@verax-ai/proxy 0.1.1 → 0.1.3

package/dist/policy.js

@@ -197,7 +197,15 @@ export function loadPolicy(json) {
             if (id === null)
                 return null;
             const found = document.rules.find((r) => r.id === id);
-            return found ? { id: found.id, text: found.text } : null;
+            return found
+                ? {
+                    id: found.id,
+                    text: found.text,
+                    ...(found.spend?.dailyMaxMinor !== undefined
+                        ? { spend: { dailyMaxMinor: found.spend.dailyMaxMinor } }
+                        : {}),
+                }
+                : null;
         },
         evaluate(call, principal, ctx) {
             if (call.name === "pay") {

package/dist/proxy.js

@@ -1,8 +1,10 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { signDecisionRecord } from "@cedulon/core";
-import { approvePending, approvalsLogFor, drainApprovalCommands } from "./approvals.js";
+import { approvePending, approvalsLogFor, createApprovalBudgetGuard, drainApprovalCommands, spentTodayMinorOf, } from "./approvals.js";
+import { SerialQueue } from "./serial-queue.js";
 import { diskProbe } from "./disk.js";
+import { markEnded, markStarted, startedWithoutEnd } from "./in-flight-log.js";
 import { effectDescriptor, sha256Canonical } from "./hash.js";
 import { inputsLogFor } from "./inputs.js";
 import { countedWork, hasPrimaryEffect, lookupDecisionByRef, lookupReauthByHash, lookupResolvedBy, noteResolution, noteTenantRef, } from "./ledger.js";
@@ -129,6 +131,13 @@ function toolCallOf(call) {
 export function createProxy(deps) {
     const inputsLog = deps.inputsLog ?? inputsLogFor(deps.ledger);
     const approvals = approvalsLogFor(deps.ledger);
+    const admission = new SerialQueue();
+    const inFlight = new Map();
+    const budgetGuard = createApprovalBudgetGuard({
+        policy: deps.policy,
+        approvals,
+        now: deps.now,
+    });
     deps.ledger.effectSigner = deps.effectSigner;
     const ledgerDir = deps.ledger.dir;
     const stateDir = typeof ledgerDir === "string" ? ledgerDir : null;
@@ -192,30 +201,6 @@ export function createProxy(deps) {
             return "daily-limited";
         return null;
     }
-    function utcDayStart(ms) {
-        const d = new Date(ms);
-        return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
-    }
-    function spentTodayMinorOf(rows, nowMs, currency) {
-        const start = utcDayStart(nowMs);
-        const end = start + 86_400_000;
-        let sum = 0;
-        for (const row of rows) {
-            if (row.subject !== "spend")
-                continue;
-            if (row.status !== "pending" && row.status !== "approved")
-                continue;
-            const created = row.createdAtMs ?? row.expiresAtMs - deps.policy.approvalTtlMs;
-            if (created < start || created >= end)
-                continue;
-            if (row.args.currency !== currency)
-                continue;
-            const amt = row.args.amountMinor;
-            if (typeof amt === "number")
-                sum += amt;
-        }
-        return sum;
-    }
     async function spendReauth(requestHash, inputs, timestampMs, subject) {
         const existingReauth = await lookupReauthByHash(deps.ledger, requestHash);
         if (existingReauth)
@@ -309,6 +294,43 @@ export function createProxy(deps) {
             reasonCode: null,
         };
     }
+    function launchInner(dispatchedCall, principal, allowRef, flightKey) {
+        // Written before the tool runs, removed after the effect is recorded. A
+        // mark that survives the process is what tells a restarted body that this
+        // ref was already started (in-flight-log.ts).
+        if (stateDir !== null)
+            markStarted(stateDir, flightKey, dispatchedCall.name);
+        const work = runInner(dispatchedCall, principal, allowRef);
+        inFlight.set(flightKey, work);
+        return { kind: "run", work, key: flightKey, replayRef: allowRef };
+    }
+    async function retryPolicyDeny(dispatchedCall, principal, requestHash, inputs, timestampMs, subject, scopedRef) {
+        let spendCtx;
+        if (dispatchedCall.name === "spend") {
+            const approvalRows = await approvals.listAll();
+            spendCtx = {
+                spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency, deps.policy.approvalTtlMs),
+            };
+        }
+        const verdict = deps.policy.evaluate(dispatchedCall, principal, spendCtx);
+        if (verdict.decision !== "deny")
+            return null;
+        const denyRef = deps.nonce();
+        await writeRecord({
+            decision: "deny",
+            reasonCode: verdict.reasonCode,
+            ref: denyRef,
+            requestHash,
+            inputs: {
+                ...inputs,
+                approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+            },
+            effectHash: null,
+            subject,
+            timestampMs,
+        });
+        return denied(verdict.reasonCode, denyRef);
+    }
     return {
         approvals,
         inputsLog,
@@ -330,6 +352,7 @@ export function createProxy(deps) {
                         policyHash: defer.policyHash,
                         approvals,
                         inputsLog,
+                        budgetGuard,
                     });
                 });
             }
@@ -366,168 +389,245 @@ export function createProxy(deps) {
                 return denied("ledger-disk-low", ref);
             }
             const given = readRef(call.arguments);
-            if (given === "invalid") {
