otto-intel-mcp 0.1.0

package/dist/execution-delegation-policy.js

@@ -0,0 +1,279 @@
+/**
+ * execution-delegation-policy.ts — the product's CDP project policy that fences the delegated leg
+ * (Model B, browser plane; seat ruling D9 = α+, 2026-08-29).
+ *
+ * WHAT THE ENGINE FENCES, AND WHAT IT CANNOT. Coinbase's policy engine offers END-USER accounts exactly
+ * one fence: the project-scope policy ("Only one project-level policy can exist at any time"; account-
+ * scoped policies attach only to developer-owned accounts, and no rule can refer to "the sender's own
+ * address"). So this policy is a SHAPE fence with constant caps, shared by every delegated user:
+ *   - approve: only on an allow-listed input token, only to the reviewed LI.FI diamond, only up to the
+ *     per-swap cap (5,000 USD, Founder word 2026-08-29) in that token's atomic units — a bound on ONE
+ *     swap, not a daily or total limit (zero stays allowed for the allowance clear);
+ *   - call: only the LI.FI diamond, zero native value, only the two GenericSwapV3 ERC20→ERC20 entry points.
+ * The approve cap is what bounds the swap's notional on-chain: the diamond can only pull what is
+ * approved. Everything else — that `_receiver` is the end user, that `_minAmount` is at least the
+ * caller's floor, that the fee leg is the ruled attribution — is Otto's SERVER-SIDE 13-check verifier on
+ * every call (`adapter/verify.ts`), run with the end user's address as the server reads it from CDP.
+ *
+ * THE RESIDUAL, STATED PLAINLY (also in the PR body and in the consent copy the user reads):
+ *   Coinbase's engine limits Otto to swaps through LI.FI up to the per-swap cap; Otto's own server checks
+ *   where the output goes; the user can revoke at any time. The engine does NOT bind the receiver — a
+ *   compromised Otto server could re-point `_receiver` inside a diamond swap; that residual is bounded by
+ *   the per-swap cap, the grant's expiry and the user's revoke, not by the engine.
+ *
+ * IDENTITY OF THE FENCE (seat ruling D6): the policy is matched by its versioned DESCRIPTION and checked
+ * by a digest over its canonical rules on every read-back — never by a policy id in env (a re-created
+ * policy silently changes id; a renamed one silently changes shape; the digest catches both). The
+ * canonical form lowercases hex strings and sorts object keys, nothing else; if the engine ever
+ * augments rules on read-back, `canonical()` is the one place to teach it.
+ *
+ * Description obeys the SDK's regex (`/^[A-Za-z0-9 ,.]{1,50}$/`): no hyphens, no parentheses.
+ */
+import { createHash } from 'node:crypto';
+import { getAddress } from 'viem';
+import { refuse } from './execution-errors.js';
+import { LIFI_DIAMOND_ADDRESS } from './execution-config.js';
+/**
+ * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
+ * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
+ * in place only when N ≤ this binary's version; a newer N is never downgraded; anything that does not match —
+ * the prefix in the middle, a suffix, no description — is foreign and is never touched.
+ */
+export const MODEL_B_POLICY_LINEAGE_PREFIX = 'OTTO model b swap fence';
+/** This binary's fence version. Bump it whenever the rules change shape or caps. */
+export const MODEL_B_POLICY_VERSION = 1;
+/** The versioned match key. */
+export const MODEL_B_POLICY_NAME_V1 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v${MODEL_B_POLICY_VERSION}`;
+const MODEL_B_LINEAGE_PATTERN = new RegExp(`^${MODEL_B_POLICY_LINEAGE_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')} v(\\d+)$`);
+/** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
+export function modelBLineageVersion(description) {
+    if (typeof description !== 'string')
+        return undefined;
+    const match = MODEL_B_LINEAGE_PATTERN.exec(description);
+    return match ? Number(match[1]) : undefined;
+}
+export const MODEL_B_POLICY_NETWORK = 'base';
+export const MODEL_B_CHAIN_ID = 8453;
+/**
+ * Delegation expiry bounds (Founder word `expiry 90/180`, 2026-08-29): the mint page defaults to 90 days
+ * and refuses anything past 180; the server routes enforce the same numbers. Coinbase documents no
+ * maximum of its own for `expiresAt` (SDK types + vendor doc read 2026-08-29); the first 180-day mint
+ * at the sitting is the live confirmation.
