otto-intel-mcp 0.1.2 → 0.1.4

package/dist/execution-errors.js

@@ -1,4 +1,6 @@
 export const EXECUTION_REFUSAL_CODES = [
+    /** New Hyperliquid exposure is retired; explicit reduce-only recovery is retained. */
+    'HYPERLIQUID_RETIRED',
     'ATTRIBUTION_MISSING',
     /**
      * The total take on the route exceeds the configured aggregate cap, while Otto's own
@@ -109,12 +111,132 @@ export const EXECUTION_REFUSAL_CODES = [
     'DELEGATION_USER_UNKNOWN',
     /** A verified plan the fence would refuse anyway: input token not allow-listed, spender not the reviewed diamond, gross over the per-swap cap. */
     'DELEGATION_OUTSIDE_FENCE',
+    /**
+     * The plan is inside the ENGINE's fence but over the per-swap cap THIS USER chose when they minted.
+     * Deliberately distinct from `DELEGATION_OUTSIDE_FENCE`: that code means "Coinbase would refuse this
+     * too"; this one means "the engine would have signed it and Otto did not, because the person set a
+     * lower number." Conflating them would make the user's own choice indistinguishable from the shared
+     * ceiling, and no test could tell whether the chosen cap was ever consulted.
+     */
+    'DELEGATION_ABOVE_USER_CAP',
+    /**
+     * The grant that reads back from CDP carries NO recorded per-swap cap on this server, so what the person
+     * agreed to is unknown. Fail-closed: nothing is submitted, and the remedy is a fresh mint (which records
+     * one). Never defaulted to the ceiling — a grant minted for $10 must not become a $5,000 grant because
+     * its record could not be found.
+     */
+    'DELEGATION_CAP_UNRECORDED',
+    /**
+     * CONFIRM FAILED: the instant CDP reports for the live grant is not the instant this mint RESERVED.
+     *
+     * Round 3 makes `(userId, expiry)` a grant identity by construction — the server picks a whole second no
+     * durable row for that user occupies, writes the cap against it, and the page mints with exactly that
+     * second. This code is what happens when that construction does not hold: either another actor's grant
+     * is what reads back (replaced between the reservation and the mint), or CDP stored something other than
+     * what was asked for. Both mean the live permission is not the one this cap was chosen for, so nothing is
+     * blessed. CDP exposes only a user-wide revoke, so the mismatch stays unconfirmed and requires an explicit
+     * fresh Stop that revokes whichever permission is current.
+     */
+    'DELEGATION_CAP_GRANT_CHANGED',
+    /**
+     * The offset ladder found no free whole-second instant at or before the requested expiry within its
+     * bound. Nothing is reserved and nothing is minted: handing out an instant a reservation already holds
+     * would put two permissions on one enforcement key, which is the collision this design removes.
+     */
+    'DELEGATION_CAP_EXPIRY_UNAVAILABLE',
+    /**
+     * 🔴 THE SEND GATE (round 4). No CONFIRMED-ACTIVE record stands for this end user, so no permission
+     * has completed `reserved → confirmed_active` on this server. A reservation on its own authorises
+     * NOTHING: that is what stops a grant minted at a reserved instant by any client — the agent CLI, an
+     * SDK caller, a second tab — from inheriting a cap it never confirmed. Never defaulted to the ceiling.
+     */
+    'DELEGATION_CAP_UNCONFIRMED',
+    /**
+     * A confirmed-active record stands, but the grant CDP reports right now is not the one it names. The
+     * live permission is a different one — replaced, or minted elsewhere — so nothing is submitted under
+     * it. Distinct from `DELEGATION_CAP_UNCONFIRMED`: that means nothing was ever confirmed; this means
+     * something was, and it is not what is live.
