otto-execute 0.1.0

package/dist/vendor/otto-intel-mcp/execution-delegation-policy.d.ts

@@ -0,0 +1,257 @@
+/**
+ * execution-delegation-policy.ts — the product's CDP project policy that fences the delegated leg
+ * (Model B, browser plane; seat ruling D9 = α+, 2026-08-29).
+ *
+ * WHAT THE ENGINE FENCES, AND WHAT IT CANNOT. Coinbase's policy engine offers END-USER accounts exactly
+ * one fence: the project-scope policy ("Only one project-level policy can exist at any time"; account-
+ * scoped policies attach only to developer-owned accounts, and no rule can refer to "the sender's own
+ * address"). So this policy is a SHAPE fence with constant caps, shared by every delegated user:
+ *   - approve: only on an allow-listed input token, only to the reviewed LI.FI diamond, only up to the
+ *     per-swap cap (5,000 USD, Founder word 2026-08-29) in that token's atomic units — a bound on ONE
+ *     swap, not a daily or total limit (zero stays allowed for the allowance clear);
+ *   - call: only the LI.FI diamond, zero native value, only the two GenericSwapV3 ERC20→ERC20 entry points.
+ * The approve cap is what bounds the swap's notional on-chain: the diamond can only pull what is
+ * approved. Everything else — that `_receiver` is the end user, that `_minAmount` is at least the
+ * caller's floor, that the fee leg is the ruled attribution — is Otto's SERVER-SIDE 13-check verifier on
+ * every call (`adapter/verify.ts`), run with the end user's address as the server reads it from CDP.
+ *
+ * THE RESIDUAL, STATED PLAINLY (also in the PR body and in the consent copy the user reads):
+ *   Coinbase's engine limits Otto to swaps through LI.FI up to the per-swap cap; Otto's own server checks
+ *   where the output goes; the user can revoke at any time. The engine does NOT bind the receiver — a
+ *   compromised Otto server could re-point `_receiver` inside a diamond swap; that residual is bounded by
+ *   the per-swap cap, the grant's expiry and the user's revoke, not by the engine.
+ *
+ * IDENTITY OF THE FENCE (seat ruling D6): the policy is matched by its versioned DESCRIPTION and checked
+ * by a digest over its canonical rules on every read-back — never by a policy id in env (a re-created
+ * policy silently changes id; a renamed one silently changes shape; the digest catches both). The
+ * canonical form lowercases hex strings and sorts object keys, nothing else; if the engine ever
+ * augments rules on read-back, `canonical()` is the one place to teach it.
+ *
+ * Description obeys the SDK's regex (`/^[A-Za-z0-9 ,.]{1,50}$/`): no hyphens, no parentheses.
+ */
+import { type Address } from 'viem';
+/**
+ * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
+ * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
+ * in place only when N ≤ this binary's version; a newer N is never downgraded; anything that does not match —
+ * the prefix in the middle, a suffix, no description — is foreign and is never touched.
+ */
+export declare const MODEL_B_POLICY_LINEAGE_PREFIX = "OTTO model b swap fence";
+/** This binary's fence version. Bump it whenever the rules change shape or caps. */
+export declare const MODEL_B_POLICY_VERSION: 1;
+/** The versioned match key. */
+export declare const MODEL_B_POLICY_NAME_V1: string;
+/** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
+export declare function modelBLineageVersion(description: unknown): number | undefined;
+export declare const MODEL_B_POLICY_NETWORK: "base";
+export declare const MODEL_B_CHAIN_ID: 8453;
+/**
+ * Delegation expiry bounds (Founder word `expiry 90/180`, 2026-08-29): the mint page defaults to 90 days
+ * and refuses anything past 180; the server routes enforce the same numbers. Coinbase documents no
+ * maximum of its own for `expiresAt` (SDK types + vendor doc read 2026-08-29); the first 180-day mint
+ * at the sitting is the live confirmation.
+ */
+export declare const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS: 90;
+export declare const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS: 180;
+/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+export declare function boundedDelegationExpiry(requestedDays: unknown, nowMs: number): {
+    readonly days: number;
+    readonly expiresAt: string;
+};
+/**
+ * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
+ * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
+ * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
+ * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
+ * bounds the swap's `fromAmount` on-chain).