+ */
+export const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS = 90;
+export const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS = 180;
+/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+export function boundedDelegationExpiry(requestedDays, nowMs) {
+    const days = requestedDays === undefined || requestedDays === null
+        ? MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS
+        : Number(requestedDays);
+    if (!Number.isInteger(days) || days < 1 || days > MODEL_B_DELEGATION_EXPIRY_MAX_DAYS) {
+        throw new Error(`delegation expiry must be a whole number of days between 1 and ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}`);
+    }
+    return Object.freeze({ days, expiresAt: new Date(nowMs + days * 86_400_000).toISOString() });
+}
+/**
+ * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
+ * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
+ * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
+ * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
+ * bounds the swap's `fromAmount` on-chain).
+ */
+export const MODEL_B_PER_SWAP_CAP_USD = 5000;
+export const BASE_USDC = getAddress('0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913');
+/**
+ * The input tokens a delegated swap may spend, v1: USDC only — the one token whose USD cap is exact.
+ * WETH (or any volatile input) needs a Founder-ruled reference price before it can carry a USD cap.
+ */
+export const MODEL_B_INPUT_TOKENS_V1 = Object.freeze([
+    Object.freeze({ symbol: 'USDC', address: BASE_USDC, decimals: 6, atomicPerUsd: 1000000n }),
+]);
+export function modelBInputToken(token) {
+    const target = getAddress(token);
+    return MODEL_B_INPUT_TOKENS_V1.find((entry) => entry.address === target);
+}
+/** The cap in the token's atomic units. */
+export function modelBPerSwapCapAtomic(token, capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+    if (!Number.isSafeInteger(capUsd) || capUsd <= 0)
+        throw new Error('per-swap cap must be a positive integer USD amount');
+    return BigInt(capUsd) * token.atomicPerUsd;
+}
+/** LibSwap.SwapData tuple, as the GenericSwapV3 facet declares it. */
+const SWAP_DATA_COMPONENTS = [
+    { name: 'callTo', type: 'address' },
+    { name: 'approveTo', type: 'address' },
+    { name: 'sendingAssetId', type: 'address' },
+    { name: 'receivingAssetId', type: 'address' },
+    { name: 'fromAmount', type: 'uint256' },
+    { name: 'callData', type: 'bytes' },
+    { name: 'requiresDeposit', type: 'bool' },
+];
+/** The two GenericSwapV3 ERC20→ERC20 entry points a same-chain swap plan may call. */
+export const GENERIC_SWAP_V3_ABI = [
+    {
+        type: 'function',
+        name: 'swapTokensSingleV3ERC20ToERC20',
+        stateMutability: 'nonpayable',
+        inputs: [
+            { name: '_transactionId', type: 'bytes32' },
+            { name: '_integrator', type: 'string' },
+            { name: '_referrer', type: 'string' },
+            { name: '_receiver', type: 'address' },
+            { name: '_minAmount', type: 'uint256' },
+            { name: '_swapData', type: 'tuple', components: SWAP_DATA_COMPONENTS },
+        ],
+        outputs: [],
+    },
+    {
+        type: 'function',
+        name: 'swapTokensMultipleV3ERC20ToERC20',
+        stateMutability: 'nonpayable',
+        inputs: [
+            { name: '_transactionId', type: 'bytes32' },
+            { name: '_integrator', type: 'string' },
+            { name: '_referrer', type: 'string' },
+            { name: '_receiver', type: 'address' },
+            { name: '_minAmount', type: 'uint256' },
+            { name: '_swapData', type: 'tuple[]', components: SWAP_DATA_COMPONENTS },
+        ],
+        outputs: [],
+    },
+];
+/** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
+export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+    const approveRules = MODEL_B_INPUT_TOKENS_V1.map((token) => ({
+        action: 'accept',
+        operation: 'sendEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmNetwork', networks: [MODEL_B_POLICY_NETWORK], operator: 'in' },