+     */
+    'DELEGATION_CAP_MISMATCH',
+    /**
+     * The record requires a NEWER cap ruleset than this worker implements. A rolling deploy runs two
+     * binaries at once, and the Coinbase fence is identical on both — so an older worker that cannot
+     * honour a per-user cap would execute a new permission at the shared ceiling. It refuses instead.
+     */
+    'DELEGATION_CAP_RULESET_STALE',
+    /**
+     * The reservation was confirmed once and a later confirmation replaced it. It is never revived: a
+     * superseded permission returning to active is a replaced cap coming back, and on a wider number that
+     * is the widening this unit exists to prevent.
+     */
+    'DELEGATION_CAP_SUPERSEDED',
+    /**
+     * The per-swap cap store itself is unavailable — no durable path is configured, or it could not be read.
+     * Every delegated send refuses while that is true, because an unreadable store is indistinguishable from
+     * an empty one and the difference decides whether a user's cap is honoured.
+     */
+    'DELEGATION_CAP_STORE_UNAVAILABLE',
+    /** The durable send journal is absent or unreadable. No delegated transaction is handed to CDP. */
+    'DELEGATION_OPERATION_STORE_UNAVAILABLE',
+    /** The new journal has started coverage but old non-journaling workers have not been attested drained. */
+    'DELEGATION_OPERATION_JOURNAL_NOT_READY',
+    /** A prior operation has an unresolved CDP/chain outcome; no conflicting operation may start. */
+    'DELEGATION_OPERATION_UNRESOLVED',
+    /** The server-held Base-USDC exit journal or its process-liveness guard is unavailable. */
+    'DELEGATION_EXIT_UNAVAILABLE',
+    /** A token-bound exit operation does not exist; status-without-id uses the explicit has_exit:false result. */
+    'DELEGATION_EXIT_NOT_FOUND',
+    /** Exact intent, signed bytes, current epoch, owner token, or canonical chain evidence did not match. */
+    'DELEGATION_EXIT_MISMATCH',
+    /** The exit signing owner changed/expired, or an old client answered after cancellation/resume. */
+    'DELEGATION_EXIT_STALE_OWNER',
+    /** A live CDP grant exists, so the exit cannot safely accept or broadcast a transaction. */
+    'DELEGATION_EXIT_GRANT_ACTIVE',
+    /** The exact hash is durable but neither a terminal receipt nor finalized replacement proof is available. */
+    'DELEGATION_EXIT_UNRESOLVED',
+    /**
+     * This worker is not creating NEW permissions right now (`DELEGATION_MINT_ENABLED` is not set true) —
+     * the staged first deployment. It gates the RESERVE only: a permission that already stands keeps
+     * working under its own cap, an in-flight mint can still be confirmed, and revoke always works.
+     */
+    'DELEGATION_MINT_PAUSED',
+    /**
+     * The person pressed Stop while this permission was being created, so the reservation it was minted
+     * against was cancelled and nothing is confirmed for it. A stale confirm never issues CDP's user-wide
+     * revoke because that could take away a replacement; the person must use a fresh Stop for the current
+     * remote permission.
