otto-intel-mcp 0.1.2 → 0.1.4

package/dist/native-yield-userop-account.js

@@ -0,0 +1,357 @@
+import { NATIVE_YIELD_USEROP_ACCOUNT_GAS_CONFIRMATION } from './native-yield-userop-definition.js';
+import { SPONSORED_GAS_REVIEW_INPUT } from './execution-sponsored-definition.js';
+import { accountGasBudgetPublicSchema, accountGasView, accountGasViewMatches, accountGasFailure, AccountGasConfirmationRefusal } from './execution-account-gas-view.js';
+/** Manual native UserOps use the shared sponsored claim, budget, transport and owned recovery rail. */
+import { getAddress } from 'viem';
+import { z } from 'zod';
+import { freezeHybridValue, hybridYieldCommitment } from './hybrid-yield-markets.js';
+import { NATIVE_ACCOUNT_CONSENT_SCHEMA, NATIVE_ACCOUNT_SCOPES } from './native-yield-account-definition.js';
+import { revokeNativeYieldConsent } from './native-yield-consent-store.js';
+import { PREPARE_NATIVE_YIELD_INPUT_SCHEMA, refuseNative } from './native-yield-definition.js';
+import { NATIVE_YIELD_USEROP_CONFIRMATION, NATIVE_YIELD_USEROP_SETTLEMENT_SCHEMA } from './native-yield-userop-definition.js';
+import { assertFreshVerifiedNativeYieldUserOp, assertNativeYieldUserOpEnvelope, nativeYieldUserOpCalls, nativeYieldUserOpRecordedCalls, prepareNativeYieldUserOp, verifyNativeYieldUserOp } from './native-yield-userop.js';
+import { simulateNativeYieldUserOp } from './native-yield-userop-simulation.js';
+import { readNativeYieldUserOpSettlement } from './native-yield-userop-settlement.js';
+import { assertNativeUserOpContext, NATIVE_USEROP_CONTEXT_SCHEMA } from './native-yield-userop-operation.js';
+import { readConfirmedSponsoredReceipt, SponsoredReceiptUnconfirmedError } from './execution-sponsored-receipt.js';
+const token = z.string().min(1).max(16_384);
+const address = z.string().regex(/^0x[0-9a-fA-F]{40}$/);
+const hash = z.string().regex(/^0x[0-9a-fA-F]{64}$/);
+const digest = z.string().regex(/^[0-9a-f]{64}$/);
+const commitment = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const atomicPattern = /^(0|[1-9][0-9]*)$/;
+const atomic = z.string().max(78).regex(atomicPattern)
+    .refine(value => atomicPattern.test(value) && value.length <= 78 && BigInt(value) < 2n ** 256n);
+const positive = atomic.refine(value => atomicPattern.test(value) && value.length <= 78 && BigInt(value) > 0n);
+const time = z.number().int().nonnegative().safe();
+const chain = z.union([z.literal(8453), z.literal(42161)]);
+const operationId = z.string().regex(/^sp_[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+const consentId = z.string().regex(/^nc_[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+const publicNativeInput = PREPARE_NATIVE_YIELD_INPUT_SCHEMA.extend({ amount: positive,
+    slippage: PREPARE_NATIVE_YIELD_INPUT_SCHEMA.shape.slippage.extend({ minOutput: positive.optional() }).strict(),
+}).strict();
+export const NATIVE_USEROP_ACCOUNT_PREPARE_INPUT = z.object({ accessToken: token, input: publicNativeInput }).strict();
+export const NATIVE_USEROP_ACCOUNT_CONSENT_REVIEW_INPUT = NATIVE_USEROP_ACCOUNT_PREPARE_INPUT;
+export const NATIVE_USEROP_ACCOUNT_CONSENT_CONFIRM_INPUT = NATIVE_USEROP_ACCOUNT_PREPARE_INPUT.extend({
+    consentId, consentCommitment: commitment, confirmation: z.literal('I reviewed the native yield scope and limits'),
+}).strict();
+export const NATIVE_USEROP_ACCOUNT_READ_INPUT = z.object({ accessToken: token, operationId }).strict();
+export const NATIVE_USEROP_ACCOUNT_SUBMIT_INPUT = NATIVE_USEROP_ACCOUNT_READ_INPUT.extend({
+    envelopeCommitment: commitment, reviewCommitment: digest, confirmation: z.enum([NATIVE_YIELD_USEROP_CONFIRMATION, NATIVE_YIELD_USEROP_ACCOUNT_GAS_CONFIRMATION]),
+}).strict();
+export const NATIVE_USEROP_ACCOUNT_REVOKE_CONSENT_INPUT = z.object({ accessToken: token, account: address }).strict();
+/** Keep the existing consent identity/state/times while removing its internal authority record. */
+export const NATIVE_USEROP_PUBLIC_CONSENT_SCHEMA = NATIVE_ACCOUNT_CONSENT_SCHEMA.omit({ authority: true }).extend({
+    account: address, chainId: chain,
+}).strict();
+export const NATIVE_USEROP_PUBLIC_SCOPE_SCHEMA = z.object({ account: address, chainId: chain,
+    scopes: z.array(z.enum(NATIVE_ACCOUNT_SCOPES)).length(5),
+    marketLimits: z.array(z.object({ marketId: z.string().min(1).max(120), action: z.enum(['deposit', 'withdraw']),
+        inputToken: address, maximumInputAtomic: positive }).strict()).min(1).max(12),
+    perDepositCapUsd: z.number().int().min(1).max(5000), maximumGasCostWei: positive,
+    maximumUserGasCostWei: positive, maximumActivationGasCostWei: positive, expiresAtMs: time,
+    requiresSeparateOperationReview: z.literal(true),
+}).strict();
