@floatonnear/mcp 0.4.0 → 0.5.0

package/dist/agent-key.d.ts

@@ -1,10 +1,22 @@
 /**
  * The node a creation-time agent is bound to.
  *
- * ROOT_NODE in the vault. The factory binds at the root because it is the only
- * node that exists at `new` — children are added later by the owner.
+ * ONE, NOT ZERO, SINCE 2026-11-08. `new` used to bind at ROOT_NODE because it
+ * was the only node that existed — which left the FIRST agent holding the
+ * whole vault budget while every agent added later through `add_role` got a
+ * child of its own. The hierarchy only began constraining from agent #2.
+ *
+ * `new` now creates the agent its own child of root, carrying the same limits,
+ * exactly as `add_role` does. Root is 0 and that child is the first node
+ * inserted after it, so the agent is 1.
+ *
+ * PREDICTED, NOT READ, and that is unavoidable: the credential is generated
+ * before the vault exists, so there is nothing to ask. It is pinned by
+ * `binding_at_init_matches_binding_afterwards` in the contract, which asserts
+ * the node is 1 and not 0 — if `new` ever inserts another node first, that
+ * test fails rather than this constant drifting in silence.
  */
-export declare const AGENT_NODE_ID = 0;
+export declare const AGENT_NODE_ID = 1;
 export interface GeneratedAgentKey {
     publicKey: string;
     /** The role this credential was filed under, when one was given. */

package/dist/agent-key.js

@@ -21,10 +21,22 @@ import { KeyPair } from "near-api-js";
 /**
  * The node a creation-time agent is bound to.
  *
- * ROOT_NODE in the vault. The factory binds at the root because it is the only
- * node that exists at `new` — children are added later by the owner.
+ * ONE, NOT ZERO, SINCE 2026-11-08. `new` used to bind at ROOT_NODE because it
+ * was the only node that existed — which left the FIRST agent holding the
+ * whole vault budget while every agent added later through `add_role` got a
+ * child of its own. The hierarchy only began constraining from agent #2.
+ *
+ * `new` now creates the agent its own child of root, carrying the same limits,
+ * exactly as `add_role` does. Root is 0 and that child is the first node
+ * inserted after it, so the agent is 1.
+ *
+ * PREDICTED, NOT READ, and that is unavoidable: the credential is generated
+ * before the vault exists, so there is nothing to ask. It is pinned by
+ * `binding_at_init_matches_binding_afterwards` in the contract, which asserts
+ * the node is 1 and not 0 — if `new` ever inserts another node first, that
+ * test fails rather than this constant drifting in silence.
  */
-export const AGENT_NODE_ID = 0;
+export const AGENT_NODE_ID = 1;
 /**
  * Write the agent's credential where the adapter will actually find it.
  *

package/dist/create.d.ts

@@ -24,13 +24,18 @@
  * caught the drift the moment the contract shrank, which is the entire
  * reason it exists.
  *
+ * 298,819 -> 298,920 on 2026-11-08, when `new` began giving a creation-time
+ * agent its OWN child node instead of binding it to root. +101 bytes, about
+ * 0.00101 NEAR more per vault. The pin caught this one too, on the first gate
+ * run after the rebuild.
+ *
  * Mirrors `packages/create-float/res/vault.wasm`, and `create.pins.test.ts`
  * reads that file and fails if the two disagree — so a contract rebuild cannot
  * silently leave this quoting a deposit that is too small. Too small is not a
  * clean failure: CreateAccount succeeds and the vault sits below its own
  * storage requirement, bricking on the first write.
  */
-export declare const CONTRACT_BYTES = 298819;
+export declare const CONTRACT_BYTES = 298920;
 /** NEAR charges 1e19 yoctoNEAR per byte of storage. */
 export declare const STORAGE_COST_PER_BYTE: bigint;
 /**
@@ -131,6 +136,26 @@ export interface CreatePlanInput {
     appUrl: string;
     /** Whether the derived account is already on chain. */
     exists?: boolean;
+    /**
+     * The EXISTING account's own `get_config.owner`, when it could be read.
+     *
+     * WHY THIS IS NOT OPTIONAL REASONING. "The account at your derived id exists,
+     * therefore it is yours" is an inference from the derivation, not a fact
+     * about the account — and `derive_prefix` IS NOT INJECTIVE. The factory says
+     * so in capitals, and `derive_prefix_collides_between_a_dot_and_a_hyphen`
+     * asserts it: `a.b.testnet` and `a-b.testnet` both land on `a-b-testnet`,
+     * because replacing the dot merges it into an alphabet that already contains
+     * the hyphen. Whoever creates first takes the id.
+     *
+     * Without reading the vault back, this tool would tell the LOSER of that
+     * collision to point their agent at the WINNER's vault. Narrow, but the
+     * failure is "you are now configured against someone else's money".
+     *
+     * `null` means the read failed, or the account is not a Float vault at all.
+     * That is a THIRD outcome and must not be flattened into either of the
+     * others — "I could not check" is not "it is yours".
+     */
+    existingOwner?: string | null;
     /**
      * The agent public key to bind at creation, if any.
      *

