otto-intel-mcp 0.1.2 → 0.1.4

package/dist/execution-delegation-operations.js

@@ -0,0 +1,282 @@
+import { decodeFunctionData, getAddress, parseTransaction } from 'viem';
+import { assertDelegationCaller } from './execution-delegation.js';
+import { verifyDelegatedStepFinality } from './execution-delegation-finality.js';
+import { DELEGATED_SEND_RESULT_SCHEMA, } from './execution-delegated-definition.js';
+import { confirmedDelegationOperationResult, DELEGATION_OPERATIONS_INPUT_SCHEMA, DELEGATION_OPERATIONS_RESULT_SCHEMA, DELEGATION_RECONCILE_INPUT_SCHEMA, } from './execution-delegation-operations-definition.js';
+import { DELEGATION_OPERATION_JOURNAL_SCHEMA_VERSION, } from './execution-delegation-operation-store.js';
+import { ExecutionWorkerBusyError } from './execution-worker-guard.js';
+import { refuse } from './execution-errors.js';
+/** Treat a structurally valid but internally contradictory store snapshot as corrupt. */
+function coherentSnapshot(userId, snapshot) {
+    if (!snapshot.unresolved && !snapshot.journal.ready)
+        return false;
+    const artifactIds = snapshot.operations.map((operation) => operation.artifactId);
+    if (new Set(artifactIds).size !== artifactIds.length)
+        return false;
+    for (const operation of snapshot.operations) {
+        if (operation.userId !== userId)
+            return false;
+        const stepIndexes = operation.steps.map((step) => step.index);
+        if (new Set(stepIndexes).size !== stepIndexes.length)
+            return false;
+        const hasUnresolvedStep = operation.steps.some((step) => step.state === 'prepared' || step.state === 'submitted' || step.state === 'unknown');
+        if (!snapshot.unresolved &&
+            (operation.state === 'prepared' || operation.state === 'submitted' || operation.state === 'unknown' || hasUnresolvedStep))
+            return false;
+        if (operation.state !== 'confirmed') {
+            if (operation.result !== undefined)
+                return false;
+            if (operation.state === 'failed' && hasUnresolvedStep)
+                return false;
+            continue;
+        }
+        if (!confirmedDelegationOperationResult(operation))
+            return false;
+    }
+    return true;
+}
+function unavailable(userId) {
+    return Object.freeze({
+        user_id: userId,
+        store_available: false,
+        journal: Object.freeze({
+            schema_version: DELEGATION_OPERATION_JOURNAL_SCHEMA_VERSION,
+            ready: false,
+            coverage_started_at: null,
+        }),
+        unresolved: true,
+        operations: [],
+    });
+}
+export async function readDelegationOperations(runtime, rawInput, caller) {
+    const services = runtime.delegation;
+    if (!services)
+        return refuse('DELEGATION_UNAVAILABLE', 'delegation is not configured on this server');
+    // Header first: malformed arguments reveal nothing before the server caller is accepted.
+    assertDelegationCaller(services, caller);
+    const parsed = DELEGATION_OPERATIONS_INPUT_SCHEMA.safeParse(rawInput);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        return refuse('DELEGATION_INPUT_INVALID', `input does not satisfy the operation lookup schema: ${issue ? `${issue.path.join('.') || '(root)'}: ${issue.message}` : 'unknown issue'}`);
+    }
+    const user = await services.rig.validateAccessToken(parsed.data.accessToken);
+    if (!user)
+        return refuse('DELEGATION_TOKEN_INVALID', 'the access token does not resolve to a CDP end user');
+    if (!services.operationStore.available)
+        return unavailable(user.userId);
+    try {
+        const snapshot = await services.operationStore.snapshotForUser(user.userId, parsed.data.artifactId);
+        if (!coherentSnapshot(user.userId, snapshot))
+            return unavailable(user.userId);
+        const result = {
+            user_id: user.userId,
+            store_available: true,
+            journal: {
+                schema_version: snapshot.journal.schemaVersion,
+                ready: snapshot.journal.ready,
+                coverage_started_at: snapshot.journal.coverageStartedAt,
+            },
+            unresolved: snapshot.unresolved,
+            operations: snapshot.operations.map((operation) => {
+                const confirmed = operation.state === 'confirmed'
+                    ? confirmedDelegationOperationResult(operation)
+                    : undefined;
+                return {
+                    artifact_id: operation.artifactId,
+                    account: getAddress(operation.account),
+                    chain_id: operation.chainId,
+                    state: operation.state,
+                    created_at: operation.createdAt,
+                    updated_at: operation.updatedAt,
+                    steps: operation.steps.map((step) => ({
+                        index: step.index,
+                        ...(step.transactionHash ? { transaction_hash: step.transactionHash } : {}),
+                        state: step.state,
+                    })),
+                    ...(confirmed ? { result: confirmed } : {}),
+                };
+            }),
+        };
+        const checked = DELEGATION_OPERATIONS_RESULT_SCHEMA.safeParse(result);
+        return checked.success
+            ? Object.freeze(checked.data)
+            : unavailable(user.userId);
+    }
+    catch {
+        // An unreadable/corrupt store is never presented as an empty safe history.