+export const NATIVE_USEROP_ACCOUNT_CONSENT_RESULT = z.object({ schemaVersion: z.literal('1'),
+    kind: z.literal('native-yield-userop'), consent: NATIVE_USEROP_PUBLIC_CONSENT_SCHEMA,
+    scope: NATIVE_USEROP_PUBLIC_SCOPE_SCHEMA.optional(), requiresSeparateOperationReview: z.literal(true),
+    automaticExecutionEnabled: z.literal(false), walletAuthorityChangeIncluded: z.literal(false),
+}).strict().refine(value => value.consent.state !== 'challenge' || !!value.scope, 'A scope challenge must include its human review terms');
+export const NATIVE_USEROP_ACCOUNT_REVOKE_RESULT = z.object({ schemaVersion: z.literal('1'), kind: z.literal('native-yield-userop'),
+    account: address, nativeConsentRevoked: z.literal(true), existingOperationRequiresReconciliation: z.literal(true),
+    automaticExecutionEnabled: z.literal(false),
+}).strict();
+const publicSettlementBase = { blockNumber: atomic, owner: address, positionBalanceAtBlock: atomic,
+    assetBalanceAtBlock: atomic, routerNonceAtBlock: atomic, actualGasCostWei: positive, actualGasUsed: positive, paymaster: address };
+/** Public descriptors keep total numeric validation and contain no checksum transforms. */
+const publicSettlement = z.union([
+    NATIVE_YIELD_USEROP_SETTLEMENT_SCHEMA.options[0].extend({ ...publicSettlementBase,
+        actualInput: positive, actualOutput: positive, actualOttoFee: atomic, feeToken: address }).strict(),
+    NATIVE_YIELD_USEROP_SETTLEMENT_SCHEMA.options[1].extend(publicSettlementBase).strict(),
+]);
+export const NATIVE_USEROP_ACCOUNT_OPERATION_RESULT = z.object({ schemaVersion: z.literal('1'), kind: z.literal('native-yield-userop'),
+    operationId, account: address, chainId: chain, marketId: z.string().min(1).max(120), action: z.enum(['deposit', 'withdraw']),
+    state: z.enum(['review', 'active', 'unknown', 'submitted', 'completed', 'failed']), reviewConsumed: z.boolean(),
+    envelopeCommitment: commitment, reviewCommitment: digest, validUntilMs: time,
+    scopeConsent: z.object({ consentId, consentCommitment: commitment, generation: z.number().int().positive().safe() }).strict(),
+    input: z.object({ token: address, amount: positive }).strict(),
+    output: z.object({ token: address, minimum: positive }).strict(),
+    estimatedOttoFee: z.object({ token: address, amount: atomic }).strict(),
+    perDepositCapUsd: z.number().int().min(1).max(5000),
+    gas: accountGasBudgetPublicSchema(positive),
+    requiresOperationReview: z.boolean(), confirmation: z.enum([NATIVE_YIELD_USEROP_CONFIRMATION, NATIVE_YIELD_USEROP_ACCOUNT_GAS_CONFIRMATION]),
+    protocolActionVerified: z.boolean(), userOpHash: hash.optional(), transactionHash: hash.optional(),
+    settlement: publicSettlement.optional(), failureCode: z.enum([
+        'SPONSOR_NOT_SUBMITTED', 'SPONSOR_USER_OPERATION_REVERTED', 'SPONSOR_GAS_CAP_EXCEEDED',
+    ]).optional(),
+    attention: z.literal('The original provider request is unresolved. Read or reconcile this operation; do not submit a replacement.').optional(),
+    automaticExecutionEnabled: z.literal(false),
+    walletAuthorityChangeIncluded: z.literal(false), retrySafe: z.literal(false),
+}).strict().refine(value => accountGasViewMatches(value) && value.confirmation === (value.gas.payer === 'account' ? NATIVE_YIELD_USEROP_ACCOUNT_GAS_CONFIRMATION : NATIVE_YIELD_USEROP_CONFIRMATION) && value.requiresOperationReview === (value.state === 'review') &&
+    value.reviewConsumed === (value.state !== 'review') &&
+    value.protocolActionVerified === (value.settlement?.status === 'completed') &&
+    (value.state !== 'completed' || value.settlement?.status === 'completed') &&
+    (!value.settlement || (value.settlement.status === 'completed' ? value.state === 'completed' : value.state === 'failed')) &&
+    (!value.transactionHash || !!value.userOpHash) &&
+    (value.gas.payer !== 'sponsor' || !value.gas.activationChainHalted || (value.state === 'submitted' && value.failureCode === 'SPONSOR_GAS_CAP_EXCEEDED')), 'Native UserOp state must agree with its review and settlement proof');
+export function nativeYieldUserOpAccountView(operation) {
+    const { context } = operation, { plan, terms } = assertNativeYieldUserOpEnvelope(context.envelope);
+    return freezeHybridValue(NATIVE_USEROP_ACCOUNT_OPERATION_RESULT.parse({ schemaVersion: '1', kind: 'native-yield-userop',
+        operationId: operation.operationId, account: context.account, chainId: terms.chainId, marketId: plan.marketId, action: plan.action,
+        state: operation.state, reviewConsumed: operation.reviewConsumed, envelopeCommitment: context.envelope.commitment,
+        reviewCommitment: operation.reviewCommitment, validUntilMs: context.validUntilMs, scopeConsent: context.review.consent,