+     */
+    'DELEGATION_CAP_CANCELLED',
     /** The user-side verifier refused the envelope with an adapter code the constructor does not share; the message carries `[CODE]`. */
     'DELEGATED_PLAN_REFUSED',
     /** The plan halted mid-way; the message reports the failed step and whether the allowance clear read back zero. */
     'DELEGATED_PLAN_HALTED',
     /** A CDP or chain read/write failed outright; no upstream body is relayed. */
     'DELEGATION_UPSTREAM_FAILED',
+    /** `otto_prepare_yield_deposit`: the executableMarketId names no executable Morpho market in this server's registry. */
+    'YIELD_MARKET_UNKNOWN',
+    /** Exact legacy position remains withdrawable but no new deposit is prepared. */
+    'YIELD_DEPOSIT_UNAVAILABLE',
+    /** The caller's registryCommitment is not the commitment recomputed over the CURRENT registry record (stale or foreign row). */
+    'YIELD_REGISTRY_MISMATCH',
+    /** The vault's own previewDeposit could not be read, so deposit parity cannot be checked; nothing is prepared. */
+    'YIELD_PREVIEW_UNAVAILABLE',
+    /** The route quotes fewer shares than the vault's own previewDeposit by more than the pinned tolerance. */
+    'YIELD_DEPOSIT_PARITY',
+    /** `otto_prepare_yield_withdraw`: the route quotes less USDC than the vault's own previewRedeem by more than the pinned tolerance. */
+    'YIELD_WITHDRAW_PARITY',
+    /** A delegated vault withdraw under a permission minted before cap ruleset v2 (no consent to withdraws); re-mint. */
+    'DELEGATION_WITHDRAW_UNCONSENTED',
+    /** `otto_prepare_stock_buy`: the executableEquityId names no executable equity in this server's registry (or the row fails its own pins). */
+    'EQUITY_UNKNOWN',
+    /** The caller's registryCommitment is not the commitment recomputed over the CURRENT equity record (stale or foreign row). */
+    'EQUITY_REGISTRY_MISMATCH',
+    /** The equity's Chainlink feed could not be read (or reads non-positive), so price parity cannot be checked; nothing is prepared. */
+    'EQUITY_ORACLE_UNAVAILABLE',
+    /** The equity's Chainlink mark is older than the pinned frozen threshold (feeds hold their last value off-hours); a delegated buy waits for a live reference. */
+    'EQUITY_ORACLE_FROZEN',
+    /** The route's gross implied price exceeds the equity's own Chainlink mark by more than the pinned tolerance. */
+    'STOCK_BUY_PARITY',
 ];
 /** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
 export class ExecutionRefusal extends Error {

package/dist/execution-index.d.ts

@@ -11,7 +11,12 @@ export { swapIntentDigestInput } from './execution-intent.js';
 export { artifactCommitmentDigest, assertArtifactAccountBinding, assertArtifactCommitment, assertArtifactEnvelope, assertArtifactFresh, assertArtifactPayloadDigest, executionDigest, MAX_ARTIFACT_TTL_MS, } from './execution-types.js';
 export type { AccountProfile, ExecutionArtifact, ExecutionEnvelope, ExecutionPayload, } from './execution-types.js';
 export { ExecutionRefusal, EXECUTION_REFUSAL_CODES } from './execution-errors.js';
-export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, type DelegationPolicyRecord, type ModelBFenceReadBack, } from './execution-delegation-policy.js';
