ctx = {
+                client,
+                trigger: { name: delivery.name, id: delivery.id, source: delivery.source, receivedAt: delivery.receivedAt },
+                consents: {
+                    async list(query = {}) {
+                        const grants = await store.consent.active({
+                            deploymentId: client.deploymentId,
+                            ...(query.step !== undefined ? { step: query.step } : {}),
+                            now: clock.now(),
+                        });
+                        if (query.instanceId === undefined)
+                            return grants;
+                        // One effective grant per wallet: the instance's own grant wins over
+                        // one for every instance, as consent checks choose at run time.
+                        const effective = new Map();
+                        for (const grant of grants) {
+                            if (grant.instanceId !== null && grant.instanceId !== query.instanceId)
+                                continue;
+                            const current = effective.get(grant.wallet);
+                            if (!current || (current.instanceId === null && grant.instanceId !== null))
+                                effective.set(grant.wallet, grant);
+                        }
+                        return [...effective.values()];
+                    },
+                },
+                step(step, request, stepOptions = {}) {
+                    return {
+                        step,
+                        wallet: request.wallet,
+                        ...(request.instance !== undefined ? { instance: request.instance } : {}),
+                        args: { ...(request.args ?? {}) },
+                        ...(stepOptions.cooldown !== undefined ? { cooldownMs: durationMs(stepOptions.cooldown) } : {}),
+                    };
+                },
+            };
+            try {
+                const requests = handler ? ((await handler(delivery.payload, ctx)) ?? []) : [];
+                const steps = new Map();
+                for (const request of requests) {
+                    if (typeof request?.step !== 'string' || typeof request.wallet !== 'string' || request.wallet === '') {
+                        throw new TypeError(`handler for ${delivery.name} returned a step request without a step or wallet`);
+                    }
+                    const id = stepJobId(delivery.id, request);
+                    if (!steps.has(id))
+                        steps.set(id, { id, deploymentId: client.deploymentId, request });
+                }
+                if (!(await store.jobs.completeDelivery(job.id, worker, [...steps.values()], clock.now()))) {
+                    throw new LostLease();
+                }
+            }
+            catch (error) {
+                if (error instanceof LostLease)
+                    return;
+                report(error, { jobId: job.id, phase: 'handler' });
+                const attempts = job.attempts + 1;
+                await store.jobs.transition(job.id, {
+                    worker,
+                    from: 'running',
+                    to: attempts >= maxAttempts ? 'failed' : 'queued',
+                    now: clock.now(),
+                    attempts,
+                    notBefore: clock.now() + backoff(attempts),
+                    ...(attempts >= maxAttempts ? { outcome: { code: 'handler_failed', reason: message(error) } } : {}),
+                });
+            }
+        };
+        return { runStep, runDelivery };
+    };
+    // -------------------------------------------------------------------------
+    // Workers
+    // -------------------------------------------------------------------------
+    let claims = 0;
+    const runOnce = async () => {
+        await bound();
+        claims += 1;
+        const holder = `${worker}#${claims}`;
+        const job = await store.jobs.claimNext({ worker: holder, leaseMs, now: clock.now() });
+        if (!job)
+            return false;
+        const runner = forClaim(holder);
+        if (job.kind === 'delivery')
+            await runner.runDelivery(job);
+        else
+            await runner.runStep(job);
+        return true;
+    };
+    let running = false;
+    let loops = [];
+    // -------------------------------------------------------------------------
+    // View sources
+    // -------------------------------------------------------------------------
+    const ENDED = Symbol('ended');
+    const newAttempt = () => {
+        let end = () => undefined;
+        const ended = new Promise((resolve) => {
+            end = () => resolve(ENDED);
+        });
+        return { active: true, ended, end };
+    };
+    /** Close an attempt: no further work of it runs, and its stream is closed. */
+    const closeAttempt = async (attempt) => {
+        attempt.active = false;
+        attempt.end();
+        const iterator = attempt.iterator;
+        attempt.iterator = undefined;
+        try {
+            await iterator?.return?.();
+        }
+        catch {
+            // Closing a stream that already failed.
+        }
+    };
+    /** `promise`, unless the attempt ends first. */
+    const within = (attempt, promise) => Promise.race([promise, attempt.ended]);
+    const watchList = async (source, attempt) => {
+        // Signals are evaluated against the rows as of each event, in order.
+        const latest = new Map();
+        const rowsByKey = new Map();
+        let rows = [];
+        const waiting = new Set();
+        const current = (key) => {
+            if (source.rowSignal)
+                return latest.get(key);
+            const signal = source.signals(rows).find(([candidate]) => candidate === key);
+            return signal ? [signal[1], signal[2]] : undefined;
+        };
+        const evaluate = async (key, value, observed) => {
+            const result = await evaluateSignal(store, clock, source, key, value, observed);
+            if (result === 'pending' && !waiting.has(key)) {
+                waiting.add(key);
+                void clock.sleep(source.stableForMs).then(() => settle(key));
+            }
+        };
+        // A pending value is promoted when its timer fires; a failed write is
+        // retried until it lands or the attempt ends.
+        const settle = async (key) => {
+            waiting.delete(key);
+            for (let failures = 0; attempt.active; failures += 1) {
+                const signal = current(key);
+                if (!signal)
+                    return;
+                try {
+                    await evaluate(key, signal[0], signal[1]);
+                    return;
+                }
+                catch (error) {
+                    report(error, { phase: 'source' });
+                    if ((await within(attempt, clock.sleep(backoff(failures + 1)))) === ENDED)
+                        return;
+                }
+            }
+        };
+        // Read the stream into a local, unbounded queue from the moment it opens:
+        // the SDK's own buffer is bounded and drops list updates silently.
+        const iterator = source.view.watchRich({ withSnapshot: true })[Symbol.asyncIterator]();
+        attempt.iterator = iterator;
+        const queued = [];
+        const waiter = { wake: null };
+        let finished = false;
+        let failure = null;
+        void (async () => {
+            try {
+                for (;;) {
+                    const next = await within(attempt, iterator.next());
+                    if (next === ENDED || next.done)
+                        break;
+                    queued.push(next.value);
+                    waiter.wake?.();
+                }
+            }
+            catch (error) {
+                failure = error;
+            }
+            finally {
+                finished = true;
+                waiter.wake?.();
+            }
+        })();
+        const take = async () => {
+            while (queued.length === 0 && !finished) {
+                await new Promise((resolve) => {
+                    waiter.wake = resolve;
+                });
+                waiter.wake = null;
+            }
+            const update = queued.shift();
+            if (update !== undefined)
+                return update;
+            if (failure !== null)
+                throw failure;
+            return null;
+        };
+        // Seed from the complete current rows: a query that is already open
+        // replays nothing on a new stream, so the stream alone cannot be the
+        // baseline.
+        const snapshot = await within(attempt, source.view.get());
+        if (snapshot === ENDED || !attempt.active)
+            return;
+        const rowKeys = new Map();
+        for (const row of snapshot)
+            rowsByKey.set(source.rowKey(row), row);
+        /** Apply an update; the row it leaves, or `undefined` for a removal. */
+        /** A row's signal is forgotten, so no pending `stableFor` change of it can still fire. */
+        const forget = (key) => {
+            rowsByKey.delete(key);
+            latest.delete(key);
+        };
+        // A removal of a row the stream never announced (seeded from the
+        // snapshot) that carries no `lastKnown`: its key cannot be derived.
+        let unmatchedRemoval = false;
+        /** Apply an update: the row and its key, or `undefined` for a removal. */
+        const apply = (update) => {
+            if (update.type === 'created' || update.type === 'updated') {
+                const row = update.type === 'created' ? update.data : update.after;
+                const key = source.rowKey(row);
+                rowKeys.set(update.key, key);
+                rowsByKey.set(key, row);
+                return { row, key };
+            }
+            const key = update.lastKnown !== undefined ? source.rowKey(update.lastKnown) : rowKeys.get(update.key);
+            if (key !== undefined)
+                forget(key);
+            else
+                unmatchedRemoval = true;
+            rowKeys.delete(update.key);
+            return undefined;
+        };
+        /** Drop the rows the view no longer has, reading it when it has no synchronous copy. */
+        const reconcileRemoval = async () => {
+            unmatchedRemoval = false;
+            const current = source.view.getSync?.() ?? (await within(attempt, source.view.get()));
+            if (current === ENDED)
+                return false;
+            const present = new Set(current.map((row) => source.rowKey(row)));
+            for (const key of [...rowsByKey.keys()])
+                if (!present.has(key))
+                    forget(key);
+            return true;
+        };
+        /**
+         * After a reconnect the SDK replaces the list with a new snapshot and
+         * announces only the rows still present; drop the ones the view no
+         * longer has.