+        input: { token: plan.inputToken, amount: plan.amount }, output: { token: plan.outputToken, minimum: plan.minimumOutput },
+        estimatedOttoFee: { token: plan.fee.token, amount: plan.fee.amount },
+        perDepositCapUsd: Math.min(context.authority.perSwapCapUsd, context.activation.maxSwapUsdc),
+        gas: accountGasView(operation, { maximumCostWei: terms.maxGasCostWei,
+            maximumUserCostWei: terms.maxUserGasCostWei, maximumActivationCostWei: terms.maxTotalGasCostWei }),
+        requiresOperationReview: operation.state === 'review', confirmation: operation.gasReview?.payer === 'account' ? NATIVE_YIELD_USEROP_ACCOUNT_GAS_CONFIRMATION : NATIVE_YIELD_USEROP_CONFIRMATION,
+        protocolActionVerified: operation.settlement?.status === 'completed',
+        ...(operation.userOpHash ? { userOpHash: operation.userOpHash } : {}),
+        ...(operation.transactionHash ? { transactionHash: operation.transactionHash } : {}),
+        ...(operation.settlement ? { settlement: operation.settlement } : {}),
+        ...(operation.failureCode ? { failureCode: operation.failureCode } : {}),
+        ...(operation.state === 'unknown' && !operation.userOpHash
+            ? { attention: 'The original provider request is unresolved. Read or reconcile this operation; do not submit a replacement.' } : {}),
+        automaticExecutionEnabled: false, walletAuthorityChangeIncluded: false, retrySafe: false }));
+}
+function equal(left, right) { return hybridYieldCommitment(left) === hybridYieldCommitment(right); }
+function refuse(code) { return refuseNative(code, 'The native UserOp requires its current owner and exact reviewed terms'); }
+export class NativeYieldUserOpAccountService {
+    issuer;
+    protocols;
+    runtime;
+    store;
+    guards;
+    transport;
+    gasRuntime;
+    constructor(issuer, protocols, runtime, store, guards, transport, gasRuntime) {
+        this.issuer = issuer;
+        this.protocols = protocols;
+        this.runtime = runtime;
+        this.store = store;
+        this.guards = guards;
+        this.transport = transport;
+        this.gasRuntime = gasRuntime;
+    }
+    protocol(chainId) {
+        return this.protocols[chainId] ?? refuse('NATIVE_USEROP_CHAIN_UNAVAILABLE');
+    }
+    async owned(accessToken, id) {
+        let userId;
+        try {
+            userId = (await this.runtime.cdp.endUser.validateAccessToken({ accessToken })).userId;
+        }
+        catch {
+            return refuse('NATIVE_USEROP_SESSION_INVALID');
+        }
+        if (!/^[a-zA-Z0-9-]{1,100}$/.test(userId))
+            return refuse('NATIVE_USEROP_SESSION_INVALID');
+        const operation = this.store.read(userId, id), who = await this.runtime.identity(accessToken, operation.context.account);
+        if (who.userId !== operation.userId)
+            return refuse('NATIVE_USEROP_OWNER_MISMATCH');
+        return operation;
+    }
+    async reviewConsent(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_CONSENT_REVIEW_INPUT.parse(raw);
+        const { consent, scope } = await this.issuer.reviewConsent(input.accessToken, input.input);
+        const { authority, ...publicConsent } = consent;
+        return NATIVE_USEROP_ACCOUNT_CONSENT_RESULT.parse({ schemaVersion: '1', kind: 'native-yield-userop',
+            consent: { ...publicConsent, account: authority.account, chainId: input.input.accountProfile.chainId }, scope,
+            requiresSeparateOperationReview: true, automaticExecutionEnabled: false, walletAuthorityChangeIncluded: false });
+    }
+    createConsent(raw) { return this.reviewConsent(raw); }
+    async confirmConsent(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_CONSENT_CONFIRM_INPUT.parse(raw);
+        const consent = await this.issuer.confirmConsent(input.accessToken, input.input, { consentId: input.consentId, consentCommitment: input.consentCommitment });
+        const { authority, ...publicConsent } = consent;
+        return NATIVE_USEROP_ACCOUNT_CONSENT_RESULT.parse({ schemaVersion: '1', kind: 'native-yield-userop',
+            consent: { ...publicConsent, account: authority.account, chainId: input.input.accountProfile.chainId },
+            requiresSeparateOperationReview: true, automaticExecutionEnabled: false, walletAuthorityChangeIncluded: false });
+    }
+    async revokeConsent(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_REVOKE_CONSENT_INPUT.parse(raw), account = getAddress(input.account);
+        const who = await this.runtime.identity(input.accessToken, account);
+        revokeNativeYieldConsent(this.store.db, who.userId, account, this.runtime.now());
