otto-intel-mcp 0.1.3 → 0.1.4

package/dist/account-userop-policy-relation.js

@@ -0,0 +1,87 @@
+/** Pure source-policy relation for native yield plus same-account guarded LP collection. */
+import { getAddress } from 'viem';
+import { z } from 'zod';
+import { freezeHybridValue, hybridYieldCommitment } from './hybrid-yield-markets.js';
+import { policyRulesDigest } from './execution-policy-compatibility.js';
+import { compileNativeYieldEndUserOperationPolicy } from './native-yield-userop-policy.js';
+import { LP_USEROP_ACTIVATION_SCHEMA } from './lp-userop-definition.js';
+import { LP_V3_BASE } from './vendor/lp-v3/lp-v3-contract.js';
+import { LP_V3_ATOMIC_NPM_ABI, LP_V3_COLLECT_GUARD_ABI } from './vendor/lp-v3/lp-v3-atomic-contract.js';
+const digest = z.string().regex(/^[0-9a-f]{64}$/).refine(value => !/^0+$/.test(value));
+import { ACCOUNT_NATIVE_LP_USEROP_COMPILER, SPONSORED_LP_USEROP_POLICY_RELATION_SCHEMA } from './account-userop-policy-definition.js';
+export { ACCOUNT_NATIVE_LP_USEROP_COMPILER, SPONSORED_LP_USEROP_POLICY_RELATION_SCHEMA } from './account-userop-policy-definition.js';
+export class LpUserOpPolicyRefusal extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'LpUserOpPolicyRefusal';
+    }
+}
+function ensure(value, code) { if (!value)
+    throw new LpUserOpPolicyRefusal(code); }
+export function lpUserOpActivationCommitment(raw) {
+    return hybridYieldCommitment(LP_USEROP_ACTIVATION_SCHEMA.parse(raw));
+}
+/**
+ * Provider scope is per call: Base, zero native value, pinned NPM/guard, and only
+ * approve(guard, tokenId) or the guard's exact collect selector. The immutable
+ * guard enforces the caller/recipient, position, pair and atomic NFT cleanup.
+ * The host separately enforces exactly [approve, collect]. This provider rule
+ * cannot express batch cardinality/order; allowed subsets/repetitions remain a
+ * provider-authority residual, including a standalone approval to the guard.
+ * Tuple-parameter enforcement is not claimed. Provider acceptance and denial
+ * evidence remain an activation gate, independent of SDK schema parsing.
+ */
+export function compileLpCollectEndUserOperationRules(raw) {
+    const activation = LP_USEROP_ACTIVATION_SCHEMA.parse(raw);
+    const guard = getAddress(activation.guardDeployment.address), manager = getAddress(LP_V3_BASE.manager);
+    const approvalAbi = LP_V3_ATOMIC_NPM_ABI.filter(item => item.type === 'function' && item.name === 'approve');
+    const collectionAbi = LP_V3_COLLECT_GUARD_ABI.filter(item => item.type === 'function' && item.name === 'collect');
+    ensure(approvalAbi.length === 1 && collectionAbi.length === 1 && guard !== manager, 'LP_USEROP_POLICY_ABI_UNAVAILABLE');
+    return freezeHybridValue([{
+            action: 'accept', operation: 'sendEndUserOperation',
+            criteria: [
+                { type: 'evmNetwork', networks: ['base'], operator: 'in' },
+                { type: 'ethValue', ethValue: '0', operator: '<=' },
+                { type: 'evmAddress', addresses: [manager, guard], operator: 'in' },
+                { type: 'evmData', abi: [...approvalAbi, ...collectionAbi], conditions: [
+                        { function: 'approve', params: [{ name: 'to', operator: 'in', values: [guard] }] },
+                        { function: 'collect' },
+                    ] },
+            ],
+        }]);
+}
+export function compileNativeLpCollectEndUserOperationPolicy(nativeActivation, rawLpActivation) {
+    const native = compileNativeYieldEndUserOperationPolicy(nativeActivation);
+    const lpActivation = LP_USEROP_ACTIVATION_SCHEMA.parse(rawLpActivation);