+         */
+        const pruneGone = () => {
+            const current = source.view.getSync?.();
+            if (!current)
+                return 0;
+            const present = new Set(current.map((row) => source.rowKey(row)));
+            let removed = 0;
+            for (const key of [...rowsByKey.keys()]) {
+                if (!present.has(key)) {
+                    forget(key);
+                    removed += 1;
+                }
+            }
+            return removed;
+        };
+        const rowJson = (row) => JSON.stringify(row, (_key, value) => (typeof value === 'bigint' ? value.toString() : value));
+        // Rows a reconnect's rebuild already took in, until the stream announces them.
+        const resynced = new Map();
+        // Let the reader drain what the stream already delivered (buffered
+        // events resolve as microtasks, before this timer), then apply it in order
+        // without evaluating: it is already reflected in the snapshot, and
+        // replaying it leaves every row at its latest value.
+        if ((await within(attempt, new Promise((resolve) => setTimeout(resolve, 0)))) === ENDED)
+            return;
+        while (queued.length > 0)
+            apply(queued.shift());
+        // A removal that arrived after the snapshot was read may name a row only
+        // the snapshot holds.
+        if (unmatchedRemoval && !(await reconcileRemoval()))
+            return;
+        rows = [...rowsByKey.values()];
+        for (const [key, value, observed] of source.signals(rows)) {
+            if (!attempt.active)
+                return;
+            if (source.rowSignal)
+                latest.set(key, [value, observed]);
+            await evaluate(key, value, observed);
+        }
+        while (attempt.active) {
+            const update = await take();
+            if (update === null || !attempt.active)
+                return;
+            if (!source.rowSignal && update.type === 'created') {
+                const key = source.rowKey(update.data);
+                if (resynced.get(key) === rowJson(update.data)) {
+                    // Part of a reconnect already evaluated as a whole.
+                    resynced.delete(key);
+                    rowKeys.set(update.key, key);
+                    continue;
+                }
+                const announcedAgain = rowsByKey.has(key);
+                apply(update);
+                const current = source.view.getSync?.();
+                if ((announcedAgain || pruneGone() > 0) && current) {
+                    // A reconnect: the SDK replaced the whole list and now announces it
+                    // row by row. Evaluate the new list once, as a whole, not a mix of
+                    // old and new rows.
+                    rowsByKey.clear();
+                    resynced.clear();
+                    for (const row of current) {
+                        const rowKey = source.rowKey(row);
+                        rowsByKey.set(rowKey, row);
+                        if (rowKey !== key)
+                            resynced.set(rowKey, rowJson(row));
+                    }
+                }
+                rows = [...rowsByKey.values()];
+                for (const [signalKey, value, observed] of source.signals(rows)) {
+                    if (!attempt.active)
+                        return;
+                    await evaluate(signalKey, value, observed);
+                }
+                continue;
+            }
+            const applied = apply(update);
+            if (update.type === 'created')
+                pruneGone();
+            if (unmatchedRemoval && !(await reconcileRemoval()))
+                return;
+            rows = [...rowsByKey.values()];
+            if (source.rowSignal) {
+                if (applied === undefined)
+                    continue;
+                const signal = source.rowSignal(applied.row);
+                if (!signal) {
+                    // It no longer passes the filter: its old signal must not fire.
+                    latest.delete(applied.key);
+                    continue;
+                }
+                latest.set(signal[0], [signal[1], signal[2]]);
+                await evaluate(signal[0], signal[1], signal[2]);
+                continue;
+            }
+            for (const [key, value, observed] of source.signals(rows)) {
+                if (!attempt.active)
+                    return;
+                await evaluate(key, value, observed);
+            }
+        }
+    };
+    const watchAppend = async (source, attempt) => {
+        const cursor = await within(attempt, store.sources.cursor(source.name));
+        if (cursor === ENDED || !attempt.active)
+            return;
+        const iterator = source.view.watch(cursor ? { after: cursor } : {})[Symbol.asyncIterator]();
+        attempt.iterator = iterator;
+        while (attempt.active) {
+            const next = await within(attempt, iterator.next());
+            if (next === ENDED || next.done || !attempt.active)
+                return;
+            const update = next.value;
+            if (update.type !== 'upsert')
+                continue;
+            if (!update.cursor)
+                throw new Error(`${source.name}: the view is not an append view (its updates carry no cursor)`);
+            if (!source.filter || source.filter(update.data)) {
+                const payload = { source: source.name, cursor: update.cursor, row: update.data };
+                await accept({
+                    id: `view:${encodeURIComponent(source.name)}:${update.cursor}`,
+                    name: source.name,
+                    source: 'view',
+                    payload,
+                });
+            }
+            await store.sources.putCursor(source.name, update.cursor, clock.now());
+        }
+    };
+    const startSource = (source, sourceOptions = {}) => {
+        let stopped = false;
+        const stopping = newAttempt();
+        let attempt = null;
+        let holding = !sourceOptions.exclusive;
+        const pause = (ms) => within(stopping, clock.sleep(ms));
+        const acquire = async () => {
+            try {
+                return await store.sources.acquireLease(source.name, worker, clock.now() + leaseMs, clock.now());
+            }
+            catch (error) {
+                report(error, { phase: 'source' });
+                return false;
+            }
+        };
+        const keepLease = async () => {
+            while (!stopped && holding) {
+                if ((await pause(Math.max(1, Math.floor(leaseMs / 3)))) === ENDED)
+                    return;
+                holding = await acquire();
+                if (!holding && attempt)
+                    await closeAttempt(attempt);
+            }
+        };
+        const loop = (async () => {
+            let failures = 0;
+            while (!stopped) {
+                if (sourceOptions.exclusive && !holding) {
+                    holding = await acquire();
+                    if (!holding) {
+                        await pause(Math.max(1, Math.floor(leaseMs / 2)));
+                        continue;
+                    }
+                    void keepLease();
+                }
+                const current = newAttempt();
+                attempt = current;
+                try {
+                    await bound();
+                    if (source.kind === 'list')
+                        await watchList(source, current);
+                    else
+                        await watchAppend(source, current);
+                    failures = 0;
+                }
+                catch (error) {
+                    if (!stopped) {
+                        report(error, { phase: 'source' });
+                        failures += 1;
+                    }
+                }
+                finally {
+                    await closeAttempt(current);
+                }
+                if (!stopped)
+                    await pause(failures > 0 ? backoff(failures) : Math.min(reconcileMs, 1000));
+            }
+        })();
+        return {
+            async stop() {
+                stopped = true;
+                stopping.end();
+                if (attempt)
+                    await closeAttempt(attempt);
+                await loop;
+                if (sourceOptions.exclusive) {
+                    await store.sources.releaseLease(source.name, worker).catch((error) => report(error, { phase: 'source' }));
+                }
+            },
+        };
+    };
+    const domain = () => {
+        if (!options.consent?.domain) {
+            throw new ConsentError('no_domain', 'createAutomations needs consent.domain to build consent proofs');
+        }
+        return options.consent.domain;
+    };
+    const consent = {
+        async proofMessage(fields) {
+            await bound();
+            const normalized = normalizeConsent(fields);
+            if (normalized.deploymentId !== client.deploymentId) {
+                throw new ConsentError('invalid_fields', `consent is for ${normalized.deploymentId}, this client runs ${client.deploymentId}`);
+            }
+            const random = new Uint8Array(16);
+            globalThis.crypto.getRandomValues(random);
+            const nonce = encodeBase58(random);
+            const issuedAt = clock.now();
+            const message = consentMessage(domain(), normalized, nonce, issuedAt);
+            await store.consent.issueNonce(nonce, issuedAt + proofTtlMs);
+            return { message, bytes: new TextEncoder().encode(message), nonce, issuedAt };
+        },
+        async grant(input) {
+            await bound();
+            const now = clock.now();
+            const normalized = normalizeConsent(input);
+            if (normalized.deploymentId !== client.deploymentId) {
+                throw new ConsentError('invalid_fields', `consent is for ${normalized.deploymentId}, this client runs ${client.deploymentId}`);
+            }
+            if (normalized.expiresAt <= now)
+                throw new ConsentError('expired', 'the consent has already expired');
+            if (!Number.isSafeInteger(input.issuedAt) || input.issuedAt > now + 60_000 || now - input.issuedAt > proofTtlMs) {
+                throw new ConsentError('proof_stale', 'the proof was issued too long ago; build and sign a new one');
+            }
+            const message = consentMessage(domain(), normalized, input.nonce, input.issuedAt);
+            const signature = typeof input.signature === 'string' ? decodeBase58(input.signature) : input.signature;
+            const walletKey = decodeBase58(normalized.wallet);
+            let valid = false;
+            try {
+                valid =
+                    signature !== null &&
+                        signature.length === 64 &&
+                        walletKey !== null &&
+                        ed25519.verify(signature, new TextEncoder().encode(message), walletKey);
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid) {
+                throw new ConsentError('invalid_signature', 'the signature is not the wallet\'s over this consent');
+            }
+            if (!(await store.consent.useNonce(input.nonce, now))) {
+                throw new ConsentError('nonce_not_usable', 'the nonce was not issued, has expired, or was already used');
+            }
+            const grant = {
+                ...normalized,
+                grantedAt: now,
+                revokedAt: null,
+                proof: { message, signature: encodeBase58(signature), nonce: input.nonce, issuedAt: input.issuedAt },
+            };
+            await store.consent.put(grant);
+            const warnings = [];
+            let status;
+            try {
+                status = signer.delegationStatus ? await signer.delegationStatus(normalized.wallet) : undefined;
+            }
+            catch (error) {
+                // The grant is stored; a provider outage must not report it as failed.
