zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/agentActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentActions.d.ts","sourceRoot":"","sources":["../src/agentActions.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAgC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAc,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIzE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,sEAAuE,CAAC;AAE7G,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC;AAIvC,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GACvB,cAAc,CAAC,QAAQ,CAAC,GACxB,cAAc,GAAG,sBAAsB,GAAG,kBAAkB,GAC5D,wBAAwB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,oBAAoB,GAC7G,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,GACrD,qBAAqB,GAAG,uBAAuB,GAAG,cAAc,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAExH,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;IACnC,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,WAAW;IAEV,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IADnC,OAAO,CAAC,OAAO,CAA2C;gBAC7B,KAAK,CAAC,EAAE;QAAE,IAAI,IAAI,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAA;KAAE,YAAA;IAGxI,UAAU,CAAC,GAAG,SAAa,GAAG,MAAM;IAIpC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;CAM7C;AAID,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,SAAa,GAAG,IAAI,CAEnJ;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,SAAa,GAAG,IAAI,CAcvM;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C,CAAC;AASF,wBAAgB,wBAAwB,CAAC,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAYxK;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAOhL;AAED,mGAAmG;AACnG,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAQjI;AAED,wFAAwF;AACxF,wBAAsB,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAED,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAAC,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAS7I;AAED,yFAAyF;AACzF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAa7K;AAED,iEAAiE;AACjE,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAK9I;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBxH;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAgB1L;AAoBD,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,CAAC;AASF;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqC7I;AAED,+FAA+F;AAC/F,wBAAsB,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU;;;;;;;;;;;;;;;;;;GAkB5E;AAED,gFAAgF;AAChF,wBAAsB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU;;;;;;;;;;iBAagP,aAAa;;;;;;;GAC1U;AAID;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG;IAAE,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;GAa3G;AAID,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAG7D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,IAGnF,cAAc,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,CAiBtD;AAID,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAC7D,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IAC5C,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAxPK,CAAC;;;;;;;;;;;;wBAOpD,CAAC;gCAA2B,CAAC;4BAC5C,CAAC;yBAA0B,CAAC;uBAAc,CAAC;6BAAmC,CAAC;0BAE7D,CAAC;;;;;;;;;;;;;;;;;wBAU0L,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAsE7L,CAAC;uBAAqB,CAAC;;;;;;;kBACgD,CAAC;2BAGzF,CAAC;uBAAiB,CAAC;gCAA0B,CAAC;iCAA4B,CAAC;;;0BAG9B,CAAA;kBAAgB,CAAC;6BAIN,CAAC;0BAAwB,CAAC;;;;;;gBAMnC,CAAC;uBAAqB,CAAC;wBAChE,CAAC;uBAAqB,CAAC;;;;;;;;;;;;;gBAcsD,CAAC;cAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqD4B,CAAC;qBAAmB,CAAC;mBAAiB,CAAC;;;;;;;;6BAUvF,CAAA;0BAAwB,CAAC;;;;;;;;;;;iBA6B/E,CAAC;0BAAwB,CAAC;sBACzC,CAAC;qBACN,CAAH;mBAAiB,CAAC;mBACC,CAAC;oBACjB,CAAF;wBACI,CAAR;qBAAmB,CAAC;gBAAc,CAAC;mBAAiB,CAAC;eAAmB,CAAC;iBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;6BAiDf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAYxE;;;;;OAKG;oBACmB,MAAM,KAAK;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC5G,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KACjG;;;;;;;;;;;;IAYD;;;;OAIG;uBACsB,MAAM;;;;;;;IAU/B,sFAAsF;4BACxD,MAAM;;;;;;;;;IAKpC,uEAAuE;2BAC1C,MAAM;;;;;wBAKT,MAAM,WAAW,MAAM;;;IAIjD;;;;;;;;OAQG;mBACkB;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE;;;;;;;;;;;IA0B5H;;;;OAIG;4BAC2B,gBAAgB,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;;+BAU3D,MAAM,WAAW,MAAM;;;;2BAC3B,MAAM,WAAW,MAAM;;;0BACxB,UAAU;;;oBAtStB,CAAC;mBAAqB,CAAC;;;;;;;cACgD,CAAC;uBAGzF,CAAC;mBAAiB,CAAC;4BAA0B,CAAC;6BAA4B,CAAC;;;sBAG9B,CAAA;cAAgB,CAAC;yBAIN,CAAC;sBAAwB,CAAC;;;;OA2Rb,CAAC,CAAC,CAAC;;;;8BAIvC,MAAM;;;;IAItC;;;;OAIG;+BAC8B,MAAM;;;;;;;;;;IAIvC,oPAAoP;0BACxN,MAAM,KAAK;QAAE,QAAQ,EAAE,SAAS,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;2BAMhG,MAAM;;;IAInC,4FAA4F;8BAC5D,MAAM;;;4BAIR,MAAM,KAChC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACvH;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACpG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;;GAU9D;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAExK,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,WAAW,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC"}

package/build/agentActions.js

@@ -0,0 +1,581 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * agentActions.ts — `zklicensing/agent/actions`
+ *
+ * Lets an AI agent carry out actions with a key its owner gave it
+ * (PERMITS_PLAN.md §16.4): buy, renew and refund licenses, and accept
+ * permit grants. Every action starts from a `PreparedAction`
+ * (`zklicensing/agent` prepare*), then:
+ *
+ *  - the owner's optional policy is checked (caps per action and per day,
+ *    allowed actions, targets and networks) — none by default;
+ *  - consent the action needs (a consumer's withdrawal waiver, permit
+ *    conditions) must come from a **standing consent** the owner signed
+ *    for this agent, and a vendor may require the human's own consent
+ *    ('human-only'), in which case the agent gets the approval link instead;
+ *  - the agent's wallet signs and pays; the result carries a confirmation
+ *    that records who gave consent and under which authorisation.
