@c4roa0/agentpay-user 0.0.0-stage → 0.3.1

package/doc/security/public-source-review-2026-11-06.md

@@ -0,0 +1,71 @@
+# Public-source preparation review — 2026-11-06
+
+## Completed cleanup
+
+- Original User code and documentation use owner-approved MPL 2.0. LICENSE,
+  NOTICE, SECURITY and CONTRIBUTING explain licensing, reporting and contributions.
+  The public Protocol artifact and attributed Agent test fixtures retain MIT.
+- Removed eleven historical Protocol archives from the publication tree. The one
+  required 0.14.1 archive is rebuilt from public Protocol commit `1c6ffab`, with
+  provenance, SHA-256, license and matching package-lock integrity.
+- Privately archived platform/MySQL harnesses, old operational records and previous
+  document snapshots. Removed the unused MySQL dependency. Product onboarding
+  scripts remain; script names alone were not grounds for removal.
+- Tests use the pinned package's Protocol fixtures and attributed local Skill
+  fixtures instead of sibling Agent/Protocol source. User imports its own declared
+  ethers dependency; built sibling Wallet remains required.
+- Reorganized current documentation by reader and function, rewrote source maps,
+  and separated implemented references from the future distribution plan.
+- Formatted maintained code and added comments explaining trust, persistence and
+  recovery boundaries. No payment, authorization or wire-format redesign was made.
+
+## Verification
+
+Independent verification uses only a temporary User checkout and the built public
+Wallet, without private Settlement, Agent or Protocol source checkouts. Offline
+`npm ci --ignore-scripts` installed the pinned dependencies successfully.
+
+The complete behavioral suite passed all 364 tests, with zero failures or skips.
+Tests exercise controlled local processes, sockets, HTTP boundaries and fixtures;
+these are not evidence of real-network payment, desktop login or participant browser
+acceptance. The portable approval-page test starts the exported server and checks
+actual responses and access restrictions instead of checking source text.
+
+Existing timeout tests were corrected to serve the current pre-purchase offer and
+separate status probes from preparation attempts. They still assert bounded timeout,
+lock release, the same request after restart and no Wallet call on invalid history.
+Grouped-command tests now use the current command surface.
+
+Syntax-tree comparison of 112 production source/script/browser files before and
+after formatting found no structural changes (comments and redundant parentheses
+excluded). Local Markdown links resolve, and `git diff --check` passes.
+
+## Follow-up documentation review
+
+A second pass found stale per-Policy Market grouping and expired-Policy connection
+instructions, along with pre-browser-signing descriptions in several runbooks.
+Those guides now use the implemented Wallet tuple and independently verified Policy
+scopes, explicit signer selection and the current browser approval flow. Implemented
+support remains distinct from uncompleted public-network/multisig acceptance.
+README/onboarding/developer prerequisites explicitly include npm and Corepack.
+The legacy preview's module comment now points to the public guided setup entry.
+
+This correction changed documentation and comments only. Local links, obsolete-claim
+search, JavaScript syntax and `git diff --check` passed; the prior behavioral suite
+was not repeated for prose-only edits.
+
+## Security scope and remaining decisions
+
+The bounded current-tree inventory found no literal private key, PEM private key
+or GitHub token; credential-bearing URL matches were negative-test fixtures.
+This is not a security audit or a guarantee against every secret format. Historical
+Git objects are outside this review and must not be assumed clean.
+
+User still imports Wallet compiled internals and enforces an exact update pair.
+The supported compatibility boundary and combined release archive remain separate
+work in the [distribution plan](../plans/user-wallet-distribution.md).
+The source review itself performed no automatic source download, service change
+or payment. Subsequently, the owner approved a single-commit history baseline
+(`2a80f4a`), force push and removal of old tags, then confirmed public visibility.
+Anonymous remote refs were verified; full fresh-clone/ZIP installation remains
+open in [TODO](../TODO.md).

package/doc/usage.md

@@ -0,0 +1,54 @@
+# Use AgentPay User
+
+The normal entry is `agentpay`; source checkouts also provide `./run`. Start with
+[installation](runbooks/user-onboarding.md); there is no need to run individual
+internal scripts for ordinary setup.
