otto-intel-mcp 0.1.0

package/dist/execution-delegation.js

@@ -0,0 +1,545 @@
+/**
+ * execution-delegation.ts — the delegated-send path on the hosted MCP (Model B, browser plane, PR-1).
+ *
+ * The human minted a time-boxed CDP delegation in a browser (PR-2); this is what Otto's server does for
+ * that human's agent, headlessly. It holds Otto's developer-side CDP access (never a user key), and it
+ * submits ONLY a plan the user-side verifier accepts for THIS end user, under a fence that is READ BACK
+ * before any authority is exercised. Order per call, as a server invariant:
+ *
+ *   0. caller authentication — the per-request header, compared in constant time, BEFORE anything is
+ *      parsed or read (a wrong caller learns nothing and causes no CDP read);
+ *   1. the artifact was PREPARED BY THIS PROCESS (`prepared-artifacts.ts`) — else refuse; then the
+ *      per-artifact idempotency record (sent → replayed, halted → never retried), then one delegated
+ *      plan at a time per end user (the rig lock serialises revocation, not sends);
+ *   2. FENCE: the project policy is present, named and digests to v1 — else refuse;
+ *   3. GRANT: the user's delegation reads back active past the envelope's own expiry — else refuse;
+ *   4. ACCOUNT: the address the caller prepared for is one of THIS end user's CDP accounts, as CDP reports
+ *      them — never an address the caller binds on its own (a Dynamic-connected address is never a CDP
+ *      end-user address by construction);
+ *   5. VERIFY: the 13-check verifier over the envelope, for exactly the request that produced it, with the
+ *      server-confirmed address; then the fence's own bound (allow-listed token, reviewed spender, cap);
+ *   6. SEND: `CdpDelegatedSigner.sendPlan` — sealed receipts, halt clears the allowance, fail-closed once
+ *      revocation was requested.
+ *
+ * Nothing here logs the header, the secret, or a credential. Refusals are machine-readable codes; upstream
+ * error bodies are never relayed.
+ */
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { getAddress } from 'viem';
+import { CDP_CAPABILITIES, CdpDelegatedSigner, DelegatedPlanHaltedError, createCdpRig, revocationRequested, } from './adapter/cdp-signer.js';
+import { isAdapterRefusal } from './adapter/refusal.js';
+import { defaultAdapterPolicy, verifySwapEnvelope } from './adapter/verify.js';
+import { DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, } from './execution-delegated-definition.js';
+import { assertWithinModelBFence, MODEL_B_CHAIN_ID, MODEL_B_PER_SWAP_CAP_USD, MODEL_B_POLICY_NAME_V1, readBackModelBFence, } from './execution-delegation-policy.js';
+import { EXECUTION_REFUSAL_CODES, ExecutionRefusal, isExecutionRefusal, refuse, } from './execution-errors.js';
+import { artifactCommitmentDigest, canonicalJson, } from './execution-types.js';
+import { DELEGATED_SUBMISSION_GRACE_MS, preparedHere } from './prepared-artifacts.js';
+/* ------------------------------------------------------------------ *
+ * Environment — names only; values are the Founder's hand on Railway `otto-intel-mcp`, never Vercel.
+ * The developer API key already binds the CDP project for the SERVER's own signer paths. `OTTO_CDP_PROJECT_ID`
+ * is a separate, PUBLIC identifier (a UUID, never a secret): the ONE value the public fence-status tool
+ * publishes so the agent CLI (`otto-execute delegate`) mints to Otto's project and no other. It is not part
+ * of the five-var credential gate; when it is unset the public tool simply does not register.
+ * ------------------------------------------------------------------ */
+export const DELEGATION_ENV_NAMES = Object.freeze([
+    'CDP_API_KEY_ID',
+    'CDP_API_KEY_SECRET',
+    'CDP_WALLET_SECRET',
+    'OTTO_DELEGATION_SERVER_SECRET',
+    'BASE_RPC_URL',
+]);
+/** The public CDP project id the fence-status tool publishes (a UUID; PUBLIC, never a secret). */
+export const PUBLIC_PROJECT_ID_ENV_NAME = 'OTTO_CDP_PROJECT_ID';
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MIN_SERVER_SECRET_LENGTH = 32;
+/**
+ * All five absent → the delegated tool does not exist (same shape as the OTTO_EXECUTION_MCP_ENABLED
+ * switch). Any present but not all → boot refuses, naming the MISSING variables (never a value).
+ */
+export function loadDelegationEnv(env = process.env) {
+    const present = DELEGATION_ENV_NAMES.filter((name) => (env[name]?.trim() ?? '') !== '');
+    if (present.length === 0)
+        return undefined;
+    const missing = DELEGATION_ENV_NAMES.filter((name) => !present.includes(name));
+    if (missing.length > 0) {
+        throw new Error(`delegated send is partially configured: missing ${missing.join(', ')}`);
+    }
+    const serverSecret = env.OTTO_DELEGATION_SERVER_SECRET.trim();
+    if (serverSecret.length < MIN_SERVER_SECRET_LENGTH) {
+        throw new Error(`OTTO_DELEGATION_SERVER_SECRET must be at least ${MIN_SERVER_SECRET_LENGTH} characters`);
+    }
+    const rpcUrl = env.BASE_RPC_URL.trim();
+    let parsed;
+    try {
+        parsed = new URL(rpcUrl);
+    }
+    catch {
+        throw new Error('BASE_RPC_URL must be a URL');
+    }
+    if (parsed.protocol !== 'https:')
+        throw new Error('BASE_RPC_URL must use https');
+    const rawProjectId = env[PUBLIC_PROJECT_ID_ENV_NAME]?.trim() ?? '';
+    if (rawProjectId !== '' && !UUID_PATTERN.test(rawProjectId)) {
+        throw new Error(`${PUBLIC_PROJECT_ID_ENV_NAME} must be a UUID (a public CDP project id)`);
+    }
+    return Object.freeze({
+        credentials: Object.freeze({
+            apiKeyId: env.CDP_API_KEY_ID.trim(),
+            apiKeySecret: env.CDP_API_KEY_SECRET.trim(),
+            walletSecret: env.CDP_WALLET_SECRET.trim(),
+        }),
+        serverSecret,
+        rpcUrl,
+        ...(rawProjectId !== '' ? { publicProjectId: rawProjectId } : {}),
+    });
+}
+function isRejectedToken(error) {
+    const e = error;
+    return (e.statusCode === 401 ||
+        e.statusCode === 403 ||
+        e.statusCode === 404 ||
+        ['unauthorized', 'invalid_token', 'not_found', 'end_user_not_found'].includes(e.errorType ?? ''));
+}
+function isAbsentEndUser(error) {
+    const e = error;
+    return (e.statusCode === 404 || e.errorType === 'not_found' || e.errorType === 'end_user_not_found');
+}
+function isAbsentDelegation(error) {
+    const e = error;
+    return (e.statusCode === 404 ||
+        ['delegation_not_found', 'delegation_revoked', 'delegation_expired'].includes(e.errorType ?? ''));
+}
+/** Build the delegation rig over a CDP client (real or structural mock) and a Base public client. */
+export function createDelegationRig(cdp, pub) {
+    const rig = createCdpRig({
+        pub,
+        submit: async (user, transaction) => {
+            const result = await cdp.endUser.sendEvmTransaction({
+                userId: user.userId,
+                address: user.address,
+                transaction,
+                network: 'base',
+            });
+            return result.transactionHash;
+        },
+        revoke: async (userId) => {
+            await cdp.endUser.revokeDelegationForEndUser({ userId });
+        },
+        readDelegation: async (userId) => {
+            try {
+                return await cdp.endUser.getDelegationForEndUser({ userId });
+            }
+            catch (error) {
+                if (isAbsentDelegation(error))
+                    return undefined;
+                throw error;
+            }
+        },
+    });
+    return Object.freeze({
+        rig,
+        async listProjectPolicies() {
+            const listed = await cdp.policies.listPolicies({ scope: 'project' });
+            return listed.policies ?? [];
+        },
+        async readEndUser(userId) {
+            let user;
+            try {
+                user = await cdp.endUser.getEndUser({ userId });
+            }
+            catch (error) {
+                if (isAbsentEndUser(error))
+                    return undefined;
+                throw error;
+            }
+            return endUserRecord(user);
+        },
+        async createProjectPolicy(body) {
+            const created = await cdp.policies.createPolicy({ policy: body });
+            return created.id;
+        },
+        async updateProjectPolicy(id, body) {
+            await cdp.policies.updatePolicy({
+                id,
+                policy: { description: body.description, rules: body.rules },
+            });
+        },
+        async readProjectPolicy(id) {
+            try {
+                const policy = await cdp.policies.getPolicyById({ id });
+                return Object.freeze({
+                    id: policy.id,
+                    scope: policy.scope,
+                    rules: policy.rules,
+                    ...(policy.description !== undefined ? { description: policy.description } : {}),
+                });
+            }
+            catch (error) {
+                const e = error;
+                if (e.statusCode === 404 || e.errorType === 'not_found')
+                    return undefined;
+                throw error;
+            }
+        },
+        async validateAccessToken(accessToken) {
+            let user;
+            try {
+                user = await cdp.endUser.validateAccessToken({ accessToken });
+            }
+            catch (error) {
+                if (isRejectedToken(error))
+                    return undefined;
+                throw error;
+            }
+            return endUserRecord(user);
+        },
+    });
+}
+function endUserRecord(user) {
+    const addresses = user.evmAccountObjects?.map((account) => account.address) ?? user.evmAccounts ?? [];
+    return Object.freeze({
+        userId: user.userId,
+        evmAddresses: Object.freeze(addresses.map((a) => getAddress(a))),
+    });
+}
+/** Pull the caller's presented secret out of the MCP request headers (case-insensitive, first value). */
+export function callerFromHeaders(headers) {
+    if (!headers)
+        return Object.freeze({});
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() !== DELEGATION_AUTH_HEADER)
+            continue;
+        const first = Array.isArray(value) ? value[0] : value;
+        return Object.freeze(first && first.length > 0 ? { presentedSecret: first } : {});
+    }
+    return Object.freeze({});
+}
+/** Constant-time compare over fixed-length digests, so neither length nor content leaks by timing. */
+function secretsMatch(presented, expected) {
+    if (!expected || typeof presented !== 'string' || presented.length === 0)
+        return false;
+    const a = createHash('sha256').update(presented).digest();
+    const b = createHash('sha256').update(expected).digest();
+    return timingSafeEqual(a, b);
+}
+/**
+ * The caller check EVERY delegation tool runs first — constant-time, before parsing or any CDP read. One
+ * seam for the send tool and the admin tools (`execution-delegation-admin.ts`).
+ */
+export function assertDelegationCaller(services, caller) {
+    if (!secretsMatch(caller.presentedSecret, services.serverSecret)) {
+        refuse('DELEGATION_UNAUTHORIZED', `the ${DELEGATION_AUTH_HEADER} header is missing or not accepted`);
+    }
+}
+/* ------------------------------------------------------------------ *
+ * Per-user in-flight: one delegated plan at a time per end user, per services instance.
+ * ------------------------------------------------------------------ */
+const IN_FLIGHT = new WeakMap();
+function acquireUser(services, userId) {
+    let users = IN_FLIGHT.get(services);
+    if (!users) {
+        users = new Set();
+        IN_FLIGHT.set(services, users);
+    }
+    if (users.has(userId)) {
+        return refuse('DELEGATION_BUSY', 'a delegated plan for this end user is already in flight; retry after it settles');
+    }
+    users.add(userId);
+    return () => {
+        users.delete(userId);
+    };
+}
+/**
+ * The request identity a submission record is bound to. The commitment is RECOMPUTED from the envelope, never
+ * read from its field. Addresses are checksum-normalized before hashing — the same normalization the verifier
+ * applies — so a retry that merely re-cases an address is the SAME request (and replays), while any change the
+ * verifier would see as different (amount, token, account, floor, chain, client_ref, user) is not.
+ */
+function requestFingerprint(input, commitment) {
+    const prepareInput = {
+        ...input.prepareInput,
+        accountProfile: {
+            ...input.prepareInput.accountProfile,
+            address: getAddress(input.prepareInput.accountProfile.address),
+        },
+        fromToken: getAddress(input.prepareInput.fromToken),
+        toToken: getAddress(input.prepareInput.toToken),
+    };
+    return createHash('sha256')
+        .update(canonicalJson({ user_id: input.userId, commitment, prepare_input: prepareInput }))
+        .digest('hex');
+}
+const SUBMISSIONS = new WeakMap();
+function submissionsOf(services, nowMs) {
+    let records = SUBMISSIONS.get(services);
+    if (!records) {
+        records = new Map();
+        SUBMISSIONS.set(services, records);
+    }
+    for (const [id, record] of records)
+        if (record.expiresAtMs <= nowMs)
+            records.delete(id);
+    return records;
+}
+/* ------------------------------------------------------------------ *
+ * Error translation — the verifier's and signer's failures as machine-readable refusals.
+ * ------------------------------------------------------------------ */
+function isExecutionCode(code) {
+    return EXECUTION_REFUSAL_CODES.includes(code);
+}
+/**
+ * The cause class of a halt: the signer's STRUCTURED `cause` only (set from the CDP `errorType`, an error's
+ * class or the receipt status at the signer's catch sites). The message text — which embeds upstream
+ * text — is never consulted, so upstream text can neither leak nor select the class.
+ */
+export function haltCause(error) {
+    return error.cause;
+}
+/** Map a verifier / signer failure to the tool's refusal taxonomy; anything else is rethrown. */
+export function toDelegationRefusal(error) {
+    if (isExecutionRefusal(error))
+        return error;
+    if (isAdapterRefusal(error)) {
+        // The adapter's message already carries `[CODE] …`; codes shared with the constructor pass through by name.
+        return isExecutionCode(error.code)
+            ? new ExecutionRefusal(error.code, error.message)
+            : new ExecutionRefusal('DELEGATED_PLAN_REFUSED', error.message);
+    }
+    if (error instanceof DelegatedPlanHaltedError) {
+        // The signer's message embeds the upstream failure text; only its CAUSE CLASS leaves this server.
+        const clear = error.allowanceCleared
+            ? 'allowance cleared (read-back 0)'
+            : `allowance NOT confirmed cleared${error.clearTransactionHash ? ` (clear ${error.clearTransactionHash})` : ''}`;
+        return new ExecutionRefusal('DELEGATED_PLAN_HALTED', `delegated plan halted at step ${error.failedStep} (${haltCause(error)}); ${clear}; the artifact is not retried on this server — prepare again`);
+    }
+    return undefined;
+}
+/* ------------------------------------------------------------------ *
+ * The tool
+ * ------------------------------------------------------------------ */
+function parseInput(rawInput) {
+    const parsed = SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA.safeParse(rawInput);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        return refuse('DELEGATION_INPUT_INVALID', `input does not satisfy the delegated-send schema: ${issue ? `${issue.path.join('.') || '(root)'}: ${issue.message}` : 'unknown issue'}`);
+    }
+    return parsed.data;
+}
+function verifiedResult(input, user, verified, sent, fence, expiresAt) {
+    return Object.freeze({
+        status: 'sent',
+        user_id: user.userId,
+        address: user.address,
+        chain_id: MODEL_B_CHAIN_ID,
+        artifact_id: verified.artifact.artifact_id,
+        steps: sent.map((step) => Object.freeze({
+            index: step.index,
+            kind: step.kind,
+            to: step.to,
+            transaction_hash: step.transaction_hash,
+            status: step.status,
+            block_number: step.block_number,
+            gas_used: step.gas_used,
+        })),
+        fence: Object.freeze({
+            policy_id: fence.id,
+            policy_name: MODEL_B_POLICY_NAME_V1,
+            rules_digest: fence.rulesDigest,
+            per_swap_cap_usd: MODEL_B_PER_SWAP_CAP_USD,
+        }),
+        delegation: Object.freeze({ expires_at: expiresAt }),
+        verification: Object.freeze({
+            checks: verified.checks.map((check) => check.id),
+            gross: verified.gross.toString(),
+            min_amount_out: verified.minAmountOut.toString(),
+            otto_fee_atomic: verified.ottoFee.toString(),
+            otto_fee_recipient: defaultAdapterPolicy(MODEL_B_CHAIN_ID).attribution.ottoRecipient,
+            fee_config_version: input.envelope.fee_attribution.config_version,
+            receiver: verified.receiver,
+        }),
+    });
+}
+/**
+ * Submit a prepared swap under the end user's delegation — the order in the file header is the contract.
+ * `caller` is derived from the request headers by the registration layer; it never comes from arguments.
+ */
+export async function submitUnderDelegation(runtime, rawInput, caller, _signal) {
+    const services = runtime.delegation;
+    if (!services)
+        return refuse('DELEGATION_UNAVAILABLE', 'delegated send is not configured on this server');
+    // 0. Caller authentication — before parsing, before any CDP read.
+    assertDelegationCaller(services, caller);
+    const input = parseInput(rawInput);
+    const nowMs = runtime.nowMs();
+    // 1a. Only an artifact THIS process prepared — same id, same whole-envelope commitment — is submittable: the
+    // idempotency record below is process-local, and a process that did not prepare the artifact cannot know
+    // whether another one already sent it (a rolling replacement runs two at once). Refused before any read;
+    // the caller prepares again. The commitment is RECOMPUTED from the presented envelope (the field it
+    // carries is never trusted), so a tampered envelope under a known id is refused here, never replayed.
+    // Checked BEFORE the record on purpose: a prepared-here entry is never evicted and expires exactly when
+    // the record does (same clock value, same window), so a record can never exist without its entry.
+    const artifactId = input.envelope.artifact_id;
+    // The strict schema has validated the shape; the digest is over whatever was presented (a malformed envelope
+    // digests to nothing this process recorded and is refused).
+    const commitment = artifactCommitmentDigest(input.envelope);
+    if (!preparedHere(services, artifactId, commitment, nowMs)) {
+        return refuse('ARTIFACT_NOT_PREPARED_HERE', 'the artifact (this id with this content) was not prepared by this server process, or its freshness window has passed; its submission record cannot exist here — prepare again');
+    }
+    // 1b. Same artifact seen before? Replay its outcome — to the SAME request only; never send twice.
+    const fingerprint = requestFingerprint(input, commitment);
+    const records = submissionsOf(services, nowMs);
+    const seen = records.get(artifactId);
+    if (seen) {
+        if (seen.fingerprint !== fingerprint) {
+            return refuse('DELEGATION_REPLAY_MISMATCH', 'this artifact was already submitted on this server with a different request (user, account or intent); nothing is re-sent — prepare again');
+        }
+        if (seen.state.kind === 'sent')
+            return Object.freeze({ ...seen.state.result, replayed: true });
+        if (seen.state.kind === 'halted')
+            throw seen.state.refusal;
+        return refuse('DELEGATION_ARTIFACT_IN_FLIGHT', 'this artifact is being submitted right now; wait for its result');
+    }
+    const release = acquireUser(services, input.userId);
+    const submission = {
+        expiresAtMs: Date.parse(input.envelope.valid_until) + DELEGATED_SUBMISSION_GRACE_MS,
+        fingerprint,
+        state: { kind: 'in_flight' },
+    };
+    records.set(artifactId, submission);
+    try {
+        // 2. FENCE before authority.
+        const fence = readBackModelBFence(await services.rig.listProjectPolicies());
+        if (!fence.present)
+            return refuse('DELEGATION_FENCE_ABSENT', `the Model-B project policy is not in force (${fence.reason}): ${fence.detail}`);
+        // 3. GRANT active past the envelope's own expiry; fail-closed once revocation was ever requested here.
+        if (revocationRequested(services.rig.rig, input.userId)) {
+            return refuse('DELEGATION_NOT_ACTIVE', 'revocation was requested for this end user on this server; nothing is submitted for them again');
+        }
+        const grant = await services.rig.rig.readDelegation(input.userId);
+        if (!grant)
+            return refuse('DELEGATION_NOT_ACTIVE', 'no active delegation reads back for this end user');
+        const expiresAtMs = Date.parse(grant.expiresAt);
+        const validUntilMs = Date.parse(input.envelope.valid_until);
+        if (!Number.isFinite(expiresAtMs) ||
+            !Number.isFinite(validUntilMs) ||
+            expiresAtMs <= validUntilMs) {
+            return refuse('DELEGATION_NOT_ACTIVE', `the delegation expires at ${grant.expiresAt}, not after the envelope's valid_until ${input.envelope.valid_until}; renew the delegation or prepare again`);
+        }
+        // 4. ACCOUNT: the caller's prepared address must be one of THIS end user's accounts as CDP reports them.
+        const record = await services.rig.readEndUser(input.userId);
+        if (!record)
+            return refuse('DELEGATION_USER_UNKNOWN', 'CDP reports no end user with this id');
+        const address = getAddress(input.prepareInput.accountProfile.address);
+        if (!record.evmAddresses.includes(address)) {
+            return refuse('ACCOUNT_BINDING_MISMATCH', "the prepared account is not one of this end user's CDP accounts");
+        }
+        const user = Object.freeze({ userId: record.userId, address });
+        // 5. VERIFY with the server-confirmed address, for exactly the request that produced the envelope.
+        let verified;
+        try {
+            verified = verifySwapEnvelope(input.envelope, {
+                profile: { kind: 'eoa', address, chainId: MODEL_B_CHAIN_ID },
+                intent: {
+                    fromToken: getAddress(input.prepareInput.fromToken),
+                    toToken: getAddress(input.prepareInput.toToken),
+                    fromAmount: BigInt(input.prepareInput.fromAmount),
+                    minAmountOut: BigInt(input.prepareInput.slippage.minAmountOut),
+                },
+                capabilities: CDP_CAPABILITIES,
+                policy: defaultAdapterPolicy(MODEL_B_CHAIN_ID),
+                nowMs: runtime.nowMs(),
+                prepareInput: input.prepareInput,
+            });
+        }
+        catch (error) {
+            const refusal = toDelegationRefusal(error);
+            if (refusal)
+                throw refusal;
+            throw error;
+        }
+        assertWithinModelBFence(verified, services.fenceBound?.perSwapCapUsd, services.fenceBound?.inputTokens);
+        // 6. SEND.
+        const signer = new CdpDelegatedSigner(services.rig.rig, user, {
+            sealedWait: services.sealedWait,
+        });
+        let sent;
+        try {
+            sent = await signer.sendPlan(verified);
+        }
+        catch (error) {
+            // Something may have reached the chain: this artifact is never retried on this server.
+            const refusal = toDelegationRefusal(error) ??
+                new ExecutionRefusal('DELEGATED_PLAN_HALTED', 'delegated plan halted (upstream_failure); the artifact is not retried on this server — prepare again');
+            submission.state = { kind: 'halted', refusal };
+            throw refusal;
+        }
+        const result = verifiedResult(input, user, verified, sent, fence, grant.expiresAt);
+        submission.state = { kind: 'sent', result };
+        return result;
+    }
+    catch (error) {
+        // A refusal BEFORE any send leaves no trace: the caller may fix the request and resubmit the same artifact.
+        if (submission.state.kind === 'in_flight')
+            records.delete(artifactId);
+        throw error;
+    }
+    finally {
+        release();
+    }
+}
+/* ------------------------------------------------------------------ *
+ * Boot: the real services from the environment (hosted only).
+ * ------------------------------------------------------------------ */
+/**
+ * `@coinbase/cdp-sdk` is an OPTIONAL dependency; it is loaded here, lazily, only when delegation is
+ * configured. Configured + absent = a named boot refusal (fail-closed), never a silent tool-less start.
+ */
+async function loadCdpSdk() {
+    try {
+        return await import('@coinbase/cdp-sdk');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`delegated send is configured (${DELEGATION_ENV_NAMES.join(', ')}) but @coinbase/cdp-sdk is not installed — refusing to boot (${reason})`);
+    }
+}
+/**
+ * Open the delegation services from a loaded environment: the SDK client over Otto's developer
+ * credentials, a Base public client whose chain id is checked once at boot, and the fenced rig.
+ * Nothing here reads a policy, a grant or a user — every call does that itself, in order.