+ *
+ * Loads o1js (identity derivation) on first use.
+ */
+import { signActionRecord, policyHash } from './agentRecord.js';
+import { AgentError } from './agent.js';
+import { notifyBroadcast } from './txBroadcastClient.js';
+import { minaUnit } from './units.js';
+/**
+ * Error codes raised here before anything reaches the keeper, on top of the
+ * keeper's own codes (see /openapi.json). None is retryable as is.
+ *  - POLICY_DENIED: the owner's policy doesn't allow the action.
+ *  - CONSENT_HUMAN_ONLY: the vendor wants the human's own consent; hand them
+ *    the approval link in the message.
+ *  - CONSENT_REQUIRED: no standing consent covers what the action needs.
+ */
+export const AGENT_ACTION_ERROR_CODES = ['POLICY_DENIED', 'CONSENT_HUMAN_ONLY', 'CONSENT_REQUIRED'];
+/** Spend record for the per-day cap. Pass `load`/`save` to persist it. */
+export class SpendLedger {
+    store;
+    entries = [];
+    constructor(store) {
+        this.store = store;
+        if (store)
+            this.entries = store.load().map(e => ({ at: e.at, nano: BigInt(e.nano) }));
+    }
+    spentOnDay(now = Date.now()) {
+        const day = Math.floor(now / 86_400_000);
+        return this.entries.filter(e => Math.floor(e.at / 86_400_000) === day).reduce((a, e) => a + e.nano, 0n);
+    }
+    record(nano, now = Date.now()) {
+        this.entries.push({ at: now, nano });
+        const cutoff = now - 2 * 86_400_000;
+        this.entries = this.entries.filter(e => e.at >= cutoff);
+        this.store?.save(this.entries.map(e => ({ at: e.at, nano: e.nano.toString() })));
+    }
+}
+const toNano = (mina) => BigInt(Math.round(mina * 1e9));
+/** Throws POLICY_DENIED when the owner's policy doesn't allow this action. */
+export function checkPolicy(policy, prepared, target, ledger, now = Date.now()) {
+    checkActionPolicy(policy, { action: prepared.action, network: prepared.network, target, amountNano: prepared.action === 'refund' ? 0n : BigInt(prepared.amounts.total) }, ledger, now);
+}
+/**
+ * The policy check for any action. `target` is the zkApp or registry acted
+ * on (none for a registry not yet deployed); `amountNano` what leaves the
+ * wallet besides transaction fees.
+ */
+export function checkActionPolicy(policy, a, ledger, now = Date.now()) {
+    if (!policy)
+        return;
+    const deny = (why) => { throw new AgentError(`Not allowed by the owner's policy: ${why}`, 'POLICY_DENIED', 0, false); };
+    if (policy.allowedActions && !policy.allowedActions.includes(a.action))
+        deny(`action "${a.action}"`);
+    if (policy.networks && !policy.networks.includes(a.network))
+        deny(`network ${a.network}`);
+    if (policy.allowedTargets && a.target !== undefined && !policy.allowedTargets.includes(a.target))
+        deny(`target ${a.target}`);
+    const amount = a.amountNano ?? 0n;
+    if (policy.maxPerActionMina !== undefined && amount > toNano(policy.maxPerActionMina))
+        deny(`amount above ${policy.maxPerActionMina} ${minaUnit(a.network)} per action`);
+    // The daily cap counts what actions spend: one that spends nothing (terms,
+    // details, prices, listings, signatures, refunds) needs no ledger for it.