+
+| Task | Command / guide |
+| --- | --- |
+| Install or continue setup | `agentpay install --market URL`, then `agentpay setup` when returning |
+| Check local state | `agentpay status` |
+| Unlock / lock | `agentpay wallet unlock`, `agentpay wallet lock` |
+| Start / stop / restart | `agentpay service start`, `stop`, `restart` |
+| Login startup | `agentpay service autostart on` / `off` |
+| Inspect identity / restore | `agentpay wallet info`, `agentpay wallet restore` |
+| Change / revoke permission | `agentpay policy renew`, `agentpay policy revoke` |
+| Connect website support | `agentpay market connect` |
+| Review an Order | `agentpay orders list`, `details ID`, `status ID` |
+| Recover original result | `agentpay orders retrieve ID` |
+| Local files | `agentpay cache help`, `agentpay orders files ID` |
+| Update npm installation | `agentpay update` (confirm, or `-f`) |
+| Repair installed services | `agentpay repair` |
+| Remove services / erase data | `agentpay uninstall` / `agentpay uninstall --delete-data` (confirmation required) |
+
+See [full command reference](runbooks/commands.md) for arguments and examples.
+Status distinguishes saved local facts from refreshed observations. It is not a
+promise that a new purchase will be accepted. Online Order status queries go through
+Wallet; a failed query or missing local result does not prove non-payment.
+
+## Authorization and recovery
+
+[Browser owner approval](runbooks/safe-owner-web.md) is available for setup,
+renewal and revocation. [Deployment updates](runbooks/deployment-authorization-update.md)
+require deliberate owner approval; neither repair nor Runtime startup may silently
+replace Policy, key or Order identity.
+
+Back up the encrypted key and password securely, with the identity displayed by
+`agentpay wallet info`. Preserve the full private User data directory for local request
+and result recovery. A Policy ID alone cannot recover a lost key.
+
+## Local services and Skills
+
+The default data directory is `$HOME/.local/share/agentpay/user`, outside the source
+checkout. Runtime listens on loopback and requires a separate caller credential.
+A Skill uses local connection discovery; it must not bundle credentials or bypass
+Wallet. [Skill integration](runbooks/runtime-skill-client.md) explains per-call
+service references and recovery. No global Provider selection is required.
+
+`agentpay payment test` is a separate, explicitly paid connectivity check using the
+maintained, digest-pinned official package. Normal Runtime operation is not tied
+to that business example. An interrupted test retains its original request.
+
+[Background service guide](runbooks/local-autostart.md) explains Linux user services,
+login reminders and manual startup. A local lock or process stop does not revoke
+permission; follow [emergency stop](runbooks/emergency-payment-stop.md) when needed.

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "@c4roa0/agentpay-user",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.1",
+  "type": "module",
+  "dependencies": {
+    "ethers": "^6.17.0",
+    "fs-native-extensions": "1.5.3",
+    "@c4roa0/agentpay-protocol": "0.14.3",
+    "@c4roa0/agentpay-wallet": "0.3.1"
+  },
+  "scripts": {
+    "start": "node src/index.mjs",
+    "check": "node --check src/index.mjs",
+    "test:unit": "node --test test/*.test.mjs",
+    "test:invocation-store": "node --test test/invocation-store.test.mjs",
+    "test:prepare-onboarding": "node --test test/prepare-onboarding.test.mjs",
+    "test:installation-guide": "node --test test/install-user.test.mjs test/install-and-setup.test.mjs test/guided-setup.test.mjs test/prepare-onboarding.test.mjs",
+    "test:market-connection": "node --test test/connect-market.test.mjs test/local-wallet-ipc.test.mjs",
+    "test": "node --test --test-concurrency=1 test/*.test.mjs"
+  },
+  "license": "MPL-2.0",
+  "bin": {
+    "agentpay": "scripts/agentpay-cli.mjs"
+  },
+  "engines": {
+    "node": ">=22.22.3"
+  },
+  "files": [
+    "src/",
+    "scripts/",
+    "run",
+    "update-pair.json",
+    "README.md",
+    "LICENSE",
+    "NOTICE.md",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "progress.md",
+    "AGENTS.md",
+    "doc/"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/c4rO-0/agentpay-user.git"
+  },
+  "description": "Local AgentPay Runtime and guided Wallet setup for AI Agents",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/progress.md

@@ -0,0 +1,210 @@
+# AgentPay User progress
+
+## User 0.3.1 paired release preparation — 2026-11-08
+
+Public npm now contains Wallet 0.3.1 with Protocol 0.14.3. User 0.3.1 pins that
+published Wallet exactly; pairing metadata and lockfile are updated together.
