otto-intel-mcp 0.1.2 → 0.1.4

package/dist/native-yield-account-runtime.d.ts

@@ -0,0 +1,71 @@
+/** Authenticated CDP account adapter. The sole native send surface is private to this runtime. */
+import { type Address, type PublicClient } from 'viem';
+import type { DelegationCapStore } from './execution-delegation-cap-store.js';
+import type { DelegationPolicyRecord } from './execution-delegation-policy.js';
+import { type NativeYieldAccountActivation, type NativeYieldAccountAuthority } from './native-yield-account-definition.js';
+import { type NativeYieldAccountPriceObservation, type ResolvedNativeYieldAccountLimits } from './native-yield-account-policy.js';
+export interface NativeYieldAccountCdp {
+    readonly endUser: {
+        validateAccessToken(input: {
+            accessToken: string;
+        }): Promise<{
+            userId: string;
+            evmAccounts?: readonly string[];
+            evmAccountObjects?: readonly {
+                address: string;
+            }[];
+        }>;
+        getEndUser(input: {
+            userId: string;
+        }): Promise<{
+            userId: string;
+            evmAccounts?: readonly string[];
+            evmAccountObjects?: readonly {
+                address: string;
+            }[];
+        }>;
+        getDelegationForEndUser(input: {
+            userId: string;
+        }): Promise<{
+            expiresAt: string;
+        }>;
+        sendEvmTransaction(input: {
+            userId: string;
+            address: string;
+            transaction: `0x${string}`;
+            network: 'base' | 'arbitrum';
+            idempotencyKey: string;
+        }): Promise<{
+            transactionHash: string;
+        }>;
+    };
+    readonly policies: {
+        listPolicies(input: {
+            scope: 'project';
+        }): Promise<{
+            policies?: readonly DelegationPolicyRecord[];
+        }>;
+    };
+}
+export interface NativeYieldAccountIdentity {
+    userId: string;
+    accounts: readonly Address[];
+}
+export declare class NativeYieldAccountRuntime {
+    private readonly cdp;
+    private readonly caps;
+    readonly clients: Readonly<Partial<Record<8453 | 42161, PublicClient>>>;
+    readonly now: () => number;
+    constructor(cdp: NativeYieldAccountCdp, caps: DelegationCapStore, clients: Readonly<Partial<Record<8453 | 42161, PublicClient>>>, now?: () => number);
+    client(chainId: 8453 | 42161): PublicClient;
+    identity(accessToken: string): Promise<NativeYieldAccountIdentity>;
+    authority(accessToken: string, account: string, activation: NativeYieldAccountActivation, purpose: 'consent' | 'send'): Promise<{
+        authority: NativeYieldAccountAuthority;
+        policyPhase: 'legacy-v2' | 'native-v3';
+    }>;
+    /** Last awaited application authority check before dispatch; Stop is never inferred from an older snapshot. */
+    assertCurrentCap(authority: NativeYieldAccountAuthority): Promise<void>;
+    /** Close the final RPC/simulation await with fresh token ownership, live grant and durable Stop checks. */
+    assertCurrentSession(accessToken: string, authority: NativeYieldAccountAuthority): Promise<void>;
+    price(limits: ResolvedNativeYieldAccountLimits): Promise<NativeYieldAccountPriceObservation | undefined>;
+}

package/dist/native-yield-account-runtime.js

@@ -0,0 +1,125 @@
+/** Authenticated CDP account adapter. The sole native send surface is private to this runtime. */
+import { getAddress, parseAbi } from 'viem';
+import { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
+import { hybridYieldCommitment } from './hybrid-yield-markets.js';
+import { refuseNative } from './native-yield-definition.js';
+import { NATIVE_ACCOUNT_AUTHORITY_SCHEMA, NATIVE_ACCOUNT_RULESET, NATIVE_ACCOUNT_SCOPES } from './native-yield-account-definition.js';
