sealbridge 0.0.1 → 0.2.0

package/dist/packages/runtime/dist/mcp.d.ts

@@ -0,0 +1,73 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { CapabilityGuard } from '@acp/core';
+import type { CapabilityToken, CapabilityContext, ApprovalReceipt } from '@acp/core';
+import { ApprovalGate } from './policy.js';
+import type { QuotaMeter } from './quota.js';
+export interface ToolBackend {
+    callTool(params: {
+        name: string;
+        arguments: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+export interface ToolDefinition {
+    resource: (args: Record<string, unknown>) => string;
+    readOnly: boolean;
+}
+export declare class MCPProxy {
+    readonly guard: CapabilityGuard;
+    private chain;
+    private context;
+    constructor(options: {
+        chain: CapabilityToken[];
+        context: CapabilityContext;
+        backend: ToolBackend | Client;
+        tools: Record<string, ToolDefinition>;
+        gate: ApprovalGate;
+        meter: QuotaMeter;
+        isActive: () => boolean;
+        onAudit?: (event: string, details: Record<string, string>) => void;
+        guard?: CapabilityGuard;
+    });
+    private options;
+    callTool(name: string, args: Record<string, unknown>, approval?: ApprovalReceipt): Promise<unknown>;
+    createServer(): Server;
+}
+/** Connect a genuine SDK client/server pair without sockets or credentials. */
+export declare function connectMCPTools(handler: (name: string, args: Record<string, unknown>) => Promise<unknown>): Promise<{
+    client: Client<{
+        method: string;
+        params?: {
+            [x: string]: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        method: string;
+        params?: {
+            [x: string]: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        [x: string]: unknown;
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+    }>;
+    close: () => Promise<void>;
+}>;

package/dist/packages/runtime/dist/mcp.js

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
+// Adapted from newtro/delegateos src/mcp/plugin.ts (MIT), Scott Smith.
+// ACP denies every unconfigured tool; no metadata-free passthrough is supported.
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, CallToolResultSchema } from '@modelcontextprotocol/sdk/types.js';
+import { CapabilityGuard, digest } from '../../core/dist/index.js';
+export class MCPProxy {
+    guard;
+    chain;
+    context;
+    constructor(options) {
+        this.options = options;
+        this.chain = structuredClone(options.chain);
+        this.context = structuredClone(options.context);
+        this.guard = options.guard ?? new CapabilityGuard();
+    }
+    options;
+    async callTool(name, args, approval) {
+        const frozenArgs = structuredClone(args);
+        try {
+            if (!this.options.isActive())
+                throw new Error('CAPABILITY_VIOLATION: inactive contract');
+            const definition = this.options.tools[name];
+            if (!Object.hasOwn(this.options.tools, name) || !definition)
+                throw new Error('CAPABILITY_VIOLATION: unknown tool');
+            this.guard.authorize(this.chain, { ...this.context, now: Date.now() }, name, frozenArgs, definition.resource(frozenArgs));
+            if (!definition.readOnly)
+                this.options.gate.require(this.context.taskId, 'external_side_effect', { name, args: frozenArgs }, approval);
+            this.options.meter.record(0, 0, 1);
+            const result = CallToolResultSchema.parse(await this.options.backend.callTool({ name, arguments: frozenArgs }));
+            this.options.onAudit?.('TOOL_ALLOWED', { name, resultDigest: digest(result) });
+            return result;
+        }
+        catch (e) {
+            const reason = String(e);
+            this.options.onAudit?.(reason.includes('TOKEN_REVOKED')
+                ? 'TOKEN_REVOKED'
+                : reason.includes('BUDGET')
+                    ? 'BUDGET_EXCEEDED'
+                    : 'CAPABILITY_VIOLATION', { name, reason });
+            throw e;
+        }
+    }
+    createServer() {
+        const server = new Server({ name: 'acp-capguard', version: '0.1.0' }, { capabilities: { tools: {} } });
+        server.setRequestHandler(CallToolRequestSchema, async (request) => CallToolResultSchema.parse(await this.callTool(request.params.name, request.params.arguments ?? {})));
+        return server;
+    }
+}
+/** Connect a genuine SDK client/server pair without sockets or credentials. */
+export async function connectMCPTools(handler) {
+    const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
+    const { InMemoryTransport } = await import('@modelcontextprotocol/sdk/inMemory.js');
+    const server = new Server({ name: 'acp-owner-tools', version: '0.1.0' }, { capabilities: { tools: {} } });
+    server.setRequestHandler(CallToolRequestSchema, async (req) => CallToolResultSchema.parse(await handler(req.params.name, req.params.arguments ?? {})));
+    const client = new Client({ name: 'acp-gateway', version: '0.1.0' });
+    const [a, b] = InMemoryTransport.createLinkedPair();
+    await Promise.all([server.connect(a), client.connect(b)]);
+    return {
+        client,
+        close: async () => {
+            await client.close();
+            await server.close();
+        },
+    };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/packages/runtime/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,uEAAuE;AACvE,iFAAiF;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAWpD,MAAM,OAAO,QAAQ;IACV,KAAK,CAAkB;IACxB,KAAK,CAAoB;IACzB,OAAO,CAAoB;IACnC,YAAY,OAUX;QACC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,eAAe,EAAE,CAAC;IACtD,CAAC;IACO,OAAO,CAOb;IACF,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAA6B,EAC7B,QAA0B;QAE1B,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;gBACzD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,SAAS,CAClB,IAAI,CAAC,KAAK,EACV,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EACpC,IAAI,EACJ,UAAU,EACV,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChC,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ;gBACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CACvB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,sBAAsB,EACtB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAC1B,QAAQ,CACT,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CACrE,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CACpB,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC9B,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACzB,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,sBAAsB,EAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;YACF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,YAAY;QACV,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAChE,oBAAoB,CAAC,KAAK,CACxB,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CACzE,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0E;IAE1E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAC7E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IACF,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5D,oBAAoB,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CACvF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IACpD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,MAAM;QACN,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/packages/runtime/dist/policy.d.ts

