otto-execute 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 otto AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,151 @@
+# otto-execute
+
+The **user's side** of Otto Model B.
+
+> **Agent path to a delegation — `otto-execute delegate`** (`otto-execute/delegate` entry): sign in as the end user by email OTP (typed on the terminal, never echoed, never written), mint a time-boxed CDP delegation to Otto's project (default 90 days, max 180), read it back, revoke it — all from the agent's own process, end-user-side (no Otto credential is ever in it). Before minting it reads the hosted MCP's PUBLIC `otto_delegation_fence_status` and refuses when the Model-B fence is not present (and fails closed when the MCP cannot be reached). **This path is not documented or supported by Coinbase and can break on an SDK update; the browser page is the supported path.** `@coinbase/cdp-core` is an optional peer PINNED to `0.0.120` (the version proven live); a canary test drives its real web build on Node against a loopback fake on every dependency bump, and the shim breaking is a named refusal (`CDP_CORE_NODE_PATH_BROKEN`), never a silent failure. The fence source (Otto's MCP, `https://mcp.ottoai.services/mcp`) and the CDP SDK endpoint are **fixed** — no flag or environment variable redirects either, and the mint binds to the public project id the fence itself publishes (there is no `--project-id`). The command also refuses to run with any Otto credential or 64-hex value in its environment, and keeps the OTP out of argv by every spelling. **Threat model:** the residual after all of the above is a **platform universal**, not a property of this CLI — a caller who controls the process environment has pre-entry arbitrary code execution in ANY Node program (via `NODE_OPTIONS=--import=…`, `LD_PRELOAD`, or PATH-shadowing the `node` binary), so environment control is equivalent to process control. **An attacker with environment control of your shell already owns your OTP and every CLI on the machine.** Run the delegate path only in an environment you trust.
+
+Otto's hosted MCP (`otto-intel-mcp`, `https://mcp.ottoai.services`) constructs transactions
+**prepare-only**: `otto_prepare_swap` returns an unsigned, digest-committed envelope carrying a LI.FI
+swap with Otto's fee attribution baked in. Nothing in it is signed. This package is what **your**
+signer runs before and while signing one:
+
+1. **Verify** — integrity (the constructor's own schema / digest / commitment / freshness / binding
+   assertions), then **your intent** (input token and exact amount, the deposit legs pulling exactly
+   that, the output token, and your own positive minimum output), then policy (reviewed router,
+   `_receiver` == you, the fee leg decoded independently and matched to the ruled 10 bps to Otto's
+   recipient through a reviewed FeeForwarder deployment, aggregate under the cap). Twelve named checks
+   (+ `intent_digest` when you pass the exact request you sent). A verified plan is deep-frozen and
+   registered by identity; signers additionally require the plan to be bound to THEIR address and chain, to
+   cover their capabilities, and to be fresh at signing time — re-checked before every live step.
+2. **Sign / submit** —
+   - **BYO/EOA** (`EoaSigner`): your key signs **and** submits, one ordered transaction per step,
+     halting and clearing a live allowance on any uncertain failure (the clear is confirmed by an
+     `allowance` read-back, never inferred from a receipt). Freshness and binding are re-asserted
+     immediately before every signature, after the nonce / fee / gas round trips. `signPlanDryRun`
+     signs, decodes back and recovers without broadcasting.
+   - **CDP-delegated** (`CdpDelegatedSigner`, from the `otto-execute/cdp` entry): you have already signed
+     in and minted a time-boxed delegation; Otto's server submits your own transactions under it —
+     user-authenticated, Otto-governed (project policy), Otto-revocable. No raw-submission surface exists
