@temporalabs/treasury 0.1.0

package/dist/preflight.js

@@ -0,0 +1,165 @@
+import { BaseError, ContractFunctionRevertedError, } from "viem";
+import { erc4626Abi, knownRevertSelectors } from "./abi/erc4626.js";
+import { erc4626Chassis } from "./registry-schema.js";
+import { describeError } from "./redact.js";
+import { parseAmount, formatAmount } from "./units.js";
+/**
+ * Names a cause only where the instrument discriminated; otherwise lists candidates.
+ * A revert is an answer. A transport error is not, and must never land here.
+ */
+export function classifyRevert(obs) {
+    const sel = obs.selector?.toLowerCase();
+    if (sel === knownRevertSelectors.AccessManagedUnauthorized) {
+        return {
+            status: "WHITELIST_GATED",
+            note: `deposit() reverted AccessManagedUnauthorized (${sel}) — the vault's AccessManager restricts deposit to a role this address does not hold (on IPOR Fusion: role 800 WHITELIST). redeem() may still be public.`,
+        };
+    }
+    if (sel === knownRevertSelectors.TransferFromReverted) {
+        return {
+            status: "NEEDS_APPROVAL",
+            note: `deposit() reverted TransferFromReverted (${sel}) — the call passed every access gate and died pulling the asset: access is OPEN, approve first.`,
+        };
+    }
+    if (obs.reason && /allowance|ERC20InsufficientAllowance|transfer amount exceeds/i.test(obs.reason)) {
+        return {
+            status: "NEEDS_APPROVAL",
+            note: `deposit() reverted "${obs.reason}" — died at the token pull: access is OPEN, approve first.`,
+        };
+    }
+    return {
+        status: "REVERTED_OTHER",
+        note: `deposit() reverted${sel ? ` with selector ${sel}` : ""}${obs.reason ? ` ("${obs.reason}")` : ""}; ` +
+            `this client does not name the cause. Check, in no particular order: vault paused; per-block or supply cap; ` +
+            `insufficient asset balance at the depositor; a chassis-specific gate this client has not seen. Raw: ${obs.raw ?? "n/a"}.`,
+    };
+}
+/** Pulls the revert payload out of viem's error chain. Returns undefined for anything that is not a definite revert. */
+export function extractRevert(err) {
+    if (!(err instanceof BaseError))
+        return undefined;
+    const r = err.walk((e) => e instanceof ContractFunctionRevertedError);
+    if (!r)
+        return undefined;
+    const raw = r.raw;
+    const signature = r.signature;
+    const selector = signature ?? (raw && raw.length >= 10 ? raw.slice(0, 10) : undefined);
+    const out = {};
+    if (selector)
+        out.selector = selector;
+    if (r.reason)
+        out.reason = r.reason;
+    if (raw)
+        out.raw = raw;
+    return out;
+}
+export async function preflightDeposit(args) {
+    const { vault, depositor, client } = args;
+    const findings = [];
+    const refuse = (why) => ({
+        vault: vault.symbol,
+        depositor,
+        status: "REFUSED_BY_CLIENT",
+        canDeposit: false,
+        findings: [...findings, why],
+    });
+    if (!erc4626Chassis.has(vault.chassis)) {
+        return refuse(`${vault.chassis} exposes no ERC-4626 deposit path; refusing (${vault.depositOpen.detail ?? "see registry"})`);
+    }
+    if (!vault.depositOpen.open) {
+        findings.push(`registry says deposits were CLOSED when last measured (block ${vault.depositOpen.measuredAtBlock}, ${vault.depositOpen.reason}); re-measuring live rather than trusting the row`);
+    }
+    // Cross-artifact identity check: the registry row and the contract must agree about each other.
+    // A presence check cannot detect a swapped address; asking the vault what its asset is can.