+export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_DELEGATION_EXPIRY_MIN_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_MINT_EXPIRY_FILLER_MS, mintExpiryFor, MODEL_B_PER_SWAP_CAP_MIN_USD, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, boundedPerSwapCap, assertWithinUserPerSwapCap, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, MODEL_B_POLICY_NAME_V2, MODEL_B_POLICY_NAME, MODEL_B_POLICY_DIGEST_V2, MODEL_B_POLICY_DIGEST, MODEL_B_POLICY_DIGEST_BY_NAME, MODEL_B_POLICY_ACCEPTED_VERSIONS, MODEL_B_WITHDRAW_TOKENS_V2, MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC, assertWithdrawWithinModelBFence, fenceIsCurrent, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, type DelegationPolicyRecord, type ModelBFenceReadBack, } from './execution-delegation-policy.js';
 export { DELEGATED_EXECUTION_TOOL_NAME, DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, DELEGATED_SEND_RESULT_SCHEMA, type DelegatedSendResult, type SubmitUnderDelegationInput, } from './execution-delegated-definition.js';
 export { DEFAULT_LIFI_AGGREGATE_FEE_CAP_RATE, DEFAULT_LIFI_FEE_BPS, DEFAULT_LIFI_FEE_CONFIG_VERSION, DEFAULT_LIFI_PLATFORM_FEE_RECIPIENT, DEFAULT_OTTO_LIFI_FEE_RECIPIENT, LIFI_DIAMOND_ADDRESS, LIFI_FEE_FORWARDERS_BY_CHAIN, LIFI_FEE_FORWARDER_V1, LIFI_FEE_FORWARDER_V1_MAINNET, LIFI_FEE_FORWARDER_V2, LIFI_INTEGRATOR, isReviewedLiFiFeeForwarder, reviewedLiFiFeeForwarders, unreviewedFeeForwarderMessage, } from './execution-config.js';
-export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, type DelegationFenceResult, type DelegationFenceStatusResult, type DelegationRevokeResult, type DelegationStatusResult, } from './execution-delegation-admin-definition.js';
+export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_CAP_INPUT_SCHEMA, DELEGATION_CAP_RESULT_SCHEMA, DELEGATION_CAP_TOOL_NAME, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, type DelegationCapResult, type DelegationFenceResult, type DelegationFenceStatusResult, type DelegationRevokeResult, type DelegationStatusResult, } from './execution-delegation-admin-definition.js';
+export { CAP_EXPIRY_MAX_OFFSET_STEPS, DELEGATION_CAP_STORE_PATH_ENV, DelegationCapExpiryUnavailableError, MINT_KEY_PATTERN, createDelegationCapStore, firstFreeExpiryMs, inMemoryDelegationCapStore, resolveDelegationCapStorePath, unavailableDelegationCapStore, wholeSecondMs, type DelegationCapRecord, type DelegationCapReservation, type DelegationCapStore, } from './execution-delegation-cap-store.js';
+export { DELEGATION_OPERATIONS_INPUT_SCHEMA, DELEGATION_OPERATIONS_RESULT_SCHEMA, DELEGATION_OPERATIONS_TOOL_NAME, DELEGATION_RECONCILE_INPUT_SCHEMA, DELEGATION_RECONCILE_TOOL_NAME, type DelegationOperationsResult, } from './execution-delegation-operations-definition.js';
+export { DELEGATION_EXIT_CHAIN_ID, DELEGATION_EXIT_INPUT_SCHEMA, DELEGATION_EXIT_NONE_RESULT_SCHEMA, DELEGATION_EXIT_RECORD_RESULT_SCHEMA, DELEGATION_EXIT_RESULT_SCHEMA, DELEGATION_EXIT_STATES, DELEGATION_EXIT_TOOL_NAME, DELEGATION_EXIT_USDC, type DelegationExitInput, type DelegationExitResult, } from './execution-delegation-exit-definition.js';
+export { DELEGATION_EXIT_SIGNING_LEASE_MS, USER_EXECUTION_CLAIM_KINDS, createDelegationExitStore, delegationExitOwnerTokenDigest, openDelegationExitStore, unavailableDelegationExitStore, type DelegationExitRecord, type DelegationExitState, type DelegationExitStore, type DelegationExitTransaction, type UserExecutionClaim, type UserExecutionClaimKind, } from './execution-delegation-exit-store.js';