+            { type: 'evmAddress', addresses: [token.address], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: 'erc20',
+                conditions: [
+                    {
+                        function: 'approve',
+                        params: [
+                            { name: 'spender', operator: 'in', values: [LIFI_DIAMOND_ADDRESS] },
+                            {
+                                name: 'value',
+                                operator: '<=',
+                                value: modelBPerSwapCapAtomic(token, capUsd).toString(),
+                            },
+                        ],
+                    },
+                ],
+            },
+        ],
+    }));
+    const routerRule = {
+        action: 'accept',
+        operation: 'sendEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmNetwork', networks: [MODEL_B_POLICY_NETWORK], operator: 'in' },
+            { type: 'evmAddress', addresses: [LIFI_DIAMOND_ADDRESS], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: GENERIC_SWAP_V3_ABI,
+                conditions: [
+                    { function: 'swapTokensSingleV3ERC20ToERC20' },
+                    { function: 'swapTokensMultipleV3ERC20ToERC20' },
+                ],
+            },
+        ],
+    };
+    return Object.freeze([...approveRules, routerRule]);
+}
+/** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
+export function modelBProjectPolicyBody() {
+    return Object.freeze({
+        scope: 'project',
+        description: MODEL_B_POLICY_NAME_V1,
+        rules: modelBProjectPolicyRules(),
+    });
+}
+/** Sorted keys, undefined dropped, hex strings lowercased; arrays keep their order. Nothing else. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const item = value[key];
+            if (item !== undefined)
+                out[key] = canonical(item);
+        }
+        return out;
+    }
+    if (typeof value === 'string' && /^0x[0-9a-fA-F]+$/.test(value))
+        return value.toLowerCase();
+    return value;
+}
+/** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
+export function policyRulesDigest(rules) {
+    return createHash('sha256')
+        .update(JSON.stringify(canonical(rules)))
+        .digest('hex');
+}
+export const MODEL_B_POLICY_DIGEST_V1 = policyRulesDigest(modelBProjectPolicyRules());
+/**
+ * The fence check the delegated-send path runs BEFORE any send: EXACTLY ONE project-scope policy reads back
+ * (Coinbase allows one; more is an anomalous snapshot and never blessed on the strength of "one of them
+ * matches"), it carries the versioned name, and its rules digest to exactly the v1 rules. Anything else is
+ * "absent" — including a policy of the right name whose rules drifted.
+ */
+export function readBackModelBFence(policies) {
+    const project = policies.filter((policy) => policy.scope === 'project');
+    if (project.length === 0)
+        return {
+            present: false,
+            reason: 'absent',
+            detail: 'the project holds no project-scope policy',
+        };
+    if (project.length > 1) {
+        return {
+            present: false,
+            reason: 'ambiguous',
+            detail: `${project.length} project-scope policies read back where Coinbase allows one`,
+        };
+    }
+    const named = project[0];
+    if (named.description !== MODEL_B_POLICY_NAME_V1) {
+        return {
+            present: false,
+            reason: 'name_mismatch',
+            detail: `the project policy is not "${MODEL_B_POLICY_NAME_V1}"`,
+        };
+    }
+    const rulesDigest = policyRulesDigest(named.rules);
+    if (rulesDigest !== MODEL_B_POLICY_DIGEST_V1) {
+        return {
+            present: false,
+            reason: 'digest_mismatch',
+            detail: `the project policy "${MODEL_B_POLICY_NAME_V1}" carries rules that do not digest to v1 (${rulesDigest.slice(0, 16)}… ≠ ${MODEL_B_POLICY_DIGEST_V1.slice(0, 16)}…)`,
+        };
+    }
+    return { present: true, id: named.id, rulesDigest };
+}
+/**
+ * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
+ * engine would refuse is refused here without spending an allowance reset on it.