-                const ref = deps.nonce();
-                await writeRecord({
-                    decision: "deny",
-                    reasonCode: "ref-invalid",
-                    ref,
-                    requestHash,
-                    inputs: resolved.inputs,
-                    effectHash: null,
-                    subject: call.name,
-                    timestampMs,
-                });
-                return denied("ref-invalid", ref);
-            }
-            if (typeof given === "string") {
-                // The ledger, the approvals snapshot and the resolution index all key on the
-                // scoped ref. The brain only ever sees and resends the raw `_ref` it chose.
-                const scopedRef = scopedClaimsRef(principal, given);
-                const existing = await lookupDecisionByRef(deps.ledger, given, tenantKey(principal));
-                if (existing) {
-                    if (existing.requestHash !== requestHash) {
-                        const ref = deps.nonce();
-                        await writeRecord({
-                            decision: "deny",
-                            reasonCode: "ref-reuse",
-                            ref,
-                            requestHash,
-                            inputs: resolved.inputs,
-                            effectHash: null,
-                            subject: call.name,
-                            timestampMs,
-                        });
-                        return denied("ref-reuse", ref);
-                    }
-                    if (existing.decision === "defer") {
-                        const snap = await approvals.get(scopedRef);
-                        const boundHit = lookupResolvedBy(deps.ledger, scopedRef);
-                        if (boundHit?.kind === "expired") {
-                            if (snap?.status === "pending")
-                                await approvals.updateStatus(scopedRef, "expired");
-                            return denied("expired", boundHit.ref);
-                        }
-                        if (snap && timestampMs > snap.expiresAtMs) {
-                            const expireRef = deps.nonce();
+            const plan = await admission.enqueue(async () => {
+                if (given === "invalid") {
+                    const ref = deps.nonce();
+                    await writeRecord({
+                        decision: "deny",
+                        reasonCode: "ref-invalid",
+                        ref,
+                        requestHash,
+                        inputs: resolved.inputs,
+                        effectHash: null,
+                        subject: call.name,
+                        timestampMs,
+                    });
+                    return { kind: "done", result: denied("ref-invalid", ref) };
+                }
+                if (typeof given === "string") {
+                    // The ledger, the approvals snapshot and the resolution index all key on the
+                    // scoped ref. The brain only ever sees and resends the raw `_ref` it chose.
+                    const scopedRef = scopedClaimsRef(principal, given);
+                    const existing = await lookupDecisionByRef(deps.ledger, given, tenantKey(principal));
+                    if (existing) {
+                        if (existing.requestHash !== requestHash) {
+                            const ref = deps.nonce();
                             await writeRecord({
                                 decision: "deny",
-                                reasonCode: "expired",
-                                ref: expireRef,
+                                reasonCode: "ref-reuse",
+                                ref,
                                 requestHash,
-                                inputs: {
-                                    ...resolved.inputs,
-                                    approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
-                                },
+                                inputs: resolved.inputs,
                                 effectHash: null,
                                 subject: call.name,
                                 timestampMs,
                             });
-                            await approvals.updateStatus(scopedRef, "expired");
-                            return denied("expired", expireRef);
+                            return { kind: "done", result: denied("ref-reuse", ref) };
                         }
-                        const allowRef = snap?.allowRef ?? (boundHit?.kind === "allow" ? boundHit.ref : undefined);
-                        const allow = allowRef ? await lookupDecisionByRef(deps.ledger, allowRef) : null;
-                        if (allow?.ref && allow.decision === "allow" && allow.reasonCode === "approved-by-operator") {
-                            const bound = await inputsLog.get(allow.ref);
-                            if (bound?.approver?.resolves && bound.approver.resolves !== scopedRef) {
-                                return deferred(given);
+                        if (existing.decision === "defer") {
+                            const snap = await approvals.get(scopedRef);
+                            const boundHit = lookupResolvedBy(deps.ledger, scopedRef);
+                            if (boundHit?.kind === "expired") {
+                                if (snap?.status === "pending")
+                                    await approvals.updateStatus(scopedRef, "expired");
+                                return { kind: "done", result: denied("expired", boundHit.ref) };