+     on the signer; submission, allowance clearing and revocation are serialized on one lock per rig.
+   - **x402** (`validateX402Challenge` + `EoaSigner.signX402Payment`): a 402 is validated against an
+     exact-match table (resource, recipient, exact amount, exact 300 s window, pinned EIP-712 domain),
+     revalidated immediately before signing, and the produced authorization is checked against the
+     table row. The `table` parameter is public on purpose: it defaults to the built-in `X402_TABLE`
+     (Otto's routes), and a caller may pass a narrower or newer table — the per-payment spend cap below
+     bounds what any table can authorize, so a wrong table cannot sign for more than `$1`.
+
+Otto never holds your keys or funds on either path.
+
+## Install
+
+```bash
+npm install otto-execute
+```
+
+That installs this package plus `@x402/core`, `@x402/evm`, `viem` and `zod` — 18 packages. The parts of
+`otto-intel-mcp` this package runs at runtime (`otto-intel-mcp/execution`, `/adapter`, `/adapter-cdp` —
+the envelope schema, the verifier, the signing adapters) are **vendored** into `dist/vendor/otto-intel-mcp/`
+at build time as file-for-file copies of the published `otto-intel-mcp` release, so a consumer does not
+install that package (it is also an MCP server and would cost ~240 packages). The copy is byte-verified:
+`dist/vendor/otto-intel-mcp/VENDORED.json` records the version, the registry integrity hash and a sha256 per
+file; `npm run vendor:check` re-derives it (and runs in `prepack`). A change in the seam is therefore a
+visible `otto-intel-mcp` version bump + re-vendor here, never silent drift. `@coinbase/cdp-sdk` stays an
+optional peer, loaded only by the `otto-execute/cdp` entry.
+
+Working on it inside the monorepo:
+
+```bash
+cd services/otto-execute && npm ci
+npm run verify          # typecheck → build (tsc + vendor-seam) → tests; the prepublishOnly gate
+npm run fixtures:check  # monorepo-only: the committed envelope fixtures still match the sibling constructor
+npm run smoke:install   # pack + clean install outside the repo + a real verify + the consumer package count
+```
+
+The test suite is **hermetic**: it resolves `otto-intel-mcp/*` from `node_modules` (the published package,
+an exact devDependency) and runs on captured envelope fixtures under `test/fixtures/envelopes/` — genuine
+`otto_prepare_swap` outputs built by the constructor's own code over its real LI.FI captures and committed by
+`scripts/capture-envelopes.ts` (the one file that touches `../otto-intel-mcp`, run only in the monorepo).
+
+**Sealed-state rule (Base Flashblocks).** A receipt can arrive from a preconfirmation while `latest` — the
+state gas estimates and reads run against — still predates it, and a preconfirmation is not final (a
+Flashblock reorg = a preconfirmed transaction omitted from the sealed block). Both signers therefore count a
+transaction as mined ONLY once `waitForSealedReceipt` has refetched its receipt and the sealed canonical
+block at that height carries the receipt's block hash — before the next estimate and before the allowance
+read-back after a clear; if that never happens within the bound, the step fails closed. Observed live
+2026-08-28: an approve preconfirmed, the swap call estimated against `latest`, `TRANSFER_FROM_FAILED` on an
+allowance already granted. The wait is what a user's wallet observes.
+
+`@coinbase/cdp-sdk` is an OPTIONAL peer: only the CDP-delegated signer needs it, and that signer lives on its
+own entry — `import { CdpDelegatedSigner } from 'otto-execute/cdp'`. The root entry (`otto-execute`: verifier,
+BYO/EOA signer, x402 table) and the CLI never resolve the SDK; `test/root-without-cdp.test.ts` loads the root
+with the peer made unresolvable to prove it. The dev-only `.npmrc` (`legacy-peer-deps`) is **gone**: it existed
+only because the SDK's optional `@x402` peers want `^2.19` while this package pinned `2.16.0`, and the
+reconcile to `2.23.0` satisfies that range natively — `npm install` now succeeds with no flag.
+
+> **`@x402/*` reconciled to 2.23.0 (2026-09-01)**, matching what `otto-intel-mcp@0.1.0` ships, so one
+> `@x402/core` instance serves both packages.
+>
+> **`spendControls` is set explicitly, and KEPT.** `@x402/core` ≥ 2.23 seeds `spendControls = {}` in the
+> bare `x402Client` constructor, which the SDK reads as *default assets only, capped at `$1` per payment*.
+> `signX402Payment` states that cap in our own source (`PER_PAYMENT_SPEND_CAP = '$1'`) instead of inheriting
+> it, so the number is visible here and a future SDK default cannot move it silently.
+>
+> It is deliberately **not** disabled. The table checks more *fields*, but it is **not an independent
+> authority**: `table` is a parameter, and even the default table's `amount_atomic` values are hand-edited
+> constants that nothing else cross-checks. A price typo (`5000` → `5000000`) leaves the table agreeing with
+> itself perfectly, and only a cap derived from the requirement amount rather than from the table stands
+> between that typo and a signature for 1000× the intended amount. Field coverage is not a second opinion.
+>
+> The SDK's rejection is translated into this package's own vocabulary as
+> **`X402_SPEND_LIMIT_EXCEEDED`** — a distinct condition from `X402_AMOUNT_EXCEEDED` (which means the
+> *challenge* disagreed with the table; this one means the *table* asked for more than the budget). Only
+> that rejection is translated; every other error rethrows untouched.
+>
+> Three tests pin it, mutation-proved in both directions: a `$5` typo row is never signed (flip the cap to
+> `false` and it signs; delete the translation and a raw SDK error escapes instead of an `X402Refusal`), a
+> live-priced row still signs through the same path, and a challenge that disagrees with the table is still
+> `X402_AMOUNT_EXCEEDED`.
+
+## Library
+
+```ts
+import { verifySwapEnvelope, defaultAdapterPolicy, EoaSigner } from 'otto-execute';
+
+const signer = EoaSigner.fromPrivateKey(process.env.MY_KEY as `0x${string}`, RPC_URL);
+const verified = verifySwapEnvelope(envelopeFromMcp, {
+  profile: { kind: 'eoa', address: signer.address, chainId: 8453 },
+  intent: { fromToken: USDC, toToken: WETH, fromAmount: 2_000_000n, minAmountOut: myOwnFloor },
+  capabilities: signer.capabilities,
+  policy: defaultAdapterPolicy(8453),
+  prepareInput: theExactInputISentToOttoPrepareSwap, // optional: binds intent_digest to your request
+});
+await signer.signPlanDryRun(verified); // proves what would be signed; broadcasts nothing
+await signer.sendPlan(verified); // Base mainnet, real funds
+```
+
+`minAmountOut` is **yours**: derive it from a price source you trust. It is also the on-chain fence
+for the swap's internal DEX legs (LI.FI's router reverts unless you receive at least it), so it must
+be positive.
+
+## CLI
+
+```bash
+otto-execute verify --envelope e.json --intent intent.json --account 0x…           # no key needed
+OTTO_EXECUTE_PRIVATE_KEY=0x… otto-execute sign   --envelope e.json --intent intent.json   # dry: sign + decode back
+OTTO_EXECUTE_PRIVATE_KEY=0x… otto-execute submit --envelope e.json --intent intent.json --i-understand-mainnet
+otto-execute x402 --challenge c.json            # validate a 402 against the table
+OTTO_EXECUTE_PRIVATE_KEY=0x… otto-execute x402 --challenge c.json --sign   # emit x_payment
+```
+
+Keys come from the environment only; a key value found in argv aborts. Refusals exit 2 with
+`{ "refused": { "code", "message" } }`.
+
+## What is proven, and where
+
+The consistency matrix (`MUTATION_CASES`, 24 rows) and the tests are the ones the Model-B proof kit
+(`scripts/probes/model-b-proof/`, PR #1918, codex gate GO r5/5) shipped with; the kit now consumes this
+package. Live sittings run from the kit's runbook (`docs/0826_model_b_proof_runbook.md`).
+
+Not in this package by design: an allowlist of DEX contracts (the on-chain minimum-output bind is the
+fence), user-side revocation claims (exists per CDP's API; unobserved), bridge / Polymarket / Hyperliquid
+adapters (their constructors are merged; consumers follow).