+ */
+export function assertWithinModelBFence(plan, capUsd = MODEL_B_PER_SWAP_CAP_USD, inputTokens = MODEL_B_INPUT_TOKENS_V1) {
+    const target = getAddress(plan.token);
+    const token = inputTokens.find((entry) => entry.address === target);
+    if (!token) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `input token ${plan.token} is not an allow-listed delegated input (${inputTokens.map((t) => t.symbol).join(', ') || 'none'})`);
+    }
+    if (getAddress(plan.spender) !== LIFI_DIAMOND_ADDRESS) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `approval spender ${plan.spender} is not the reviewed LI.FI diamond`);
+    }
+    const capAtomic = modelBPerSwapCapAtomic(token, capUsd);
+    if (plan.gross > capAtomic) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `gross ${plan.gross} ${token.symbol} atomic exceeds the per-swap cap ${capAtomic} (${capUsd} USD)`);
+    }
+    return { token, capAtomic };
+}
+//# sourceMappingURL=execution-delegation-policy.js.map

package/dist/execution-delegation.d.ts

@@ -0,0 +1,190 @@
+/**
+ * execution-delegation.ts — the delegated-send path on the hosted MCP (Model B, browser plane, PR-1).
+ *
+ * The human minted a time-boxed CDP delegation in a browser (PR-2); this is what Otto's server does for
+ * that human's agent, headlessly. It holds Otto's developer-side CDP access (never a user key), and it
+ * submits ONLY a plan the user-side verifier accepts for THIS end user, under a fence that is READ BACK
+ * before any authority is exercised. Order per call, as a server invariant:
+ *
+ *   0. caller authentication — the per-request header, compared in constant time, BEFORE anything is
+ *      parsed or read (a wrong caller learns nothing and causes no CDP read);
+ *   1. the artifact was PREPARED BY THIS PROCESS (`prepared-artifacts.ts`) — else refuse; then the
+ *      per-artifact idempotency record (sent → replayed, halted → never retried), then one delegated
+ *      plan at a time per end user (the rig lock serialises revocation, not sends);
+ *   2. FENCE: the project policy is present, named and digests to v1 — else refuse;
+ *   3. GRANT: the user's delegation reads back active past the envelope's own expiry — else refuse;
+ *   4. ACCOUNT: the address the caller prepared for is one of THIS end user's CDP accounts, as CDP reports
+ *      them — never an address the caller binds on its own (a Dynamic-connected address is never a CDP
+ *      end-user address by construction);
+ *   5. VERIFY: the 13-check verifier over the envelope, for exactly the request that produced it, with the
+ *      server-confirmed address; then the fence's own bound (allow-listed token, reviewed spender, cap);
+ *   6. SEND: `CdpDelegatedSigner.sendPlan` — sealed receipts, halt clears the allowance, fail-closed once
+ *      revocation was requested.
+ *
+ * Nothing here logs the header, the secret, or a credential. Refusals are machine-readable codes; upstream
+ * error bodies are never relayed.