+        return unavailable(user.userId);
+    }
+}
+const APPROVE_ABI = [
+    {
+        type: 'function', name: 'approve', stateMutability: 'nonpayable',
+        inputs: [{ name: 'spender', type: 'address' }, { name: 'amount', type: 'uint256' }],
+        outputs: [{ name: 'success', type: 'bool' }],
+    },
+    {
+        type: 'function', name: 'allowance', stateMutability: 'view',
+        inputs: [{ name: 'owner', type: 'address' }, { name: 'spender', type: 'address' }],
+        outputs: [{ name: 'allowance', type: 'uint256' }],
+    },
+];
+function hasCompleteDelegatedSuccessShape(operation) {
+    return !(operation.steps.length !== 3 ||
+        operation.steps.some((step, index) => step.index !== index ||
+            step.kind !== ['approve_reset', 'approve', 'call'][index] ||
+            step.state !== 'confirmed' ||
+            step.receipt?.status !== 'success' ||
+            step.receipt.transactionHash.toLowerCase() !== step.transactionHash?.toLowerCase()));
+}
+function recoveredDelegatedSuccess(operation) {
+    if (!operation.recoveryContext || !hasCompleteDelegatedSuccessShape(operation))
+        return undefined;
+    const steps = operation.steps.map((step) => {
+        const transaction = parseTransaction(step.request.transaction);
+        if (!transaction.to || !step.transactionHash || !step.receipt)
+            throw new Error('a confirmed recovery step is incomplete');
+        return {
+            index: step.index,
+            kind: step.kind,
+            to: getAddress(transaction.to),
+            transaction_hash: step.transactionHash,
+            status: 'success',
+            block_number: step.receipt.blockNumber,
+            gas_used: step.receipt.gasUsed,
+        };
+    });
+    const parsed = DELEGATED_SEND_RESULT_SCHEMA.safeParse({ ...operation.recoveryContext, steps });
+    if (!parsed.success)
+        throw new Error('the durable recovery result does not satisfy its output schema');
+    return Object.freeze(parsed.data);
+}
+async function allowanceIsZero(pub, operation) {
+    // The bounded halt clear, when present, is the freshest durable request naming the plan's token and
+    // spender. Otherwise the reset request names them even when it reverted. A failed reset may leave an
+    // allowance that predates this plan, so absence of a confirmed approval is never evidence of zero.
+    // Every non-empty interrupted plan must prove allowance at one exact finalized canonical block before
+    // its unified claim can be released.
