otto-intel-mcp 0.1.0

package/dist/adapter/chain.d.ts

@@ -0,0 +1,36 @@
+/**
+ * chain.ts — the one chain-state rule both signers follow on Base.
+ *
+ * With Flashblocks, a transaction receipt can arrive from a PRECONFIRMATION while `latest` — the last
+ * SEALED block, the state every default read and gas estimate runs against — still predates it, and a
+ * preconfirmation is not final: Base defines a Flashblock reorg as a preconfirmed transaction OMITTED
+ * from the sealed block. Observed live on 2026-08-28: the approve was preconfirmed, the swap call was
+ * estimated against `latest`, and the router's `transferFrom` reverted `TRANSFER_FROM_FAILED` on an
+ * allowance that was already granted. Rule: a transaction counts as mined ONLY once its receipt is
+ * refetched by hash and the sealed canonical block at that height carries the receipt's block hash.
+ * Until then the signer touches no state (no next estimate, no allowance read-back); if that never
+ * happens within the bound, the signer fails closed. This is the conservative mechanism — it is also
+ * exactly what a user copying this flow in a wallet observes.
+ */
+import type { Hex, PublicClient, TransactionReceipt } from 'viem';
+export interface SealedWaitOptions {
+    /** Delay between polls (default 250 ms). */
+    readonly pollMs?: number;
+    /** Give up after this many polls (default 240 → 60 s at the default cadence). */
+    readonly maxPolls?: number;
+}
+export type SealedClient = Pick<PublicClient, 'getBlockNumber' | 'getTransactionReceipt' | 'getBlock'>;
+/** The wait gave up: no receipt in a sealed canonical block within the bound. A CLASS, so callers classify structurally. */
+export declare class SealedReceiptTimeoutError extends Error {
+    readonly hash: Hex;
+    readonly polls: number;
+    constructor(hash: Hex, polls: number);
+}
+/**
+ * Resolve with the receipt of `hash` once it is SEALED and CANONICAL: refetched by hash, its block
+ * number ≤ the sealed head, and the sealed block at that number has the receipt's `blockHash`. A
+ * preconfirmed receipt that was omitted from the sealed block (Flashblock reorg) is never returned —
+ * the wait continues until the transaction is re-included in a sealed block, or throws after
+ * `maxPolls` so the caller fails closed instead of treating the transaction as mined.
+ */
+export declare function waitForSealedReceipt(pub: SealedClient, hash: Hex, options?: SealedWaitOptions): Promise<TransactionReceipt>;

package/dist/adapter/chain.js

@@ -0,0 +1,65 @@
+/**
+ * chain.ts — the one chain-state rule both signers follow on Base.
+ *
+ * With Flashblocks, a transaction receipt can arrive from a PRECONFIRMATION while `latest` — the last
+ * SEALED block, the state every default read and gas estimate runs against — still predates it, and a
+ * preconfirmation is not final: Base defines a Flashblock reorg as a preconfirmed transaction OMITTED
+ * from the sealed block. Observed live on 2026-08-28: the approve was preconfirmed, the swap call was
+ * estimated against `latest`, and the router's `transferFrom` reverted `TRANSFER_FROM_FAILED` on an
+ * allowance that was already granted. Rule: a transaction counts as mined ONLY once its receipt is
+ * refetched by hash and the sealed canonical block at that height carries the receipt's block hash.
+ * Until then the signer touches no state (no next estimate, no allowance read-back); if that never
+ * happens within the bound, the signer fails closed. This is the conservative mechanism — it is also
+ * exactly what a user copying this flow in a wallet observes.
+ */
+/** The wait gave up: no receipt in a sealed canonical block within the bound. A CLASS, so callers classify structurally. */
+export class SealedReceiptTimeoutError extends Error {
+    hash;
+    polls;
+    constructor(hash, polls) {
+        super(`transaction ${hash} has no receipt in a sealed canonical block after ${polls} polls; refusing to treat it as mined`);
+        this.hash = hash;
+        this.polls = polls;
+        this.name = 'SealedReceiptTimeoutError';
+    }
+}
+/** STRUCTURAL: viem's own class name for "no receipt yet". Message text is never consulted — it must not select a class. */
+function isReceiptNotFound(error) {
+    return error?.name === 'TransactionReceiptNotFoundError';
+}
+/**
+ * Resolve with the receipt of `hash` once it is SEALED and CANONICAL: refetched by hash, its block
+ * number ≤ the sealed head, and the sealed block at that number has the receipt's `blockHash`. A
+ * preconfirmed receipt that was omitted from the sealed block (Flashblock reorg) is never returned —
+ * the wait continues until the transaction is re-included in a sealed block, or throws after
+ * `maxPolls` so the caller fails closed instead of treating the transaction as mined.
+ */
+export async function waitForSealedReceipt(pub, hash, options = {}) {
+    const pollMs = options.pollMs ?? 250;
+    const maxPolls = options.maxPolls ?? 240;
+    for (let poll = 0;; poll++) {
+        let receipt;
+        try {
+            receipt = await pub.getTransactionReceipt({ hash });
+        }
+        catch (error) {
+            if (!isReceiptNotFound(error))
+                throw error;
+        }
+        if (receipt) {
+            // viem caches getBlockNumber for the client's cacheTime by default — a cached head would defeat the wait.
+            const head = await pub.getBlockNumber({ cacheTime: 0 });
+            if (head >= receipt.blockNumber) {
+                const sealed = await pub.getBlock({ blockNumber: receipt.blockNumber });
+                if (sealed.hash === receipt.blockHash)
+                    return receipt;
+                // The block this receipt claims is not the sealed block at that height: the preconfirmation did
+                // not survive sealing. Keep polling — the transaction may be re-included in a later block.
+            }
+        }
+        if (poll + 1 >= maxPolls)
+            throw new SealedReceiptTimeoutError(hash, maxPolls);
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+    }
+}
+//# sourceMappingURL=chain.js.map