+ */
+import { type Address, type PublicClient } from 'viem';
+import type { SealedWaitOptions } from './adapter/chain.js';
+import { DelegatedPlanHaltedError, type CdpDeveloperCredentials, type CdpRig, type DelegatedHaltCause } from './adapter/cdp-signer.js';
+import { type DelegatedSendResult } from './execution-delegated-definition.js';
+import { type DelegationPolicyRecord, type ModelBInputToken } from './execution-delegation-policy.js';
+import { ExecutionRefusal } from './execution-errors.js';
+import type { ExecutionToolRuntime } from './execution-tools.js';
+export declare const DELEGATION_ENV_NAMES: readonly ["CDP_API_KEY_ID", "CDP_API_KEY_SECRET", "CDP_WALLET_SECRET", "OTTO_DELEGATION_SERVER_SECRET", "BASE_RPC_URL"];
+/** The public CDP project id the fence-status tool publishes (a UUID; PUBLIC, never a secret). */
+export declare const PUBLIC_PROJECT_ID_ENV_NAME: "OTTO_CDP_PROJECT_ID";
+export interface DelegationEnv {
+    readonly credentials: CdpDeveloperCredentials;
+    readonly serverSecret: string;
+    readonly rpcUrl: string;
+    /** Otto's PUBLIC CDP project id (a UUID), when `OTTO_CDP_PROJECT_ID` is set; else undefined. */
+    readonly publicProjectId?: string;
+}
+/**
+ * All five absent → the delegated tool does not exist (same shape as the OTTO_EXECUTION_MCP_ENABLED
+ * switch). Any present but not all → boot refuses, naming the MISSING variables (never a value).
+ */
+export declare function loadDelegationEnv(env?: NodeJS.ProcessEnv): DelegationEnv | undefined;
+export interface DelegationEndUserRecord {
+    readonly userId: string;
+    readonly evmAddresses: readonly Address[];
+}
+/** What the delegated-send path needs from CDP beyond the fenced signer rig: the fence and the user. */
+export interface DelegationRig {
+    /** The fenced rig `CdpDelegatedSigner` runs over (reads + revocation; no raw submission surface). */
+    readonly rig: CdpRig;
+    listProjectPolicies(): Promise<readonly DelegationPolicyRecord[]>;
+    /** `undefined` when CDP has no such end user. */
+    readEndUser(userId: string): Promise<DelegationEndUserRecord | undefined>;
+    /** Create THE project-scope policy (Coinbase allows one); returns its id. Only the fence tool calls this. */
+    createProjectPolicy(body: DelegationProjectPolicyBody): Promise<string>;
+    /** Update an existing project-scope policy in place (description + rules). Only the fence tool calls this. */
+    updateProjectPolicy(id: string, body: DelegationProjectPolicyBody): Promise<void>;
+    /** One policy by id, as CDP reports it now; `undefined` when it no longer exists. The fence tool's pre-write re-read. */
+    readProjectPolicy(id: string): Promise<DelegationPolicyRecord | undefined>;
+    /** The end user a CDP access token resolves to, or `undefined` when the token is not accepted. Never logged. */
+    validateAccessToken(accessToken: string): Promise<DelegationEndUserRecord | undefined>;
+}
+export interface DelegationProjectPolicyBody {
+    readonly scope: 'project';
+    readonly description: string;
+    readonly rules: unknown;
+}
+/** The subset of `CdpClient` the delegated-send path touches — structural, so no SDK import is needed to type it. */
+export interface DelegationCdpClient {
+    readonly endUser: {
+        getEndUser(options: {
+            userId: string;
+        }): Promise<{
+            readonly userId: string;
+            readonly evmAccounts?: readonly string[];
+            readonly evmAccountObjects?: readonly {
+                readonly address: string;
+            }[];
+        }>;
+        getDelegationForEndUser(options: {
+            userId: string;
+        }): Promise<{
+            readonly expiresAt: string;
+        }>;
+        revokeDelegationForEndUser(options: {
+            userId: string;
+        }): Promise<void>;
+        validateAccessToken(options: {
+            accessToken: string;
+        }): Promise<{
+            readonly userId: string;
+            readonly evmAccounts?: readonly string[];
+            readonly evmAccountObjects?: readonly {
+                readonly address: string;
+            }[];
+        }>;
+        sendEvmTransaction(options: {
+            userId: string;
+            address: string;
+            transaction: `0x${string}`;
+            network: 'base';
+        }): Promise<{
+            readonly transactionHash: string;
+        }>;