@@ -0,0 +1,19 @@
+import type { ApprovalReceipt, Gate, KeyPair } from '@acp/core';
+export declare const gates: Gate[];
+export interface OwnerPolicy {
+    requiredGates: Gate[];
+    autoApprove: Gate[];
+}
+export declare class ApprovalGate {
+    readonly ownerDid: string;
+    private used;
+    readonly policy: OwnerPolicy;
+    constructor(ownerDid: string, policy: OwnerPolicy);
+    require(taskId: string, gate: Gate, target: unknown, receipt?: ApprovalReceipt): ApprovalReceipt;
+    autoApprove(taskId: string, gate: Gate, target: unknown, owner: KeyPair): ApprovalReceipt;
+}
+export declare function approvalTarget(taskId: string, gate: Gate, details: unknown): {
+    taskId: string;
+    gate: Gate;
+    detailsDigest: string;
+};

package/dist/packages/runtime/dist/policy.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+import { verifyApproval, signApproval, digest } from '../../core/dist/index.js';
+export const gates = [
+    'contract_acceptance',
+    'external_side_effect',
+    'budget_increase',
+    'redelegation',
+    'final_verification',
+];
+export class ApprovalGate {
+    ownerDid;
+    used = new Set();
+    policy;
+    constructor(ownerDid, policy) {
+        this.ownerDid = ownerDid;
+        if (policy.autoApprove.some((g) => ['external_side_effect', 'budget_increase'].includes(g)) ||
+            [...policy.requiredGates, ...policy.autoApprove].some((g) => !gates.includes(g)))
+            throw new Error('INVALID_OWNER_POLICY');
+        this.policy = structuredClone(policy);
+    }
+    require(taskId, gate, target, receipt) {
+        if (!gates.includes(gate) ||
+            !receipt ||
+            !verifyApproval(receipt, this.ownerDid, taskId, gate, target) ||
+            this.used.has(receipt.payload.receiptId))
+            throw new Error('APPROVAL_REQUIRED: ' + gate);
+        this.used.add(receipt.payload.receiptId);
+        return receipt;
+    }
+    autoApprove(taskId, gate, target, owner) {
+        if (owner.did !== this.ownerDid ||
+            !this.policy.autoApprove.includes(gate) ||
+            this.policy.requiredGates.includes(gate))
+            throw new Error('HITL_REQUIRED: ' + gate);
+        return signApproval(taskId, gate, target, owner);
+    }
+}
+export function approvalTarget(taskId, gate, details) {
+    return { taskId, gate, detailsDigest: digest(details) };
+}
+//# sourceMappingURL=policy.js.map