package/dist/cdp-signer.d.ts

@@ -0,0 +1,2 @@
+/** cdp-signer.ts — re-exported from `./vendor/otto-intel-mcp/adapter-cdp-index.js` (moved 2026-08-29; see that entry's header). */
+export { CDP_CAPABILITIES, CHAIN_ID, CdpDelegatedSigner, DelegatedPlanHaltedError, NETWORK, createCdpRig, openCdpRig, revocationRequested, revokeDelegationByUserId, type CdpDeveloperCredentials, type CdpEndUser, type CdpRawOperations, type CdpRig, } from './vendor/otto-intel-mcp/adapter-cdp-index.js';

package/dist/cdp-signer.js

@@ -0,0 +1,3 @@
+/** cdp-signer.ts — re-exported from `./vendor/otto-intel-mcp/adapter-cdp-index.js` (moved 2026-08-29; see that entry's header). */
+export { CDP_CAPABILITIES, CHAIN_ID, CdpDelegatedSigner, DelegatedPlanHaltedError, NETWORK, createCdpRig, openCdpRig, revocationRequested, revokeDelegationByUserId, } from './vendor/otto-intel-mcp/adapter-cdp-index.js';
+//# sourceMappingURL=cdp-signer.js.map

package/dist/cdp.d.ts

@@ -0,0 +1,7 @@
+/**
+ * otto-execute/cdp — the CDP-delegated signer on its OWN entry, re-exported from `./vendor/otto-intel-mcp/adapter-cdp-index.js`
+ * (moved 2026-08-29). The optional `@coinbase/cdp-sdk` peer is loaded LAZILY, inside `openCdpRig` only: this
+ * entry imports safely without it, and a consumer that only signs with its own key imports `otto-execute`
+ * and never touches the SDK at all. Kept off the root export so the boundary stays visible.
+ */
+export { CDP_CAPABILITIES, CdpDelegatedSigner, DelegatedPlanHaltedError, createCdpRig, openCdpRig, revocationRequested, revokeDelegationByUserId, type CdpDeveloperCredentials, type CdpEndUser, type CdpRawOperations, type CdpRig, } from './cdp-signer.js';

package/dist/cdp.js

@@ -0,0 +1,8 @@
+/**
+ * otto-execute/cdp — the CDP-delegated signer on its OWN entry, re-exported from `./vendor/otto-intel-mcp/adapter-cdp-index.js`
+ * (moved 2026-08-29). The optional `@coinbase/cdp-sdk` peer is loaded LAZILY, inside `openCdpRig` only: this
+ * entry imports safely without it, and a consumer that only signs with its own key imports `otto-execute`
+ * and never touches the SDK at all. Kept off the root export so the boundary stays visible.
+ */
+export { CDP_CAPABILITIES, CdpDelegatedSigner, DelegatedPlanHaltedError, createCdpRig, openCdpRig, revocationRequested, revokeDelegationByUserId, } from './cdp-signer.js';
+//# sourceMappingURL=cdp.js.map

package/dist/chain.d.ts

@@ -0,0 +1,2 @@
+/** chain.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { waitForSealedReceipt, type SealedClient, type SealedWaitOptions, } from './vendor/otto-intel-mcp/adapter-index.js';

package/dist/chain.js

@@ -0,0 +1,3 @@
+/** chain.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { waitForSealedReceipt, } from './vendor/otto-intel-mcp/adapter-index.js';
+//# sourceMappingURL=chain.js.map

package/dist/cli.d.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * otto-execute CLI — the user's signer, from a terminal or an agent's shell.
+ *
+ *   otto-execute verify  --envelope e.json --account 0x… --intent intent.json [--prepare-input p.json]
+ *   otto-execute sign    --envelope e.json --intent intent.json [--prepare-input p.json]   (dry: sign, decode back, never broadcast)
+ *   otto-execute submit  --envelope e.json --intent intent.json [--prepare-input p.json] --i-understand-mainnet   (live: Base mainnet)
+ *   otto-execute x402    --challenge c.json [--sign]   (validate a 402 against the exact-match table; --sign emits x_payment)
+ *   otto-execute delegate --email you@example.com [--expires-days 90]
+ *                        (agent path: email OTP → mint a Model-B delegation, bound to the project the PUBLIC fence read publishes; see src/delegate.ts)
+ *   otto-execute delegation status|revoke --email you@example.com   (end-user-side read-back / revoke, after an OTP sign-in)
+ *
+ * The signing key is read ONLY from `OTTO_EXECUTE_PRIVATE_KEY` (never argv). `verify` needs no key.
+ * intent.json: { "fromToken": "0x…", "toToken": "0x…", "fromAmount": "1000000", "minAmountOut": "395000000000000" }
+ * Output is one JSON document on stdout; refusals exit 2 with { "refused": { code, message } }.
+ */
+export {};

package/dist/cli.js

@@ -0,0 +1,400 @@
+#!/usr/bin/env node
+/**
+ * otto-execute CLI — the user's signer, from a terminal or an agent's shell.
+ *
+ *   otto-execute verify  --envelope e.json --account 0x… --intent intent.json [--prepare-input p.json]
+ *   otto-execute sign    --envelope e.json --intent intent.json [--prepare-input p.json]   (dry: sign, decode back, never broadcast)
+ *   otto-execute submit  --envelope e.json --intent intent.json [--prepare-input p.json] --i-understand-mainnet   (live: Base mainnet)
+ *   otto-execute x402    --challenge c.json [--sign]   (validate a 402 against the exact-match table; --sign emits x_payment)
+ *   otto-execute delegate --email you@example.com [--expires-days 90]
+ *                        (agent path: email OTP → mint a Model-B delegation, bound to the project the PUBLIC fence read publishes; see src/delegate.ts)
+ *   otto-execute delegation status|revoke --email you@example.com   (end-user-side read-back / revoke, after an OTP sign-in)
+ *
+ * The signing key is read ONLY from `OTTO_EXECUTE_PRIVATE_KEY` (never argv). `verify` needs no key.
+ * intent.json: { "fromToken": "0x…", "toToken": "0x…", "fromAmount": "1000000", "minAmountOut": "395000000000000" }
+ * Output is one JSON document on stdout; refusals exit 2 with { "refused": { code, message } }.
+ */
+import { readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { getAddress } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { DEFAULT_OTTO_MCP_URL, DelegateRefusal, UNSUPPORTED_PATH_NOTE, assertFencePresent, initEndUserSdk, isDelegateRefusal, mintDelegation, readDelegationAsUser, readPublicFenceStatus, redactSecrets, resolveDelegateEndpoints, revokeDelegationAsUser, signInWithEmailOtp, } from './delegate.js';
+import { EoaSigner } from './eoa-signer.js';
+import { isAdapterRefusal } from './refusal.js';
+import { defaultAdapterPolicy, verifySwapEnvelope } from './verify.js';
+import { validateX402Challenge, X402Refusal } from './x402-table.js';
+const CHAIN_ID = 8453;
+function usage() {
+    process.stderr.write('usage: otto-execute verify|sign|submit --envelope <file> --intent <file> [--account 0x…] [--prepare-input <file>] [--rpc <https url>] [--i-understand-mainnet]\n' +
+        '       otto-execute x402 --challenge <file> [--sign]\n' +
+        '       otto-execute delegate --email <you@example.com> [--expires-days 90]\n' +
+        '       otto-execute delegation status|revoke --email <you@example.com>\n');
+    process.exit(1);
+}
+function arg(name) {
+    const index = process.argv.indexOf(`--${name}`);
+    return index >= 0 ? process.argv[index + 1] : undefined;
+}
+function flag(name) {
+    return process.argv.includes(`--${name}`);
+}
+function readJson(path, what) {
+    if (!path)
+        throw new Error(`--${what} is required`);
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+function out(value) {
+    process.stdout.write(`${JSON.stringify(value, (_k, v) => (typeof v === 'bigint' ? v.toString() : v), 2)}\n`);
+}
+function refuseAndExit(error) {
+    if (isAdapterRefusal(error) || error instanceof X402Refusal || isDelegateRefusal(error)) {
+        out({ refused: { code: error.code, message: redactSecrets(error.message) } });
+        process.exit(2);
+    }
+    process.stderr.write(`${redactSecrets(error instanceof Error ? error.message : String(error))}\n`);
+    process.exit(1);
+}
+function loadKey() {
+    const raw = process.env.OTTO_EXECUTE_PRIVATE_KEY?.trim();
+    if (!raw)
+        throw new Error('OTTO_EXECUTE_PRIVATE_KEY is required (environment only; never pass a key as an argument)');
+    const key = raw.startsWith('0x') ? raw : `0x${raw}`;
+    if (!/^0x[0-9a-fA-F]{64}$/.test(key))
+        throw new Error('OTTO_EXECUTE_PRIVATE_KEY must be a 32-byte hex private key');
+    return key;
+}
+function loadIntent() {
+    const raw = readJson(arg('intent'), 'intent');
+    const str = (k) => {
+        const v = raw[k];
+        if (typeof v !== 'string' || v === '')
+            throw new Error(`intent.${k} is required`);
+        return v;
+    };
+    return {
+        fromToken: getAddress(str('fromToken')),
+        toToken: getAddress(str('toToken')),
+        fromAmount: BigInt(str('fromAmount')),
+        minAmountOut: BigInt(str('minAmountOut')),
+    };
+}
+/**
+ * Startup guard, before any command runs: a 32-byte hex value anywhere in argv (any case, with or
+ * without 0x, as a token OR as the value of a `--flag=value` token) or a key-looking flag is refused
+ * outright — argv is visible in the process table and in shell history, whichever command was invoked.
+ */
+function refuseSecretsInArgv() {
+    const argv = process.argv.slice(2);
+    const isKeyLike = (value) => /^(0x)?[0-9a-f]{64}$/i.test(value.trim());
+    const parts = (token) => token.includes('=')
+        ? [token.slice(0, token.indexOf('=')), token.slice(token.indexOf('=') + 1)]
+        : [token];
+    if (argv.some((token) => parts(token).some(isKeyLike))) {
+        throw new Error('refusing: a 32-byte hex value is present in argv; keys come from OTTO_EXECUTE_PRIVATE_KEY only');
+    }
+    if (argv.some((token) => /^--?(private-?key|key|secret|mnemonic|seed)(=|$)/i.test(token))) {
+        throw new Error('refusing: key-like flags are not accepted; keys come from OTTO_EXECUTE_PRIVATE_KEY only');
+    }
+}
+/* ------------------------------------------------------------------ *
+ * The delegate path runs with NO Otto credential in its process, only the known flags, a trusted fence
+ * source, and every error redacted. These guards run before the fence read or any CDP request.
+ * ------------------------------------------------------------------ */
+const DELEGATE_SENSITIVE_ENV = [
+    'OTTO_EXECUTE_PRIVATE_KEY',
+    'OTTO_DELEGATION_SERVER_SECRET',
+    'CDP_API_KEY_ID',
+    'CDP_API_KEY_SECRET',
+    'CDP_WALLET_SECRET',
+];
+const DELEGATE_KNOWN_FLAGS = {
+    delegate: new Set(['email', 'expires-days']),
+    delegation: new Set(['email']),
+};
+/** Refuse if any Otto credential, the server secret, or ANY 64-hex value is present in the environment. */
+function guardDelegateEnvironment() {
+    const named = DELEGATE_SENSITIVE_ENV.filter((n) => (process.env[n]?.trim() ?? '') !== '');
+    if (named.length > 0) {
+        throw new DelegateRefusal('CREDENTIAL_IN_ENVIRONMENT', `refusing: ${named.join(', ')} present in this process's environment; the delegate path runs with no Otto credential in-process (clear it and re-run)`);
+    }
+    const sixtyFourHex = /(?<![0-9a-fA-F])[0-9a-fA-F]{64}(?![0-9a-fA-F])/;
+    for (const [name, value] of Object.entries(process.env)) {
+        if (value && sixtyFourHex.test(value)) {
+            throw new DelegateRefusal('CREDENTIAL_IN_ENVIRONMENT', `refusing: a 64-hex value is present in the environment (${name}); the delegate path runs with no key material in-process (clear it and re-run)`);
+        }
+    }
+}
+/**
+ * Only the known long flags (and their values) plus the command's own positionals are accepted. Short flags
+ * (`-o 654321`), unknown long flags (`--otp/--code/--token`), and stray positionals (a bare `654321`) are all
+ * refused — so an OTP can never sit in argv (the process table / shell history) by ANY spelling.
+ */
+function assertKnownDelegateFlags(command) {
+    const allowed = DELEGATE_KNOWN_FLAGS[command];
+    const argv = process.argv.slice(2);
+    // argv[0] is the command; `delegation` also takes a subcommand positional (status|revoke).
+    const maxPositionals = command === 'delegation' ? 2 : 1;
+    let positionals = 0;
+    const seenFlags = new Set();
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i];
+        if (token.startsWith('--')) {
+            const name = token.slice(2).split('=')[0];
+            if (!allowed.has(name)) {
+                throw new DelegateRefusal('UNKNOWN_OPTION', `refusing: unknown option --${name}; the OTP is entered interactively and is never accepted as a flag`);
+            }
+            // A repeated flag would leave its extra value in argv — refuse before consuming it (no token echo).
+            if (seenFlags.has(name)) {
+                throw new DelegateRefusal('UNKNOWN_OPTION', `refusing: option --${name} is repeated; the OTP is entered interactively and is never passed as an argument`);
+            }
+            seenFlags.add(name);
+            // Consume this flag's value (the `--flag value` form) so it is not counted as a stray positional.
+            if (!token.includes('=') && i + 1 < argv.length && !argv[i + 1].startsWith('-'))
+                i += 1;
+            continue;
+        }
+        // NB: never echo the token here — a short-flag or bare positional could BE the OTP.
+        if (token.startsWith('-')) {
+            throw new DelegateRefusal('UNKNOWN_OPTION', 'refusing: a short option is not accepted; the OTP is entered interactively and is never passed as an argument');
+        }
+        positionals += 1;
+        if (positionals > maxPositionals) {
+            throw new DelegateRefusal('UNKNOWN_OPTION', 'refusing: an unexpected positional argument is present; the OTP is entered interactively and is never passed as an argument');
+        }
+    }
+}
+function hostIsLoopback(urlStr) {
+    try {
+        const host = new URL(urlStr).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A sanity check on the resolved fence source: Otto's default MCP, or a loopback host (which can only arise
+ * from the in-process test global, never a caller's env/argv). A non-loopback, non-default source can only