+    ensure(lpActivation.nativeActivationCommitment === native.nativeActivationCommitment, 'LP_USEROP_NATIVE_ACTIVATION_RELATION');
+    const lpRules = compileLpCollectEndUserOperationRules(lpActivation), rules = [...native.body.rules, ...lpRules];
+    ensure(lpRules.length === 1 && rules.length <= 10, 'LP_USEROP_POLICY_RULE_LIMIT');
+    return freezeHybridValue({
+        body: { scope: 'project', description: native.body.description, rules },
+        compiler: ACCOUNT_NATIVE_LP_USEROP_COMPILER,
+        nativeCompiledPolicyDigest: native.compiledFullPolicyDigest,
+        nativeActivationCommitment: native.nativeActivationCommitment, nativeRulesDigest: native.nativeRulesDigest,
+        lpActivationCommitment: lpUserOpActivationCommitment(lpActivation), lpRulesDigest: policyRulesDigest(lpRules),
+        compiledFullPolicyDigest: policyRulesDigest(rules),
+    });
+}
+/** Preserve the existing native-only compiler proof; the new relation binds the augmented actual policy. */
+export function assertNativeLpCollectPolicyRelation(nativeActivation, sponsorActivation, lpActivation) {
+    const base = compileNativeYieldEndUserOperationPolicy(nativeActivation);
+    const compiled = compileNativeLpCollectEndUserOperationPolicy(nativeActivation, lpActivation);
+    const relation = SPONSORED_LP_USEROP_POLICY_RELATION_SCHEMA.parse(sponsorActivation.lpUserOpPolicyRelation);
+    const native = sponsorActivation.nativeYieldUserOpPolicyRelation;
+    ensure(native && native.compiler === base.compiler &&
+        native.nativeActivationCommitment === base.nativeActivationCommitment &&
+        native.nativeRulesDigest === base.nativeRulesDigest && native.compiledFullPolicyDigest === base.compiledFullPolicyDigest &&
+        digest.safeParse(native.relationReviewEvidenceDigest).success, 'LP_USEROP_NATIVE_POLICY_RELATION');
+    const { relationReviewEvidenceDigest: _reviewEvidence, ...derived } = relation;
+    const { body: _body, ...expected } = compiled;
+    ensure(hybridYieldCommitment(derived) === hybridYieldCommitment(expected) &&
+        sponsorActivation.policyId === nativeActivation.policyId && sponsorActivation.policyName === nativeActivation.policyName &&
+        sponsorActivation.policyRulesDigest === compiled.compiledFullPolicyDigest, 'LP_USEROP_COMPOSITE_POLICY_RELATION');
+    return compiled;
+}
+//# sourceMappingURL=account-userop-policy-relation.js.map

package/dist/adapter/cdp-signer.d.ts

@@ -41,6 +41,31 @@ export interface CdpEndUser {
     readonly userId: string;
     readonly address: Address;
 }
+export interface DelegatedSubmissionAttempt {
+    readonly index: number;
+    readonly kind: 'approve_reset' | 'approve' | 'call' | 'allowance_clear';
+    readonly userId: string;
+    readonly address: Address;
+    readonly transaction: Hex;
+    readonly network: typeof NETWORK;
+}
+export interface DelegatedSubmissionReceipt {
+    readonly transactionHash: Hex;
+    readonly status: 'success' | 'reverted';
+    readonly blockNumber: string;
+    readonly blockHash: Hex;
+    readonly gasUsed: string;
+}
+/** Durable observer used by the hosted delegated path. Its prepare call must commit before it resolves. */
+export interface DelegatedSubmissionJournal {
+    prepare(attempt: DelegatedSubmissionAttempt): Promise<{
+        readonly idempotencyKey: string;
+    }>;
+    notSubmitted(index: number, idempotencyKey: string): Promise<void>;
+    submitted(index: number, idempotencyKey: string, transactionHash: Hex): Promise<void>;
+    unknown(index: number, idempotencyKey: string): Promise<void>;
+    receipt(index: number, idempotencyKey: string, receipt: DelegatedSubmissionReceipt): Promise<void>;
+}
 /** The PUBLIC face of a rig: chain reads, delegation read-back, revocation. No submission surface. */
 export interface CdpRig {
     readonly pub: PublicClient;
@@ -58,7 +83,7 @@ export interface CdpRig {
 export interface CdpRawOperations {
     readonly pub: PublicClient;
     /** Sign + broadcast an unsigned serialized EIP-1559 transaction under the user's delegation. Returns the tx hash. */
-    submit(user: CdpEndUser, unsignedTransaction: Hex): Promise<Hex>;
+    submit(user: CdpEndUser, unsignedTransaction: Hex, idempotencyKey?: string): Promise<Hex>;
     revoke(userId: string): Promise<void>;
     readDelegation(userId: string): Promise<{
         expiresAt: string;
@@ -80,9 +105,11 @@ export type DelegatedHaltCause = 'policy_violation' | 'delegation_not_active' |
 /** The node could not estimate a later step (timeout, rate limit, transport); nothing more was broadcast. */
  | 'estimate_unavailable' | 'receipt_not_sealed' | 'upstream_failure';
 /**
- * A delegated plan halted; `cause` is the structured class above, `allowanceCleared` says whether the
- * router allowance is known to be zero again. The message is for the operator; a consumer that must not
- * relay upstream text reads `cause` and the two fields only.
+ * A delegated plan halted; `cause` is the structured class above. `allowanceCleared` reports only
+ * whether the bounded cleanup's live, unpinned allowance read returned zero. It is diagnostic and is
+ * never sufficient to release a durable operation claim; finalized-canonical recovery owns that proof.
+ * The message is for the operator; a consumer that must not relay upstream text reads `cause` and the
+ * two fields only.
  */
 export declare class DelegatedPlanHaltedError extends Error {
     readonly failedStep: number;
@@ -147,6 +174,7 @@ export declare class CdpDelegatedSigner {
         readonly afterBuild?: () => Promise<void>;
         readonly beforeSubmit?: () => void;
         readonly grantExpiresAt?: string;
+        readonly submissionJournal?: DelegatedSubmissionJournal;
     });
     get address(): Address;
     get user(): CdpEndUser;

package/dist/adapter/cdp-signer.js

@@ -34,6 +34,15 @@ import { assertPlanSignableBy } from './verify.js';
 export const CDP_CAPABILITIES = Object.freeze(['send_evm_transaction']);
 export const CHAIN_ID = 8453;
 export const NETWORK = 'base';
+/** Internal proof that a step failed before the raw CDP submission function was entered. */
+class DelegatedPreHandoffError extends Error {
+    original;
+    constructor(original) {
+        super('delegated step refused before the CDP hand-off');
+        this.original = original;
+        this.name = 'DelegatedPreHandoffError';
+    }
+}
 const RAW = new WeakMap();
 /** One lifecycle lock PER RIG — shared by every signer over it and by the rig's own public `revoke`. */
 const LOCKS = new WeakMap();
@@ -67,9 +76,11 @@ function serializedOn(rig, operation) {
     return run;
 }
 /**
- * A delegated plan halted; `cause` is the structured class above, `allowanceCleared` says whether the
- * router allowance is known to be zero again. The message is for the operator; a consumer that must not
- * relay upstream text reads `cause` and the two fields only.
+ * A delegated plan halted; `cause` is the structured class above. `allowanceCleared` reports only
+ * whether the bounded cleanup's live, unpinned allowance read returned zero. It is diagnostic and is
+ * never sufficient to release a durable operation claim; finalized-canonical recovery owns that proof.
+ * The message is for the operator; a consumer that must not relay upstream text reads `cause` and the
+ * two fields only.
  */
 export class DelegatedPlanHaltedError extends Error {
     failedStep;
@@ -192,8 +203,14 @@ export async function openCdpRig(credentials, rpcUrl) {
         throw new Error(`RPC reports chainId ${chainId}, expected ${CHAIN_ID} (Base mainnet)`);
     return createCdpRig({
         pub,
-        submit: async (user, transaction) => {
-            const result = await cdp.endUser.sendEvmTransaction({ userId: user.userId, address: user.address, transaction, network: NETWORK });
+        submit: async (user, transaction, idempotencyKey) => {
+            const result = await cdp.endUser.sendEvmTransaction({
+                userId: user.userId,
+                address: user.address,
+                transaction,
+                network: NETWORK,
+                ...(idempotencyKey ? { idempotencyKey } : {}),
+            });
             return result.transactionHash;
         },
         revoke: async (userId) => {
@@ -330,6 +347,7 @@ export class CdpDelegatedSigner {
      */
     #afterBuild;
     #beforeSubmit;
+    #submissionJournal;
     constructor(rig, user, options = {}) {
         const raw = RAW.get(rig);
         if (!raw)
@@ -342,6 +360,7 @@ export class CdpDelegatedSigner {
         this.#afterBuild = options.afterBuild;
         this.#beforeSubmit = options.beforeSubmit;
         this.#grantExpiresAt = options.grantExpiresAt;
+        this.#submissionJournal = options.submissionJournal;
     }
     get address() {
         return this.#user.address;
@@ -353,28 +372,70 @@ export class CdpDelegatedSigner {
      * Assemble the unsigned transaction from chain reads, run `beforeSubmit` (the plan's freshness /
      * binding re-check, AFTER the RPC round trips and immediately before the hand-off), then submit.
      */
-    async #submit(step, beforeSubmit) {
-        // A plan step (it carries `beforeSubmit`) refuses on a reverting estimate; the halt path's clear does not.
-        const transaction = await buildUnsignedTransaction(this.#raw.pub, this.#user.address, step, beforeSubmit ? { kind: 'refuse', stepKind: step.kind ?? 'plan' } : { kind: 'allowance_clear' });
-        /**
-         * 🔴 THE AUTHORITATIVE RE-READ, AFTER CONSTRUCTION. A revoke or a narrower re-mint that landed while
-         * the nonce, fees and gas were being fetched is visible here and nowhere earlier.
-         *
-         * 🔴 AND ONLY FOR A PLAN STEP. `beforeSubmit` is passed by `sendPlan` and by nothing else, so it is
-         * the signal that this submission is part of the plan. The halt path's `approve(spender, 0)` goes
-         * out through this same method WITHOUT it, and it must never be gated: the clear is the safety
-         * action that runs precisely BECAUSE something went wrong, including the grant changing under it.
-         * Refusing to clear an allowance because the permission that opened it has gone is the one outcome
-         * nobody wants.
-         */
-        if (beforeSubmit) {
-            await this.#afterBuild?.();
-            beforeSubmit();
-            // …and the caller's own last word, synchronous, on what that re-read just found. Nothing is
-            // awaited between here and the hand-off, because an await is the window this exists to close.
-            this.#beforeSubmit?.();
+    async #submit(step, beforeSubmit, journalStep) {
+        let idempotencyKey;
+        let handedToCdp = false;
+        try {
+            // A plan step (it carries `beforeSubmit`) refuses on a reverting estimate; the halt path's clear does not.
+            // The build and journal prepare are inside this boundary: both are provably before the raw hand-off.
+            const transaction = await buildUnsignedTransaction(this.#raw.pub, this.#user.address, step, beforeSubmit ? { kind: 'refuse', stepKind: step.kind ?? 'plan' } : { kind: 'allowance_clear' });
+            if (this.#submissionJournal) {
+                if (!journalStep)
+                    throw new Error('a journaled submission needs a stable step identity');
+                ({ idempotencyKey } = await this.#submissionJournal.prepare({
+                    index: journalStep.index,
+                    kind: journalStep.kind,
+                    userId: this.#user.userId,
+                    address: this.#user.address,
+                    transaction,
+                    network: NETWORK,
+                }));
+            }
+            /**
+             * 🔴 THE AUTHORITATIVE RE-READ, AFTER CONSTRUCTION. A revoke or a narrower re-mint that landed while
+             * the nonce, fees and gas were being fetched is visible here and nowhere earlier.
+             *
+             * 🔴 AND ONLY FOR A PLAN STEP. `beforeSubmit` is passed by `sendPlan` and by nothing else, so it is
+             * the signal that this submission is part of the plan. The halt path's `approve(spender, 0)` goes
+             * out through this same method WITHOUT it, and it must never be gated: the clear is the safety
+             * action that runs precisely BECAUSE something went wrong, including the grant changing under it.
+             * Refusing to clear an allowance because the permission that opened it has gone is the one outcome
+             * nobody wants.
+             */
+            if (beforeSubmit) {
+                // The journal write above is asynchronous. Re-read authority AFTER it, so the final synchronous
+                // checks still stand immediately beside the CDP hand-off rather than before a database wait.
+                await this.#afterBuild?.();
+                beforeSubmit();
+                this.#beforeSubmit?.();
+            }
+            handedToCdp = true;
+            const hash = await this.#raw.submit(this.#user, transaction, idempotencyKey);
+            if (this.#submissionJournal && idempotencyKey && journalStep)
+                await this.#submissionJournal.submitted(journalStep.index, idempotencyKey, hash);
+            return Object.freeze({ hash, ...(idempotencyKey ? { idempotencyKey } : {}) });
+        }
+        catch (error) {
+            if (this.#submissionJournal && idempotencyKey && journalStep) {
+                try {
+                    if (handedToCdp)
+                        await this.#submissionJournal.unknown(journalStep.index, idempotencyKey);
+                    else
+                        await this.#submissionJournal.notSubmitted(journalStep.index, idempotencyKey);
+                }
+                catch {
+                    // The durable row already remains unresolved. Never replace the causal refusal with a journal
+                    // cleanup error, and never retry CDP to compensate for a local write failure.
+                }
+            }
+            // `handedToCdp` flips immediately before entering the raw submission function. While it is false,
+            // zero requests are a local fact, independent of the error class (build, journal, authority recheck,
+            // or any other pre-handoff failure). Preserve that fact for step 0 so no cleanup transaction creates
+            // the first ambiguous request.
+            if (!handedToCdp)
+                throw new DelegatedPreHandoffError(error);
+            throw error;
         }
-        return this.#raw.submit(this.#user, transaction);
     }
     /**
      * Fail-closed: once revocation was requested for THE GRANT THIS PLAN IS BOUND TO, nothing more is
@@ -413,36 +474,55 @@ export class CdpDelegatedSigner {
                     await this.#beforeEachStep?.();
                 }
                 catch (error) {
+                    // Before step 0 no transaction has been built, journaled, or handed to CDP. Propagate the
+                    // refusal directly so the caller's zero-step finalizer can release the exact claim. Trying an
+                    // allowance clear here would create the first ambiguous request under a grant that may already
+                    // have been revoked, turning provable no-send into an unnecessary unknown operation.
+                    if (index === 0)
+                        throw error;
                     throw await this.#halt(plan, index, `plan no longer signable before step ${index}: ${error instanceof Error ? error.message : String(error)}`, haltCauseOf(error));
                 }
                 let hash;
                 let receipt;
                 try {
-                    hash = await this.#submit(step, () => {
+                    const submitted = await this.#submit(step, () => {
                         this.#assertNotRevoked();
                         assertPlanSignableBy(plan, this, Date.now());
-                    });
+                    }, { index, kind: step.kind });
+                    hash = submitted.hash;
                     await this.#raw.pub.waitForTransactionReceipt({ hash }); // first sight (may be a preconfirmation) …
                     // … then only the SEALED, CANONICAL receipt counts: the next step is estimated against sealed state,
                     // and a preconfirmation omitted from the sealed block is never reported as success.
                     receipt = await waitForSealedReceipt(this.#raw.pub, hash, this.#sealedWait);
+                    if (this.#submissionJournal && submitted.idempotencyKey) {
+                        await this.#submissionJournal.receipt(index, submitted.idempotencyKey, {
+                            transactionHash: hash,
+                            status: receipt.status,
+                            blockNumber: receipt.blockNumber.toString(),
+                            blockHash: receipt.blockHash,
+                            gasUsed: receipt.gasUsed.toString(),
+                        });
+                    }
                 }
                 catch (error) {
+                    const cause = error instanceof DelegatedPreHandoffError ? error.original : error;
+                    if (index === 0 && error instanceof DelegatedPreHandoffError)
+                        throw cause;
                     /**
                      * 🔴 A REVERTING ESTIMATE BEFORE THE FIRST STEP IS A REFUSAL, NOT A HALT. Nothing of this plan has
                      * reached the chain, so there is no allowance of ours to clear and no reason to spend the user's gas
                      * on a clear; the caller gets the typed reason and may prepare again. From step 1 on, an earlier step
                      * has landed (an allowance may stand), so the halt path runs and the cause is `would_revert`.
                      */
-                    if ((error instanceof DelegatedTransactionWouldRevertError ||
-                        error instanceof DelegatedTransactionEstimateUnavailableError) &&
+                    if ((cause instanceof DelegatedTransactionWouldRevertError ||
+                        cause instanceof DelegatedTransactionEstimateUnavailableError) &&
                         index === 0) {
-                        throw error;
+                        throw cause;
                     }
                     // The CAUSE is classified from the error's structure (`haltCauseOf`); the message carries the upstream
                     // text for the operator and is never what a consumer classifies on.
-                    const errorType = error.errorType;
-                    throw await this.#halt(plan, index, `delegated step ${index} (${step.kind}) failed: ${typeof errorType === 'string' && errorType ? `${errorType} | ` : ''}${error instanceof Error ? error.message : String(error)}`, haltCauseOf(error));
+                    const errorType = cause.errorType;
+                    throw await this.#halt(plan, index, `delegated step ${index} (${step.kind}) failed: ${typeof errorType === 'string' && errorType ? `${errorType} | ` : ''}${cause instanceof Error ? cause.message : String(cause)}`, haltCauseOf(cause));
                 }
                 if (receipt.status !== 'success') {
                     throw await this.#halt(plan, index, `delegated step ${index} (${step.kind}) reverted on-chain: ${hash}`, 'reverted');
@@ -462,21 +542,32 @@ export class CdpDelegatedSigner {
     }
     /**
      * After ANY failure: attempt `approve(spender, 0)` under the delegation, then READ the allowance back.
-     * `allowanceCleared` is true only when the read-back is zero — a mined clear whose read-back is not
-     * zero, a reverted clear, a failed submission or a failed read all report false with the hand-off.
+     * `allowanceCleared` is true only when the live read-back is zero — a mined clear whose read-back is
+     * not zero, a reverted clear, a failed submission or a failed read all report false with the hand-off.
+     * This is operator context, not finality or durable-claim release evidence.
      */
     async #halt(plan, failedStep, message, cause) {
         const handOff = `clear approve(${plan.spender}, 0) on ${plan.token} BEFORE revoking the delegation`;
         let hash;
         try {
-            hash = await this.#submit({
+            const submitted = await this.#submit({
                 to: plan.token,
                 value: 0n,
                 data: encodeFunctionData({ abi: ERC20_APPROVE_ABI, functionName: 'approve', args: [plan.spender, 0n] }),
-            });
+            }, undefined, { index: 3, kind: 'allowance_clear' });
+            hash = submitted.hash;
             await this.#raw.pub.waitForTransactionReceipt({ hash });
             // The read-back below must see the clear: only its sealed canonical receipt counts.
             const clearReceipt = await waitForSealedReceipt(this.#raw.pub, hash, this.#sealedWait);
+            if (this.#submissionJournal && submitted.idempotencyKey) {
+                await this.#submissionJournal.receipt(3, submitted.idempotencyKey, {
+                    transactionHash: hash,
+                    status: clearReceipt.status,
+                    blockNumber: clearReceipt.blockNumber.toString(),
+                    blockHash: clearReceipt.blockHash,
+                    gasUsed: clearReceipt.gasUsed.toString(),
+                });
+            }
             if (clearReceipt.status !== 'success') {
                 return new DelegatedPlanHaltedError(`${message}; allowance clear ${hash} reverted — ${handOff}`, failedStep, false, cause, hash);
             }

package/dist/adapter-cdp-index.d.ts

@@ -3,4 +3,4 @@
  * `@coinbase/cdp-sdk` is an optional dependency loaded lazily inside `openCdpRig`; importing this
  * entry never resolves the SDK, and a rig built from raw operations (`createCdpRig`) never needs it.