package/dist/adapter/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/adapter/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,4HAA4H;AAC5H,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAAoB;IAAzC,YAAqB,IAAS,EAAW,KAAa;QACpD,KAAK,CAAC,eAAe,IAAI,qDAAqD,KAAK,uCAAuC,CAAC,CAAC;QADzG,SAAI,GAAJ,IAAI,CAAK;QAAW,UAAK,GAAL,KAAK,CAAQ;QAEpD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,4HAA4H;AAC5H,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAQ,KAAmC,EAAE,IAAI,KAAK,iCAAiC,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAiB,EAAE,IAAS,EAAE,UAA6B,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IACzC,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,IAAI,OAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,0GAA0G;YAC1G,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBACxE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,SAAS;oBAAE,OAAO,OAAO,CAAC;gBACtD,gGAAgG;gBAChG,2FAA2F;YAC7F,CAAC;QACH,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,IAAI,QAAQ;YAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/adapter/erc20.d.ts

@@ -0,0 +1,39 @@
+/**
+ * erc20.ts — the two ERC-20 calls the signers make on their OWN behalf: the bounded `approve(spender, 0)`
+ * that clears a halted plan's allowance, and the `allowance` read-back that turns "the clear was
+ * mined" into "the allowance IS zero" — a receipt status is a claim about a transaction, the read-back
+ * is the fact about the token.
+ */
+import { type Address, type PublicClient } from 'viem';
+export declare const ERC20_APPROVE_ABI: readonly [{
+    readonly name: "approve";
+    readonly type: "function";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly type: "address";
+        readonly name: "spender";
+    }, {
+        readonly type: "uint256";
+        readonly name: "amount";
+    }];
+    readonly outputs: readonly [{
+        readonly type: "bool";
+    }];
+}];
+export declare const ERC20_ALLOWANCE_ABI: readonly [{
+    readonly name: "allowance";
+    readonly type: "function";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [{
+        readonly type: "address";
+        readonly name: "owner";
+    }, {
+        readonly type: "address";
+        readonly name: "spender";
+    }];
+    readonly outputs: readonly [{
+        readonly type: "uint256";
+    }];
+}];
+/** The live allowance `owner` has granted `spender` on `token`. Throws if the read itself fails. */
+export declare function readAllowance(pub: PublicClient, token: Address, owner: Address, spender: Address): Promise<bigint>;

package/dist/adapter/erc20.js

@@ -0,0 +1,17 @@
+/**
+ * erc20.ts — the two ERC-20 calls the signers make on their OWN behalf: the bounded `approve(spender, 0)`
+ * that clears a halted plan's allowance, and the `allowance` read-back that turns "the clear was
+ * mined" into "the allowance IS zero" — a receipt status is a claim about a transaction, the read-back
+ * is the fact about the token.
+ */
+import { parseAbi } from 'viem';
+export const ERC20_APPROVE_ABI = parseAbi(['function approve(address spender, uint256 amount) returns (bool)']);
+export const ERC20_ALLOWANCE_ABI = parseAbi(['function allowance(address owner, address spender) view returns (uint256)']);
+/** The live allowance `owner` has granted `spender` on `token`. Throws if the read itself fails. */
+export async function readAllowance(pub, token, owner, spender) {
+    const value = await pub.readContract({ address: token, abi: ERC20_ALLOWANCE_ABI, functionName: 'allowance', args: [owner, spender] });
+    if (typeof value !== 'bigint')
+        throw new Error('allowance read-back did not return a uint256');
+    return value;
+}
+//# sourceMappingURL=erc20.js.map

package/dist/adapter/erc20.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc20.js","sourceRoot":"","sources":["../../src/adapter/erc20.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAmC,MAAM,MAAM,CAAC;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC;AAChH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAAC,2EAA2E,CAAC,CAAC,CAAC;AAE3H,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB,EAAE,KAAc,EAAE,KAAc,EAAE,OAAgB;IACrG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACtI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/adapter/lifi-decode.d.ts

