@ai-digital-factory/lmt-cli 0.1.1 → 0.1.3

package/dist/index.js

@@ -15,13 +15,15 @@ var __export = (target, all) => {
 };
 
 // ../../packages/contracts/src/index.ts
-var OPERATOR_SESSION_EXPIRY_TRACE_GRACE_SECONDS, OPERATOR_SESSION_EXPIRY_WARNING_MS, DEFAULT_OPERATOR_SESSION_IDLE_HINT_SECONDS, API_PATHS;
+var OPERATOR_SESSION_EXPIRY_TRACE_GRACE_SECONDS, OPERATOR_SESSION_EXPIRY_WARNING_MS, DEFAULT_OPERATOR_SESSION_IDLE_HINT_SECONDS, ZERODHA_SESSION_ADMISSION_HEADER, ZERODHA_SESSION_ADMISSION_VERIFY, API_PATHS;
 var init_src = __esm({
   "../../packages/contracts/src/index.ts"() {
     "use strict";
     OPERATOR_SESSION_EXPIRY_TRACE_GRACE_SECONDS = 24 * 60 * 60;
     OPERATOR_SESSION_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
     DEFAULT_OPERATOR_SESSION_IDLE_HINT_SECONDS = 7 * 24 * 60 * 60;
+    ZERODHA_SESSION_ADMISSION_HEADER = "x-lmt-session-admission";
+    ZERODHA_SESSION_ADMISSION_VERIFY = "verify";
     API_PATHS = {
       health: "/api/health",
       unlockOperatorSession: "/api/operator-session/unlock",
@@ -37,6 +39,7 @@ var init_src = __esm({
       cancelOperatorLogin: "/api/operators/login/cancel",
       zerodhaCredentials: "/api/zerodha/credentials",
       entryCategorySettings: "/api/settings/entry-categories",
+      operatorSettings: "/api/settings",
       marketProtectionSettings: "/api/settings/market-protection",
       operatorEgress: "/api/operator-egress",
       validateInstrument: "/api/instruments/validate",
@@ -48,6 +51,7 @@ var init_src = __esm({
       previousInstruments: "/api/market-watch/previous-instruments",
       candleHistoryLatest: "/api/candle-history/latest",
       candleHistoryExport: "/api/candle-history/export",
+      candleExportOnDemand: "/api/candle-history/export/on-demand",
       candleHistoryExportShare: "/api/candle-history/export/share",
       candleHistory: "/api/candle-history",
       zerodhaHistoricalCandles: "/api/zerodha/historical-candles",
@@ -111,7 +115,7 @@ function transportErrorDetail(error) {
   }
   return error.message;
 }
-async function requestOrThrow(request, unavailableMessage, signal, targetUrl) {
+async function requestOrThrow(request, unavailableMessage, signal, targetUrl, secrets = []) {
   try {
     return await request();
   } catch (error) {
@@ -119,7 +123,7 @@ async function requestOrThrow(request, unavailableMessage, signal, targetUrl) {
     if (error instanceof OperatorSessionRejectedError || error instanceof ZerodhaLoginAttemptUnavailableError) throw error;
     const detail = transportErrorDetail(error);
     const at = targetUrl ? ` [${targetUrl}]` : "";
-    throw new Error(detail ? `${unavailableMessage} (${detail})${at}` : `${unavailableMessage}${at}`);
+    throw new Error(redactSecrets(detail ? `${unavailableMessage} (${detail})${at}` : `${unavailableMessage}${at}`, secrets));
   }
 }
 function responseCookies(response) {
@@ -170,10 +174,18 @@ function parseEventFrame(frame) {
   } catch {
     throw new Error("Origin returned an invalid Zerodha login update.");
   }
-  if (!event || typeof event !== "object" || !("type" in event)) {
+  if (!event || typeof event !== "object" || !("type" in event) || typeof event.attemptId !== "string" || !event.attemptId || "message" in event && typeof event.message !== "string" || event.type === "status" && (event.operatorId !== "OPERATOR_1" && event.operatorId !== "OPERATOR_2" || !["loading", "awaiting_otp", "succeeded", "failed"].includes(event.status) || event.failedOtpAttempts !== void 0 && (!Number.isInteger(event.failedOtpAttempts) || event.failedOtpAttempts < 0)) || event.type === "attempt_error" && (!["login_attempt_cancelled", "login_attempt_expired", "login_attempt_not_found"].includes(event.error) || typeof event.message !== "string") || event.type !== "status" && event.type !== "attempt_error") {
     throw new Error("Origin returned an invalid Zerodha login update.");
   }
-  return event;
+  if (event.type === "attempt_error") return { type: event.type, attemptId: event.attemptId, error: event.error, message: event.message };
+  return {
+    type: event.type,
+    attemptId: event.attemptId,
+    operatorId: event.operatorId,
+    status: event.status,
+    ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
+    ...event.message === void 0 ? {} : { message: event.message }
+  };
 }
 function createGateApi(origin, fetchImpl = fetch, options = {}) {
   let cookies = { ...options.cookies ?? {} };
@@ -189,8 +201,7 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
     return AbortSignal.any(present);
   }
   function sessionSecrets() {
-    if (!cookies.operatorSessionCookie) return [];
-    return [cookies.operatorSessionCookie, cookies.operatorSessionCookie.slice(cookies.operatorSessionCookie.indexOf("=") + 1)];
+    return [cookies.operatorSessionCookie, cookies.clientIdentityCookie].filter((cookie) => Boolean(cookie)).flatMap((cookie) => [cookie, cookie.slice(cookie.indexOf("=") + 1)]);
   }
   function headers(extra) {
     const result = new Headers(extra);
@@ -223,7 +234,7 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
       throw new OperatorSessionRejectedError(rejectionReason(body));
     }
   }
-  async function postJson(path4, body, explicitSignal) {
+  async function postJson(path4, body, explicitSignal, secrets = []) {
     const signal = actionSignal(explicitSignal);
     const url = `${origin}${path4}`;
     const response = await requestOrThrow(
@@ -235,33 +246,44 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
       }),
       "Could not reach the selected Live Market Terminal Origin.",
       signal,
-      url
+      url,
+      [...sessionSecrets(), ...otpValues, ...secrets]
     );
     rememberCookies(response);
     await rejectAbsentSession(response, path4);
     return response;
   }
-  async function getJson(path4, explicitSignal) {
+  async function getJson(path4, explicitSignal, extraHeaders) {
     const signal = actionSignal(explicitSignal);
     const url = `${origin}${path4}`;
     const response = await requestOrThrow(
       () => fetchImpl(url, {
         method: "GET",
-        headers: headers({ accept: "application/json" }),
+        headers: headers({ accept: "application/json", ...extraHeaders }),
         cache: "no-store",
         ...signal ? { signal } : {}
       }),
       "Could not reach the selected Live Market Terminal Origin.",
       signal,
-      url
+      url,
+      [...sessionSecrets(), ...otpValues]
     );
     rememberCookies(response);
     await rejectAbsentSession(response, path4);
     return response;
   }
   const api = {
+    async exportCandles(request) {
+      const response = await postJson(API_PATHS.candleExportOnDemand, request);
+      const body = await readJson(response);
+      if (!response.ok || !body || !("url" in body) || typeof body.url !== "string" || !("filename" in body)) {
+        throw new Error(messageFromBody(body, "Could not publish Candle Export.", sessionSecrets()));
+      }
+      return body;
+    },
     setActionSignal(signal) {
       actionDeadlineSignal = signal;
+      if (!signal) otpValues.clear();
     },
     setCookies(next) {
       cookies = { ...next };
@@ -276,7 +298,7 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
       return { ...metadata };
     },
     async unlock(username, password, signal) {
-      const response = await postJson(API_PATHS.unlockOperatorSession, { username, password }, signal);
+      const response = await postJson(API_PATHS.unlockOperatorSession, { username, password }, signal, [username, password]);
       const body = await readJson(response);
       if (!response.ok || !body || !("operatorSession" in body) || body.operatorSession !== "present") {
         if (body && typeof body === "object" && "error" in body && body.error === "incorrect_credentials") {
@@ -366,8 +388,9 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
         "Could not reach the selected Origin to start Login with Zerodha."
       );
       const body = await readJson(response);
-      if (!response.ok || !body || !("status" in body) || body.status !== "started" || typeof body.attemptId !== "string") {
-        throw new Error(messageFromBody(body, "Could not start Login with Zerodha.", sessionSecrets()));
+      if (!response.ok || !body || typeof body !== "object" || !("status" in body) || body.status !== "started" || typeof body.attemptId !== "string") {
+        const code = body && typeof body === "object" && "error" in body && typeof body.error === "string" && ["zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(body.error) ? body.error : void 0;
+        throw Object.assign(new Error(messageFromBody(body, "Could not start Login with Zerodha.", sessionSecrets())), code ? { code } : {});
       }
       otpValues.clear();
       return { attemptId: body.attemptId, operatorId: body.operatorId };
@@ -379,9 +402,9 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
         "Could not reach the selected Origin to submit the OTP."
       );
       const body = await readJson(response);
-      if (!response.ok || !body || !("status" in body) || body.status !== "loading") {
+      if (!response.ok || !body || typeof body !== "object" || !("status" in body) || body.status !== "loading") {
         const message = messageFromBody(body, "Could not submit the Zerodha OTP.", [...sessionSecrets(), ...otpValues]);
-        if (body && "error" in body && (body.error === "login_attempt_not_found" || body.error === "login_attempt_expired")) {
+        if (body && typeof body === "object" && "error" in body && (body.error === "login_attempt_not_found" || body.error === "login_attempt_expired")) {
           throw new ZerodhaLoginAttemptUnavailableError(message);
         }
         throw new Error(message);
@@ -415,12 +438,22 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
           throw new Error(message);
         }
         const reader = response.body.getReader();
+        const cancelReader = () => {
+          void reader.cancel().catch(() => void 0);
+        };
+        requestSignal.addEventListener("abort", cancelReader, { once: true });
         const decoder = new TextDecoder();
         let buffer = "";
         let completed = false;
         try {
           while (!requestSignal.aborted) {
-            const { done, value } = await reader.read();
+            let chunk;
+            try {
+              chunk = await reader.read();
+            } catch {
+              break;
+            }
+            const { done, value } = chunk;
             buffer += decoder.decode(value, { stream: !done });
             let boundary = buffer.search(/\r?\n\r?\n/);
             while (boundary >= 0) {
@@ -450,6 +483,7 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
             if (done) break;
           }
         } finally {
+          requestSignal.removeEventListener("abort", cancelReader);
           await reader.cancel().catch(() => void 0);
         }
         if (completed || requestSignal.aborted) return;
@@ -458,12 +492,13 @@ function createGateApi(origin, fetchImpl = fetch, options = {}) {
     },
     async confirmZerodhaSession() {
       const response = await requestOrThrow(
-        () => getJson(API_PATHS.zerodhaSession),
+        () => getJson(API_PATHS.zerodhaSession, void 0, { [ZERODHA_SESSION_ADMISSION_HEADER]: ZERODHA_SESSION_ADMISSION_VERIFY }),
         "Could not verify the Zerodha Session with the selected Origin."
       );
       const body = await readJson(response);
-      if (!response.ok || !body || !("zerodhaSession" in body) || body.zerodhaSession !== "present") {
-        throw new Error(messageFromBody(body, "Zerodha Session is not present on the Broker.", sessionSecrets()));
+      if (!response.ok || !body || typeof body !== "object" || !("zerodhaSession" in body) || body.zerodhaSession !== "present") {
+        const code = body && typeof body === "object" && "error" in body && body.error === "zerodha_session_restoring" ? "verification" in body && body.verification === "unavailable" ? "zerodha_verification_unavailable" : "zerodha_session_restoring" : body && typeof body === "object" && "error" in body && body.error === "zerodha_session_absent" ? "zerodha_session_absent" : "zerodha_verification_unavailable";
+        throw Object.assign(new Error(messageFromBody(body, "Zerodha Session is not present on the Broker.", sessionSecrets())), { code });
       }
       return body;
     }
@@ -515,6 +550,112 @@ var init_gate_api = __esm({
   }
 });
 
+// src/action-deadline.ts
+function withinActionDeadline(operation, signal, deadlineMessage) {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(new Error(deadlineMessage));
+    if (signal.aborted) {
+      void operation.catch(() => void 0);
+      abort();
+      return;
+    }
+    signal.addEventListener("abort", abort, { once: true });
+    operation.then(
+      (value) => {
+        signal.removeEventListener("abort", abort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", abort);
+        reject(error);
+      }
+    );
+  });
+}
+var init_action_deadline = __esm({
+  "src/action-deadline.ts"() {
+    "use strict";
+  }
+});
+
+// src/zerodha-actions.ts
+async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp, options = {}) {
+  const started = Date.now();
+  let observedState;
+  let observedOperator2;
+  api.setActionSignal?.(signal);
+  try {
+    if (signal.aborted) throw new Error("Zerodha login observation exceeded its deadline.");
+    if (action === "status") {
+      const session = await withinActionDeadline(api.confirmZerodhaSession(), signal, "Zerodha login observation exceeded its deadline.");
+      if (session.operatorId && session.operatorId !== operatorId) throw new Error("Origin returned an unexpected Zerodha Session Operator.");
+      return { status: "succeeded", observedState: "present", ...session.operatorId ? { observedOperator: session.operatorId } : {}, elapsedMs: Date.now() - started };
+    }
+    if (action === "login") {
+      const attempt = await withinActionDeadline(api.startLogin(), signal, "Zerodha login observation exceeded its deadline.");
+      attemptId = attempt.attemptId;
+      if (attempt.operatorId !== operatorId) throw new Error("Zerodha login reached an unexpected Operator.");
+    }
+    if (!attemptId) throw new Error("Zerodha login requires an attempt identifier.");
+    if (action === "otp") {
+      if (!otp) throw new Error("Zerodha OTP input is required.");
+      await withinActionDeadline(api.submitOtp(attemptId, otp), signal, "Zerodha login observation exceeded its deadline.");
+    }
+    const observer = new AbortController();
+    const observationSignal = AbortSignal.any([signal, observer.signal]);
+    let result;
+    try {
+      await withinActionDeadline(api.watchLoginAttempt(attemptId, (event) => {
+        if (observer.signal.aborted || signal.aborted) return;
+        if (event.attemptId !== attemptId || event.type === "status" && event.operatorId !== operatorId) {
+          throw new Error("Origin returned an unexpected Zerodha login attempt.");
+        }
+        if (event.type === "status") {
+          observedState = event.status;
+          observedOperator2 = event.operatorId;
+        }
+        options.onObservation?.(event);
+        if (event.type === "status" && (event.status === "awaiting_otp" || event.status === "succeeded")) {
+          result = {
+            status: event.status,
+            attemptId,
+            observedOperator: observedOperator2,
+            observedState,
+            ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
+            ...event.message ? { message: event.message } : {}
+          };
+          observer.abort();
+        }
+      }, observationSignal), observationSignal, "Zerodha login observation exceeded its deadline.");
+    } catch (error) {
+      if (!observer.signal.aborted || !result) throw error;
+    }
+    if (signal.aborted || !result) throw new Error("Zerodha login observation exceeded its deadline.");
+    if (result.status === "succeeded") {
+      const session = await withinActionDeadline(api.confirmZerodhaSession(), signal, "Zerodha login observation exceeded its deadline.");
+      if (session.operatorId && session.operatorId !== operatorId) throw new Error("Origin returned an unexpected Zerodha Session Operator.");
+    }
+    return { ...result, elapsedMs: Date.now() - started };
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : new Error("Zerodha action failed.");
+    Object.assign(error, {
+      ...attemptId ? { attemptId, recovery: "Observe this exact attempt with the same target and profile; start explicitly only if Gate reports it inactive." } : {},
+      ...observedState ? { observedState } : {},
+      ...observedOperator2 ? { observedOperator: observedOperator2 } : {},
+      elapsedMs: Date.now() - started
+    });
+    throw error;
+  } finally {
+    api.setActionSignal?.();
+  }
+}
+var init_zerodha_actions = __esm({
+  "src/zerodha-actions.ts"() {
+    "use strict";
+    init_action_deadline();
+  }
+});
+
 // src/credential-app.tsx
 var credential_app_exports = {};
 __export(credential_app_exports, {
@@ -581,6 +722,24 @@ __export(app_exports, {
 import { useEffect, useRef, useState as useState2 } from "react";
 import { Box as Box2, Text as Text2, useInput as useInput2 } from "ink";
 import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function formatZerodhaValidationReport(report) {
+  return [
+    "Scenario: zerodha-session",
+    `Outcome: ${report.outcome}`,
+    `Reason: ${report.reason}`,
+    `Target: ${report.target.environment} ${report.target.origin}`,
+    `Profile: ${report.profile}`,
+    `Observed Operator: ${report.observedOperator ?? "not observed"}`,
+    `Observed state: ${report.observedState ?? "not observed"}`,
+    `Attempt: ${report.attemptId ?? "not observed"}`,
+    `Elapsed: ${report.elapsedMs} ms`,
+    `Request ID: ${report.requestId ?? "unavailable"}`,
+    `Build ID: ${report.buildId ?? "unavailable"}`,
+    ...report.failedOtpAttempts === void 0 ? [] : [`Failed OTP attempts: ${report.failedOtpAttempts}`],
+    ...report.message ? [report.message] : [],
+    ...report.nextStep ? [`Next step: ${report.nextStep}`] : []
+  ].join("\n");
+}
 function formatValidationReport(report) {
   const lines = [
     `Outcome: ${report.outcome}`,
@@ -603,14 +762,18 @@ function formatValidationReport(report) {
   }
   return lines.join("\n");
 }
-function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperatorActivity, onStatus, onValidate, onLogout }) {
+function LoginApp({ api, expectedOperatorId = "OPERATOR_1", actionTimeoutMs = 3e4, onResumeSession, onReportOperatorActivity, onStatus, onValidate, onValidateZerodha, onLogout }) {
   const [step, setStep] = useState2(onResumeSession ? "checking" : "username");
   const [username, setUsername] = useState2("");
   const [password, setPassword] = useState2("");
   const [otp, setOtp] = useState2("");
+  const [progress, setProgress] = useState2(null);
   const [error, setError] = useState2("");
   const [menuMessage, setMenuMessage] = useState2("");
   const [validationReport, setValidationReport] = useState2(null);
+  const [zerodhaValidationReport, setZerodhaValidationReport] = useState2(null);
+  const [resumeAttemptInput, setResumeAttemptInput] = useState2("");
+  const validatingZerodha = useRef(false);
   const [selectedMenuIndex, setSelectedMenuIndex] = useState2(0);
   const attemptId = useRef(null);
   const watcher = useRef(null);
@@ -695,80 +858,105 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
       setStep("username");
     }
   }
-  function applyLoginEvent(event, signal) {
-    if (signal.aborted) return;
-    if (event.type === "attempt_error") return;
-    if (event.status === "awaiting_otp") {
-      setError(event.message ?? "");
+  function applyLoginEvent(event, signal, action) {
+    if (signal.aborted || event.type !== "status") return;
+    attemptId.current = event.attemptId;
+    setProgress({
+      status: event.status === "succeeded" ? "succeeded" : "awaiting_otp",
+      attemptId: event.attemptId,
+      observedState: event.status,
+      observedOperator: event.operatorId,
+      ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts }
+    });
+    if (event.status === "loading") setStep(action === "login" ? "waiting" : "verifying");
+  }
+  async function runLoginAction(action, controller, code) {
+    try {
+      const result = await runZerodhaAction(
+        api,
+        action,
+        expectedOperatorId,
+        controller.signal,
+        action === "otp" ? attemptId.current ?? void 0 : void 0,
+        code,
+        { onObservation: (event) => applyLoginEvent(event, controller.signal, action) }
+      );
+      if (controller.signal.aborted) return;
+      attemptId.current = result.attemptId ?? null;
+      setProgress(result);
       setOtp("");
-      setStep("otp");
-      return;
-    }
-    if (event.status === "loading") {
-      setStep("verifying");
+      if (result.status === "awaiting_otp") {
+        setError(result.message ?? "");
+        setStep("otp");
+      } else {
+        clearZerodhaLoginDeadline(controller);
+        setStep("success");
+      }
+    } catch (cause) {
+      if (controller.signal.aborted) return;
+      clearZerodhaLoginDeadline(controller);
+      setOtp("");
+      const recovery = cause;
+      if (recovery?.attemptId) attemptId.current = recovery.attemptId;
+      setError(`${cause instanceof Error ? cause.message : "Login with Zerodha failed."}${recovery?.attemptId ? ` Attempt: ${recovery.attemptId}. ${recovery.recovery ?? "Observe this exact attempt with the same target and profile."}` : ""}`);
+      setStep(cause instanceof OperatorSessionRejectedError ? "username" : "menu");
     }
   }
   async function beginLogin() {
+    validatingZerodha.current = false;
+    setZerodhaValidationReport(null);
     setError("");
+    setProgress(null);
+    attemptId.current = null;
     setStep("starting");
     const controller = new AbortController();
     watcher.current?.abort();
     watcher.current = controller;
-    api.setActionSignal?.(controller.signal);
     const timer = setTimeout(() => {
       if (zerodhaLoginDeadline.current?.controller !== controller) return;
       controller.abort();
       clearZerodhaLoginDeadline(controller);
-      setError("Login with Zerodha exceeded its deadline.");
+      setOtp("");
+      setError(`Login with Zerodha exceeded its deadline.${attemptId.current ? ` Observe attempt ${attemptId.current} with the same target and profile.` : ""}`);
       setStep("menu");
     }, actionTimeoutMs);
     zerodhaLoginDeadline.current = { controller, timer };
-    try {
-      const login = await api.startLogin();
-      if (controller.signal.aborted) return;
-      attemptId.current = login.attemptId;
-      setStep("waiting");
-      void api.watchLoginAttempt(login.attemptId, (event) => applyLoginEvent(event, controller.signal), controller.signal).then(async () => {
-        if (controller.signal.aborted) return;
-        await api.confirmZerodhaSession();
-        if (!controller.signal.aborted) {
-          clearZerodhaLoginDeadline(controller);
-          setStep("success");
-        }
-      }).catch((cause) => {
-        if (controller.signal.aborted) return;
-        clearZerodhaLoginDeadline(controller);
-        setError(cause instanceof Error ? cause.message : "Login with Zerodha failed.");
-        setStep("menu");
-      });
-    } catch (cause) {
-      if (controller.signal.aborted) return;
-      clearZerodhaLoginDeadline(controller);
-      setError(cause instanceof Error ? cause.message : "Could not start Login with Zerodha.");
-      setStep("menu");
-    }
+    await runLoginAction("login", controller);
   }
   async function submitOtp() {
     if (!/^\d{6}$/.test(otp)) {
       setError("Enter the 6-digit Zerodha OTP.");
       return;
     }
-    if (!attemptId.current) {
+    if (!attemptId.current || !watcher.current || watcher.current.signal.aborted) {
+      setOtp("");
       setError("The Zerodha login attempt is no longer active.");
       setStep("menu");
       return;
     }
+    const code = otp;
+    setOtp("");
     setError("");
     setStep("verifying");
-    try {
-      await api.submitOtp(attemptId.current, otp);
-      if (watcher.current?.signal.aborted) return;
-      setOtp("");
-    } catch (cause) {
-      if (watcher.current?.signal.aborted) return;
-      setError(cause instanceof Error ? cause.message : "Could not submit the Zerodha OTP.");
-      setStep("otp");
-    }
+    if (validatingZerodha.current) await runValidation(watcher.current, attemptId.current, code);
+    else await runLoginAction("otp", watcher.current, code);
+  }
+  function checkZerodhaSession() {
+    setError("");
+    setMenuMessage("");
+    setStep("checking");
+    const controller = new AbortController();
+    watcher.current = controller;
+    const timer = setTimeout(() => controller.abort(), actionTimeoutMs);
+    void runZerodhaAction(api, "status", expectedOperatorId, controller.signal).then(() => {
+      setMenuMessage("Zerodha Session confirmed by Gate.");
+      setStep("menu");
+    }).catch((cause) => {
+      setError(cause instanceof Error ? cause.message : "Could not check the Zerodha Session.");
+      setStep(cause instanceof OperatorSessionRejectedError ? "username" : "menu");
+    }).finally(() => {
+      clearTimeout(timer);
+    });
   }
   function checkOperatorSession() {
     if (!onStatus) return;
@@ -805,6 +993,81 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
       setStep("menu");
     });
   }
+  async function runValidation(controller, selectedAttempt, code) {
+    if (!onValidateZerodha) return;
+    try {
+      const result = await onValidateZerodha({
+        attemptId: selectedAttempt,
+        otp: code,
+        signal: controller.signal,
+        onObservation: (event) => applyLoginEvent(event, controller.signal, code ? "otp" : "login")
+      });
+      if (watcher.current !== controller) return;
+      setOtp("");
+      setZerodhaValidationReport(result);
+      attemptId.current = result.attemptId ?? null;
+      if (!controller.signal.aborted && result.attemptId && ["awaiting_otp", "otp_rejected"].includes(result.reason)) {
+        setStep("otp");
+      } else {
+        clearZerodhaLoginDeadline(controller);
+        validatingZerodha.current = false;
+        if (result.reason === "operator_login_required") {
+          setUsername("");
+          setPassword("");
+        }
+        setStep(result.reason === "operator_login_required" ? "username" : "menu");
+      }
+    } catch (cause) {
+      if (watcher.current !== controller) return;
+      clearZerodhaLoginDeadline(controller);
+      validatingZerodha.current = false;
+      setOtp("");
+      const message = cause instanceof Error ? cause.message : "Zerodha Session validation failed.";
+      setError(code ? message.replaceAll(code, "[REDACTED]") : message);
+      setStep("menu");
+    }
+  }
+  async function beginValidation(selectedAttempt) {
+    watcher.current?.abort();
+    clearZerodhaLoginDeadline();
+    const controller = new AbortController();
+    const started = Date.now();
+    watcher.current = controller;
+    validatingZerodha.current = true;
+    attemptId.current = selectedAttempt ?? null;
+    setOtp("");
+    setProgress(null);
+    setError("");
+    setMenuMessage("");
+    setValidationReport(null);
+    setZerodhaValidationReport(null);
+    setStep("validatingZerodha");
+    const timer = setTimeout(() => {
+      if (zerodhaLoginDeadline.current?.controller !== controller) return;
+      controller.abort();
+      clearZerodhaLoginDeadline(controller);
+      validatingZerodha.current = false;
+      setOtp("");
+      setZerodhaValidationReport((previous) => previous ? {
+        ...previous,
+        outcome: "fail",
+        reason: "deadline_exceeded",
+        exitCode: 1,
+        message: "The Zerodha Session validation exceeded its deadline.",
+        elapsedMs: Date.now() - started,
+        nextStep: `Observe attempt ${previous.attemptId} with the same target and profile; explicitly start again only if Gate reports it inactive.`
+      } : previous);
+      setError(`Zerodha Session validation exceeded its deadline.${attemptId.current ? ` Observe attempt ${attemptId.current} with the same target and profile.` : ""}`);
+      setStep("menu");
+    }, actionTimeoutMs);
+    zerodhaLoginDeadline.current = { controller, timer };
+    await runValidation(controller, selectedAttempt);
+  }
+  function resumeValidation() {
+    setError("");
+    setResumeAttemptInput("");
+    setStep("validationAttempt");
+  }
   function logoutOperatorSession() {
     if (!onLogout) return;
     setError("");
@@ -814,6 +1077,7 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
       setPassword("");
       setMenuMessage("");
       setValidationReport(null);
+      setZerodhaValidationReport(null);
       setStep("username");
     }).catch((cause) => {
       setError(cause instanceof Error ? cause.message : "Could not log out the Operator Session.");
@@ -826,7 +1090,14 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
     } },
     ...onStatus ? [{ shortcut: "2", label: "Check Operator Session", run: checkOperatorSession }] : [],
     ...onValidate ? [{ shortcut: "3", label: "Validate Operator Session", run: validateOperatorSession }] : [],
-    ...onLogout ? [{ shortcut: "4", label: "Logout Operator Session", run: logoutOperatorSession }] : []
+    ...onLogout ? [{ shortcut: "4", label: "Logout Operator Session", run: logoutOperatorSession }] : [],
+    { shortcut: "5", label: "Check Zerodha Session", run: checkZerodhaSession },
+    ...onValidateZerodha ? [
+      { shortcut: "6", label: "Validate Zerodha Session", run: () => {
+        void beginValidation();
+      } },
+      { shortcut: "7", label: "Resume Zerodha Validation", run: resumeValidation }
+    ] : []
   ];
   const activeMenuIndex = Math.min(selectedMenuIndex, menuActions.length - 1);
   useInput2((input, key) => {
@@ -864,6 +1135,15 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
       }
       return;
     }
+    if (step === "validationAttempt") {
+      if (key.escape) setStep("menu");
+      else if (key.return) {
+        if (!/^[a-zA-Z0-9_-]{1,200}$/.test(resumeAttemptInput)) setError("Enter an explicit valid Zerodha attempt ID.");
+        else void beginValidation(resumeAttemptInput);
+      } else if (key.backspace || key.delete) setResumeAttemptInput((value) => value.slice(0, -1));
+      else if (input && !key.ctrl && !key.meta) setResumeAttemptInput((value) => (value + input).slice(0, 200));
+      return;
+    }
     if (step === "menu") {
       if (key.upArrow) {
         setSelectedMenuIndex((index) => (index - 1 + menuActions.length) % menuActions.length);
@@ -878,7 +1158,13 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
       return;
     }
     if (step === "otp") {
-      if (key.return) void submitOtp();
+      if (key.escape && validatingZerodha.current) {
+        watcher.current?.abort();
+        clearZerodhaLoginDeadline();
+        validatingZerodha.current = false;
+        setOtp("");
+        setStep("menu");
+      } else if (key.return) void submitOtp();
       else if (key.backspace || key.delete) setOtp((value) => value.slice(0, -1));
       else if (input) setOtp((value) => (value + input.replace(/\D/g, "")).slice(0, 6));
     }
@@ -923,6 +1209,16 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
     ] }),
     step === "checking" && /* @__PURE__ */ jsx2(Text2, { children: "Checking Operator Session\u2026" }),
     step === "validating" && /* @__PURE__ */ jsx2(Text2, { children: "Validating Operator Session\u2026" }),
+    step === "validatingZerodha" && /* @__PURE__ */ jsx2(Text2, { children: "Validating Zerodha Session\u2026" }),
+    step === "validationAttempt" && /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx2(Text2, { children: "Zerodha attempt ID" }),
+      /* @__PURE__ */ jsxs2(Text2, { children: [
+        resumeAttemptInput,
+        /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
+      ] }),
+      /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Enter to observe this attempt \xB7 Esc to return" })
+    ] }),
+    zerodhaValidationReport ? /* @__PURE__ */ jsx2(Text2, { children: formatZerodhaValidationReport(zerodhaValidationReport) }) : null,
     step === "loggingOut" && /* @__PURE__ */ jsx2(Text2, { children: "Logging out of the Operator Session\u2026" }),
     step === "starting" && /* @__PURE__ */ jsx2(Text2, { children: "Starting Login with Zerodha\u2026" }),
     step === "waiting" && /* @__PURE__ */ jsx2(Text2, { children: "Connecting to Zerodha\u2026" }),
@@ -931,9 +1227,22 @@ function LoginApp({ api, actionTimeoutMs = 3e4, onResumeSession, onReportOperato
       /* @__PURE__ */ jsxs2(Text2, { children: [
         "\u2022".repeat(otp.length),
         /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
-      ] })
+      ] }),
+      validatingZerodha.current ? /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Enter to submit \xB7 Esc to return and resume later" }) : null
     ] }),
     step === "verifying" && /* @__PURE__ */ jsx2(Text2, { children: "Verifying Zerodha login\u2026" }),
+    progress?.attemptId ? /* @__PURE__ */ jsxs2(Text2, { children: [
+      "Attempt: ",
+      progress.attemptId
+    ] }) : null,
+    progress?.observedState ? /* @__PURE__ */ jsxs2(Text2, { children: [
+      "Zerodha state: ",
+      progress.observedState
+    ] }) : null,
+    progress?.failedOtpAttempts !== void 0 ? /* @__PURE__ */ jsxs2(Text2, { children: [
+      "Failed OTP attempts: ",
+      progress.failedOtpAttempts
+    ] }) : null,
     error ? /* @__PURE__ */ jsx2(Text2, { color: "red", children: error }) : null
   ] });
 }
@@ -941,6 +1250,7 @@ var init_app = __esm({
   "src/app.tsx"() {
     "use strict";
     init_gate_api();
+    init_zerodha_actions();
   }
 });
 
@@ -1441,8 +1751,7 @@ function normalizeSession(value) {
     operatorId: session.operatorId,
     updatedAt: session.updatedAt,
     ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
-    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
-    ...typeof session.zerodhaAttemptId === "string" && /^[a-zA-Z0-9_-]{1,200}$/.test(session.zerodhaAttemptId) ? { zerodhaAttemptId: session.zerodhaAttemptId } : {}
+    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
   };
 }
 function parseRecord(raw) {
@@ -1493,9 +1802,9 @@ function sessionHasCookies(session) {
   return Boolean(session.operatorSessionCookie || session.clientIdentityCookie);
 }
 var CliProfileStore = class {
-  constructor(homeDirectory = process.env.HOME ?? process.env.USERPROFILE ?? process.cwd(), lockWaitMs = LOCK_WAIT_MS) {
+  constructor(homeDirectory = process.env.HOME ?? process.env.USERPROFILE ?? process.cwd(), lockWaitMs = LOCK_WAIT_MS, directoryName = ".lmt") {
     this.lockWaitMs = lockWaitMs;
-    this.directory = path2.join(homeDirectory, ".lmt");
+    this.directory = path2.join(homeDirectory, directoryName);
     this.filePath = path2.join(this.directory, FILE_NAME);
     this.lockPath = path2.join(this.directory, `${FILE_NAME}.lock`);
   }
@@ -1539,10 +1848,6 @@ var CliProfileStore = class {
         ...cookies.clientIdentityCookie ? { clientIdentityCookie: cookies.clientIdentityCookie } : {},
         ...cookies.operatorSessionCookie ? { operatorSessionCookie: cookies.operatorSessionCookie } : {}
       };
-      const previous = profileRecord.sessions[index];
-      if (previous?.operatorSessionCookie && previous.operatorSessionCookie === next.operatorSessionCookie && previous.zerodhaAttemptId) {
-        next.zerodhaAttemptId = previous.zerodhaAttemptId;
-      }
       if (!sessionHasCookies(next)) {
         if (index >= 0) profileRecord.sessions.splice(index, 1);
       } else if (index >= 0) {
@@ -1563,32 +1868,11 @@ var CliProfileStore = class {
       if (index < 0) return;
       const stored = profileRecord.sessions[index];
       delete stored.operatorSessionCookie;
-      delete stored.zerodhaAttemptId;
       stored.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
       this.cleanEmptySession(profileRecord, index);
       if (profileRecord.sessions.length === 0) delete record.profiles[profile];
     });
   }
-  async getZerodhaAttempt(profile, target) {
-    assertClientProfileName(profile);
-    return this.withLock(async () => {
-      const session = (await this.readRecord()).profiles[profile]?.sessions.find((value) => targetsEqual(value, target));
-      return session?.operatorSessionCookie ? session.zerodhaAttemptId : void 0;
-    });
-  }
-  async saveZerodhaAttempt(profile, target, attemptId) {
-    assertClientProfileName(profile);
-    if (attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) throw new Error("Invalid Zerodha attempt identifier.");
-    await this.update((record) => {
-      const session = record.profiles[profile]?.sessions.find((value) => targetsEqual(value, target));
-      if (!session?.operatorSessionCookie) {
-        if (attemptId) throw new Error("An Operator Session is required to save a Zerodha login attempt.");
-        return;
-      }
-      if (attemptId) session.zerodhaAttemptId = attemptId;
-      else delete session.zerodhaAttemptId;
-    });
-  }
   async removeTarget(profile, target) {
     assertClientProfileName(profile);
     await this.update((record) => {
@@ -1716,7 +2000,6 @@ var CliProfileStore = class {
               operatorId: session.operatorId,
               ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
               ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
-              ...session.zerodhaAttemptId ? { zerodhaAttemptId: session.zerodhaAttemptId } : {},
               updatedAt: session.updatedAt
             }))
           }
@@ -1749,46 +2032,161 @@ var CliProfileStore = class {
   }
 };
 
-// src/zerodha-actions.ts
-async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp, onStarted) {
-  if (action === "status") {
-    await api.confirmZerodhaSession();
-    return { status: "succeeded" };
-  }
-  if (action === "login") {
-    const attempt = await api.startLogin();
-    if (attempt.operatorId !== operatorId) throw new Error("Zerodha login reached an unexpected Operator.");
-    attemptId = attempt.attemptId;
-    await onStarted?.(attemptId);
-  }
-  if (!attemptId) throw new Error("Zerodha login requires an attempt identifier.");
-  if (action === "otp") {
-    if (!otp) throw new Error("Zerodha OTP input is required.");
-    await api.submitOtp(attemptId, otp);
-  }
-  const observer = new AbortController();
-  const observationSignal = AbortSignal.any([signal, observer.signal]);
-  let result;
-  await api.watchLoginAttempt(attemptId, (event) => {
-    if (event.attemptId !== attemptId || event.type === "status" && event.operatorId !== operatorId) {
-      throw new Error("Origin returned an unexpected Zerodha login attempt.");
-    }
-    if (event.type === "status" && (event.status === "awaiting_otp" || event.status === "succeeded")) {
-      result = {
-        status: event.status,
-        attemptId,
-        ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
-        ...event.message ? { message: event.message } : {}
-      };
-      observer.abort();
+// src/zerodha-validation.ts
+init_action_deadline();
+init_gate_api();
+init_profile_name();
+
+// src/protected-input.ts
+var ProtectedInputError = class extends Error {
+  code = "invalid_invocation";
+};
+async function readProtectedOtp(stdin, signal) {
+  if (stdin.isTTY) throw new ProtectedInputError("OTP requires piped protected stdin; interactive mode provides masked entry.");
+  const chunks = [];
+  let size = 0;
+  try {
+    const iterator = stdin[Symbol.asyncIterator]();
+    while (true) {
+      if (signal.aborted) throw new Error("The action exceeded its deadline.");
+      const next = await new Promise((resolve, reject) => {
+        const abort = () => {
+          stdin.destroy?.();
+          reject(new Error("The action exceeded its deadline."));
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        Promise.resolve(iterator.next()).then(resolve, () => reject(new ProtectedInputError("Could not read OTP from protected stdin; provide one six-digit line."))).finally(() => signal.removeEventListener("abort", abort));
+      });
+      if (next.done) break;
+      size += typeof next.value === "string" ? Buffer.byteLength(next.value) : next.value.byteLength;
+      if (size > 8) {
+        stdin.destroy?.();
+        throw new ProtectedInputError("OTP input is too large; provide one six-digit line.");
+      }
+      chunks.push(Buffer.from(next.value));
+    }
+    const buffer = Buffer.concat(chunks);
+    try {
+      const value = buffer.toString("utf8");
+      if (!/^\d{6}(?:\r?\n)?$/.test(value)) throw new ProtectedInputError("OTP input must be one six-digit line.");
+      return value.slice(0, 6);
+    } finally {
+      buffer.fill(0);
     }
-  }, observationSignal);
-  if (signal.aborted || !result) throw new Error("Zerodha login observation exceeded its deadline.");
-  if (result.status === "succeeded") await api.confirmZerodhaSession();
-  return result;
+  } catch (error) {
+    if (signal.aborted || error instanceof ProtectedInputError) throw error;
+    throw new ProtectedInputError("Could not read OTP from protected stdin; provide one six-digit line.");
+  } finally {
+    for (const chunk of chunks) chunk.fill(0);
+  }
+}
+
+// src/zerodha-validation.ts
+init_zerodha_actions();
+async function runZerodhaValidation(options) {
+  const started = performance.now();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 12e4);
+  const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+  const observations = [];
+  let api;
+  let otp;
+  let result = {
+    scenario: "zerodha-session",
+    outcome: "fail",
+    reason: "validation_action_failed",
+    exitCode: 1,
+    target: { environment: options.target.environment, origin: options.target.origin },
+    profile: options.callerProfile,
+    ...options.attemptId ? { attemptId: options.attemptId } : {},
+    observations,
+    nextStep: null
+  };
+  const safeText = (message) => (otp ? message.replaceAll(otp, "[REDACTED]") : message).replace(/lmt_(?:operator_session|client_id)=[^\s,;]+/g, "[REDACTED]").replace(/(password|token|credential|cookie)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]");
+  const resumeStep = () => result.attemptId ? `Use the same environment and profile: validate zerodha-session --attempt ${result.attemptId} --otp-stdin. Observe without --otp-stdin; start explicitly only if Gate reports the attempt inactive.` : "Run validate zerodha-session again after resolving the reported prerequisite.";
+  try {
+    if (!["local", "dev"].includes(options.target.environment)) throw Object.assign(new Error("The CLI supports local or dev targets only; prod is not permitted."), { code: "invalid_target" });
+    try {
+      assertClientProfileName(options.callerProfile);
+    } catch {
+      throw new ProtectedInputError(CLIENT_PROFILE_NAME_ERROR);
+    }
+    if (options.attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(options.attemptId)) throw new ProtectedInputError("--attempt must be a valid Zerodha attempt ID.");
+    if (options.readOtp && !options.attemptId) throw new ProtectedInputError("OTP submission requires an explicit --attempt ID from a prior login or validation.");
+    const actions = createOperatorSessionActions({
+      target: options.target,
+      profile: options.callerProfile,
+      store: options.store,
+      timeoutMs: options.timeoutMs ?? 12e4,
+      signal,
+      ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
+    });
+    api = await withinActionDeadline(actions.getApi(), signal, "The Zerodha Session validation exceeded its deadline.");
+    const operator = await actions.status();
+    result.observedOperator = operator.observedOperator;
+    if (options.readOtp) {
+      otp = await withinActionDeadline(options.readOtp(signal), signal, "The Zerodha Session validation exceeded its deadline.");
+      if (!/^\d{6}$/.test(otp)) throw new ProtectedInputError("OTP input must be one six-digit line.");
+    }
+    const action = options.attemptId ? options.readOtp ? "otp" : "observe" : "login";
+    const login = await runZerodhaAction(api, action, options.target.operatorId, signal, options.attemptId, otp, {
+      onObservation(event) {
+        result.attemptId = event.attemptId;
+        if (event.type === "status") {
+          result.observedState = event.status;
+          result.observedOperator = event.operatorId;
+          observations.push(event.status);
+          if (event.failedOtpAttempts !== void 0) result.failedOtpAttempts = event.failedOtpAttempts;
+          if (event.message) result.message = safeText(event.message);
+        }
+        options.onObservation?.(event);
+      }
+    });
+    result.attemptId = login.attemptId;
+    if (login.status === "awaiting_otp") {
+      const rejected = !!options.readOtp && (login.failedOtpAttempts ?? 0) > 0;
+      result = { ...result, outcome: rejected ? "fail" : "blocked", reason: rejected ? "otp_rejected" : "awaiting_otp", exitCode: rejected ? 1 : 4, nextStep: resumeStep() };
+    } else {
+      result = { ...result, outcome: "pass", reason: "zerodha_session_validated", exitCode: 0, nextStep: null };
+    }
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : void 0;
+    if (error?.attemptId) result.attemptId = error.attemptId;
+    if (error?.observedState) result.observedState = error.observedState;
+    if (error?.observedOperator) result.observedOperator = error.observedOperator;
+    const code = error?.code;
+    if (signal.aborted) {
+      result.reason = "deadline_exceeded";
+      result.message = "The Zerodha Session validation exceeded its deadline.";
+    } else if (cause instanceof OperatorSessionRejectedError) {
+      result.outcome = "blocked";
+      result.reason = "operator_login_required";
+      result.exitCode = 3;
+      result.message = "No valid Operator Session is available; run login with this environment and profile first.";
+    } else if (code && ["zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(code)) {
+      result.outcome = "blocked";
+      result.reason = code;
+      result.exitCode = 4;
+      result.message = safeText(error.message);
+    } else {
+      result.reason = cause instanceof ProtectedInputError ? "invalid_invocation" : cause instanceof ZerodhaLoginAttemptUnavailableError ? "login_attempt_inactive" : cause instanceof ZerodhaLoginFailedError ? "zerodha_login_failed" : code ?? "validation_action_failed";
+      result.exitCode = cause instanceof ProtectedInputError || code === "invalid_target" ? 2 : 1;
+      result.message = error ? safeText(error.message) : "The Zerodha Session validation failed.";
+    }
+    result.nextStep = result.reason === "operator_login_required" ? "Run login with the selected environment and profile, then explicitly start Zerodha validation." : result.reason === "zerodha_credentials_missing" ? "Provision the selected Operator's Broker-owned Zerodha credentials, then explicitly start validation." : result.reason === "secret_store_unavailable" ? "Restore Broker access to its secret store, then explicitly start validation." : result.reason === "operator_not_configured" ? "Configure the selected Operator on Broker, then explicitly start validation." : resumeStep();
+    if (cause instanceof OperatorSessionRejectedError && api && !signal.aborted) {
+      await options.store.saveSession(options.callerProfile, options.target, api.getCookies()).catch(() => void 0);
+    }
+  } finally {
+    otp = void 0;
+    clearTimeout(timer);
+  }
+  const metadata = api?.responseMetadata();
+  return { ...result, elapsedMs: Math.round(performance.now() - started), requestId: metadata?.requestId ?? null, buildId: metadata?.buildId ?? null };
 }
 
 // src/commands.ts
+init_zerodha_actions();
 init_gate_api();
 
 // src/validation-scenario.ts
@@ -2053,17 +2451,19 @@ function parseTimeout(raw) {
   return Math.ceil(value);
 }
 function splitHeadlessArgv(argv) {
+  if (hasArgumentOtp(argv)) throw new InvocationError("--otp arguments are no longer accepted. Use --otp-stdin with an explicit --attempt ID.");
   if (argv.length === 0 || argv[0] === "interactive") {
     throw new InvocationError("Choose a headless command or run `live-market-terminal interactive`.");
   }
   const options = /* @__PURE__ */ new Map();
   let credentialStdin = false;
+  let otpStdin = false;
   const positional = [];
   for (let index = 0; index < argv.length; index += 1) {
     const token = argv[index];
-    if (token.startsWith("--otp=")) {
-      if (options.has("--otp")) throw new InvocationError("Argument --otp may be specified only once.");
-      options.set("--otp", token.slice("--otp=".length));
+    if (token === "--otp-stdin") {
+      if (otpStdin) throw new InvocationError("Argument --otp-stdin may be specified only once.");
+      otpStdin = true;
       continue;
     }
     if (token === "--credential-stdin") {
@@ -2071,7 +2471,7 @@ function splitHeadlessArgv(argv) {
       credentialStdin = true;
       continue;
     }
-    if (token === "--env" || token === "--profile" || token === "--timeout" || token === "--attempt" || token === "--otp") {
+    if (token === "--env" || token === "--profile" || token === "--timeout" || token === "--attempt" || token === "--date") {
       const value = argv[index + 1];
       if (value === void 0 || value.startsWith("--")) {
         throw new InvocationError(`Invalid or incomplete command argument: ${token}`);
@@ -2086,10 +2486,32 @@ function splitHeadlessArgv(argv) {
     }
     positional.push(token);
   }
-  return { positional, options, credentialStdin };
+  return { positional, options, credentialStdin, otpStdin };
 }
 function parseArguments(argv) {
-  const { positional, options, credentialStdin } = splitHeadlessArgv(argv);
+  const { positional, options, credentialStdin, otpStdin } = splitHeadlessArgv(argv);
+  if (positional[0] === "candle-export") {
+    const instrument = positional[1]?.match(/^([A-Za-z][A-Za-z0-9]{0,31}):([^:\s]{1,100})$/);
+    const date = options.get("--date");
+    const parsedDate = date ? /* @__PURE__ */ new Date(`${date}T00:00:00Z`) : void 0;
+    if (positional.length !== 2 || !instrument || credentialStdin || otpStdin || options.has("--attempt") || date !== void 0 && (!/^\d{4}-\d{2}-\d{2}$/.test(date) || !Number.isFinite(parsedDate.getTime()) || parsedDate.toISOString().slice(0, 10) !== date || date < "2000-01-01")) {
+      throw new InvocationError("Use candle-export EXCHANGE:SYMBOL [--date YYYY-MM-DD].");
+    }
+    const environment2 = options.get("--env");
+    const profile2 = options.get("--profile");
+    if (!environment2 || !profile2) throw new InvocationError("Headless commands require both --env local|dev and --profile NAME.");
+    validateCommandProfile(profile2);
+    return {
+      kind: "candle-export",
+      exchange: instrument[1].toUpperCase(),
+      tradingSymbol: instrument[2].toUpperCase(),
+      environment: environment2,
+      profile: profile2,
+      ...date ? { date } : {},
+      ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {}
+    };
+  }
+  if (options.has("--date")) throw new InvocationError("--date is only supported for candle-export.");
   if (positional[0] === "zerodha") {
     const action = positional[1];
     if (!["login", "observe", "otp", "status"].includes(action) || positional.length !== 2 || credentialStdin) {
@@ -2103,22 +2525,41 @@ function parseArguments(argv) {
     if (attemptId && (action === "login" || action === "status") || attemptId && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) {
       throw new InvocationError("--attempt must be a valid Zerodha attempt ID and is only supported for observe and otp.");
     }
-    const otp = options.get("--otp");
-    if (action === "otp" && otp === void 0 || otp !== void 0 && action !== "otp" && action !== "login") {
-      throw new InvocationError("--otp VALUE is supported for zerodha login and required for zerodha otp.");
+    if ((action === "observe" || action === "otp") && !attemptId) {
+      throw new InvocationError("--attempt ID is required for zerodha observe and otp. Use the attemptId returned by zerodha login.");
+    }
+    if (action === "otp" && !otpStdin || otpStdin && action !== "otp") {
+      throw new InvocationError("--otp-stdin is required for zerodha otp only. Start with zerodha login, then submit with zerodha otp --attempt ID --otp-stdin.");
     }
-    if (otp !== void 0 && !/^\d{6}$/.test(otp)) throw new InvocationError("OTP must be six digits.");
     return {
       kind: "zerodha",
       action,
       environment: environment2,
       profile: profile2,
       attemptId,
-      otp,
+      otpStdin,
       ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {}
     };
   }
-  if (options.has("--otp") || options.has("--attempt")) throw new InvocationError("--otp and --attempt are Zerodha options only.");
+  if (positional[0] === "validate" && positional[1] === "zerodha-session") {
+    if (positional.length !== 2 || credentialStdin) throw new InvocationError("Use validate zerodha-session with optional --attempt ID and --otp-stdin.");
+    const environment2 = options.get("--env");
+    const profile2 = options.get("--profile");
+    if (!environment2 || !profile2) throw new InvocationError("Headless commands require both --env local|dev and --profile NAME.");
+    validateCommandProfile(profile2);
+    const attemptId = options.get("--attempt");
+    if (attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) throw new InvocationError("--attempt must be a valid Zerodha attempt ID.");
+    if (otpStdin && !attemptId) throw new InvocationError("--otp-stdin requires an explicit --attempt ID from a prior login or validation.");
+    return {
+      kind: "validate-zerodha",
+      environment: environment2,
+      profile: profile2,
+      attemptId,
+      otpStdin,
+      ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {}
+    };
+  }
+  if (otpStdin || options.has("--attempt")) throw new InvocationError("--otp-stdin and --attempt are Zerodha options only.");
   if (positional[0] === "credential") {
     if (positional[1] !== "provision" || positional.length > 2) {
       throw new InvocationError("Use `credential provision` to provision the protected SMS credential.");
@@ -2144,9 +2585,9 @@ function parseArguments(argv) {
       throw new InvocationError("Unexpected positional argument; use --help for command syntax.");
     }
   } else if (positional.length === 0) {
-    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session.");
+    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session|zerodha-session.");
   } else {
-    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session.");
+    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session|zerodha-session.");
   }
   const environment = options.get("--env");
   const profile = options.get("--profile");
@@ -2163,11 +2604,11 @@ function validateCommandProfile(profile) {
   }
 }
 function durationFor(command) {
-  return command.kind === "validate" ? command.timeoutMs ?? 12e4 : command.kind === "credential-provision" ? 3e4 : command.timeoutMs ?? 3e4;
+  return command.kind === "validate" || command.kind === "validate-zerodha" ? command.timeoutMs ?? 12e4 : command.kind === "credential-provision" ? 3e4 : command.timeoutMs ?? 3e4;
 }
 function errorDetails(error, signal) {
   if (signal?.aborted) return { code: "deadline_exceeded", message: "The action exceeded its deadline.", exitCode: 1 };
-  if (error instanceof InvocationError) {
+  if (error instanceof InvocationError || error instanceof ProtectedInputError) {
     return { code: error.code, message: error.message, exitCode: 2 };
   }
   if (error instanceof OperatorSessionRejectedError) {
@@ -2176,6 +2617,11 @@ function errorDetails(error, signal) {
   if (error instanceof OperatorCredentialsRejectedError) {
     return { code: "incorrect_credentials", message: "Gate rejected the Operator Login credentials.", exitCode: 1 };
   }
+  if (error instanceof ZerodhaLoginAttemptUnavailableError) return { code: "login_attempt_inactive", message: error.message, exitCode: 1 };
+  if (error instanceof ZerodhaLoginFailedError) return { code: "zerodha_login_failed", message: error.message, exitCode: 1 };
+  if (error instanceof Error && "code" in error && typeof error.code === "string" && ["zerodha_session_absent", "zerodha_session_restoring", "zerodha_verification_unavailable", "zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(error.code)) {
+    return { code: error.code, message: error.message, exitCode: 1 };