+    };
+    readonly policies: {
+        listPolicies(options: {
+            scope: 'project';
+        }): Promise<{
+            readonly policies?: readonly DelegationPolicyRecord[];
+        }>;
+        createPolicy(options: {
+            policy: DelegationProjectPolicyBody;
+        }): Promise<{
+            readonly id: string;
+        }>;
+        updatePolicy(options: {
+            id: string;
+            policy: {
+                readonly description: string;
+                readonly rules: unknown;
+            };
+        }): Promise<unknown>;
+        getPolicyById(options: {
+            id: string;
+        }): Promise<DelegationPolicyRecord>;
+        /** Declared so a mock can PROVE it is never called; this service never invokes it. */
+        deletePolicy?(options: {
+            id: string;
+        }): Promise<void>;
+    };
+}
+/** Build the delegation rig over a CDP client (real or structural mock) and a Base public client. */
+export declare function createDelegationRig(cdp: DelegationCdpClient, pub: PublicClient): DelegationRig;
+export interface DelegationServices {
+    readonly rig: DelegationRig;
+    /** The server-to-server secret the caller must present in `x-otto-delegation-auth`. Never logged. */
+    readonly serverSecret: string;
+    /** Otto's PUBLIC CDP project id (a UUID) the fence-status tool publishes; undefined disables that tool. */
+    readonly publicProjectId?: string;
+    readonly sealedWait?: SealedWaitOptions;
+    /**
+     * Test-only injection of the server-side fence bound (the cap / the input allow-list), so a test can
+     * prove the tool CALLS the bound with a plan the fixtures can build — an assertion no test can redden is
+     * indistinguishable from an absent one. Production boot (`createDelegationServicesFromEnv`) never sets
+     * it; the engine's installed policy is the v1 constant either way.
+     */
+    readonly fenceBound?: {
+        readonly perSwapCapUsd?: number;
+        readonly inputTokens?: readonly ModelBInputToken[];
+    };
+}
+export interface DelegationCaller {
+    /** The header value as presented, or undefined when absent. Never logged. */
+    readonly presentedSecret?: string;
+}
+/** Pull the caller's presented secret out of the MCP request headers (case-insensitive, first value). */
+export declare function callerFromHeaders(headers: Readonly<Record<string, string | string[] | undefined>> | undefined): DelegationCaller;
+/**
+ * The caller check EVERY delegation tool runs first — constant-time, before parsing or any CDP read. One
+ * seam for the send tool and the admin tools (`execution-delegation-admin.ts`).
+ */
+export declare function assertDelegationCaller(services: DelegationServices, caller: DelegationCaller): void;
+/**
+ * The cause class of a halt: the signer's STRUCTURED `cause` only (set from the CDP `errorType`, an error's
+ * class or the receipt status at the signer's catch sites). The message text — which embeds upstream
+ * text — is never consulted, so upstream text can neither leak nor select the class.
+ */
+export declare function haltCause(error: DelegatedPlanHaltedError): DelegatedHaltCause;
+/** Map a verifier / signer failure to the tool's refusal taxonomy; anything else is rethrown. */
+export declare function toDelegationRefusal(error: unknown): ExecutionRefusal | undefined;
+/**
+ * Submit a prepared swap under the end user's delegation — the order in the file header is the contract.
+ * `caller` is derived from the request headers by the registration layer; it never comes from arguments.
+ */
+export declare function submitUnderDelegation(runtime: ExecutionToolRuntime, rawInput: unknown, caller: DelegationCaller, _signal?: AbortSignal): Promise<DelegatedSendResult>;
+/**
+ * Open the delegation services from a loaded environment: the SDK client over Otto's developer
+ * credentials, a Base public client whose chain id is checked once at boot, and the fenced rig.
+ * Nothing here reads a policy, a grant or a user — every call does that itself, in order.
+ */
+export declare function openDelegationServicesFromEnv(env: DelegationEnv): Promise<DelegationServices>;
+/** `loadDelegationEnv` + `openDelegationServicesFromEnv`; undefined when the five variables are all absent. */
+export declare function createDelegationServicesFromEnv(env?: NodeJS.ProcessEnv): Promise<DelegationServices | undefined>;