package/dist/packages/runtime/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,qBAAqB;IACrB,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,oBAAoB;CACrB,CAAC;AAKF,MAAM,OAAO,YAAY;IAIZ;IAHH,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACxB,MAAM,CAAc;IAC7B,YACW,QAAgB,EACzB,MAAmB;QADV,aAAQ,GAAR,QAAQ,CAAQ;QAGzB,IACE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvF,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEhF,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,MAAc,EAAE,IAAU,EAAE,MAAe,EAAE,OAAyB;QAC5E,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,CAAC,OAAO;YACR,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;YAExC,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,MAAc,EAAE,IAAU,EAAE,MAAe,EAAE,KAAc;QACrE,IACE,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ;YAC3B,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAExC,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAC5C,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;CACF;AACD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAU,EAAE,OAAgB;IACzE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/packages/runtime/dist/quota.d.ts

@@ -0,0 +1,39 @@
+import type { BudgetSpec, KeyPair, Usage, UsageReceipt, ApprovalReceipt } from '@acp/core';
+export declare function usageWithinBudget(usage: Usage, budget: BudgetSpec): boolean;
+export declare function verifyUsage(receipt: UsageReceipt, signerDid: string, taskId: string, budget: BudgetSpec): boolean;
+export declare class QuotaMeter {
+    #private;
+    readonly taskId: string;
+    readonly ownerDid: string;
+    readonly clock: () => number;
+    readonly controller: AbortController;
+    get budget(): BudgetSpec;
+    constructor(taskId: string, budget: BudgetSpec, ownerDid: string, clock?: () => number);
+    private timer;
+    private halt;
+    record(inputTokens?: number, outputTokens?: number, toolCalls?: number): void;
+    recordMetrics(delta: Partial<{
+        inputTokens: number;
+        outputTokens: number;
+        totalTokens: number;
+        toolCalls: number;
+        wallTimeMs: number;
+    }>): void;
+    amendmentTarget(budget: BudgetSpec): {
+        taskId: string;
+        previousBudgetDigest: string;
+        budget: BudgetSpec;
+    };
+    amend(budget: BudgetSpec, approval: ApprovalReceipt): void;
+    receipt(key: KeyPair): UsageReceipt;
+    close(): void;
+}
+/** Instrument the owner's provider adapter, before forwarding any stream output.
+ * The adapter owns its BYOK credential; neither the credential nor provider SDK
+ * enters the worker. Usage deltas must come from that trusted adapter.
+ */
+export declare function meteredProvider<T>(meter: QuotaMeter, stream: AsyncIterable<{
+    value: T;
+    inputTokens: number;
+    outputTokens: number;
+}>): AsyncGenerator<T>;

