thevoidforge 21.0.0

package/dist/wizard/lib/financial/campaign/tiktok-campaign.js

@@ -0,0 +1,350 @@
+/**
+ * TikTok Marketing Campaign Adapter — real implementation via node:https (zero new dependencies).
+ *
+ * Implements AdPlatformAdapter for TikTok Marketing API v1.3.
+ *
+ * TikTok Marketing API v1.3:
+ *   Base URL: https://business-api.tiktok.com/open_api/v1.3
+ *   Auth: Access-Token header
+ *   Campaign CRUD via campaign/create, campaign/update
+ *   Reporting via report/integrated/get
+ *   Rate limit: 10 calls/sec
+ *
+ * PRD Reference: §9.5, §9.19.10, §9.20.4
+ * No Stubs Doctrine: every method makes a real API call or returns documented empty.
+ */
+import { request as httpsRequest } from 'node:https';
+import { toCents, toDollars, TokenBucketLimiter } from './base.js';
+const TIKTOK_HOST = 'business-api.tiktok.com';
+// ── HTTP helpers ─────────────────────────────────────
+async function tiktokGet(path, accessToken, params) {
+    const query = params
+        ? '?' + new URLSearchParams(params).toString()
+        : '';
+    return new Promise((resolve, reject) => {
+        const req = httpsRequest({
+            hostname: TIKTOK_HOST,
+            path: `/open_api/v1.3${path}${query}`,
+            method: 'GET',
+            headers: {
+                'Access-Token': accessToken,
+                'Accept': 'application/json',
+            },
+            timeout: 15000,
+        }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk.toString(); });
+            res.on('end', () => resolve({ status: res.statusCode ?? 500, body: data }));
+        });
+        req.on('error', reject);
+        req.on('timeout', () => { req.destroy(); reject(new Error('TikTok API timeout')); });
+        req.end();
+    });
+}
+async function tiktokPost(path, accessToken, body) {
+    const payload = JSON.stringify(body);
+    return new Promise((resolve, reject) => {
+        const req = httpsRequest({
+            hostname: TIKTOK_HOST,
+            path: `/open_api/v1.3${path}`,
+            method: 'POST',
+            headers: {
+                'Access-Token': accessToken,
+                'Content-Type': 'application/json',
+                'Accept': 'application/json',
+            },
+            timeout: 15000,
+        }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk.toString(); });
+            res.on('end', () => resolve({ status: res.statusCode ?? 500, body: data }));
+        });
+        req.on('error', reject);
+        req.on('timeout', () => { req.destroy(); reject(new Error('TikTok API timeout')); });
+        req.write(payload);
+        req.end();
+    });
+}
+function safeParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return { message: 'Non-JSON response from TikTok API' };
+    }
+}
+function makePlatformError(code, originalCode, message, retryable = false, retryAfter) {
+    return { platform: 'tiktok', code, originalCode, message, retryable, retryAfter };
+}
+function mapObjective(obj) {
+    const map = {
+        awareness: 'REACH',
+        traffic: 'TRAFFIC',
+        conversions: 'CONVERSIONS',
+    };
+    return map[obj];
+}
+// ── TikTok API response handling ────────────────────
+function requireSuccess(parsed, context) {
+    const code = parsed.code;
+    const message = parsed.message ?? 'Unknown error';
+    if (code !== 0) {
+        if (code === 40100) {
+            throw makePlatformError('AUTH_EXPIRED', code, `${context}: ${message}`);
+        }
+        if (code === 40002 || code === 40003) {
+            throw makePlatformError('RATE_LIMITED', code, `${context}: ${message}`, true, 1);
+        }
+        if (code === 40101 || code === 40201 || message.toLowerCase().includes('budget')) {
+            throw makePlatformError('BUDGET_EXCEEDED', code ?? 400, `${context}: ${message}`);
+        }
+        throw makePlatformError('UNKNOWN', code ?? 500, `${context}: ${message}`);
+    }
+    return parsed.data ?? {};
+}
+// ── Adapter Implementation ──────────────────────────
+export class TikTokCampaignAdapter {
+    config;
+    rateLimiter;
+    constructor(config) {
+        this.config = config;
+        // TikTok: 10 calls/sec
+        this.rateLimiter = new TokenBucketLimiter({ capacity: 10, refillRate: 10 });
+    }
+    async refreshToken(token) {
+        // TikTok uses long-lived tokens that don't need frequent refresh.