@@ -0,0 +1,52 @@
+/**
+ * lifi-decode.ts — the adapter's OWN decoder for what it is about to sign.
+ *
+ * Re-specified (not imported) from the reviewed layouts in `src/lib/otto-wallet/lifi-swap-action.ts`
+ * (GenericSwapV3 ERC20→ERC20: receiver@96 / minAmount@128, `LibSwap.SwapData` tuple) and the
+ * FeeCollector `collectTokenFees(token, (recipient, amount)[])` body. Spec §11 fences the dApp decoder
+ * as a live owner-op importer that must not move; spec §1 keeps the constructor's own assertions on
+ * the constructor's side. This file is the user-side view: if the two ever disagree, the artifact is
+ * refused, which is the correct outcome for a disagreement about calldata that moves money.
+ *
+ * Decoding runs on the ARG REGION with `decodeAbiParameters` after a separate selector check, so a
+ * selector/ABI mismatch cannot mask a correct-looking parameter decode. Every decode is re-encoded
+ * and compared to the input: trailing bytes or non-canonical encodings are refused, never ignored.
+ */
+import { type Address, type Hex } from 'viem';
+/** swapTokensSingleV3ERC20ToERC20 / swapTokensMultipleV3ERC20ToERC20 — the only selectors a swap plan may call. */
+export declare const GENERIC_SWAP_SELECTORS: Readonly<{
+    single: Hex;
+    multiple: Hex;
+}>;
+/** FeeCollector.collectTokenFees — the only calldata a fee-forwarding leg may carry. */
+export declare const COLLECT_TOKEN_FEES_SELECTOR: Hex;
+export interface SwapLeg {
+    readonly callTo: Address;
+    readonly approveTo: Address;
+    readonly sendingAssetId: Address;
+    readonly receivingAssetId: Address;
+    readonly fromAmount: bigint;
+    readonly callData: Hex;
+    readonly requiresDeposit: boolean;
+}
+export interface DecodedGenericSwap {
+    readonly selector: Hex;
+    readonly transactionId: Hex;
+    readonly integrator: string;
+    readonly referrer: string;
+    readonly receiver: Address;
+    readonly minAmount: bigint;
+    readonly legs: readonly SwapLeg[];
+}
+export interface FeeDistribution {
+    readonly recipient: Address;
+    readonly amount: bigint;
+}
+export interface DecodedCollectTokenFees {
+    readonly token: Address;
+    readonly distributions: readonly FeeDistribution[];
+}
+export declare function decodeGenericSwap(data: Hex): DecodedGenericSwap;
+export declare function decodeCollectTokenFees(callData: Hex): DecodedCollectTokenFees;
+export declare function encodeGenericSwap(swap: DecodedGenericSwap): Hex;
+export declare function encodeCollectTokenFees(fees: DecodedCollectTokenFees): Hex;