+    let block;
+    let onchainAsset;
+    let onchainDecimals;
+    try {
+        [block, onchainAsset, onchainDecimals] = await Promise.all([
+            client.getBlockNumber(),
+            client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "asset" }),
+            client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "decimals" }),
+        ]);
+    }
+    catch (e) {
+        return { vault: vault.symbol, depositor, status: "UNRESOLVED", canDeposit: false, findings: [...findings, `identity reads failed: ${describeError(e)}`] };
+    }
+    if (onchainAsset.toLowerCase() !== vault.asset.address.toLowerCase()) {
+        return refuse(`registry asset ${vault.asset.address} != on-chain asset() ${onchainAsset} — registry row is wrong or the address is a different contract`);
+    }
+    if (onchainDecimals !== vault.shareDecimals) {
+        return refuse(`registry shareDecimals ${vault.shareDecimals} != on-chain decimals() ${onchainDecimals}`);
+    }
+    findings.push(`identity OK at block ${block}: asset()=${onchainAsset}, decimals()=${onchainDecimals}`);
+    const assets = parseAmount(args.assetsHuman ?? "1", vault.asset.decimals, `deposit amount (${vault.asset.symbol})`);
+    // Reads. Each on its own; a failure here is UNRESOLVED, never a verdict.
+    let assetBal, shareBal, allowance, oneShareInAssets, totalAssets, maxDep;
+    try {
+        [assetBal, shareBal, allowance, oneShareInAssets, totalAssets, maxDep] = await Promise.all([
+            client.readContract({ address: vault.asset.address, abi: erc4626Abi, functionName: "balanceOf", args: [depositor] }),
+            client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "balanceOf", args: [depositor] }),
+            client.readContract({ address: vault.asset.address, abi: erc4626Abi, functionName: "allowance", args: [depositor, vault.address] }),
+            client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "convertToAssets", args: [10n ** BigInt(vault.shareDecimals)] }),
+            client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "totalAssets" }),
+            client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "maxDeposit", args: [depositor] }),
+        ]);
+    }
+    catch (e) {
+        return { vault: vault.symbol, depositor, status: "UNRESOLVED", canDeposit: false, findings: [...findings, `state reads failed: ${describeError(e)}`] };
+    }
+    const balances = {
+        asset: `${formatAmount(assetBal, vault.asset.decimals)} ${vault.asset.symbol}`,
+        shares: `${formatAmount(shareBal, vault.shareDecimals)} ${vault.symbol}`,
+        allowance: `${formatAmount(allowance, vault.asset.decimals)} ${vault.asset.symbol}`,
+    };
+    const quotes = {
+        sharePriceInAssets: `${formatAmount(oneShareInAssets, vault.asset.decimals)} ${vault.asset.symbol} per share`,
+        totalAssets: `${formatAmount(totalAssets, vault.asset.decimals)} ${vault.asset.symbol}`,
+    };
+    const advisory = {
+        maxDepositRaw: maxDep.toString(),
+        note: "maxDeposit() is ADVISORY ONLY: measured returning uint256.max on a whitelist-gated Fusion vault and 0 on an open Morpho V2 vault. The simulation below is the verdict.",
+    };
+    if (assetBal < assets)
+        findings.push(`depositor holds ${balances.asset}, less than the ${formatAmount(assets, vault.asset.decimals)} requested — a live deposit would fail on balance even if access is open`);
+    // Preview (does not depend on access) — gives the shares quote where the chassis supports it.
+    try {
+        const previewShares = await client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "previewDeposit", args: [assets] });
+        quotes.previewShares = `${formatAmount(previewShares, vault.shareDecimals)} ${vault.symbol}`;
+    }
+    catch {
+        findings.push("previewDeposit() reverted; no shares quote");
+    }
+    // The verdict: simulate the real call from the real depositor.