+        // When they expire, re-authenticate through the OAuth flow.
+        // For now, return the same token — heartbeat will detect expiry.
+        return {
+            ...token,
+            expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
+        };
+    }
+    async createCampaign(config) {
+        if (config.complianceStatus !== 'passed') {
+            throw makePlatformError('UNKNOWN', 400, 'Campaign compliance not passed — cannot create');
+        }
+        await this.rateLimiter.acquire();
+        const { status, body } = await tiktokPost('/campaign/create/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            campaign_name: config.name,
+            objective_type: mapObjective(config.objective),
+            budget_mode: 'BUDGET_MODE_DAY',
+            budget: toDollars(config.dailyBudget),
+            operation_status: 'DISABLE', // Create paused
+            // Idempotency per ADR-3: TikTok supports request_id for dedup
+            request_id: config.idempotencyKey,
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, `TikTok campaign create failed: HTTP ${status}`);
+        }
+        const parsed = safeParseJson(body);
+        const data = requireSuccess(parsed, 'createCampaign');
+        const externalId = String(data.campaign_id ?? '');
+        return {
+            externalId,
+            platform: 'tiktok',
+            status: 'created',
+            dashboardUrl: `https://ads.tiktok.com/i18n/perf/campaign?aadvid=${this.config.appId}&campaign_id=${externalId}`,
+        };
+    }
+    async updateCampaign(id, changes) {
+        await this.rateLimiter.acquire();
+        const updateBody = {
+            advertiser_id: this.config.appId,
+            campaign_id: id,
+        };
+        if (changes.name !== undefined)
+            updateBody.campaign_name = changes.name;
+        if (changes.dailyBudget !== undefined)
+            updateBody.budget = toDollars(changes.dailyBudget);
+        const { status, body } = await tiktokPost('/campaign/update/', this.config.accessToken, updateBody);
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, `TikTok campaign update failed: HTTP ${status}`);
+        }
+        const parsed = safeParseJson(body);
+        requireSuccess(parsed, 'updateCampaign');
+    }
+    async pauseCampaign(id) {
+        await this.rateLimiter.acquire();
+        const { status, body } = await tiktokPost('/campaign/status/update/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            campaign_ids: [id],
+            opt_status: 'DISABLE',
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, `TikTok campaign pause failed: HTTP ${status}`);
+        }
+        const parsed = safeParseJson(body);
+        requireSuccess(parsed, 'pauseCampaign');
+    }
+    async resumeCampaign(id) {
+        await this.rateLimiter.acquire();
+        const { status, body } = await tiktokPost('/campaign/status/update/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            campaign_ids: [id],
+            opt_status: 'ENABLE',
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, `TikTok campaign resume failed: HTTP ${status}`);
+        }
+        const parsed = safeParseJson(body);
+        requireSuccess(parsed, 'resumeCampaign');
+    }
+    async deleteCampaign(id) {
+        await this.rateLimiter.acquire();
+        const { status, body } = await tiktokPost('/campaign/status/update/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            campaign_ids: [id],
+            opt_status: 'DELETE',
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, `TikTok campaign delete failed: HTTP ${status}`);
+        }
+        const parsed = safeParseJson(body);
+        requireSuccess(parsed, 'deleteCampaign');
+    }
+    async updateBudget(id, dailyBudget) {
+        await this.rateLimiter.acquire();
+        const { status, body } = await tiktokPost('/campaign/update/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            campaign_id: id,
+            budget: toDollars(dailyBudget),
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, `TikTok budget update failed: HTTP ${status}`);
+        }
+        const parsed = safeParseJson(body);
+        requireSuccess(parsed, 'updateBudget');
+    }
+    async updateCreative(id, creative) {
+        await this.rateLimiter.acquire();
+        // TikTok creative updates go through ad objects, not campaigns
+        // Query the first ad under this campaign's ad groups
+        const { status: queryStatus, body: queryBody } = await tiktokGet('/ad/get/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            filtering: JSON.stringify({ campaign_ids: [id] }),
+            page_size: '1',
+        });
+        if (queryStatus !== 200) {
+            throw makePlatformError('UNKNOWN', queryStatus, 'TikTok ad query failed');
+        }
+        const queryParsed = safeParseJson(queryBody);
+        const queryData = requireSuccess(queryParsed, 'updateCreative.query');
+        const ads = queryData.list ?? [];
+        if (ads.length === 0) {
+            throw makePlatformError('CREATIVE_REJECTED', 404, `No ads found for campaign ${id}`);
+        }
