otto-intel-mcp 0.1.0

package/dist/execution-delegation-admin.js

@@ -0,0 +1,290 @@
+/**
+ * execution-delegation-admin.ts — the three delegation ADMIN tools on the hosted MCP (PR-1b, seat ruling D10 = (a)).
+ *
+ *   otto_delegation_fence   — the ONLY writer of the Model-B project policy: ensure-by-digest + read-back.
+ *   otto_delegation_status  — one user's grant/fence read-back, bound to the user a CDP access token resolves to.
+ *   otto_delegation_revoke  — developer-side revoke with read-back, fail-closed under the rig lock.
+ *
+ * Every tool: the request header FIRST (constant-time, before parsing or any CDP read — the same seam as
+ * `otto_submit_under_delegation`), then the strict schema, then the reads. Nothing here logs a token, the
+ * header, or a credential; refusals are machine-readable codes.
+ *
+ * FENCE RULES (gate r1 of this PR sharpened them; each is mutation-proved in the tests):
+ *   CARDINALITY — Coinbase allows exactly one project-scope policy. A read-back with MORE than one is an
+ *     anomalous snapshot and refuses (`DELEGATION_FENCE_AMBIGUOUS`) before any other judgement — nothing is
+ *     written, nothing is blessed as present on the strength of "one of them matches".
+ *   LINEAGE — a project policy is OURS only when its description matches the ANCHORED pattern
+ *     `^OTTO model b swap fence v<N>$` (`modelBLineageVersion`). Ours with N == this binary's version and the
+ *     v-current rules → `unchanged`. Ours with N ≤ this version and stale rules → updated IN PLACE. Ours with
+ *     N > this version → refused (`DELEGATION_FENCE_NEWER`): a running older binary never downgrades a newer
+ *     fence (rollback is a governed manual act). Anything else — the proof kit's `OTTO PROBE …`, a hand-installed
+ *     policy, no description, the prefix in the middle, a suffix — is FOREIGN: refused by name
+ *     (`DELEGATION_FENCE_FOREIGN`, naming the description + rules-digest prefix); never overwritten, never deleted.
+ *   WRITE ONCE — a create that Coinbase refuses as a duplicate (`already_exists` / 409: someone created a policy
+ *     between the snapshot and the write) is never retried and never turned into an update from this path: the
+ *     tool re-reads once and judges what is there.
+ *   BEFORE AN UPDATE — the policy is re-read BY ID immediately before the write and must still be exactly the
+ *     snapshot (same description, same rules digest); any change → refused, nothing written. `@coinbase/cdp-sdk`
+ *     1.54.0 offers no conditional update (`UpdatePolicyOptions` = { id, policy, idempotencyKey } — no revision,
+ *     no ETag), so the window between that re-read and the write cannot be closed by code. It is closed by the
+ *     OPERATIONAL PREMISE, stated here, in the tool description and in the README: AT MOST ONE ENSURE WRITES
+ *     PROJECT-WIDE AT A TIME, ACROSS VERSIONS — the ensure is an OPS action run by one operator, never during a
+ *     rolling deploy (two versions of this tool running at once are two writers, and the older one would win a
+ *     race and downgrade); the dApp never invokes it (PR-2's mint gate reads `fence.present` from
+ *     `otto_delegation_status`); nobody edits the policy in the CDP portal while an ensure runs. Under that
+ *     premise the re-read is exact; without it, "never overwrite foreign" and "never downgrade" narrow to
+ *     "…what was foreign / newer one round-trip ago".
+ *   READ-BACK BOUND TO THE WRITE — after a write, the proof is a read-back of exactly one project policy whose
+ *     id IS the id that was written (the created id, or the updated id) and which reads back as v-current. A
+ *     matching record under another id (a stale cache, a ghost) is not proof; a bounded poll covers the engine's
+ *     asynchronous propagation, then the tool fails closed (`DELEGATION_FENCE_ABSENT`).
