otto-intel-mcp 0.1.2 → 0.1.4

package/dist/native-yield-account.js

@@ -0,0 +1,371 @@
+/** Manual, session-authenticated native account flow. No autonomous continuation and no ambiguous replay. */
+import { randomUUID } from 'node:crypto';
+import { getAddress, keccak256 } from 'viem';
+import { hybridYieldCommitment } from './hybrid-yield-markets.js';
+import { NATIVE_YIELD_ERC20_ABI, refuseNative } from './native-yield-definition.js';
+import { prepareNativeYield } from './native-yield.js';
+import { viemNativeYieldReader } from './native-yield-reader.js';
+import { verifyNativeYieldPlan, nativeYieldAllowanceRevocation } from './native-yield-verify.js';
+import { simulateNativeYieldPlan } from './native-yield-simulation.js';
+import { readNativeYieldSettlement } from './native-yield-settlement.js';
+import { createNativeYieldConsent, confirmNativeYieldConsent, readConfirmedNativeYieldConsent, revokeNativeYieldConsent, readNativeYieldConsent } from './native-yield-consent-store.js';
+import { nativeAccountDigest, nativeAccountRevocationCommitment } from './native-yield-account-store.js';
+import { deriveExactApprovedNativeMarketLimits, assertNativeDepositWithinOwnerUsdCap, assertNativeInputWithinApprovedAtomicCeiling, resolveNativeYieldAccountActivation, nativeYieldAccountActivationCommitment } from './native-yield-account-policy.js';
+import { prepareNativeYieldAccountTransaction, revalidateNativeYieldAccountTransaction } from './native-yield-account-gas.js';
+import { proveNativeYieldAccountTransaction } from './native-yield-account-rpc.js';
+import { NATIVE_ACCOUNT_CONSENT_REVIEW_INPUT, NATIVE_ACCOUNT_CONSENT_CONFIRM_INPUT, NATIVE_ACCOUNT_PREPARE_INPUT, NATIVE_ACCOUNT_SUBMIT_INPUT, NATIVE_ACCOUNT_READ_INPUT, NATIVE_ACCOUNT_RECONCILE_INPUT, NATIVE_ACCOUNT_REVOKE_INPUT, NATIVE_ACCOUNT_COST_QUOTE_SCHEMA, NATIVE_YIELD_ACCOUNT_ACTIVATIONS, NATIVE_ACCOUNT_CONTINUE_INPUT, NATIVE_ACCOUNT_OPERATION_VIEW_SCHEMA } from './native-yield-account-definition.js';
+function storedQuote(quote) {
+    return NATIVE_ACCOUNT_COST_QUOTE_SCHEMA.parse(JSON.parse(JSON.stringify(quote, (_key, value) => typeof value === 'bigint' ? value.toString() : value)));
+}
+function gasLimits(raw) {
+    return { maxGasLimit: BigInt(raw.maxGasLimit), maxFeePerGasWei: BigInt(raw.maxFeePerGasWei),
+        maxPriorityFeePerGasWei: BigInt(raw.maxPriorityFeePerGasWei), maxEstimatedTotalCostWei: BigInt(raw.maxEstimatedTotalCostWei),
+        gasLimitBufferBps: raw.gasLimitBufferBps };
+}
+function errorCode(error) {
+    const code = error?.code;
+    return typeof code === 'string' && /^[A-Z0-9_]{1,100}$/.test(code) ? code : 'NATIVE_ACTION_STOPPED';
+}
+function uncertain(step) { return ['prepared', 'submitted', 'unknown'].includes(step.state); }
+export class NativeYieldAccountService {
+    runtime;
+    cdp;
+    store;
+    guards;
+    activations;
+    constructor(runtime, cdp, store, guards, activations = NATIVE_YIELD_ACCOUNT_ACTIVATIONS) {
+        this.runtime = runtime;
+        this.cdp = cdp;
+        this.store = store;
+        this.guards = guards;
+        this.activations = activations;
+        // One project policy, one explicit account scope. A manifest can cover both supported chains.