+        const adId = String(ads[0].ad_id ?? '');
+        const updateBody = {
+            advertiser_id: this.config.appId,
+            ad_id: adId,
+        };
+        if (creative.landingUrl)
+            updateBody.landing_page_url = creative.landingUrl;
+        if (creative.headlines?.[0])
+            updateBody.ad_name = creative.headlines[0];
+        if (creative.descriptions?.[0])
+            updateBody.ad_text = creative.descriptions[0];
+        if (creative.callToAction)
+            updateBody.call_to_action = creative.callToAction;
+        const { status, body } = await tiktokPost('/ad/update/', this.config.accessToken, updateBody);
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, 'TikTok creative update failed');
+        }
+        const parsed = safeParseJson(body);
+        requireSuccess(parsed, 'updateCreative');
+    }
+    async getSpend(dateRange) {
+        await this.rateLimiter.acquire();
+        const { status, body } = await tiktokPost('/report/integrated/get/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            report_type: 'BASIC',
+            dimensions: ['campaign_id'],
+            metrics: ['spend', 'impressions', 'clicks', 'conversion'],
+            data_level: 'AUCTION_CAMPAIGN',
+            start_date: dateRange.start.slice(0, 10),
+            end_date: dateRange.end.slice(0, 10),
+            page_size: 1000,
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, 'TikTok spend report failed');
+        }
+        const parsed = safeParseJson(body);
+        const data = requireSuccess(parsed, 'getSpend');
+        const list = data.list ?? [];
+        const campaigns = list.map(row => {
+            const dims = row.dimensions ?? {};
+            const metrics = row.metrics ?? {};
+            return {
+                externalId: dims.campaign_id ?? '',
+                spend: toCents(parseFloat(metrics.spend ?? '0')),
+                impressions: parseInt(metrics.impressions ?? '0'),
+                clicks: parseInt(metrics.clicks ?? '0'),
+                conversions: parseInt(metrics.conversion ?? '0'),
+            };
+        });
+        const totalSpend = campaigns.reduce((sum, c) => (sum + c.spend), 0);
+        return { platform: 'tiktok', dateRange, totalSpend, campaigns };
+    }
+    async getPerformance(campaignId) {
+        await this.rateLimiter.acquire();
+        const today = new Date().toISOString().slice(0, 10);
+        const { status, body } = await tiktokPost('/report/integrated/get/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            report_type: 'BASIC',
+            dimensions: ['campaign_id'],
+            metrics: ['spend', 'impressions', 'clicks', 'conversion', 'ctr', 'cpc'],
+            data_level: 'AUCTION_CAMPAIGN',
+            start_date: today,
+            end_date: today,
+            filtering: [{ field_name: 'campaign_ids', filter_type: 'IN', filter_value: JSON.stringify([campaignId]) }],
+            page_size: 1,
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, 'TikTok performance report failed');
+        }
+        const parsed = safeParseJson(body);
+        const data = requireSuccess(parsed, 'getPerformance');
+        const list = data.list ?? [];
+        const metrics = list[0]?.metrics ?? {};
+        const spend = toCents(parseFloat(metrics.spend ?? '0'));
+        return {
+            campaignId,
+            impressions: parseInt(metrics.impressions ?? '0'),
+            clicks: parseInt(metrics.clicks ?? '0'),
+            conversions: parseInt(metrics.conversion ?? '0'),
+            spend,
+            ctr: parseFloat(metrics.ctr ?? '0'),
+            cpc: toCents(parseFloat(metrics.cpc ?? '0')),
+            roas: (spend > 0 ? 0 : 0), // Revenue from Stripe, not ad platform
+        };
+    }
+    async getInsights(campaignId, metrics) {
+        await this.rateLimiter.acquire();
+        const today = new Date().toISOString().slice(0, 10);
+        const { status, body } = await tiktokPost('/report/integrated/get/', this.config.accessToken, {
+            advertiser_id: this.config.appId,
+            report_type: 'BASIC',
+            dimensions: ['campaign_id'],
+            metrics,
+            data_level: 'AUCTION_CAMPAIGN',
+            start_date: today,
+            end_date: today,
+            filtering: [{ field_name: 'campaign_ids', filter_type: 'IN', filter_value: JSON.stringify([campaignId]) }],
+            page_size: 1,
+        });
+        if (status !== 200) {
+            throw makePlatformError('UNKNOWN', status, 'TikTok insights report failed');
+        }
+        const parsed = safeParseJson(body);
+        const data = requireSuccess(parsed, 'getInsights');
+        const list = data.list ?? [];
+        const row = list[0]?.metrics ?? {};
+        const result = {};
+        for (const metric of metrics) {
+            result[metric] = parseFloat(row[metric] ?? '0');
+        }
+        return { campaignId, metrics: result };
+    }
+}

package/dist/wizard/lib/financial/funding-auto.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Auto-Funding Module — bridges treasury-planner and funding-policy
+ * for the heartbeat daemon's runway-forecast job.