+ *
+ * IDENTITY. `status` and the user path of `revoke` resolve the userId from `cdp.endUser.validateAccessToken`;
+ * a client-sent id is refused by the strict schema. The support path of `revoke` takes `{ userId,
+ * support_reason }` from an operator holding the server secret; the reason is written to the structured log
+ * through the boot redactor (URLs and configured secret values never land in the log), the token never is.
+ */
+import { getAddress } from 'viem';
+import { revocationRequested } from './adapter/cdp-signer.js';
+import { redactBootMessage } from './boot-redaction.js';
+import { DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_STATUS_INPUT_SCHEMA, } from './execution-delegation-admin-definition.js';
+import { assertDelegationCaller, } from './execution-delegation.js';
+import { MODEL_B_PER_SWAP_CAP_USD, MODEL_B_POLICY_LINEAGE_PREFIX, MODEL_B_POLICY_NAME_V1, MODEL_B_POLICY_VERSION, modelBLineageVersion, modelBProjectPolicyBody, policyRulesDigest, readBackModelBFence, } from './execution-delegation-policy.js';
+import { refuse } from './execution-errors.js';
+const DEFAULT_FENCE_WAIT = { pollMs: 500, maxPolls: 20 };
+function servicesOf(runtime) {
+    const services = runtime.delegation;
+    if (!services)
+        return refuse('DELEGATION_UNAVAILABLE', 'delegated send is not configured on this server');
+    return services;
+}
+function parseWith(schema, rawInput) {
+    const parsed = schema.safeParse(rawInput);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        return refuse('DELEGATION_INPUT_INVALID', `input does not satisfy the schema: ${issue ? `${issue.path.map(String).join('.') || '(root)'}: ${issue.message}` : 'unknown issue'}`);
+    }
+    return parsed.data;
+}
+/* ------------------------------------------------------------------ *
+ * One fence write at a time per services instance (the tool is idempotent; two concurrent ensures must not
+ * race a create against an update). Across instances/processes the singleton is Coinbase's: a duplicate create
+ * is refused upstream and handled by the WRITE ONCE rule above.
+ * ------------------------------------------------------------------ */
+const FENCE_LOCKS = new WeakMap();
+function serializedFence(services, op) {
+    const prev = FENCE_LOCKS.get(services) ?? Promise.resolve();
+    const run = prev.then(op, op);
+    FENCE_LOCKS.set(services, run.catch(() => undefined));
+    return run;
+}
+function projectScoped(policies) {
+    return policies.filter((policy) => policy.scope === 'project');
+}
+function describe(policy) {
+    return `"${policy.description ?? '(no description)'}" (id ${policy.id}, rules digest ${policyRulesDigest(policy.rules).slice(0, 16)}…)`;
+}
+function refuseAmbiguous(project) {
+    return refuse('DELEGATION_FENCE_AMBIGUOUS', `${project.length} project-scope policies read back where Coinbase allows one — ${project.map(describe).join('; ')}; nothing written, nothing deleted; resolve by hand`);
+}
+function refuseForeign(policy) {
+    return refuse('DELEGATION_FENCE_FOREIGN', `a different project-scope policy is installed — ${describe(policy)}; Coinbase allows one, and this tool never overwrites or deletes a policy outside the "${MODEL_B_POLICY_LINEAGE_PREFIX} v<N>" lineage — remove it by hand first`);
+}
+function refuseNewer(policy) {
+    return refuse('DELEGATION_FENCE_NEWER', `the installed fence is ${describe(policy)} — a NEWER version than this server knows (v${MODEL_B_POLICY_VERSION}); refusing to downgrade it; deploy the newer server or roll the fence back by hand`);
+}
+/** Coinbase refused a second project-scope policy: `already_exists` (409). */
+function isCreateConflict(error) {
+    const e = error;
+    return e?.statusCode === 409 || e?.errorType === 'already_exists';
+}
+/** `otto_delegation_fence` — ensure-by-digest + read-back bound to the write; the only writer of the project policy. */
+export async function ensureDelegationFence(runtime, rawInput, caller, wait = {}) {
+    const services = servicesOf(runtime);
+    assertDelegationCaller(services, caller);
+    parseWith(DELEGATION_FENCE_INPUT_SCHEMA, rawInput);
+    return serializedFence(services, async () => {
+        // CARDINALITY first: more than one project policy is never judged, never written to.