+    const reset = operation.steps.find((step) => step.index === 0 && step.kind === 'approve_reset');
+    const clear = operation.steps.find((step) => step.index === 3 && step.kind === 'allowance_clear');
+    const zeroRequest = clear ?? reset;
+    if (!zeroRequest)
+        return false;
+    try {
+        const transaction = parseTransaction(zeroRequest.request.transaction);
+        if (!transaction.to || !transaction.data)
+            return false;
+        const decoded = decodeFunctionData({ abi: APPROVE_ABI, data: transaction.data });
+        if (decoded.functionName !== 'approve')
+            return false;
+        const [spender, amount] = decoded.args;
+        if (amount !== 0n)
+            return false;
+        const finalized = await pub.getBlock({ blockTag: 'finalized' });
+        if (finalized.number === null || finalized.hash === null)
+            return false;
+        const allowance = await pub.readContract({
+            address: getAddress(transaction.to),
+            abi: APPROVE_ABI,
+            functionName: 'allowance',
+            args: [getAddress(operation.account), getAddress(spender)],
+            blockNumber: finalized.number,
+        });
+        const canonical = await pub.getBlock({ blockNumber: finalized.number });
+        return canonical.number === finalized.number &&
+            canonical.hash?.toLowerCase() === finalized.hash.toLowerCase() && allowance === 0n;
+    }
+    catch {
+        return false;
+    }
+}
+/** Known-hash-only recovery. The original worker's fixed guard must be acquirable before any mutation. */
+export async function reconcileDelegationOperation(runtime, rawInput, caller) {
+    const services = runtime.delegation;
+    if (!services)
+        return refuse('DELEGATION_UNAVAILABLE', 'delegation is not configured on this server');
+    assertDelegationCaller(services, caller);
+    const parsed = DELEGATION_RECONCILE_INPUT_SCHEMA.safeParse(rawInput);
+    if (!parsed.success)
+        return refuse('DELEGATION_INPUT_INVALID', 'input does not satisfy the delegated reconcile schema');
+    const user = await services.rig.validateAccessToken(parsed.data.accessToken);
+    if (!user)
+        return refuse('DELEGATION_TOKEN_INVALID', 'the access token does not resolve to a CDP end user');
+    if (!services.operationStore.available || !services.workerGuards?.available)
+        return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the operation journal or worker guard is unavailable');
+    const initial = await services.operationStore.readRecoveryArtifact(parsed.data.artifactId);
+    if (!initial || initial.userId !== user.userId)
+        return refuse('DELEGATION_REPLAY_MISMATCH', 'this delegated operation does not belong to the authenticated end user');
+    if (initial.state === 'confirmed' || initial.state === 'failed')
+        return readDelegationOperations(runtime, parsed.data, caller);
+    let guard;
+    try {
+        guard = await services.workerGuards.acquire('delegated', parsed.data.artifactId);
+    }
+    catch (error) {
+        return error instanceof ExecutionWorkerBusyError
+            ? refuse('DELEGATION_OPERATION_UNRESOLVED', 'the original delegated worker is still active')
+            : refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the permanent delegated worker guard is missing or corrupt');
+    }
+    try {
+        // Re-read after acquiring the liveness proof. A late terminal journal write wins and needs no recovery.
+        let operation = await services.operationStore.readRecoveryArtifact(parsed.data.artifactId);
+        if (!operation || operation.userId !== user.userId)
+            return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the delegated operation changed while acquiring recovery ownership');
+        if (operation.state === 'confirmed' || operation.state === 'failed')
+            return readDelegationOperations(runtime, parsed.data, caller);
+        const binding = {
+            artifactId: operation.artifactId,
+            userId: operation.userId,
+            account: operation.account,
+            chainId: operation.chainId,
+            fingerprint: operation.fingerprint,
+        };
+        const verifiedReceiptSteps = new Set();
+        for (const step of operation.steps) {
+            const reconciled = await verifyDelegatedStepFinality(services.rig.rig.pub, operation, step);
+            if (reconciled.outcome === 'unverified')
+                continue;
+            if (step.receipt)
+                verifiedReceiptSteps.add(step.index);
+            if (reconciled.outcome === 'seal') {
+                await services.operationStore.markStepReceipt(binding, step.index, step.idempotencyKey, reconciled.receipt, runtime.nowMs());
+                verifiedReceiptSteps.add(step.index);
+                operation = (await services.operationStore.readRecoveryArtifact(operation.artifactId));
+            }
+        }
+        const unresolved = operation.steps.some((step) => step.state === 'prepared' || step.state === 'submitted' || step.state === 'unknown');
+        if (operation.steps.length === 0) {
+            // The permanent guard proves the original worker is gone; no durable step means the journal's
+            // required pre-handoff write never happened, so zero CDP requests were possible.