  */
-export { CDP_CAPABILITIES, CHAIN_ID, CdpDelegatedSigner, DelegatedPlanHaltedError, NETWORK, RevocationRequestedError, createCdpRig, haltCauseOf, openCdpRig, revocationRequested, revokeDelegationByUserId, type CdpDeveloperCredentials, type DelegatedHaltCause, type CdpEndUser, type CdpRawOperations, type CdpRig, } from './adapter/cdp-signer.js';
+export { CDP_CAPABILITIES, CHAIN_ID, CdpDelegatedSigner, DelegatedPlanHaltedError, NETWORK, RevocationRequestedError, createCdpRig, haltCauseOf, openCdpRig, revocationRequested, revokeDelegationByUserId, type CdpDeveloperCredentials, type DelegatedHaltCause, type CdpEndUser, type CdpRawOperations, type CdpRig, type DelegatedSubmissionAttempt, type DelegatedSubmissionJournal, type DelegatedSubmissionReceipt, } from './adapter/cdp-signer.js';

package/dist/execution-account-gas-quote.d.ts

@@ -0,0 +1,141 @@
+import { type PublicClient } from 'viem';
+import { z } from 'zod';
+declare const callsSchema: z.ZodArray<z.ZodObject<{
+    to: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+    data: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+    value: z.ZodString;
+}, z.core.$strict>>;
+declare const bindingSchema: z.ZodObject<{
+    account: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+    chainId: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<8453>, z.ZodLiteral<42161>, z.ZodLiteral<10>, z.ZodLiteral<137>]>;
+    entryPoint: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+    calls: z.ZodArray<z.ZodObject<{
+        to: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        data: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+        value: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const priceSchema: z.ZodObject<{
+    amountAtomic: z.ZodString;
+    decimals: z.ZodNumber;
+    observedAtMs: z.ZodNumber;
+    expiresAtMs: z.ZodNumber;
+}, z.core.$strict>;
+declare const sponsorSchema: z.ZodObject<{
+    paymaster: z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>;
+    sponsorshipPolicyId: z.ZodString;
+}, z.core.$strict>;
+export type AccountGasQuoteCall = z.input<typeof callsSchema>[number];
+export type AccountGasQuoteBinding = Omit<z.input<typeof bindingSchema>, 'calls'> & {
+    calls: readonly AccountGasQuoteCall[];
+};
+export type AccountGasQuoteUsdPrice = z.input<typeof priceSchema>;
+/** The block anchor covers balance, deposit and nonce only. The bundler estimate has no block parameter. */
+export declare const ACCOUNT_GAS_QUOTE_SCHEMA: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"estimate">;
+    payer: z.ZodLiteral<"user">;
+    account: z.ZodString;
+    chainId: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<8453>, z.ZodLiteral<42161>, z.ZodLiteral<10>, z.ZodLiteral<137>]>;
+    entryPoint: z.ZodString;
+    nativeAsset: z.ZodObject<{
+        symbol: z.ZodEnum<{
+            ETH: "ETH";
+            POL: "POL";
+        }>;
+        decimals: z.ZodLiteral<18>;
+    }, z.core.$strict>;
+    callsCommitment: z.ZodString;
+    nonce: z.ZodString;
+    blockNumber: z.ZodString;
+    blockHash: z.ZodString;
+    blockTimestampMs: z.ZodNumber;
+    observedAtMs: z.ZodNumber;
+    expiresAtMs: z.ZodNumber;
+    simulation: z.ZodLiteral<"sender-balance-override">;
+    providerEstimate: z.ZodObject<{
+        blockAnchor: z.ZodLiteral<"unanchored">;
+        startedAtMs: z.ZodNumber;
+        completedAtMs: z.ZodNumber;
+        elapsedMs: z.ZodNumber;
+    }, z.core.$strict>;
+    gas: z.ZodObject<{
+        callGasLimit: z.ZodString;
+        verificationGasLimit: z.ZodString;