+        return NATIVE_USEROP_ACCOUNT_REVOKE_RESULT.parse({ schemaVersion: '1', kind: 'native-yield-userop', account,
+            nativeConsentRevoked: true, existingOperationRequiresReconciliation: true, automaticExecutionEnabled: false });
+    }
+    async prepare(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_PREPARE_INPUT.parse(raw);
+        this.store.assertReadyForNewOperations();
+        let authority = await this.issuer.mint(input.accessToken, input.input);
+        const envelope = await prepareNativeYieldUserOp(this.protocol(input.input.accountProfile.chainId), input.input, this.issuer.terms(authority));
+        authority = await this.issuer.refresh(input.accessToken, authority);
+        const context = NATIVE_USEROP_CONTEXT_SCHEMA.parse({ kind: 'native-yield-userop', account: envelope.terms.account,
+            chainId: envelope.terms.chainId, envelope, review: this.issuer.reviewRecord(authority),
+            authority: this.issuer.sponsorship(authority), activation: this.issuer.activation(authority),
+            reviewedAtMs: envelope.preparedAtMs, validUntilMs: envelope.validUntilMs });
+        const operation = this.store.transaction(() => {
+            this.issuer.assertConsent(authority);
+            assertNativeUserOpContext(context, true, this.runtime.now());
+            return this.store.create(context);
+        });
+        const guard = await this.guards.acquire('sponsored', operation.operationId, true);
+        guard.release();
+        if (context.activation.gasPaymentReviewEnabled) {
+            try {
+                return await this.reviewGas({ accessToken: input.accessToken,
+                    operationId: operation.operationId, reviewCommitment: operation.reviewCommitment, preference: 'auto' });
+            }
+            catch (error) {
+                return nativeYieldUserOpAccountView(this.store.recordGasReviewFailure(operation.userId, operation.operationId, accountGasFailure(error) ?? 'ACCOUNT_GAS_QUOTE_UNAVAILABLE'));
+            }
+        }
+        return nativeYieldUserOpAccountView(operation);
+    }
+    async reviewGas(raw) {
+        const input = SPONSORED_GAS_REVIEW_INPUT.extend({ operationId: NATIVE_USEROP_ACCOUNT_READ_INPUT.shape.operationId }).parse(raw), owned = await this.owned(input.accessToken, input.operationId);
+        const guard = await this.guards.acquire('sponsored', owned.operationId, false);
+        try {
+            const operation = this.store.read(owned.userId, owned.operationId);
+            if (!this.gasRuntime || (operation.state !== 'review' && !(operation.state === 'failed' && !operation.handoffAttempted && operation.failureCode === 'SPONSOR_NOT_SUBMITTED')))
+                return refuse('ACCOUNT_GAS_REVIEW_UNAVAILABLE');
+            const authority = await this.issuer.restoreFromTrustedReview(input.accessToken, operation.context.review);
+            this.assertCurrentReview(operation, authority);
+            const gasReview = await this.gasRuntime.review(operation, nativeYieldUserOpRecordedCalls(operation.context.envelope), input.preference);
+            return nativeYieldUserOpAccountView(this.store.reviewGas(operation.userId, operation.operationId, input.reviewCommitment, gasReview));
+        }
+        finally {
+            guard.release();
+        }
+    }
+    async read(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_READ_INPUT.parse(raw);
+        return nativeYieldUserOpAccountView(await this.owned(input.accessToken, input.operationId));
+    }
+    assertCurrentReview(operation, authority) {
+        if (!equal(this.issuer.reviewRecord(authority), operation.context.review) ||
+            !equal(this.issuer.terms(authority), operation.context.envelope.terms))
+            return refuse('NATIVE_USEROP_REVIEW_CHANGED');
+        assertNativeUserOpContext(operation.context, true, this.runtime.now());
+    }
+    async submit(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_SUBMIT_INPUT.parse(raw), owned = await this.owned(input.accessToken, input.operationId);
+        if (owned.state !== 'review' || owned.reviewConsumed || input.reviewCommitment !== owned.reviewCommitment ||
+            input.envelopeCommitment !== owned.context.envelope.commitment)
+            return refuse('NATIVE_USEROP_REVIEW_REQUIRED');
+        if (input.confirmation !== (owned.gasReview?.payer === 'account' ? NATIVE_YIELD_USEROP_ACCOUNT_GAS_CONFIRMATION : NATIVE_YIELD_USEROP_CONFIRMATION))
+            throw new AccountGasConfirmationRefusal();
+        const guard = await this.guards.acquire('sponsored', owned.operationId, false);
+        try {
+            // Only the authenticated stored row reaches restore; request-provided reviews/terms are rejected by the schema.