+    try {
+        await client.simulateContract({
+            address: vault.address,
+            abi: erc4626Abi,
+            functionName: "deposit",
+            args: [assets, depositor],
+            account: depositor,
+        });
+        findings.push("simulated deposit() SUCCEEDED from this address with the current allowance");
+        return { vault: vault.symbol, depositor, status: "OPEN_READY", canDeposit: true, findings, balances, quotes, advisory, measuredAtBlock: Number(block) };
+    }
+    catch (e) {
+        const obs = extractRevert(e);
+        if (!obs) {
+            return { vault: vault.symbol, depositor, status: "UNRESOLVED", canDeposit: false, findings: [...findings, `simulation did not return a definite revert: ${describeError(e)}`], balances, quotes, advisory, measuredAtBlock: Number(block) };
+        }
+        const c = classifyRevert(obs);
+        findings.push(c.note);
+        return {
+            vault: vault.symbol,
+            depositor,
+            status: c.status,
+            canDeposit: c.status === "NEEDS_APPROVAL",
+            findings,
+            balances,
+            quotes,
+            advisory,
+            measuredAtBlock: Number(block),
+        };
+    }
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,6BAA6B,GAG9B,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuBvD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAsB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxC,IAAI,GAAG,KAAK,oBAAoB,CAAC,yBAAyB,EAAE,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE,iDAAiD,GAAG,0JAA0J;SACrN,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,oBAAoB,CAAC,oBAAoB,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,4CAA4C,GAAG,kGAAkG;SACxJ,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,+DAA+D,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnG,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,uBAAuB,GAAG,CAAC,MAAM,4DAA4D;SACpG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,IAAI,EACF,qBAAqB,GAAG,CAAC,CAAC,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI;YACpG,6GAA6G;YAC7G,uGAAuG,GAAG,CAAC,GAAG,IAAI,KAAK,GAAG;KAC7H,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,CAAC,GAAG,YAAY,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,6BAA6B,CAAyC,CAAC;IAC9G,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,GAAG,GAAI,CAAmB,CAAC,GAAG,CAAC;IACrC,MAAM,SAAS,GAAI,CAAyB,CAAC,SAAS,CAAC;IACvD,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,GAAG;QAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAmB;IACxD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAmB,EAAE,CAAC,CAAC;QAChD,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,SAAS;QACT,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,gDAAgD,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,cAAc,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,gEAAgE,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,KAAK,CAAC,WAAW,CAAC,MAAM,mDAAmD,CAClL,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,4FAA4F;IAC5F,IAAI,KAAa,CAAC;IAClB,IAAI,YAAqB,CAAC;IAC1B,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,MAAM,CAAC,cAAc,EAAE;YACvB,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACvF,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,0BAA0B,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5J,CAAC;IACD,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,OAAO,wBAAwB,YAAY,iEAAiE,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,eAAe,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,0BAA0B,KAAK,CAAC,aAAa,2BAA2B,eAAe,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,wBAAwB,KAAK,aAAa,YAAY,gBAAgB,eAAe,EAAE,CAAC,CAAC;IAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpH,yEAAyE;IACzE,IAAI,QAAgB,EAAE,QAAgB,EAAE,SAAiB,EAAE,gBAAwB,EAAE,WAAmB,EAAE,MAAc,CAAC;IACzH,IAAI,CAAC;QACH,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzF,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YACpH,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9G,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnI,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC7I,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;YAC7F,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;SAChH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,uBAAuB,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACzJ,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,KAAK,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;QAC9E,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE;QACxE,SAAS,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;KACpF,CAAC;IACF,MAAM,MAAM,GAA8B;QACxC,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,YAAY;QAC7G,WAAW,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;KACxF,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE;QAChC,IAAI,EAAE,wKAAwK;KAC/K,CAAC;IACF,IAAI,QAAQ,GAAG,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,KAAK,mBAAmB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,0EAA0E,CAAC,CAAC;IAE/M,8FAA8F;IAC9F,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7I,MAAM,CAAC,aAAa,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC9D,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,gBAAgB,CAAC;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,UAAU;YACf,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;YACzB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1J,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,gDAAgD,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9O,CAAC;QACD,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,MAAM,KAAK,gBAAgB;YACzC,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC;SAC/B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/quote.d.ts

@@ -0,0 +1,55 @@
+import type { Address } from "viem";
+import { type VaultEntry } from "./registry-schema.js";
+import type { ReadClient } from "./client.js";
+import { type PreflightResult } from "./preflight.js";
+/**
+ * Pre-trade quotes. A quote is three things kept apart:
+ * what the chain says the trade would do now (preview/simulate), what a data provider says the
+ * and what this client cannot know (gas at inclusion, slippage the
+ * vault does not bound). Each is labelled as itself.