+export { DELEGATION_OPERATION_DB_FILE, DELEGATION_OPERATION_HISTORY_LIMIT, DELEGATION_OPERATION_JOURNAL_SCHEMA_VERSION, DELEGATION_OPERATION_STATES, DELEGATION_OPERATION_STEP_KINDS, DELEGATION_OPERATION_STEP_STATES, createDelegationOperationStore, delegationOperationIdempotencyKey, inMemoryDelegationOperationStore, openDelegationOperationStore, unavailableDelegationOperationStore, type DelegationOperationBinding, type DelegationOperationJournalStatus, type DelegationOperationRecord, type DelegationOperationRecoveryRecord, type DelegationOperationRecoveryStep, type DelegationOperationSnapshot, type DelegationOperationState, type DelegationOperationStep, type DelegationOperationStepKind, type DelegationOperationStepState, type DelegationOperationStore, } from './execution-delegation-operation-store.js';

package/dist/execution-index.js

@@ -9,8 +9,13 @@ export { EXECUTION_ARTIFACT_SCHEMA, EXECUTION_ENVELOPE_SCHEMA, PREPARE_SWAP_INPU
 export { swapIntentDigestInput } from './execution-intent.js';
 export { artifactCommitmentDigest, assertArtifactAccountBinding, assertArtifactCommitment, assertArtifactEnvelope, assertArtifactFresh, assertArtifactPayloadDigest, executionDigest, MAX_ARTIFACT_TTL_MS, } from './execution-types.js';
 export { ExecutionRefusal, EXECUTION_REFUSAL_CODES } from './execution-errors.js';
-export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, } from './execution-delegation-policy.js';
+export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_DELEGATION_EXPIRY_MIN_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_MINT_EXPIRY_FILLER_MS, mintExpiryFor, MODEL_B_PER_SWAP_CAP_MIN_USD, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, boundedPerSwapCap, assertWithinUserPerSwapCap, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, MODEL_B_POLICY_NAME_V2, MODEL_B_POLICY_NAME, MODEL_B_POLICY_DIGEST_V2, MODEL_B_POLICY_DIGEST, MODEL_B_POLICY_DIGEST_BY_NAME, MODEL_B_POLICY_ACCEPTED_VERSIONS, MODEL_B_WITHDRAW_TOKENS_V2, MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC, assertWithdrawWithinModelBFence, fenceIsCurrent, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, } from './execution-delegation-policy.js';
 export { DELEGATED_EXECUTION_TOOL_NAME, DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, DELEGATED_SEND_RESULT_SCHEMA, } from './execution-delegated-definition.js';
 export { DEFAULT_LIFI_AGGREGATE_FEE_CAP_RATE, DEFAULT_LIFI_FEE_BPS, DEFAULT_LIFI_FEE_CONFIG_VERSION, DEFAULT_LIFI_PLATFORM_FEE_RECIPIENT, DEFAULT_OTTO_LIFI_FEE_RECIPIENT, LIFI_DIAMOND_ADDRESS, LIFI_FEE_FORWARDERS_BY_CHAIN, LIFI_FEE_FORWARDER_V1, LIFI_FEE_FORWARDER_V1_MAINNET, LIFI_FEE_FORWARDER_V2, LIFI_INTEGRATOR, isReviewedLiFiFeeForwarder, reviewedLiFiFeeForwarders, unreviewedFeeForwarderMessage, } from './execution-config.js';
-export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, } from './execution-delegation-admin-definition.js';
+export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_CAP_INPUT_SCHEMA, DELEGATION_CAP_RESULT_SCHEMA, DELEGATION_CAP_TOOL_NAME, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, } from './execution-delegation-admin-definition.js';
+export { CAP_EXPIRY_MAX_OFFSET_STEPS, DELEGATION_CAP_STORE_PATH_ENV, DelegationCapExpiryUnavailableError, MINT_KEY_PATTERN, createDelegationCapStore, firstFreeExpiryMs, inMemoryDelegationCapStore, resolveDelegationCapStorePath, unavailableDelegationCapStore, wholeSecondMs, } from './execution-delegation-cap-store.js';
+export { DELEGATION_OPERATIONS_INPUT_SCHEMA, DELEGATION_OPERATIONS_RESULT_SCHEMA, DELEGATION_OPERATIONS_TOOL_NAME, DELEGATION_RECONCILE_INPUT_SCHEMA, DELEGATION_RECONCILE_TOOL_NAME, } from './execution-delegation-operations-definition.js';
+export { DELEGATION_EXIT_CHAIN_ID, DELEGATION_EXIT_INPUT_SCHEMA, DELEGATION_EXIT_NONE_RESULT_SCHEMA, DELEGATION_EXIT_RECORD_RESULT_SCHEMA, DELEGATION_EXIT_RESULT_SCHEMA, DELEGATION_EXIT_STATES, DELEGATION_EXIT_TOOL_NAME, DELEGATION_EXIT_USDC, } from './execution-delegation-exit-definition.js';