+            let authority = await this.issuer.restoreFromTrustedReview(input.accessToken, owned.context.review);
+            this.assertCurrentReview(owned, authority);
+            const protocol = this.protocol(owned.context.envelope.terms.chainId);
+            const simulation = await simulateNativeYieldUserOp(protocol, owned.context.envelope, this.issuer.terms(authority));
+            authority = await this.issuer.refresh(input.accessToken, authority);
+            this.assertCurrentReview(owned, authority);
+            const sponsorAuthority = this.issuer.sponsorship(authority);
+            this.store.transaction(() => {
+                this.store.begin(owned.userId, owned.operationId, input.reviewCommitment, sponsorAuthority);
+                this.issuer.assertConsent(authority);
+            });
+            let handoffProof;
+            let unattemptedRecordCommitment;
+            try {
+                const operation = this.store.read(owned.userId, owned.operationId);
+                unattemptedRecordCommitment = hybridYieldCommitment(operation);
+                const request = this.transport.prepare({ userId: operation.userId, account: operation.context.account,
+                    chainId: operation.context.chainId, idempotencyKey: operation.operationId.slice(3) }, nativeYieldUserOpCalls(simulation.verified), operation.gasReview?.payer ?? 'sponsor');
+                unattemptedRecordCommitment = hybridYieldCommitment(this.store.prepare(operation.userId, operation.operationId, request));
+                let verified;
+                let checkedGas;
+                const result = await this.transport.send(request, async () => {
+                    if (operation.context.activation.gasPaymentReviewEnabled && !this.gasRuntime)
+                        return refuse('ACCOUNT_GAS_REVIEW_UNAVAILABLE');
+                    checkedGas = await this.gasRuntime?.revalidate(operation, nativeYieldUserOpRecordedCalls(operation.context.envelope));
+                    // All public-chain and provider-authority awaits finish before the durable attempted stamp.
+                    verified = await verifyNativeYieldUserOp(protocol, operation.context.envelope, this.issuer.terms(authority));
+                    authority = await this.issuer.refresh(input.accessToken, authority);
+                    this.assertCurrentReview(operation, authority);
+                    assertFreshVerifiedNativeYieldUserOp(verified, this.runtime.now());
+                }, start => {
+                    handoffProof = this.store.attemptedWithProof(operation.userId, operation.operationId);
+                    return this.store.handoff(operation.userId, operation.operationId, () => {
+                        // Preserve journal -> caps lock order and the gas-circuit boundary. No await follows the stamp.