+    if (policy.maxPerDayMina !== undefined && amount > 0n) {
+        if (!ledger)
+            deny('a daily cap needs a SpendLedger');
+        if (ledger.spentOnDay(now) + amount > toNano(policy.maxPerDayMina))
+            deny(`daily cap of ${policy.maxPerDayMina} ${minaUnit(a.network)}`);
+    }
+}
+const KIND_TEXT = {
+    'withdrawal-waiver': 'waive my right of withdrawal when a purchase or renewal takes effect immediately',
+    'vendor-terms': 'accept the vendor terms of service and register apps, waiving my right of withdrawal on each registration fee',
+    'authority-terms': 'accept authority terms of service',
+    'permit-conditions': 'accept the conditions of permits granted to me',
+};
+export function standingConsentStatement(f) {
+    return [
+        'zkLicensing standing consent',
+        `owner: ${f.owner}`,
+        `agent: ${f.agent}`,
+        `network: ${f.network}`,
+        `issuedAt: ${f.issuedAt}`,
+        `expiresAt: ${f.expiresAt ?? 'until revoked'}`,
+        'I authorise this agent, acting with its own key, to give the following consents on my behalf:',
+        ...[...f.kinds].sort().map(k => `- ${KIND_TEXT[k]}`),
+        'Each consent it gives is recorded as given by this agent under this authorisation.',
+    ].join('\n');
+}
+/** How long a standing consent lasts unless the owner chooses otherwise. */
+export const DEFAULT_CONSENT_DAYS = 90;
+/**
+ * The owner signs a standing consent for an agent with their own wallet.
+ * It expires after DEFAULT_CONSENT_DAYS unless `expiresAt` is given; pass
+ * `expiresAt: null` for a consent that lasts until revoked.
+ */
+export async function grantStandingConsent(owner, f) {
+    if (f.kinds.length === 0)
+        throw new AgentError('kinds must not be empty', 'INVALID_REQUEST', 0, false);
+    const issued = new Date();
+    const expiresAt = f.expiresAt === undefined ? new Date(issued.getTime() + DEFAULT_CONSENT_DAYS * 86_400_000).toISOString() : f.expiresAt;
+    const fields = { owner: owner.address, agent: f.agent, kinds: f.kinds, network: f.network, issuedAt: issued.toISOString(), expiresAt };
+    const statement = standingConsentStatement(fields);
+    return { version: 1, ...fields, statement, signature: await owner.signMessage(statement) };
+}
+/** Checks a standing consent's text and signature (mina-signer, as for wallet text signatures). */
+export async function verifyStandingConsent(c, now = Date.now()) {
+    if (c?.version !== 1)
+        return { ok: false, reason: 'unknown consent format' };
+    if (c.statement !== standingConsentStatement(c))
+        return { ok: false, reason: 'statement does not match its fields' };
+    if (c.expiresAt && Date.parse(c.expiresAt) <= now)
+        return { ok: false, reason: 'expired' };
+    const { default: Client } = await import('mina-signer');
+    const signer = new Client({ network: c.network === 'mainnet' ? 'mainnet' : 'testnet' });
+    const ok = signer.verifyMessage({ data: c.statement, publicKey: c.owner, signature: c.signature });
+    return ok ? { ok: true, reason: null } : { ok: false, reason: 'signature does not verify for the owner' };
+}
+/** SHA-256 (hex) of a consent's statement: how a consent is referred to and revoked. */
+export async function consentId(c) {
+    return sha256Hex(c.statement);
+}
+/** The text an owner signs to revoke a standing consent. */
+export function standingConsentRevocationStatement(f) {
+    return [
+        'zkLicensing standing consent revocation',
+        `owner: ${f.owner}`,
+        `consent: ${f.statementSha256}`,
+        `network: ${f.network}`,
+        `revokedAt: ${f.revokedAt}`,
+        'I revoke this standing consent. My agent may no longer give consent on my behalf under it.',
+    ].join('\n');
+}
+/** The owner revokes a standing consent at the keeper, signing with their own wallet. */
+export async function revokeStandingConsent(owner, consent, opts) {
+    if (owner.address !== consent.owner)
+        throw new AgentError('Only the consent\'s owner can revoke it', 'FORBIDDEN', 0, false);
+    const statementSha256 = await consentId(consent);
+    const revokedAt = new Date().toISOString();
+    const statement = standingConsentRevocationStatement({ owner: owner.address, statementSha256, network: consent.network, revokedAt });
+    const signature = await owner.signMessage(statement);
+    const r = await (opts.fetcher ?? fetch)(`${opts.keeperUrl.replace(/\/+$/, '')}/consents/revoke`, {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ owner: owner.address, statementSha256, network: consent.network, revokedAt, signature }),
+    });
+    const body = await r.json().catch(() => ({}));
+    if (!r.ok)
+        throw new AgentError(body.error ?? `HTTP ${r.status}`, body.code ?? 'UPSTREAM_UNAVAILABLE', r.status, body.retryable ?? r.status >= 500);
+    return { revokedAt };
+}
+/** Whether the owner has revoked a consent (asks the keeper). */
+export async function isStandingConsentRevoked(consent, opts) {
+    const id = await consentId(consent);
+    const r = await (opts.fetcher ?? fetch)(`${opts.keeperUrl.replace(/\/+$/, '')}/consents/${id}?owner=${encodeURIComponent(consent.owner)}`);
+    if (!r.ok)
+        throw new AgentError(`Could not check whether the consent was revoked (HTTP ${r.status})`, 'UPSTREAM_UNAVAILABLE', r.status, true);
+    return (await r.json()).revoked === true;
+}
+/** Signs the action record; a failure becomes a warning (the payment is already sent). */
+async function recordAction(opts, prepared, consent, f) {
+    try {
+        const actionRecord = await signActionRecord(opts.wallet, {
+            network: prepared.network, action: prepared.action, target: f.target, reference: f.reference, summary: prepared.summary,
+            amounts: prepared.amounts, txHash: f.txHash, receipt: f.receipt ?? null, policySha256: await policyHash(opts.policy),
+            consent: consent.givenBy === 'agent' ? { givenBy: 'agent', statementSha256: consent.statementSha256, kinds: [...consent.kinds] } : { givenBy: 'none' },
+            at: new Date().toISOString(),
+        });
+        return { actionRecord, warnings: [] };
+    }
+    catch (e) {
+        return { warnings: [`The action record could not be signed (${e?.message ?? e}).`] };
+    }
+}
+async function sha256Hex(text) {
+    const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+    return [...new Uint8Array(d)].map(b => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Consent the prepared action needs, from the standing consent. Refuses
+ * when the vendor requires the human's own consent, returning the approval
+ * link in the error so the agent can hand it to the human.