+export { DELEGATION_EXIT_SIGNING_LEASE_MS, USER_EXECUTION_CLAIM_KINDS, createDelegationExitStore, delegationExitOwnerTokenDigest, openDelegationExitStore, unavailableDelegationExitStore, } from './execution-delegation-exit-store.js';
+export { DELEGATION_OPERATION_DB_FILE, DELEGATION_OPERATION_HISTORY_LIMIT, DELEGATION_OPERATION_JOURNAL_SCHEMA_VERSION, DELEGATION_OPERATION_STATES, DELEGATION_OPERATION_STEP_KINDS, DELEGATION_OPERATION_STEP_STATES, createDelegationOperationStore, delegationOperationIdempotencyKey, inMemoryDelegationOperationStore, openDelegationOperationStore, unavailableDelegationOperationStore, } from './execution-delegation-operation-store.js';
 //# sourceMappingURL=execution-index.js.map

package/dist/execution-journal-schema.d.ts

@@ -0,0 +1,96 @@
+/** Ordinary fresh initialization remains v4; v5 is an explicit offline semantic-reader migration. */
+export declare const EXECUTION_JOURNAL_SCHEMA_VERSION: 4;
+export declare const EXECUTION_JOURNAL_MAX_SCHEMA_VERSION: 6;
+export declare const USER_EXECUTION_CLAIM_KINDS: readonly ["mint", "delegated", "exit", "native", "sponsored"];
+export type UserExecutionClaimKind = (typeof USER_EXECUTION_CLAIM_KINDS)[number];
+export interface UserExecutionClaim {
+    readonly userId: string;
+    readonly kind: UserExecutionClaimKind;
+    readonly claimId: string;
+    /** Only mint claims carry the Stop generation that acquired the claim. */
+    readonly claimGeneration?: number;
+}
+export interface ExecutionJournalDatabase {
+    readonly isTransaction?: boolean;
+    exec(sql: string): void;
+    prepare(sql: string): {
+        run(...params: unknown[]): {
+            changes: number | bigint;
+        };
+        get(...params: unknown[]): unknown;
+        all(...params: unknown[]): unknown[];
+    };
+}
+export interface ExecutionJournalStatus {
+    readonly schemaVersion: 2 | 3 | 4 | 5 | 6;
+    /** Existing Base admission status. Internal schema upgrades must not change the public v2 contract. */
+    readonly ready: boolean;
+    readonly coverageStartedAt: string;
+    readonly nativeReady: boolean;
+    readonly nativeCoverageStartedAt: string | null;
+    readonly sponsoredReady: boolean;
+    readonly sponsoredCoverageStartedAt: string | null;
+    readonly nativeUserOpReady: boolean;
+    readonly nativeUserOpCoverageStartedAt: string | null;
+    readonly lpUserOpReady: boolean;
+    readonly lpUserOpCoverageStartedAt: string | null;
+}
+export declare class ExecutionJournalNotReadyError extends Error {
+    constructor();
+}
+/** Every writer checks the actual version under its own transaction. Opening is not migration authority. */
+export declare function assertExecutionJournalCompatible(db: ExecutionJournalDatabase, minimumVersion?: 2 | 3 | 4 | 5 | 6): void;
+export declare function readExecutionJournalStatus(db: ExecutionJournalDatabase): ExecutionJournalStatus;
+export declare function requireExecutionJournalReady(db: ExecutionJournalDatabase): void;
+export declare function requireNativeExecutionJournalReady(db: ExecutionJournalDatabase): void;
+export declare function requireSponsoredExecutionJournalReady(db: ExecutionJournalDatabase): void;
+/** v2 native records require a new reader rollout. Existing v4 sponsorship readiness is insufficient. */
+export declare function requireNativeUserOpJournalReady(db: ExecutionJournalDatabase): void;
+/** Operator-only transaction after draining every v4 worker; no table, record or claim is rewritten. */