+  }
   if (error instanceof SmsReadError) {
     return { code: error.code, message: error.message, exitCode: 1 };
   }
@@ -2221,18 +2667,25 @@ async function readProtectedInput(stdin, signal, label = "SMS credential") {
   return credential;
 }
 async function runHeadlessCli(argv, dependencies = {}) {
-  const streams = { stdout: dependencies.stdout ?? defaultOut, stderr: dependencies.stderr ?? defaultErr };
+  let otp;
+  const protect = (stream) => ({ write(chunk) {
+    return stream.write(otp ? chunk.replaceAll(otp, "[redacted]") : chunk);
+  } });
+  const streams = { stdout: protect(dependencies.stdout ?? defaultOut), stderr: protect(dependencies.stderr ?? defaultErr) };
   const started = performance.now();
   let command;
   let target;
   let profile;
   let actionApi;
   let signal;
+  let deadlineTimer;
   let store;
   try {
     command = parseArguments(argv);
     const timeoutMs = durationFor(command);
-    signal = AbortSignal.timeout(timeoutMs);
+    const deadline = new AbortController();
+    deadlineTimer = setTimeout(() => deadline.abort(), timeoutMs);
+    signal = deadline.signal;
     profile = command.profile;
     try {
       target = resolveCliTarget({ LMT_ENV: command.environment }, dependencies.configPath);
@@ -2255,6 +2708,33 @@ async function runHeadlessCli(argv, dependencies = {}) {
       }, streams);
       return 0;
     }
+    if (command.kind === "validate-zerodha") {
+      const validation = await runZerodhaValidation({
+        target,
+        callerProfile: profile,
+        store,
+        timeoutMs,
+        signal,
+        attemptId: command.attemptId,
+        ...command.otpStdin ? { readOtp: (inputSignal) => readProtectedOtp(dependencies.stdin ?? process.stdin, inputSignal) } : {},
+        ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {}
+      });
+      emit({
+        version: 1,
+        command: "validate zerodha-session",
+        outcome: validation.outcome,
+        reason: validation.reason,
+        target: validation.target,
+        profile,
+        observedOperator: validation.observedOperator,
+        attemptId: validation.attemptId,
+        observedState: validation.observedState,
+        elapsedMs: validation.elapsedMs,
+        metadata: { requestId: validation.requestId, buildId: validation.buildId },
+        validation
+      }, streams, validation.exitCode === 0 ? void 0 : `Zerodha Session validation ${validation.outcome}: ${validation.reason}. ${validation.nextStep ?? ""}`);
+      return validation.exitCode;
+    }
     if (command.kind === "validate") {
       const validation = await runOperatorSessionValidation({
         target,
@@ -2292,42 +2772,37 @@ async function runHeadlessCli(argv, dependencies = {}) {
       ...dependencies.readLoginCredentials ? { readLoginCredentials: dependencies.readLoginCredentials } : {}
     });
     actionApi = await actions.getApi();
+    if (command.kind === "candle-export") {
+      await actions.status();
+      const candleExport = await actionApi.exportCandles({
+        exchange: command.exchange,
+        tradingSymbol: command.tradingSymbol,
+        ...command.date ? { date: command.date } : {}
+      });
+      emit({
+        version: 1,
+        command: command.kind,
+        outcome: "success",
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        observedOperator: target.operatorId,
+        candleExport,
+        elapsedMs: Math.round(performance.now() - started),
+        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
+      }, streams);
+      return 0;
+    }
     if (command.kind === "zerodha") {
       await actions.status();
-      const otp = command.otp;
-      let attemptId = command.attemptId;
-      if (!attemptId && (command.action === "otp" || command.action === "observe" || command.action === "login" && otp)) {
-        attemptId = await store.getZerodhaAttempt(profile, target);
-      }
-      if (!attemptId && (command.action === "otp" || command.action === "observe")) {
-        throw new InvocationError("No pending Zerodha login for this profile. Run zerodha login first.");
-      }
-      let completed;
-      if (command.action === "login" && otp && attemptId) {
-        try {
-          const pending = await runZerodhaAction(actionApi, "observe", target.operatorId, signal, attemptId);
-          if (pending.status === "succeeded") completed = pending;
-        } catch (error) {
-          if (!(error instanceof ZerodhaLoginFailedError || error instanceof ZerodhaLoginAttemptUnavailableError) || signal.aborted) throw error;
-          await store.saveZerodhaAttempt(profile, target);
-          attemptId = void 0;
-        }
-      }
-      const action = command.action === "login" && otp && attemptId ? "otp" : command.action;
-      const saveAttempt = (id) => store.saveZerodhaAttempt(profile, target, id);
-      let zerodha;
-      let startedFresh = action === "login";
-      try {
-        zerodha = completed ?? await runZerodhaAction(actionApi, action, target.operatorId, signal, attemptId, otp, saveAttempt);
-      } catch (error) {
-        if (!(error instanceof ZerodhaLoginAttemptUnavailableError) || command.action !== "login" || !otp || signal.aborted) throw error;
-        startedFresh = true;
-        zerodha = await runZerodhaAction(actionApi, "login", target.operatorId, signal, void 0, void 0, saveAttempt);
-      }
-      if (command.action === "login" && otp && zerodha.status === "awaiting_otp" && startedFresh) {
-        zerodha = await runZerodhaAction(actionApi, "otp", target.operatorId, signal, zerodha.attemptId, otp);
-      }
-      if (zerodha.status === "succeeded") await store.saveZerodhaAttempt(profile, target);
+      if (command.otpStdin) otp = await readProtectedOtp(dependencies.stdin ?? process.stdin, signal);
+      const zerodha = await runZerodhaAction(
+        actionApi,
+        command.action,
+        target.operatorId,
+        signal,
+        command.attemptId,
+        otp
+      );
       const awaitingOtp = zerodha.status === "awaiting_otp";
       emit({
         version: 1,
@@ -2377,20 +2852,22 @@ async function runHeadlessCli(argv, dependencies = {}) {
     }, streams);
     return 0;
   } catch (error) {
-    if ((error instanceof ZerodhaLoginFailedError || error instanceof ZerodhaLoginAttemptUnavailableError) && command?.kind === "zerodha" && !command.attemptId && store && target && profile && !signal?.aborted) {
-      await store.saveZerodhaAttempt(profile, target).catch(() => void 0);
-    }
     if (error instanceof OperatorSessionRejectedError && store && actionApi && target && profile && !signal?.aborted) {
       await store.saveSession(profile, target, actionApi.getCookies()).catch(() => void 0);
     }
     const details = errorDetails(error, signal);
+    const recovery = error instanceof Error ? error : void 0;
+    const attemptId = recovery?.attemptId ?? (command?.kind === "zerodha" ? command.attemptId : void 0);
     emit({
       version: 1,
-      command: command?.kind === "zerodha" ? `zerodha ${command.action}` : command?.kind === "credential-provision" ? "credential provision" : command?.kind === "validate" ? "validate operator-session" : command?.kind ?? "",
+      command: command?.kind === "zerodha" ? `zerodha ${command.action}` : command?.kind === "credential-provision" ? "credential provision" : command?.kind === "validate-zerodha" ? "validate zerodha-session" : command?.kind === "validate" ? "validate operator-session" : command?.kind ?? "",
       outcome: details.exitCode === 4 ? "blocked" : "fail",
       reason: details.code,
       ...target ? { target: { environment: target.environment, origin: target.origin } } : command ? { target: { environment: command.environment } } : {},
       ...profile ? { profile } : {},
+      ...attemptId ? { attemptId, recovery: recovery?.recovery ?? "Observe this exact attempt with the same target and profile; start explicitly only if Gate reports it inactive." } : {},
+      ...recovery?.observedState ? { observedState: recovery.observedState } : {},
+      ...recovery?.observedOperator ? { observedOperator: recovery.observedOperator } : {},
       elapsedMs: Math.round(performance.now() - started),
       metadata: {
         requestId: actionApi?.responseMetadata().requestId ?? null,
@@ -2399,8 +2876,14 @@ async function runHeadlessCli(argv, dependencies = {}) {
       error: { code: details.code, message: details.message }
     }, streams, details.exitCode === 2 ? `Invalid CLI invocation: ${details.message}` : details.message);
     return details.exitCode;
+  } finally {
+    otp = void 0;
+    if (deadlineTimer) clearTimeout(deadlineTimer);
   }
 }
+function hasArgumentOtp(argv) {
+  return argv.some((token) => token === "--otp" || token.startsWith("--otp="));
+}
 