+ */
+export interface DepositQuote {
+    vault: string;
+    depositor: Address;
+    amountUsdc: string;
+    expectedShares: string;
+    sharePriceInAssets: string;
+    preflight: PreflightResult;
+    canProceed: boolean;
+    rejectReason?: string;
+    bounds: string;
+    validUntil: string;
+}
+export declare function quoteDeposit(args: {
+    vault: VaultEntry;
+    depositor: Address;
+    assetsHuman: string;
+    client: ReadClient;
+}): Promise<DepositQuote>;
+export interface WithdrawQuote {
+    vault: string;
+    owner: Address;
+    amountUsdc: string;
+    sharesToBurn: string;
+    sharesHeld: string;
+    simulated: "OK" | "REVERTED" | "UNRESOLVED";
+    note: string;
+    /**
+     * The vault's OWN balance of the asset — what it can pay out in this block without unwinding a
+     * position. On Fusion with no instant-withdrawal fuses this is the hard ceiling on a withdrawal,
+     * and `maxWithdraw()` does not know it (measured 2026-09-13: maxWithdraw 10.01, liquid 0.80).
+     */
+    instantLiquidity: string;
+    advisory: {
+        maxWithdrawRaw: string;
+        note: string;
+    };
+    queue: string;
+    canProceed: boolean;
+}
+export declare function quoteWithdraw(args: {
+    vault: VaultEntry;
+    owner: Address;
+    assetsHuman: string;
+    client: ReadClient;
+}): Promise<WithdrawQuote>;

package/dist/quote.js

@@ -0,0 +1,83 @@
+import { erc4626Abi } from "./abi/erc4626.js";
+import { describeError } from "./redact.js";
+import { parseAmount, formatAmount } from "./units.js";
+import { preflightDeposit, extractRevert } from "./preflight.js";
+export async function quoteDeposit(args) {
+    const { vault, depositor, client } = args;
+    const assets = parseAmount(args.assetsHuman, vault.asset.decimals, `deposit amount (${vault.asset.symbol})`);
+    const pre = await preflightDeposit({ vault, depositor, assetsHuman: args.assetsHuman, client });
+    const [previewShares, oneShareInAssets] = await Promise.all([
+        client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "previewDeposit", args: [assets] }).catch(() => undefined),
+        client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "convertToAssets", args: [10n ** BigInt(vault.shareDecimals)] }),
+    ]);
+    const q = {
+        vault: vault.symbol,
+        depositor,
+        amountUsdc: `${formatAmount(assets, vault.asset.decimals)} ${vault.asset.symbol}`,
+        expectedShares: previewShares === undefined ? "unavailable (previewDeposit reverted)" : `${formatAmount(previewShares, vault.shareDecimals)} ${vault.symbol}`,
+        sharePriceInAssets: `${formatAmount(oneShareInAssets, vault.asset.decimals)} ${vault.asset.symbol} per share`,
+        preflight: pre,
+        canProceed: pre.canDeposit,
+        bounds: "ERC-4626 deposit has no on-chain min-shares parameter; the share count at inclusion may differ slightly from expectedShares as the share price moves. Gas: estimate × 1.5 (see gasAdvice on the built calls).",
+        validUntil: "this block — re-quote before signing if more than a few blocks pass",
+    };
+    if (!pre.canDeposit)
+        q.rejectReason = pre.findings.at(-1) ?? pre.status;
+    return q;
+}
+export async function quoteWithdraw(args) {
+    const { vault, owner, client } = args;
+    const assets = parseAmount(args.assetsHuman, vault.asset.decimals, `withdraw amount (${vault.asset.symbol})`);
+    const [held, toBurn, maxW, liquid] = await Promise.all([
+        client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "balanceOf", args: [owner] }),
+        client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "previewWithdraw", args: [assets] }).catch(() => undefined),
+        client.readContract({ address: vault.address, abi: erc4626Abi, functionName: "maxWithdraw", args: [owner] }).catch(() => undefined),
+        client.readContract({ address: vault.asset.address, abi: erc4626Abi, functionName: "balanceOf", args: [vault.address] }),
+    ]);
+    let simulated = "UNRESOLVED";
+    let note = "";
+    try {
+        await client.simulateContract({ address: vault.address, abi: erc4626Abi, functionName: "withdraw", args: [assets, owner, owner], account: owner });
+        simulated = "OK";
+        note = "simulated withdraw() from the owner succeeds at this block";
+    }
+    catch (e) {
+        const obs = extractRevert(e);
+        if (obs) {
+            simulated = "REVERTED";
+            // Withdraw reverts have their own causes; classifyRevert is the DEPOSIT classifier and its
+            // "approve first" wording is wrong here (it was reused, and told an agent to approve USDC
+            // when the vault simply had 0.80 USDC liquid — measured 2026-09-13 on a Fusion vault).