+This release adds actual installed Protocol verification and running-version checks
+for status/repair. Prior release-gate notes below describe earlier checkpoints.
+User 0.3.1 passed 378 behavioral tests and standalone npm archive installation,
+including real Wallet/Runtime restart and matching running-version reports.
+User 0.3.1 publication and real published-version upgrade acceptance remain pending.
+No participant services, keys, Policies or Orders are changed by package verification.
+
+## Installed dependency verification / paired release — 2026-11-08
+
+User now checks the actual Protocol package resolved from User and Wallet separately,
+including nested npm copies. Process reports use resolved installed versions, not
+just dependency declarations. Wallet 0.3.1 candidate passed behavioral and independent
+package checks and is pushed as `7e4d4fa`; its OIDC publication is the next operator step.
+User remains pinned to public Wallet 0.3.0 until the new registry release exists;
+then update its exact dependency, lockfile and pairing metadata together. User changes
+remain unreleased. No participant service, key, Policy or Order was changed.
+
+## User 0.3.0 published; running-version checks in development — 2026-11-07
+
+`@c4roa0/agentpay-user@0.3.0` was published from User `86ee8e7`.
+Public registry version/latest and archive integrity matched the verified artifact.
+User and Wallet Trusted Publishers are configured; first OIDC releases remain pending.
+Earlier candidate sections below are historical, not current publication status.
+
+Wallet 0.3.1 candidate reports process-start software metadata. User status and repair
+compare running package/interface/Protocol versions against the installed pair.
+Missing reporting is unknown, never proof of compatibility. Policy format/version,
+identity and transaction authority are unchanged. Wallet behavioral tests (30) and installed-package IPC checks passed. User full
+regressions (378) passed, followed by final status checks and an isolated candidate
+Wallet/User process restart test. The candidate pair used a temporary test-only pin.
+
+Release gate: publish verified Wallet 0.3.1 first, then update User's exact Wallet pin,
+lockfile and pairing metadata and verify the combined package before publishing User.
+Current User still pins published Wallet 0.3.0; these development changes are not yet
+an installable verified release pair. No participant services/data were changed.
+
+
+## npm update and migration review fixes — 2026-11-07
+
+Approved `agentpay update [-f]`: query npm, confirm the exact User release and its
+pinned Wallet, check requirements, stop managed services, install and invoke the new
+repair/official-test digest. Other Skills, original test requests, Policies and keys
+are preserved. No paid test is triggered. Source/npm-link checkouts are not replaced.
+
+Review fixes: relocation-aware preparation validates without rewriting the client
+path before services stop; explicit data purge also retires matching legacy source
+checkpoints/configuration; packaged documentation includes its referenced public
+entry files. Independent regression suite: 374 passed; final targeted checks: 35
+passed. Real npm replacement between two local unpublished tarballs and new-process
+repair passed with controlled registry metadata/service readiness. User npm release
+and real published-version upgrade acceptance remain pending; no participant services changed.
+
+
+## User npm integration candidate complete — 2026-11-07
+
+User 0.3.0 now pins public Wallet 0.3.0 and Protocol 0.14.3, resolves public Wallet
+exports and exposes `agentpay`. Installer/setup, managed service paths, repair and
+explicit uninstall modes no longer require sibling Wallet source or a compiler.
+Private data remains outside program files. Old custom data selections are retained;
+repair can refresh a moved client-module path only with matching URL/credential.
+Service changes are covered by the installer lock.
+
+Independent User tests passed (366 in the complete suite, followed by targeted
+migration/concurrency regressions). A packed User installed from its tarball with
+public dependencies and passed real isolated Wallet/Runtime restart checks without
+sibling source. No participant service, Policy, key or Order was changed. User is
+still `private: true`; no User npm upload or Market guide deployment occurred.