+                warnings.push(`the ${signer.kind} signer could not report its delegation: ${String(error?.message ?? error)}`);
+                return { grant, warnings };
+            }
+            if (!status) {
+                warnings.push(`the ${signer.kind} signer cannot report whether a provider policy bounds what it signs`);
+            }
+            else {
+                if (!status.delegated)
+                    warnings.push(`the ${signer.kind} signer has no delegated access to ${normalized.wallet}`);
+                if (!status.providerPolicy) {
+                    warnings.push(`no provider policy bounds what the ${signer.kind} signer may sign for ${normalized.wallet}`);
+                }
+            }
+            return { grant, warnings };
+        },
+        async revoke(input) {
+            await bound();
+            return store.consent.revoke({ ...input, deploymentId: client.deploymentId, now: clock.now() });
+        },
+        async list(input) {
+            await bound();
+            return store.consent.list(input);
+        },
+    };
+    const automations = {
+        consent,
+        on(name, handler) {
+            handlers.set(name, handler);
+            return automations;
+        },
+        dispatch(name, payload, { id }) {
+            return accept({ id: `dispatch:${id}`, name, source: 'dispatch', payload });
+        },
+        acceptWebhook,
+        webhookHandler(webhook) {
+            return async (request) => {
+                const body = new Uint8Array(await request.arrayBuffer());
+                const result = await acceptWebhook(body, request.headers, webhook);
+                return new Response(JSON.stringify(result.body), {
+                    status: result.status,
+                    headers: { 'content-type': 'application/json' },
+                });
+            };
+        },
+        expressWebhookHandler(webhook) {
+            return async (req, res) => {
+                const raw = req.body;
+                if (!(raw instanceof Uint8Array) && typeof raw !== 'string') {
+                    res.status(500).json({
+                        error: 'raw-body-required',
+                        message: "mount the webhook route behind express.raw({ type: 'application/json' })",
+                    });
+                    return;
+                }
+                const result = await acceptWebhook(raw, req.headers, webhook);
+                res.status(result.status).json(result.body);
+            };
+        },
+        follow(instanceId, followOptions = {}) {
+            if (!client.events)
+                throw new Error('this client cannot follow event streams');
+            let stopped = false;
+            let queue = Promise.resolve();
+            // The stream moves past an event before its handler runs, so an event
+            // whose accept fails is retried here, in order, until it is stored.
+            const acceptUntilStored = async (delivery) => {
+                for (let failures = 0; !stopped && !followOptions.signal?.aborted; failures += 1) {
+                    try {
+                        await accept(delivery);
+                        return;
+                    }
+                    catch (error) {
+                        report(error, { phase: 'stream' });
+                        await clock.sleep(Math.min(1000 * 2 ** failures, 30_000));
+                    }
+                }
+            };
+            const subscription = client.events(instanceId, {
+                ...(followOptions.lastEventId !== undefined ? { lastEventId: followOptions.lastEventId } : {}),
+                ...(followOptions.signal ? { signal: followOptions.signal } : {}),
+                onEvent(streamEvent) {
+                    if (streamEvent.type !== 'emit' || !handlers.has(streamEvent.event))
+                        return;
+                    const data = streamEvent.data;
+                    const event = {
+                        id: String(data.id),
+                        event: streamEvent.event,
+                        deploymentId: client.deploymentId,
+                        instanceId: data.instanceId,
+                        participantId: data.participantId,
+                        state: null,
+                        occurredAt: data.at,
+                        source: 'stream',
+                    };
+                    const delivery = {
+                        id: `stream:${encodeURIComponent(data.instanceId)}:${data.id}`,
+                        name: streamEvent.event,
+                        source: 'stream',
+                        payload: event,
+                    };
+                    queue = queue.then(() => acceptUntilStored(delivery));
+                },
+                onError(error) {
+                    report(error, { phase: 'stream' });
+                },
+            });
+            return {
+                get lastEventId() {
+                    return subscription.lastEventId;
+                },
+                get closed() {
+                    return subscription.closed;
+                },
+                close() {
+                    stopped = true;
+                    subscription.close();
+                },
+            };
+        },
+        source: startSource,
+        async use(definition, useOptions = {}) {
+            // A definition for another protocol would register handlers for events
+            // this deployment never emits.
+            const own = client.definition?.name;
+            if (own !== undefined && definition.protocol.name !== own) {
+                throw new Error(`the definition is for protocol ${definition.protocol.name}, but the client is for ${own}`);
+            }
+            const setup = {
+                on: ((name, handler) => automations.on(name, handler)),
+                source: startSource,
+                connect: useOptions.connect ?? connectStack,
+            };
+            await definition.setup(setup);
+            return automations;
+        },
+        async poll(source) {
+            if (source.kind !== 'list')
+                throw new TypeError('only list-view sources can be polled');
+            await bound();
+            let delivered = 0;
+            let pending = 0;
+            for (const [key, value, observed] of source.signals(await source.view.get())) {
+                const result = await evaluateSignal(store, clock, source, key, value, observed);
+                if (result === 'delivered')
+                    delivered += 1;
+                if (result === 'pending')
+                    pending += 1;
+            }
+            return { delivered, pending };
+        },
+        runOnce,
+        async drain(drainOptions = {}) {
+            const max = drainOptions.maxJobs ?? Number.POSITIVE_INFINITY;
+            let ran = 0;
+            while (ran < max && (await runOnce()))
+                ran += 1;
+            return ran;
+        },
+        start(startOptions = {}) {
+            if (running)
+                return;
+            running = true;
+            const pollMs = durationMs(startOptions.pollInterval ?? 1_000);
+            const loop = async () => {
+                while (running) {
+                    let ran = false;
+                    try {
+                        ran = await runOnce();
+                    }
+                    catch (error) {
+                        report(error, { phase: 'worker' });
+                    }
+                    if (!ran && running)
+                        await clock.sleep(pollMs);
+                }
+            };
+            loops = Array.from({ length: Math.max(1, startOptions.concurrency ?? 1) }, loop);
+        },
+        async stop() {
+            running = false;
+            await Promise.all(loops);
+            loops = [];
+        },
+    };
+    return automations;
+}
+
+/** An append-view cursor `{epoch}:{offset}` as numbers, or `null` when it is not one. */
+function parseCursor(cursor) {
+    // The epoch is opaque (the server uses a UUID per tape lifetime); the
+    // offset follows the last colon.
