obolos 0.0.0-stage → 1.4.0

package/CHANGELOG.md

@@ -0,0 +1,402 @@
+# Changelog
+
+All notable changes to the `obolos` CLI are documented here.
+
+## [Unreleased]
+
+## [1.4.0] - 2026-11-01
+
+### Added
+
+- `obolos login --try` connects to try.obolos.io.
+- `obolos upgrade` updates the CLI and its skill to the latest version.
+
+### Changed
+
+- Commands work on the network you logged in to, and read it through its public RPC, so neither `--chain` nor an
+  RPC URL is needed. Both still override.
+- `obolos whoami` and `obolos doctor` name the site: app.obolos.io or try.obolos.io.
+
+## [1.3.0] - 2026-11-01
+
+### Changed
+
+- Uses @obolos/sdk 1.2.1
+- The obolos skill installs the CLI itself when it isn't there, instead of asking you to.
+
+## [1.2.0] - 2026-11-01
+
+### Added
+
+- `obolos login` connects the terminal as one of your agent wallets: it prints a link and a code to approve in the app.
+  `--company <company>` connects it at one company, `--key` signs in with your own key.
+- `obolos agents` lists the agent wallets this terminal is connected as, `obolos agents use <name>` picks one, and
+  `obolos agents check <address>` asks whether a verified person stands behind an agent.
+- `obolos company incorporate --form` asks obolos to form the legal entity; `--formation <id>` sets the company up once
+  it is formed. `obolos company formation` lists your requests, and `obolos company details` shows or sets the legal
+  details.
+- `obolos email verify <address>` and `obolos email confirm <code>` verify the account's email.
+
+### Changed
+
+- Published on npm as `obolos`; earlier releases were `@equitylayer/cli` on GitHub Packages.
+- Uses @obolos/sdk 1.2.0, bundled into the package and minified. Installing the CLI no longer installs the SDK as a
+  separate package.
+- Works on Arbitrum One when no `--chain`, `OBOLOS_CHAIN_ID` or RPC URL names a network, so `obolos login` needs no
+  flags.
+- Requires Node 24.
+
+## [1.1.1] - 2026-10-22
+
+### Changed
+
+- Uses @obolos/sdk 1.1.1
+
+### Added
+
+- `fundraise create --price-salt <hex>` seals a priced round's price under a given salt, for an agreement rendered
+  beforehand with its price commitment.
+
+### Fixed
+
+- Back-to-back sends from one wallet each read a fresh nonce: the RPC provider keeps no request cache.
+
+## [1.1.0] - 2026-10-21
+
+### Changed
+
+- Uses @obolos/sdk 1.1.0
+
+## [1.0.0] - 2026-10-20
+
+### Changed
+
+- Uses @obolos/sdk 1.0.0
+- The CLI pins CoFHE SDK 1.0.1 for encrypted inputs and permit handling.
+- `fundraise reservation countersign` asks each deal's funding check with the company's signature when the actor
+  manages the fundraise, and `fundraise record` then records a deal that holds a yes in one transaction. A check holds
+  the deal's room until its record or a cancel, so recording another deal in between no longer sends it back for a
+  fresh one. On a priced round the share count is sealed with the check and only goes public with the record.
+### Added
+
+- `obolos treasury deposit --amount <amount>`: pay into the selected company's vault from your wallet.
+
+## [0.9.0] - 2026-10-17
+
+### Added
+
+- `fundraise publish <round>`: make a finalized SAFE or note round's total public. The company's session decrypts
+  the sealed total under its own permit and the announcement carries the network's signed result, which the contract
+  relays as the announcement lands. Until then `fundraise show` and `fundraise list` state the figure as confidential
+  to anyone but a session that may read it.
+
+- `fundraise reserve --source <fund-lead|platform>`: who brought the investor's capital, kept with the spot on chain;
+  the fund lead's when omitted. `fundraise reservations` lists each spot's source.