+        const snapshot = await services.rig.listProjectPolicies();
+        const project = projectScoped(snapshot);
+        if (project.length > 1)
+            return refuseAmbiguous(project);
+        const before = readBackModelBFence(snapshot);
+        if (before.present)
+            return fenceResult('unchanged', before.id, before.rulesDigest);
+        let action;
+        let targetId;
+        if (project.length === 0) {
+            try {
+                targetId = await services.rig.createProjectPolicy(modelBProjectPolicyBody());
+                action = 'created';
+            }
+            catch (error) {
+                if (!isCreateConflict(error))
+                    throw error;
+                // WRITE ONCE: Coinbase's singleton refused a second policy — one appeared between the snapshot and the
+                // write. Never a second create, never an update from this path: re-read once and judge what is there.
+                const again = await services.rig.listProjectPolicies();
+                const againProject = projectScoped(again);
+                if (againProject.length > 1)
+                    return refuseAmbiguous(againProject);
+                const read = readBackModelBFence(again);
+                if (read.present)
+                    return fenceResult('unchanged', read.id, read.rulesDigest);
+                const appeared = againProject[0];
+                if (!appeared)
+                    return refuse('DELEGATION_FENCE_ABSENT', 'the create was refused as a duplicate but no project policy reads back; run the fence tool again');
+                const appearedVersion = modelBLineageVersion(appeared.description);
+                if (appearedVersion === undefined)
+                    return refuseForeign(appeared);
+                if (appearedVersion > MODEL_B_POLICY_VERSION)
+                    return refuseNewer(appeared);
+                return refuse('DELEGATION_FENCE_ABSENT', `a policy of our lineage appeared during the ensure and does not read back as v-current (${describe(appeared)}); nothing written — run the fence tool again`);
+            }
+        }
+        else {
+            const existing = project[0];
+            const version = modelBLineageVersion(existing.description);
+            if (version === undefined)
+                return refuseForeign(existing);
+            if (version > MODEL_B_POLICY_VERSION)
+                return refuseNewer(existing);
+            // BEFORE AN UPDATE: re-read this policy by id; it must still be exactly the snapshot. (No conditional
+            // update exists in the SDK — see the header for the operational premise that closes the remaining window.)
+            const current = await services.rig.readProjectPolicy(existing.id);
+            if (!current ||
+                current.scope !== 'project' ||
+                current.description !== existing.description ||
+                policyRulesDigest(current.rules) !== policyRulesDigest(existing.rules)) {
+                if (current && modelBLineageVersion(current.description) === undefined)
+                    return refuseForeign(current);
+                return refuse('DELEGATION_FENCE_ABSENT', `the project policy changed between the snapshot and the write (${current ? describe(current) : 'it no longer reads back by id'}); nothing written — run the fence tool again`);
+            }
+            await services.rig.updateProjectPolicy(existing.id, modelBProjectPolicyBody());
+            targetId = existing.id;
+            action = 'updated';
+        }
+        // READ-BACK BOUND TO THE WRITE: exactly one project policy, its id IS the written id, and it is v-current.
+        // Bounded: the engine propagates asynchronously.