+ *
+ * Pure logic — no API calls, no file I/O, fully testable.
+ * Called by the heartbeat's `runway-forecast` job every 6 hours.
+ * If both the planner says "off-ramp needed" and the policy says "allow",
+ * generates a FundingPlan for the daemon to execute.
+ *
+ * PRD Reference: §15 (Rules Engine), §12.4 (FundingPlan)
+ * Agents: Dockson (treasury), Heartbeat daemon
+ */
+import type { Cents, FundingPlan, StablecoinFundingSource, OperatingBankAccount } from '../patterns/funding-plan.js';
+import type { FundingPlanConfig, ObligationInput } from './treasury-planner.js';
+import type { PolicyDecision } from './funding-policy.js';
+interface AutoFundingConfig {
+    source: StablecoinFundingSource;
+    bank: OperatingBankAccount;
+    planConfig: FundingPlanConfig;
+    /** Current pending spend across all platforms */
+    pendingSpendCents: Cents;
+    /** Current obligations (invoices, debits, buffer needs) */
+    obligations: ObligationInput[];
+    /** Whether a Google invoice is due within the threshold window */
+    googleInvoiceDueSoon: boolean;
+    /** Google invoice amount in cents */
+    googleInvoiceCents: Cents;
+    /** Whether Meta uses direct debit billing */
+    metaUsesDirectDebit: boolean;
+    /** Meta forecasted 7-day spend in cents */
+    metaForecast7DayCents: Cents;
+    /** Current debit protection buffer in cents */
+    debitProtectionBufferCents: Cents;
+    /** Whether a reconciliation discrepancy currently exists */
+    discrepancyExists: boolean;
+    /** Previous hash for chain continuity */
+    previousHash: string;
+}
+interface AutoFundingResult {
+    plan: FundingPlan;
+    policyDecisions: PolicyDecision[];
+}
+export declare function evaluateAutoFunding(config: AutoFundingConfig): AutoFundingResult | null;
+export type { AutoFundingConfig, AutoFundingResult };

package/dist/wizard/lib/financial/funding-auto.js

@@ -0,0 +1,52 @@
+/**
+ * Auto-Funding Module — bridges treasury-planner and funding-policy
+ * for the heartbeat daemon's runway-forecast job.
+ *
+ * Pure logic — no API calls, no file I/O, fully testable.
+ * Called by the heartbeat's `runway-forecast` job every 6 hours.
+ * If both the planner says "off-ramp needed" and the policy says "allow",
+ * generates a FundingPlan for the daemon to execute.
+ *
+ * PRD Reference: §15 (Rules Engine), §12.4 (FundingPlan)
+ * Agents: Dockson (treasury), Heartbeat daemon
+ */
+import { shouldTriggerOfframp, generateFundingPlan } from './treasury-planner.js';
+import { evaluatePolicy, aggregateDecisions } from './funding-policy.js';
+// ── Evaluate Auto-Funding ────────────────────────────
+// Returns a FundingPlan if both planner and policy approve, null otherwise.