+ */
+export declare const MODEL_B_PER_SWAP_CAP_USD: 5000;
+export interface ModelBInputToken {
+    readonly symbol: string;
+    readonly address: Address;
+    readonly decimals: number;
+    /** Atomic units per one USD — exact for a USD stablecoin; anything else needs a ruled reference price. */
+    readonly atomicPerUsd: bigint;
+}
+export declare const BASE_USDC: Address;
+/**
+ * The input tokens a delegated swap may spend, v1: USDC only — the one token whose USD cap is exact.
+ * WETH (or any volatile input) needs a Founder-ruled reference price before it can carry a USD cap.
+ */
+export declare const MODEL_B_INPUT_TOKENS_V1: readonly ModelBInputToken[];
+export declare function modelBInputToken(token: Address): ModelBInputToken | undefined;
+/** The cap in the token's atomic units. */
+export declare function modelBPerSwapCapAtomic(token: ModelBInputToken, capUsd?: number): bigint;
+/** The two GenericSwapV3 ERC20→ERC20 entry points a same-chain swap plan may call. */
+export declare const GENERIC_SWAP_V3_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "swapTokensSingleV3ERC20ToERC20";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "_transactionId";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "_integrator";
+        readonly type: "string";
+    }, {
+        readonly name: "_referrer";
+        readonly type: "string";
+    }, {
+        readonly name: "_receiver";
+        readonly type: "address";
+    }, {
+        readonly name: "_minAmount";
+        readonly type: "uint256";
+    }, {
+        readonly name: "_swapData";
+        readonly type: "tuple";
+        readonly components: readonly [{
+            readonly name: "callTo";
+            readonly type: "address";
+        }, {
+            readonly name: "approveTo";
+            readonly type: "address";
+        }, {
+            readonly name: "sendingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "receivingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "fromAmount";
+            readonly type: "uint256";
+        }, {
+            readonly name: "callData";
+            readonly type: "bytes";
+        }, {
+            readonly name: "requiresDeposit";
+            readonly type: "bool";
+        }];
+    }];
+    readonly outputs: readonly [];
+}, {
+    readonly type: "function";
+    readonly name: "swapTokensMultipleV3ERC20ToERC20";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "_transactionId";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "_integrator";
+        readonly type: "string";
+    }, {
+        readonly name: "_referrer";
+        readonly type: "string";
+    }, {
+        readonly name: "_receiver";
+        readonly type: "address";
+    }, {
+        readonly name: "_minAmount";
+        readonly type: "uint256";
+    }, {
+        readonly name: "_swapData";
+        readonly type: "tuple[]";
+        readonly components: readonly [{
+            readonly name: "callTo";
+            readonly type: "address";
+        }, {
+            readonly name: "approveTo";
+            readonly type: "address";
+        }, {
+            readonly name: "sendingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "receivingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "fromAmount";
+            readonly type: "uint256";
+        }, {
+            readonly name: "callData";
+            readonly type: "bytes";
+        }, {
+            readonly name: "requiresDeposit";
+            readonly type: "bool";
+        }];
+    }];
+    readonly outputs: readonly [];
+}];
+/** The rule dialect this fence emits — structurally the SDK's `sendEndUserEvmTransaction` rule. */
+export interface DelegationPolicyParamCondition {
+    readonly name: string;
+    readonly operator: 'in' | '<=' | '>=';
+    readonly value?: string;
+    readonly values?: readonly string[];
+}
+export interface DelegationPolicyDataCondition {
+    readonly function: string;
+    readonly params?: readonly DelegationPolicyParamCondition[];
+}
+export type DelegationPolicyCriterion = {
+    readonly type: 'evmNetwork';
+    readonly networks: readonly string[];
+    readonly operator: 'in';
+} | {
+    readonly type: 'evmAddress';
+    readonly addresses: readonly string[];
+    readonly operator: 'in';
+} | {
+    readonly type: 'ethValue';
+    readonly ethValue: string;
+    readonly operator: '<=';
+} | {
+    readonly type: 'evmData';
+    readonly abi: 'erc20' | typeof GENERIC_SWAP_V3_ABI;
+    readonly conditions: readonly DelegationPolicyDataCondition[];
+};
+export interface DelegationPolicyRule {
+    readonly action: 'accept';
+    readonly operation: 'sendEndUserEvmTransaction';
+    readonly criteria: readonly DelegationPolicyCriterion[];
+}
+/** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
+export declare function modelBProjectPolicyRules(capUsd?: number): readonly DelegationPolicyRule[];
+/** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
+export declare function modelBProjectPolicyBody(): {
+    readonly scope: 'project';
+    readonly description: string;
+    readonly rules: readonly DelegationPolicyRule[];
+};
+/** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
+export declare function policyRulesDigest(rules: unknown): string;
+export declare const MODEL_B_POLICY_DIGEST_V1: string;
+/** What the server reads back from `cdp.policies.listPolicies({ scope: 'project' })`, structurally. */
+export interface DelegationPolicyRecord {
+    readonly id: string;
+    readonly description?: string;
+    readonly scope: string;
+    readonly rules: unknown;
+}
+export type ModelBFenceReadBack = {
+    readonly present: true;
+    readonly id: string;
+    readonly rulesDigest: string;
+} | {
+    readonly present: false;
+    readonly reason: 'absent' | 'ambiguous' | 'name_mismatch' | 'digest_mismatch';
+    readonly detail: string;
+};
+/**
+ * The fence check the delegated-send path runs BEFORE any send: EXACTLY ONE project-scope policy reads back
+ * (Coinbase allows one; more is an anomalous snapshot and never blessed on the strength of "one of them
+ * matches"), it carries the versioned name, and its rules digest to exactly the v1 rules. Anything else is
+ * "absent" — including a policy of the right name whose rules drifted.