+        const pollMs = wait.pollMs ?? DEFAULT_FENCE_WAIT.pollMs;
+        const maxPolls = wait.maxPolls ?? DEFAULT_FENCE_WAIT.maxPolls;
+        let last = 'no project policy read back';
+        for (let poll = 0; poll < maxPolls; poll += 1) {
+            const listed = await services.rig.listProjectPolicies();
+            const afterProject = projectScoped(listed);
+            if (afterProject.length > 1)
+                return refuseAmbiguous(afterProject);
+            const after = readBackModelBFence(listed);
+            if (after.present && after.id === targetId)
+                return fenceResult(action, after.id, after.rulesDigest);
+            last = after.present
+                ? `a v-current policy reads back under id ${after.id}, not the written id ${targetId}`
+                : `${after.reason}: ${after.detail}`;
+            if (poll + 1 < maxPolls)
+                await new Promise((resolve) => setTimeout(resolve, pollMs));
+        }
+        return refuse('DELEGATION_FENCE_ABSENT', `the fence was ${action} (id ${targetId}) but does not read back as "${MODEL_B_POLICY_NAME_V1}" with the v1 rules digest under that id after ${maxPolls} polls (${last}); nothing is submittable until it does`);
+    });
+}
+function fenceResult(action, id, rulesDigest) {
+    return Object.freeze({
+        status: 'present',
+        action,
+        policy_id: id,
+        policy_name: MODEL_B_POLICY_NAME_V1,
+        rules_digest: rulesDigest,
+        per_swap_cap_usd: MODEL_B_PER_SWAP_CAP_USD,
+    });
+}
+/**
+ * `otto_delegation_fence_status` — PUBLIC, read-only, no caller check: the fence's public promise. Nothing here
+ * names a user, a grant, an address or a policy's contents; `reason` is a class from `readBackModelBFence`.
+ */
+export async function readDelegationFenceStatus(runtime) {
+    const services = servicesOf(runtime);
+    const fence = readBackModelBFence(await services.rig.listProjectPolicies());
+    return Object.freeze({
+        present: fence.present,
+        policy_name: MODEL_B_POLICY_NAME_V1,
+        per_swap_cap_usd: MODEL_B_PER_SWAP_CAP_USD,
+        // The public authority binding: published present or absent, so the agent CLI mints to THIS project
+        // (and can still bind status/revoke to it after the fence is removed). Registration requires it set.
+        ...(services.publicProjectId ? { project_id: services.publicProjectId } : {}),
+        ...(fence.present ? { rules_digest: fence.rulesDigest } : { reason: fence.reason }),
+    });
+}
+/* ------------------------------------------------------------------ *
+ * Identity: the user a CDP access token resolves to. The token is consulted once, never stored, never logged.
+ * ------------------------------------------------------------------ */
+async function userFromAccessToken(services, accessToken) {
+    const user = await services.rig.validateAccessToken(accessToken);
+    if (!user)
+        return refuse('DELEGATION_TOKEN_INVALID', 'the access token does not resolve to a CDP end user');
+    return Object.freeze({
+        userId: user.userId,
+        addresses: user.evmAddresses.map((a) => getAddress(a)),
+    });
+}
+/** `otto_delegation_status` — one user's read-back, bound to the token's user. */
+export async function readDelegationStatus(runtime, rawInput, caller) {
+    const services = servicesOf(runtime);
+    assertDelegationCaller(services, caller);
+    const input = parseWith(DELEGATION_STATUS_INPUT_SCHEMA, rawInput);
+    const user = await userFromAccessToken(services, input.accessToken);
+    const fence = readBackModelBFence(await services.rig.listProjectPolicies());
+    const requestedHere = revocationRequested(services.rig.rig, user.userId);
+    const grant = await services.rig.rig.readDelegation(user.userId);
+    const expiresAtMs = grant ? Date.parse(grant.expiresAt) : Number.NaN;
+    const active = grant !== undefined &&
+        !requestedHere &&
+        Number.isFinite(expiresAtMs) &&
+        expiresAtMs > runtime.nowMs();
+    return Object.freeze({
+        user_id: user.userId,
+        addresses: [...user.addresses],
+        fence: Object.freeze({
+            present: fence.present,
+            policy_name: MODEL_B_POLICY_NAME_V1,
+            per_swap_cap_usd: MODEL_B_PER_SWAP_CAP_USD,
+            ...(fence.present ? { rules_digest: fence.rulesDigest } : {}),
+        }),
+        delegation: Object.freeze({ active, ...(grant ? { expires_at: grant.expiresAt } : {}) }),
+        revocation_requested_here: requestedHere,
+    });
+}
+const STDOUT_SUPPORT_SINK = {
+    write: (entry) => process.stdout.write(`${JSON.stringify({ tag: 'delegation-support', ...entry })}\n`),
+};
+/** `otto_delegation_revoke` — developer-side revoke, read-back inside the rig lock, fail-closed afterwards. */
+export async function revokeDelegation(runtime, rawInput, caller, supportSink = STDOUT_SUPPORT_SINK) {
+    const services = servicesOf(runtime);
+    assertDelegationCaller(services, caller);
+    const input = parseWith(DELEGATION_REVOKE_INPUT_SCHEMA, rawInput);
+    let userId;
+    let path;
+    if ('accessToken' in input) {
+        userId = (await userFromAccessToken(services, input.accessToken)).userId;
+        path = 'user';
+    }
+    else {
+        userId = input.userId;
+        path = 'support';
+        supportSink.write({
+            action: 'delegation_revoke',
+            userId,
+            // Free text from an operator: URLs and any configured secret value are redacted before it lands in a log.