+ */
+export async function consentFor(prepared, agentAddress, consent, keeper) {
+    const needed = prepared.requiresConsent;
+    if (needed.length === 0)
+        return { givenBy: 'none' };
+    if (needed.includes('withdrawal-waiver') && !prepared.agentMayConsent) {
+        throw new AgentError(`The vendor requires the buyer's own consent for this purchase. Ask the human to approve it: ${prepared.approvalUrl ?? '(no approval page)'}`, 'CONSENT_HUMAN_ONLY', 0, false);
+    }
+    if (!consent)
+        throw new AgentError(`This action needs consent (${needed.join(', ')}); none was given. Ask the human: ${prepared.approvalUrl ?? '(no approval page)'}`, 'CONSENT_REQUIRED', 0, false);
+    if (consent.agent !== agentAddress)
+        throw new AgentError('The standing consent is for another agent key', 'CONSENT_REQUIRED', 0, false);
+    if (consent.network !== prepared.network)
+        throw new AgentError('The standing consent is for another network', 'CONSENT_REQUIRED', 0, false);
+    const missing = needed.filter(k => !consent.kinds.includes(k));
+    if (missing.length)
+        throw new AgentError(`The standing consent does not cover: ${missing.join(', ')}`, 'CONSENT_REQUIRED', 0, false);
+    const v = await verifyStandingConsent(consent);
+    if (!v.ok)
+        throw new AgentError(`Standing consent is not valid: ${v.reason}`, 'CONSENT_REQUIRED', 0, false);
+    // Fails closed: an agent that can't confirm the consent still stands doesn't use it.
+    if (keeper && await isStandingConsentRevoked(consent, keeper))
+        throw new AgentError('The owner has revoked this standing consent', 'CONSENT_REQUIRED', 0, false);
+    return { givenBy: 'agent', agent: consent.agent, owner: consent.owner, kinds: needed, statementSha256: await sha256Hex(consent.statement), issuedAt: consent.issuedAt };
+}
+/** Runs the keeper confirm step after a transaction is sent; a failure becomes a warning. */
+async function afterSend(confirm, step) {
+    let last;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            return { warnings: [], result: await confirm() };
+        }
+        catch (e) {
+            last = e;
+            await new Promise(r => setTimeout(r, 500 * 2 ** attempt));
+        }
+    }
+    return { warnings: [`The transaction was sent but the keeper did not record it (${last?.message}). Keep the result and retry ${step} with the transaction hash.`] };
+}
+function assertFresh(prepared) {
+    if (Date.parse(prepared.expiresAt) <= Date.now())
+        throw new AgentError('The prepared action has expired; prepare it again', 'REQUEST_STALE', 0, true);
+}
+function randomPassphrase() {
+    const b = crypto.getRandomValues(new Uint8Array(24));
+    return btoa(String.fromCharCode(...b)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+// ── licensing ────────────────────────────────────────────────────────────────
+/**
+ * Buys a license. The license belongs to a key derived from `passphrase`
+ * (generated if omitted) — keep the returned passphrase and license file:
+ * they are the license.
+ */
+export async function buyLicense(prepared, opts) {
+    if (prepared.action !== 'buy')
+        throw new AgentError('Not a prepared purchase', 'INVALID_REQUEST', 0, false);
+    assertFresh(prepared);
+    const zkAppAddress = String(prepared.params.zkAppAddress);
+    checkPolicy(opts.policy, prepared, zkAppAddress, opts.ledger);
+    const consent = await consentFor(prepared, opts.wallet.address, opts.consent, { keeperUrl: opts.keeperUrl, fetcher: opts.fetcher });
+    const { deriveBuyIdentity, proveBuy, confirmBuy } = await import('./buyClient.js');
+    const passphrase = opts.passphrase ?? randomPassphrase();
+    const identity = await deriveBuyIdentity(passphrase, zkAppAddress);
+    const proved = await proveBuy({
+        keeperUrl: opts.keeperUrl, licenseHash: identity.licenseHash.toString(), buyerAddress: opts.wallet.address, zkAppAddress,
+        ownerPubKey: identity.publicKeyBase58, network: prepared.network, duration: prepared.params.duration,
+        buyerCountry: opts.buyerCountry, buyerZip: opts.buyerZip,
+        refundWaiverAccepted: prepared.params.escrowless === true, fetcher: opts.fetcher,
+        agentConsent: consent.givenBy === 'agent' ? opts.consent : undefined,
+    });
+    const txHash = await opts.wallet.signAndSendTransaction(proved.provenTxJson);
+    opts.ledger?.record(BigInt(prepared.amounts.total));
+    await notifyBroadcast({ keeperUrl: opts.keeperUrl, appId: proved.appKey, txHash, fetcher: opts.fetcher });
+    // The payment is sent: never throw past this point, or the passphrase
+    // (the license itself) would be lost with the error.