+ */
+export declare function readBackModelBFence(policies: readonly DelegationPolicyRecord[]): ModelBFenceReadBack;
+/**
+ * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
+ * engine would refuse is refused here without spending an allowance reset on it.
+ */
+export declare function assertWithinModelBFence(plan: {
+    readonly token: Address;
+    readonly spender: Address;
+    readonly gross: bigint;
+}, capUsd?: number, inputTokens?: readonly ModelBInputToken[]): {
+    readonly token: ModelBInputToken;
+    readonly capAtomic: bigint;
+};

package/dist/vendor/otto-intel-mcp/execution-delegation-policy.js

@@ -0,0 +1,279 @@
+/**
+ * execution-delegation-policy.ts — the product's CDP project policy that fences the delegated leg
+ * (Model B, browser plane; seat ruling D9 = α+, 2026-08-29).
+ *
+ * WHAT THE ENGINE FENCES, AND WHAT IT CANNOT. Coinbase's policy engine offers END-USER accounts exactly
+ * one fence: the project-scope policy ("Only one project-level policy can exist at any time"; account-
+ * scoped policies attach only to developer-owned accounts, and no rule can refer to "the sender's own
+ * address"). So this policy is a SHAPE fence with constant caps, shared by every delegated user:
+ *   - approve: only on an allow-listed input token, only to the reviewed LI.FI diamond, only up to the
+ *     per-swap cap (5,000 USD, Founder word 2026-08-29) in that token's atomic units — a bound on ONE
+ *     swap, not a daily or total limit (zero stays allowed for the allowance clear);
+ *   - call: only the LI.FI diamond, zero native value, only the two GenericSwapV3 ERC20→ERC20 entry points.
+ * The approve cap is what bounds the swap's notional on-chain: the diamond can only pull what is
+ * approved. Everything else — that `_receiver` is the end user, that `_minAmount` is at least the
+ * caller's floor, that the fee leg is the ruled attribution — is Otto's SERVER-SIDE 13-check verifier on
+ * every call (`adapter/verify.ts`), run with the end user's address as the server reads it from CDP.
+ *
+ * THE RESIDUAL, STATED PLAINLY (also in the PR body and in the consent copy the user reads):
+ *   Coinbase's engine limits Otto to swaps through LI.FI up to the per-swap cap; Otto's own server checks
+ *   where the output goes; the user can revoke at any time. The engine does NOT bind the receiver — a
+ *   compromised Otto server could re-point `_receiver` inside a diamond swap; that residual is bounded by
+ *   the per-swap cap, the grant's expiry and the user's revoke, not by the engine.
+ *
+ * IDENTITY OF THE FENCE (seat ruling D6): the policy is matched by its versioned DESCRIPTION and checked
+ * by a digest over its canonical rules on every read-back — never by a policy id in env (a re-created
+ * policy silently changes id; a renamed one silently changes shape; the digest catches both). The
+ * canonical form lowercases hex strings and sorts object keys, nothing else; if the engine ever
+ * augments rules on read-back, `canonical()` is the one place to teach it.
+ *
+ * Description obeys the SDK's regex (`/^[A-Za-z0-9 ,.]{1,50}$/`): no hyphens, no parentheses.