+            reason: redactBootMessage(input.support_reason),
+            ts: new Date(runtime.nowMs()).toISOString(),
+        });
+    }
+    try {
+        // Serialized on the rig, the lock held through the read-back; the user is marked revocation-requested BEFORE
+        // the raw revoke, so a plan queued behind this call is refused whatever the read-back says.
+        await services.rig.rig.revoke(userId);
+    }
+    catch {
+        return refuse('DELEGATION_REVOKE_NOT_CONFIRMED', 'the revoke was issued but the delegation still reads back; this server submits nothing for the user from now on — retry, and check the CDP portal');
+    }
+    return Object.freeze({ user_id: userId, revoked: true, reads_back: false, path });
+}
+//# sourceMappingURL=execution-delegation-admin.js.map

package/dist/execution-delegation-policy.d.ts

@@ -0,0 +1,257 @@
+/**
+ * execution-delegation-policy.ts — the product's CDP project policy that fences the delegated leg
+ * (Model B, browser plane; seat ruling D9 = α+, 2026-08-29).
+ *
+ * WHAT THE ENGINE FENCES, AND WHAT IT CANNOT. Coinbase's policy engine offers END-USER accounts exactly
+ * one fence: the project-scope policy ("Only one project-level policy can exist at any time"; account-
+ * scoped policies attach only to developer-owned accounts, and no rule can refer to "the sender's own
+ * address"). So this policy is a SHAPE fence with constant caps, shared by every delegated user:
+ *   - approve: only on an allow-listed input token, only to the reviewed LI.FI diamond, only up to the
+ *     per-swap cap (5,000 USD, Founder word 2026-08-29) in that token's atomic units — a bound on ONE
+ *     swap, not a daily or total limit (zero stays allowed for the allowance clear);
+ *   - call: only the LI.FI diamond, zero native value, only the two GenericSwapV3 ERC20→ERC20 entry points.
+ * The approve cap is what bounds the swap's notional on-chain: the diamond can only pull what is
+ * approved. Everything else — that `_receiver` is the end user, that `_minAmount` is at least the
+ * caller's floor, that the fee leg is the ruled attribution — is Otto's SERVER-SIDE 13-check verifier on
+ * every call (`adapter/verify.ts`), run with the end user's address as the server reads it from CDP.
+ *
+ * THE RESIDUAL, STATED PLAINLY (also in the PR body and in the consent copy the user reads):
+ *   Coinbase's engine limits Otto to swaps through LI.FI up to the per-swap cap; Otto's own server checks
+ *   where the output goes; the user can revoke at any time. The engine does NOT bind the receiver — a
+ *   compromised Otto server could re-point `_receiver` inside a diamond swap; that residual is bounded by
+ *   the per-swap cap, the grant's expiry and the user's revoke, not by the engine.
+ *
+ * IDENTITY OF THE FENCE (seat ruling D6): the policy is matched by its versioned DESCRIPTION and checked
+ * by a digest over its canonical rules on every read-back — never by a policy id in env (a re-created
+ * policy silently changes id; a renamed one silently changes shape; the digest catches both). The
+ * canonical form lowercases hex strings and sorts object keys, nothing else; if the engine ever
+ * augments rules on read-back, `canonical()` is the one place to teach it.