+            const reason = obs.reason ?? "";
+            if (toBurn !== undefined && held < toBurn) {
+                note = `withdraw() reverted: the owner holds ${formatAmount(held, vault.shareDecimals)} ${vault.symbol} against ${formatAmount(toBurn, vault.shareDecimals)} needed — insufficient shares. (${reason || obs.selector})`;
+            }
+            else if (/transfer amount exceeds balance|ERC20InsufficientBalance/i.test(reason) || liquid < assets) {
+                note = `withdraw() reverted: the vault holds ${formatAmount(liquid, vault.asset.decimals)} ${vault.asset.symbol} liquid against ${formatAmount(assets, vault.asset.decimals)} requested — this chassis pays withdrawals from its own balance in the same block; the rest is deployed and needs the fund to unwind first. Withdraw at most the liquid amount now, or wait. maxWithdraw() (${maxW === undefined ? "reverted" : formatAmount(maxW, vault.asset.decimals)}) does not know this.`;
+            }
+            else {
+                note = `withdraw() reverted "${reason || obs.selector}" — not a balance or liquidity shortfall; treat as a vault-side refusal.`;
+            }
+        }
+        else {
+            note = `simulation did not return a definite revert: ${describeError(e, 160)}`;
+        }
+    }
+    return {
+        vault: vault.symbol,
+        owner,
+        amountUsdc: `${formatAmount(assets, vault.asset.decimals)} ${vault.asset.symbol}`,
+        sharesToBurn: toBurn === undefined ? "unavailable (previewWithdraw reverted)" : `${formatAmount(toBurn, vault.shareDecimals)} ${vault.symbol}`,
+        sharesHeld: `${formatAmount(held, vault.shareDecimals)} ${vault.symbol}`,
+        simulated,
+        note,
+        instantLiquidity: `${formatAmount(liquid, vault.asset.decimals)} ${vault.asset.symbol}`,
+        advisory: {
+            maxWithdrawRaw: maxW === undefined ? "reverted" : maxW.toString(),
+            note: "maxWithdraw() is ADVISORY: Morpho Vault V2 returns 0 for every owner by design; The simulation above is the verdict.",
+        },
+        queue: "none — this chassis settles withdrawals in the same transaction; no claim step",
+        canProceed: simulated === "OK",
+    };
+}
+//# sourceMappingURL=quote.js.map

package/dist/quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.js","sourceRoot":"","sources":["../src/quote.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAwB,MAAM,gBAAgB,CAAC;AAqBvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwF;IACzH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACvI,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;KAC9I,CAAC,CAAC;IACH,MAAM,CAAC,GAAiB;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,SAAS;QACT,UAAU,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;QACjF,cAAc,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE;QAC7J,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,YAAY;QAC7G,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EACJ,+MAA+M;QACjN,UAAU,EAAE,qEAAqE;KAClF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;IACxE,OAAO,CAAC,CAAC;AACX,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoF;IACtH,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9G,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1G,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACxI,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACnI,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,CAAC,CAAC;IACH,IAAI,SAAS,GAA+B,YAAY,CAAC;IACzD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACnJ,SAAS,GAAG,IAAI,CAAC;QACjB,IAAI,GAAG,4DAA4D,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,GAAG,EAAE,CAAC;YACR,SAAS,GAAG,UAAU,CAAC;YACvB,2FAA2F;YAC3F,0FAA0F;YAC1F,uFAAuF;YACvF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBAC1C,IAAI,GAAG,wCAAwC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,YAAY,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,mCAAmC,MAAM,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;YAC1N,CAAC;iBAAM,IAAI,2DAA2D,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;gBACvG,IAAI,GAAG,wCAAwC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,+MAA+M,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAC/d,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,wBAAwB,MAAM,IAAI,GAAG,CAAC,QAAQ,0EAA0E,CAAC;YAClI,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,gDAAgD,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,KAAK;QACL,UAAU,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;QACjF,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE;QAC9I,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE;QACxE,SAAS;QACT,IAAI;QACJ,gBAAgB,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;QACvF,QAAQ,EAAE;YACR,cAAc,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE;YACjE,IAAI,EAAE,sHAAsH;SAC7H;QACD,KAAK,EAAE,gFAAgF;QACvF,UAAU,EAAE,SAAS,KAAK,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Describe an error for a tool result WITHOUT leaking the RPC endpoint.