+ */
+import { createHash } from 'node:crypto';
+import { getAddress } from 'viem';
+import { refuse } from './execution-errors.js';
+import { LIFI_DIAMOND_ADDRESS } from './execution-config.js';
+/**
+ * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
+ * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
+ * in place only when N ≤ this binary's version; a newer N is never downgraded; anything that does not match —
+ * the prefix in the middle, a suffix, no description — is foreign and is never touched.
+ */
+export const MODEL_B_POLICY_LINEAGE_PREFIX = 'OTTO model b swap fence';
+/** This binary's fence version. Bump it whenever the rules change shape or caps. */
+export const MODEL_B_POLICY_VERSION = 1;
+/** The versioned match key. */
+export const MODEL_B_POLICY_NAME_V1 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v${MODEL_B_POLICY_VERSION}`;
+const MODEL_B_LINEAGE_PATTERN = new RegExp(`^${MODEL_B_POLICY_LINEAGE_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')} v(\\d+)$`);
+/** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
+export function modelBLineageVersion(description) {
+    if (typeof description !== 'string')
+        return undefined;
+    const match = MODEL_B_LINEAGE_PATTERN.exec(description);
+    return match ? Number(match[1]) : undefined;
+}
+export const MODEL_B_POLICY_NETWORK = 'base';
+export const MODEL_B_CHAIN_ID = 8453;
+/**
+ * Delegation expiry bounds (Founder word `expiry 90/180`, 2026-08-29): the mint page defaults to 90 days
+ * and refuses anything past 180; the server routes enforce the same numbers. Coinbase documents no
+ * maximum of its own for `expiresAt` (SDK types + vendor doc read 2026-08-29); the first 180-day mint
+ * at the sitting is the live confirmation.
+ */
+export const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS = 90;
+export const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS = 180;
+/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+export function boundedDelegationExpiry(requestedDays, nowMs) {
+    const days = requestedDays === undefined || requestedDays === null
+        ? MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS
+        : Number(requestedDays);
+    if (!Number.isInteger(days) || days < 1 || days > MODEL_B_DELEGATION_EXPIRY_MAX_DAYS) {
+        throw new Error(`delegation expiry must be a whole number of days between 1 and ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}`);
+    }
+    return Object.freeze({ days, expiresAt: new Date(nowMs + days * 86_400_000).toISOString() });
+}
+/**
+ * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
+ * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
+ * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
+ * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
+ * bounds the swap's `fromAmount` on-chain).
+ */
+export const MODEL_B_PER_SWAP_CAP_USD = 5000;
+export const BASE_USDC = getAddress('0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913');
+/**
+ * The input tokens a delegated swap may spend, v1: USDC only — the one token whose USD cap is exact.
+ * WETH (or any volatile input) needs a Founder-ruled reference price before it can carry a USD cap.
+ */
+export const MODEL_B_INPUT_TOKENS_V1 = Object.freeze([
+    Object.freeze({ symbol: 'USDC', address: BASE_USDC, decimals: 6, atomicPerUsd: 1000000n }),
+]);
+export function modelBInputToken(token) {
+    const target = getAddress(token);
+    return MODEL_B_INPUT_TOKENS_V1.find((entry) => entry.address === target);
+}
+/** The cap in the token's atomic units. */
+export function modelBPerSwapCapAtomic(token, capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+    if (!Number.isSafeInteger(capUsd) || capUsd <= 0)
+        throw new Error('per-swap cap must be a positive integer USD amount');
+    return BigInt(capUsd) * token.atomicPerUsd;
+}
+/** LibSwap.SwapData tuple, as the GenericSwapV3 facet declares it. */
+const SWAP_DATA_COMPONENTS = [
+    { name: 'callTo', type: 'address' },
+    { name: 'approveTo', type: 'address' },
+    { name: 'sendingAssetId', type: 'address' },
+    { name: 'receivingAssetId', type: 'address' },
+    { name: 'fromAmount', type: 'uint256' },
+    { name: 'callData', type: 'bytes' },
+    { name: 'requiresDeposit', type: 'bool' },
+];
+/** The two GenericSwapV3 ERC20→ERC20 entry points a same-chain swap plan may call. */
+export const GENERIC_SWAP_V3_ABI = [
+    {
+        type: 'function',
+        name: 'swapTokensSingleV3ERC20ToERC20',
+        stateMutability: 'nonpayable',
+        inputs: [
+            { name: '_transactionId', type: 'bytes32' },
+            { name: '_integrator', type: 'string' },
+            { name: '_referrer', type: 'string' },
+            { name: '_receiver', type: 'address' },
+            { name: '_minAmount', type: 'uint256' },
+            { name: '_swapData', type: 'tuple', components: SWAP_DATA_COMPONENTS },
+        ],
+        outputs: [],
+    },
+    {
+        type: 'function',