package/dist/packages/runtime/dist/quota.js

@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: Apache-2.0
+import { signUsage, verifySigned, validateSchema, verifyApproval, digest } from '../../core/dist/index.js';
+export function usageWithinBudget(usage, budget) {
+    return ([
+        usage.inputTokens,
+        usage.outputTokens,
+        usage.totalTokens,
+        usage.toolCalls,
+        usage.wallTimeMs,
+    ].every((n) => Number.isSafeInteger(n) && n >= 0) &&
+        usage.totalTokens === usage.inputTokens + usage.outputTokens &&
+        !usage.halted &&
+        usage.inputTokens <= budget.maxInputTokens &&
+        usage.outputTokens <= budget.maxOutputTokens &&
+        usage.toolCalls <= budget.maxToolInvocations &&
+        usage.wallTimeMs <= budget.maxWallClockSeconds * 1000);
+}
+export function verifyUsage(receipt, signerDid, taskId, budget) {
+    try {
+        validateSchema('usage-receipt', receipt);
+        return (verifySigned(receipt, signerDid) &&
+            receipt.payload.taskId === taskId &&
+            usageWithinBudget(receipt.payload, budget));
+    }
+    catch {
+        return false;
+    }
+}
+export class QuotaMeter {
+    taskId;
+    ownerDid;
+    clock;
+    controller = new AbortController();
+    #reportedWallTime = 0;
+    #usage;
+    #budget;
+    #started;
+    #timer;
+    #amendments = new Set();
+    get budget() {
+        return structuredClone(this.#budget);
+    }
+    constructor(taskId, budget, ownerDid, clock = Date.now) {
+        this.taskId = taskId;
+        this.ownerDid = ownerDid;
+        this.clock = clock;
+        this.#budget = structuredClone(budget);
+        this.#started = clock();
+        this.#usage = {
+            type: 'UsageReceipt',
+            taskId,
+            inputTokens: 0,
+            outputTokens: 0,
+            totalTokens: 0,
+            toolCalls: 0,
+            wallTimeMs: 0,
+            halted: false,
+        };
+        this.#timer = this.timer();
+    }
+    timer() {
+        const timer = setTimeout(() => this.halt('wallTimeMs'), Math.max(1, this.#budget.maxWallClockSeconds * 1000 - (this.clock() - this.#started)));
+        timer.unref();
+        return timer;
+    }
+    halt(reason) {
+        this.#usage.halted = true;
+        this.controller.abort('BUDGET_EXCEEDED: ' + reason);
+    }
+    record(inputTokens = 0, outputTokens = 0, toolCalls = 0) {
+        if (![inputTokens, outputTokens, toolCalls].every((n) => Number.isSafeInteger(n) && n >= 0)) {
+            this.halt('invalid usage');
+            throw new Error('INVALID_USAGE');
+        }
+        if (this.#usage.halted)
+            throw new Error('BUDGET_EXCEEDED: halted');
+        this.#usage.inputTokens += inputTokens;
+        this.#usage.outputTokens += outputTokens;
+        this.#usage.totalTokens = this.#usage.inputTokens + this.#usage.outputTokens;
+        this.#usage.toolCalls += toolCalls;
+        this.#usage.wallTimeMs = Math.max(this.#usage.wallTimeMs, 0, this.clock() - this.#started);
+        if (!usageWithinBudget(this.#usage, this.#budget)) {
+            this.halt('quota');
+            throw new Error('BUDGET_EXCEEDED');
+        }
+    }
+    recordMetrics(delta) {
+        const i = delta.inputTokens ?? 0, o = delta.outputTokens ?? 0;
+        if (Object.values(delta).some((n) => !Number.isSafeInteger(n) || n < 0) ||
+            (delta.totalTokens !== undefined && delta.totalTokens !== i + o)) {
+            this.halt('invalid usage');
+            throw new Error('INVALID_USAGE');
+        }
+        if (delta.wallTimeMs !== undefined)
+            this.#reportedWallTime += delta.wallTimeMs;
+        this.#usage.wallTimeMs = Math.max(this.#usage.wallTimeMs, this.#reportedWallTime);
+        this.record(i, o, delta.toolCalls ?? 0);
+    }
+    amendmentTarget(budget) {
+        return { taskId: this.taskId, previousBudgetDigest: digest(this.#budget), budget };
+    }
+    amend(budget, approval) {
+        if (this.#budget.onOverrun !== 'request_hitl_amendment' ||
+            !verifyApproval(approval, this.ownerDid, this.taskId, 'budget_increase', this.amendmentTarget(budget)) ||
+            this.#amendments.has(approval.payload.receiptId) ||
+            this.#usage.halted)
+            throw new Error('BUDGET_APPROVAL_REQUIRED');
+        if (![
+            budget.maxInputTokens,
+            budget.maxOutputTokens,
+            budget.maxToolInvocations,
+            budget.maxWallClockSeconds,
+        ].every((n) => Number.isSafeInteger(n) && n >= 0) ||
+            budget.maxWallClockSeconds < 1)
+            throw new Error('INVALID_BUDGET');
+        this.#amendments.add(approval.payload.receiptId);
+        this.#budget = structuredClone(budget);
+        clearTimeout(this.#timer);
+        this.#timer = this.timer();
+        this.record();
+    }
+    receipt(key) {
+        if (key.did !== this.ownerDid)
+            throw new Error('USAGE_SIGNER');
+        try {
+            this.record();
+        }
+        catch {
+            /* Preserve exceeded totals in the signed receipt. */
+        }
+        return signUsage(this.#usage, key);
+    }
+    close() {
+        clearTimeout(this.#timer);
+    }
+}
+/** Instrument the owner's provider adapter, before forwarding any stream output.
+ * The adapter owns its BYOK credential; neither the credential nor provider SDK
+ * enters the worker. Usage deltas must come from that trusted adapter.
+ */
+export async function* meteredProvider(meter, stream) {
+    for await (const chunk of stream) {
+        meter.record(chunk.inputTokens, chunk.outputTokens);
+        yield chunk.value;
+    }
+}
+//# sourceMappingURL=quota.js.map