+See the [User package integration record](doc/reference/npm-integration-verification.md) for evidence and remaining limits.
+
+Next: review the candidate, then participant install/upgrade/restart/uninstall
+acceptance. Running-daemon version negotiation, User OIDC publication and Market
+install instructions remain open. Wallet Trusted Publisher is configured by the
+owner and pending its first OIDC publication. Earlier sections below are historical
+milestones; their sibling-build and unpublished-Wallet statements are superseded.
+
+
+## Wallet first npm publication complete — 2026-11-07
+
+`@c4roa0/agentpay-wallet@0.3.0` is public; npm `latest` is 0.3.0. The owner
+published the verified artifact using a hidden-input Token. Registry SHA-512
+integrity matches the local artifact. A fresh public-registry installation with
+scripts disabled passed installed CLI and real IPC permission/unlock/restart checks;
+disposable test data was removed. Source revision: Wallet `082a8db`.
+
+The publication workflow is on GitHub, but Wallet's npm Trusted Publisher setup
+and first OIDC publication remain unverified. User 0.2.0 still rejects this Wallet
+pair; next development loop is User package adoption. No live Wallet services,
+keys, Policies or Orders were changed. Earlier candidate sections record pre-release
+evidence and are superseded for publication status by this section.
+
+
+## Wallet package review follow-up — 2026-11-07
+
+Review found a missing prepack build guard and stale internal-path examples in
+packaged documentation. Wallet now rebuilds compiled files before normal npm pack;
+installed tarballs need no build hook. Public client examples and package reading
+paths are corrected. Clean independent pack/install, a TypeScript consumer and real
+CLI/IPC unlock/restart checks passed. User integration remains the next loop;
+Wallet 0.3.0 is still unpublished and intentionally rejected by User 0.2.0 pairing.
+
+
+## Wallet npm candidate verified — 2026-11-07
+
+Steps 1–2 complete: Protocol migration baseline committed; Wallet 0.3.0 candidate
+provides public client/local-administration/CLI entries and compiled declarations.
+Independent frozen install/build and 29 behavioral tests passed. The packed artifact
+installed without sibling sources; real CLI/IPC checks passed for capability denial,
+no generic signing, unlock and restart preserving the key while locking the service.
+No npm publication, service restart or participant data change was performed.
+
+Next: User consumes this reviewed Wallet package and resolves public entries instead
+of sibling `dist/src` files. Current User 0.2.0 pair checks deliberately reject Wallet
+0.3.0; do not update a participant Wallet alone. Publication remains blocked by
+`private: true`; package and User integration must be completed before synchronization.
+
+
+## npm client distribution plan — 2026-11-07
+
+Approved npm-first distribution for Protocol, Wallet and User; separate repositories
+and processes remain. Ordinary users will install User, which supplies a reviewed
+compiled Wallet dependency. Combined source ZIP is optional later work. See the
+local distribution plan for public entries, upgrades, service paths, private data
+and uninstall boundaries. Steps 1–2 are authorized: commit the verified Protocol
+dependency baseline, then prepare/test Wallet's public package. User package
+integration and npm uploads are later loops; present sibling installation remains
+until replaced and verified.
+
+
+## Public Protocol npm migration verified — 2026-11-06
+
+User now pins `@c4roa0/agentpay-protocol@0.14.3`; production imports, test fixtures
+and the public notice use that package. No unrelated locked dependencies changed.
+The v1 update-pair metadata retains its `typesDependency` field and pins 0.14.3;
+checks require both User and Wallet to use the new package at that exact version.
+Old archive-based Wallet and different Protocol versions are rejected. Version-range
+compatibility remains planned; no legacy alias or bypass was added.
+
+Installer/repair fingerprints no longer require a vendor directory. Manifests and
+lockfiles still bind dependency changes. Removed the old archive/license/manifest
+after independent verification; historical review records describe the earlier state.
+With only sibling User/Wallet source in a temporary directory, frozen Wallet install,
+Wallet build, User npm ci and all 364 tests passed (zero failures/skips). Real installer
+prepare-only execution also passed twice: first preparation ran the package managers
+and build, unchanged retry skipped them. Actual pair checks/snapshot reads passed
+without vendor directories. This proves preparation and controlled local behavior,
+not participant setup, owner approval or real-network payment acceptance.