package/dist/adapter/lifi-decode.js

@@ -0,0 +1,149 @@
+/**
+ * lifi-decode.ts — the adapter's OWN decoder for what it is about to sign.
+ *
+ * Re-specified (not imported) from the reviewed layouts in `src/lib/otto-wallet/lifi-swap-action.ts`
+ * (GenericSwapV3 ERC20→ERC20: receiver@96 / minAmount@128, `LibSwap.SwapData` tuple) and the
+ * FeeCollector `collectTokenFees(token, (recipient, amount)[])` body. Spec §11 fences the dApp decoder
+ * as a live owner-op importer that must not move; spec §1 keeps the constructor's own assertions on
+ * the constructor's side. This file is the user-side view: if the two ever disagree, the artifact is
+ * refused, which is the correct outcome for a disagreement about calldata that moves money.
+ *
+ * Decoding runs on the ARG REGION with `decodeAbiParameters` after a separate selector check, so a
+ * selector/ABI mismatch cannot mask a correct-looking parameter decode. Every decode is re-encoded
+ * and compared to the input: trailing bytes or non-canonical encodings are refused, never ignored.
+ */
+import { decodeAbiParameters, encodeAbiParameters, getAddress, parseAbiParameters, } from 'viem';
+import { refuse } from './refusal.js';
+/** LibSwap.SwapData — (callTo, approveTo, sendingAssetId, receivingAssetId, fromAmount, callData, requiresDeposit). */
+const SWAP_DATA_TUPLE = '(address callTo, address approveTo, address sendingAssetId, address receivingAssetId, uint256 fromAmount, bytes callData, bool requiresDeposit)';
+const GENERIC_SWAP_SINGLE_PARAMS = parseAbiParameters(`bytes32 _transactionId, string _integrator, string _referrer, address _receiver, uint256 _minAmount, ${SWAP_DATA_TUPLE} _swapData`);
+const GENERIC_SWAP_MULTIPLE_PARAMS = parseAbiParameters(`bytes32 _transactionId, string _integrator, string _referrer, address _receiver, uint256 _minAmount, ${SWAP_DATA_TUPLE}[] _swapData`);
+const COLLECT_TOKEN_FEES_PARAMS = parseAbiParameters('address token, (address recipient, uint256 amount)[] distributions');
+/** swapTokensSingleV3ERC20ToERC20 / swapTokensMultipleV3ERC20ToERC20 — the only selectors a swap plan may call. */
+export const GENERIC_SWAP_SELECTORS = Object.freeze({
+    single: '0x4666fc80',
+    multiple: '0x5fd9ae2e',
+});
+/** FeeCollector.collectTokenFees — the only calldata a fee-forwarding leg may carry. */
+export const COLLECT_TOKEN_FEES_SELECTOR = '0x332d746b';
+function selectorOf(data) {
+    return data.slice(0, 10).toLowerCase();
+}
+function argRegion(data) {
+    return `0x${data.slice(10)}`;
+}
+function normalizeLeg(leg) {
+    return Object.freeze({
+        callTo: getAddress(leg.callTo),
+        approveTo: getAddress(leg.approveTo),
+        sendingAssetId: getAddress(leg.sendingAssetId),
+        receivingAssetId: getAddress(leg.receivingAssetId),
+        fromAmount: leg.fromAmount,
+        callData: leg.callData,
+        requiresDeposit: leg.requiresDeposit,
+    });
+}
+export function decodeGenericSwap(data) {
+    if (!/^0x[0-9a-fA-F]*$/.test(data) || data.length < 10) {
+        refuse('SWAP_CALLDATA_INVALID', 'swap step calldata is not hex or has no selector');
+    }
+    const selector = selectorOf(data);
+    const args = argRegion(data);
+    const params = selector === GENERIC_SWAP_SELECTORS.single
+        ? GENERIC_SWAP_SINGLE_PARAMS
+        : selector === GENERIC_SWAP_SELECTORS.multiple
+            ? GENERIC_SWAP_MULTIPLE_PARAMS
+            : undefined;
+    if (!params) {
+        refuse('SWAP_CALLDATA_INVALID', `selector ${selector} is not an allowlisted GenericSwap ERC20→ERC20 function`);
+    }
+    let decoded;
+    try {
+        decoded = decodeAbiParameters(params, args);
+        if (encodeAbiParameters(params, decoded).toLowerCase() !== args.toLowerCase()) {
+            refuse('SWAP_CALLDATA_INVALID', 'swap calldata is non-canonical or carries trailing bytes');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AdapterRefusal')
+            throw error;
+        refuse('SWAP_CALLDATA_INVALID', 'GenericSwap calldata failed to decode');
+    }
+    const [transactionId, integrator, referrer, receiver, minAmount, swapData] = decoded;
+    const legs = (Array.isArray(swapData) ? swapData : [swapData]).map(normalizeLeg);
+    if (legs.length === 0)
+        refuse('SWAP_CALLDATA_INVALID', 'GenericSwap carries no swap legs');
+    return Object.freeze({
+        selector,
+        transactionId,
+        integrator,
+        referrer,
+        receiver: getAddress(receiver),
+        minAmount,
+        legs: Object.freeze(legs),
+    });
+}
+export function decodeCollectTokenFees(callData) {
+    if (selectorOf(callData) !== COLLECT_TOKEN_FEES_SELECTOR) {
+        refuse('ATTRIBUTION_MISSING', 'fee-forwarding leg does not call collectTokenFees');
+    }
+    const args = argRegion(callData);
+    let decoded;
+    try {
+        decoded = decodeAbiParameters(COLLECT_TOKEN_FEES_PARAMS, args);
+        if (encodeAbiParameters(COLLECT_TOKEN_FEES_PARAMS, decoded).toLowerCase() !==
+            args.toLowerCase()) {
+            refuse('ATTRIBUTION_MISSING', 'fee calldata is non-canonical or carries trailing bytes');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AdapterRefusal')
+            throw error;
+        refuse('ATTRIBUTION_MISSING', 'collectTokenFees calldata failed to decode');
+    }
+    const [token, distributions] = decoded;
+    if (distributions.length === 0 || distributions.length > 8) {
+        refuse('ATTRIBUTION_MISSING', 'fee calldata has an unexpected distribution count');
+    }
+    return Object.freeze({
+        token: getAddress(token),
+        distributions: Object.freeze(distributions.map((distribution) => Object.freeze({ recipient: getAddress(distribution.recipient), amount: distribution.amount }))),
+    });
+}
+/* ------------------------------------------------------------------ *
+ * Encoders — used ONLY by the mutation matrix (tests + the fence section) to
+ * derive inconsistent artifacts the verifier must refuse. Production paths never encode.
+ * ------------------------------------------------------------------ */
+export function encodeGenericSwap(swap) {
+    const legs = swap.legs.map((leg) => ({ ...leg }));
+    if (swap.selector === GENERIC_SWAP_SELECTORS.single) {
+        if (legs.length !== 1)
+            throw new Error('single selector needs exactly one leg');
+        const body = encodeAbiParameters(GENERIC_SWAP_SINGLE_PARAMS, [
+            swap.transactionId,
+            swap.integrator,
+            swap.referrer,
+            swap.receiver,
+            swap.minAmount,
+            legs[0],
+        ]);
+        return `${swap.selector}${body.slice(2)}`;
+    }
+    const body = encodeAbiParameters(GENERIC_SWAP_MULTIPLE_PARAMS, [
+        swap.transactionId,
+        swap.integrator,
+        swap.referrer,
+        swap.receiver,
+        swap.minAmount,
+        legs,
+    ]);
+    return `${swap.selector}${body.slice(2)}`;
+}
+export function encodeCollectTokenFees(fees) {
+    const body = encodeAbiParameters(COLLECT_TOKEN_FEES_PARAMS, [
+        fees.token,
+        fees.distributions.map((distribution) => ({ ...distribution })),
+    ]);
+    return `${COLLECT_TOKEN_FEES_SELECTOR}${body.slice(2)}`;
+}
+//# sourceMappingURL=lifi-decode.js.map