+    const at = cursor.lastIndexOf(':');
+    const epoch = cursor.slice(0, at);
+    const offset = cursor.slice(at + 1);
+    if (at <= 0 || !/^\d+$/.test(offset))
+        return null;
+    return { epoch, offset: BigInt(offset) };
+}
+/**
+ * Whether `next` moves past `current`. Offsets are compared within an
+ * epoch; a different epoch is a new tape lifetime, which cannot be ordered
+ * against the old one, so it always moves on. Any cursor is after an
+ * unreadable one.
+ */
+function cursorAfter(next, current) {
+    const order = parseCursor(next);
+    if (!order)
+        throw new TypeError(`'${next}' is not an {epoch}:{offset} cursor`);
+    const stored = current === null ? null : parseCursor(current);
+    if (!stored || stored.epoch !== order.epoch)
+        return true;
+    return order.offset > stored.offset;
+}
+class StoreDeploymentError extends Error {
+    constructor(bound, requested) {
+        super(`this store belongs to deployment ${bound}, not ${requested}; use one store per deployment`);
+        this.name = 'StoreDeploymentError';
+    }
+}
+
+/**
+ * An in-memory store for tests and single-process development. State is
+ * lost on restart, so it must not back automations that sign real funds.
+ * Each method runs to completion without awaiting, which makes every
+ * operation atomic under JavaScript's single-threaded event loop.
+ */
+function isActiveStep(job) {
+    return job.kind === 'step' && ACTIVE_STEP_STATES.includes(job.state);
+}
+function isFinished(job) {
+    return job.kind === 'step'
+        ? TERMINAL_STEP_STATES.includes(job.state)
+        : TERMINAL_DELIVERY_STATES.includes(job.state);
+}
+function clone(value) {
+    return structuredClone(value);
+}
+const STATES = new WeakMap();
+/** A copy of a memory store's contents (source leases are not kept). */
+function memoryStoreState(store) {
+    const state = STATES.get(store);
+    if (!state)
+        throw new TypeError('not a memory store');
+    return state();
+}
+function memoryStore(options = {}) {
+    const initial = options.state ? clone(options.state) : null;
+    if (initial && initial.version !== 1)
+        throw new TypeError('unknown memory store state');
+    const deliveries = initial?.deliveries ?? new Map();
+    const jobs = initial?.jobs ?? new Map();
+    let order = initial?.order ?? 0;
+    const sequence = initial?.sequence ?? new Map();
+    const grants = initial?.grants ?? [];
+    let deployment = initial?.deployment ?? null;
+    const nonces = initial?.nonces ?? new Map();
+    const ledger = initial?.ledger ?? [];
+    const sourceStates = initial?.sourceStates ?? new Map();
+    const cursors = initial?.cursors ?? new Map();
+    const sourceLeases = new Map();
+    // A restored state's workers stopped with the process that saved it, so
+    // their claims are released rather than left to expire.
+    for (const [id, job] of jobs)
+        if (job.lease)
+            jobs.set(id, { ...job, lease: null });
+    const insert = (job) => {
+        jobs.set(job.id, job);
+        sequence.set(job.id, order++);
+    };
+    const acceptNow = (delivery, now) => {
+        if (deliveries.has(delivery.id))
+            return false;
+        // Clone first: a value that cannot be stored leaves the store unchanged.
+        const copy = clone(delivery);
+        deliveries.set(delivery.id, now);
+        if (jobs.has(delivery.id))
+            return false;
+        insert({
+            kind: 'delivery',
+            id: delivery.id,
+            state: 'queued',
+            delivery: copy,
+            attempts: 0,
+            notBefore: now,
+            lease: null,
+            createdAt: now,
+            updatedAt: now,
+            outcome: null,
+        });
+        return true;
+    };
+    const walletBusy = (wallet, except) => {
+        for (const job of jobs.values()) {
+            if (job.id !== except && job.kind === 'step' && job.request.wallet === wallet && isActiveStep(job)) {
+                return true;
+            }
+        }
+        return false;
+    };
+    const claimable = (job, now) => {
+        if (job.notBefore > now)
+            return false;
+        const leased = job.lease !== null && job.lease.until > now;
+        if (leased)
+            return false;
+        if (job.kind === 'delivery')
+            return job.state === 'queued' || job.state === 'running';
+        if (job.state === 'queued')
+            return !walletBusy(job.request.wallet, job.id);
+        return isActiveStep(job);
+    };
+    const store = {
+        async bindDeployment(deploymentId) {
+            if (deployment !== null && deployment !== deploymentId)
+                throw new StoreDeploymentError(deployment, deploymentId);
+            deployment = deploymentId;
+        },
+        deliveries: {
+            async accept(delivery, now) {
+                return acceptNow(delivery, now);
+            },
+            async prune(before) {
+                let removed = 0;
+                for (const [id, at] of deliveries) {
+                    if (at < before) {
+                        deliveries.delete(id);
+                        removed += 1;
+                    }
+                }
+                return removed;
+            },
+        },
+        jobs: {
+            async get(id) {
+                const job = jobs.get(id);
+                return job ? clone(job) : null;
+            },
+            async claimNext({ worker, leaseMs, now }) {
+                const candidates = [...jobs.values()]
+                    .filter((job) => claimable(job, now))
+                    .sort((a, b) => a.notBefore - b.notBefore || sequence.get(a.id) - sequence.get(b.id));
+                const job = candidates[0];
+                if (!job)
+                    return null;
+                const lease = { worker, until: now + leaseMs };
+                const claimed = job.state === 'queued'
+                    ? { ...job, state: 'running', lease, updatedAt: now }
+                    : { ...job, lease, updatedAt: now };
+                jobs.set(job.id, claimed);
+                return clone(claimed);
+            },
+            async transition(id, input) {
+                const job = jobs.get(id);
+                if (!job || job.state !== input.from)
+                    return false;
+                if (job.lease?.worker !== input.worker)
+                    return false;
+                const next = {
+                    ...job,
+                    state: input.to,
+                    updatedAt: input.now,
+                    lease: input.keepLease ? { worker: input.worker, until: input.keepLease.until } : null,
+                    ...(input.notBefore !== undefined ? { notBefore: input.notBefore } : {}),
+                    ...(input.attempts !== undefined ? { attempts: input.attempts } : {}),
+                    ...(input.outcome !== undefined ? { outcome: clone(input.outcome) } : {}),
+                    ...(job.kind === 'step' && input.progress
+                        ? { progress: { ...job.progress, ...clone(input.progress) } }
+                        : {}),
+                };
+                if (next.kind === 'step' && isActiveStep(next) && walletBusy(next.request.wallet, id)) {
+                    return false;
+                }
+                jobs.set(id, next);
+                if (input.ledger?.void) {
+                    for (const [index, entry] of ledger.entries()) {
+                        if (entry.jobId === id && entry.voidedAt === null && !input.ledger.keepAssets?.includes(entry.asset)) {
+                            ledger[index] = { ...entry, voidedAt: input.now };
+                        }
+                    }
+                }
+                for (const entry of input.ledger?.record ?? []) {
+                    ledger.push({ ...clone(entry), jobId: id, recordedAt: entry.recordedAt ?? input.now, voidedAt: null });
+                }
+                return true;
+            },
+            async renew(id, worker, until) {
+                const job = jobs.get(id);
+                if (!job || job.lease?.worker !== worker)
+                    return false;
+                jobs.set(id, { ...job, lease: { worker, until } });
+                return true;
+            },
+            async completeDelivery(id, worker, steps, now) {
+                const job = jobs.get(id);
+                if (!job || job.kind !== 'delivery' || job.state !== 'running' || job.lease?.worker !== worker) {
+                    return false;
+                }
+                const requests = steps.map((step) => clone(step.request));
+                jobs.set(id, { ...job, state: 'done', lease: null, updatedAt: now, outcome: null });
+                for (const [index, step] of steps.entries()) {
+                    if (jobs.has(step.id))
+                        continue;
+                    const created = {
+                        kind: 'step',
+                        id: step.id,
+                        state: 'queued',
+                        deliveryId: id,
+                        deploymentId: step.deploymentId,
+                        request: requests[index],
+                        progress: { generation: 0 },
+                        attempts: 0,
+                        notBefore: now,
+                        lease: null,
+                        createdAt: now,
+                        updatedAt: now,
+                        outcome: null,
+                    };
+                    insert(created);
+                }
+                return true;
+            },
+            async lastCompleted({ wallet, deploymentId, step }) {
+                let last = null;
+                for (const job of jobs.values()) {
+                    if (job.kind === 'step' &&
+                        job.state === 'completed' &&
+                        job.request.wallet === wallet &&
+                        job.request.step === step &&
+                        job.deploymentId === deploymentId) {
+                        last = last === null ? job.updatedAt : Math.max(last, job.updatedAt);
+                    }
+                }
+                return last;
+            },
+            async list(filter = {}) {
+                return [...jobs.values()]
+                    .filter((job) => (filter.kind ? job.kind === filter.kind : true))
+                    .filter((job) => (filter.state ? job.state === filter.state : true))
+                    .sort((a, b) => sequence.get(a.id) - sequence.get(b.id))
+                    .map(clone);
+            },
+            async prune(before) {
+                let removed = 0;
+                for (const job of [...jobs.values()]) {
+                    if (isFinished(job) && job.updatedAt < before) {
+                        jobs.delete(job.id);
+                        removed += 1;
+                    }
+                }
+                return removed;
+            },
+        },
+        consent: {
+            async put(grant) {
+                const index = grants.findIndex((existing) => existing.wallet === grant.wallet &&
+                    existing.deploymentId === grant.deploymentId &&
+                    existing.instanceId === grant.instanceId);
+                if (index >= 0)
+                    grants.splice(index, 1);
+                grants.push(clone(grant));
+            },
+            async find({ wallet, deploymentId, step, instanceId, now }) {
+                const candidates = grants.filter((grant) => grant.wallet === wallet &&
+                    grant.deploymentId === deploymentId &&
+                    (grant.instanceId === null || grant.instanceId === instanceId) &&
+                    grant.steps.includes(step) &&
+                    grant.revokedAt === null &&
+                    grant.expiresAt > now);
+                // A grant scoped to the instance is more specific than one for every instance.