+        name: 'swapTokensMultipleV3ERC20ToERC20',
+        stateMutability: 'nonpayable',
+        inputs: [
+            { name: '_transactionId', type: 'bytes32' },
+            { name: '_integrator', type: 'string' },
+            { name: '_referrer', type: 'string' },
+            { name: '_receiver', type: 'address' },
+            { name: '_minAmount', type: 'uint256' },
+            { name: '_swapData', type: 'tuple[]', components: SWAP_DATA_COMPONENTS },
+        ],
+        outputs: [],
+    },
+];
+/** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
+export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+    const approveRules = MODEL_B_INPUT_TOKENS_V1.map((token) => ({
+        action: 'accept',
+        operation: 'sendEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmNetwork', networks: [MODEL_B_POLICY_NETWORK], operator: 'in' },
+            { type: 'evmAddress', addresses: [token.address], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: 'erc20',
+                conditions: [
+                    {
+                        function: 'approve',
+                        params: [
+                            { name: 'spender', operator: 'in', values: [LIFI_DIAMOND_ADDRESS] },
+                            {
+                                name: 'value',
+                                operator: '<=',
+                                value: modelBPerSwapCapAtomic(token, capUsd).toString(),
+                            },
+                        ],
+                    },
+                ],
+            },
+        ],
+    }));
+    const routerRule = {
+        action: 'accept',
+        operation: 'sendEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmNetwork', networks: [MODEL_B_POLICY_NETWORK], operator: 'in' },
+            { type: 'evmAddress', addresses: [LIFI_DIAMOND_ADDRESS], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: GENERIC_SWAP_V3_ABI,
+                conditions: [
+                    { function: 'swapTokensSingleV3ERC20ToERC20' },
+                    { function: 'swapTokensMultipleV3ERC20ToERC20' },
+                ],
+            },
+        ],
+    };
+    return Object.freeze([...approveRules, routerRule]);
+}
+/** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
+export function modelBProjectPolicyBody() {
+    return Object.freeze({
+        scope: 'project',
+        description: MODEL_B_POLICY_NAME_V1,
+        rules: modelBProjectPolicyRules(),
+    });
+}
+/** Sorted keys, undefined dropped, hex strings lowercased; arrays keep their order. Nothing else. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const item = value[key];
+            if (item !== undefined)
+                out[key] = canonical(item);
+        }
+        return out;
+    }
+    if (typeof value === 'string' && /^0x[0-9a-fA-F]+$/.test(value))
+        return value.toLowerCase();
+    return value;
+}
+/** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
+export function policyRulesDigest(rules) {
+    return createHash('sha256')
+        .update(JSON.stringify(canonical(rules)))
+        .digest('hex');
+}
+export const MODEL_B_POLICY_DIGEST_V1 = policyRulesDigest(modelBProjectPolicyRules());
+/**
+ * The fence check the delegated-send path runs BEFORE any send: EXACTLY ONE project-scope policy reads back
+ * (Coinbase allows one; more is an anomalous snapshot and never blessed on the strength of "one of them
+ * matches"), it carries the versioned name, and its rules digest to exactly the v1 rules. Anything else is
+ * "absent" — including a policy of the right name whose rules drifted.
+ */
+export function readBackModelBFence(policies) {
+    const project = policies.filter((policy) => policy.scope === 'project');
+    if (project.length === 0)
+        return {
+            present: false,
+            reason: 'absent',
+            detail: 'the project holds no project-scope policy',
+        };
+    if (project.length > 1) {
+        return {
+            present: false,
+            reason: 'ambiguous',
+            detail: `${project.length} project-scope policies read back where Coinbase allows one`,
+        };
+    }
+    const named = project[0];
+    if (named.description !== MODEL_B_POLICY_NAME_V1) {
+        return {
+            present: false,
+            reason: 'name_mismatch',
+            detail: `the project policy is not "${MODEL_B_POLICY_NAME_V1}"`,
+        };
+    }
+    const rulesDigest = policyRulesDigest(named.rules);
+    if (rulesDigest !== MODEL_B_POLICY_DIGEST_V1) {
+        return {
+            present: false,
+            reason: 'digest_mismatch',
+            detail: `the project policy "${MODEL_B_POLICY_NAME_V1}" carries rules that do not digest to v1 (${rulesDigest.slice(0, 16)}… ≠ ${MODEL_B_POLICY_DIGEST_V1.slice(0, 16)}…)`,
+        };
+    }
+    return { present: true, id: named.id, rulesDigest };
+}
+/**
+ * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
+ * engine would refuse is refused here without spending an allowance reset on it.