+    const { warnings, result: confirmed } = await afterSend(() => confirmBuy({ keeperUrl: opts.keeperUrl, zkAppAddress, licenseHash: proved.licenseHash, txHash, fetcher: opts.fetcher }), 'confirmBuy (zklicensing/buy)');
+    const rec = await recordAction(opts, prepared, consent, { target: zkAppAddress, reference: proved.licenseHash, txHash, receipt: confirmed?.receipt?.number });
+    return {
+        txHash,
+        warnings: [...warnings, ...rec.warnings],
+        ...(rec.actionRecord ? { actionRecord: rec.actionRecord } : {}),
+        passphrase,
+        // The receipt in the vendor's name (zklicensing/receipt): keep it apart from the license file.
+        ...(confirmed?.receipt ? { receipt: confirmed.receipt } : {}),
+        proofFile: {
+            licenseHash: proved.licenseHash, expirySlot: proved.expirySlot, zkAppAddress, network: prepared.network, txHash,
+            tier: proved.durationLabel, verificationKeyHash: proved.verificationKeyHash, purchaseSlot: proved.purchaseSlot,
+            purchaseAmount: proved.purchaseAmount, escrowless: prepared.params.escrowless === true, generation: proved.generation, pending: true,
+        },
+        confirmation: { action: 'buy', summary: prepared.summary, amounts: prepared.amounts, consent, at: new Date().toISOString() },
+    };
+}
+/** Renews a license; always needs the withdrawal waiver (renewals take effect immediately). */
+export async function renewLicense(prepared, opts) {
+    if (prepared.action !== 'renew')
+        throw new AgentError('Not a prepared renewal', 'INVALID_REQUEST', 0, false);
+    assertFresh(prepared);
+    const zkAppAddress = String(prepared.params.zkAppAddress);
+    checkPolicy(opts.policy, prepared, zkAppAddress, opts.ledger);
+    const consent = await consentFor(prepared, opts.wallet.address, opts.consent, { keeperUrl: opts.keeperUrl, fetcher: opts.fetcher });
+    const { proveRenew, confirmRenew } = await import('./renewClient.js');
+    const proved = await proveRenew({
+        keeperUrl: opts.keeperUrl, licenseHash: String(prepared.params.licenseHash), buyerAddress: opts.wallet.address, zkAppAddress,
+        network: prepared.network, duration: prepared.params.duration, waiverAccepted: true, fetcher: opts.fetcher,
+        agentConsent: consent.givenBy === 'agent' ? opts.consent : undefined,
+    });
+    const txHash = await opts.wallet.signAndSendTransaction(proved.provenTxJson);
+    opts.ledger?.record(BigInt(prepared.amounts.total));
+    await notifyBroadcast({ keeperUrl: opts.keeperUrl, appId: proved.appKey, txHash, fetcher: opts.fetcher });
+    const { warnings, result: confirmed } = await afterSend(() => confirmRenew({ keeperUrl: opts.keeperUrl, zkAppAddress, licenseHash: proved.licenseHash, txHash, fetcher: opts.fetcher }), 'confirmRenew (zklicensing/renew)');
+    const rec = await recordAction(opts, prepared, consent, { target: zkAppAddress, reference: proved.licenseHash, txHash, receipt: confirmed?.receipt?.number });
+    return { txHash, warnings: [...warnings, ...rec.warnings], ...(rec.actionRecord ? { actionRecord: rec.actionRecord } : {}), newExpirySlot: proved.newExpirySlot, ...(confirmed?.receipt ? { receipt: confirmed.receipt } : {}), confirmation: { action: 'renew', summary: prepared.summary, amounts: prepared.amounts, consent, at: new Date().toISOString() } };
+}
+/** Refunds a license inside its 14-day window, to the wallet that bought it. */
+export async function refundLicense(prepared, opts) {
+    if (prepared.action !== 'refund')
+        throw new AgentError('Not a prepared refund', 'INVALID_REQUEST', 0, false);
+    assertFresh(prepared);
+    const zkAppAddress = String(prepared.params.zkAppAddress);
+    checkPolicy(opts.policy, prepared, zkAppAddress, opts.ledger);
+    const { proveRefund, confirmRefund } = await import('./refundClient.js');
+    const proved = await proveRefund({
+        keeperUrl: opts.keeperUrl, licenseHash: String(prepared.params.licenseHash), buyerAddress: opts.wallet.address, zkAppAddress,
+        network: prepared.network, fetcher: opts.fetcher,
+    });
+    const txHash = await opts.wallet.signAndSendTransaction(proved.provenTxJson);
+    const { warnings, result: confirmed } = await afterSend(() => confirmRefund({ keeperUrl: opts.keeperUrl, zkAppAddress, licenseHash: proved.licenseHash, txHash, fetcher: opts.fetcher }), 'confirmRefund (zklicensing/refund)');
+    const rec = await recordAction(opts, prepared, { givenBy: 'none' }, { target: zkAppAddress, reference: proved.licenseHash, txHash, receipt: confirmed?.creditNote?.number });
+    return { txHash, warnings: [...warnings, ...rec.warnings], ...(rec.actionRecord ? { actionRecord: rec.actionRecord } : {}), ...(confirmed?.creditNote ? { creditNote: confirmed.creditNote } : {}), confirmation: { action: 'refund', summary: prepared.summary, amounts: prepared.amounts, consent: { givenBy: 'none' }, at: new Date().toISOString() } };
+}
+// ── permits ──────────────────────────────────────────────────────────────────
+/**
+ * Accepts a permit grant as its holder (the agent's wallet must be the
+ * holder key) and pays with `payer` (default the same wallet).