+                const match = candidates.find((grant) => grant.instanceId !== null) ?? candidates[0];
+                return match ? clone(match) : null;
+            },
+            async revoke({ wallet, deploymentId, steps, instanceId, now }) {
+                let revoked = 0;
+                for (const [index, grant] of grants.entries()) {
+                    if (grant.wallet !== wallet || grant.deploymentId !== deploymentId || grant.revokedAt !== null)
+                        continue;
+                    if (instanceId !== undefined && grant.instanceId !== instanceId)
+                        continue;
+                    if (steps && !grant.steps.some((step) => steps.includes(step)))
+                        continue;
+                    const remaining = steps ? grant.steps.filter((step) => !steps.includes(step)) : [];
+                    grants[index] = remaining.length > 0 ? { ...grant, steps: remaining } : { ...grant, revokedAt: now };
+                    revoked += 1;
+                }
+                return revoked;
+            },
+            async list({ wallet }) {
+                return grants.filter((grant) => grant.wallet === wallet).map(clone);
+            },
+            async active({ deploymentId, step, now }) {
+                return grants
+                    .filter((grant) => grant.deploymentId === deploymentId &&
+                    grant.revokedAt === null &&
+                    grant.expiresAt > now &&
+                    (step === undefined || grant.steps.includes(step)))
+                    .map(clone);
+            },
+            async issueNonce(nonce, expiresAt) {
+                if (!nonces.has(nonce))
+                    nonces.set(nonce, { expiresAt, used: false });
+            },
+            async useNonce(nonce, now) {
+                const issued = nonces.get(nonce);
+                if (!issued || issued.used || issued.expiresAt <= now)
+                    return false;
+                nonces.set(nonce, { ...issued, used: true });
+                return true;
+            },
+        },
+        sources: {
+            async get(source, key) {
+                const state = sourceStates.get(`${source}\u0000${key}`);
+                return state ? clone(state) : null;
+            },
+            async advance({ source, key, expectedVersion, next, deliver, now }) {
+                const id = `${source}\u0000${key}`;
+                const current = sourceStates.get(id) ?? null;
+                if ((current?.version ?? null) !== expectedVersion)
+                    return null;
+                const generation = (current?.generation ?? 0) + (current?.hash === next.hash ? 0 : 1);
+                const state = {
+                    source,
+                    key,
+                    hash: next.hash,
+                    value: clone(next.value),
+                    generation,
+                    pending: next.pending ? clone(next.pending) : null,
+                    observed: next.observed ?? null,
+                    version: (current?.version ?? 0) + 1,
+                    updatedAt: now,
+                };
+                // Copy everything before changing anything: a payload that cannot be
+                // stored must leave the source state as it was, or the trigger is lost.
+                const delivery = deliver
+                    ? {
+                        id: `view:${encodeURIComponent(source)}:${encodeURIComponent(key)}:${generation}`,
+                        name: deliver.name,
+                        source: 'view',
+                        payload: clone(deliver.payload),
+                        receivedAt: now,
+                    }
+                    : null;
+                const result = clone(state);
+                sourceStates.set(id, state);
+                if (delivery)
+                    acceptNow(delivery, now);
+                return result;
+            },
+            async cursor(source) {
+                return cursors.get(source) ?? null;
+            },
+            async putCursor(source, cursor) {
+                if (cursorAfter(cursor, cursors.get(source) ?? null))
+                    cursors.set(source, cursor);
+            },
+            async acquireLease(source, holder, until, now) {
+                const lease = sourceLeases.get(source);
+                if (lease && lease.holder !== holder && lease.until > now)
+                    return false;
+                sourceLeases.set(source, { holder, until });
+                return true;
+            },
+            async releaseLease(source, holder) {
+                if (sourceLeases.get(source)?.holder === holder)
+                    sourceLeases.delete(source);
+            },
+        },
+        ledger: {
+            async spent({ wallet, deploymentId, asset, since }) {
+                let total = 0n;
+                for (const entry of ledger) {
+                    if (entry.wallet === wallet &&
+                        entry.deploymentId === deploymentId &&
+                        entry.asset === asset &&
+                        entry.voidedAt === null &&
+                        entry.recordedAt >= since) {
+                        total += BigInt(entry.amount);
+                    }
+                }
+                return total;
+            },
+            async list({ wallet }) {
+                return ledger.filter((entry) => entry.wallet === wallet).map(clone);
+            },
+        },
+    };
+    STATES.set(store, () => clone({ version: 1, deliveries, jobs, order, sequence, grants, deployment, nonces, ledger, sourceStates, cursors }));
+    return store;
+}
+
+/**
+ * Forwards a dev environment's protocol events as signed webhook deliveries.
+ *
+ * Dev environments deliver no webhooks, and production delivery refuses
+ * local addresses, so `a4 dev` follows every instance's event stream and
+ * turns each emission into the body and headers a production webhook sends,
+ * signed with the project's dev secret. Handlers receive them through
+ * `acceptWebhook` (or the app's own webhook route), so signature checks and
+ * duplicate handling run in development too.
+ */
+/** The body and headers of one delivery, signed with `secret`. */
+function signDelivery(secret, payload, timestamp) {
+    const body = JSON.stringify(payload);
+    return {
+        body,
+        headers: {
+            'content-type': 'application/json',
+            'arete-webhook-id': String(payload.id),
+            'arete-webhook-timestamp': String(timestamp),
+            'arete-webhook-signature': `v1=${signWebhook(secret, timestamp, body)}`,
+        },
+    };
+}
+function startEventPump(options) {
+    const { client, cursors } = options;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const subscriptions = new Map();
+    const report = (error, context) => {
+        try {
+            options.onError?.(error, context);
+        }
+        catch {
+            // A failing error hook must not stop the pump.