package/dist/adapter/lifi-decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifi-decode.js","sourceRoot":"","sources":["../../src/adapter/lifi-decode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,GAGnB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,uHAAuH;AACvH,MAAM,eAAe,GACnB,iJAAiJ,CAAC;AAEpJ,MAAM,0BAA0B,GAAG,kBAAkB,CACnD,wGAAwG,eAAe,YAAY,CACpI,CAAC;AACF,MAAM,4BAA4B,GAAG,kBAAkB,CACrD,wGAAwG,eAAe,cAAc,CACtI,CAAC;AACF,MAAM,yBAAyB,GAAG,kBAAkB,CAClD,oEAAoE,CACrE,CAAC;AAEF,mHAAmH;AACnH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,YAAmB;IAC3B,QAAQ,EAAE,YAAmB;CAC9B,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAmB,CAAC;AAgC/D,SAAS,UAAU,CAAC,IAAS;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAS,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,IAAS;IAC1B,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAS,CAAC;AACtC,CAAC;AAYD,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QACpC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9C,gBAAgB,EAAE,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAClD,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,eAAe,EAAE,GAAG,CAAC,eAAe;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAS;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GACV,QAAQ,KAAK,sBAAsB,CAAC,MAAM;QACxC,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,QAAQ,KAAK,sBAAsB,CAAC,QAAQ;YAC5C,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CACJ,uBAAuB,EACvB,YAAY,QAAQ,yDAAyD,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,mBAAmB,CAAC,MAAM,EAAE,OAAgB,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvF,MAAM,CAAC,uBAAuB,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,KAAK,CAAC;QAC3E,MAAM,CAAC,uBAAuB,EAAE,uCAAuC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,OAO5E,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;IAE3F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ;QACR,aAAa;QACb,UAAU;QACV,QAAQ;QACR,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;QAC9B,SAAS;QACT,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAa;IAClD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,2BAA2B,EAAE,CAAC;QACzD,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAC/D,IACE,mBAAmB,CAAC,yBAAyB,EAAE,OAAgB,CAAC,CAAC,WAAW,EAAE;YAC9E,IAAI,CAAC,WAAW,EAAE,EAClB,CAAC;YACD,MAAM,CAAC,qBAAqB,EAAE,yDAAyD,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,KAAK,CAAC;QAC3E,MAAM,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,OAA8D,CAAC;IAC9F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,CAC1B,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACjC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAC9F,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;wEAGwE;AAExE,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,KAAK,sBAAsB,CAAC,MAAM,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,mBAAmB,CAAC,0BAA0B,EAAE;YAC3D,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,CAAC,CAAU;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAS,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,4BAA4B,EAAE;QAC7D,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,SAAS;QACd,IAAa;KACd,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAS,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAA6B;IAClE,MAAM,IAAI,GAAG,mBAAmB,CAAC,yBAAyB,EAAE;QAC1D,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC,CAAU;KACzE,CAAC,CAAC;IACH,OAAO,GAAG,2BAA2B,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAS,CAAC;AACjE,CAAC"}