+ *
+ * Description obeys the SDK's regex (`/^[A-Za-z0-9 ,.]{1,50}$/`): no hyphens, no parentheses.
+ */
+import { type Address } from 'viem';
+/**
+ * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
+ * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
+ * in place only when N ≤ this binary's version; a newer N is never downgraded; anything that does not match —
+ * the prefix in the middle, a suffix, no description — is foreign and is never touched.
+ */
+export declare const MODEL_B_POLICY_LINEAGE_PREFIX = "OTTO model b swap fence";
+/** This binary's fence version. Bump it whenever the rules change shape or caps. */
+export declare const MODEL_B_POLICY_VERSION: 1;
+/** The versioned match key. */
+export declare const MODEL_B_POLICY_NAME_V1: string;
+/** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
+export declare function modelBLineageVersion(description: unknown): number | undefined;
+export declare const MODEL_B_POLICY_NETWORK: "base";
+export declare const MODEL_B_CHAIN_ID: 8453;
+/**
+ * Delegation expiry bounds (Founder word `expiry 90/180`, 2026-08-29): the mint page defaults to 90 days
+ * and refuses anything past 180; the server routes enforce the same numbers. Coinbase documents no
+ * maximum of its own for `expiresAt` (SDK types + vendor doc read 2026-08-29); the first 180-day mint
+ * at the sitting is the live confirmation.
+ */
+export declare const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS: 90;
+export declare const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS: 180;
+/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+export declare function boundedDelegationExpiry(requestedDays: unknown, nowMs: number): {
+    readonly days: number;
+    readonly expiresAt: string;
+};
+/**
+ * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
+ * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
+ * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
+ * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
+ * bounds the swap's `fromAmount` on-chain).
+ */
+export declare const MODEL_B_PER_SWAP_CAP_USD: 5000;
+export interface ModelBInputToken {
+    readonly symbol: string;
+    readonly address: Address;
+    readonly decimals: number;
+    /** Atomic units per one USD — exact for a USD stablecoin; anything else needs a ruled reference price. */
+    readonly atomicPerUsd: bigint;
+}
+export declare const BASE_USDC: Address;
+/**
+ * The input tokens a delegated swap may spend, v1: USDC only — the one token whose USD cap is exact.
+ * WETH (or any volatile input) needs a Founder-ruled reference price before it can carry a USD cap.
+ */
+export declare const MODEL_B_INPUT_TOKENS_V1: readonly ModelBInputToken[];
+export declare function modelBInputToken(token: Address): ModelBInputToken | undefined;
+/** The cap in the token's atomic units. */
+export declare function modelBPerSwapCapAtomic(token: ModelBInputToken, capUsd?: number): bigint;
+/** The two GenericSwapV3 ERC20→ERC20 entry points a same-chain swap plan may call. */
+export declare const GENERIC_SWAP_V3_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "swapTokensSingleV3ERC20ToERC20";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "_transactionId";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "_integrator";
+        readonly type: "string";
+    }, {
+        readonly name: "_referrer";
+        readonly type: "string";
+    }, {
+        readonly name: "_receiver";
+        readonly type: "address";
+    }, {
+        readonly name: "_minAmount";
+        readonly type: "uint256";
+    }, {
+        readonly name: "_swapData";
+        readonly type: "tuple";
+        readonly components: readonly [{
+            readonly name: "callTo";
+            readonly type: "address";
+        }, {
+            readonly name: "approveTo";
+            readonly type: "address";
+        }, {
+            readonly name: "sendingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "receivingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "fromAmount";
+            readonly type: "uint256";
+        }, {
+            readonly name: "callData";
+            readonly type: "bytes";
+        }, {
+            readonly name: "requiresDeposit";
+            readonly type: "bool";
+        }];
+    }];
+    readonly outputs: readonly [];
+}, {
+    readonly type: "function";