+                        this.issuer.assertConsent(authority);
+                        this.assertCurrentReview(operation, authority);
+                        return this.issuer.withCurrentCap(authority, () => {
+                            this.assertCurrentReview(operation, authority);
+                            if (!verified || !handoffProof)
+                                return refuse('NATIVE_USEROP_HANDOFF_UNVERIFIED');
+                            assertFreshVerifiedNativeYieldUserOp(verified, this.runtime.now());
+                            return start((gasPolicy) => {
+                                this.gasRuntime?.assertFresh(operation, nativeYieldUserOpRecordedCalls(operation.context.envelope), checkedGas, gasPolicy);
+                                this.store.consumeHandoffProof(handoffProof);
+                            });
+                        });
+                    });
+                });
+                this.store.acknowledged(operation.userId, operation.operationId, result);
+            }
+            catch (error) {
+                const current = this.store.read(owned.userId, owned.operationId);
+                if (current.state === 'active' && !current.handoffAttempted && !current.userOpHash && !current.transactionHash &&
+                    unattemptedRecordCommitment === hybridYieldCommitment(current))
+                    this.store.failBeforeHandoff(owned.userId, owned.operationId);
+                else if (handoffProof) {
+                    try {
+                        this.store.failUninvokedHandoff(handoffProof);
+                    }
+                    catch { /* Invoked, changed, restarted or uncertain journal state retains the original claim. */ }
+                }
+                const gasFailure = accountGasFailure(error);
+                if (gasFailure)
+                    this.store.recordGasReviewFailure(owned.userId, owned.operationId, gasFailure);
+                return nativeYieldUserOpAccountView(this.store.read(owned.userId, owned.operationId));
+            }
+            return await this.reconcileOwned(this.store.read(owned.userId, owned.operationId));
+        }
+        finally {
+            guard.release();
+        }
+    }
+    /** Owned recovery deliberately needs neither an active grant, unexpired review nor current sending authority. */
+    async reconcile(raw) {
+        const input = NATIVE_USEROP_ACCOUNT_READ_INPUT.parse(raw), operation = await this.owned(input.accessToken, input.operationId);
+        if (['review', 'completed', 'failed'].includes(operation.state))
+            return nativeYieldUserOpAccountView(operation);
+        const guard = await this.guards.acquire('sponsored', operation.operationId, false);
+        try {
+            return await this.reconcileOwned(this.store.read(operation.userId, operation.operationId));
+        }
+        finally {
+            guard.release();
+        }
+    }
+    async reconcileOwned(operation) {
+        if (!operation.handoffAttempted)
+            return nativeYieldUserOpAccountView(this.store.failBeforeHandoff(operation.userId, operation.operationId));
+        if (!operation.userOpHash)
+            return nativeYieldUserOpAccountView(operation);
+        try {
+            const calls = nativeYieldUserOpRecordedCalls(operation.context.envelope);
+            const acknowledgement = await this.runtime.readAcknowledgement(operation, calls);
+            operation = this.store.acknowledged(operation.userId, operation.operationId, acknowledgement);
+            if (!operation.transactionHash)
+                return nativeYieldUserOpAccountView(operation);
+            const { terms } = operation.context.envelope, client = this.runtime.client(terms.chainId);
+            const binding = { userOpHash: operation.userOpHash, transactionHash: operation.transactionHash };
+            const receipt = await readConfirmedSponsoredReceipt({ ...binding, chainId: terms.chainId, account: terms.account,
+                payer: operation.gasReview?.payer ?? 'sponsor', entryPoint: terms.entryPoint,
+                paymaster: operation.gasReview?.payer === 'account' ? '0x0000000000000000000000000000000000000000' : terms.paymaster, maxGasCostWei: BigInt(terms.maxGasCostWei) }, client);
+            const settlement = await readNativeYieldUserOpSettlement(operation.context.envelope, binding, client, operation.gasReview?.payer ?? 'sponsor');
+            // Reverted batches also need the native zero-allowance/nonce/account proof before claim release.
+            if (!settlement.releaseClaim)
+                return nativeYieldUserOpAccountView(this.store.read(operation.userId, operation.operationId));
+            return nativeYieldUserOpAccountView(this.store.finish(operation.userId, operation.operationId, receipt, settlement));
+        }
+        catch (error) {
+            if (error instanceof SponsoredReceiptUnconfirmedError && error.code === 'SPONSOR_GAS_CAP_EXCEEDED' && error.breachedReceipt)
+                return nativeYieldUserOpAccountView(this.store.recordGasCapBreach(operation.userId, operation.operationId, error.breachedReceipt));
+            return nativeYieldUserOpAccountView(this.store.read(operation.userId, operation.operationId));