                             }
-                            if (!snap?.allowRef) {
-                                await approvals.updateStatus(scopedRef, "approved", { allowRef: allow.ref });
+                            if (snap && timestampMs > snap.expiresAtMs) {
+                                const expireRef = deps.nonce();
+                                await writeRecord({
+                                    decision: "deny",
+                                    reasonCode: "expired",
+                                    ref: expireRef,
+                                    requestHash,
+                                    inputs: {
+                                        ...resolved.inputs,
+                                        approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+                                    },
+                                    effectHash: null,
+                                    subject: call.name,
+                                    timestampMs,
+                                });
+                                await approvals.updateStatus(scopedRef, "expired");
+                                return { kind: "done", result: denied("expired", expireRef) };
                             }
-                            if (await hasPrimaryEffect(deps.ledger, allow.ref))
-                                return allowedReplay(allow.ref);
-                            if (allow.subject === "spend") {
-                                return spendReauth(requestHash, resolved.inputs, timestampMs, call.name);
+                            const allowRef = snap?.allowRef ?? (boundHit?.kind === "allow" ? boundHit.ref : undefined);
+                            const allow = allowRef ? await lookupDecisionByRef(deps.ledger, allowRef) : null;
+                            if (allow?.ref && allow.decision === "allow" && allow.reasonCode === "approved-by-operator") {
+                                const bound = await inputsLog.get(allow.ref);
+                                if (bound?.approver?.resolves && bound.approver.resolves !== scopedRef) {
+                                    return { kind: "done", result: deferred(given) };
+                                }
+                                if (!snap?.allowRef) {
+                                    await approvals.updateStatus(scopedRef, "approved", { allowRef: allow.ref });
+                                }
+                                if (await hasPrimaryEffect(deps.ledger, allow.ref)) {
+                                    return { kind: "done", result: allowedReplay(allow.ref) };
+                                }
+                                if (allow.subject === "spend") {
+                                    return {
+                                        kind: "done",
+                                        result: await spendReauth(requestHash, resolved.inputs, timestampMs, call.name),
+                                    };
+                                }
+                                const policyDeny = await retryPolicyDeny(dispatched, principal, requestHash, resolved.inputs, timestampMs, call.name, scopedRef);
+                                if (policyDeny)
+                                    return { kind: "done", result: policyDeny };
+                                const flying = inFlight.get(scopedRef);
+                                if (flying)
+                                    return { kind: "wait", work: flying, replayRef: allow.ref };
+                                // An approved allow means "the operator said yes", not "it ran",
+                                // so the first retry after an approval is the first run. Only a
+                                // mark left on disk says a run was already started and never
+                                // finished — that one cannot be run again.
+                                if (stateDir !== null && startedWithoutEnd(stateDir, scopedRef)) {
+                                    const unknownRef = deps.nonce();
+                                    await writeRecord({
+                                        decision: "deny",
+                                        reasonCode: "outcome-unknown",
+                                        ref: unknownRef,
+                                        requestHash,
+                                        inputs: {
+                                            ...resolved.inputs,
+                                            approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+                                        },
+                                        effectHash: null,
+                                        subject: call.name,
+                                        timestampMs,
+                                    });
+                                    return { kind: "done", result: denied("outcome-unknown", unknownRef) };
+                                }
+                                return launchInner(dispatched, principal, allow.ref, scopedRef);
                             }
-                            return runInner(dispatched, principal, allow.ref);
+                            return { kind: "done", result: deferred(given) };
                         }
-                        return deferred(given);
-                    }
-                    if (existing.decision === "deny") {
-                        return denied(existing.reasonCode, given, call);
-                    }
-                    if (existing.decision === "allow" && existing.ref) {
-                        if (await hasPrimaryEffect(deps.ledger, existing.ref)) {