package/dist/packages/runtime/dist/quota.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota.js","sourceRoot":"","sources":["../src/quota.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE5F,MAAM,UAAU,iBAAiB,CAAC,KAAY,EAAE,MAAkB;IAChE,OAAO,CACL;QACE,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,UAAU;KACjB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY;QAC5D,CAAC,KAAK,CAAC,MAAM;QACb,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,cAAc;QAC1C,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe;QAC5C,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,kBAAkB;QAC5C,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,GAAG,IAAI,CACtD,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,WAAW,CACzB,OAAqB,EACrB,SAAiB,EACjB,MAAc,EACd,MAAkB;IAElB,IAAI,CAAC;QACH,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,CACL,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YACjC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,OAAO,UAAU;IAYV;IAEA;IACA;IAdF,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAC5C,iBAAiB,GAAG,CAAC,CAAC;IACtB,MAAM,CAAQ;IACd,OAAO,CAAa;IACpB,QAAQ,CAAS;IACjB,MAAM,CAAgC;IACtC,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM;QACR,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,YACW,MAAc,EACvB,MAAkB,EACT,QAAgB,EAChB,QAAsB,IAAI,CAAC,GAAG;QAH9B,WAAM,GAAN,MAAM,CAAQ;QAEd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAyB;QAEvC,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG;YACZ,IAAI,EAAE,cAAc;YACpB,MAAM;YACN,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,KAAK;SACd,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IACO,KAAK;QACX,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CACtF,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACO,IAAI,CAAC,MAAc;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,YAAY,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC;QACrD,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,YAAY,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3F,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,aAAa,CACX,KAME;QAEF,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,EAC9B,CAAC,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;QAC9B,IACE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAE,GAAG,CAAC,CAAC;YACpE,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,EAChE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,eAAe,CAAC,MAAkB;QAChC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACrF,CAAC;IACD,KAAK,CAAC,MAAkB,EAAE,QAAyB;QACjD,IACE,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,wBAAwB;YACnD,CAAC,cAAc,CACb,QAAQ,EACR,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,iBAAiB,EACjB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAC7B;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,MAAM;YAElB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,IACE,CAAC;YACC,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,eAAe;YACtB,MAAM,CAAC,kBAAkB;YACzB,MAAM,CAAC,mBAAmB;SAC3B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,CAAC,mBAAmB,GAAG,CAAC;YAE9B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACvC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,GAAY;QAClB,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,KAAK;QACH,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACpC,KAAiB,EACjB,MAA8E;IAE9E,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/packages/runtime/dist/session-audit.d.ts