+        }
+    };
+    let stopped = false;
+    const follow = (instanceId) => {
+        let queue = Promise.resolve();
+        const forward = async (cursor, payload, event) => {
+            for (let failures = 0; !stopped; failures += 1) {
+                try {
+                    // Signed at each attempt, so a retry is inside the timestamp tolerance.
+                    await options.deliver(signDelivery(options.secret, payload, Math.floor(now() / 1000)), { event, instanceId });
+                    cursors.set(instanceId, cursor);
+                    return;
+                }
+                catch (error) {
+                    report(error, { phase: 'deliver', instanceId });
+                    await sleep(Math.min(1000 * 2 ** failures, 30_000));
+                }
+            }
+        };
+        const lastEventId = cursors.get(instanceId);
+        const subscription = client.events(instanceId, {
+            ...(lastEventId !== undefined ? { lastEventId } : {}),
+            onEvent(streamEvent) {
+                if (streamEvent.type !== 'emit')
+                    return;
+                const data = streamEvent.data;
+                const occurred = Date.parse(data.at);
+                if (Number.isFinite(occurred) && occurred < options.since) {
+                    queue = queue.then(() => void cursors.set(instanceId, streamEvent.id));
+                    return;
+                }
+                // The payload of a production delivery. The stream does not carry the
+                // machine's state at the emission, so `state` is absent: handlers
+                // read current state rather than trust the trigger.
+                const payload = {
+                    id: String(data.id),
+                    event: streamEvent.event,
+                    deploymentId: client.deploymentId,
+                    instanceId: data.instanceId,
+                    participantId: data.participantId,
+                    occurredAt: data.at,
+                };
+                queue = queue.then(() => forward(streamEvent.id, payload, streamEvent.event));
+            },
+            onError(error) {
+                report(error, { phase: 'stream', instanceId });
+            },
+        });
+        subscriptions.set(instanceId, subscription);
+    };
+    const refresh = async () => {
+        let cursor;
+        do {
+            const page = await client.instances.list({ limit: 100, ...(cursor !== undefined ? { cursor } : {}) });
+            for (const instance of page.instances) {
+                if (!stopped && !subscriptions.has(instance.id))
+                    follow(instance.id);
+            }
+            cursor = page.nextCursor ?? undefined;
+        } while (cursor !== undefined && !stopped);
+    };
+    const interval = options.listIntervalMs ?? 3000;
+    let timer;
+    const list = async () => {
+        try {
+            await refresh();
+        }
+        catch (error) {
+            report(error, { phase: 'list' });
+        }
+        if (!stopped)
+            timer = setTimeout(list, interval);
+    };
+    void list();
+    return {
+        get following() {
+            return subscriptions.size;
+        },
+        refresh,
+        stop() {
+            stopped = true;
+            clearTimeout(timer);
+            for (const subscription of subscriptions.values())
+                subscription.close();
+            subscriptions.clear();
+        },
+    };
+}
+
+/**
+ * A signer over a local ed25519 keypair, for development, tests and dev
+ * wallets. Production automations sign through a provider whose own policy
+ * bounds what the key may sign.
+ */
+/**
+ * A {@link ProtocolSigner} for one keypair: a Solana CLI secret key (64
+ * bytes, the seed then the public key, or the JSON array of them) or a
+ * 32-byte seed. The key is held only for signing; it never appears in
+ * errors or in the signer's properties.
+ */
+function keypairSigner(secretKey, options = {}) {
+    const bytes = Uint8Array.from(secretKey);
+    if (bytes.length !== 64 && bytes.length !== 32) {
+        throw new Error('a keypair secret key is 64 bytes (seed and public key) or a 32-byte seed');
+    }
+    const seed = bytes.slice(0, 32);
+    const publicKeyBytes = ed25519.getPublicKey(seed);
+    if (bytes.length === 64 && !bytes.subarray(32).every((byte, index) => byte === publicKeyBytes[index])) {
+        throw new Error("the keypair's public key does not match its secret key");
+    }
+    bytes.fill(0);
+    const publicKey = encodeBase58(publicKeyBytes);
+    return {
+        kind: 'keypair',
+        publicKey,
+        supportedTransactionFormats: options.transactionFormats ?? ['v1', 'v0'],
+        async canSign(wallet) {
+            return wallet === publicKey;
+        },
+        async delegationStatus(wallet) {
+            return {
+                delegated: wallet === publicKey,
+                providerPolicy: false,
+                detail: 'a local keypair has no provider policy; use it for development only',
+            };
+        },
+        async signTransactions({ wallet, transactions }) {
+            if (wallet !== publicKey) {
+                throw new Error(`this keypair signs for ${publicKey}, not ${wallet}`);
+            }
+            return transactions.map(({ index, transactionBase64 }) => {
+                const wire = decodeBase64(transactionBase64);
+                if (wire === null)
+                    throw new Error(`prepared transaction ${index} is not base64`);
+                const decoded = decodeTransaction(wire);
+                const required = Math.min(decoded.requiredSignatures, decoded.signatures.length);
+                const slot = decoded.staticKeys.slice(0, required).indexOf(publicKey);
+                if (slot < 0) {
+                    throw new Error(`the wallet ${publicKey} is not a required signer of transaction ${index}`);
+                }
+                const signature = ed25519.sign(wire.subarray(decoded.message.start, decoded.message.end), seed);
+                const signed = wire.slice();
+                signed.set(signature, decoded.signatureOffset + 64 * slot);
+                return encodeBase64(signed);
+            });
+        },
+    };
+}
+
+/**
+ * Signs for every dev wallet of the project (`.arete/dev/wallets/*.json`,
+ * the keypairs `a4 dev wallet` creates), so several dev wallets can stand in
+ * for users. Wallets created while it runs are picked up at the next
+ * signature. Dev environments only: the keys are plain files.
+ */
+/** The dev wallets in `dir`, by public key and by file name. */
+function readDevWallets(dir) {
+    const byAddress = new Map();
+    const byName = new Map();
+    let files;
+    try {
+        files = readdirSync(dir).filter((file) => file.endsWith('.json'));
+    }
+    catch {
+        files = [];
+    }
+    for (const file of files) {
+        try {
+            const secret = Uint8Array.from(JSON.parse(readFileSync(join(dir, file), 'utf8')));
+            const seed = secret.slice(0, 32);
+            const signer = {
+                ...keypairSigner(secret),
+                signMessage: (message) => ed25519.sign(message, seed),
+            };
+            secret.fill(0);
+            byAddress.set(signer.publicKey, signer);
+            byName.set(file.slice(0, -'.json'.length), signer);
+        }
+        catch {
+            // Not a keypair file; skipped.
+        }
+    }
+    return { byAddress, byName };
+}
+function devWalletsSigner(dir) {
+    const lookup = (wallet) => readDevWallets(dir).byAddress.get(wallet);
+    return {
+        kind: 'dev-wallets',
+        supportedTransactionFormats: ['v1', 'v0'],
+        async canSign(wallet) {
+            return lookup(wallet) !== undefined;
+        },
+        async delegationStatus(wallet) {
+            return {
+                delegated: lookup(wallet) !== undefined,
+                providerPolicy: false,
+                detail: 'a dev wallet: a4 dev holds its key, for the dev environment only',
+            };
+        },
+        async signTransactions(input) {
+            const signer = lookup(input.wallet);
+            if (!signer)
+                throw new Error(`${input.wallet} is not a dev wallet of this project`);
+            return signer.signTransactions(input);
+        },
+    };
+}
+
+/**
+ * `arete-automations dev`: what `a4 dev up` runs for `[dev.automations]` in
+ * arete.toml. It loads the project's automations definition and runs it
+ * against the dev environment `.arete/dev/session.json` describes:
+ *
+ * - the client the definition's protocol module carries (the one `a4 dev`
+ *   generated, so its deployment is the dev environment's);
+ * - a signer for every dev wallet, and a policy for that deployment only;
+ * - a simulator on `a4 dev up`'s local RPC (the fork's state);
+ * - a memory store saved under `.arete/dev/automations/`, so jobs, consent
+ *   and spending survive the restarts that reload the handlers;
+ * - the environment's protocol events, forwarded as signed webhook
+ *   deliveries (dev environments send no webhooks);
+ * - view sources on the environment's stack.