+No running services, key files, Policies or Orders were modified.
+
+
+## Public-source preparation — 2026-11-06
+
+User's original code is MPL 2.0, as selected by the owner; public Protocol and
+attributed reference fixtures retain MIT. Wallet and Protocol are public. User
+history was replaced by the approved single-commit baseline `2a80f4a`; the owner
+confirmed public visibility. Anonymous refs were verified on 2026-11-06. Release
+assets and full anonymous clone/ZIP installation remain separate work.
+
+Current preparation removes private platform harnesses and historical dependency
+archives from the public tree, uses the reviewed public Protocol 0.14.1 archive,
+and makes tests independent of sibling Agent/Protocol/private platform checkouts.
+User still requires a built sibling Wallet. The exact version pair and internal
+Wallet imports remain current constraints, not the planned compatibility contract.
+See [source review](doc/security/public-source-review-2026-11-06.md).
+
+Current documentation is organized by role and feature. Private chronological records
+and previous TODO snapshots are preserved outside the repository; removing them from
+publication does not cancel outstanding acceptance. Independent User + built public Wallet verification passed all 364 tests with no
+failures or skips. Offline installation, 112-file syntax-tree comparison, local
+Markdown links and whitespace checks passed. This does not establish live-network
+or fresh participant installation acceptance.
+
+Follow-up public-document review corrected stale Market per-Policy grouping claims,
+expired-Policy connection guidance and owner-signing descriptions across setup,
+renewal, migration and deployment references. Installation prerequisites now include
+npm/Corepack. The old preview module is labelled as such; executable behavior is
+unchanged. Local links, stale-wording scan, syntax and whitespace checks passed.
+
+## Implemented product scope
+
+- One grouped `./run` entry for installation, repair, Wallet/Policy operations,
+  Linux user services, Market connection, Orders and local cache management.
+- External-owner browser approval with resumable operation plans; separate guarded
+  Anvil signer. Policy renewal/deployment replacement preserves key and Order history.
+- Per-call service-neutral Runtime, private caller authentication, original request
+  recovery, durable input/result snapshots and explicitly managed attachment cache.
+- Stable Wallet display identity with individually verified Policy scopes. Local
+  status distinguishes saved metadata, live observations and unresolved results.
+- Official digest-pinned paid connectivity test, with explicit price consent and
+  original-request continuation after interruption.
+
+The recorded private single-owner MetaMask/Anvil authorization and payment journey
+passed, including participant Market Order viewing and independent payout reconciliation.
+This is scoped private evidence, not public-network, multisig, real-funds or production
+approval. Detailed operational records are not distributed in this repository.
+
+## Next work
+
+Public source preparation is complete within the recorded review scope. Next is the approved
+[distribution plan](doc/plans/user-wallet-distribution.md): a supported public Wallet
+client/version boundary and combined release archive. No automatic source updater.
+
+Official test network mapping, deployment/artifact handoff, complete interrupted owner
+signing and real-network acceptance remain open. macOS and graphical unlock remain
+deferred. [TODO](doc/TODO.md) tracks these gates and the retained acceptance backlog.

package/run

@@ -0,0 +1,29 @@
+#!/bin/sh
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+# If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+# Use an explicit Node installation without requiring a global installation.
+if [ -n "${AGENTPAY_NODE:-}" ]; then
+  case "$AGENTPAY_NODE" in
+    /*) node_path=$AGENTPAY_NODE ;;
+    *) printf '%s\n' 'AGENTPAY_NODE must be the full path to your Node executable.' >&2; exit 1 ;;
+  esac
+else
+  node_path=$(command -v node) || {
+    printf '%s\n' 'Node was not found. Set AGENTPAY_NODE to its full path, then retry.' 'Example: AGENTPAY_NODE=/path/to/node ./run help' >&2
+    exit 1
+  }
+fi
+if [ ! -f "$node_path" ] || [ ! -x "$node_path" ]; then
+  printf '%s\n' 'The selected Node executable does not exist or is not executable. Check AGENTPAY_NODE.' >&2
+  exit 1
+fi
+case "$node_path" in
+  /*) ;;
+  *) node_path="$PWD/$node_path" ;;
+esac
+# npm and its child scripts must see the same selected Node installation.