+ */
+export async function acceptPermitGrant(prepared, opts) {
+    if (prepared.action !== 'accept-permit')
+        throw new AgentError('Not a prepared permit acceptance', 'INVALID_REQUEST', 0, false);
+    assertFresh(prepared);
+    const registry = String(prepared.params.registry);
+    checkPolicy(opts.policy, prepared, registry, opts.ledger);
+    if (prepared.params.holderKey !== opts.wallet.address)
+        throw new AgentError('The agent wallet is not the permit holder', 'FORBIDDEN', 0, false);
+    const consent = await consentFor(prepared, opts.wallet.address, opts.consent, { keeperUrl: opts.keeperUrl, fetcher: opts.fetcher });
+    const { createPermitsClient } = await import('./permitsClient.js');
+    const client = createPermitsClient({ keeperUrl: opts.keeperUrl, network: prepared.network, wallet: opts.wallet, fetcher: opts.fetcher });
+    const res = await client.acceptGrant(String(prepared.params.requestId), opts.payer);
+    opts.ledger?.record(BigInt(prepared.amounts.total));
+    const rec = await recordAction(opts, prepared, consent, { target: registry, reference: res.subject, txHash: res.txHash, receipt: res.receipt?.number });
+    return { ...res, ...(rec.actionRecord ? { actionRecord: rec.actionRecord } : {}), ...(rec.warnings.length ? { warnings: rec.warnings } : {}), confirmation: { action: 'accept-permit', summary: prepared.summary, amounts: prepared.amounts, consent, docHash: prepared.params.docHash ?? null, at: new Date().toISOString() } };
+}
+// ── broadcasting ─────────────────────────────────────────────────────────────
+/** Public Mina nodes used to broadcast when no URL is given (as onChainRoot's defaults). */
+export const DEFAULT_SEND_GRAPHQL_URLS = {
+    mainnet: 'https://api.minascan.io/node/mainnet/v1/graphql',
+    devnet: 'https://devnet-plain-1.gcp.o1test.net/graphql',
+};
+/**
+ * A `send` for `minaSignerWallet` that posts the signed zkApp command to a
+ * Mina node's GraphQL `sendZkapp` — no o1js needed.
+ */
+export function graphqlSender(network, opts = {}) {
+    const url = opts.url ?? DEFAULT_SEND_GRAPHQL_URLS[network];
+    const fetcher = opts.fetcher ?? fetch;
+    return async (zkappCommand) => {
+        const resp = await fetcher(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                query: 'mutation($input: SendZkappInput!) { sendZkapp(input: $input) { zkapp { hash } } }',
+                variables: { input: { zkappCommand } },
+            }),
+        });
+        const body = await resp.json().catch(() => null);
+        const hash = body?.data?.sendZkapp?.zkapp?.hash;
+        if (!resp.ok || !hash) {
+            const why = body?.errors?.map(e => e.message).join('; ') || `HTTP ${resp.status}`;
+            throw new AgentError(`The Mina node refused the transaction: ${why}`, 'UPSTREAM_UNAVAILABLE', resp.status, resp.status >= 500);
+        }
+        return hash;
+    };
+}
+/**
+ * Every permits flow for an agent key, with the owner's policy checked
+ * first: as an operator (apply, withdraw, surrender, prove access) and as an
+ * authority key-set member (create and deploy a registry, decide
+ * applications, sign and execute requests, request changes). Signing a
+ * request is one key's approval; the registry's threshold still applies.