+ *
+ * With `forward` instead of an entry it only forwards the signed deliveries
+ * to the app's own webhook route. `a4 dev up` restarts the process when the
+ * handlers or the generated client change.
+ */
+const sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+/** The config from `a4 dev up`'s environment variables. */
+function configFromEnv(env) {
+    const need = (name) => {
+        const value = env[name];
+        if (!value)
+            throw new Error(`${name} is not set; a4 dev up runs this command`);
+        return value;
+    };
+    const entry = env.ARETE_AUTOMATIONS_ENTRY || undefined;
+    const forward = env.ARETE_AUTOMATIONS_FORWARD || undefined;
+    if (!entry === !forward)
+        throw new Error('set exactly one of ARETE_AUTOMATIONS_ENTRY and ARETE_AUTOMATIONS_FORWARD');
+    return {
+        root: need('ARETE_PROJECT_ROOT'),
+        ...(entry ? { entry } : {}),
+        ...(forward ? { forward } : {}),
+        apiKey: need('ARETE_API_KEY'),
+        webhookSecret: need('ARETE_WEBHOOK_SECRET'),
+        port: Number(env.ARETE_AUTOMATIONS_PORT ?? '0'),
+    };
+}
+async function readSession(root, log) {
+    const path = join(root, '.arete', 'dev', 'session.json');
+    let waiting = false;
+    for (;;) {
+        try {
+            const session = JSON.parse(readFileSync(path, 'utf8'));
+            if (session.deploymentId)
+                return session;
+        }
+        catch {
+            // Not written yet.
+        }
+        if (!waiting)
+            log('waiting for the protocol to deploy to the dev environment');
+        waiting = true;
+        await sleep(2000);
+    }
+}
+/**
+ * tsx's `tsImport`, from the project that holds `entry`: resolved from the
+ * entry's directory, since a package manager that keeps each package's
+ * dependencies apart (pnpm) does not let this package see the project's
+ * tsx. `undefined` without tsx: Node's own type stripping (22.18+, 23.6+)
+ * is the fallback.
+ */
+async function projectTsImport(entry) {
+    let manifestPath;
+    try {
+        manifestPath = createRequire(entry).resolve('tsx/package.json');
+    }
+    catch {
+        return undefined;
+    }
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    const target = manifest.exports?.['./esm/api']?.import;
+    const file = typeof target === 'string' ? target : target?.default;
+    if (!file)
+        return undefined;
+    const api = (await import(pathToFileURL(join(dirname(manifestPath), file)).href));
+    return api.tsImport;
+}
+/** Import the definition module; TypeScript through the project's tsx when it is installed. */
+async function loadDefinition(entry) {
+    const url = pathToFileURL(entry).href;
+    let module;
+    if (/\.[cm]?tsx?$/.test(entry)) {
+        const tsImport = await projectTsImport(entry);
+        try {
+            module = tsImport ? await tsImport(url, import.meta.url) : (await import(url));
+        }
+        catch (error) {
+            if (!tsImport) {
+                throw new Error(`could not load ${entry}: install tsx (npm install --save-dev tsx) to run TypeScript (${error.message})`);
+            }
+            throw error;
+        }
+    }
+    else {
+        module = (await import(url));
+    }
+    // In a project without `"type": "module"` tsx loads the entry as
+    // CommonJS, so its default export arrives one level down.
+    const nested = module.default?.default;
+    const definition = [module.default, nested, module.automations].find(isAutomationsDefinition);
+    if (!definition) {
+        throw new Error(`${entry} must export its defineAutomations(...) as the default export`);
+    }
+    return definition;
+}
+/** How long `connect` waits for the dev environment's stack to be found. */
+const STACK_WAIT_MS = 20_000;
+/**
+ * Stacks of the dev environment connect to it, with session tokens minted
+ * from the API key. The session is read at each connect, and a connect made
+ * before `a4 dev up` has found the environment's stack waits for it, so a
+ * stack still starting is not mistaken for one the environment lacks. (`a4
+ * dev up` also restarts the runner when the deployment or stack changes.)
+ */
+function devStackConnector(readCurrent, apiKey, log, waitMs = STACK_WAIT_MS) {
+    const warned = new Set();
+    return async (stack) => {
+        let session = readCurrent();
+        if (!session?.stack) {
+            log(`waiting for the dev environment's stack before connecting ${stack.name}`);
+            for (let waited = 0; waited < waitMs && !session?.stack; waited += 500) {
+                await sleep(500);
+                session = readCurrent();
+            }
+        }
+        if (session?.stack && session.stackWsUrl && session.deploymentId && stack.name === session.stack) {
+            const { stackWsUrl: url, sessionEndpoint, deploymentId } = session;
+            return Arete.connect(stack, {
+                url,
+                auth: {
+                    getToken: async () => {
+                        const response = await fetch(sessionEndpoint, {
+                            method: 'POST',
+                            headers: { authorization: `Bearer ${apiKey}`, 'content-type': 'application/json' },
+                            body: JSON.stringify({ websocket_url: url, protocolDeploymentId: deploymentId }),
+                        });
+                        if (!response.ok)
+                            throw new Error(`minting a stack session failed: HTTP ${response.status}`);
+                        const body = (await response.json());
+                        return { token: body.token, ...(body.expires_at !== undefined ? { expiresAt: body.expires_at } : {}) };
+                    },
+                },
+            });
+        }
+        if (!warned.has(stack.name)) {
+            warned.add(stack.name);
+            log(`stack ${stack.name} is not in the dev environment; its sources read the published stack's data`);
+        }
+        return Arete.connect(stack);
+    };
+}
+function readJson(path, fallback) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+function describe(outcome) {
+    const where = outcome.instanceId ? ` on ${outcome.instanceId}` : '';
+    const reason = outcome.reason ? ` (${outcome.reason})` : '';
+    const signatures = outcome.signatures.filter(Boolean);
+    return `${outcome.state}: ${outcome.step} for ${outcome.wallet}${where}: ${outcome.code}${reason}${signatures.length ? ` ${signatures.join(', ')}` : ''}`;
+}
+/** Forward-only mode needs a client for listing instances and their events, not a protocol module. */
+function bareClient(session, apiKey, newClient) {
+    const definition = {
+        kind: 'protocol',
+        name: session.protocolSlug ?? 'protocol',
+        deployment: {
+            deploymentId: session.deploymentId,
+            access: 'private',
+            apiUrl: `${session.apiUrl.replace(/\/$/, '')}/api`,
+            sessionEndpoint: session.sessionEndpoint,
+            environment: 'dev',
+        },
+        steps: {},
+        events: {},
+    };
+    return newClient(definition, apiKey);
+}
+async function runDev(config, log = (line) => console.log(line), overrides = {}) {
+    const newClient = overrides.createClient ?? ((definition, apiKey) => createProtocolClient(definition, { auth: { secretKey: apiKey } }));
+    const devDir = join(config.root, '.arete', 'dev');
+    const stateDir = join(devDir, 'automations');
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const session = await readSession(config.root, log);
+    // Events before the first run are history, not triggers.
+    const sincePath = join(stateDir, 'since');
+    if (!existsSync(sincePath))
+        writeFileSync(sincePath, String(Date.now()));
+    const recorded = Number(readFileSync(sincePath, 'utf8').trim());
+    const since = Number.isFinite(recorded) ? recorded : Date.now();
+    const cursorsPath = join(stateDir, 'cursors.json');
+    const cursors = new Map(Object.entries(readJson(cursorsPath, {})));
+    const saveCursors = () => writeFileSync(cursorsPath, JSON.stringify(Object.fromEntries(cursors), null, 2));
+    let automations = null;
+    let pumpClient;
+    let saveStore = () => { };
+    let deliver;
+    if (config.entry) {
+        const entry = resolve(config.root, config.entry);
+        const definition = await loadDefinition(entry);
+        const client = newClient(definition.protocol, config.apiKey);
+        if (clientCluster(client) !== 'dev') {
+            throw new Error(`${entry} imports the published client (deployment ${client.deploymentId}), which targets mainnet. ` +
+                'a4 dev runs automations against the dev environment only: `a4 dev sdk` generates its client.');
+        }
+        // A stale client would run the workers and the event pump against the
+        // old deployment. a4 dev up restarts the runner once the client is
+        // regenerated (it watches the generated client).