+        }
+    }
+}
+//# sourceMappingURL=native-yield-userop-account.js.map

package/dist/native-yield-userop-authority.d.ts

@@ -0,0 +1,214 @@
+import { type LpUserOpActivation } from './lp-userop-definition.js';
+import { z } from 'zod';
+import { type SponsoredActivation, type SponsoredAuthority, type SponsoredChainTerms } from './execution-sponsored-definition.js';
+import { SponsoredAccountRuntime } from './execution-sponsored-runtime.js';
+import type { ExecutionJournalDatabase } from './execution-journal-schema.js';
+import { type NativeYieldAccountActivation, type NativeYieldAccountConsent } from './native-yield-account-definition.js';
+import { NativeYieldAccountRuntime } from './native-yield-account-runtime.js';
+import { type NativeYieldUserOpTerms } from './native-yield-userop-definition.js';
+declare const RELATION_SCHEMA: z.ZodObject<{
+    nativeActivationCommitment: z.ZodString;
+    nativeRulesDigest: z.ZodString;
+    compiledFullPolicyDigest: z.ZodString;
+    relationReviewEvidenceDigest: z.ZodString;
+    compiler: z.ZodLiteral<"legacy-v2-native-enduser-userop-v1">;
+}, z.core.$strict>;
+declare const PROFILE_SCHEMA: z.ZodObject<{
+    implementation: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+    implementationCodeHash: z.ZodString;
+    delegateBatchAbi: z.ZodLiteral<"coinbase-executeBatch-v1">;
+    delegateBatchReviewDigest: z.ZodString;
+    entryPointVersion: z.ZodLiteral<"0.6">;
+    ownerProfile: z.ZodObject<{
+        kind: z.ZodLiteral<"sole-eoa-owner">;
+        nextOwnerIndex: z.ZodLiteral<"1">;
+        ownerCount: z.ZodLiteral<"1">;
+        requireAccountAsOwner: z.ZodLiteral<true>;
+        spendPermissionsEnabled: z.ZodLiteral<false>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Source-only additions; neither is accepted from an MCP request. */
+export type NativeYieldUserOpPolicyRelation = z.infer<typeof RELATION_SCHEMA>;
+export type NativeYieldUserOpSourceProfile = z.infer<typeof PROFILE_SCHEMA>;
+export type NativeYieldUserOpSponsoredActivation = SponsoredActivation & {
+    nativeYieldUserOpPolicyRelation: NativeYieldUserOpPolicyRelation;
+    chains: (SponsoredChainTerms & {
+        nativeYieldUserOpProfile?: NativeYieldUserOpSourceProfile;
+    })[];
+};
+export { compileNativeYieldEndUserOperationPolicy } from './native-yield-userop-policy.js';
+export declare const NATIVE_YIELD_USEROP_REVIEW_RECORD_SCHEMA: z.ZodObject<{
+    input: z.ZodObject<{
+        accountProfile: z.ZodObject<{
+            kind: z.ZodLiteral<"eoa">;
+            address: z.ZodString;
+            chainId: z.ZodUnion<readonly [z.ZodLiteral<8453>, z.ZodLiteral<42161>]>;
+        }, z.core.$strict>;
+        marketId: z.ZodString;
+        registryCommitment: z.ZodString;
+        action: z.ZodEnum<{
+            deposit: "deposit";
+            withdraw: "withdraw";
+        }>;
+        amount: z.ZodString;
+        slippage: z.ZodObject<{
+            maxBps: z.ZodNumber;
+            minOutput: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        clientRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    terms: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        ruleset: z.ZodLiteral<"native-yield-userop-v1">;
+        userId: z.ZodString;
+        account: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        chainId: z.ZodUnion<readonly [z.ZodLiteral<8453>, z.ZodLiteral<42161>]>;
+        authorityDigest: z.ZodString;
+        nativeActivationCommitment: z.ZodString;
+        sponsoredActivationId: z.ZodString;
+        sponsoredActivationDigest: z.ZodString;
+        projectId: z.ZodString;
+        policyId: z.ZodString;
+        policyRulesDigest: z.ZodString;
+        providerEnforcementEvidenceDigest: z.ZodString;
+        providerEndpoint: z.ZodLiteral<"cdp-end-user-smart-account-send-v1">;
+        deployment: z.ZodObject<{
+            chainId: z.ZodUnion<readonly [z.ZodLiteral<8453>, z.ZodLiteral<42161>]>;
+            address: z.ZodString;
+            runtimeCodeHash: z.ZodString;
+            version: z.ZodLiteral<"native-yield-router-v1">;
+            reviewId: z.ZodString;
+        }, z.core.$strict>;
+        delegate: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        delegateCodeHash: z.ZodString;
+        implementation: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        implementationCodeHash: z.ZodString;
+        delegateBatchAbi: z.ZodLiteral<"coinbase-executeBatch-v1">;
+        delegateBatchReviewDigest: z.ZodString;
+        entryPoint: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        entryPointCodeHash: z.ZodString;
+        entryPointVersion: z.ZodLiteral<"0.6">;
+        ownerProfile: z.ZodObject<{
+            kind: z.ZodLiteral<"sole-eoa-owner">;
+            nextOwnerIndex: z.ZodLiteral<"1">;
+            ownerCount: z.ZodLiteral<"1">;
+            ownerAtIndex0: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            spendPermissionsEnabled: z.ZodLiteral<false>;
+        }, z.core.$strict>;
+        paymaster: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        paymasterCodeHash: z.ZodString;
+        sponsorshipPolicyId: z.ZodString;
+        maxGasCostWei: z.ZodString;
+        maxUserGasCostWei: z.ZodString;
+        maxTotalGasCostWei: z.ZodString;