@@ -0,0 +1,107 @@
+import type { Json, KeyPair, Signed, SignedEnvelope, Transition } from '@acp/core';
+import type { AuditBundle, AuditEntry } from '@acp/ledger';
+import type { RelayConnectionStatus } from '@acp/relay';
+import type { RelayReceiveFilter, RelayTransport } from '@acp/relay';
+import type { ProgressPayload } from './adapter.js';
+import type { ErrorDetail, SessionResult } from './session.js';
+/** The peer's signed ERROR, retaining optional diagnostics for programmatic callers. */
+export declare class PeerRejectedError extends Error {
+    readonly code?: string;
+    readonly detail?: ErrorDetail;
+    readonly recovery?: {
+        proposalDigest: string;
+        result?: SessionResult;
+        part?: {
+            index: number;
+            count: number;
+            data: string;
+            resultDigest: string;
+        };
+    };
+    constructor(body: Json);
+}
+export declare const asJson: (v: unknown) => Json;
+export declare function receiveRelay(relay: RelayTransport, did: string, signal?: AbortSignal, filter?: RelayReceiveFilter, onStatus?: (status: RelayConnectionStatus) => void): Promise<SignedEnvelope>;
+/** A lost ack is retried by the HTTP client when the completed envelope is redelivered. */
+export declare function acknowledgeRelay(relay: RelayTransport, envelope: SignedEnvelope): Promise<void>;
+export interface CancelBody {
+    reason: string;
+    cancelledBy: string;
+    transition: Signed<Transition>;
+}
+/** Each side has only its own private key. All countersignatures arrive on wire. */
+export declare class SessionWire {
+    readonly relay: RelayTransport;
+    readonly owner: KeyPair;
+    readonly peerDid: string;
+    readonly taskId: string;
+    readonly actors: [string, string];
+    readonly signal: AbortSignal;
+    readonly auditPath?: string | undefined;
+    /** Legacy in-memory fixtures may open cleartext. Network sessions leave this false. */
+    readonly allowUnencryptedEnvelopes: boolean;
+    private outgoing;
+    private incoming;
+    private readonly recoveryParts;
+    /** Opened session views keep the ciphertext envelope so delivery verification can check it. */
+    private readonly sealedByView;
+    private readonly inbox;
+    private readonly inboxWaiters;
+    private readonly stashed;
+    private readonly waiters;
+    private readonly waiterAdded;
+    private readonly cancelResolvers;
+    private pumpError?;
+    private pumping;
+    private dispatching;
+    private detached;
+    private stopped;
+    private readonly readController;
+    private lastHeartbeat;
+    private cancellation?;
+    /** One bilateral send at a time so PROGRESS cannot overtake its own ACK. */
+    private sendTail;
+    readonly entries: AuditEntry[];
+    onProgress?: (progress: ProgressPayload, envelope: SignedEnvelope) => void | Promise<void>;
+    onActivity?: () => void;
+    /** Aborts the running task as soon as a CANCEL frame is queued. */
+    earlyCancel?: () => void;
+    lastCancel?: SignedEnvelope;
+    cancelHandled: boolean;
+    constructor(relay: RelayTransport, owner: KeyPair, peerDid: string, taskId: string, actors: [string, string], signal: AbortSignal, auditPath?: string | undefined, 
+    /** Legacy in-memory fixtures may open cleartext. Network sessions leave this false. */
+    allowUnencryptedEnvelopes?: boolean);
+    get cancellationStarted(): boolean;
+    close(): void;
+    /** Liveness is signed/encrypted but does not consume audit sequence numbers or extend quota. */
+    heartbeat(): Promise<void>;
+    /** Keep reading after the caller aborts the session signal, so CANCEL can still be sealed. */
+    detachSignal(): void;
+    cancelSession(payload?: CancelBody): Promise<void>;
+    waitUntilCancelHandled(): Promise<void>;
+    private startPump;
+    private runPump;
+    private shift;
+    private nextEnvelope;
+    private rejectWaiters;
+    private dispatch;
+    private watchDelivery;
+    rawSend(eventType: string, payload: unknown): Promise<void>;
+    /** Ciphertext that still matches the outer signature, when `view` was opened for the session. */
+    sealed(view: SignedEnvelope): SignedEnvelope;
+    private check;
+    private acceptInitial;
+    rawReceive(expected: string | string[], initial?: SignedEnvelope): Promise<SignedEnvelope>;
+    private append;
+    private body;
+    private acknowledgeControl;
+    private recordPeer;
+    sendEvent(eventType: string, payload: unknown): Promise<void>;
+    private transmit;
+    receiveEvent(eventType: string | string[], initial?: SignedEnvelope): Promise<SignedEnvelope>;
+    private sendCancel;
+    private checkpoint;
+    private seal;
+    finishRequester(): Promise<AuditBundle>;
+    finishWorker(onSealed?: (bundle: AuditBundle) => void): Promise<AuditBundle>;
+}