+        preVerificationGas: z.ZodString;
+        maxFeePerGasWei: z.ZodString;
+        maxPriorityFeePerGasWei: z.ZodString;
+        estimatedPrefundWei: z.ZodString;
+        reserveWei: z.ZodString;
+        estimatedRequiredWei: z.ZodString;
+        reserveBps: z.ZodLiteral<"2500">;
+    }, z.core.$strict>;
+    balance: z.ZodObject<{
+        nativeWei: z.ZodString;
+        entryPointDepositWei: z.ZodString;
+        callValueWei: z.ZodString;
+        depositAppliedToGasWei: z.ZodString;
+        walletGasRequirementWei: z.ZodString;
+        nativeAvailableForGasWei: z.ZodString;
+        gasShortfallWei: z.ZodString;
+        requiredNativeWei: z.ZodString;
+        shortfallWei: z.ZodString;
+    }, z.core.$strict>;
+    usdPrice: z.ZodOptional<z.ZodObject<{
+        amountAtomic: z.ZodString;
+        decimals: z.ZodNumber;
+        observedAtMs: z.ZodNumber;
+        expiresAtMs: z.ZodNumber;
+    }, z.core.$strict>>;
+    estimatedGasCostUsdMicros: z.ZodOptional<z.ZodString>;
+    sponsoredEstimate: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"estimate">;
+        simulation: z.ZodLiteral<"paymaster-stub">;
+        entryPointVersion: z.ZodLiteral<"0.6">;
+        paymaster: z.ZodString;
+        sponsorshipPolicyId: z.ZodString;
+        paymasterAndDataCommitment: z.ZodString;
+        providerEstimate: z.ZodObject<{
+            blockAnchor: z.ZodLiteral<"unanchored">;
+            startedAtMs: z.ZodNumber;
+            completedAtMs: z.ZodNumber;
+            elapsedMs: z.ZodNumber;
+        }, z.core.$strict>;
+        gas: z.ZodObject<{
+            callGasLimit: z.ZodString;
+            verificationGasLimit: z.ZodString;
+            preVerificationGas: z.ZodString;
+            maxFeePerGasWei: z.ZodString;
+            maxPriorityFeePerGasWei: z.ZodString;
+            verificationGasMultiplier: z.ZodLiteral<"3">;
+            estimatedPrefundWei: z.ZodString;
+            reserveWei: z.ZodString;
+            estimatedRequiredWei: z.ZodString;
+            reserveBps: z.ZodLiteral<"2500">;
+        }, z.core.$strict>;
+        estimatedGasCostUsdMicros: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AccountGasQuote = z.infer<typeof ACCOUNT_GAS_QUOTE_SCHEMA>;
+export declare class AccountGasQuoteError extends Error {
+    readonly code = "ACCOUNT_GAS_QUOTE_UNAVAILABLE";
+    constructor(message?: string);
+}
+export declare function accountGasCallsCommitment(calls: readonly AccountGasQuoteCall[]): string;
+export interface PrepareAccountGasQuoteInput extends AccountGasQuoteBinding {
+    client: PublicClient;
+    /** Operator-configured Pimlico endpoint. Kept out of quotes, hashes and errors. */
+    paymasterUrl: string;
+    fetch?: typeof globalThis.fetch;
+    nowMs?: () => number;
+    monotonicNowMs?: () => number;
+    /** Optional separately sourced advisory USD price. Missing means unavailable, never zero. */
+    usdPrice?: AccountGasQuoteUsdPrice;
+    /** Already reviewed source activation identity, never selected by the end user. */
+    sponsor?: z.input<typeof sponsorSchema>;
+}
+/** No signer, paymaster sponsorship, submission, account authority or account code reads. */
+export declare function prepareAccountGasQuote(input: PrepareAccountGasQuoteInput): Promise<AccountGasQuote>;
+/** Call synchronously at request start. Persisted copies retain wall-clock expiry but no process-local clock proof. */
+export declare function assertFreshAccountGasQuote(value: AccountGasQuote, input: AccountGasQuoteBinding, nowMs?: number): void;
+export {};