-                            return allowedReplay(existing.ref);
+                        if (existing.decision === "deny") {
+                            return { kind: "done", result: denied(existing.reasonCode, given, call) };
                         }
-                        if (existing.subject === "spend") {
-                            return spendReauth(requestHash, resolved.inputs, timestampMs, call.name);
+                        if (existing.decision === "allow" && existing.ref) {
+                            if (await hasPrimaryEffect(deps.ledger, existing.ref)) {
+                                return { kind: "done", result: allowedReplay(existing.ref) };
+                            }
+                            if (existing.subject === "spend") {
+                                return {
+                                    kind: "done",
+                                    result: await spendReauth(requestHash, resolved.inputs, timestampMs, call.name),
+                                };
+                            }
+                            const policyDeny = await retryPolicyDeny(dispatched, principal, requestHash, resolved.inputs, timestampMs, call.name, scopedRef);
+                            if (policyDeny)
+                                return { kind: "done", result: policyDeny };
+                            const flying = inFlight.get(scopedRef);
+                            if (flying)
+                                return { kind: "wait", work: flying, replayRef: existing.ref };
+                            const denyRef = deps.nonce();
+                            await writeRecord({
+                                decision: "deny",
+                                reasonCode: "outcome-unknown",
+                                ref: denyRef,
+                                requestHash,
+                                inputs: {
+                                    ...resolved.inputs,
+                                    approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+                                },
+                                effectHash: null,
+                                subject: call.name,
+                                timestampMs,
+                            });
+                            return { kind: "done", result: denied("outcome-unknown", denyRef) };
                         }
-                        return runInner(dispatched, principal, existing.ref);
                     }
                 }
-            }
-            let spendCtx;
-            if (dispatched.name === "spend") {
-                const approvalRows = await approvals.listAll();
-                spendCtx = {
-                    spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency),
-                };
-            }
-            const verdict = deps.policy.evaluate(dispatched, principal, spendCtx);
-            let reasonCode = resolved.reasonCode ?? verdict.reasonCode;
-            let decision = resolved.reasonCode ? "deny" : verdict.decision;
-            const bound = rateBound(timestampMs, decision === "allow" || decision === "defer");
-            if (bound) {
-                decision = "deny";
-                reasonCode = bound;
-            }
-            if (!bound &&
-                decision === "allow" &&
-                deps.checkTenantMismatch &&
-                (await deps.checkTenantMismatch(dispatched, principal))) {
-                decision = "deny";
-                reasonCode = "tenant-mismatch";
-            }
-            const ref = typeof given === "string" ? scopedClaimsRef(principal, given) : deps.nonce();
-            // What the brain is told: its own `_ref`, so a retry carries the same key back.
-            const shown = typeof given === "string" ? given : ref;
-            const allow = decision === "allow";
-            await writeRecord({
-                decision,
-                reasonCode,
-                ref,
-                requestHash,
-                inputs: resolved.inputs,
-                effectHash: allow ? sha256Canonical(effectDescriptor(dispatched.name, dispatched.arguments)) : null,
-                subject: call.name,
-                timestampMs,
-            });
-            if (typeof given === "string") {
-                noteTenantRef(deps.ledger, tenantKey(principal), given);
-            }
-            if (decision === "defer") {
-                const rule = deps.policy.rule(verdict.rule);
-                const amount = dispatched.name === "spend" ? dispatched.arguments.amountMinor : dispatched.arguments.amount;
-                const payee = dispatched.arguments.payee;
-                const currency = dispatched.arguments.currency;
-                await approvals.append({
+                let spendCtx;
+                if (dispatched.name === "spend") {
+                    const approvalRows = await approvals.listAll();
+                    spendCtx = {
+                        spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency, deps.policy.approvalTtlMs),
+                    };
+                }
+                const verdict = deps.policy.evaluate(dispatched, principal, spendCtx);
+                let reasonCode = resolved.reasonCode ?? verdict.reasonCode;
+                let decision = resolved.reasonCode ? "deny" : verdict.decision;
+                const bound = rateBound(timestampMs, decision === "allow" || decision === "defer");
+                if (bound) {
+                    decision = "deny";
+                    reasonCode = bound;
+                }
+                if (!bound &&