+ */
+export async function openDelegationServicesFromEnv(env) {
+    const { CdpClient } = await loadCdpSdk();
+    const { createPublicClient, http } = await import('viem');
+    const { base } = await import('viem/chains');
+    const cdp = new CdpClient({
+        apiKeyId: env.credentials.apiKeyId,
+        apiKeySecret: env.credentials.apiKeySecret,
+        walletSecret: env.credentials.walletSecret,
+    });
+    const pub = createPublicClient({ chain: base, transport: http(env.rpcUrl) });
+    let chainId;
+    try {
+        chainId = await pub.getChainId();
+    }
+    catch {
+        // FIXED text, on purpose: viem's own message embeds the RPC URL, and an API key rides in that URL's
+        // path. The upstream error is never rethrown or printed; the boot refuses with a message that carries
+        // no value at all (`hosted-main.ts` redacts URLs a second time before anything reaches stderr).
+        throw new Error('BASE_RPC_URL did not answer eth_chainId at boot; refusing to boot (upstream detail withheld)');
+    }
+    if (chainId !== MODEL_B_CHAIN_ID) {
+        throw new Error(`BASE_RPC_URL reports chainId ${chainId}, expected ${MODEL_B_CHAIN_ID} (Base mainnet)`);
+    }
+    return Object.freeze({
+        rig: createDelegationRig(cdp, pub),
+        serverSecret: env.serverSecret,
+        ...(env.publicProjectId ? { publicProjectId: env.publicProjectId } : {}),
+    });
+}
+/** `loadDelegationEnv` + `openDelegationServicesFromEnv`; undefined when the five variables are all absent. */
+export async function createDelegationServicesFromEnv(env = process.env) {
+    const loaded = loadDelegationEnv(env);
+    return loaded ? openDelegationServicesFromEnv(loaded) : undefined;
+}
+//# sourceMappingURL=execution-delegation.js.map

package/dist/execution-errors.d.ts

@@ -0,0 +1,9 @@
+export declare const EXECUTION_REFUSAL_CODES: readonly ["ATTRIBUTION_MISSING", "LIFI_FEE_CAP_EXCEEDED", "ACCOUNT_BINDING_MISMATCH", "DIGEST_MISMATCH", "ARTIFACT_INVALID", "STALE_ARTIFACT", "EXECUTION_RATE_LIMITED", "EXECUTION_CONCURRENCY_FULL", "UNSUPPORTED_ACCOUNT_PROFILE", "LIFI_QUOTE_FAILED", "LIFI_QUOTE_INVALID", "UNSUPPORTED_LIFI_ROUTE", "POLYMARKET_METADATA_FAILED", "POLYMARKET_METADATA_INVALID", "UNSUPPORTED_POLYMARKET_MARKET", "POLYMARKET_ORDER_INVALID", "POLYMARKET_BUILDER_FEE_UNRULED", "HYPERLIQUID_META_FAILED", "HYPERLIQUID_META_INVALID", "UNSUPPORTED_HYPERLIQUID_MARKET", "HYPERLIQUID_ORDER_INVALID", "DELEGATION_UNAVAILABLE", "DELEGATION_UNAUTHORIZED", "DELEGATION_INPUT_INVALID", "DELEGATION_BUSY", "DELEGATION_ARTIFACT_IN_FLIGHT", "ARTIFACT_NOT_PREPARED_HERE", "PREPARED_ARTIFACT_CAPACITY", "ARTIFACT_ID_COLLISION", "DELEGATION_REPLAY_MISMATCH", "DELEGATION_FENCE_ABSENT", "DELEGATION_FENCE_FOREIGN", "DELEGATION_FENCE_AMBIGUOUS", "DELEGATION_FENCE_NEWER", "DELEGATION_TOKEN_INVALID", "DELEGATION_REVOKE_NOT_CONFIRMED", "DELEGATION_NOT_ACTIVE", "DELEGATION_USER_UNKNOWN", "DELEGATION_OUTSIDE_FENCE", "DELEGATED_PLAN_REFUSED", "DELEGATED_PLAN_HALTED", "DELEGATION_UPSTREAM_FAILED"];
+export type ExecutionRefusalCode = (typeof EXECUTION_REFUSAL_CODES)[number];
+/** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
+export declare class ExecutionRefusal extends Error {
+    readonly code: ExecutionRefusalCode;
+    constructor(code: ExecutionRefusalCode, message: string);
+}
+export declare function refuse(code: ExecutionRefusalCode, message: string): never;
+export declare function isExecutionRefusal(error: unknown): error is ExecutionRefusal;