package/dist/adapter/refusal.d.ts

@@ -0,0 +1,21 @@
+/**
+ * refusal.ts — the adapter's refusal taxonomy.
+ *
+ * Every refusal names a defect in the artifact or in the request (spec §10). A refusal that cannot
+ * name one is not a refusal but a service fault, and is thrown as a plain Error so the ladder grades
+ * it INCONCLUSIVE rather than BLOCKED.
+ *
+ * `errorType` mirrors `code` so the CDP kit's ladder — which only grades a *structured* refusal as
+ * the fence biting — recognises adapter refusals without a second grading path.
+ */
+export declare const ADAPTER_REFUSAL_CODES: readonly ["SCHEMA_INVALID", "UNSUPPORTED_OPERATION", "DIGEST_MISMATCH", "STALE_ARTIFACT", "ACCOUNT_BINDING_MISMATCH", "CAPABILITY_MISSING", "CHAIN_MISMATCH", "PLAN_SHAPE_INVALID", "APPROVAL_INVALID", "TARGET_NOT_ALLOWED", "SWAP_CALLDATA_INVALID", "RECEIVER_MISMATCH", "INTENT_MISMATCH", "MIN_OUTPUT_TOO_LOW", "ATTRIBUTION_MISSING", "ATTRIBUTION_MISMATCH", "FEE_CAP_EXCEEDED"];
+export type AdapterRefusalCode = (typeof ADAPTER_REFUSAL_CODES)[number];
+export declare class AdapterRefusal extends Error {
+    readonly code: AdapterRefusalCode;
+    /** Same value as `code`; lets `normalizeError` treat this as a structured refusal. */
+    readonly errorType: AdapterRefusalCode;
+    constructor(code: AdapterRefusalCode, message: string);
+}
+export declare function refuse(code: AdapterRefusalCode, message: string): never;
+export declare function isAdapterRefusal(error: unknown): error is AdapterRefusal;
+export declare function isAdapterRefusalCode(value: string): value is AdapterRefusalCode;

package/dist/adapter/refusal.js

@@ -0,0 +1,55 @@
+/**
+ * refusal.ts — the adapter's refusal taxonomy.
+ *
+ * Every refusal names a defect in the artifact or in the request (spec §10). A refusal that cannot
+ * name one is not a refusal but a service fault, and is thrown as a plain Error so the ladder grades
+ * it INCONCLUSIVE rather than BLOCKED.
+ *
+ * `errorType` mirrors `code` so the CDP kit's ladder — which only grades a *structured* refusal as
+ * the fence biting — recognises adapter refusals without a second grading path.
+ */
+export const ADAPTER_REFUSAL_CODES = [
+    // Envelope integrity (the constructor's own assertions, surfaced unchanged)
+    'SCHEMA_INVALID',
+    'UNSUPPORTED_OPERATION',
+    'DIGEST_MISMATCH',
+    'STALE_ARTIFACT',
+    'ACCOUNT_BINDING_MISMATCH',
+    // Adapter contract (spec §9)
+    'CAPABILITY_MISSING',
+    'CHAIN_MISMATCH',
+    // Adapter-side plan policy (what the user's signer is willing to sign)
+    'PLAN_SHAPE_INVALID',
+    'APPROVAL_INVALID',
+    'TARGET_NOT_ALLOWED',
+    'SWAP_CALLDATA_INVALID',
+    'RECEIVER_MISMATCH',
+    // Intent binding — the artifact must be the trade the USER asked for
+    'INTENT_MISMATCH',
+    'MIN_OUTPUT_TOO_LOW',
+    // Attribution — assert what you are about to sign, against the RULED constants
+    'ATTRIBUTION_MISSING',
+    'ATTRIBUTION_MISMATCH',
+    'FEE_CAP_EXCEEDED',
+];
+export class AdapterRefusal extends Error {
+    code;
+    /** Same value as `code`; lets `normalizeError` treat this as a structured refusal. */
+    errorType;
+    constructor(code, message) {
+        super(`[${code}] ${message}`);
+        this.code = code;
+        this.name = 'AdapterRefusal';
+        this.errorType = code;
+    }
+}
+export function refuse(code, message) {
+    throw new AdapterRefusal(code, message);
+}
+export function isAdapterRefusal(error) {
+    return error instanceof AdapterRefusal;
+}
+export function isAdapterRefusalCode(value) {
+    return ADAPTER_REFUSAL_CODES.includes(value);
+}
+//# sourceMappingURL=refusal.js.map

package/dist/adapter/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../../src/adapter/refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,4EAA4E;IAC5E,gBAAgB;IAChB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,6BAA6B;IAC7B,oBAAoB;IACpB,gBAAgB;IAChB,uEAAuE;IACvE,oBAAoB;IACpB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,qEAAqE;IACrE,iBAAiB;IACjB,oBAAoB;IACpB,+EAA+E;IAC/E,qBAAqB;IACrB,sBAAsB;IACtB,kBAAkB;CACV,CAAC;AAIX,MAAM,OAAO,cAAe,SAAQ,KAAK;IAK5B;IAJX,sFAAsF;IAC7E,SAAS,CAAqB;IAEvC,YACW,IAAwB,EACjC,OAAe;QAEf,KAAK,CAAC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAHrB,SAAI,GAAJ,IAAI,CAAoB;QAIjC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,MAAM,CAAC,IAAwB,EAAE,OAAe;IAC9D,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,cAAc,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/dist/adapter/sent-step.d.ts