+            if (operation.state !== 'prepared')
+                return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'a zero-step delegated operation has an impossible aggregate state; its claim remains unresolved');
+            await services.operationStore.finalizeFailure(binding, 'DELEGATED_PLAN_NOT_SUBMITTED_RECONCILED', runtime.nowMs());
+        }
+        else if (!unresolved &&
+            operation.steps.every((step) => !step.receipt || verifiedReceiptSteps.has(step.index))) {
+            const completeSuccess = hasCompleteDelegatedSuccessShape(operation);
+            // A complete economic success can never fall through to the partial-plan allowance rule. A
+            // pre-context worker lacks the static result fields needed to reconstruct its response, so the
+            // exact safe classification is unresolved until an operator resolves it from external evidence.
+            if (completeSuccess && !operation.recoveryContext)
+                return readDelegationOperations(runtime, parsed.data, caller);
+            let recovered;
+            try {
+                recovered = recoveredDelegatedSuccess(operation);
+            }
+            catch {
+                return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the durable delegated result context cannot reconstruct the canonical success receipt');
+            }
+            if (recovered) {
+                await services.operationStore.finalizeSuccess(binding, recovered, runtime.nowMs());
+            }
+            else if (!completeSuccess && operation.recoveryContext && await allowanceIsZero(services.rig.rig.pub, operation)) {
+                await services.operationStore.finalizeFailure(binding, 'DELEGATED_PLAN_INTERRUPTED_RECONCILED', runtime.nowMs());
+            }
+        }
+        return readDelegationOperations(runtime, parsed.data, caller);
+    }
+    finally {
+        guard.release();
+    }
+}
+//# sourceMappingURL=execution-delegation-operations.js.map

package/dist/execution-delegation-policy.d.ts

@@ -30,6 +30,7 @@
  * Description obeys the SDK's regex (`/^[A-Za-z0-9 ,.]{1,50}$/`): no hyphens, no parentheses.
  */
 import { type Address } from 'viem';
+export { policyRulesDigest } from './execution-policy-compatibility.js';
 /**
  * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
  * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
@@ -37,10 +38,30 @@ import { type Address } from 'viem';
  * the prefix in the middle, a suffix, no description — is foreign and is never touched.
  */
 export declare const MODEL_B_POLICY_LINEAGE_PREFIX = "OTTO model b swap fence";
-/** This binary's fence version. Bump it whenever the rules change shape or caps. */
-export declare const MODEL_B_POLICY_VERSION: 1;
-/** The versioned match key. */
-export declare const MODEL_B_POLICY_NAME_V1: string;
+/**
+ * This binary's fence version. Bump it whenever the rules change shape or caps.
+ *
+ * 🔴 v2 (Founder word `fence v2`, pending — Yield Copilot withdraw, 2026-09-03). v2 ADDS to v1: an approve
+ * rule per registry Morpho share token (spender = the diamond only, bounded by
+ * `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`) so a delegated vault WITHDRAW can route shares → USDC through the
+ * same fenced GenericSwapV3 entry, and a sign-only accept rule for a USDC `transfer` (see
+ * `modelBProjectPolicyRules`). The router rule is UNCHANGED and still carries no receiver condition — that
+ * is the person's only way to move value out of an Otto/CDP wallet today (ws-7, 2026-09-03), and the
+ * receiver pin lives in Otto's delegated verifier.
+ *
+ * TRANSITION: a v2 binary ACCEPTS a v1 fence (swaps and deposits keep working; a withdraw under v1 is
+ * refused by name) and the fence tool upgrades v1 → v2 in place only when it is run — deploying this code
+ * writes nothing to the CDP project.