package/dist/create.js

@@ -24,13 +24,18 @@
  * caught the drift the moment the contract shrank, which is the entire
  * reason it exists.
  *
+ * 298,819 -> 298,920 on 2026-11-08, when `new` began giving a creation-time
+ * agent its OWN child node instead of binding it to root. +101 bytes, about
+ * 0.00101 NEAR more per vault. The pin caught this one too, on the first gate
+ * run after the rebuild.
+ *
  * Mirrors `packages/create-float/res/vault.wasm`, and `create.pins.test.ts`
  * reads that file and fails if the two disagree — so a contract rebuild cannot
  * silently leave this quoting a deposit that is too small. Too small is not a
  * clean failure: CreateAccount succeeds and the vault sits below its own
  * storage requirement, bricking on the first write.
  */
-export const CONTRACT_BYTES = 298819;
+export const CONTRACT_BYTES = 298920;
 /** NEAR charges 1e19 yoctoNEAR per byte of storage. */
 export const STORAGE_COST_PER_BYTE = 10n ** 19n;
 /**
@@ -139,8 +144,25 @@ export function buildCreatePlan(i) {
             `64-character limit. Use a named account.`);
     }
     if (known && i.exists) {
-        throw new Error(`${i.vaultId} already exists. That is this owner's vault — connect to it ` +
-            `with NEAR_VAULT_CONTRACT=${i.vaultId} rather than creating another.`);
+        // Three outcomes, deliberately not two. The old message asserted the
+        // first one for all three.
+        if (i.existingOwner && i.existingOwner === i.owner) {
+            throw new Error(`${i.vaultId} already exists and ${i.owner} owns it — confirmed by reading ` +
+                `its get_config. Connect to it with NEAR_VAULT_CONTRACT=${i.vaultId} ` +
+                `rather than creating another.`);
+        }
+        if (i.existingOwner) {
+            throw new Error(`${i.vaultId} already exists and is owned by ${i.existingOwner}, NOT by ` +
+                `${i.owner}. Do NOT point an agent at it.\n\n` +
+                `The factory derives a vault id by replacing dots with hyphens, and that ` +
+                `is not injective: "a.b.near" and "a-b.near" both derive "a-b-near", and ` +
+                `whoever created first holds the id. Create yours under a label instead, ` +
+                `which puts it at a different address.`);
+        }
+        throw new Error(`${i.vaultId} already exists, but its owner could NOT be read, so whether it ` +
+            `is yours is unknown — not assumed. It may not be a Float vault at all. ` +
+            `Check it before pointing anything at it:\n` +
+            `  near view ${i.vaultId} get_config`);
     }
     // Two different floors, and the quote must clear BOTH.
     //

package/dist/server.js

@@ -183,7 +183,7 @@ const limitShape = z
 // startup: a wrong relative path would break the server outright instead of
 // merely reporting a stale version. server.smoke.test.ts asserts the two agree,
 // so a bump cannot land with only one of them moved.
-const server = new McpServer({ name: "float", version: "0.4.0" });
+const server = new McpServer({ name: "float", version: "0.5.0" });
 // ----------------------------------------------------------------- reads
 server.tool("vault_tree", "Read the whole budget tree: every node, its caps, parent, bound agent account, cooldown and freeze state. No key required.", {}, async () => json(await viewFunction(cfg.rpcUrl, requireVault(), "get_tree", {})));
 server.tool("vault_budget", "Read one node's budget for a UTC day: cap, executed, in-flight (pending) and available, in human units. Omit `day` for today. No key required.", {
@@ -316,6 +316,25 @@ server.tool("vault_create", "For a user who has NO vault yet. Works out where th
             `the vault will be initialised with "${config.network}".`);
     }
     const exists = owner && vaultId ? await accountExists(rpc, vaultId) : false;
+    /**
+     * ASK THE EXISTING VAULT WHO OWNS IT, rather than inferring it from the
+     * derivation that produced the id.
+     *
+     * `derive_prefix` replaces dots with hyphens and is NOT injective:
+     * `a.b.near` and `a-b.near` both derive `a-b-near`, and the factory ships
+     * a test asserting exactly that. So "an account exists at your derived id"
+     * does not mean "it is yours" — and the message here used to say it did,
+     * which would point the loser of a collision at the winner's vault.
+     *
+     * `null` on any failure, which the planner treats as a THIRD outcome.
+     * Collapsing the error into "not yours" would be as wrong as collapsing it
+     * into "yours": a vault that is merely unreadable right now is neither.
+     */
+    const existingOwner = exists && vaultId
+        ? await viewFunction(rpc, vaultId, "get_config", {})
+            .then((c) => c?.owner ?? null)
+            .catch(() => null)
+        : null;
     // AN AGENT NEEDS A VAULT ID, and not for the transaction — the page
     // derives that from the connected wallet. It is needed for the CREDENTIAL,
     // which the adapter files under the account the key signs as. A virtual
@@ -345,6 +364,7 @@ server.tool("vault_create", "For a user who has NO vault yet. Works out where th
             paused: config.paused,
             appUrl: cfg.appUrl,
             exists,
+            existingOwner,
             agentPk: generated?.publicKey ?? null,
         });
         return json({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floatonnear/mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "MCP server for the hierarchical budget vault. The agent key signs request_payment only; owner methods emit unsigned payloads for wallet approval.",
   "license": "MIT",