+ */
+export function assertWithinModelBFence(plan, capUsd = MODEL_B_PER_SWAP_CAP_USD, inputTokens = MODEL_B_INPUT_TOKENS_V1) {
+    const target = getAddress(plan.token);
+    const token = inputTokens.find((entry) => entry.address === target);
+    if (!token) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `input token ${plan.token} is not an allow-listed delegated input (${inputTokens.map((t) => t.symbol).join(', ') || 'none'})`);
+    }
+    if (getAddress(plan.spender) !== LIFI_DIAMOND_ADDRESS) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `approval spender ${plan.spender} is not the reviewed LI.FI diamond`);
+    }
+    const capAtomic = modelBPerSwapCapAtomic(token, capUsd);
+    if (plan.gross > capAtomic) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `gross ${plan.gross} ${token.symbol} atomic exceeds the per-swap cap ${capAtomic} (${capUsd} USD)`);
+    }
+    return { token, capAtomic };
+}
+//# sourceMappingURL=execution-delegation-policy.js.map

package/dist/vendor/otto-intel-mcp/execution-errors.d.ts

@@ -0,0 +1,9 @@
+export declare const EXECUTION_REFUSAL_CODES: readonly ["ATTRIBUTION_MISSING", "LIFI_FEE_CAP_EXCEEDED", "ACCOUNT_BINDING_MISMATCH", "DIGEST_MISMATCH", "ARTIFACT_INVALID", "STALE_ARTIFACT", "EXECUTION_RATE_LIMITED", "EXECUTION_CONCURRENCY_FULL", "UNSUPPORTED_ACCOUNT_PROFILE", "LIFI_QUOTE_FAILED", "LIFI_QUOTE_INVALID", "UNSUPPORTED_LIFI_ROUTE", "POLYMARKET_METADATA_FAILED", "POLYMARKET_METADATA_INVALID", "UNSUPPORTED_POLYMARKET_MARKET", "POLYMARKET_ORDER_INVALID", "POLYMARKET_BUILDER_FEE_UNRULED", "HYPERLIQUID_META_FAILED", "HYPERLIQUID_META_INVALID", "UNSUPPORTED_HYPERLIQUID_MARKET", "HYPERLIQUID_ORDER_INVALID", "DELEGATION_UNAVAILABLE", "DELEGATION_UNAUTHORIZED", "DELEGATION_INPUT_INVALID", "DELEGATION_BUSY", "DELEGATION_ARTIFACT_IN_FLIGHT", "ARTIFACT_NOT_PREPARED_HERE", "PREPARED_ARTIFACT_CAPACITY", "ARTIFACT_ID_COLLISION", "DELEGATION_REPLAY_MISMATCH", "DELEGATION_FENCE_ABSENT", "DELEGATION_FENCE_FOREIGN", "DELEGATION_FENCE_AMBIGUOUS", "DELEGATION_FENCE_NEWER", "DELEGATION_TOKEN_INVALID", "DELEGATION_REVOKE_NOT_CONFIRMED", "DELEGATION_NOT_ACTIVE", "DELEGATION_EXPIRY_EXCEEDS_BOUND", "DELEGATION_USER_UNKNOWN", "DELEGATION_OUTSIDE_FENCE", "DELEGATED_PLAN_REFUSED", "DELEGATED_PLAN_HALTED", "DELEGATION_UPSTREAM_FAILED"];
+export type ExecutionRefusalCode = (typeof EXECUTION_REFUSAL_CODES)[number];
+/** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
+export declare class ExecutionRefusal extends Error {
+    readonly code: ExecutionRefusalCode;
+    constructor(code: ExecutionRefusalCode, message: string);
+}
+export declare function refuse(code: ExecutionRefusalCode, message: string): never;
+export declare function isExecutionRefusal(error: unknown): error is ExecutionRefusal;