+ */
+export declare const MODEL_B_POLICY_VERSION: 2;
+/** The v1 match key — the fence every permission before `fence v2` was minted under; still accepted for swaps and deposits. */
+export declare const MODEL_B_POLICY_NAME_V1: "OTTO model b swap fence v1";
+/** The v2 match key — what the fence tool writes; the only fence that admits a delegated Yield Copilot withdraw. */
+export declare const MODEL_B_POLICY_NAME_V2: string;
+/** The CURRENT match key (v2). */
+export declare const MODEL_B_POLICY_NAME: string;
+/** Every lineage version this binary accepts on read-back, oldest first. */
+export declare const MODEL_B_POLICY_ACCEPTED_VERSIONS: readonly (1 | 2)[];
 /** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
 export declare function modelBLineageVersion(description: unknown): number | undefined;
 export declare const MODEL_B_POLICY_NETWORK: "base";
@@ -53,19 +74,63 @@ export declare const MODEL_B_CHAIN_ID: 8453;
  */
 export declare const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS: 90;
 export declare const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS: 180;
-/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+/**
+ * The floor `boundedDelegationExpiry` has always enforced, NAMED — it was a literal `1` inside the bound,
+ * so the reserve schema could not state the range it accepts without hand-copying the number, and a
+ * hand-copied bound is a bound that drifts. Mirrors `MODEL_B_DELEGATION_EXPIRY_MIN_DAYS` in the dApp.
+ */
+export declare const MODEL_B_DELEGATION_EXPIRY_MIN_DAYS: 1;
+/**
+ * A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint.
+ *
+ * 🔴 THE RESULT LANDS ON A WHOLE SECOND (round 3). CDP stores `expiresAt` at whole-second granularity and
+ * truncates milliseconds toward zero — verified live on the dev project 2026-09-02 (`…:46.137Z` came back
+ * as `…:46Z` from `createDelegation` AND from `getDelegationForEndUser`; `…:45.999Z` came back as
+ * `…:45Z`, so it truncates rather than rounds). Everything downstream — the reservation, the durable row
+ * and every enforcement read — keys on that second, so the bound produces it directly rather than leaving
+ * a millisecond remainder for one of them to drop and another to keep.
+ */
 export declare function boundedDelegationExpiry(requestedDays: unknown, nowMs: number): {
     readonly days: number;
     readonly expiresAt: string;
 };
+/**
+ * The mint-expiry helpers live with the store that owns the reserved second; re-exported here because
+ * this is the module every consumer of the Model-B numbers already imports.
+ */
+export { MINT_EXPIRY_FILLER_MS as MODEL_B_MINT_EXPIRY_FILLER_MS } from './execution-delegation-cap-store.js';
+export { mintExpiryForSecond as mintExpiryFor } from './execution-delegation-cap-store.js';
+export { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
 /**
  * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
  * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
  * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
  * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
  * bounds the swap's `fromAmount` on-chain).
+ *
+ * 🔴 THIS IS THE CEILING, SHARED BY EVERY DELEGATED USER — NOT ANY ONE PERSON'S CAP (Founder word
+ * `delegate cap choice`, 2026-09-02). Coinbase's engine offers end-user accounts exactly one fence, the
+ * project-scope policy, so the number compiled into those rules is the same for everybody and CANNOT be
+ * narrowed per user by the engine. A person who wants a lower number — "try it with $10" — gets it from
+ * Otto's own server: their choice is recorded against their grant (`execution-delegation-cap-store.ts`)
+ * and enforced on every delegated send, on top of this ceiling and never above it.
  */
 export declare const MODEL_B_PER_SWAP_CAP_USD: 5000;
+/**
+ * The floor of the range a person may choose. One whole dollar: the smallest cap that can still pass a
+ * real swap, and low enough that "try it with $10" is nowhere near it.
+ */
+export declare const MODEL_B_PER_SWAP_CAP_MIN_USD: 1;
+/**
+ * A requested per-swap cap, bounded — the same shape as `boundedDelegationExpiry`, and the ONLY place a
+ * requested number becomes a cap.
+ *
+ * 🔴 IT REFUSES; IT NEVER CLAMPS. A hostile 50,000 is not silently turned into 5,000: a caller that asked
+ * for a number outside the range is a caller whose intent this server does not know, and quietly
+ * substituting one would make "the cap you chose" a claim nobody could check. Absent means the ceiling —
+ * the terms every grant already carried before a choice existed.