+        maximumInputAtomic: z.ZodString;
+        intentCommitment: z.ZodString;
+        consentCreatedAtMs: z.ZodNumber;
+        consentExpiresAtMs: z.ZodNumber;
+        initialInputAllowance: z.ZodLiteral<"0">;
+        initialProtocolAllowance: z.ZodLiteral<"0">;
+        execution: z.ZodLiteral<"atomic-approve-reset-approve-execute">;
+    }, z.core.$strict>;
+    consent: z.ZodObject<{
+        consentId: z.ZodString;
+        generation: z.ZodNumber;
+        consentCommitment: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type NativeYieldUserOpReviewRecord = z.infer<typeof NATIVE_YIELD_USEROP_REVIEW_RECORD_SCHEMA>;
+declare const brand: unique symbol;
+/** The runtime accepts only objects minted by this issuer, never a structural cast or JSON. */
+export interface NativeYieldUserOpAuthority {
+    readonly [brand]: true;
+}
+export declare class NativeYieldUserOpAuthorityIssuer {
+    private readonly native;
+    private readonly sponsor;
+    private readonly db;
+    private readonly issued;
+    private readonly minted;
+    private readonly nativeActivations;
+    private readonly sponsorActivations;
+    private readonly lpActivations;
+    constructor(native: NativeYieldAccountRuntime, sponsor: SponsoredAccountRuntime, db: ExecutionJournalDatabase, 
+    /** Internal source fixtures only. The production constructor uses the two empty reviewed arrays. */
+    fixtures?: {
+        nativeActivations: readonly NativeYieldAccountActivation[];
+        sponsoredActivations: readonly NativeYieldUserOpSponsoredActivation[];
+        lpActivations?: readonly LpUserOpActivation[];
+    });
+    private now;
+    private sources;
+    private consentAuthority;
+    private assertValuation;
+    private window;
+    private derivedTerms;
+    private facts;
+    /** Fresh source-scope projection for human consent review, before an operation authority exists. */
+    reviewConsent(accessToken: string, rawInput: unknown): Promise<{
+        consent: {
+            consentId: string;
+            authority: {
+                userId: string;
+                account: string;
+                mintKey: string;
+                grantExpiresAt: string;
+                revokeGeneration: number;
+                capRulesetVersion: number;
+                perSwapCapUsd: number;
+                policyId: string;
+                policyName: "OTTO model b swap fence v3";
+                policyDigest: string;
+                legacyRulesDigest: string;
+                nativeRulesDigest: string;
+                activationCommitment: string;
+                scopeCommitment: string;
+                ruleset: "native-yield-account-v1";
+                scopes: ("deposit" | "withdraw" | "approve" | "approve-reset" | "revoke")[];
+            };
+            consentCommitment: string;
+            state: "challenge" | "confirmed" | "revoked" | "superseded";
+            generation: number;
+            createdAtMs: number;
+            challengeExpiresAtMs: number;
+            confirmedAtMs: number | null;
+        };
+        scope: {
+            account: string;
+            chainId: 8453 | 42161;
+            scopes: ("deposit" | "withdraw" | "approve" | "approve-reset" | "revoke")[];
+            marketLimits: {
+                marketId: string;
+                action: "deposit" | "withdraw";
+                inputToken: `0x${string}`;
+                maximumInputAtomic: string;
+            }[];
+            perDepositCapUsd: number;
+            maximumGasCostWei: string;
+            maximumUserGasCostWei: string;
+            maximumActivationGasCostWei: string;
+            expiresAtMs: number;
+            requiresSeparateOperationReview: true;
+        };
+    }>;
+    createConsent(accessToken: string, rawInput: unknown): Promise<NativeYieldAccountConsent>;
+    confirmConsent(accessToken: string, rawInput: unknown, confirmation: {
+        consentId: string;
+        consentCommitment: string;
+    }): Promise<NativeYieldAccountConsent>;
+    private issue;
+    mint(accessToken: string, rawInput: unknown): Promise<NativeYieldUserOpAuthority>;
+    private read;
+    /** Re-read after the shared journal stamp and after transport auth, immediately before POST. */
+    refresh(accessToken: string, authority: NativeYieldUserOpAuthority): Promise<NativeYieldUserOpAuthority>;
+    /** Internal journal recovery only. Never route raw MCP terms into this method. */
+    restoreFromTrustedReview(accessToken: string, rawStoredReview: unknown): Promise<NativeYieldUserOpAuthority>;
+    /** Must also run synchronously inside/after the caller's shared-journal stamp; performs no await. */
+    assertConsent(authority: NativeYieldUserOpAuthority): void;
+    /** Hold the current cap writer lock through the synchronous provider request invocation. */
+    withCurrentCap<T>(authority: NativeYieldUserOpAuthority, start: () => T): T;
+    terms(authority: NativeYieldUserOpAuthority): NativeYieldUserOpTerms;
+    reviewRecord(authority: NativeYieldUserOpAuthority): NativeYieldUserOpReviewRecord;
+    sponsorship(authority: NativeYieldUserOpAuthority): SponsoredAuthority;
+    activation(authority: NativeYieldUserOpAuthority): NativeYieldUserOpSponsoredActivation;
+}