+export function evaluateAutoFunding(config) {
+    // Step 1: Ask the planner if an off-ramp is even needed
+    const offrampCheck = shouldTriggerOfframp(config.bank.availableBalanceCents, config.planConfig.bufferTargetCents, config.pendingSpendCents);
+    if (!offrampCheck.shouldOfframp) {
+        return null;
+    }
+    // Step 2: Generate a candidate funding plan
+    const plan = generateFundingPlan(config.source, config.bank, config.obligations, config.planConfig, config.previousHash);
+    if (!plan) {
+        return null;
+    }
+    // Step 3: Evaluate policy against all 7 rules
+    const policyState = {
+        bankBalanceCents: config.bank.availableBalanceCents,
+        minimumBufferCents: config.bank.minimumBufferCents,
+        reservedCents: config.bank.reservedBalanceCents,
+        proposedOfframpCents: plan.requiredCents,
+        maxDailyMovementCents: config.planConfig.maxDailyOfframpCents,
+        googleInvoiceDueSoon: config.googleInvoiceDueSoon,
+        googleInvoiceCents: config.googleInvoiceCents,
+        metaUsesDirectDebit: config.metaUsesDirectDebit,
+        metaForecast7DayCents: config.metaForecast7DayCents,
+        debitProtectionBufferCents: config.debitProtectionBufferCents,
+        discrepancyExists: config.discrepancyExists,
+        proposingBudgetRaise: false, // auto-funding never raises budgets
+        platformCapability: 'FULLY_FUNDABLE', // auto-funding targets funded platforms
+        claimingAutonomousFunding: true, // this IS autonomous funding
+    };
+    const decisions = evaluatePolicy(policyState);
+    const aggregate = aggregateDecisions(decisions);
+    // Step 4: Block if any rule denies or freezes
+    if (aggregate.action === 'deny' || aggregate.action === 'freeze') {
+        return null;
+    }
+    return { plan, policyDecisions: decisions };
+}

package/dist/wizard/lib/financial/funding-policy.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Funding Policy — the 7 deterministic rules from PRD Section 15.
+ *
+ * Pure logic — no API calls, no file I/O, fully testable.
+ * Each rule evaluates independently and returns an allow/deny/freeze decision.
+ * All rules are evaluated on every cycle; the most restrictive decision wins.
+ *
+ * PRD Reference: §15 (Rules Engine V1)
+ * Agents: Dockson (treasury), Heartbeat daemon
+ */
+import type { Cents, CapabilityState } from '../patterns/funding-plan.js';
+interface TreasuryState {
+    /** Current bank available balance in cents */
+    bankBalanceCents: Cents;
+    /** Minimum operating buffer floor in cents */
+    minimumBufferCents: Cents;
+    /** Reserved balance (earmarked for pending settlements) */
+    reservedCents: Cents;
+    /** Proposed off-ramp amount in cents (0 if no off-ramp proposed) */
+    proposedOfframpCents: Cents;
+    /** Maximum allowed daily treasury movement in cents */
+    maxDailyMovementCents: Cents;
+    /** Whether a Google invoice is due within the threshold window */
+    googleInvoiceDueSoon: boolean;
+    /** Google invoice amount in cents (0 if none) */
+    googleInvoiceCents: Cents;
+    /** Whether Meta uses direct debit billing */
+    metaUsesDirectDebit: boolean;
+    /** Meta forecasted 7-day spend in cents */
+    metaForecast7DayCents: Cents;
+    /** Current debit protection buffer in cents */
+    debitProtectionBufferCents: Cents;
+    /** Whether a reconciliation discrepancy currently exists */
+    discrepancyExists: boolean;
+    /** Whether a platform budget raise is being proposed */
+    proposingBudgetRaise: boolean;
+    /** Capability state of the platform being funded */
+    platformCapability: CapabilityState;
+    /** Whether autonomous funding is being claimed */
+    claimingAutonomousFunding: boolean;
+}
+interface PolicyDecision {
+    rule: number;
+    action: 'allow' | 'deny' | 'freeze';
+    reason: string;
+}
+interface PolicyThresholds {
+    /** Days before Google invoice due date to start prioritizing */
+    googleInvoiceWindowDays: number;
+    /** Multiplier for debit protection buffer over forecast */
+    debitProtectionMultiplier: number;
+}
+declare const DEFAULT_THRESHOLDS: PolicyThresholds;
+export declare function evaluatePolicy(state: TreasuryState, _thresholds?: PolicyThresholds): PolicyDecision[];
+export declare function aggregateDecisions(decisions: PolicyDecision[]): {
+    action: 'allow' | 'deny' | 'freeze';
+    blockingRules: PolicyDecision[];
+};
+export type { TreasuryState, PolicyDecision, PolicyThresholds };
+export { DEFAULT_THRESHOLDS };

package/dist/wizard/lib/financial/funding-policy.js

@@ -0,0 +1,179 @@
+/**
+ * Funding Policy — the 7 deterministic rules from PRD Section 15.