+ */
+export declare function boundedPerSwapCap(requestedUsd: unknown): number;
 export interface ModelBInputToken {
     readonly symbol: string;
     readonly address: Address;
@@ -80,6 +145,28 @@ export declare const BASE_USDC: Address;
  */
 export declare const MODEL_B_INPUT_TOKENS_V1: readonly ModelBInputToken[];
 export declare function modelBInputToken(token: Address): ModelBInputToken | undefined;
+/**
+ * 🔴 v2 — the share tokens a delegated Yield Copilot WITHDRAW may approve to the diamond: exactly the
+ * registry's executable Morpho vaults (ERC-4626 shares, 18 decimals), derived from the registry so a vault
+ * added or removed there changes the fence shape (= a new digest) rather than drifting past it.
+ */
+export interface ModelBWithdrawToken {
+    readonly symbol: string;
+    readonly address: Address;
+    readonly decimals: 18;
+    readonly marketId: string;
+}
+export declare const MODEL_B_WITHDRAW_TOKENS_V2: readonly ModelBWithdrawToken[];
+export declare function modelBWithdrawToken(token: Address): ModelBWithdrawToken | undefined;
+/**
+ * The engine-side bound on ONE withdraw's approve, in share atomic units: 5,000 shares. A USDC vault's
+ * share is worth ≥ 1 USDC by construction at inception and accrues from there (gtUSDCp ≈ 1.107 USDC on
+ * 2026-09-03), so 5,000 shares ≈ the 5,000 USD per-swap ceiling at par and somewhat more as yield accrues;
+ * after a vault loss the bound only tightens. It is the residual bound for a re-pointed withdraw, the same
+ * class as the swap rule's; the person's own cap does NOT apply to a withdraw (see the send gate: a withdraw
+ * returns the person's own assets to the person and never increases exposure).
+ */
+export declare const MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC: bigint;
 /** The cap in the token's atomic units. */
 export declare function modelBPerSwapCapAtomic(token: ModelBInputToken, capUsd?: number): bigint;
 /** The two GenericSwapV3 ERC20→ERC20 entry points a same-chain swap plan may call. */
@@ -206,10 +293,26 @@ export type DelegationPolicyCriterion = {
 };
 export interface DelegationPolicyRule {
     readonly action: 'accept';
-    readonly operation: 'sendEndUserEvmTransaction';
+    /** `sendEndUserEvmTransaction` = the delegated send; `signEndUserEvmTransaction` (v2) = sign-only, the client broadcasts. */
+    readonly operation: 'sendEndUserEvmTransaction' | 'signEndUserEvmTransaction';
     readonly criteria: readonly DelegationPolicyCriterion[];
 }
 /** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
+/** The v1 rules, frozen as history: USDC approve to the diamond up to the cap + the router rule. */
+export declare function modelBProjectPolicyRulesV1(capUsd?: number): readonly DelegationPolicyRule[];
+/**
+ * The v2 rules = v1 + (a) one approve rule per registry Morpho share token, spender = the diamond only,
+ * value ≤ `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`, ethValue 0 — the delegated withdraw's allowance leg; the
+ * router rule is UNCHANGED (no receiver condition; the person's exit path); (b) a SIGN-ONLY accept rule
+ * (`signEndUserEvmTransaction`) for a USDC `transfer(to, value)` with value ≤ the per-swap cap and NO
+ * recipient condition — the person's own USDC exit without a swap, signed in their browser and broadcast
+ * by the page. The CDP policy schema carries no initiator/session criterion, so the engine cannot tell a
+ * user-signed send from a delegated one on the SAME operation; what it can do is fence a DIFFERENT
+ * operation, and Otto's delegated signer only ever calls the send operation (`adapter/cdp-signer.ts`).
+ * Stated residual: the developer-side end-user client also exposes `signEvmTransaction`, so under a
+ * delegation a compromised Otto could sign a USDC transfer to any address up to the cap — the same
+ * class and bound as the router rule's missing receiver condition, not a new one.