@@ -0,0 +1,15 @@
+/**
+ * sent-step.ts — one submitted plan step as both signers report it: the step's index and kind, its
+ * target, the transaction hash, and the SEALED canonical receipt's block number and gas used.
+ */
+import type { Address, Hex } from 'viem';
+import type { VerifiedStep } from './verify.js';
+export interface SentStep {
+    readonly index: number;
+    readonly kind: VerifiedStep['kind'];
+    readonly to: Address;
+    readonly transaction_hash: Hex;
+    readonly status: 'success';
+    readonly block_number: string;
+    readonly gas_used: string;
+}

package/dist/adapter/sent-step.js

@@ -0,0 +1,6 @@
+/**
+ * sent-step.ts — one submitted plan step as both signers report it: the step's index and kind, its
+ * target, the transaction hash, and the SEALED canonical receipt's block number and gas used.
+ */
+export {};
+//# sourceMappingURL=sent-step.js.map

package/dist/adapter/sent-step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sent-step.js","sourceRoot":"","sources":["../../src/adapter/sent-step.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/adapter/verify.d.ts

@@ -0,0 +1,149 @@
+/**
+ * verify.ts — the adapter core: what the user's signer checks BEFORE it signs anything.
+ *
+ * Model B (docs/0808_model_b_scope_and_verdict.md, spec docs/0816_step1_execution_mcp_spec_draft.md):
+ * Otto constructs; the user's own custody signs and submits; Otto's fee is attribution baked into
+ * the constructed payload. The constructor is prepare-only and asserts what it built. This module is
+ * the OTHER half of spec §8 — "the consuming adapter re-checks digest + expected signer before
+ * signing" — extended to a full adapter-side policy, because an artifact's own digests prove
+ * integrity relative to the artifact's own claims and nothing more: an inconsistent artifact with
+ * correctly recomputed digests is still inconsistent. The checks run in three layers:
+ *
+ *   1. INTEGRITY — the constructor's own assertions, unchanged (schema, payload digest, whole-envelope
+ *      commitment + freshness, account binding).
+ *   2. INTENT    — the artifact is the trade the USER asked for: the approved token and amount ARE the
+ *      intent's, the deposit legs pull exactly that amount, the output token IS the intent's, and the
+ *      on-chain minimum output is at least the caller's own floor (> 0). The caller owns the floor;
+ *      it never comes from the artifact. This is the fence for the swap legs themselves: LI.FI's
+ *      GenericSwapV3 reverts unless `_receiver` gets at least `_minAmount` of the output token, so an
+ *      internal DEX leg is bounded on-chain by the receiver + minimum-output binds rather than by an
+ *      allowlist of every DEX contract (which this adapter deliberately does not attempt to hold).
+ *   3. POLICY    — capability contract, chain, plan shape, approvals only to the reviewed spender
+ *      that IS the call target, `_receiver` == this account, and the fee leg decoded with the
+ *      adapter's own decoder and matched against the RULED attribution constants (10 bps to Otto's
+ *      recipient, only the reviewed FeeForwarder deployments, nothing to strangers, aggregate under
+ *      the cap).
+ *
+ * P0 LIVENESS binds here exactly as it binds the constructor (spec §7.0): a valid artifact for the
+ * stated intent MUST pass. The test suite's first test is that property; the mutation matrix proves
+ * every refusal reddens. Every check that passes is recorded by id so the sitting's evidence shows
+ * what was verified, not just that "verification passed".
+ */
+import { type Address, type Hex } from 'viem';
+import { type AccountProfile, type ExecutionEnvelope } from '../execution-index.js';
+import { type DecodedCollectTokenFees } from './lifi-decode.js';
+export type SigningCapability = 'send_evm_transaction' | 'submit_evm_batch' | 'sign_eip712' | 'sign_hyperliquid_l1' | 'sign_x402_payment';
+/** What the USER asked for. Owned by the caller; never read out of the artifact. */
+export interface SwapIntent {
+    readonly fromToken: Address;
+    readonly toToken: Address;
+    /** Exact input amount in atomic units. */
+    readonly fromAmount: bigint;
+    /**
+     * The caller's OWN minimum acceptable output (atomic units), from a price source the caller
+     * trusts. Must be positive: a zero floor would let a swap leg deliver nothing.
+     */
+    readonly minAmountOut: bigint;
+}
+export interface AttributionPolicy {
+    /** The RULED fee config version the envelope must carry (spec §8: mechanism + version, never values). */
+    readonly configVersion: string;
+    /** The RULED Otto fee in basis points, asserted against the decoded fee leg. */
+    readonly feeBps: bigint;
+    readonly integrator: string;
+    readonly ottoRecipient: Address;
+    /** Recipients other than Otto's that a fee leg may pay (LI.FI's own platform share). Anything else is refused. */
+    readonly otherAllowedRecipients: readonly Address[];
