# Generated from:
# "run my site for $500/month. no annual plans.
#  never advertise. ask before spending more than $50."

version: "1.0"
goal:
  id: operate_web_business
  description: "Keep the site online and fulfill paid customer work"

budget:
  currency: USD
  monthly_total: 500
  max_single_payment: 50
  period_anchor: calendar_month
  split_window: 72h

card:
  allowed_categories: [hosting, domains, software, data]
  blocked_categories: [advertising, gambling, cash_advance]
  subscription_periods: [monthly]
  require_receipt: true

onchain:
  chain_id: 46630
  settlement_asset: USDG
  borrowing: false
  unknown_contracts: deny
  max_slippage_bps: 50

approval:
  owner_signature_above: 50
  always_require_for: [new_merchant, permission_change, bridge]

failure:
  policy: fail_closed
  stale_price_after: 5m
  reconciliation_timeout: 15m
  on_mismatch: freeze_and_notify

import { keccak256, toBytes } from "viem";
import { PolicySchema, type Policy } from "@mimor/policy";
import { builder, breaker } from "@mimor/agents";
import { canonicalize, encodePolicy } from "./canonicalize";

const REQUIRED_FIELDS = [
  "budget.monthly_total",
  "budget.max_single_payment",
  "failure.policy"
] as const;

export type Compilation = {
  policy: Policy;
  policyRoot: `0x${string}`;
  explanation: string[];
  attacks: Counterexample[];
  requiresConfirmation: true;
};

export async function compileMandate(humanIntent: string): Promise<Compilation> {
  if (humanIntent.trim().length < 12) {
    throw new InvalidMandate("mandate is too ambiguous");
  }

  // The builder can propose policy. It can never approve its own output.
  const proposal = await builder.generateObject({
    schema: PolicySchema,
    input: humanIntent,
    defaults: SAFE_DEFAULTS,
    instruction: "Never infer permission. Missing authority means deny."
  });

  const policy = canonicalize(PolicySchema.parse(proposal.object));
  assertFields(policy, REQUIRED_FIELDS);
  assertNoContradictions(policy);
  assertKnownAssets(policy.onchain.assets);

  // Search sequences, not only individual calls. Five legal $20 payments
  // may still violate a $50 aggregate merchant limit.
  const attacks = await breaker.findCounterexamples(policy, {
    targets: [
      "split-spend", "approval-bypass", "asset-hop",
      "stale-oracle", "subscription-upgrade", "delegatecall"
    ],
    maxDepth: 8,
    maxScenarios: 2_000
  });

  const escaped = attacks.filter((attack) => attack.succeeded);
  if (escaped.length) throw new UnsafeMandate(escaped);

  const encoded = encodePolicy(policy);
  return {
    policy,
    policyRoot: keccak256(toBytes(encoded)),
    explanation: explainDiff(humanIntent, policy),
    attacks,
    requiresConfirmation: true
  };
}

export async function deployConfirmedMandate(result: Compilation, signature: Hex) {
  verifyOwnerSignature(result.policyRoot, signature);

  const account = await deployPolicyAccount({
    chainId: 46630,
    entryPoint: ENTRY_POINT_V07,
    policyRoot: result.policyRoot,
    ownerSignature: signature
  });

  return {
    account,
    sessionKey: await issueSessionKey(account, scopeSession(result.policy)),
    cardControls: mapToCardControls(result.policy)
  };
}

export async function executePlan(plan: EconomicPlan, ctx: RuntimeContext) {
  const saga = await ctx.ledger.begin({
    planHash: hashPlan(plan),
    policyRoot: ctx.policy.root,
    createdBy: ctx.agent.id
  });

  try {
    for (const action of plan.actions) {
      const preState = await ctx.state.snapshot();
      const verdict = evaluateDeterministically(action, preState, ctx.policy);

      if (!verdict.allowed) {
        await saga.reject(action, verdict.reason);
        throw new PolicyRejected(verdict);
      }