+    readonly name: "swapTokensMultipleV3ERC20ToERC20";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "_transactionId";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "_integrator";
+        readonly type: "string";
+    }, {
+        readonly name: "_referrer";
+        readonly type: "string";
+    }, {
+        readonly name: "_receiver";
+        readonly type: "address";
+    }, {
+        readonly name: "_minAmount";
+        readonly type: "uint256";
+    }, {
+        readonly name: "_swapData";
+        readonly type: "tuple[]";
+        readonly components: readonly [{
+            readonly name: "callTo";
+            readonly type: "address";
+        }, {
+            readonly name: "approveTo";
+            readonly type: "address";
+        }, {
+            readonly name: "sendingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "receivingAssetId";
+            readonly type: "address";
+        }, {
+            readonly name: "fromAmount";
+            readonly type: "uint256";
+        }, {
+            readonly name: "callData";
+            readonly type: "bytes";
+        }, {
+            readonly name: "requiresDeposit";
+            readonly type: "bool";
+        }];
+    }];
+    readonly outputs: readonly [];
+}];
+/** The rule dialect this fence emits — structurally the SDK's `sendEndUserEvmTransaction` rule. */
+export interface DelegationPolicyParamCondition {
+    readonly name: string;
+    readonly operator: 'in' | '<=' | '>=';
+    readonly value?: string;
+    readonly values?: readonly string[];
+}
+export interface DelegationPolicyDataCondition {
+    readonly function: string;
+    readonly params?: readonly DelegationPolicyParamCondition[];
+}
+export type DelegationPolicyCriterion = {
+    readonly type: 'evmNetwork';
+    readonly networks: readonly string[];
+    readonly operator: 'in';
+} | {
+    readonly type: 'evmAddress';
+    readonly addresses: readonly string[];
+    readonly operator: 'in';
+} | {
+    readonly type: 'ethValue';
+    readonly ethValue: string;
+    readonly operator: '<=';
+} | {
+    readonly type: 'evmData';
+    readonly abi: 'erc20' | typeof GENERIC_SWAP_V3_ABI;
+    readonly conditions: readonly DelegationPolicyDataCondition[];
+};
+export interface DelegationPolicyRule {
+    readonly action: 'accept';
+    readonly operation: 'sendEndUserEvmTransaction';
+    readonly criteria: readonly DelegationPolicyCriterion[];
+}
+/** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
+export declare function modelBProjectPolicyRules(capUsd?: number): readonly DelegationPolicyRule[];
+/** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
+export declare function modelBProjectPolicyBody(): {
+    readonly scope: 'project';
+    readonly description: string;
+    readonly rules: readonly DelegationPolicyRule[];
+};
+/** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
+export declare function policyRulesDigest(rules: unknown): string;
+export declare const MODEL_B_POLICY_DIGEST_V1: string;
+/** What the server reads back from `cdp.policies.listPolicies({ scope: 'project' })`, structurally. */
+export interface DelegationPolicyRecord {
+    readonly id: string;
+    readonly description?: string;
+    readonly scope: string;
+    readonly rules: unknown;
+}
+export type ModelBFenceReadBack = {
+    readonly present: true;
+    readonly id: string;
+    readonly rulesDigest: string;
+} | {
+    readonly present: false;
+    readonly reason: 'absent' | 'ambiguous' | 'name_mismatch' | 'digest_mismatch';
+    readonly detail: string;
+};
+/**
+ * The fence check the delegated-send path runs BEFORE any send: EXACTLY ONE project-scope policy reads back
+ * (Coinbase allows one; more is an anomalous snapshot and never blessed on the strength of "one of them
+ * matches"), it carries the versioned name, and its rules digest to exactly the v1 rules. Anything else is
+ * "absent" — including a policy of the right name whose rules drifted.
+ */
+export declare function readBackModelBFence(policies: readonly DelegationPolicyRecord[]): ModelBFenceReadBack;
+/**
+ * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
+ * engine would refuse is refused here without spending an allowance reset on it.
+ */
+export declare function assertWithinModelBFence(plan: {
+    readonly token: Address;
+    readonly spender: Address;
+    readonly gross: bigint;
+}, capUsd?: number, inputTokens?: readonly ModelBInputToken[]): {
+    readonly token: ModelBInputToken;
+    readonly capAtomic: bigint;
+};