+PATH="${node_path%/*}:${PATH:-/usr/bin:/bin}"
+export PATH
+run_dir=$(CDPATH= cd -- "${0%/*}" && pwd -P) || exit 1
+exec "$node_path" "$run_dir/scripts/agentpay-cli.mjs" "$@"

package/scripts/agentpay-cli.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { runUserCli } from "../src/user-cli.mjs";
+try {
+  process.exitCode = await runUserCli(process.argv.slice(2));
+} catch (error) {
+  console.error(error.message || "Local operation failed. Run agentpay help.");
+  process.exitCode = 1;
+}

package/scripts/authorize-existing-safe.mjs

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+// Private-Anvil existing-Safe authorization. Never accepts an owner key.
+import { readFile, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { Contract, getAddress, JsonRpcProvider } from "ethers";
+import { Phase0Wallet } from "@c4roa0/agentpay-wallet/local";
+import {
+  buildSafePolicyPlan,
+  inspectSafePolicy,
+  safeEthSignSignature,
+} from "../src/safe-policy-plan.mjs";
+
+const [command, privateDirArg, configArg] = process.argv.slice(2);
+if (
+  !["preview", "authorize", "bind", "check"].includes(command) ||
+  !privateDirArg ||
+  !configArg ||
+  process.argv.length !== 5
+)
+  throw new Error(
+    "usage: authorize-existing-safe.mjs <preview|authorize|bind|check> <private-user-data-dir> <public-policy-config.json>",
+  );
+const dataDir = resolve(privateDirArg);
+const config = JSON.parse(await readFile(resolve(configArg), "utf8"));
+const walletDir = join(dataDir, "wallet");
+const wallet = await Phase0Wallet.open(walletDir);
+const delegate = await wallet.address();
+const plan = buildSafePolicyPlan(config, delegate);
+const ownerAddress = getAddress(config.ownerAddress);
+const rpc = new JsonRpcProvider(plan.rpcUrl, plan.chainId, {
+  staticNetwork: true,
+});
+try {
+  const state = await inspectSafePolicy(rpc, plan);
+  if (!state.owners.includes(ownerAddress) || state.threshold !== 1) {
+    throw new Error(
+      "C6 first rehearsal requires the selected Anvil owner to be the sole Safe signature threshold",
+    );
+  }
+  const publicPlan = {
+    chainId: plan.chainId,
+    safe: plan.safe,
+    ownerAddress,
+    delegate: plan.delegate,
+    module: plan.module,
+    factory: plan.factory,
+    registry: plan.registry,
+    token: plan.token,
+    policyId: plan.policyId,
+    maxPerPaymentAtomic: plan.maxPerPayment.toString(),
+    totalBudgetAtomic: plan.totalBudget.toString(),
+    validAfter: plan.validAfter,
+    validUntil: plan.validUntil,
+    dynamicQualification:
+      "AgentPay Registry at the fixed address; future qualified Skills need no new Policy",
+    currentState: state,
+    safeCalls: plan.calls,
+  };
+  if (command === "preview") {
+    process.stdout.write(
+      `${JSON.stringify({ ok: true, plan: publicPlan }, null, 2)}\n`,
+    );
+  } else {
+    if (command === "authorize") {
+      const url = new URL(plan.rpcUrl);
+      if (
+        plan.chainId !== 31337 ||
+        url.protocol !== "http:" ||
+        !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+      ) {
+        throw new Error("ANVIL_OWNER_SIGNING_TEST_ONLY");
+      }
+      if (state.policyExists && !state.policyMatches)
+        throw new Error("EXISTING_POLICY_CONFLICT");
+      if (!state.moduleEnabled || !state.policyExists) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, authorizationPreview: publicPlan }, null, 2)}\n`,
+        );
+        const expected = `AUTHORIZE ${plan.policyId}`;
+        if (!process.stdin.isTTY || !process.stderr.isTTY)
+          throw new Error("OWNER_AUTHORIZATION_TTY_REQUIRED");
+        const prompt = createInterface({
+          input: process.stdin,
+          output: process.stderr,
+        });
+        let answer;
+        try {