+    /** Reviewed FeeForwarder deployments for the plan's chain (v1 + v2.0.0 today); a leg calling any other address is refused by name. */
+    readonly forwarders: readonly Address[];
+    /** Aggregate (Otto + LI.FI) fee ceiling in basis points; strictly above it is refused. */
+    readonly aggregateCapBps: bigint;
+}
+export interface AdapterPolicy {
+    readonly allowedCallTargets: readonly Address[];
+    readonly allowedApproveSpenders: readonly Address[];
+    readonly attribution: AttributionPolicy;
+}
+export interface VerifyExpectations {
+    readonly profile: AccountProfile;
+    readonly intent: SwapIntent;
+    readonly capabilities: readonly SigningCapability[];
+    readonly policy: AdapterPolicy;
+    readonly nowMs?: number;
+    /**
+     * The EXACT `otto_prepare_swap` input the caller sent (raw, as sent). When supplied, the artifact's
+     * `intent_digest` is recomputed with the constructor's own normalizer (which parses and checksums
+     * exactly as the constructor does) and must match — the artifact is then bound not only to the
+     * semantic intent fields but to the very request that produced it.
+     */
+    readonly prepareInput?: unknown;
+}
+export interface VerifiedStep {
+    readonly kind: 'approve_reset' | 'approve' | 'call';
+    readonly to: Address;
+    readonly value: bigint;
+    readonly data: Hex;
+}
+export interface VerifiedCheck {
+    readonly id: string;
+    readonly result: 'passed';
+}
+export interface VerifiedSwap {
+    readonly artifact: ExecutionEnvelope;
+    readonly steps: readonly [VerifiedStep, VerifiedStep, VerifiedStep];
+    readonly intent: SwapIntent;
+    readonly token: Address;
+    readonly outputToken: Address;
+    readonly spender: Address;
+    readonly gross: bigint;
+    readonly receiver: Address;
+    readonly minAmountOut: bigint;
+    readonly ottoFee: bigint;
+    readonly fees: DecodedCollectTokenFees;
+    readonly checks: readonly VerifiedCheck[];
+}
+/** The reviewed v1 policy for a same-chain LI.FI swap on `chainId`. */
+export declare function defaultAdapterPolicy(chainId: number): AdapterPolicy;
+export declare function verifySwapEnvelope(raw: unknown, expected: VerifyExpectations): VerifiedSwap;
+/** The verifier's record of a plan at verification time. Signers bind to THIS, not to the plan's fields. */
+export interface PlanIdentity {
+    readonly address: Address;
+    readonly chainId: number;
+    readonly capabilities: readonly SigningCapability[];
+    readonly validUntilMs: number;
+    readonly artifactId: string;
+    readonly artifactDigest: Hex;
+    readonly stepTargets: readonly [Address, Address, Address];
+}
+/** True iff every object reachable from `value` is frozen. */
+export declare function isDeepFrozen(value: unknown): boolean;
+/** True iff `plan` is an object `verifySwapEnvelope` itself returned (identity, not shape). */
+export declare function isVerifierOutput(plan: unknown): boolean;
+/** The verifier's own record of an intact verified plan (throws for anything else). */
+export declare function verifiedPlanIdentity(plan: VerifiedSwap): PlanIdentity;
+/** What a signer must present to be allowed to sign a verified plan. */
+export interface SignerIdentity {
+    readonly address: Address;
+    readonly chainId: number;
+    readonly capabilities: readonly SigningCapability[];
+}
+/**
+ * The FULL signer-side gate, called at signer entry and again immediately before every signature or
+ * submission: provenance + frozen shape (`assertVerifiedPlanIntact`), then — against the verifier's
+ * RECORD of the plan, not the plan's fields — the bound account IS this signer, the chain matches,
+ * every required capability is provided, and the plan is still fresh at `nowMs` (the record's
+ * deadline AND the artifact's own commitment-bound deadline). A plan verified for another account,
+ * another chain, or that has since expired is refused here even though it was genuinely verified.
+ */
+export declare function assertPlanSignableBy(plan: VerifiedSwap, signer: SignerIdentity, nowMs?: number): void;
+/**
+ * Signer-side gate: a plan may be signed only if it IS the object `verifySwapEnvelope` returned
+ * (provenance, checked by identity), it is still the deep-frozen shape it was returned as — the
+ * artifact's nested objects included — and it still matches the verifier's own record of it. A thawed
+ * copy, a JSON round trip, a mutated clone, a fully frozen look-alike that imitates the shape, or a
+ * re-pointed artifact with a recomputed commitment are all refused, so the only way to sign
+ * different bytes is to verify different bytes.
+ */
+export declare function assertVerifiedPlanIntact(plan: VerifiedSwap): void;
+/** The check ids `verifySwapEnvelope` records on a passing artifact, in order. Tests pin this list. */
+export declare const VERIFY_CHECK_IDS: readonly ["schema", "payload_digest", "commitment", "freshness", "account_binding", "capabilities", "chain", "plan_shape", "approvals", "swap_decode", "min_output", "fee_attribution"];