+export declare function migrateNativeUserOpJournal(db: ExecutionJournalDatabase, nowMs: number, expected: {
+    readonly coverageStartedAt: string;
+    readonly sponsoredCoverageStartedAt: string;
+}): ExecutionJournalStatus;
+/** A separate explicit attestation that all deployed readers understand native version-2 records. */
+export declare function markNativeUserOpReadyAfterDrain(db: ExecutionJournalDatabase, nowMs: number): ExecutionJournalStatus;
+/** LP record v3 is another explicit reader rollout; prior native readiness does not grant LP admission. */
+export declare function requireLpUserOpJournalReady(db: ExecutionJournalDatabase): void;
+export declare function migrateLpUserOpJournal(db: ExecutionJournalDatabase, nowMs: number, expected: {
+    readonly coverageStartedAt: string;
+    readonly sponsoredCoverageStartedAt: string;
+    readonly nativeUserOpCoverageStartedAt: string;
+}): ExecutionJournalStatus;
+export declare function markLpUserOpReadyAfterDrain(db: ExecutionJournalDatabase, nowMs: number): ExecutionJournalStatus;
+/** Explicit operator attestation that every worker understands sponsored claims; migration alone cannot enable sends. */
+export declare function markSponsoredExecutionReadyAfterLegacyDrain(db: ExecutionJournalDatabase, nowMs: number): ExecutionJournalStatus;
+/** Explicit native rollout attestation, separate from the existing public Base rollout action. */
+export declare function markNativeExecutionReadyAfterLegacyDrain(db: ExecutionJournalDatabase, nowMs: number): ExecutionJournalStatus;
+export declare function executionClaimFromRow(row: unknown): UserExecutionClaim | undefined;
+export declare function readUserExecutionClaim(db: ExecutionJournalDatabase, userId: string): UserExecutionClaim | undefined;
+/**
+ * Fresh databases are initialized atomically, unready, with all storage contracts. Existing databases
+ * are only validated unless the operator supplies the exact prior version and coverage after draining
+ * every old writer. Ordinary status, construction and hosted startup can never widen a live journal.
+ */
+export declare function initializeExecutionJournal(db: ExecutionJournalDatabase, nowMs: number, expectedPrior?: {
+    readonly schemaVersion: '2' | '3';
+    readonly coverageStartedAt: string;
+}): void;
+export interface NativeExecutionClaimBinding {
+    readonly userId: string;
+    readonly operationId: string;
+}
+export type NativeExecutionClaimOutcome = {
+    readonly outcome: 'started' | 'existing';
+} | {
+    readonly outcome: 'conflict';
+    readonly claim: UserExecutionClaim;
+};
+/** Call inside the transaction that also creates the native operation row. No standalone reservation. */
+export declare function claimNativeExecution(db: ExecutionJournalDatabase, binding: NativeExecutionClaimBinding, nowMs: number): NativeExecutionClaimOutcome;
+/** The caller must prove and record the native terminal outcome in this same transaction. */
+export declare function releaseNativeExecutionClaim(db: ExecutionJournalDatabase, binding: NativeExecutionClaimBinding): void;
+/** Atomic companion to inserting/consuming a sponsored review in the same operations.db transaction. */
+export declare function claimSponsoredExecution(db: ExecutionJournalDatabase, binding: NativeExecutionClaimBinding, nowMs: number): NativeExecutionClaimOutcome;
+/** Caller commits the proven terminal record in this same transaction. No TTL or provider-timeout release. */
+export declare function releaseSponsoredExecutionClaim(db: ExecutionJournalDatabase, binding: NativeExecutionClaimBinding): void;