+        if (activations.length > 1)
+            throw new Error('NATIVE_ACTIVATION_AMBIGUOUS');
+    }
+    activation(chainId) {
+        return resolveNativeYieldAccountActivation(chainId ?? this.activations[0]?.deployments[0]?.chainId ?? 8453, this.activations);
+    }
+    protocol(activation) {
+        return { reader: viemNativeYieldReader(this.runtime.clients, this.runtime.now), deployments: activation.deployments, nowMs: this.runtime.now };
+    }
+    context(plan, maximumInputAtomic) {
+        return { account: { address: plan.owner, chainId: plan.chainId }, maximumInputAtomic: BigInt(maximumInputAtomic) };
+    }
+    async owned(accessToken, operationId) {
+        const who = await this.runtime.identity(accessToken), op = this.store.read(who.userId, operationId);
+        if (!who.accounts.includes(getAddress(op.account)))
+            return refuseNative('NATIVE_OWNER_MISMATCH', 'The current session does not own this operation account');
+        return op;
+    }
+    async reviewConsent(raw) {
+        const input = NATIVE_ACCOUNT_CONSENT_REVIEW_INPUT.parse(raw), activation = this.activation();
+        if (activation.mode !== 'enabled')
+            return refuseNative('NATIVE_EXECUTION_UNAVAILABLE', 'New native consent is unavailable');
+        const current = await this.runtime.authority(input.accessToken, input.account, activation, 'consent');
+        const consent = createNativeYieldConsent(this.store.db, current.authority, this.runtime.now());
+        return { schemaVersion: '1', consent, terms: activation, policyPhase: current.policyPhase,
+            requiresSeparateOperationReview: true, automaticExecutionEnabled: false };
+    }
+    async confirmConsent(raw) {
+        const input = NATIVE_ACCOUNT_CONSENT_CONFIRM_INPUT.parse(raw), who = await this.runtime.identity(input.accessToken);
+        // The store owns the challenge identity; no caller-supplied account or authority is accepted.
+        const challenge = readNativeYieldConsent(this.store.db, who.userId, input.consentId);
+        if (!challenge)
+            return refuseNative('NATIVE_CONSENT_NOT_FOUND', 'The consent review is unavailable');
+        const activation = this.activation();
+        if (activation.mode !== 'enabled')
+            return refuseNative('NATIVE_EXECUTION_UNAVAILABLE', 'New native consent is unavailable');
+        const current = await this.runtime.authority(input.accessToken, challenge.authority.account, activation, 'consent');
+        const consent = confirmNativeYieldConsent(this.store.db, { userId: who.userId, consentId: input.consentId, consentCommitment: input.consentCommitment }, current.authority, this.runtime.now());
+        return { schemaVersion: '1', consent, policyPhase: current.policyPhase, automaticExecutionEnabled: false };
+    }
+    async revokeConsent(raw) {
+        const input = NATIVE_ACCOUNT_CONSENT_REVIEW_INPUT.parse(raw), who = await this.runtime.identity(input.accessToken);
+        if (!who.accounts.includes(getAddress(input.account)))
+            return refuseNative('NATIVE_OWNER_MISMATCH', 'The session does not own this account');
+        revokeNativeYieldConsent(this.store.db, who.userId, input.account, this.runtime.now());
+        return { schemaVersion: '1', nativeConsentRevoked: true, existingOperationRequiresReconciliation: true };
+    }
+    async prepare(raw) {
+        const input = NATIVE_ACCOUNT_PREPARE_INPUT.parse(raw), request = input.input, activation = this.activation(request.accountProfile.chainId);
+        if (activation.mode !== 'enabled')
+            return refuseNative('NATIVE_EXECUTION_UNAVAILABLE', 'New native execution is unavailable');
+        const current = await this.runtime.authority(input.accessToken, request.accountProfile.address, activation, 'send');
+        const consent = readConfirmedNativeYieldConsent(this.store.db, current.authority.userId, current.authority.account, this.runtime.now());
+        if (!consent)
+            return refuseNative('NATIVE_CONSENT_REQUIRED', 'Review and confirm the native scope before preparing an operation');
+        const limits = deriveExactApprovedNativeMarketLimits(activation, { chainId: request.accountProfile.chainId,
+            marketId: request.marketId, registryCommitment: request.registryCommitment, action: request.action });
+        assertNativeInputWithinApprovedAtomicCeiling(BigInt(request.amount), limits);
+        if (request.action === 'deposit')
+            assertNativeDepositWithinOwnerUsdCap({ amountAtomic: BigInt(request.amount), authority: current.authority,
+                limits, priceObservation: await this.runtime.price(limits), nowMs: this.runtime.now() });
+        const plan = await prepareNativeYield(this.protocol(activation), request);
+        await verifyNativeYieldPlan(this.protocol(activation), plan, request, this.context(plan, limits.maximumInputAtomic.toString()));
+        const fresh = await this.runtime.authority(input.accessToken, plan.owner, activation, 'send');
+        if (hybridYieldCommitment(fresh.authority) !== hybridYieldCommitment(consent.authority))
+            return refuseNative('NATIVE_CONSENT_STALE', 'Account authority changed; review native scope again');
+        const op = this.store.create({ input: request, plan, consent, activation, maximumInputAtomic: limits.maximumInputAtomic.toString(),
+            maximumOperationEstimatedCostWei: limits.gasLimits.maxOperationEstimatedCostWei });
+        const preparedGuard = await this.guards.acquire('native', op.operationId, true);
+        preparedGuard.release();
+        return this.view(op);
+    }
+    async guard(op, token, recovery = false) {
+        const activation = this.activation(op.chainId);
+        if (!recovery && (activation.mode !== 'enabled' || nativeYieldAccountActivationCommitment(activation) !==
+            nativeYieldAccountActivationCommitment(op.context.activation)))
+            return refuseNative('NATIVE_ACTIVATION_CHANGED', 'The reviewed execution configuration changed');
+        const current = await this.runtime.authority(token, op.account, activation, 'send');
+        if (current.authority.userId !== op.userId)
+            return refuseNative('NATIVE_OWNER_MISMATCH', 'The session identity changed');
+        if (!recovery)
+            this.store.assertConsent(op, current.authority);
+        // Recovery proves its exact old spender against the CURRENT approved deployment, even if the plan expired.
+        if (recovery)
+            nativeYieldAllowanceRevocation(op.context.plan, this.context(op.context.plan, op.context.maximumInputAtomic), activation.deployments);
+        let limits = deriveExactApprovedNativeMarketLimits(recovery ? op.context.activation : activation, { chainId: op.chainId, marketId: op.context.plan.marketId,
+            registryCommitment: op.context.plan.registryCommitment, action: op.context.plan.action });
+        if (recovery) {
+            const currentGas = activation.gasLimits.find((gas) => gas.chainId === op.chainId);
+            if (!currentGas)
+                return refuseNative('NATIVE_GAS_UNAVAILABLE', 'Current recovery gas limits are unavailable');
+            limits = { ...limits, gasLimits: currentGas };
+        }
+        if (!recovery) {
+            assertNativeInputWithinApprovedAtomicCeiling(BigInt(op.context.plan.amount), limits);
+            if (op.context.plan.action === 'deposit')
+                assertNativeDepositWithinOwnerUsdCap({ amountAtomic: BigInt(op.context.plan.amount), authority: current.authority,
+                    limits, priceObservation: await this.runtime.price(limits), nowMs: this.runtime.now() });
+            await verifyNativeYieldPlan(this.protocol(activation), op.context.plan, op.context.input, this.context(op.context.plan, limits.maximumInputAtomic.toString()));
+        }
+        return { activation, current, limits };
+    }
+    async submit(raw) {
+        const input = NATIVE_ACCOUNT_SUBMIT_INPUT.parse(raw), reviewed = await this.owned(input.accessToken, input.operationId);
+        if (reviewed.state !== 'review' || reviewed.reviewConsumed)
+            return refuseNative('NATIVE_REVIEW_REQUIRED', 'This operation review was already consumed');
+        const guard = await this.guards.acquire('native', reviewed.operationId);
+        try {
+            const activation = this.activation(reviewed.chainId);
+            if (activation.mode !== 'enabled' || nativeYieldAccountActivationCommitment(activation) !==
+                nativeYieldAccountActivationCommitment(reviewed.context.activation))
+                return refuseNative('NATIVE_ACTIVATION_CHANGED', 'The operation requires a fresh review');
+            const fresh = await this.runtime.authority(input.accessToken, reviewed.account, activation, 'send');
+            await verifyNativeYieldPlan(this.protocol(activation), reviewed.context.plan, reviewed.context.input, this.context(reviewed.context.plan, reviewed.context.maximumInputAtomic));
+            const op = this.store.begin(reviewed.userId, reviewed.operationId, input.planCommitment, input.reviewCommitment, fresh.authority);
+            return await this.advance(op, input.accessToken);
+        }
+        finally {
+            guard.release();
+        }
+    }
+    /** Separate explicit session action. It can only send a previously uncreated next step of this claimed review. */
+    async continueOperation(raw) {
+        const input = NATIVE_ACCOUNT_CONTINUE_INPUT.parse(raw), op = await this.owned(input.accessToken, input.operationId);
+        const guard = await this.guards.acquire('native', op.operationId);
+        try {
+            if (!op.reviewConsumed || ['completed', 'failed'].includes(op.state) || input.reviewCommitment !== op.context.reviewCommitment)
+                return refuseNative('NATIVE_REVIEW_REQUIRED', 'No current consumed review can be continued');
+            return await this.advance(op, input.accessToken);
+        }
+        finally {
+            guard.release();
+        }
+    }
+    async advance(initial, token) {
+        let op = initial;
+        try {
+            for (let index = 0; index < 3; index++) {
+                const existing = op.steps.find((s) => s.index === index);
+                if (existing) {
+                    if (uncertain(existing) || existing.state === 'reverted' || existing.state === 'not-submitted')
+                        return this.view(op); // Never regenerate a request, key or send for any existing step.
+                    await proveNativeYieldAccountTransaction(this.runtime.client(op.chainId), existing.request, existing.transactionHash, 'mined');
+                    continue;
+                }
+                if (op.steps.some((s) => s.index === 3))
+                    return this.view(op);
+                op = await this.sendStep(op, token, index);
+                const step = op.steps.find((s) => s.index === index);
+                if (step.state !== 'mined' && step.state !== 'confirmed')
+                    return this.view(op);
+            }
+            return this.view(await this.reconcileOwned(op));
+        }
+        catch (error) {
+            return this.view(this.store.attention(op.userId, op.operationId, errorCode(error)));
+        }
+    }
+    async sendStep(op, token, index) {
+        const recovery = index === 3, guarded = await this.guard(op, token, recovery), pub = this.runtime.client(op.chainId);
+        const step = recovery ? nativeYieldAllowanceRevocation(op.context.plan, this.context(op.context.plan, op.context.maximumInputAtomic), guarded.activation.deployments) : op.context.plan.steps[index];
+        const limits = gasLimits(guarded.limits.gasLimits);
+        const prepared = await prepareNativeYieldAccountTransaction(pub, { chainId: op.chainId, owner: getAddress(op.account),
+            step: { to: getAddress(step.to), data: step.data, value: '0' }, limits, nowMs: this.runtime.now });
+        const request = { userId: op.userId, address: op.account, network: prepared.network,
+            transaction: prepared.serializedTransaction, idempotencyKey: randomUUID() };
+        const priorCost = op.steps.filter((s) => s.state !== 'not-submitted').reduce((sum, s) => sum + BigInt(s.quote.estimatedTotalCostWei), 0n);
+        const operationBudget = BigInt(op.context.maximumOperationEstimatedCostWei) < BigInt(guarded.limits.gasLimits.maxOperationEstimatedCostWei)
+            ? BigInt(op.context.maximumOperationEstimatedCostWei) : BigInt(guarded.limits.gasLimits.maxOperationEstimatedCostWei);
+        if (priorCost + prepared.quote.estimatedTotalCostWei > operationBudget)
+            return refuseNative('NATIVE_GAS_BUDGET_EXCEEDED', 'The operation gas estimate exceeds the reviewed budget');
+        op = this.store.append(op.userId, op.operationId, { index, kind: ['approve_reset', 'approve', 'call', 'allowance_clear'][index],
+            state: 'prepared', request, requestDigest: nativeAccountDigest(request), quote: storedQuote(prepared.quote) });
+        try {
+            // Every awaited journal operation is behind us. Repeat account, policy, consent, valuation and protocol checks.
+            const final = await this.guard(op, token, recovery);
+            if (index === 2)
+                await simulateNativeYieldPlan(pub, this.protocol(final.activation), op.context.plan, op.context.input, this.context(op.context.plan, final.limits.maximumInputAtomic.toString()));
+            const freshQuote = await revalidateNativeYieldAccountTransaction(pub, prepared, gasLimits(final.limits.gasLimits), this.runtime.now);
+            if (priorCost + freshQuote.estimatedTotalCostWei > operationBudget ||
+                freshQuote.estimatedTotalCostWei > prepared.quote.estimatedTotalCostWei)
+                return refuseNative('NATIVE_GAS_BUDGET_CHANGED', 'Gas costs increased; the prepared request is not sent');
+            await this.runtime.assertCurrentSession(token, final.current.authority);
+            if (this.runtime.now() >= freshQuote.expiresAtMs)
+                return refuseNative('NATIVE_GAS_STALE', 'Gas evidence expired during authority checks');
+            if (!recovery) {
+                if (this.runtime.now() >= op.context.plan.deadline * 1000)
+                    return refuseNative('NATIVE_PLAN_EXPIRED', 'The reviewed plan expired before sending');
+                this.store.assertConsent(op, final.current.authority);
+            }
+        }
+        catch (error) {
+            this.store.evidence(op.userId, op.operationId, index, { state: 'not-submitted' });
+            return this.store.attention(op.userId, op.operationId, errorCode(error));
+        }
+        let hash;
+        try {
+            // Sole native SDK send. A lost response consumes the durable request; there is no retry call path.
+            hash = (await this.cdp.endUser.sendEvmTransaction({ ...request, transaction: request.transaction })).transactionHash;
+            if (!/^0x[0-9a-fA-F]{64}$/.test(hash))
+                throw new Error('NATIVE_SEND_UNKNOWN');
+        }
+        catch {
+            return this.store.evidence(op.userId, op.operationId, index, { state: 'unknown' });
+        }
+        op = this.store.evidence(op.userId, op.operationId, index, { state: 'submitted', transactionHash: hash });
+        try {
+            // A bounded receipt wait is convenience only. Timeout returns the durable hash for explicit reconciliation.
+            await pub.waitForTransactionReceipt({ hash: hash, timeout: 25_000, pollingInterval: 750, confirmations: 1 });
+            const receipt = await proveNativeYieldAccountTransaction(pub, request, hash, 'mined');
+            return this.store.evidence(op.userId, op.operationId, index, { state: receipt.status === 'success' ? 'mined' : 'reverted', receipt, finality: 'mined' });
+        }
+        catch {
+            return op;
+        }
+    }
+    async read(raw) {
+        const input = NATIVE_ACCOUNT_READ_INPUT.parse(raw), who = await this.runtime.identity(input.accessToken);
+        const ops = input.operationId ? [await this.owned(input.accessToken, input.operationId)] : this.store.list(who.userId);
+        return { schemaVersion: '1', operations: ops.filter((op) => who.accounts.includes(getAddress(op.account))).map((op) => this.view(op)) };
+    }
+    async reconcile(raw) {
+        const input = NATIVE_ACCOUNT_RECONCILE_INPUT.parse(raw), op = await this.owned(input.accessToken, input.operationId);
+        if (!op.reviewConsumed || ['completed', 'failed'].includes(op.state))
+            return this.view(op);
+        const guard = await this.guards.acquire('native', op.operationId);
+        try {
+            let current = this.store.read(op.userId, op.operationId);
+            for (const candidate of input.knownTransactions ?? []) {
+                const step = current.steps.find((s) => s.index === candidate.index);
+                if (!step || !['prepared', 'unknown', 'submitted'].includes(step.state))
+                    return refuseNative('NATIVE_EVIDENCE_INVALID', 'No unresolved request matches this evidence candidate');
+                // Uncertain response candidates must be FINAL before recording their hash; a pending guess cannot bind recovery.
+                const receipt = await proveNativeYieldAccountTransaction(this.runtime.client(op.chainId), step.request, candidate.transactionHash, 'finalized');
+                current = this.store.evidence(op.userId, op.operationId, step.index, { state: receipt.status === 'success' ? 'confirmed' : 'reverted', receipt, finality: 'finalized' });
+            }
+            return this.view(await this.reconcileOwned(current));
+        }
+        finally {
+            guard.release();
+        }
+    }
+    async reconcileOwned(op) {
+        const pub = this.runtime.client(op.chainId);
+        let allFinal = true;
+        for (const step of op.steps) {
+            if (step.state === 'not-submitted')
+                continue;
+            if (!step.transactionHash) {
+                allFinal = false;
+                continue;
+            }
+            try {
+                const receipt = await proveNativeYieldAccountTransaction(pub, step.request, step.transactionHash, 'finalized');
+                op = this.store.evidence(op.userId, op.operationId, step.index, { state: receipt.status === 'success' ? 'confirmed' : 'reverted', receipt, finality: 'finalized' });
+            }
+            catch {
+                allFinal = false;
+            }
+        }
+        if (!allFinal || op.steps.some(uncertain))
+            return op;
+        const activation = this.activation(op.chainId), call = op.steps.find((s) => s.index === 2);
+        if (call?.state === 'confirmed') {
+            const settlement = await readNativeYieldSettlement(pub, op.context.plan, call.transactionHash, activation.deployments);
+            if (settlement.status === 'completed')
+                return this.store.finish(op.userId, op.operationId, { state: 'completed', result: settlement });
+            return this.store.attention(op.userId, op.operationId, 'NATIVE_SETTLEMENT_UNPROVEN');
+        }
+        // Before releasing a failed/cancelled action, all possible sends must be final and its approval must be cleared.
+        if (!op.steps.some((s) => s.state === 'reverted' || s.state === 'not-submitted' || s.index === 3) &&
+            op.context.plan.deadline * 1000 > this.runtime.now())
+            return op;
+        const deployment = activation.deployments.find((d) => d.chainId === op.chainId);
+        if (!deployment || hybridYieldCommitment(deployment) !== hybridYieldCommitment(op.context.plan.deployment))
+            return op;
+        const block = await pub.getBlock({ blockTag: 'finalized' });
+        if (block.number === null || !block.hash)
+            return op;
+        const [allowance, code, canonical] = await Promise.all([
+            pub.readContract({ address: getAddress(op.context.plan.inputToken), abi: NATIVE_YIELD_ERC20_ABI, functionName: 'allowance',
+                args: [getAddress(op.account), getAddress(deployment.address)], blockNumber: block.number }),
+            pub.getCode({ address: getAddress(deployment.address), blockNumber: block.number }), pub.getBlock({ blockNumber: block.number }),
+        ]);
+        if (allowance !== 0n || !code || keccak256(code).toLowerCase() !== deployment.runtimeCodeHash.toLowerCase() ||
+            canonical.hash !== block.hash || await pub.getChainId() !== op.chainId)
+            return op;
+        return this.store.finish(op.userId, op.operationId, { state: 'failed', result: { status: 'closed-without-native-completion',
+                inputAllowance: '0', finalizedBlockNumber: block.number.toString(), retrySafe: false } });
+    }
+    async revokeAllowance(raw) {
+        const input = NATIVE_ACCOUNT_REVOKE_INPUT.parse(raw), op = await this.owned(input.accessToken, input.operationId);
+        if (!op.reviewConsumed || ['completed', 'failed'].includes(op.state) || input.revocationCommitment !== nativeAccountRevocationCommitment(op))
+            return refuseNative('NATIVE_REVOCATION_REVIEW_REQUIRED', 'Review the exact operation allowance clear');
+        const guard = await this.guards.acquire('native', op.operationId);
+        try {
+            const current = await this.reconcileOwned(op);
+            if (['completed', 'failed'].includes(current.state))
+                return this.view(current);
+            if (current.steps.some(uncertain) || current.steps.some((s) => s.index === 3))
+                return refuseNative('NATIVE_RECONCILIATION_REQUIRED', 'Resolve every uncertain send before changing this allowance');