+ *
+ * Pure logic — no API calls, no file I/O, fully testable.
+ * Each rule evaluates independently and returns an allow/deny/freeze decision.
+ * All rules are evaluated on every cycle; the most restrictive decision wins.
+ *
+ * PRD Reference: §15 (Rules Engine V1)
+ * Agents: Dockson (treasury), Heartbeat daemon
+ */
+const DEFAULT_THRESHOLDS = {
+    googleInvoiceWindowDays: 7,
+    debitProtectionMultiplier: 1.0,
+};
+// ── Rule Evaluators ──────────────────────────────────
+function evaluateRule1(state) {
+    // Rule 1: Maintain minimum operating buffer
+    const balanceAfterReserve = (state.bankBalanceCents - state.reservedCents);
+    if (balanceAfterReserve < state.minimumBufferCents) {
+        return {
+            rule: 1,
+            action: 'deny',
+            reason: `Balance after reserves ($${(balanceAfterReserve / 100).toFixed(2)}) below minimum buffer ($${(state.minimumBufferCents / 100).toFixed(2)}) — deny non-essential spend`,
+        };
+    }
+    return {
+        rule: 1,
+        action: 'allow',
+        reason: `Balance after reserves ($${(balanceAfterReserve / 100).toFixed(2)}) above minimum buffer ($${(state.minimumBufferCents / 100).toFixed(2)})`,
+    };
+}
+function evaluateRule2(state) {
+    // Rule 2: Never off-ramp more than max daily treasury movement
+    if (state.proposedOfframpCents > state.maxDailyMovementCents) {
+        return {
+            rule: 2,
+            action: 'deny',
+            reason: `Proposed off-ramp ($${(state.proposedOfframpCents / 100).toFixed(2)}) exceeds max daily movement ($${(state.maxDailyMovementCents / 100).toFixed(2)})`,
+        };
+    }
+    return {
+        rule: 2,
+        action: 'allow',
+        reason: `Proposed off-ramp ($${(state.proposedOfframpCents / 100).toFixed(2)}) within max daily movement ($${(state.maxDailyMovementCents / 100).toFixed(2)})`,
+    };
+}
+function evaluateRule3(state) {
+    // Rule 3: Never raise platform budget if bank balance after reserve falls below floor
+    if (!state.proposingBudgetRaise) {
+        return {
+            rule: 3,
+            action: 'allow',
+            reason: 'No budget raise proposed',
+        };
+    }
+    const balanceAfterReserve = (state.bankBalanceCents - state.reservedCents);
+    if (balanceAfterReserve < state.minimumBufferCents) {
+        return {
+            rule: 3,
+            action: 'deny',
+            reason: `Cannot raise platform budget — balance after reserve ($${(balanceAfterReserve / 100).toFixed(2)}) below floor ($${(state.minimumBufferCents / 100).toFixed(2)})`,
+        };
+    }
+    return {
+        rule: 3,
+        action: 'allow',
+        reason: `Budget raise permitted — balance after reserve ($${(balanceAfterReserve / 100).toFixed(2)}) above floor ($${(state.minimumBufferCents / 100).toFixed(2)})`,
+    };
+}
+function evaluateRule4(state) {
+    // Rule 4: If Google invoice due within threshold, prioritize invoice coverage
+    if (!state.googleInvoiceDueSoon) {
+        return {
+            rule: 4,
+            action: 'allow',
+            reason: 'No Google invoice due soon',
+        };
+    }
+    const availableForInvoice = (state.bankBalanceCents - state.reservedCents - state.minimumBufferCents);
+    if (availableForInvoice < state.googleInvoiceCents) {
+        return {
+            rule: 4,
+            action: 'deny',
+            reason: `Google invoice ($${(state.googleInvoiceCents / 100).toFixed(2)}) due soon but only $${(availableForInvoice / 100).toFixed(2)} available after reserves and buffer — prioritize invoice coverage over new expansion`,