+          answer = await prompt.question(
+            `Type '${expected}' to submit the displayed Safe calls: `,
+          );
+        } finally {
+          prompt.close();
+        }
+        if (answer.trim() !== expected)
+          throw new Error("OWNER_AUTHORIZATION_NOT_CONFIRMED");
+        const calls = [
+          ...(!state.moduleEnabled ? [plan.calls[0]] : []),
+          ...(!state.policyExists ? [plan.calls[1]] : []),
+        ];
+        for (const call of calls)
+          await executeSafeCall(rpc, plan.safe, ownerAddress, call);
+      }
+    }
+    const final = await inspectSafePolicy(rpc, plan);
+    if (!final.moduleEnabled || !final.policyMatches)
+      throw new Error("CHAIN_POLICY_NOT_VERIFIED");
+    if (command === "bind") {
+      if (
+        await stat(join(walletDir, "wallet.sock")).then(
+          () => true,
+          (error) => {
+            if (error.code === "ENOENT") return false;
+            throw error;
+          },
+        )
+      )
+        throw new Error("STOP_WALLET_SERVICE_BEFORE_LOCAL_BIND");
+      if (wallet.policy) {
+        if (JSON.stringify(wallet.policy) !== JSON.stringify(plan.walletPolicy))
+          throw new Error("LOCAL_POLICY_CONFLICT");
+      } else await wallet.bindPolicy(plan.walletPolicy);
+    }
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          ok: true,
+          chainPolicyVerified: true,
+          moduleEnabled: final.moduleEnabled,
+          policyMatches: final.policyMatches,
+          localWalletBound: command === "bind" ? true : wallet.policy !== null,
+          remainingBudgetAtomic: (
+            plan.totalBudget - BigInt(final.policySpent)
+          ).toString(),
+        },
+        null,
+        2,
+      )}\n`,
+    );
+  }
+} finally {
+  rpc.destroy();
+}
+
+async function executeSafeCall(rpc, safeAddress, ownerAddress, call) {
+  const zero = "0x0000000000000000000000000000000000000000";
+  const safe = new Contract(
+    safeAddress,
+    [
+      "function nonce() view returns (uint256)",
+      "function getTransactionHash(address to,uint256 value,bytes data,uint8 operation,uint256 safeTxGas,uint256 baseGas,uint256 gasPrice,address gasToken,address refundReceiver,uint256 nonce) view returns (bytes32)",
+      "function execTransaction(address to,uint256 value,bytes data,uint8 operation,uint256 safeTxGas,uint256 baseGas,uint256 gasPrice,address gasToken,address refundReceiver,bytes signatures) returns (bool)",
+      "event ExecutionSuccess(bytes32 indexed txHash,uint256 payment)",
+      "event ExecutionFailure(bytes32 indexed txHash,uint256 payment)",
+    ],
+    await rpc.getSigner(ownerAddress),
+  );
+  const nonce = await safe.nonce();
+  const hash = await safe.getTransactionHash(
+    call.to,
+    0,
+    call.data,
+    0,
+    0,
+    0,
+    0,
+    zero,
+    zero,
+    nonce,
+  );
+  const signedMessage = await rpc.send("eth_sign", [ownerAddress, hash]);
+  const safeSignature = safeEthSignSignature(hash, signedMessage, ownerAddress);
+  const receipt = await (
+    await safe.execTransaction(
+      call.to,
+      0,
+      call.data,
+      0,
+      0,
+      0,
+      0,
+      zero,
+      zero,
+      safeSignature,
+    )
+  ).wait();
+  const events = receipt.logs.map((log) => {
+    try {
+      return safe.interface.parseLog(log);
+    } catch {
+      return null;
+    }
+  });
+  if (
+    receipt.status !== 1 ||
+    !events.some((event) => event?.name === "ExecutionSuccess") ||
+    events.some((event) => event?.name === "ExecutionFailure")
+  )
+    throw new Error("SAFE_OWNER_CALL_FAILED");
+  process.stdout.write(
+    `${JSON.stringify({
+      safeCall: call.purpose,
+      transactionHash: receipt.hash,
+      safeNonce: nonce.toString(),
+      confirmed: true,
+    })}\n`,
+  );
+}