otto-execute 0.1.0

package/dist/eoa-signer.js

@@ -0,0 +1,289 @@
+/**
+ * eoa-signer.ts — the bring-your-own-EOA capability provider (spec §2 SigningAdapter, §9 handshakes).
+ *
+ * Provides `send_evm_transaction` (one signed tx per plan step, in order; nonce/gas/serialization are
+ * adapter-owned per spec §6) and `sign_x402_payment` (challenge → signed `x_payment`, exactly the
+ * hosted MCP's existing retry protocol). The key never leaves this process; it is read from the
+ * environment once (env.ts registers it with the output guard) or generated in-process for a
+ * dry run and discarded. On this path the USER's key both signs and submits.
+ *
+ * Dry run = sign, never broadcast: every step is signed with placeholder nonce/gas, parsed back, and
+ * the parsed {to, value, data} must equal the verified plan step byte-for-byte, and the signature
+ * must recover to this account. That proves "what the signer signs is what the adapter verified"
+ * without touching a chain.
+ */
+import { createPublicClient, encodeFunctionData, getAddress, http, parseTransaction, recoverTransactionAddress, } from 'viem';
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';
+import { base } from 'viem/chains';
+import { waitForSealedReceipt } from './chain.js';
+import { ERC20_APPROVE_ABI, readAllowance } from './erc20.js';
+import { x402Client } from '@x402/core/client';
+import { encodePaymentSignatureHeader } from '@x402/core/http';
+import { ExactEvmScheme } from '@x402/evm/exact/client';
+import { toClientEvmSigner } from '@x402/evm';
+import { requirementMatchesRow, validateX402Challenge, X402_TABLE, X402Refusal, } from './x402-table.js';
+import { assertPlanSignableBy } from './verify.js';
+export const EOA_CAPABILITIES = Object.freeze([
+    'send_evm_transaction',
+    'sign_x402_payment',
+]);
+export const CHAIN_ID = 8453;
+/** Clock tolerance when bounding an EIP-3009 `validBefore` against the row's window. */
+const VALID_BEFORE_SKEW_SECONDS = 60;
+/**
+ * The INDEPENDENT per-payment ceiling applied to every x402 signature, stated here rather than
+ * inherited from `@x402/core`'s default (which is the same `$1`, but is the SDK's number to change,
+ * not ours). Every live table row is $0.001–$0.002, so this has ~500x of headroom over real traffic;
+ * it exists to bound a table that is wrong, not to bound normal use. Raising it is a deliberate edit.
+ */
+export const PER_PAYMENT_SPEND_CAP = '$1';
+/**
+ * True only for `@x402/core`'s spend-control rejection. Matched narrowly on the SDK's own message so a
+ * different failure is never mistaken for a budget refusal; if the SDK ever rewords this, the
+ * mutation-proved test below fails loudly rather than the translation silently going quiet.
+ */
+function isSpendControlRejection(error) {
+    return error instanceof Error && /rejected by spendControls/.test(error.message);
+}
+/** A plan step failed after an approval was live; the adapter tried to clear the allowance. */
+export class PlanHaltedError extends Error {
+    failedStep;
+    allowanceCleared;
+    clearTransactionHash;
+    constructor(message, failedStep, allowanceCleared, clearTransactionHash) {
+        super(message);
+        this.failedStep = failedStep;
+        this.allowanceCleared = allowanceCleared;
+        this.clearTransactionHash = clearTransactionHash;
+        this.name = 'PlanHaltedError';
+    }
+}
+export class EoaSigner {
+    account;
+    rpcUrl;
+    address;
+    capabilities = EOA_CAPABILITIES;
+    chainId = CHAIN_ID;
+    constructor(account, rpcUrl) {
+        this.account = account;
+        this.rpcUrl = rpcUrl;
+        this.address = getAddress(account.address);
+    }
+    static fromPrivateKey(privateKey, rpcUrl) {
+        return new EoaSigner(privateKeyToAccount(privateKey), rpcUrl);
+    }
+    /** A throwaway in-process key for dry runs. Never printed, never persisted, gone with the process. */
+    static ephemeral() {
+        return new EoaSigner(privateKeyToAccount(generatePrivateKey()), undefined);
+    }
+    publicClient() {
+        return createPublicClient({ chain: base, transport: http(this.rpcUrl) });
+    }
+    /**
+     * `send_evm_transaction`, dry: sign every step, decode back, recover — broadcast nothing. `clock` is
+     * either a fixed instant (deterministic tests) or a clock FUNCTION read afresh before every signature
+     * (the default, `Date.now`), so an artifact that expires between two signatures is caught.
+     */
+    async signPlanDryRun(plan, clock = Date.now) {
+        const now = typeof clock === 'number' ? () => clock : clock;
+        assertPlanSignableBy(plan, this, now());
+        const out = [];
+        for (const [index, step] of plan.steps.entries()) {
+            // Re-asserted immediately before each signature, from a fresh clock read, exactly as the live path does.
+            assertPlanSignableBy(plan, this, now());
+            const raw = await this.account.signTransaction({
+                chainId: CHAIN_ID,
+                type: 'eip1559',
+                nonce: index,
+                to: step.to,
+                value: step.value,
+                data: step.data,
+                gas: 400000n,
+                maxFeePerGas: 1000000n,
+                maxPriorityFeePerGas: 1000n,
+            });
+            const parsed = parseTransaction(raw);
+            if (parsed.type !== 'eip1559' ||
+                parsed.chainId !== CHAIN_ID ||
+                !parsed.to ||
+                getAddress(parsed.to) !== step.to ||
+                (parsed.value ?? 0n) !== step.value ||
+                (parsed.data ?? '0x').toLowerCase() !== step.data.toLowerCase()) {
+                throw new Error(`dry-run step ${index} (${step.kind}) did not decode back to the verified plan step`);
+            }
+            const recovered = getAddress(await recoverTransactionAddress({ serializedTransaction: raw }));
+            if (recovered !== this.address) {
+                throw new Error(`dry-run step ${index} recovered to ${recovered}, not ${this.address}`);
+            }
+            out.push(Object.freeze({
+                index,
+                kind: step.kind,
+                to: step.to,
+                signed_bytes: (raw.length - 2) / 2,
+                recovered_signer: recovered,
+                decoded_matches_plan: true,
+                broadcast: false,
+            }));
+        }
+        return out;
+    }
+    /**
+     * Nonce / fee / gas round trips first, then `beforeSign` (the plan's freshness + binding re-check,
+     * AFTER those round trips and immediately before the signature), then sign and broadcast. Resolves
+     * only with the SEALED, CANONICAL receipt (`waitForSealedReceipt`): the next step's gas estimate and
+     * any read-back must see this transaction, and a Flashblocks preconfirmation alone guarantees neither
+     * that they do nor that the transaction survived sealing.
+     */
+    async submit(pub, step, beforeSign, sealedWait) {
+        const [nonce, fees, gasEstimate] = await Promise.all([
+            pub.getTransactionCount({ address: this.address, blockTag: 'pending' }),
+            pub.estimateFeesPerGas(),
+            pub.estimateGas({ account: this.address, to: step.to, value: step.value, data: step.data }),
+        ]);
+        beforeSign?.();
+        const raw = await this.account.signTransaction({
+            chainId: CHAIN_ID,
+            type: 'eip1559',
+            nonce,
+            to: step.to,
+            value: step.value,
+            data: step.data,
+            gas: (gasEstimate * 12n) / 10n,
+            maxFeePerGas: fees.maxFeePerGas,
+            maxPriorityFeePerGas: fees.maxPriorityFeePerGas,
+        });
+        const hash = await pub.sendRawTransaction({ serializedTransaction: raw });
+        await pub.waitForTransactionReceipt({ hash }); // first sight (may be a preconfirmation) …
+        const receipt = await waitForSealedReceipt(pub, hash, sealedWait); // … then only the sealed canonical receipt counts
+        return { hash, status: receipt.status, blockNumber: receipt.blockNumber, gasUsed: receipt.gasUsed };
+    }
+    /**
+     * `send_evm_transaction`, live: one tx per step, in order, the plan re-checked before every step AND
+     * again immediately before each signature (after the nonce / fee / gas round trips, so an artifact
+     * that expires during preparation is never signed). The plan halts at the first step that does not
+     * succeed; after ANY failure a bounded `approve(spender, 0)` is attempted and its real outcome —
+     * confirmed by an allowance read-back — is reported, so no allowance outlives the halted plan unnoticed.
+     */
+    async sendPlan(plan, pub = this.publicClient(), sealedWait) {
+        assertPlanSignableBy(plan, this, Date.now());
+        const out = [];
+        for (const [index, step] of plan.steps.entries()) {
+            // Freshness is re-checked before EVERY live step: an artifact that expires mid-plan halts (and
+            // clears the allowance) instead of sending its remaining steps.
+            try {
+                assertPlanSignableBy(plan, this, Date.now());
+            }
+            catch (error) {
+                throw await this.halt(plan, pub, index, `plan no longer signable before step ${index}: ${error instanceof Error ? error.message : String(error)}`, sealedWait);
+            }
+            let result;
+            try {
+                result = await this.submit(pub, step, () => assertPlanSignableBy(plan, this, Date.now()), sealedWait);
+            }
+            catch (error) {
+                throw await this.halt(plan, pub, index, `step ${index} (${step.kind}) could not be submitted: ${error instanceof Error ? error.message : String(error)}`, sealedWait);
+            }
+            if (result.status !== 'success') {
+                throw await this.halt(plan, pub, index, `step ${index} (${step.kind}) reverted on-chain: ${result.hash}`, sealedWait);
+            }
+            out.push(Object.freeze({
+                index,
+                kind: step.kind,
+                to: step.to,
+                transaction_hash: result.hash,
+                status: 'success',
+                block_number: result.blockNumber.toString(),
+                gas_used: result.gasUsed.toString(),
+            }));
+        }
+        return out;
+    }
+    async halt(plan, pub, failedStep, message, sealedWait) {
+        // The clear is attempted after ANY failure, step 0 included: a failed reset may leave a
+        // PRE-EXISTING allowance, and from step 1 on the approval may already be broadcast even when the
+        // receipt or the transport failed. Clearing a never-set allowance is a harmless approve(spender, 0),
+        // and `allowanceCleared` reports the clear's real outcome, never an assumption.
+        const handOff = `clear approve(${plan.spender}, 0) on ${plan.token} by hand`;
+        let hash;
+        try {
+            const clear = await this.submit(pub, { to: plan.token, value: 0n, data: encodeFunctionData({ abi: ERC20_APPROVE_ABI, functionName: 'approve', args: [plan.spender, 0n] }) }, undefined, sealedWait);
+            hash = clear.hash;
+            if (clear.status !== 'success') {
+                return new PlanHaltedError(`${message}; allowance clear ${hash} reverted — ${handOff}`, failedStep, false, hash);
+            }
+            // A mined clear is a claim about a transaction; the read-back is the fact about the token.
+            const remaining = await readAllowance(pub, plan.token, this.address, plan.spender);
+            if (remaining !== 0n) {
+                return new PlanHaltedError(`${message}; allowance clear ${hash} was mined but ${remaining} still reads back — ${handOff}`, failedStep, false, hash);
+            }
+            return new PlanHaltedError(`${message}; allowance cleared in ${hash} (read-back 0)`, failedStep, true, hash);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            return new PlanHaltedError(`${message}; allowance clear ${hash ? `${hash} could not be confirmed` : 'FAILED'} (${reason}) — ${handOff}`, failedStep, false, hash);
+        }
+    }
+    /**
+     * `sign_x402_payment`: turn a table-validated challenge into the signed `x_payment` value.
+     * Validation and hand-off are two moments. Immediately before signing, the document is validated
+     * AGAIN against the static table and must resolve to the same row and the same bound fields as the