+import { assertNativeAccountSendFence, assertNativeConsentPolicyContext, nativeYieldAccountActivationCommitment } from './native-yield-account-policy.js';
+function accounts(user) {
+    return [...new Set([...(user.evmAccounts ?? []), ...(user.evmAccountObjects ?? []).map((a) => a.address)].map((a) => getAddress(a)))];
+}
+export class NativeYieldAccountRuntime {
+    cdp;
+    caps;
+    clients;
+    now;
+    constructor(cdp, caps, clients, now = Date.now) {
+        this.cdp = cdp;
+        this.caps = caps;
+        this.clients = clients;
+        this.now = now;
+    }
+    client(chainId) {
+        const pub = this.clients[chainId];
+        if (!pub)
+            return refuseNative('NATIVE_CHAIN_UNAVAILABLE', 'A reviewed account reader is unavailable');
+        return pub;
+    }
+    async identity(accessToken) {
+        if (!accessToken || accessToken.length > 16384)
+            return refuseNative('NATIVE_TOKEN_INVALID', 'A current account session is required');
+        let user;
+        try {
+            user = await this.cdp.endUser.validateAccessToken({ accessToken });
+        }
+        catch {
+            return refuseNative('NATIVE_TOKEN_INVALID', 'The account session could not be verified');
+        }
+        if (!/^[a-zA-Z0-9-]{1,100}$/.test(user.userId))
+            return refuseNative('NATIVE_TOKEN_INVALID', 'Invalid account identity');
+        const current = await this.cdp.endUser.getEndUser({ userId: user.userId });
+        const currentAccounts = accounts(current);
+        const owned = accounts(user).filter((a) => currentAccounts.includes(a));
+        if (current.userId !== user.userId || owned.length === 0)
+            return refuseNative('NATIVE_OWNER_MISMATCH', 'The session owns no current account');
+        return { userId: user.userId, accounts: owned };
+    }
+    async authority(accessToken, account, activation, purpose) {
+        const who = await this.identity(accessToken), owner = getAddress(account);
+        if (!who.accounts.includes(owner) || !this.caps.available)
+            return refuseNative('NATIVE_AUTHORITY_UNAVAILABLE', 'Current owned account and durable cap are required');
+        const [cap, generation, grant, policyReply] = await Promise.all([
+            this.caps.readActive(who.userId, this.now()), this.caps.readRevokeGeneration(who.userId),
+            this.cdp.endUser.getDelegationForEndUser({ userId: who.userId }), this.cdp.policies.listPolicies({ scope: 'project' }),
+        ]);
+        if (!cap || cap.state !== 'confirmed_active' || cap.requiredVersion !== MODEL_B_CAP_RULESET_VERSION ||
+            cap.revokeGeneration !== generation || Date.parse(grant.expiresAt) !== Date.parse(cap.expiresAt) ||
+            !Number.isFinite(Date.parse(grant.expiresAt)) || Date.parse(grant.expiresAt) <= this.now())
+            return refuseNative('NATIVE_GRANT_UNAVAILABLE', 'The confirmed current grant and Stop generation must match');
+        const policies = policyReply.policies ?? [];
+        const fence = purpose === 'send' ? { ...assertNativeAccountSendFence(policies, activation), phase: 'native-v3' }
+            : assertNativeConsentPolicyContext(policies, activation);
+        for (const deployment of activation.deployments) {
+            const pub = this.client(deployment.chainId);
+            const [chain, code] = await Promise.all([pub.getChainId(), pub.getCode({ address: owner })]);
+            if (chain !== deployment.chainId || (code && code !== '0x'))
+                return refuseNative('NATIVE_ACCOUNT_KIND_UNSUPPORTED', 'Only the verified EOA on the exact configured chain is supported');
+        }
+        const authority = NATIVE_ACCOUNT_AUTHORITY_SCHEMA.parse({ userId: who.userId, account: owner,
+            mintKey: cap.mintKey, grantExpiresAt: new Date(Date.parse(grant.expiresAt)).toISOString(), revokeGeneration: generation,