+        if (client.deploymentId !== session.deploymentId) {
+            throw new Error(`the generated client names deployment ${client.deploymentId}, but the dev environment runs ${session.deploymentId}; ` +
+                'run `a4 dev sdk` to regenerate it');
+        }
+        // One store per deployment: a redeploy to a new deployment starts afresh
+        // and keeps the previous state beside it.
+        const storePath = join(stateDir, 'store.bin');
+        let state;
+        if (existsSync(storePath)) {
+            state = deserialize(readFileSync(storePath));
+            if (state.deployment !== null && state.deployment !== client.deploymentId) {
+                renameSync(storePath, join(stateDir, `store-${state.deployment}.bin`));
+                log(`the deployment changed; earlier consent and jobs are kept in store-${state.deployment}.bin`);
+                state = undefined;
+            }
+        }
+        const store = memoryStore(state ? { state } : {});
+        let saved = state ? serialize(state) : Buffer.alloc(0);
+        saveStore = () => {
+            const next = serialize(memoryStoreState(store));
+            if (!next.equals(saved)) {
+                writeFileSync(`${storePath}.tmp`, next, { mode: 0o600 });
+                renameSync(`${storePath}.tmp`, storePath);
+                saved = next;
+            }
+        };
+        const walletsDir = join(devDir, 'wallets');
+        const running = createAutomations({
+            client,
+            signer: devWalletsSigner(walletsDir),
+            policy: definePolicy({
+                maxSolPerTransaction: '1',
+                ...definition.policy,
+                deployments: [client.deploymentId],
+                clusters: ['dev'],
+            }),
+            simulator: rpcSimulator(session.rpcUrl),
+            store,
+            consent: { domain: 'localhost' },
+            onOutcome: (outcome) => log(describe(outcome)),
+            onError: (error, context) => log(`error (${context.phase}${context.jobId ? ` ${context.jobId}` : ''}): ${error?.message ?? error}`),
+        });
+        const sessionPath = join(devDir, 'session.json');
+        await running.use(definition, {
+            connect: devStackConnector(() => readJson(sessionPath, null), config.apiKey, log),
+        });
+        running.start({ pollInterval: '1s' });
+        automations = running;
+        pumpClient = client;
+        deliver = async (body, headers) => {
+            const result = await running.acceptWebhook(body, headers, { secret: config.webhookSecret });
+            if (result.status !== 200)
+                throw new Error(`the delivery was refused: ${JSON.stringify(result.body)}`);
+        };
+    }
+    else {
+        const url = config.forward;
+        pumpClient = bareClient(session, config.apiKey, newClient);
+        deliver = async (body, headers) => {
+            const response = await fetch(url, { method: 'POST', headers, body });
+            if (!response.ok)
+                throw new Error(`${url} answered HTTP ${response.status}`);
+        };
+    }
+    const pump = startEventPump({
+        client: pumpClient,
+        secret: config.webhookSecret,
+        cursors,
+        since,
+        deliver: async (delivery, event) => {
+            await deliver(delivery.body, delivery.headers);
+            if (!automations)
+                log(`forwarded ${event.event} on ${event.instanceId}`);
+        },
+        onError: (error, context) => log(`error (${context.phase}${context.instanceId ? ` ${context.instanceId}` : ''}): ${error?.message ?? error}`),
+    });
+    const persist = setInterval(() => {
+        try {
+            saveStore();
+            saveCursors();
+        }
+        catch (error) {
+            log(`could not save the automations state: ${error.message}`);
+        }
+    }, 1000);
+    // `a4 dev consent` reads the token from runner.json (mode 0600); a web page
+    // that reaches the loopback port cannot.
+    const token = randomBytes(32).toString('hex');
+    const server = await startControl(config.port, token, automations, pumpClient.deploymentId, join(devDir, 'wallets'), log);
+    const port = server.address().port;
+    writeFileSync(join(stateDir, 'runner.json'), JSON.stringify({ pid: process.pid, port, token }), { mode: 0o600 });
+    log(automations
+        ? `running ${config.entry} against deployment ${session.deploymentId}`
+        : `forwarding events of deployment ${session.deploymentId} to ${config.forward}`);
+    return {
+        port,
+        async stop() {
+            // `a4 dev up` kills the runner 5s after SIGTERM: save first, let the
+            // workers wind down for at most 3s (saving as they go), save again.
+            pump.stop();
+            server.closeAllConnections();
+            server.close();
+            const save = () => {
+                try {
+                    saveStore();
+                    saveCursors();
+                }
+                catch (error) {
+                    log(`could not save the automations state: ${error.message}`);
+                }
+            };
+            save();
+            await Promise.race([automations?.stop(), sleep(3000)]);
+            clearInterval(persist);
+            save();
+        },
+    };
+}
+async function startControl(port, token, automations, deploymentId, walletsDir, log) {
+    const json = (res, status, body) => {
+        res.writeHead(status, { 'content-type': 'application/json' });
+        res.end(JSON.stringify(body, (_key, value) => (typeof value === 'bigint' ? value.toString() : value)));
+    };
+    const readBody = async (req) => {
+        const chunks = [];
+        for await (const chunk of req)
+            chunks.push(chunk);
+        return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+    };
+    const server = createServer(async (req, res) => {
+        try {
+            if (req.method === 'GET' && req.url === '/health')
+                return json(res, 200, { ok: true, handlers: automations !== null });
+            if (req.method !== 'POST' || req.url !== '/consent')
+                return json(res, 404, { error: 'not-found' });
+            // Only `a4 dev consent`: no browser origin, JSON only, and the token.
+            if (req.headers.origin !== undefined)
+                return json(res, 403, { error: 'forbidden' });
+            if (!req.headers['content-type']?.startsWith('application/json'))
+                return json(res, 415, { error: 'json-only' });
+            const expected = Buffer.from(`Bearer ${token}`);
+            const given = Buffer.from(req.headers.authorization ?? '');
+            if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
+                return json(res, 401, { error: 'unauthorized' });
+            }
+            if (!automations)
+                return json(res, 409, { error: 'forwarding only: consent lives in your app' });
+            const request = await readBody(req);
+            const wallets = readDevWallets(walletsDir);
+            const signer = wallets.byName.get(request.wallet) ?? wallets.byAddress.get(request.wallet);
+            if (!signer)
+                return json(res, 400, { error: `${request.wallet} is not a dev wallet (a4 dev wallet <name> creates one)` });
+            const wallet = signer.publicKey;
+            if (request.revoke) {
+                const revoked = await automations.consent.revoke({
+                    wallet,
+                    ...(request.steps.length ? { steps: request.steps } : {}),
+                    ...(request.instanceId ? { instanceId: request.instanceId } : {}),
+                });
+                log(`revoked ${revoked} consent grant(s) of ${wallet}`);
+                return json(res, 200, { wallet, revoked });
+            }
+            const fields = {
+                wallet,
+                deploymentId,
+                steps: request.steps,
+                limits: (request.limits ?? {}),
+                ...(request.params ? { params: request.params } : {}),
+                ...(request.instanceId ? { instanceId: request.instanceId } : {}),
+                expiresAt: request.expiresAt ?? Date.now() + 30 * 86_400_000,
+            };
+            const proof = await automations.consent.proofMessage(fields);
+            // The dev wallet signs the message as the user's wallet would.
+            const signature = encodeBase58(signer.signMessage(proof.bytes));
+            const { grant, warnings } = await automations.consent.grant({
+                ...fields,
+                nonce: proof.nonce,
+                issuedAt: proof.issuedAt,
+                signature,
+            });
+            log(`${wallet} consented to ${request.steps.join(', ')}`);
+            return json(res, 200, { grant, warnings, message: proof.message });
+        }
+        catch (error) {
+            json(res, 400, { error: error.message });
+        }
+    });
+    await new Promise((done, fail) => {
+        server.once('error', fail);
+        server.listen(port, '127.0.0.1', () => done());
+    });
+    return server;
+}
+
+var runner = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  configFromEnv: configFromEnv,
+  devStackConnector: devStackConnector,
+  loadDefinition: loadDefinition,
+  projectTsImport: projectTsImport,
+  runDev: runDev
+});