+        };
+    }
+    return {
+        rule: 4,
+        action: 'allow',
+        reason: `Google invoice ($${(state.googleInvoiceCents / 100).toFixed(2)}) due soon — sufficient funds available ($${(availableForInvoice / 100).toFixed(2)})`,
+    };
+}
+function evaluateRule5(state) {
+    // Rule 5: If Meta uses direct debit, maintain debit protection buffer above 7-day forecast
+    if (!state.metaUsesDirectDebit) {
+        return {
+            rule: 5,
+            action: 'allow',
+            reason: 'Meta does not use direct debit',
+        };
+    }
+    if (state.debitProtectionBufferCents < state.metaForecast7DayCents) {
+        return {
+            rule: 5,
+            action: 'deny',
+            reason: `Debit protection buffer ($${(state.debitProtectionBufferCents / 100).toFixed(2)}) below Meta 7-day forecast ($${(state.metaForecast7DayCents / 100).toFixed(2)}) — maintain buffer before other operations`,
+        };
+    }
+    return {
+        rule: 5,
+        action: 'allow',
+        reason: `Debit protection buffer ($${(state.debitProtectionBufferCents / 100).toFixed(2)}) above Meta 7-day forecast ($${(state.metaForecast7DayCents / 100).toFixed(2)})`,
+    };
+}
+function evaluateRule6(state) {
+    // Rule 6: If discrepancy exists, freeze spend increases but allow monitoring
+    if (!state.discrepancyExists) {
+        return {
+            rule: 6,
+            action: 'allow',
+            reason: 'No reconciliation discrepancy detected',
+        };
+    }
+    return {
+        rule: 6,
+        action: 'freeze',
+        reason: 'Reconciliation discrepancy detected — freeze spend increases, allow read-only monitoring',
+    };
+}
+function evaluateRule7(state) {
+    // Rule 7: If platform capability is MONITORED_ONLY, never claim autonomous funding
+    if (state.platformCapability !== 'MONITORED_ONLY') {
+        return {
+            rule: 7,
+            action: 'allow',
+            reason: `Platform capability is ${state.platformCapability} — autonomous funding rules apply normally`,
+        };
+    }
+    if (state.claimingAutonomousFunding) {
+        return {
+            rule: 7,
+            action: 'deny',
+            reason: 'Platform capability is MONITORED_ONLY — cannot claim autonomous funding support',
+        };
+    }
+    return {
+        rule: 7,
+        action: 'allow',
+        reason: 'Platform is MONITORED_ONLY but no autonomous funding claimed — monitoring allowed',
+    };
+}
+// ── Main Policy Evaluator ────────────────────────────
+// Evaluates all 7 rules and returns all decisions.
+// The caller should enforce the most restrictive: freeze > deny > allow.
+export function evaluatePolicy(state, _thresholds = DEFAULT_THRESHOLDS) {
+    return [
+        evaluateRule1(state),
+        evaluateRule2(state),
+        evaluateRule3(state),
+        evaluateRule4(state),
+        evaluateRule5(state),
+        evaluateRule6(state),
+        evaluateRule7(state),
+    ];
+}
+// ── Decision Aggregator ──────────────────────────────
+// Reduces a list of decisions to a single most-restrictive action.
+export function aggregateDecisions(decisions) {
+    const freezeRules = decisions.filter(d => d.action === 'freeze');
+    if (freezeRules.length > 0) {
+        return { action: 'freeze', blockingRules: freezeRules };
+    }
+    const denyRules = decisions.filter(d => d.action === 'deny');
+    if (denyRules.length > 0) {
+        return { action: 'deny', blockingRules: denyRules };
+    }
+    return { action: 'allow', blockingRules: [] };
+}
+export { DEFAULT_THRESHOLDS };