+            for (const step of current.steps.filter((s) => s.transactionHash))
+                await proveNativeYieldAccountTransaction(this.runtime.client(op.chainId), step.request, step.transactionHash, 'finalized');
+            const result = await this.sendStep(current, input.accessToken, 3);
+            return this.view(await this.reconcileOwned(result));
+        }
+        finally {
+            guard.release();
+        }
+    }
+    view(op) {
+        const ambiguous = op.steps.some(uncertain), terminal = ['completed', 'failed'].includes(op.state);
+        return NATIVE_ACCOUNT_OPERATION_VIEW_SCHEMA.parse({ schemaVersion: '1', operationId: op.operationId, account: op.account, chainId: op.chainId,
+            marketId: op.context.plan.marketId, action: op.context.plan.action, state: op.state,
+            planCommitment: op.context.plan.planCommitment, reviewCommitment: op.context.reviewCommitment,
+            review: { amount: op.context.plan.amount, inputToken: op.context.plan.inputToken, minimumOutput: op.context.plan.minimumOutput,
+                outputToken: op.context.plan.outputToken, fee: op.context.plan.fee, deadline: op.context.plan.deadline,
+                maximumOperationEstimatedCostWei: op.context.maximumOperationEstimatedCostWei, isHardTotalGasCap: false },
+            steps: op.steps.map((s) => ({ index: s.index, kind: s.kind, state: s.state, ...(s.transactionHash ? { transactionHash: s.transactionHash } : {}),
+                costEstimate: s.quote, ...(s.receiptFinality ? { receiptFinality: s.receiptFinality } : {}), ...(s.receipt ? { receiptGasCostWei: (BigInt(s.receipt.gasUsed) * BigInt(s.receipt.effectiveGasPrice)).toString() } : {}) })),
+            continuationAvailable: !terminal && op.reviewConsumed && !ambiguous && op.context.plan.deadline * 1000 > this.runtime.now() &&
+                op.steps.length < 3 && op.steps.every((s) => ['mined', 'confirmed'].includes(s.state)),
+            allowanceRecovery: { reviewCommitment: nativeAccountRevocationCommitment(op), available: !terminal && op.reviewConsumed &&
+                    !ambiguous && !op.steps.some((s) => s.index === 3), requiresFreshSession: true },
+            ...(op.result !== undefined ? { actualSettlement: op.result } : {}), ...(op.failureCode ? { failureCode: op.failureCode } : {}),
+            automaticExecutionEnabled: false, retrySafe: false });
+    }
+}
+//# sourceMappingURL=native-yield-account.js.map

package/dist/native-yield-consent-store.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { type NativeYieldAccountAuthority, type NativeYieldAccountConsent } from './native-yield-account-definition.js';
+import { type ExecutionJournalDatabase } from './execution-journal-schema.js';
+declare const CONFIRM_INPUT: z.ZodObject<{
+    userId: z.ZodString;
+    consentId: z.ZodString;
+    consentCommitment: z.ZodString;
+}, z.core.$strict>;
+export type ConfirmNativeYieldConsentInput = z.infer<typeof CONFIRM_INPUT>;
+export declare function initializeNativeYieldConsents(db: ExecutionJournalDatabase): void;
+/** Authenticated subject lookup for challenge review/confirmation. History is evidence, not authority. */
+export declare function readNativeYieldConsent(db: ExecutionJournalDatabase, userId: string, consentId: string): NativeYieldAccountConsent | undefined;
+export declare function createNativeYieldConsent(db: ExecutionJournalDatabase, inputAuthority: NativeYieldAccountAuthority, nowMs: number): NativeYieldAccountConsent;
+export declare function confirmNativeYieldConsent(db: ExecutionJournalDatabase, rawInput: ConfirmNativeYieldConsentInput, inputAuthority: NativeYieldAccountAuthority, nowMs: number): NativeYieldAccountConsent;
+export declare function readConfirmedNativeYieldConsent(db: ExecutionJournalDatabase, userId: string, account: string, nowMs: number): NativeYieldAccountConsent | undefined;
+/** Read-only: safe inside the operation's claim transaction and again immediately before handoff. */
+export declare function assertCurrentNativeYieldConsent(db: ExecutionJournalDatabase, inputRecord: NativeYieldAccountConsent, inputAuthority: NativeYieldAccountAuthority, nowMs: number): void;
+/** Stop remains available while a money operation is unresolved; it never releases that operation's claim. */
+export declare function revokeNativeYieldConsent(db: ExecutionJournalDatabase, userId: string, account: string, nowMs: number): void;
+export {};