 // src/index.ts
 init_profile_name();
@@ -2422,23 +2905,36 @@ Usage (lmt is an alias of live-market-terminal):
   live-market-terminal interactive credential provision [--env local|dev] [--profile NAME]
   live-market-terminal login --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal logout --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal candle-export EXCHANGE:SYMBOL [--date YYYY-MM-DD] --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal status --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha login --env local|dev --profile NAME [--otp CODE] [--timeout DURATION]
-  live-market-terminal zerodha observe [--attempt ID] --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha otp [--attempt ID] --otp CODE --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal zerodha login --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal zerodha observe --attempt ID --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal zerodha otp --attempt ID --otp-stdin --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal zerodha status --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal validate operator-session --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal validate zerodha-session --env local|dev --profile NAME [--attempt ID [--otp-stdin]] [--timeout DURATION]
   live-market-terminal credential provision --env local|dev --profile NAME --credential-stdin
 
-Headless options (--env, --profile, --timeout, --otp, --credential-stdin) may appear before or after the command.
+Headless options (--env, --profile, --timeout, --attempt, --otp-stdin, --credential-stdin) may appear before or after the command.
 
 From the monorepo root:
   pnpm cli [--profile NAME]                       # interactive; --env defaults to local
   pnpm cli --env dev --profile my-dev-session
   pnpm -s cli:headless status --env local --profile default   # build step runs quietly (-s)
 
+Candle Export publishes a new immutable workbook link and returns its context in candleExport JSON.
+Empty or unavailable sources are explained in the workbook. Export never starts Zerodha login or token recovery.
+
 Targets: local and dev only. Production is not permitted.
 
+Zerodha login is two steps: zerodha login, then zerodha otp --attempt ID --otp-stdin.
+Obtain the OTP from Kite after login returns awaiting_otp; expired attempts require a new login.
+OTP arguments (--otp CODE and --otp=CODE) are rejected. Pipe protected input; headless mode never prompts.
+
+Validate Zerodha Session starts a new attempt; resume the returned ID with --attempt ID.
+Supply --otp-stdin only when submitting a human OTP to that exact attempt.
+Validation retains the caller profile session and can replace Broker's active attempt or refresh its shared token.
+Interactive mode offers Validate Zerodha Session and explicit Resume Zerodha Validation.
 Interactive mode restores a saved Operator Session when Gate still accepts it.
 Headless commands write one JSON object per line to stdout; diagnostics go to stderr.
 
@@ -2453,8 +2949,9 @@ Options:
   --env local|dev       Target environment (interactive default: local; headless: required)
   --profile NAME        Client profile (default: default for interactive)
   --timeout DURATION    Action deadline, e.g. 45s, 2m, 30000ms (headless)
-  --attempt ID          Override the remembered Zerodha attempt (optional)
-  --otp CODE            Six-digit OTP for zerodha login or otp
+  --date YYYY-MM-DD     Single IST date for candle-export; omitted: latest completed exchange session
+  --attempt ID          Attempt ID returned by zerodha login (required for observe and otp)
+  --otp-stdin           Read one six-digit OTP line from piped protected stdin (maximum 8 bytes)
   --credential-stdin    Read SMS credential from piped stdin (headless provision)
   --help, -h            Show this help
 
@@ -2474,6 +2971,10 @@ async function bootstrapCli(dependencies = {}) {
     return;
   }
   const argv = normalizeArgv(process.argv.slice(2));
+  if (hasArgumentOtp(argv)) {
+    process.exitCode = await runHeadlessCli(argv);
+    return;
+  }
   if (wantsCliHelp(argv)) {
     process.stdout.write(formatCliHelp());
     return;
@@ -2528,6 +3029,7 @@ async function bootstrapCli(dependencies = {}) {
   };
   const app = render(createElement(LoginApp2, {
     api,
+    expectedOperatorId: target.operatorId,
     actionTimeoutMs: 3e4,
     async onResumeSession() {
       return actions.resumeInteractiveSession();
@@ -2547,6 +3049,16 @@ async function bootstrapCli(dependencies = {}) {
       });
       return result;
     },
+    onValidateZerodha: (input) => runZerodhaValidation({
+      target,
+      callerProfile: profile,
+      store,
+      timeoutMs: 12e4,
+      signal: input.signal,
+      attemptId: input.attemptId,
+      onObservation: input.onObservation,
+      ...input.otp ? { readOtp: async () => input.otp } : {}
+    }),
     onLogout: () => actions.logout()
   }));
   await app.waitUntilExit();