+- `fundraise create --carry <pct> --platform-share <pct>`: a vehicle's carry and the platform's share of it, fixed
+  with the round. `spv waterfall --round <id>` and `distribution waterfall --round <id>` take both, and every
+  investor's capital and source, from the chain.
+- `fundraise subscribe --source <fund-lead|platform>`: who brought you to the round, kept with your subscription on
+  chain; the fund lead's when omitted.
+
+### Changed
+
+- **A priced round's price is sealed.** `fundraise create --type priced` seals the price; `fundraise show` and
+  `fundraise list` state it, every amount and an unpublished total as confidential to a session that cannot read
+  them. `fundraise subscribe` on a priced round unlocks the price first when you cannot read it yet, and refuses an
+  amount that buys no whole number of shares. `fundraise record` names the shares on a priced round. `fundraise
+  finalize` on a priced round asks whether the sealed total qualifies it before its last window. `fundraise publish`
+  takes a priced round too, and its total reveals the price. Adding an address to a priced round's whitelist shows
+  it the price. `conversion show`, `list`, `trigger` and `settle` print the price only to a session that reads it.
+- **Nothing is paid on the contract.** `fundraise subscribe` makes an offer at the round's terms: it signs the
+  agreement and seals the amount, pays nothing, and one offer of yours stands open per round until the company
+  countersigns it or you withdraw it with `fundraise reservation cancel`. You pay by bank transfer or by sending the
+  payment token to the company's vault once the company has countersigned; the company then runs `fundraise record
+  <round> --reservation <id> --amount <usd>`, which on a SAFE or note round asks the network whether the sealed amount
+  fits and records with its answer, relayed by the record itself and only when it is yes and still current; a record
+  the round refuses publishes nothing. `fundraise reserve` seals a SAFE or
+  note spot's amount; `fundraise refund` reverses a cancelled round's payments on the ledger once the money went
+  back the way it came. Removed: `fundraise invest`, `fundraise exit`, `fundraise claim-refund`.
+- The Agent Skill is now `obolos` (was `use-obolos`): invoke it as `/obolos` in Claude Code or `$obolos` in Codex,
+  and `/obolos:obolos` through the Claude Code plugin. `obolos skills install` writes `skills/obolos`; delete an
+  older `skills/use-obolos` copy so agents don't load both.
+
+### Security
+
+- `docs read` without `--save` writes only a plain file name in the current folder: a document's name no longer picks
+  a path or a dot file.
+- `--expect-hash <hash>` on `send`, `resume` and every command with `--send` refuses a plan or stage whose hash
+  differs from the one approved (`cli.hash_mismatch`, exit 2). The skill tells agents to pass it with `--yes`. A
+  stage built only as the run advances shows no hash until the stage before it lands.
+- `fundraise reservation sign --accept-terms`, `conversion settle --prover-address` and `note repay --prover-address`.
+- `companies` and `whoami` show only direct grants as held; `whoami` lists covered roles under `implied`.
+
+## [0.8.0] - 2026-10-12
+
+### Added
+
+- `company modules`: the modules a company can add after creation, with their state and price.
+  `company module activate <fundraise|grants|voting|safe|note>` activates one at its credit price.
+- `company incorporate --modules fundraise,grants,voting --preload <usd>`: activate modules and buy credits right after
+  the company is created.
+- `compliance rule attach --kind max-holders-total [--max-holders <n>] [--unrecorded <n>]`: the company holder cap.
+  A later class joins the company's one instance.
+- `compliance set unrecorded-holders --count <n>`: holders the company has outside obolos, up to 1,000,000.
+- `compliance set max-holders` now sets whichever cap the entity takes.
+- `sdk prepare compliance.setUnrecordedHolders`.
+- `company incorporate --entity lp`: a Delaware limited partnership.
+- `compliance presets --all`: every preset as defined, ignoring the selected company.
+- `grant confirm-exercise <grantId> [--paid-on <date>] [--document <ref>]`: confirm a holder paid the strike of their
+  pending option or warrant exercise, which settles the shares to them; `--paid-on` is when the payment arrived (the
+  exercise date, defaulting to now) and `--document` names a payment receipt, if any. It confirms only the request it
+  showed, and only until the settlement window after the grant's expiry closes. `grant decline-exercise <grantId>`
+  declines an unpaid request while the grant is open; a paid one always settles. `sdk prepare grants.confirmExercise`
+  builds the confirmation directly, `sdk prepare grants.setSettlementWindow` sets the window (7 to 365 days, 14 until
+  set) and `sdk read grants.settlementWindow` reads it; `pool show` and `grant exercises` show it in days.
+- `grant withdraw-exercise <grantId>`: the holder withdraws their own request before its payment is on record.
+  `grant settle-exercise <grantId>`: publish an exercise's vesting check and settle it, your own or, for the company,
+  one whose payment is on record; a denial of a paid exercise says to return the payment to the holder.
+  `grant exercises [--holder <addr>]`: the exercises in flight, each with the date to confirm it by, the payment
+  reference the holder quotes and, with `--reveal`, the amount due.
+- A holder who can't hold the shares when their exercise settles, refused by the class's rules or frozen, has them
+  parked to claim later (`shares claim`); the exercise commands say so. `shares claim` says when your wallet is still
+  frozen on the class and the company has to lift the freeze first.
+- `grant cleanup` waits out the company's settlement window after an option or warrant expires, and
+  `grant record-exercise` refuses a payment dated before the grant's last vesting change.
+- `grant record-exercise <grantId> --shares <qty> --document <ref> [--paid-on <date>]`: for a holder who can't request
+  it, record an option or warrant exercise on their signed notice, then settle it to the holder. A notice and payment
+  that arrived before expiry stay recordable for the settlement window after it, and vesting counts as of
+  `--paid-on`. A data room notice is hashed onto the record; any other reference records no hash, with a warning that
+  the link is public.
+- `grant exercise` opens a confidential session when your key is configured, refuses a strike request for more than has
+  vested, and quotes the amount due in its payment note; without the key it warns that such a request is refused
+  publicly. It refuses a `--net` exercise that nets less than one whole share at the current valuation, and phantom
+  units at or under water, when your key can read the strike and the valuation, and warns when it can't.
+- `--paid-on <date>` on `grant confirm-exercise` and `grant record-exercise` counts to the end of that UTC day, or now
+  if sooner, and for a record to before expiry, so the vesting check counts the whole day; the date on record stays that
+  day.
+- `grant count-exercise <grantId>`: the company counts the shares a holder's net exercise nets at the valuation it was
+  filed at, which the holder never sees, then publishes the count and settles them to the holder. `grant exercise
+  --net` now only files the request; `grant settle-exercise` refuses a net request until it is counted, and
+  `grant exercises` and `grant show` say whether one is counted. `sdk prepare grants.confirmNetExercise` takes a sealed
+  count, so it goes through the command. Grant, warrant, milestone and schedule amounts are sealed as whole shares: a
+  fraction is refused before anything is sent.
+
+- `fundraise hardcap <round> --amount <usd>`: raise an open round's hard cap when an investor wants to put in more, or
+  lower it, never below the money in; zero lifts it.
+- `sdk prepare grants.acceptGrant` and `sdk prepare grants.filePaperAcceptance`: a holder's signed acceptance of a
+  grant's document, and the company's filing of one given on paper. A grant without a document hash is accepted too,
+  and a paper filing takes any scan link, with a `scanHash` of zero unless the scan is a data room document.
+- `docs list --history`: earlier versions too, each with the reference of the version that superseded it.
+- `grant attach-document <grantId> --document <ref>`: attach a data room document, with its hash, to a grant that
+  records none. Only a data room document is taken, and only its latest version; it is shared with the holder when
+  you hold Records. The attach is permanent, and it replaces an outside link the grant was issued with. It clears
+  the holder's signed acceptance, which covered no document, so they accept the attached one; a paper acceptance
+  stands. `sdk prepare grants.attachDocument` builds the call directly.
+- `grant show` and `grant list` show each grant's document hash and acceptance (`none`, `signed` or `paper`, and when).
+
+### Changed
+
+- Reaches the 12 Oct 2026 Arbitrum Sepolia deployment, through SDK 0.35.0.
+- Warrant commands (`grant issue --type warrant`, `pool increase|decrease --budget warrant`, and confirming, recording,
+  settling or attaching a document to a warrant) need the Shares role, like every other grant; Fundraise no longer
+  covers warrants.
+- `grant issue --milestone` and `vesting create --milestone` take `date:shares` or `<document ref>:date:shares`; the
+  leading part was a free-text label and is now a document reference. Every `--document` and `--evidence` refuses text.
+  `vesting show` prints each milestone's document reference.
+- `grant exercise` pays no strike on chain. On an option or warrant it files a request: the holder pays the company
+  the strike off-platform, and the shares arrive once the company confirms the payment (`grant confirm-exercise`). It
+  settles RSUs and phantom units itself, and nets options with `--net`. The prepare action `grants.exerciseGrant`
+  replaces `grants.exerciseOptions` and `grants.exercisePhantom`, and `grants.recordExercise` and
+  `grants.confirmExercise` are new.
+- `safe issue` and `note issue` require `--document`, the signed agreement's reference, which may be any link. A data
+  room document (`obolos://rooms/<room>/folders/<folder>/doc/<index>`) is read with your key and hashed; one stored in
+  the clear is hashed with a warning that the investor's private terms are readable. `--document-hash <hex>` gives
+  the keccak256 of its bytes instead, and any other link records no hash. A data room document you can't open, such as
+  a removed one, is refused, as in the app.
+- A command that records a `--document` hashes a data room document onto the record: its bytes come through
+  `OBOLOS_API_URL` or the API the project signed in to, and it opens with your key. Any other reference, an `ipfs://`
+  file included, records no hash.
+- `docs replace` files the new version as a new document at a new reference, which the run file's outputs carry
+  (`documentRef`, and the old reference as `replaces`); the old reference keeps its bytes and readers. A reference
+  that already has a newer version is refused, naming the latest.
+- `docs list` shows the latest version of each document. `docs show` and `docs read` name the newer version when one
+  exists, and `docs sign` warns before signing an earlier version.
+- `docs show` lists every version of the document, oldest first. `docs list` and the folder question count each
+  folder's current documents: latest versions only, removed ones left out.
+- `grant transfer` shares the grant's data room document with the new holder when you hold Records and your key is
+  configured, so they can accept it. Without the key it still prepares, and warns that the document needs sharing by
+  hand; nothing about sharing ever stops a transfer.
+- `grant issue`, `safe issue` and `note issue` share a sealed data room document with the recipient in the issuing
+  transaction when you hold Records, and warn otherwise.
+- `safe cancel` and `note cancel` hash a data room `--document` onto the record, like the other commands that record
+  one.
+- `docs replace` keeps the document's kind tag, refuses a document whose latest version was removed (upload a new
+  one instead), and warns that whoever could read the old version keeps it.
+- A command that hashes a `--document` onto its record warns when that reference has a newer version.
+- `compliance presets` lists the selected company's presets (`--company`, `OBOLOS_COMPANY` or `obolos use`), or every
+  preset with the entity types it is offered to when none is selected. `compliance policy create --preset` refuses a
+  preset the company's entity type is not offered.
+- `fundraise create` warns, instead of refusing, when a round open to anyone rests on a policy without KYC or
+  sanctions: attach the rules before investors pay.
+- Workflow commands open a confidential session only when the path they take needs one: a decline or a withdrawal
+  prepares without one, and so does a strike exercise request unless your key is configured, when it checks the request
+  against what has vested first.
+
+### Removed
+
+- `fundraise create --person-cap`: the maximum investment always counts per person for wallets bound at the company,
+  and per wallet otherwise.
+
+### Fixed
+
+- `grant exercise` and `grant record-exercise` refuse a grant before its first whole vesting interval has passed, cliff
+  or none, as the chain does; `grant exercise` says when the first shares vest.
+- `fundraise reserve --reservation <id>` now sends with a key: the old spot is cancelled, then the new one committed.
+- `fundraise reservation countersign` names the Fundraise viewing permission a signer lacks, before signing.
+- `fundraise subscribe` and `fundraise invest` refuse an address that is not an obolos company.
+- `docs upload` completes its run once the document is filed; it looked for the filing under the room instead of the
+  folder.
+
+## [0.7.0] - 2026-09-28
+
+### Added
+
+- `passport attest` and `passport activate` for platforms, over the obolos passport API with `OBOLOS_API_KEY`.
+- `passport activate` and `passport attest` take the wallet's `--signature` and its `--issued-at`, and `attest`
+  takes the person's `--code`. `--code -` reads the code from stdin, so it stays out of argv. With `--email`, the
+  signed message names that email on its `Email:` line. The refusals `consent_required`, `signature_invalid`,
+  `locked` and `rate_limited` exit 4 like every other refusal.
+- `fundraise subscribe <round> --amount <usd>` signs the round's published agreement and pays at its public terms in
+  one step; a first subscription at the company opens your private channel with it in the same batch. The company
+  accepts by signing within seven days, or refunds; left unaccepted, `fundraise exit` takes the money back after
+  seven days.
+
+### Changed
+
+- **Breaking:** `fundraise create` takes `--agreement <ref>`, the round's agreement, and publishes it unsigned and
+  unencrypted in the round's Term Sheets with its hash pinned on the round (`--agreement-hash`, or fetched and hashed
+  through `--api-url`) before opening the round. A company without a data room, or an actor without Records
+  authority, is refused. `--person-cap` needs `--max` and the company's attestation hub.
+- **Breaking** for rounds open to anyone on custom policies: `fundraise create` without `--whitelist-only` refuses a
+  policy that lacks a KYC rule at level 1 or above or a sanctions rule with its oracle set
+  (`workflow.fundraise.create.policy_unscreened`, exit 4). Attach them with `compliance rule attach --policy <ref> --kind kyc` or `--kind ofac`, use a policy made from
+  a preset, or pass `--whitelist-only`; the company then vets who subscribes.
+- **Breaking:** `fundraise invest` requires `--reservation <id>` and pays a spot the company committed and signed,
+  signing its agreement in the same step when you have not, after checking the spot's sealed terms open its
+  commitment; `--draft-hash` names a bespoke draft. With a plain key, each step is its own transaction. Subscribing
+  at the round's terms is `fundraise subscribe`.
+- **Breaking:** `fundraise reservation countersign --reservation <ids...>` signs deals for the company, several in
+  one batch: a spot committed unsigned, one the investor signed first, or a subscription, where signing is the
+  acceptance. A subscription older than seven days can no longer be accepted (`acceptance_closed`, exit 4).
+  `--draft-hash` names bespoke drafts, and `--paper` files the company's paper signatures instead.
+- **Breaking:** `fundraise record` requires `--reservation <id>`, a spot the company signed. `--document` is the
+  investor's paper signature, filed in the same run unless one is on record. Past the round's deadline it is refused
+  (`deadline_passed`, exit 4), as the contract refuses the record.
+- `fundraise reserve` commits a spot for a named investor at the round's terms or bespoke ones (`--cap`,
+  `--discount`, `--mfn`, `--pro-rata`), over the round's agreement or a bespoke draft (`--draft-hash`), signed for the
+  company when you sign documents (`--unsigned` leaves it for a signer). `--reservation <id>` replaces an unfunded
+  spot in one batch.
+- `fundraise reservation sign` signs a spot as its investor without paying, for a wire or to pay later;
+  `reservation file` files an investor's paper signature; `reservation attach` attaches or replaces a spot's
+  document, and both signatures start over; `reservation cancel` withdraws an unfunded spot or refunds a funded
+  allocation.
+- `obolos send` hands a run that pins documents storage through the API the project's session signed in to, with that
+  session, which goes to no other API; nothing of the session goes into the run file. A run recording another API
+  (`normalizedInput.apiUrl`) is refused (`cli.usage`), since its file carries no key and may be edited. A command
+  pinning through another API than the session's (`--api-url`, `OBOLOS_API_URL`) is not handed the session and asks
+  for a sign-in. A stage stopped for storage says how to resume.
+- **Breaking:** the passport commands send `OBOLOS_API_KEY` only to `OBOLOS_API_URL` or the default API, never
+  to the `apiUrl` of a project's `.obolos/session.json`, which could send the key anywhere. `passport attest`
+  prints `status: "code_sent"` for an email's first call and `credentialId` in place of `passportId`.
+- **Breaking:** `identity activate` is gone with holder-side activation; platforms use `passport activate`.
+- **Breaking:** `identity secret store`, `identity secret clear` and `identity secret recover` are gone with the
+  hub's identity vault, and `identity status` no longer reports it.
+- **Breaking:** `compliance rule attach` and `compliance set accreditation` drop `--qp`. The accredited rule no
+  longer carries a qualified-purchaser alternative; qualified-purchaser status is a `qpType` predicate.
+
+### Fixed
+
+- The provider key (`OBOLOS_API_KEY`) is sent only to `OBOLOS_API_URL` or the default API, never to the API a project's
+  `.obolos/session.json` names, so a cloned repository cannot redirect it.
+- The private-key error no longer echoes the rejected value: a malformed `OBOLOS_PRIVATE_KEY` or mnemonic
+  used to appear verbatim in `--json` output and on stderr.
+- An acting address that is not an address is refused naming where it came from (`--from`, `OBOLOS_FROM`
+  or `.obolos/config.json`), never quoting it, so a private key set there no longer reaches the output.
+- Invalid JSON input keeps the parser's account of the fault but drops its excerpt of the text, so a malformed
+  input file never prints what it holds.
+- `send`, `resume` and `--send` validate `--confirmations` before broadcasting; `0`, a negative value or a
+  fraction used to send the stage anyway and then hang waiting to reach it.
+- A plan send whose transaction is not included within 120s stops with exit 5 instead of waiting forever,
+  and says the transaction may still land, so it is checked by hash before the plan is sent again. Once it
+  is included, extra `--confirmations` are waited out untimed, so a mined transaction is never reported as
+  unmined and re-sent.
+- `sdk read` and `sdk prepare` refuse internal client plumbing (`executor`, `workflows`, `actions`, ...), and
+  builders that take a sealed input or a CoFHE proof (`grants.exerciseNet`, `voting.castBallot`,
+  `voting.castBallotFor`) are classified confidential rather than read or plain prepare.
+- `parsePlan` refuses calldata that is not a whole number of bytes.
+
+### Changed
+
+- The CLI resolves `@obolos/sdk` from the workspace, so the next build also carries the SDK's narrower
+  jurisdiction gate (ADR 17: rounds, direct SAFE and note issuance, comp grants and warrants only) and its
+  stricter sharing- and prover-permit scoping, with no CLI code of its own to change.
+
+## [0.6.0] - 2026-09-16
+
+### Added
+
+- `obolos distribution`: `dividend` and `waterfall` prepare a distribution (`--payment-date`,
+  `--claim-window-days`, `--exclude`, `--off-platform`, `--unvested pay|hold`), then `pay`, `record`,
+  `top-up`, `claim`, `claim-pending`, `close`, `cancel` and `show` carry it through settlement.
+
+### Changed
+
+- Licensed under the obolos Source Available License 1.0 instead of BUSL-1.1.
+
+### Removed
+
+- The dividend commands.
+
+## [0.5.0] - 2026-09-12
+
+### Fixed
+
+- `compliance presets` works with an actor configured through `--from`, the environment, local config,
+  or a signer. Commands only inject an `actor` input when the workflow schema declares it.
+
+### Added
+
+- `shares parked list --holder <address>` shows a wallet's unclaimed parked lots, and
+  `shares parked cancel --holder <address> --lot <id>` voids one that must never be claimed.
+
+- `shares issue --issued <date>` records an existing holding's acquisition date without
+  requiring a round. `shares claim --lot <id>` selects a parked allocation; the CLI asks
+  when several exist. Claims preserve each allocation's date and require current eligibility.
+
+- `fundraise create --policy` takes an address or a name and must point at a policy that already
+  carries its rules (`compliance policy create`, `compliance rule attach`); the `create` shortcut is
+  gone. Missing SAFE or note terms are asked for; `--cap none`, `--discount none`, `--no-mfn`,
+  `--no-pro-rata` and `--no-early-repayment` state a negative without a prompt.
+
+### Changed
+
+- `conversion trigger` no longer prices anything. It reopens a qualifying round's lapsed series
+  (`--round <id>`, default the latest qualifying round) on that round's own class, price and
+  pre-money basis, over the instruments outstanding when the round qualified. `--class`,
+  `--price` and `--document` are gone; a priced round finalizing at the threshold opens the
+  series itself.
+
+### Added
+
+- `obolos skills install|list`: the `use-obolos` Agent Skill now ships with this package. It is
+  installed to the cross-agent `~/.agents/skills` root plus every detected agent directory
+  (Claude Code, Cursor, OpenCode, GitHub Copilot, Factory Droid), is idempotent, refuses to
+  overwrite a locally edited copy without `--replace`, and backs one up when replacing. `--agent`
+  accepts `codex`, `gemini`, `amp`, `cline` and `warp` as names for that shared root. Moved
+  here from `@obolos/sdk`, whose `obolos-skill` binary is gone: the skill routes an agent to
+  these commands, so it belongs with the package that provides them and versions with it.
+- Initial SDK-backed `obolos` CLI with dynamic reads and preparation, tamper-evident plans,
+  batching, simulation, company/jurisdiction inspection, structured error decoding, diagnostics,
+  and guarded user-owned-key sending.
+- Versioned workflow discovery/preparation (`workflow list|describe|prepare`) and the user-intent
+  `shares issue` command, both backed by `@obolos/sdk/workflows` with no duplicated ABI or rules.

package/LICENSE

@@ -0,0 +1,134 @@
+obolos Source Available License 1.0
+===================================
+
+Licensor: Obolos Group Incorporated
+
+Software: the software the Licensor distributes with this license, including
+the obolos protocol contracts and circuits, the SDK, the CLI, the indexer and
+the backend, each version separately
+
+Other licenses: legal@obolos.io
+
+1. Acceptance. By using the Software you agree to these terms as conditions of
+every license they grant. If you do not agree, you have no license.
+
+2. What you may do.
+
+  (a) Non-Production Use. You may copy, modify, create derivative works of, and
+      distribute the Software for Non-Production Use.
+
+  (b) Use with Authorised Deployments. You may use, modify and combine with
+      your own software the SDK, the CLI, the interface definitions and the
+      documentation in Production Use to interact with Authorised Deployments,
+      including to build and operate your own products that interact with
+      Authorised Deployments.
+
+  (c) Conditions. Every copy or derivative work you distribute must carry this
+      license, the Licensor's copyright notice and any Required Notice, and
+      must identify the changes you made. You may not remove or obscure a
+      notice or any licensee identification in the Software. A product built
+      under section 2(b) may include the SDK and the interface definitions in
+      compiled or bundled form without identifying changes, provided the
+      notices in the Software's own files are kept.
+
+3. What you may not do. Without a separate written license from the Licensor,
+you may not:
+
+  (a) deploy the protocol contracts, or any derivative work or compiled form of
+      them, to any network, or operate such a deployment, other than as an
+      Authorised Deployment or as Non-Production Use;
+
+  (b) use the Software, its interface definitions, ABIs, schemas or
+      documentation to deploy, operate or interact with any implementation or
+      redeployment of the protocol that is not an Authorised Deployment, other
+      than as Non-Production Use;
+
+  (c) make Production Use of the Software or any derivative work except as
+      section 2(b) allows;
+
+  (d) use the Software or any derivative work to provide a Competing Product;
+
+  (e) sublicense or transfer your licenses.
+
+4. Patents. The Licensor grants you a license under the patent claims it can
+license that your permitted use of the Software would otherwise infringe, for
+that permitted use only. If you or your company make a written claim that the
+Software, or a product or service of the Licensor that uses it, infringes a
+patent, your patent license ends immediately.
+
+5. Contributions. If you submit changes or new works to the Licensor, you grant
+the Licensor a perpetual, irrevocable, worldwide, royalty-free, sublicensable
+license, including under any patent claims you can license, to use, modify,
+distribute and relicense them under any terms, and you confirm that you have
+the right to grant it.
+
+6. Third-party components. Third-party components included with the Software
+remain under their own licenses, which are identified in the Software. These
+terms do not apply to them and do not limit the rights those licenses give you.
+
+7. No trademark rights. These terms grant no right to use the name obolos or
+any other name, mark or logo of the Licensor, except to describe the origin of
+the Software accurately.
+
+8. Term and termination. Your licenses continue for as long as you comply with
+these terms and do not expire or convert to any other license. They end
+automatically if you violate these terms. The first time the Licensor notifies
+you in writing of a violation, your licenses continue if you cure it within 30
+days of the notice, except that a violation of section 3(a), 3(b) or 3(d) ends
+your licenses for every current and later version of the Software immediately.
+Termination of your licenses does not end the licenses of people who received
+the Software from you in compliance with these terms.
+
+9. Versions and other rights. This license applies separately to each version
+of the Software. The Licensor may offer later versions under different terms
+and may grant anyone other licenses. All rights not expressly granted are
+reserved. Nothing in these terms limits rights you have under applicable law
+that cannot be limited by contract, including fair use, and where the law does
+not allow these terms to restrict the use of interface information to achieve
+the interoperability of an independently created program, they do not restrict
+it. If any term is unenforceable, the rest remain in force. This is not an
+open-source license.
+
+10. No warranty and no liability. The Software is provided as is, without
+warranty of any kind, express or implied, including merchantability, fitness
+for a particular purpose, title and non-infringement. To the extent the law
+allows, the Licensor is not liable for any damages arising out of these terms
+or your use of the Software, under any legal theory.
+
+11. Definitions.
+
+  (a) "Authorised Deployment" means an instance of the protocol contracts
+      deployed by the Licensor, or by another person with the Licensor's
+      written authorisation, at the addresses the Licensor publishes, including
+      in the SDK's address configuration, together with every contract created,
+      directly or indirectly, by such an instance.
+
+  (b) "Non-Production Use" means use for evaluation, development, testing,
+      security research, audit or education that, if it runs on a network, runs
+      only on a local, test or development network, does not create, record or
+      transfer rights, obligations or value for any person, and does not
+      provide the Software's functionality to third parties as a product or
+      service. Any other use is "Production Use".
+
+  (c) "Competing Product" means a product or service, whether or not offered
+      for a fee, that provides functionality substantially similar to the
+      Software or to a product or service that the Licensor or one of its
+      affiliates provides using the Software, regardless of interface,
+      platform, network or programming language. A product that provides its
+      functionality through Authorised Deployments is not a Competing Product.
+
+  (d) "You" means the person or entity agreeing to these terms, and "your
+      company" means every organisation you work for and every organisation
+      that controls, is controlled by, or is under common control with it.
+
+  (e) An "affiliate" of the Licensor is any organisation that controls, is
+      controlled by, or is under common control with it. Control means the
+      power to direct an organisation's management and policies, by ownership,
+      vote, contract or otherwise.
+
+  (f) "Distribute" includes making the Software, or any part of it, available
+      to third parties by any means.
+
+Required Notice: Copyright (c) 2026 Obolos Group Incorporated. Licensed under
+the obolos Source Available License 1.0, [https://obolos.io/license].
+Commercial licenses: legal@obolos.io.