+ */
+export async function createPermitAgent(opts) {
+    const { createPermitsClient } = await import('./permitsClient.js');
+    const client = createPermitsClient({ keeperUrl: opts.keeperUrl, network: opts.network, wallet: opts.wallet, fetcher: opts.fetcher });
+    const net = opts.network;
+    const allow = (action, target) => checkActionPolicy(opts.policy, { action, network: net, target }, opts.ledger);
+    const registryOf = async (requestId) => (await client.getRequest(requestId)).request;
+    // Pays an application, retrying while the keeper is busy (another proof,
+    // the registry syncing). If it still can't, the application stays saved
+    // unpaid: the error names it, so it is paid (or withdrawn) rather than
+    // applied for again, which would make another and use up the key's places.
+    const payWithRetry = async (id) => {
+        const until = Date.now() + (opts.payRetryMs ?? 180_000);
+        for (;;) {
+            try {
+                return await client.fileApplication(id);
+            }
+            catch (e) {
+                const wait = Math.min(60_000, Number(e?.body?.retryAfterMs ?? e?.retryAfterMs ?? 15_000));
+                if (e?.retryable === true && Date.now() + wait < until) {
+                    await new Promise(r => setTimeout(r, wait));
+                    continue;
+                }
+                throw new AgentError(`${e?.message ?? String(e)}. Application ${id} is saved unpaid: pay it with pay_permit_application (payApplication) or withdraw it; applying again makes another application.`, typeof e?.code === 'string' ? e.code : 'INTERNAL', typeof e?.status === 'number' ? e.status : 0, e?.retryable === true, e?.body?.retryAfterMs, { applicationId: id });
+            }
+        }
+    };
+    return {
+        client,
+        address: opts.wallet.address,
+        // operator
+        /**
+         * Applies for a permit (`subject`: renew or change this key's permit) and
+         * pays the fee into escrow from this key: a spend under the owner's
+         * policy (the full fee; on a rejection or withdrawal only the processing
+         * fee is kept, with no decision by the deadline nothing).
+         */
+        async apply(registry, a) {
+            allow('apply-permit', registry);
+            const { chain } = await client.getRegistry(registry);
+            const fee = BigInt((a.subject ? chain?.fees?.renewalFee : chain?.fees?.grantFee) ?? 0);
+            checkActionPolicy(opts.policy, { action: 'apply-permit', network: net, target: registry, amountNano: fee }, opts.ledger);
+            const created = await client.apply(registry, { ...a, holderKey: opts.wallet.address, pay: false });
+            const due = BigInt(created.apply?.fee ?? fee);
+            if (due !== fee)
+                checkActionPolicy(opts.policy, { action: 'apply-permit', network: net, target: registry, amountNano: due }, opts.ledger);
+            const filed = await payWithRetry(created.application.id);
+            opts.ledger?.record(due);
+            return { ...created, ...filed };
+        },
+        /**
+         * Pays an application this key made that is still unpaid (submitted):
+         * for one whose payment `apply` couldn't complete. A spend under the
+         * owner's policy, as `apply`.
+         */
+        async payApplication(id) {
+            const { application, apply } = await client.getApplication(id);
+            allow('apply-permit', application?.registry);
+            if (!apply)
+                throw new AgentError(`Application ${id} is ${application?.status}: nothing to pay`, 'CONFLICT', 409, false);
+            const due = BigInt(apply.fee ?? 0);
+            checkActionPolicy(opts.policy, { action: 'apply-permit', network: net, target: application.registry, amountNano: due }, opts.ledger);
+            const filed = await payWithRetry(id);
+            opts.ledger?.record(due);
+            return { application: { ...application, status: 'filed' }, ...filed };
+        },
+        /** Withdraws an application (paid: the processing fee is kept, the rest refunded). */
+        async withdrawApplication(id) {
+            const { application } = await client.getApplication(id);
+            allow('withdraw-application', application?.registry);
+            return client.withdrawApplication(id);
+        },
+        /** After the decision deadline: returns the whole fee to the payer. */
+        async reclaimApplication(id) {
+            const { application } = await client.getApplication(id);
+            allow('withdraw-application', application?.registry);
+            return client.reclaimApplication(id);
+        },
+        async surrender(registry, subject) {
+            allow('surrender-permit', registry);
+            return client.surrender(registry, subject);
+        },
+        /**
+         * Proves this key holds an active permit covering `requiredScope`,
+         * without revealing which permit (zero-knowledge holder proof). Give the
+         * verifier the proof. The challenge is bound to the verifier: `verifier`
+         * is the identity this agent is actually talking to (the service's URL,
+         * not a name it claims) and `nonce` the number it handed out, so two
+         * services cannot link the agent by agreeing on one challenge. The
+         * permit's secret is re-derived with this key (findHolderSecret).