+     * earlier validation; the requirement selector accepts only a candidate matching that ROW; and the
+     * produced payload's `accepted` requirement and authorization are checked against the ROW (not
+     * against anything the challenge supplied) before the header is returned.
+     */
+    async signX402Payment(paymentRequired, validated, table = X402_TABLE, nowSeconds = Math.floor(Date.now() / 1000)) {
+        const fresh = validateX402Challenge(paymentRequired, table);
+        if (fresh.row !== validated.row || JSON.stringify(fresh.requirement) !== JSON.stringify(validated.requirement)) {
+            throw new Error('the challenge no longer validates to the same row and requirement it was validated against; refusing to sign');
+        }
+        const row = validated.row;
+        const signer = toClientEvmSigner(this.account, this.publicClient());
+        const client = new x402Client((_version, requirements) => {
+            const match = requirements.find((candidate) => requirementMatchesRow(candidate, row));
+            if (!match)
+                throw new Error('no offered requirement matches the validated table row');
+            return match;
+        });
+        // `@x402/core` >= 2.23 seeds `spendControls = {}` in the bare constructor, which the SDK reads as
+        // "default assets only, capped at $1 per payment". We state that cap EXPLICITLY rather than inherit
+        // it, so the number is visible in this file and a future SDK default cannot move it silently.
+        //
+        // It is deliberately KEPT, not disabled. The table checks more FIELDS, but it is not an independent
+        // authority: `table` is a parameter, and even the default table's `amount_atomic` values are
+        // hand-edited constants that nothing else cross-checks. A price typo (5000 -> 5000000) makes the
+        // table agree with itself perfectly, and only this cap — derived from the requirement amount rather
+        // than from the table — stands between that typo and a signature for 1000x the intended amount.
+        // Field coverage is not the same as a second opinion.
+        client.setSpendControls({ maxAmountPerPayment: PER_PAYMENT_SPEND_CAP });
+        client.register('eip155:*', new ExactEvmScheme(signer));
+        let payload;
+        try {
+            payload = (await client.createPaymentPayload(paymentRequired));
+        }
+        catch (error) {
+            // Translate ONLY the spend-control rejection into this package's typed refusal vocabulary, so a
+            // caller keying on X402Refusal sees a code rather than an SDK string. Anything else rethrows
+            // untouched — this must never become a catch-all that turns a real failure into a tidy refusal.
+            if (isSpendControlRejection(error)) {
+                throw new X402Refusal('X402_SPEND_LIMIT_EXCEEDED', 'amount', `at most ${PER_PAYMENT_SPEND_CAP} per payment`, `${row.amount_atomic} atomic units of ${row.asset}`, table.table_version);
+            }
+            throw error;
+        }
+        if (!requirementMatchesRow(payload.accepted, row)) {
+            throw new Error('payment payload accepted a requirement that does not match the validated table row');
+        }
+        const inner = (payload.payload ?? {});
+        const authorization = inner.authorization ?? {};
+        if (typeof authorization.from !== 'string' || getAddress(authorization.from) !== this.address ||
+            typeof authorization.to !== 'string' || getAddress(authorization.to) !== row.pay_to ||
+            authorization.value !== row.amount_atomic) {
+            throw new Error('payment authorization does not bind this signer to the table pay_to and amount');
+        }
+        const validBefore = Number(authorization.validBefore);
+        if (!Number.isFinite(validBefore) || validBefore > nowSeconds + row.max_timeout_seconds + VALID_BEFORE_SKEW_SECONDS) {
+            throw new Error(`payment authorization validBefore ${String(authorization.validBefore)} exceeds the row window of ${row.max_timeout_seconds}s`);
+        }
+        return Object.freeze({ header: encodePaymentSignatureHeader(payload), payload });
+    }
+}
+//# sourceMappingURL=eoa-signer.js.map

package/dist/erc20.d.ts

@@ -0,0 +1,2 @@
+/** erc20.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { ERC20_ALLOWANCE_ABI, ERC20_APPROVE_ABI, readAllowance } from './vendor/otto-intel-mcp/adapter-index.js';

package/dist/erc20.js

@@ -0,0 +1,3 @@
+/** erc20.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { ERC20_ALLOWANCE_ABI, ERC20_APPROVE_ABI, readAllowance } from './vendor/otto-intel-mcp/adapter-index.js';
+//# sourceMappingURL=erc20.js.map

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * otto-execute — the USER'S side of Model B.
+ *
+ * Otto's hosted MCP constructs transactions prepare-only (`otto_prepare_*`, unsigned envelopes with
+ * Otto's fee attribution baked in). This package is what a user's own signer runs BEFORE and WHILE
+ * signing one: verify (integrity → intent → policy → attribution), then sign/submit with the user's
+ * key (BYO/EOA: the user signs and submits) or under a delegation the user minted (CDP-delegated:
+ * user-authorized, Otto-submitted, Otto-governed, Otto-revocable). Otto never holds user keys or funds.
+ */
+export { ADAPTER_REFUSAL_CODES, AdapterRefusal, isAdapterRefusal, isAdapterRefusalCode, type AdapterRefusalCode, } from './refusal.js';
+export { COLLECT_TOKEN_FEES_SELECTOR, GENERIC_SWAP_SELECTORS, decodeCollectTokenFees, decodeGenericSwap, encodeCollectTokenFees, encodeGenericSwap, type DecodedCollectTokenFees, type DecodedGenericSwap, type FeeDistribution, type SwapLeg, } from './lifi-decode.js';
+export { VERIFY_CHECK_IDS, assertVerifiedPlanIntact, defaultAdapterPolicy, isVerifierOutput, verifySwapEnvelope, type AdapterPolicy, type AttributionPolicy, type SigningCapability, type SwapIntent, type VerifiedCheck, type VerifiedStep, type VerifiedSwap, type VerifyExpectations, } from './verify.js';
+export { waitForSealedReceipt, type SealedClient, type SealedWaitOptions } from './chain.js';
+export { EOA_CAPABILITIES, EoaSigner, PlanHaltedError, type DryRunSignedStep, type SentStep, type SignedX402Payment, } from './eoa-signer.js';
+export { BASE_USDC, OTTO_X402_PAY_TO, X402_REFUSAL_CODES, X402_TABLE, X402_TABLE_VERSION, X402Refusal, canonicalResourceUrl, requirementMatchesRow, validateX402Challenge, type PaymentRequirementLike, type ValidatedX402Challenge, type X402ExpectedRow, type X402RefusalCode, type X402Table, } from './x402-table.js';
+export { FOREIGN_ADDRESS, FOREIGN_TOKEN, MUTATION_CASES, applyMutation, recommit, recommitCommitmentOnly, recommitPayloadOnly, type CatchingLayer, type MutationCase, type MutationContext, } from './mutations.js';

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * otto-execute — the USER'S side of Model B.
+ *
+ * Otto's hosted MCP constructs transactions prepare-only (`otto_prepare_*`, unsigned envelopes with
+ * Otto's fee attribution baked in). This package is what a user's own signer runs BEFORE and WHILE
+ * signing one: verify (integrity → intent → policy → attribution), then sign/submit with the user's
+ * key (BYO/EOA: the user signs and submits) or under a delegation the user minted (CDP-delegated:
+ * user-authorized, Otto-submitted, Otto-governed, Otto-revocable). Otto never holds user keys or funds.
+ */
+export { ADAPTER_REFUSAL_CODES, AdapterRefusal, isAdapterRefusal, isAdapterRefusalCode, } from './refusal.js';
+export { COLLECT_TOKEN_FEES_SELECTOR, GENERIC_SWAP_SELECTORS, decodeCollectTokenFees, decodeGenericSwap, encodeCollectTokenFees, encodeGenericSwap, } from './lifi-decode.js';
+export { VERIFY_CHECK_IDS, assertVerifiedPlanIntact, defaultAdapterPolicy, isVerifierOutput, verifySwapEnvelope, } from './verify.js';
+export { waitForSealedReceipt } from './chain.js';
+export { EOA_CAPABILITIES, EoaSigner, PlanHaltedError, } from './eoa-signer.js';
+// The CDP-delegated signer lives on its own entry, `otto-execute/cdp`: only its `openCdpRig` needs the
+// optional `@coinbase/cdp-sdk` peer (loaded lazily); this root never references the SDK at all.
+export { BASE_USDC, OTTO_X402_PAY_TO, X402_REFUSAL_CODES, X402_TABLE, X402_TABLE_VERSION, X402Refusal, canonicalResourceUrl, requirementMatchesRow, validateX402Challenge, } from './x402-table.js';
+export { FOREIGN_ADDRESS, FOREIGN_TOKEN, MUTATION_CASES, applyMutation, recommit, recommitCommitmentOnly, recommitPayloadOnly, } from './mutations.js';
+//# sourceMappingURL=index.js.map

package/dist/lifi-decode.d.ts

@@ -0,0 +1,2 @@
+/** lifi-decode.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { COLLECT_TOKEN_FEES_SELECTOR, GENERIC_SWAP_SELECTORS, decodeCollectTokenFees, decodeGenericSwap, encodeCollectTokenFees, encodeGenericSwap, type DecodedCollectTokenFees, type DecodedGenericSwap, type FeeDistribution, type SwapLeg, } from './vendor/otto-intel-mcp/adapter-index.js';

package/dist/lifi-decode.js

@@ -0,0 +1,3 @@
+/** lifi-decode.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { COLLECT_TOKEN_FEES_SELECTOR, GENERIC_SWAP_SELECTORS, decodeCollectTokenFees, decodeGenericSwap, encodeCollectTokenFees, encodeGenericSwap, } from './vendor/otto-intel-mcp/adapter-index.js';
+//# sourceMappingURL=lifi-decode.js.map

package/dist/mutations.d.ts

@@ -0,0 +1,55 @@
+/**
+ * mutations.ts — the consistency matrix (mutation cases the adapter MUST refuse).
+ *
+ * Each entry derives an INCONSISTENT variant of a VALID artifact and names the exact refusal the
+ * adapter must produce. Used twice: by the test suite (every refusal must redden — delete a check
+ * in verify.ts and its row fails) and by the sitting's fence section (the BYO "policy engine" is the
+ * adapter itself; these rows are its out-of-policy inputs, graded BLOCKED / LEAKED by the ladder).
+ * Same vocabulary as the constructor's own mutation proofs (`test/*-mutation-proof.ts`).
+ *
+ * Two mutation models, deliberately both:
+ *   - `recommit: false` — bytes change, digests are left stale. The integrity layer catches it.
+ *   - `recommit: true`  — payload + commitment digests are recomputed (they are unkeyed keccak over
+ *     public content, so any party holding the artifact can). Only the adapter's INTENT and POLICY
+ *     layers can catch these. A verifier that stopped at digests would grade every one of them LEAKED.
+ *
+ * Every row names the layer expected to catch it. Rows caught by the shared envelope schema are kept
+ * (they document the contract) but are NOT evidence for a verifier-local check; the verifier-local
+ * checks each have their own row(s) below.
+ *
+ * Deliberately NOT a row: an internal DEX leg re-pointed at a foreign contract with the receiver and
+ * minimum output intact. The adapter does not hold an allowlist of every DEX; that leg is bounded
+ * ON-CHAIN by the router's `_receiver` + `_minAmount` enforcement (GenericSwapV3 reverts unless the
+ * receiver gets at least the minimum), which is why the intent floor must be positive and the
+ * caller's own (verify.ts layer 2).
+ */
+import { type Address } from 'viem';
+import type { AdapterRefusalCode } from './refusal.js';
+import { type ExecutionEnvelope } from './vendor/otto-intel-mcp/execution-index.js';
+/** A foreign address no reviewed table names; the mutation target for every substitution row. */
+export declare const FOREIGN_ADDRESS: `0x${string}`;
+/** A foreign ERC20 no intent names (Base USDbC), for token substitutions. */
+export declare const FOREIGN_TOKEN: `0x${string}`;
+/** Recompute both digests with the constructor's public canonicalization, as any holder of the artifact could. */
+export declare function recommit(artifact: ExecutionEnvelope): ExecutionEnvelope;
+/** Which adapter layer is expected to catch the mutation (recorded in evidence). */
+export type CatchingLayer = 'schema' | 'integrity' | 'intent' | 'policy';
+export interface MutationCase {
+    readonly id: string;
+    readonly what: string;
+    readonly recommit: boolean;
+    readonly expect: AdapterRefusalCode;
+    readonly layer: CatchingLayer;
+    readonly mutate: (artifact: ExecutionEnvelope, context: MutationContext) => ExecutionEnvelope;
+}
+export interface MutationContext {
+    readonly forwarders: readonly Address[];
+    readonly ottoRecipient: Address;
+    readonly nowMs: number;
+}
+export declare const MUTATION_CASES: readonly MutationCase[];
+/** Recompute ONLY the payload digest (commitment left stale) — isolates the commitment check. */
+export declare function recommitPayloadOnly(artifact: ExecutionEnvelope): ExecutionEnvelope;
+/** Recompute ONLY the whole-envelope commitment (payload digest left stale) — isolates the payload-digest check. */
+export declare function recommitCommitmentOnly(artifact: ExecutionEnvelope): ExecutionEnvelope;
+export declare function applyMutation(mutation: MutationCase, artifact: ExecutionEnvelope, context: MutationContext): ExecutionEnvelope;