+ */
 export declare function modelBProjectPolicyRules(capUsd?: number): readonly DelegationPolicyRule[];
 /** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
 export declare function modelBProjectPolicyBody(): {
@@ -217,9 +320,15 @@ export declare function modelBProjectPolicyBody(): {
     readonly description: string;
     readonly rules: readonly DelegationPolicyRule[];
 };
-/** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
-export declare function policyRulesDigest(rules: unknown): string;
 export declare const MODEL_B_POLICY_DIGEST_V1: string;
+export declare const MODEL_B_POLICY_DIGEST_V2: string;
+/** The CURRENT digest (v2). */
+export declare const MODEL_B_POLICY_DIGEST: string;
+/** name → {version, digest} for every accepted lineage version. */
+export declare const MODEL_B_POLICY_DIGEST_BY_NAME: ReadonlyMap<string, {
+    readonly version: 1 | 2;
+    readonly digest: string;
+}>;
 /** What the server reads back from `cdp.policies.listPolicies({ scope: 'project' })`, structurally. */
 export interface DelegationPolicyRecord {
     readonly id: string;
@@ -231,6 +340,9 @@ export type ModelBFenceReadBack = {
     readonly present: true;
     readonly id: string;
     readonly rulesDigest: string;
+    /** Which accepted lineage version reads back; a delegated withdraw needs 2. */
+    readonly version: 1 | 2;
+    readonly name: string;
 } | {
     readonly present: false;
     readonly reason: 'absent' | 'ambiguous' | 'name_mismatch' | 'digest_mismatch';
@@ -243,6 +355,8 @@ export type ModelBFenceReadBack = {
  * "absent" — including a policy of the right name whose rules drifted.
  */
 export declare function readBackModelBFence(policies: readonly DelegationPolicyRecord[]): ModelBFenceReadBack;
+/** True when the read-back is THIS binary's fence version — what the fence tool leaves alone. */
+export declare function fenceIsCurrent(readBack: ModelBFenceReadBack): boolean;
 /**
  * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
  * engine would refuse is refused here without spending an allowance reset on it.
@@ -255,3 +369,35 @@ export declare function assertWithinModelBFence(plan: {
     readonly token: ModelBInputToken;
     readonly capAtomic: bigint;
 };
+/**
+ * 🔴 v2 — the delegated WITHDRAW's fence: the approve token must be a registry share token, the spender the
+ * diamond, the approve amount within the share cap, and the OUTPUT token USDC (a withdraw is "shares → the
+ * person's USDC", never a swap into something else under the withdraw's cap-free rule). The receiver pin
+ * (== the signing account) is the verifier's, already applied before this runs.
+ */
+export declare function assertWithdrawWithinModelBFence(plan: {
+    readonly token: Address;
+    readonly spender: Address;
+    readonly gross: bigint;
+    readonly outputToken: Address;
+}): {
+    readonly token: ModelBWithdrawToken;
+};
+/**
+ * THE PERSON'S OWN CAP, enforced after the engine's (Founder word `delegate cap choice`, 2026-09-02).
+ *
+ * 🔴 WHY THIS IS A SEPARATE CHECK AND A SEPARATE CODE. `assertWithinModelBFence` above answers "would
+ * Coinbase's engine have signed this?" — it is the shared ceiling and it is also enforced on-chain by the
+ * project policy, so a plan past it never reaches a signature whatever this server does. THIS check
+ * answers a different question: "is it inside the number THIS PERSON chose when they minted?" The engine
+ * cannot ask it (one project policy, shared by every delegated user), so Otto's server is the only place
+ * it can be asked, and a plan that fails it is one the engine WOULD have signed.
+ *
+ * Folding the two into one call with a smaller number would pass every shape-level test while making the
+ * two facts indistinguishable in the refusal, in the logs and in the tests. They are kept apart so a
+ * mutation that drops the user's cap reddens on its own named code rather than hiding behind the ceiling.
+ */
+export declare function assertWithinUserPerSwapCap(grossAtomic: bigint, capUsd: number, token: ModelBInputToken): {
+    readonly capUsd: number;
+    readonly capAtomic: bigint;
+};