      if (verdict.requiresOwner) {
        await ctx.approvals.requireOwner(action, verdict);
      }

      if (action.rail === "onchain") {
        const simulation = await ctx.chain.simulate(action);
        assertPostState(simulation, verdict.expectedPostState);

        const proof = buildPolicyProof(action, preState, ctx.policy);
        const tx = await ctx.account.executeUserOperation(action, proof);
        await saga.commit(action, { rail: "onchain", txHash: tx.hash });
      } else {
        // The Banking MCP does not shop. The agent reaches checkout first;
        // card credentials are fetched only after policy and approval checks.
        assertCheckoutMatches(action.checkout, verdict);
        const card = await ctx.banking.getAuthorizedVirtualCard();
        const receipt = await ctx.checkout.pay(action.checkout, card);
        await saga.commit(action, { rail: "card", receiptHash: hash(receipt) });
      }
    }

    const root = await ctx.ledger.commitMerkleRoot(saga.entries());
    return await saga.complete({ ledgerRoot: root });
  } catch (error) {
    // Card and chain writes are not atomic. Compensate completed steps
    // in reverse order, then freeze if the books still disagree.
    const result = await saga.compensateReverse();
    if (!result.reconciled) await ctx.account.freeze("ledger mismatch");
    throw error;
  }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {MerkleProof} from "openzeppelin/utils/cryptography/MerkleProof.sol";
import {ReentrancyGuard} from "openzeppelin/utils/ReentrancyGuard.sol";

contract MimorPolicy is ReentrancyGuard {
  struct Action {
    address target;
    address asset;
    uint256 value;
    uint48 validAfter;
    uint48 validUntil;
    uint64 nonce;
    bytes data;
  }

  struct PolicyProof {
    bytes32[] targetProof;
    bytes32[] assetProof;
    uint256 maxPerAction;
    uint256 maxPerPeriod;
    uint48 period;
    bytes ownerApproval;
  }

  bytes32 public immutable policyRoot;
  bytes32 public immutable targetRoot;
  bytes32 public immutable assetRoot;
  address public immutable owner;
  address public agentKey;
  bool public frozen;

  mapping(uint256 bucket => uint256 amount) public spent;
  mapping(bytes32 actionHash => bool used) public executed;

  event ActionAuthorized(bytes32 indexed hash, address indexed target, uint256 value);
  event AccountFrozen(string reason);

  modifier onlyAgent() {
    require(msg.sender == agentKey, "not agent");
    require(!frozen, "account frozen");
    _;
  }

  function authorize(Action calldata action, PolicyProof calldata proof)
    external onlyAgent nonReentrant returns (bytes32 actionHash)
  {
    require(block.timestamp >= action.validAfter, "too early");
    require(block.timestamp <= action.validUntil, "expired");
    require(action.value <= proof.maxPerAction, "single limit");

    bytes32 targetLeaf = keccak256(abi.encode(action.target));
    bytes32 assetLeaf = keccak256(abi.encode(action.asset));
    require(MerkleProof.verify(proof.targetProof, targetRoot, targetLeaf), "target denied");
    require(MerkleProof.verify(proof.assetProof, assetRoot, assetLeaf), "asset denied");

    uint256 bucket = block.timestamp / proof.period;
    spent[bucket] += action.value;
    require(spent[bucket] <= proof.maxPerPeriod, "period limit");

    actionHash = keccak256(abi.encode(block.chainid, address(this), action));
    require(!executed[actionHash], "replay");
    executed[actionHash] = true;

    (bool ok, ) = action.target.call{value: action.value}(action.data);
    require(ok, "execution failed");
    emit ActionAuthorized(actionHash, action.target, action.value);
  }

  function freeze(string calldata reason) external {
    require(msg.sender == owner, "not owner");
    frozen = true;
    emit AccountFrozen(reason);
  }

  function rotateAgentKey(address next) external {
    require(msg.sender == owner, "not owner");
    require(next != address(0), "zero key");
    agentKey = next;
  }
}