+         */
+        async proveAccess(a) {
+            const [{ proveHolder, holderProofMessage, verifierContext, normalizeVerifier }, { findHolderSecret }, { recordToLeaf }, { PublicKey, Field }] = await Promise.all([
+                import('./permitProof.js'), import('./holderSecret.js'), import('./permitRegistryRebuild.js'), import('o1js'),
+            ]);
+            let context;
+            let verifier;
+            try {
+                verifier = normalizeVerifier(a.verifier);
+                context = verifierContext(verifier, a.nonce);
+            }
+            catch (e) {
+                throw new AgentError(e?.message ?? String(e), 'INVALID_REQUEST', 0, false);
+            }
+            const served = await client.getPermit(a.registry, a.subject);
+            if (!served.permit)
+                throw new AgentError('Permit not found', 'NOT_FOUND', 404, false);
+            if (served.permit.holderKey !== opts.wallet.address)
+                throw new AgentError('This key is not the permit holder', 'FORBIDDEN', 403, false);
+            // Asked through an earlier generation's address, the permit comes from the current one: prove there.
+            const home = served.registry ?? a.registry;
+            let secret;
+            try {
+                ({ secret } = await findHolderSecret(opts.wallet, { lineage: await client.registryLineage(home), network: net, subject: a.subject }));
+            }
+            catch (e) {
+                throw new AgentError(e?.message ?? String(e), 'FORBIDDEN', 403, false);
+            }
+            const msg = holderProofMessage(PublicKey.fromBase58(home), Field(served.root), Field(context));
+            const sig = await opts.wallet.signFields(msg.map((f) => f.toString()));
+            const r = await proveHolder({
+                registry: home, root: served.root, witness: served.witness, leaf: recordToLeaf(served.permit), holderSecret: secret,
+                slot: served.slot, requiredScope: a.requiredScope ?? 0n, context, holderSignature: sig,
+            });
+            return { ...r, registry: home, root: served.root, slot: served.slot, verifier, nonce: String(a.nonce), context: context.toString(), requiredScope: (a.requiredScope ?? 0n).toString() };
+        },
+        // authority
+        /**
+         * Accepts the Authority Terms with the agent key, for its owner. Needs a
+         * standing consent covering 'authority-terms'; the keeper records the
+         * acceptance as given by this agent under that authorisation.
+         */
+        async acceptAuthorityTerms(f) {
+            allow('accept-authority-terms');
+            const c = opts.consent;
+            if (!c || c.agent !== opts.wallet.address || c.network !== net || !c.kinds.includes('authority-terms')) {
+                throw new AgentError('Accepting the Authority Terms needs a standing consent from the owner covering authority-terms for this agent key', 'CONSENT_REQUIRED', 0, false);
+            }
+            const v = await verifyStandingConsent(c);
+            if (!v.ok)
+                throw new AgentError(`Standing consent is not valid: ${v.reason}`, 'CONSENT_REQUIRED', 0, false);
+            return client.acceptAuthorityTerms({ ...f, agentConsent: c });
+        },
+        async listApplications(registry, status) { return client.listApplications(registry, status); },
+        async listRequests(registry, status) { return client.listRequests(registry, status); },
+        async createRegistry(draft) {
+            allow('create-registry');
+            return client.createRegistry(draft);
+        },
+        async deployRegistry(requestId) {
+            allow('deploy-registry');
+            return client.deployRegistry(requestId);
+        },
+        /**
+         * Starts a redeploy to the current release: two requests for the keys,
+         * retire (sign, then execute_request) and the new registry (sign, then
+         * deployRegistry; after a pending hard fork). Every permit carries over to it.
+         */
+        async redeployRegistry(registry) {
+            allow('redeploy-registry', registry);
+            return client.redeployRegistry(registry);
+        },
+        /** Approves exactly what was applied for, or rejects (the processing fee is kept): a request for the authority keys to sign (an unpaid one whose payment waits for a Mina upgrade may be decided before payment; the request follows once paid). */
+        async decideApplication(id, d) {
+            const { application } = await client.getApplication(id);
+            allow('decide-application', application?.registry);
+            if (d.decision === 'reject')
+                return client.rejectApplication(id, d.reason, d.reasonCode);
+            return client.approveApplication(id);
+        },
+        async signRequest(requestId) {
+            allow('sign-request', (await registryOf(requestId)).registry);
+            return client.signRequest(requestId);
+        },
+        /** Proves and pays for a fully signed non-grant request (grants are paid by the holder). */
+        async executeRequest(requestId) {
+            allow('execute-request', (await registryOf(requestId)).registry);
+            return client.executeRequest(requestId);
+        },
+        async requestChange(registry, c) {
+            allow('request-change', registry);
+            switch (c.kind) {
+                case 'renewal': {
+                    const { kind: _k, subject, ...change } = c;
+                    return client.requestRenewal(registry, subject, change);
+                }
+                case 'status': return client.requestStatus(registry, c.subject, c.action, c.reasonCode);
+                case 'fees': return client.requestFees(registry, c.grantFeeMina, c.renewalFeeMina);
+                case 'rotation': return client.requestRotation(registry, c.keys, c.threshold);
+            }
+        },
+    };
+}
+export { signActionRecord, verifyActionRecord, actionRecordStatement, policyHash, canonicalJson, ACTION_RECORD_LIMITS } from './agentRecord.js';
+export { createVendorAgent, vendorAcceptanceMessage, billingHash, REGISTRATION_FEE_MINA } from './agentVendor.js';
+//# sourceMappingURL=agentActions.js.map