+            capRulesetVersion: cap.requiredVersion, perSwapCapUsd: cap.perSwapCapUsd,
+            policyId: fence.policyId, policyName: fence.policyName, policyDigest: fence.policyDigest,
+            legacyRulesDigest: fence.legacyRulesDigest, nativeRulesDigest: fence.nativeRulesDigest,
+            activationCommitment: nativeYieldAccountActivationCommitment(activation),
+            scopeCommitment: hybridYieldCommitment({ domain: 'native-yield-account-scope-v1', ruleset: NATIVE_ACCOUNT_RULESET,
+                scopes: NATIVE_ACCOUNT_SCOPES, deployments: activation.deployments, marketRules: activation.marketRules,
+                gasLimits: activation.gasLimits, priceRules: activation.priceRules }),
+            ruleset: NATIVE_ACCOUNT_RULESET, scopes: [...NATIVE_ACCOUNT_SCOPES] });
+        return { authority, policyPhase: fence.phase };
+    }
+    /** Last awaited application authority check before dispatch; Stop is never inferred from an older snapshot. */
+    async assertCurrentCap(authority) {
+        const [cap, generation] = await Promise.all([
+            this.caps.readActive(authority.userId, this.now()), this.caps.readRevokeGeneration(authority.userId),
+        ]);
+        if (!cap || cap.state !== 'confirmed_active' || cap.mintKey !== authority.mintKey ||
+            cap.revokeGeneration !== generation || generation !== authority.revokeGeneration ||
+            cap.requiredVersion !== authority.capRulesetVersion || cap.perSwapCapUsd !== authority.perSwapCapUsd ||
+            Date.parse(cap.expiresAt) !== Date.parse(authority.grantExpiresAt) || Date.parse(cap.expiresAt) <= this.now())
+            return refuseNative('NATIVE_GRANT_CHANGED', 'The grant or Stop generation changed before sending');
+    }
+    /** Close the final RPC/simulation await with fresh token ownership, live grant and durable Stop checks. */
+    async assertCurrentSession(accessToken, authority) {
+        const [who, grant] = await Promise.all([
+            this.identity(accessToken), this.cdp.endUser.getDelegationForEndUser({ userId: authority.userId }),
+        ]);
+        if (who.userId !== authority.userId || !who.accounts.includes(getAddress(authority.account)) ||
+            Date.parse(grant.expiresAt) !== Date.parse(authority.grantExpiresAt) || Date.parse(grant.expiresAt) <= this.now())
+            return refuseNative('NATIVE_GRANT_CHANGED', 'The account session or live grant changed before sending');
+        await this.assertCurrentCap(authority);
+    }
+    async price(limits) {
+        if (limits.marketRule.action === 'withdraw' || limits.market.asset.symbol === 'USDC')
+            return undefined;
+        const rule = limits.activation.priceRules.find((p) => p.chainId === limits.market.chainId &&
+            p.asset.toLowerCase() === limits.market.asset.address.toLowerCase());
+        if (!rule)
+            return refuseNative('NATIVE_PRICE_UNAVAILABLE', 'An approved asset valuation is required');
+        const pub = this.client(rule.chainId), block = await pub.getBlock({ blockTag: 'latest' });
+        if (block.number === null || !block.hash)
+            return refuseNative('NATIVE_PRICE_UNAVAILABLE', 'Missing price block');
+        const abi = parseAbi(['function decimals() view returns (uint8)',
+            'function latestRoundData() view returns (uint80 roundId,int256 answer,uint256 startedAt,uint256 updatedAt,uint80 answeredInRound)']);
+        const [decimals, round] = await Promise.all([
+            pub.readContract({ address: getAddress(rule.feed), abi, functionName: 'decimals', blockNumber: block.number }),
+            pub.readContract({ address: getAddress(rule.feed), abi, functionName: 'latestRoundData', blockNumber: block.number }),
+        ]);
+        const canonical = await pub.getBlock({ blockNumber: block.number });
+        if (canonical.hash !== block.hash || await pub.getChainId() !== rule.chainId)
+            return refuseNative('NATIVE_PRICE_UNAVAILABLE', 'Price block is not canonical');
+        return { chainId: rule.chainId, asset: getAddress(rule.asset), feed: getAddress(rule.feed), feedDecimals: decimals,
+            roundId: round[0], answer: round[1], startedAt: round[2], updatedAt: round[3], answeredInRound: round[4],
+            blockNumber: block.number, blockHash: block.hash, blockTimestampMs: Number(block.timestamp) * 1000, observedAtMs: this.now() };
+    }
+}
+//# sourceMappingURL=native-yield-account-runtime.js.map

package/dist/native-yield-account-store.d.ts

@@ -0,0 +1,40 @@
+import { type ExecutionJournalDatabase } from './execution-journal-schema.js';
+import { type NativeYieldAccountOperation, type NativeYieldAccountOperationContext, type NativeYieldAccountAuthority, type NativeYieldAccountStep, type NativeYieldAccountReceipt } from './native-yield-account-definition.js';
+export declare function nativeAccountDigest(value: unknown): string;
+export declare function nativeAccountReviewCommitment(operationId: string, context: Omit<NativeYieldAccountOperationContext, 'reviewCommitment'>): string;
+export declare function nativeAccountRevocationCommitment(operation: NativeYieldAccountOperation): string;
+/** Rebuild invariants on every read. The database is evidence, never an unchecked signing request. */
+export declare function validateNativeAccountOperation(raw: unknown): NativeYieldAccountOperation;
+export declare class NativeYieldAccountStore {
+    readonly db: ExecutionJournalDatabase;
+    private readonly now;
+    constructor(db: ExecutionJournalDatabase, now?: () => number);
+    transaction<T>(fn: () => T): T;
+    private decode;
+    private checkClaims;
+    private requireClaim;
+    read(userId: string, operationId: string): NativeYieldAccountOperation;
+    list(userId: string): NativeYieldAccountOperation[];
+    private save;
+    create(context: Omit<NativeYieldAccountOperationContext, 'reviewCommitment'>): NativeYieldAccountOperation;
+    begin(userId: string, operationId: string, planCommitment: string, reviewCommitment: string, authority: NativeYieldAccountAuthority): NativeYieldAccountOperation;
+    assertConsent(op: NativeYieldAccountOperation, authority: NativeYieldAccountAuthority): void;
+    append(userId: string, operationId: string, rawStep: NativeYieldAccountStep): NativeYieldAccountOperation;
+    evidence(userId: string, operationId: string, index: number, evidence: {
+        state: 'submitted';
+        transactionHash: string;
+    } | {
+        state: 'mined' | 'confirmed' | 'reverted';
+        receipt: NativeYieldAccountReceipt;
+        finality: 'mined' | 'finalized';
+    } | {
+        state: 'unknown' | 'not-submitted';
+    }): NativeYieldAccountOperation;
+    attention(userId: string, operationId: string, code: string): NativeYieldAccountOperation;
+    /** Caller supplies finalized transaction/protocol/zero-allowance proofs; this commits the terminal record and release atomically. */
+    finish(userId: string, operationId: string, outcome: {
+        state: 'completed' | 'failed';
+        result: unknown;
+    }): NativeYieldAccountOperation;
+}
+export declare function openNativeYieldAccountStore(root: string, now?: () => number, requireExistingLegacyJournal?: boolean): Promise<NativeYieldAccountStore>;

package/dist/native-yield-account-store.js

@@ -0,0 +1,307 @@
+import { NATIVE_OPERATION_SCHEMA, assertExecutionStorageSchema } from './execution-journal-tables.js';
+/** Durable native journal in the SAME operations.db as legacy execution. No tokens, retries or TTL unlocks. */
+import { randomUUID, createHash } from 'node:crypto';
+import { access, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { getAddress, parseTransaction } from 'viem';
+import { hybridYieldCommitment } from './hybrid-yield-markets.js';
+import { nativeYieldFee } from './native-yield-definition.js';
+import { nativeYieldAllowanceRevocation } from './native-yield-verify.js';
+import { assertExecutionJournalCompatible, claimNativeExecution, initializeExecutionJournal, readUserExecutionClaim, releaseNativeExecutionClaim } from './execution-journal-schema.js';
+import { initializeNativeYieldConsents, assertCurrentNativeYieldConsent } from './native-yield-consent-store.js';
+import { NATIVE_ACCOUNT_OPERATION_SCHEMA, NATIVE_ACCOUNT_OPERATION_CONTEXT_SCHEMA, NATIVE_ACCOUNT_STEP_SCHEMA, NATIVE_ACCOUNT_SETTLEMENT_SCHEMA } from './native-yield-account-definition.js';
+export function nativeAccountDigest(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+export function nativeAccountReviewCommitment(operationId, context) {
+    return hybridYieldCommitment({ domain: 'native-yield-account-review-v1', operationId, ...context });
+}
+export function nativeAccountRevocationCommitment(operation) {
+    return hybridYieldCommitment({ domain: 'native-yield-account-clear-v1', operationId: operation.operationId,
+        planCommitment: operation.context.plan.planCommitment, account: operation.account, chainId: operation.chainId });
+}
+const unresolved = (op) => op.reviewConsumed && !['completed', 'failed'].includes(op.state);
+function invalid(detail) { throw new Error(`NATIVE_JOURNAL_INVALID: ${detail}`); }
+/** Rebuild invariants on every read. The database is evidence, never an unchecked signing request. */
+export function validateNativeAccountOperation(raw) {
+    const op = NATIVE_ACCOUNT_OPERATION_SCHEMA.parse(raw), { reviewCommitment, ...core } = op.context;
+    if (!op.operationId.startsWith('ny_') || op.userId !== core.consent.authority.userId ||
+        getAddress(op.account) !== getAddress(core.plan.owner) || getAddress(op.account) !== getAddress(core.consent.authority.account) ||
+        op.chainId !== core.plan.chainId || reviewCommitment !== nativeAccountReviewCommitment(op.operationId, core) ||
+        (op.state === 'review') !== !op.reviewConsumed || op.updatedAtMs < op.createdAtMs)
+        invalid('operation binding');
+    const { planCommitment, ...planCore } = core.plan;
+    if (hybridYieldCommitment(planCore) !== planCommitment || core.plan.intentCommitment !== hybridYieldCommitment(core.input))
+        invalid('plan seal');
+    if (op.state === 'review' && op.steps.length)
+        invalid('review contains sends');
+    let prior = -1;
+    for (const step of op.steps) {
+        const expected = step.index === 3 ? nativeYieldAllowanceRevocation(core.plan, { account: { address: op.account, chainId: op.chainId } }, core.activation.deployments) : core.plan.steps[step.index];
+        if (!expected || step.index <= prior || (step.index < 3 && step.index !== prior + 1) ||
+            step.kind !== ['approve_reset', 'approve', 'call', 'allowance_clear'][step.index] ||
+            step.requestDigest !== nativeAccountDigest(step.request) || step.request.userId !== op.userId ||
+            getAddress(step.request.address) !== getAddress(op.account) ||
+            step.request.network !== (op.chainId === 8453 ? 'base' : 'arbitrum'))
+            invalid('step binding');
+        const tx = parseTransaction(step.request.transaction);
+        if (tx.type !== 'eip1559' || tx.chainId !== op.chainId || !tx.to ||
+            getAddress(tx.to) !== getAddress(expected.to) || (tx.data ?? '0x').toLowerCase() !== expected.data.toLowerCase() ||
+            (tx.value ?? 0n) !== 0n || tx.nonce === undefined || tx.gas === undefined || tx.gas <= 0n ||
+            tx.maxFeePerGas === undefined || tx.maxPriorityFeePerGas === undefined || tx.r || tx.s || tx.yParity !== undefined ||
+            (tx.accessList?.length ?? 0) > 0)
+            invalid('unsigned request');
+        if (['submitted', 'mined', 'confirmed', 'reverted'].includes(step.state) && !step.transactionHash)
+            invalid('missing hash');
+        if (['mined', 'confirmed', 'reverted'].includes(step.state) && (!step.receipt || !step.receiptFinality ||
+            (step.state === 'confirmed' && step.receiptFinality !== 'finalized') ||
+            (step.state === 'mined' && step.receiptFinality !== 'mined') ||
+            step.receipt.transactionHash.toLowerCase() !== step.transactionHash?.toLowerCase() ||
+            (step.state === 'reverted' ? step.receipt.status !== 'reverted' : step.receipt.status !== 'success')))
+            invalid('receipt state');
+        if (['prepared', 'not-submitted', 'unknown'].includes(step.state) && (step.transactionHash || step.receipt || step.receiptFinality))
+            invalid('unexpected evidence');
+        if (step.state === 'submitted' && (step.receipt || step.receiptFinality))
+            invalid('unsealed receipt');
+        prior = step.index;
+    }
+    if (op.state === 'completed' && (!op.result || !op.steps.some((s) => s.index === 2 && s.state === 'confirmed') ||
+        op.steps.some((s) => !['confirmed', 'not-submitted'].includes(s.state))))
+        invalid('completion proof');
+    if (op.state === 'failed' && op.steps.some((s) => !['confirmed', 'reverted', 'not-submitted'].includes(s.state) ||
+        (s.state !== 'not-submitted' && s.receiptFinality !== 'finalized')))
+        invalid('failed evidence');
+    if (op.state === 'completed') {
+        const result = op.result, call = op.steps.find((step) => step.index === 2);
+        if (!result || result.status !== 'completed' || !call?.receipt ||
+            getAddress(result.owner) !== getAddress(op.account) || result.marketId !== core.plan.marketId || result.action !== core.plan.action ||
+            result.transactionHash.toLowerCase() !== call.transactionHash?.toLowerCase() || result.blockNumber !== call.receipt.blockNumber ||
+            result.actualInput !== core.plan.amount || BigInt(result.actualOutput) < BigInt(core.plan.minimumOutput) ||
+            getAddress(result.feeToken) !== getAddress(core.plan.fee.token) ||
+            BigInt(result.actualOttoFee) !== nativeYieldFee(core.plan.action === 'deposit' ? BigInt(result.actualInput) :
+                BigInt(result.actualOutput) + BigInt(result.actualOttoFee)) ||
+            result.gasUsed !== call.receipt.gasUsed || BigInt(result.receiptGasCostWei) !==
+            BigInt(call.receipt.gasUsed) * BigInt(call.receipt.effectiveGasPrice))
+            invalid('completed result binding');
+    }
+    else if (op.state === 'failed') {
+        if (op.result?.status !== 'closed-without-native-completion' || op.steps.some((step) => step.index === 2 && step.state === 'confirmed'))
+            invalid('failed result binding');
+    }
+    else if (op.result !== undefined)
+        invalid('nonterminal result');
+    return op;
+}
+export class NativeYieldAccountStore {
+    db;
+    now;
+    constructor(db, now = Date.now) {
+        this.db = db;
+        this.now = now;
+        assertExecutionJournalCompatible(db, 3);
+        initializeNativeYieldConsents(db);
+        assertExecutionStorageSchema(db, NATIVE_OPERATION_SCHEMA);
+        this.transaction(() => this.checkClaims());
+    }
+    transaction(fn) {
+        if (this.db.isTransaction) {
+            const savepoint = `native_${randomUUID().replaceAll('-', '')}`;
+            this.db.exec(`SAVEPOINT ${savepoint}`);
+            try {
+                assertExecutionJournalCompatible(this.db, 3);
+                const value = fn();
+                this.db.exec(`RELEASE ${savepoint}`);
+                return value;
+            }
+            catch (error) {
+                try {
+                    this.db.exec(`ROLLBACK TO ${savepoint}`);
+                    this.db.exec(`RELEASE ${savepoint}`);
+                }
+                catch { /* retain original failure */ }
+                throw error;
+            }
+        }
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            assertExecutionJournalCompatible(this.db, 3);
+            const value = fn();
+            this.db.exec('COMMIT');
+            return value;
+        }
+        catch (error) {
+            try {
+                this.db.exec('ROLLBACK');
+            }
+            catch { /* retain original failure */ }
+            throw error;
+        }
+    }
+    decode(row) {
+        if (!row)
+            return undefined;
+        const value = row;
+        const op = validateNativeAccountOperation(JSON.parse(value.record_json));
+        if (op.operationId !== value.operation_id || op.userId !== value.user_id)
+            invalid('row identity');
+        return op;
+    }
+    checkClaims() {
+        const rows = this.db.prepare('SELECT * FROM native_yield_operations').all().map((r) => this.decode(r));
+        for (const op of rows.filter(unresolved))
+            this.requireClaim(op);
+        const claims = this.db.prepare("SELECT user_id,claim_id FROM user_execution_claims WHERE kind='native'").all();
+        for (const claim of claims)
+            if (!rows.some((op) => unresolved(op) && op.userId === claim.user_id && op.operationId === claim.claim_id))
+                invalid('orphan native claim');
+    }
+    requireClaim(op) {
+        const claim = readUserExecutionClaim(this.db, op.userId);
+        if (claim?.kind !== 'native' || claim.claimId !== op.operationId)
+            invalid('native claim mismatch');
+    }
+    read(userId, operationId) {
+        assertExecutionJournalCompatible(this.db, 3);
+        const op = this.decode(this.db.prepare('SELECT * FROM native_yield_operations WHERE operation_id=? AND user_id=?').get(operationId, userId));
+        if (!op)
+            throw new Error('NATIVE_OPERATION_NOT_FOUND');
+        if (unresolved(op))
+            this.requireClaim(op);
+        return op;
+    }
+    list(userId) {
+        assertExecutionJournalCompatible(this.db, 3);
+        return this.db.prepare('SELECT * FROM native_yield_operations WHERE user_id=? ORDER BY rowid DESC LIMIT 100').all(userId)
+            .map((row) => { const op = this.decode(row); if (unresolved(op))
+            this.requireClaim(op); return op; });
+    }
+    save(op) {
+        op.updatedAtMs = this.now();
+        if (op.state !== 'attention')
+            delete op.failureCode;
+        validateNativeAccountOperation(op);
+        const changed = this.db.prepare('UPDATE native_yield_operations SET record_json=? WHERE operation_id=? AND user_id=?')
+            .run(JSON.stringify(op), op.operationId, op.userId);
+        if (Number(changed.changes) !== 1)
+            invalid('write disappeared');
+        return op;
+    }
+    create(context) {
+        return this.transaction(() => {
+            const operationId = `ny_${randomUUID()}`, now = this.now();
+            const full = NATIVE_ACCOUNT_OPERATION_CONTEXT_SCHEMA.parse({ ...context, reviewCommitment: nativeAccountReviewCommitment(operationId, context) });
+            assertCurrentNativeYieldConsent(this.db, full.consent, full.consent.authority, now);
+            if (readUserExecutionClaim(this.db, full.consent.authority.userId))
+                throw new Error('NATIVE_EXECUTION_BUSY');
+            const op = validateNativeAccountOperation({ operationId, userId: full.consent.authority.userId, account: full.plan.owner,
+                chainId: full.plan.chainId, state: 'review', context: full, reviewConsumed: false, createdAtMs: now, updatedAtMs: now, steps: [] });
+            this.db.prepare('INSERT INTO native_yield_operations (operation_id,user_id,record_json) VALUES (?,?,?)')
+                .run(operationId, op.userId, JSON.stringify(op));
+            return op;
+        });
+    }
+    begin(userId, operationId, planCommitment, reviewCommitment, authority) {
+        return this.transaction(() => {
+            const op = this.read(userId, operationId);
+            if (op.state !== 'review' || op.reviewConsumed || op.context.plan.planCommitment !== planCommitment ||
+                op.context.reviewCommitment !== reviewCommitment || op.context.plan.deadline * 1000 <= this.now())
+                throw new Error('NATIVE_REVIEW_REQUIRED');
+            assertCurrentNativeYieldConsent(this.db, op.context.consent, authority, this.now());
+            if (claimNativeExecution(this.db, { userId, operationId }, this.now()).outcome !== 'started')
+                throw new Error('NATIVE_EXECUTION_BUSY');
+            op.reviewConsumed = true;
+            op.state = 'active';
+            return this.save(op);
+        });
+    }
+    assertConsent(op, authority) {
+        this.transaction(() => {
+            const current = this.read(op.userId, op.operationId);
+            this.requireClaim(current);
+            assertCurrentNativeYieldConsent(this.db, current.context.consent, authority, this.now());
+        });
+    }
+    append(userId, operationId, rawStep) {
+        return this.transaction(() => {
+            const op = this.read(userId, operationId), step = NATIVE_ACCOUNT_STEP_SCHEMA.parse(rawStep);
+            this.requireClaim(op);
+            if (step.state !== 'prepared' || op.steps.some((s) => s.index === step.index) ||
+                op.steps.some((s) => ['prepared', 'submitted', 'unknown'].includes(s.state)) ||
+                (step.index < 3 && op.steps.some((s) => !['mined', 'confirmed'].includes(s.state))))
+                invalid('unsafe new step');
+            op.steps.push(step);
+            op.state = 'active';
+            return this.save(op);
+        });
+    }
+    evidence(userId, operationId, index, evidence) {
+        return this.transaction(() => {
+            const op = this.read(userId, operationId);
+            this.requireClaim(op);
+            const step = op.steps.find((s) => s.index === index);
+            if (!step)
+                invalid('unknown step');
+            if (evidence.state === 'unknown' || evidence.state === 'not-submitted') {
+                if (step.state !== 'prepared')
+                    invalid('request already left pre-send');
+                step.state = evidence.state;
+            }
+            else {
+                const hash = 'receipt' in evidence ? evidence.receipt.transactionHash : 'transactionHash' in evidence ? evidence.transactionHash : invalid('evidence shape');
+                if (step.state === 'not-submitted' || (step.transactionHash && step.transactionHash.toLowerCase() !== hash.toLowerCase()))
+                    invalid('hash changed');
+                if (step.state === 'confirmed' && evidence.state !== 'confirmed')
+                    invalid('final receipt regressed');
+                step.transactionHash = hash;
+                step.state = evidence.state;
+                if ('receipt' in evidence) {
+                    if (step.receiptFinality === 'finalized' && (evidence.finality !== 'finalized' ||
+                        nativeAccountDigest(step.receipt) !== nativeAccountDigest(evidence.receipt)))
+                        invalid('final receipt changed');
+                    step.receipt = evidence.receipt;
+                    step.receiptFinality = evidence.finality;
+                }
+            }
+            op.state = evidence.state === 'unknown' || evidence.state === 'reverted' || evidence.state === 'not-submitted' ? 'attention' : 'confirming';
+            return this.save(op);
+        });
+    }
+    attention(userId, operationId, code) {
+        return this.transaction(() => {
+            const op = this.read(userId, operationId);
+            this.requireClaim(op);
+            op.state = 'attention';
+            op.failureCode = /^[A-Z0-9_]{1,100}$/.test(code) ? code : 'NATIVE_ACTION_STOPPED';
+            return this.save(op);
+        });
+    }
+    /** Caller supplies finalized transaction/protocol/zero-allowance proofs; this commits the terminal record and release atomically. */
+    finish(userId, operationId, outcome) {
+        return this.transaction(() => {
+            const op = this.read(userId, operationId);
+            this.requireClaim(op);
+            op.state = outcome.state;
+            op.result = NATIVE_ACCOUNT_SETTLEMENT_SCHEMA.parse(outcome.result);
+            this.save(op);
+            releaseNativeExecutionClaim(this.db, { userId, operationId });
+            return op;
+        });
+    }
+}
+export async function openNativeYieldAccountStore(root, now = Date.now, requireExistingLegacyJournal = false) {
+    if (requireExistingLegacyJournal)
+        await access(join(root, 'operations.db'));
+    else
+        await mkdir(root, { recursive: true, mode: 0o700 });
+    const specifier = 'node:sqlite';
+    const { DatabaseSync } = await import(specifier);
+    const db = new DatabaseSync(join(root, 'operations.db'));
+    if (requireExistingLegacyJournal && !db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='operations'").get())
+        invalid('existing legacy operation journal required');
+    db.exec('PRAGMA busy_timeout=5000');
+    initializeExecutionJournal(db, now());
+    assertExecutionJournalCompatible(db, 3);
+    db.exec('PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;');
+    return new NativeYieldAccountStore(db, now);
+}
+//# sourceMappingURL=native-yield-account-store.js.map