+ * mean a mis-set test global — refuse it.
+ */
+function assertFenceSourceTrusted(mcpUrl) {
+    if (mcpUrl === DEFAULT_OTTO_MCP_URL || hostIsLoopback(mcpUrl))
+        return;
+    throw new DelegateRefusal('FENCE_SOURCE_NOT_OTTO', 'refusing: the fence source is neither Otto’s MCP nor a loopback host; it is not trusted');
+}
+/** The SDK-endpoint override (`OTTO_DELEGATE_CDP_BASE_PATH`) is accepted only for a loopback host (the tests). */
+function assertLoopbackBasePath(basePath) {
+    if (!basePath || hostIsLoopback(basePath))
+        return;
+    throw new DelegateRefusal('SDK_ENDPOINT_NOT_COINBASE', 'refusing: OTTO_DELEGATE_CDP_BASE_PATH redirects the SDK endpoint to a non-loopback host');
+}
+/**
+ * The OTP, read from the terminal WITHOUT echo (raw mode on a TTY; one un-echoed line when stdin is a pipe —
+ * an agent feeding the code). It is consulted once by the SDK and never written anywhere by this process.
+ */
+async function readOtpMuted(email) {
+    process.stderr.write(`An OTP was sent to ${email}. Type it here (not echoed, never written): `);
+    const input = process.stdin;
+    if (input.isTTY && typeof input.setRawMode === 'function') {
+        return new Promise((resolve) => {
+            let code = '';
+            const cleanup = () => {
+                input.setRawMode(false);
+                input.pause();
+                input.off('data', onData);
+            };
+            const onData = (chunk) => {
+                for (const ch of chunk) {
+                    if (ch === '\u0003') {
+                        cleanup();
+                        process.stderr.write('\n');
+                        process.exit(130);
+                    }
+                    if (ch === '\r' || ch === '\n') {
+                        cleanup();
+                        process.stderr.write('\n');
+                        resolve(code);
+                        return;
+                    }
+                    if (ch === '\u007f' || ch === '\b') {
+                        code = code.slice(0, -1);
+                        continue;
+                    }
+                    code += ch;
+                }
+            };
+            input.setRawMode(true);
+            input.resume();
+            input.setEncoding('utf8');
+            input.on('data', onData);
+        });
+    }
+    const rl = createInterface({ input, terminal: false });
+    try {
+        for await (const line of rl)
+            return line;
+    }
+    finally {
+        rl.close();
+    }
+    return '';
+}
+/** Write the document, let stdout drain, then exit: cdp-core schedules refresh timers that would keep the process alive. */
+async function finish(value) {
+    out(value);
+    await new Promise((resolve) => process.stdout.write('', () => resolve()));
+    process.exit(0);
+}
+async function delegateCommands(command) {
+    // No Otto credential in-process, only the known flags, a trusted fence source and SDK endpoint.
+    guardDelegateEnvironment();
+    assertKnownDelegateFlags(command);
+    const email = arg('email');
+    if (!email)
+        usage();
+    // Production: the fence is Otto's default MCP and the SDK is Coinbase's own endpoint — FIXED. The only
+    // override is the in-process test global, which a production invocation never sets (see resolveDelegateEndpoints).
+    const { mcpUrl, apiBasePath } = resolveDelegateEndpoints();
+    assertLoopbackBasePath(apiBasePath);
+    assertFenceSourceTrusted(mcpUrl);
+    if (command === 'delegate') {
+        // FENCE BEFORE AUTHORITY, and the mint is BOUND to the project the fence publishes — there is no CLI
+        // project-id override: an agent cannot read Otto's real fence and mint to some other project.
+        const fence = await readPublicFenceStatus(mcpUrl);
+        assertFencePresent(fence);
+        const days = arg('expires-days');
+        await initEndUserSdk(fence.project_id, { ...(apiBasePath ? { apiBasePath } : {}) });
+        const user = await signInWithEmailOtp(email, () => readOtpMuted(email));
+        const minted = await mintDelegation(days === undefined ? undefined : Number(days));
+        await finish({
+            delegated: {
+                user_id: user.userId,
+                address: user.address,
+                expires_at: minted.expiresAt,
+                days: minted.days,
+                fence: {
+                    policy_name: fence.policy_name,
+                    rules_digest: fence.rules_digest,
+                    per_swap_cap_usd: fence.per_swap_cap_usd,
+                    project_id: fence.project_id,
+                },
+            },
+            note: UNSUPPORTED_PATH_NOTE,
+        });
+    }
+    const sub = process.argv[3];
+    if (command === 'delegation' && (sub === 'status' || sub === 'revoke')) {
+        // Bind to the SAME published project id (present or not — status/revoke work after the fence is removed).
+        const fence = await readPublicFenceStatus(mcpUrl);
+        await initEndUserSdk(fence.project_id, { ...(apiBasePath ? { apiBasePath } : {}) });
+        const user = await signInWithEmailOtp(email, () => readOtpMuted(email));
+        if (sub === 'status') {
+            const grant = await readDelegationAsUser();
+            await finish({
+                user_id: user.userId,
+                address: user.address,
+                delegation: grant ? { active: true, expires_at: grant.expiresAt } : { active: false },
+            });
+        }
+        const revoked = await revokeDelegationAsUser();
+        // A revoke that did not take is a NON-ZERO refusal, never a success (the grant still reads back).
+        if (revoked.readsBack) {
+            throw new DelegateRefusal('REVOKE_NOT_CONFIRMED', 'the revoke did not take: the grant still reads back from CDP; nothing is confirmed');
+        }
+        await finish({
+            user_id: user.userId,
+            address: user.address,
+            revoked: true,
+            reads_back: false,
+        });
+    }
+    usage();
+}
+async function main() {
+    refuseSecretsInArgv();
+    const command = process.argv[2];
+    if (!command)
+        usage();
+    if (command === 'delegate' || command === 'delegation') {
+        await delegateCommands(command);
+        return;
+    }
+    if (command === 'x402') {
+        // Accept the raw PaymentRequired document OR the hosted MCP's challenge result / a capture wrapper
+        // ({ error: 'payment_required', payment_required: {...} }) — the document is what gets validated.
+        const loaded = readJson(arg('challenge'), 'challenge');
+        const challenge = loaded && typeof loaded === 'object' && 'payment_required' in loaded
+            ? loaded.payment_required
+            : loaded;
+        const validated = validateX402Challenge(challenge);
+        if (!flag('sign')) {
+            out({
+                validated: {
+                    row: validated.row,
+                    requirement: validated.requirement,
+                    requirement_index: validated.requirementIndex,
+                },
+            });
+            return;
+        }
+        const signer = EoaSigner.fromPrivateKey(loadKey(), arg('rpc'));
+        const signed = await signer.signX402Payment(challenge, validated);
+        out({ payer: signer.address, row: validated.row.resource, x_payment: signed.header });
+        return;
+    }
+    if (command !== 'verify' && command !== 'sign' && command !== 'submit')
+        usage();
+    const envelope = readJson(arg('envelope'), 'envelope');
+    const intent = loadIntent();
+    const prepareInput = arg('prepare-input')
+        ? readJson(arg('prepare-input'), 'prepare-input')
+        : undefined;
+    let account;
+    let signer;
+    if (command === 'verify') {
+        const given = arg('account');
+        if (given) {
+            account = getAddress(given);
+        }
+        else {
+            account = getAddress(privateKeyToAccount(loadKey()).address);
+        }
+    }
+    else {
+        signer = EoaSigner.fromPrivateKey(loadKey(), arg('rpc'));
+        account = signer.address;
+    }
+    const verified = verifySwapEnvelope(envelope, {
+        profile: { kind: 'eoa', address: account, chainId: CHAIN_ID },
+        intent,
+        capabilities: signer?.capabilities ?? ['send_evm_transaction', 'sign_x402_payment'],
+        policy: defaultAdapterPolicy(CHAIN_ID),
+        ...(prepareInput ? { prepareInput } : {}),
+    });
+    const summary = {
+        account,
+        checks: verified.checks.map((c) => c.id),
+        token: verified.token,
+        output_token: verified.outputToken,
+        gross: verified.gross,
+        otto_fee: verified.ottoFee,
+        min_amount_out: verified.minAmountOut,
+        fee_distributions: verified.fees.distributions,
+        valid_until: verified.artifact.valid_until,
+        artifact_id: verified.artifact.artifact_id,
+    };
+    if (command === 'verify') {
+        out({ verified: summary });
+        return;
+    }
+    if (command === 'sign') {
+        out({ verified: summary, signed_dry_run: await signer.signPlanDryRun(verified) });
+        return;
+    }
+    if (!flag('i-understand-mainnet')) {
+        throw new Error('submit broadcasts on Base MAINNET with real funds; pass --i-understand-mainnet to proceed');
+    }
+    out({ verified: summary, submitted: await signer.sendPlan(verified) });
+}
+main().catch(refuseAndExit);
+//# sourceMappingURL=cli.js.map