+                    decision === "allow" &&
+                    deps.checkTenantMismatch &&
+                    (await deps.checkTenantMismatch(dispatched, principal))) {
+                    decision = "deny";
+                    reasonCode = "tenant-mismatch";
+                }
+                const ref = typeof given === "string" ? scopedClaimsRef(principal, given) : deps.nonce();
+                // What the brain is told: its own `_ref`, so a retry carries the same key back.
+                const shown = typeof given === "string" ? given : ref;
+                const allow = decision === "allow";
+                await writeRecord({
+                    decision,
+                    reasonCode,
                     ref,
                     requestHash,
-                    subject: dispatched.name,
-                    args: dispatched.arguments,
-                    ruleId: verdict.rule,
-                    ruleText: rule?.text ?? null,
-                    inputsSummary: {
-                        count: resolved.inputs.inputs.length,
-                        ids: resolved.inputs.inputs.map((i) => i.id),
-                    },
-                    ...(amount !== undefined ? { amount } : {}),
-                    ...(payee !== undefined ? { payee } : {}),
-                    ...(currency !== undefined ? { currency } : {}),
-                    createdAtMs: timestampMs,
-                    expiresAtMs: timestampMs + deps.policy.approvalTtlMs,
-                    status: "pending",
-                    brain: principal.brain,
+                    inputs: resolved.inputs,
+                    effectHash: allow ? sha256Canonical(effectDescriptor(dispatched.name, dispatched.arguments)) : null,
+                    subject: call.name,
+                    timestampMs,
                 });
-                return deferred(shown);
+                if (typeof given === "string") {
+                    noteTenantRef(deps.ledger, tenantKey(principal), given);
+                }
+                if (decision === "defer") {
+                    const rule = deps.policy.rule(verdict.rule);
+                    const amount = dispatched.name === "spend" ? dispatched.arguments.amountMinor : dispatched.arguments.amount;
+                    const payee = dispatched.arguments.payee;
+                    const currency = dispatched.arguments.currency;
+                    await approvals.append({
+                        ref,
+                        requestHash,
+                        subject: dispatched.name,
+                        args: dispatched.arguments,
+                        ruleId: verdict.rule,
+                        ruleText: rule?.text ?? null,
+                        inputsSummary: {
+                            count: resolved.inputs.inputs.length,
+                            ids: resolved.inputs.inputs.map((i) => i.id),
+                        },
+                        ...(amount !== undefined ? { amount } : {}),
+                        ...(payee !== undefined ? { payee } : {}),
+                        ...(currency !== undefined ? { currency } : {}),
+                        createdAtMs: timestampMs,
+                        expiresAtMs: timestampMs + deps.policy.approvalTtlMs,
+                        status: "pending",
+                        brain: principal.brain,
+                    });
+                    return { kind: "done", result: deferred(shown) };
+                }
+                if (!allow) {
+                    return { kind: "done", result: denied(reasonCode, shown, call) };
+                }
+                return launchInner(dispatched, principal, ref, ref);
+            });
+            if (plan.kind === "done")
+                return plan.result;
+            if (plan.kind === "wait") {
+                try {
+                    await plan.work;
+                }
+                catch {
+                    // The first call recorded the throw on its effect row.
+                }
+                return allowedReplay(plan.replayRef);
+            }
+            try {
+                return await plan.work;
             }
-            if (!allow) {
-                return denied(reasonCode, shown, call);
+            finally {
+                inFlight.delete(plan.key);
+                // runInner has written its effect row by now — on the throw path too,
+                // as `<name>:threw`. The outcome is on the ledger, so the mark goes.
+                if (stateDir !== null)
+                    markEnded(stateDir, plan.key);
             }
-            return runInner(dispatched, principal, ref);
         },
     };
 }

package/dist/serial-queue.d.ts

@@ -0,0 +1,5 @@
+/** One async tail so a later turn cannot start until the earlier one settles. */
+export declare class SerialQueue {
+    private tail;
+    enqueue<T>(fn: () => Promise<T>): Promise<T>;
+}

package/dist/serial-queue.js

@@ -0,0 +1,9 @@
+/** One async tail so a later turn cannot start until the earlier one settles. */
+export class SerialQueue {
+    tail = Promise.resolve();
+    enqueue(fn) {
+        const run = this.tail.then(fn, fn);
+        this.tail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+}

package/dist/types.d.ts

@@ -48,6 +48,9 @@ export type Policy = {
     rule(id: string | null): {
         id: string;
         text: string;
+        spend?: {
+            dailyMaxMinor?: number;
+        };
     } | null;
 };
 export type WitnessClass = "self" | "same-org" | "third-party" | "regulated";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verax-ai/proxy",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {