otto-execute 0.1.0

package/dist/vendor/otto-intel-mcp/adapter/lifi-decode.js

@@ -0,0 +1,149 @@
+/**
+ * lifi-decode.ts — the adapter's OWN decoder for what it is about to sign.
+ *
+ * Re-specified (not imported) from the reviewed layouts in `src/lib/otto-wallet/lifi-swap-action.ts`
+ * (GenericSwapV3 ERC20→ERC20: receiver@96 / minAmount@128, `LibSwap.SwapData` tuple) and the
+ * FeeCollector `collectTokenFees(token, (recipient, amount)[])` body. Spec §11 fences the dApp decoder
+ * as a live owner-op importer that must not move; spec §1 keeps the constructor's own assertions on
+ * the constructor's side. This file is the user-side view: if the two ever disagree, the artifact is
+ * refused, which is the correct outcome for a disagreement about calldata that moves money.
+ *
+ * Decoding runs on the ARG REGION with `decodeAbiParameters` after a separate selector check, so a
+ * selector/ABI mismatch cannot mask a correct-looking parameter decode. Every decode is re-encoded
+ * and compared to the input: trailing bytes or non-canonical encodings are refused, never ignored.
+ */
+import { decodeAbiParameters, encodeAbiParameters, getAddress, parseAbiParameters, } from 'viem';
+import { refuse } from './refusal.js';
+/** LibSwap.SwapData — (callTo, approveTo, sendingAssetId, receivingAssetId, fromAmount, callData, requiresDeposit). */
+const SWAP_DATA_TUPLE = '(address callTo, address approveTo, address sendingAssetId, address receivingAssetId, uint256 fromAmount, bytes callData, bool requiresDeposit)';
+const GENERIC_SWAP_SINGLE_PARAMS = parseAbiParameters(`bytes32 _transactionId, string _integrator, string _referrer, address _receiver, uint256 _minAmount, ${SWAP_DATA_TUPLE} _swapData`);
+const GENERIC_SWAP_MULTIPLE_PARAMS = parseAbiParameters(`bytes32 _transactionId, string _integrator, string _referrer, address _receiver, uint256 _minAmount, ${SWAP_DATA_TUPLE}[] _swapData`);
+const COLLECT_TOKEN_FEES_PARAMS = parseAbiParameters('address token, (address recipient, uint256 amount)[] distributions');
+/** swapTokensSingleV3ERC20ToERC20 / swapTokensMultipleV3ERC20ToERC20 — the only selectors a swap plan may call. */
+export const GENERIC_SWAP_SELECTORS = Object.freeze({
+    single: '0x4666fc80',
+    multiple: '0x5fd9ae2e',
+});
+/** FeeCollector.collectTokenFees — the only calldata a fee-forwarding leg may carry. */
+export const COLLECT_TOKEN_FEES_SELECTOR = '0x332d746b';
+function selectorOf(data) {
+    return data.slice(0, 10).toLowerCase();
+}
+function argRegion(data) {
+    return `0x${data.slice(10)}`;
+}
+function normalizeLeg(leg) {
+    return Object.freeze({
+        callTo: getAddress(leg.callTo),
+        approveTo: getAddress(leg.approveTo),
+        sendingAssetId: getAddress(leg.sendingAssetId),
+        receivingAssetId: getAddress(leg.receivingAssetId),
+        fromAmount: leg.fromAmount,
+        callData: leg.callData,
+        requiresDeposit: leg.requiresDeposit,
+    });
+}
+export function decodeGenericSwap(data) {
+    if (!/^0x[0-9a-fA-F]*$/.test(data) || data.length < 10) {
+        refuse('SWAP_CALLDATA_INVALID', 'swap step calldata is not hex or has no selector');
+    }
+    const selector = selectorOf(data);
+    const args = argRegion(data);
+    const params = selector === GENERIC_SWAP_SELECTORS.single
+        ? GENERIC_SWAP_SINGLE_PARAMS
+        : selector === GENERIC_SWAP_SELECTORS.multiple
+            ? GENERIC_SWAP_MULTIPLE_PARAMS
+            : undefined;
+    if (!params) {
+        refuse('SWAP_CALLDATA_INVALID', `selector ${selector} is not an allowlisted GenericSwap ERC20→ERC20 function`);
+    }
+    let decoded;
+    try {
+        decoded = decodeAbiParameters(params, args);
+        if (encodeAbiParameters(params, decoded).toLowerCase() !== args.toLowerCase()) {
+            refuse('SWAP_CALLDATA_INVALID', 'swap calldata is non-canonical or carries trailing bytes');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AdapterRefusal')
+            throw error;
+        refuse('SWAP_CALLDATA_INVALID', 'GenericSwap calldata failed to decode');
+    }
+    const [transactionId, integrator, referrer, receiver, minAmount, swapData] = decoded;
+    const legs = (Array.isArray(swapData) ? swapData : [swapData]).map(normalizeLeg);
+    if (legs.length === 0)
+        refuse('SWAP_CALLDATA_INVALID', 'GenericSwap carries no swap legs');
+    return Object.freeze({
+        selector,
+        transactionId,
+        integrator,
+        referrer,
+        receiver: getAddress(receiver),
+        minAmount,
+        legs: Object.freeze(legs),
+    });
+}
+export function decodeCollectTokenFees(callData) {
+    if (selectorOf(callData) !== COLLECT_TOKEN_FEES_SELECTOR) {
+        refuse('ATTRIBUTION_MISSING', 'fee-forwarding leg does not call collectTokenFees');
+    }
+    const args = argRegion(callData);
+    let decoded;
+    try {
+        decoded = decodeAbiParameters(COLLECT_TOKEN_FEES_PARAMS, args);
+        if (encodeAbiParameters(COLLECT_TOKEN_FEES_PARAMS, decoded).toLowerCase() !==
+            args.toLowerCase()) {
+            refuse('ATTRIBUTION_MISSING', 'fee calldata is non-canonical or carries trailing bytes');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AdapterRefusal')
+            throw error;
+        refuse('ATTRIBUTION_MISSING', 'collectTokenFees calldata failed to decode');
+    }
+    const [token, distributions] = decoded;
+    if (distributions.length === 0 || distributions.length > 8) {
+        refuse('ATTRIBUTION_MISSING', 'fee calldata has an unexpected distribution count');
+    }
+    return Object.freeze({
+        token: getAddress(token),
+        distributions: Object.freeze(distributions.map((distribution) => Object.freeze({ recipient: getAddress(distribution.recipient), amount: distribution.amount }))),
+    });
+}
+/* ------------------------------------------------------------------ *
+ * Encoders — used ONLY by the mutation matrix (tests + the fence section) to
+ * derive inconsistent artifacts the verifier must refuse. Production paths never encode.
+ * ------------------------------------------------------------------ */
+export function encodeGenericSwap(swap) {
+    const legs = swap.legs.map((leg) => ({ ...leg }));
+    if (swap.selector === GENERIC_SWAP_SELECTORS.single) {
+        if (legs.length !== 1)
+            throw new Error('single selector needs exactly one leg');
+        const body = encodeAbiParameters(GENERIC_SWAP_SINGLE_PARAMS, [
+            swap.transactionId,
+            swap.integrator,
+            swap.referrer,
+            swap.receiver,
+            swap.minAmount,
+            legs[0],
+        ]);
+        return `${swap.selector}${body.slice(2)}`;
+    }
+    const body = encodeAbiParameters(GENERIC_SWAP_MULTIPLE_PARAMS, [
+        swap.transactionId,
+        swap.integrator,
+        swap.referrer,
+        swap.receiver,
+        swap.minAmount,
+        legs,
+    ]);
+    return `${swap.selector}${body.slice(2)}`;
+}
+export function encodeCollectTokenFees(fees) {
+    const body = encodeAbiParameters(COLLECT_TOKEN_FEES_PARAMS, [
+        fees.token,
+        fees.distributions.map((distribution) => ({ ...distribution })),
+    ]);
+    return `${COLLECT_TOKEN_FEES_SELECTOR}${body.slice(2)}`;
+}
+//# sourceMappingURL=lifi-decode.js.map

package/dist/vendor/otto-intel-mcp/adapter/refusal.d.ts

@@ -0,0 +1,21 @@
+/**
+ * refusal.ts — the adapter's refusal taxonomy.
+ *
+ * Every refusal names a defect in the artifact or in the request (spec §10). A refusal that cannot
+ * name one is not a refusal but a service fault, and is thrown as a plain Error so the ladder grades
+ * it INCONCLUSIVE rather than BLOCKED.
+ *
+ * `errorType` mirrors `code` so the CDP kit's ladder — which only grades a *structured* refusal as
+ * the fence biting — recognises adapter refusals without a second grading path.
+ */
+export declare const ADAPTER_REFUSAL_CODES: readonly ["SCHEMA_INVALID", "UNSUPPORTED_OPERATION", "DIGEST_MISMATCH", "STALE_ARTIFACT", "ACCOUNT_BINDING_MISMATCH", "CAPABILITY_MISSING", "CHAIN_MISMATCH", "PLAN_SHAPE_INVALID", "APPROVAL_INVALID", "TARGET_NOT_ALLOWED", "SWAP_CALLDATA_INVALID", "RECEIVER_MISMATCH", "INTENT_MISMATCH", "MIN_OUTPUT_TOO_LOW", "ATTRIBUTION_MISSING", "ATTRIBUTION_MISMATCH", "FEE_CAP_EXCEEDED"];
+export type AdapterRefusalCode = (typeof ADAPTER_REFUSAL_CODES)[number];
+export declare class AdapterRefusal extends Error {
+    readonly code: AdapterRefusalCode;
+    /** Same value as `code`; lets `normalizeError` treat this as a structured refusal. */
+    readonly errorType: AdapterRefusalCode;
+    constructor(code: AdapterRefusalCode, message: string);
+}
+export declare function refuse(code: AdapterRefusalCode, message: string): never;
+export declare function isAdapterRefusal(error: unknown): error is AdapterRefusal;
+export declare function isAdapterRefusalCode(value: string): value is AdapterRefusalCode;

package/dist/vendor/otto-intel-mcp/adapter/refusal.js

@@ -0,0 +1,55 @@
+/**
+ * refusal.ts — the adapter's refusal taxonomy.
+ *
+ * Every refusal names a defect in the artifact or in the request (spec §10). A refusal that cannot
+ * name one is not a refusal but a service fault, and is thrown as a plain Error so the ladder grades
+ * it INCONCLUSIVE rather than BLOCKED.
+ *
+ * `errorType` mirrors `code` so the CDP kit's ladder — which only grades a *structured* refusal as
+ * the fence biting — recognises adapter refusals without a second grading path.
+ */
+export const ADAPTER_REFUSAL_CODES = [
+    // Envelope integrity (the constructor's own assertions, surfaced unchanged)
+    'SCHEMA_INVALID',
+    'UNSUPPORTED_OPERATION',
+    'DIGEST_MISMATCH',
+    'STALE_ARTIFACT',
+    'ACCOUNT_BINDING_MISMATCH',
+    // Adapter contract (spec §9)
+    'CAPABILITY_MISSING',
+    'CHAIN_MISMATCH',
+    // Adapter-side plan policy (what the user's signer is willing to sign)
+    'PLAN_SHAPE_INVALID',
+    'APPROVAL_INVALID',
+    'TARGET_NOT_ALLOWED',
+    'SWAP_CALLDATA_INVALID',
+    'RECEIVER_MISMATCH',
+    // Intent binding — the artifact must be the trade the USER asked for
+    'INTENT_MISMATCH',
+    'MIN_OUTPUT_TOO_LOW',
+    // Attribution — assert what you are about to sign, against the RULED constants
+    'ATTRIBUTION_MISSING',
+    'ATTRIBUTION_MISMATCH',
+    'FEE_CAP_EXCEEDED',
+];
+export class AdapterRefusal extends Error {
+    code;
+    /** Same value as `code`; lets `normalizeError` treat this as a structured refusal. */
+    errorType;
+    constructor(code, message) {
+        super(`[${code}] ${message}`);
+        this.code = code;
+        this.name = 'AdapterRefusal';
+        this.errorType = code;
+    }
+}
+export function refuse(code, message) {
+    throw new AdapterRefusal(code, message);
+}
+export function isAdapterRefusal(error) {
+    return error instanceof AdapterRefusal;
+}
+export function isAdapterRefusalCode(value) {
+    return ADAPTER_REFUSAL_CODES.includes(value);
+}
+//# sourceMappingURL=refusal.js.map

package/dist/vendor/otto-intel-mcp/adapter/sent-step.d.ts

@@ -0,0 +1,15 @@
+/**
+ * sent-step.ts — one submitted plan step as both signers report it: the step's index and kind, its
+ * target, the transaction hash, and the SEALED canonical receipt's block number and gas used.
+ */
+import type { Address, Hex } from 'viem';
+import type { VerifiedStep } from './verify.js';
+export interface SentStep {
+    readonly index: number;
+    readonly kind: VerifiedStep['kind'];
+    readonly to: Address;
+    readonly transaction_hash: Hex;
+    readonly status: 'success';
+    readonly block_number: string;
+    readonly gas_used: string;
+}

package/dist/vendor/otto-intel-mcp/adapter/sent-step.js

@@ -0,0 +1,6 @@
+/**
+ * sent-step.ts — one submitted plan step as both signers report it: the step's index and kind, its
+ * target, the transaction hash, and the SEALED canonical receipt's block number and gas used.
+ */
+export {};
+//# sourceMappingURL=sent-step.js.map

package/dist/vendor/otto-intel-mcp/adapter/verify.d.ts

@@ -0,0 +1,149 @@
+/**
+ * verify.ts — the adapter core: what the user's signer checks BEFORE it signs anything.
+ *
+ * Model B (docs/0808_model_b_scope_and_verdict.md, spec docs/0816_step1_execution_mcp_spec_draft.md):
+ * Otto constructs; the user's own custody signs and submits; Otto's fee is attribution baked into
+ * the constructed payload. The constructor is prepare-only and asserts what it built. This module is
+ * the OTHER half of spec §8 — "the consuming adapter re-checks digest + expected signer before
+ * signing" — extended to a full adapter-side policy, because an artifact's own digests prove
+ * integrity relative to the artifact's own claims and nothing more: an inconsistent artifact with
+ * correctly recomputed digests is still inconsistent. The checks run in three layers:
+ *
+ *   1. INTEGRITY — the constructor's own assertions, unchanged (schema, payload digest, whole-envelope
+ *      commitment + freshness, account binding).
+ *   2. INTENT    — the artifact is the trade the USER asked for: the approved token and amount ARE the
+ *      intent's, the deposit legs pull exactly that amount, the output token IS the intent's, and the
+ *      on-chain minimum output is at least the caller's own floor (> 0). The caller owns the floor;
+ *      it never comes from the artifact. This is the fence for the swap legs themselves: LI.FI's
+ *      GenericSwapV3 reverts unless `_receiver` gets at least `_minAmount` of the output token, so an
+ *      internal DEX leg is bounded on-chain by the receiver + minimum-output binds rather than by an
+ *      allowlist of every DEX contract (which this adapter deliberately does not attempt to hold).
+ *   3. POLICY    — capability contract, chain, plan shape, approvals only to the reviewed spender
+ *      that IS the call target, `_receiver` == this account, and the fee leg decoded with the
+ *      adapter's own decoder and matched against the RULED attribution constants (10 bps to Otto's
+ *      recipient, only the reviewed FeeForwarder deployments, nothing to strangers, aggregate under
+ *      the cap).
+ *
+ * P0 LIVENESS binds here exactly as it binds the constructor (spec §7.0): a valid artifact for the
+ * stated intent MUST pass. The test suite's first test is that property; the mutation matrix proves
+ * every refusal reddens. Every check that passes is recorded by id so the sitting's evidence shows
+ * what was verified, not just that "verification passed".
+ */
+import { type Address, type Hex } from 'viem';
+import { type AccountProfile, type ExecutionEnvelope } from '../execution-index.js';
+import { type DecodedCollectTokenFees } from './lifi-decode.js';
+export type SigningCapability = 'send_evm_transaction' | 'submit_evm_batch' | 'sign_eip712' | 'sign_hyperliquid_l1' | 'sign_x402_payment';
+/** What the USER asked for. Owned by the caller; never read out of the artifact. */
+export interface SwapIntent {
+    readonly fromToken: Address;
+    readonly toToken: Address;
+    /** Exact input amount in atomic units. */
+    readonly fromAmount: bigint;
+    /**
+     * The caller's OWN minimum acceptable output (atomic units), from a price source the caller
+     * trusts. Must be positive: a zero floor would let a swap leg deliver nothing.
+     */
+    readonly minAmountOut: bigint;
+}
+export interface AttributionPolicy {
+    /** The RULED fee config version the envelope must carry (spec §8: mechanism + version, never values). */
+    readonly configVersion: string;
+    /** The RULED Otto fee in basis points, asserted against the decoded fee leg. */
+    readonly feeBps: bigint;
+    readonly integrator: string;
+    readonly ottoRecipient: Address;
+    /** Recipients other than Otto's that a fee leg may pay (LI.FI's own platform share). Anything else is refused. */
+    readonly otherAllowedRecipients: readonly Address[];
+    /** Reviewed FeeForwarder deployments for the plan's chain (v1 + v2.0.0 today); a leg calling any other address is refused by name. */
+    readonly forwarders: readonly Address[];
+    /** Aggregate (Otto + LI.FI) fee ceiling in basis points; strictly above it is refused. */
+    readonly aggregateCapBps: bigint;
+}
+export interface AdapterPolicy {
+    readonly allowedCallTargets: readonly Address[];
+    readonly allowedApproveSpenders: readonly Address[];
+    readonly attribution: AttributionPolicy;
+}
+export interface VerifyExpectations {
+    readonly profile: AccountProfile;
+    readonly intent: SwapIntent;
+    readonly capabilities: readonly SigningCapability[];
+    readonly policy: AdapterPolicy;
+    readonly nowMs?: number;
+    /**
+     * The EXACT `otto_prepare_swap` input the caller sent (raw, as sent). When supplied, the artifact's
+     * `intent_digest` is recomputed with the constructor's own normalizer (which parses and checksums
+     * exactly as the constructor does) and must match — the artifact is then bound not only to the
+     * semantic intent fields but to the very request that produced it.
+     */
+    readonly prepareInput?: unknown;
+}
+export interface VerifiedStep {
+    readonly kind: 'approve_reset' | 'approve' | 'call';
+    readonly to: Address;
+    readonly value: bigint;
+    readonly data: Hex;
+}
+export interface VerifiedCheck {
+    readonly id: string;
+    readonly result: 'passed';
+}
+export interface VerifiedSwap {
+    readonly artifact: ExecutionEnvelope;
+    readonly steps: readonly [VerifiedStep, VerifiedStep, VerifiedStep];
+    readonly intent: SwapIntent;
+    readonly token: Address;
+    readonly outputToken: Address;
+    readonly spender: Address;
+    readonly gross: bigint;
+    readonly receiver: Address;
+    readonly minAmountOut: bigint;
+    readonly ottoFee: bigint;
+    readonly fees: DecodedCollectTokenFees;
+    readonly checks: readonly VerifiedCheck[];
+}
+/** The reviewed v1 policy for a same-chain LI.FI swap on `chainId`. */
+export declare function defaultAdapterPolicy(chainId: number): AdapterPolicy;
+export declare function verifySwapEnvelope(raw: unknown, expected: VerifyExpectations): VerifiedSwap;
+/** The verifier's record of a plan at verification time. Signers bind to THIS, not to the plan's fields. */
+export interface PlanIdentity {
+    readonly address: Address;
+    readonly chainId: number;
+    readonly capabilities: readonly SigningCapability[];
+    readonly validUntilMs: number;
+    readonly artifactId: string;
+    readonly artifactDigest: Hex;
+    readonly stepTargets: readonly [Address, Address, Address];
+}
+/** True iff every object reachable from `value` is frozen. */
+export declare function isDeepFrozen(value: unknown): boolean;
+/** True iff `plan` is an object `verifySwapEnvelope` itself returned (identity, not shape). */
+export declare function isVerifierOutput(plan: unknown): boolean;
+/** The verifier's own record of an intact verified plan (throws for anything else). */
+export declare function verifiedPlanIdentity(plan: VerifiedSwap): PlanIdentity;
+/** What a signer must present to be allowed to sign a verified plan. */
+export interface SignerIdentity {
+    readonly address: Address;
+    readonly chainId: number;
+    readonly capabilities: readonly SigningCapability[];
+}
+/**
+ * The FULL signer-side gate, called at signer entry and again immediately before every signature or
+ * submission: provenance + frozen shape (`assertVerifiedPlanIntact`), then — against the verifier's
+ * RECORD of the plan, not the plan's fields — the bound account IS this signer, the chain matches,
+ * every required capability is provided, and the plan is still fresh at `nowMs` (the record's
+ * deadline AND the artifact's own commitment-bound deadline). A plan verified for another account,
+ * another chain, or that has since expired is refused here even though it was genuinely verified.
+ */
+export declare function assertPlanSignableBy(plan: VerifiedSwap, signer: SignerIdentity, nowMs?: number): void;
+/**
+ * Signer-side gate: a plan may be signed only if it IS the object `verifySwapEnvelope` returned
+ * (provenance, checked by identity), it is still the deep-frozen shape it was returned as — the
+ * artifact's nested objects included — and it still matches the verifier's own record of it. A thawed
+ * copy, a JSON round trip, a mutated clone, a fully frozen look-alike that imitates the shape, or a
+ * re-pointed artifact with a recomputed commitment are all refused, so the only way to sign
+ * different bytes is to verify different bytes.
+ */
+export declare function assertVerifiedPlanIntact(plan: VerifiedSwap): void;
+/** The check ids `verifySwapEnvelope` records on a passing artifact, in order. Tests pin this list. */
+export declare const VERIFY_CHECK_IDS: readonly ["schema", "payload_digest", "commitment", "freshness", "account_binding", "capabilities", "chain", "plan_shape", "approvals", "swap_decode", "min_output", "fee_attribution"];