+ *
+ * viem's error messages embed the transport URL (`URL: https://…/v2/<key>`) and the request body. A
+ * keyed provider URL (Alchemy, Infura) IS a secret, and every tool handler's failure path would
+ * otherwise paste it into the model's context — measured in the first review of this package:
+ * `preflightDeposit` with a fake Alchemy key → `findings[]` contained the key verbatim.
+ *
+ * Preference order: viem's own `shortMessage` (never carries the URL), followed by viem's `details`
+ * when present — that is where a JSON-RPC error body's own sentence lives (a provider at its monthly
+ * cap says "Monthly capacity limit exceeded" there, and `shortMessage` alone is the useless
+ * "RPC Request failed."; measured in review) → the first line of the message with any `URL:` /
+ * `Request body:` / `http(s)://…` content masked → the error's name.
+ */
+export declare function describeError(e: unknown, max?: number): string;
+/** Register the source of known-secret values. Called by the MCP server at build time. */
+export declare function registerSecretSource(f: () => readonly string[]): void;
+/**
+ * Mask literal secret VALUES wherever they appear, in any shape.
+ *
+ * 🔴 This is the PRIMARY defence and the pattern rules below are the backstop — the inverse of the
+ * original design, which had only a backstop. Measured by review against a real viem client
+ * and a real HTTP server: a provider that rejects a key and ECHOES IT BACK in the response body
+ * puts it in viem's `Details:` line as prose inside JSON — no scheme, no errno, no header keyword,
+ * so every shape rule misses it and the key reaches tool output. Patterns chase shapes forever;
+ * that was the third new shape in one day. We KNOW the value (`rpcUrlFromEnv` resolved it), so we
+ * match on the literal we are protecting instead of on where we guessed it would sit.
+ *
+ * Short values are ignored: a 2-character path segment like `v2` is not a secret and masking it
+ * would destroy every message it appears in.
+ *
+ * ⚠️ THE BOUNDARY IS CHOSEN, NOT MISSED. Value matching masks the literal and its percent-decoded
+ * form. It does NOT mask an arbitrary re-encoding — an upper-cased key, a base64 of the key, or one
+ * split across whitespace. No implementation can, and attempting it would over-redact wildly; those
+ * are the residual the shape rules below exist for (review).
+ *
+ * ⚠️ VALUE MASKING IS A PROPERTY OF THE SERVER, NOT OF THIS LIBRARY. `registerSecretSource` is
+ * called by the MCP server in `buildServer()`. A consumer importing `describeError`/`redactEndpoints`
+ * directly gets `secretSource = () => []` and therefore the shape rules only — which degrades safely
+ * and is the documented backstop, but is not inherited.
+ */
+export declare function redactSecrets(s: string, secrets?: readonly string[]): string;
+/** Mask every http(s) URL and the viem `URL:` / `Request body:` lines in a string. Exported for the tool boundary. */
+export declare function redactEndpoints(s: string): string;

package/dist/redact.js

@@ -0,0 +1,92 @@
+/**
+ * Describe an error for a tool result WITHOUT leaking the RPC endpoint.
+ *
+ * viem's error messages embed the transport URL (`URL: https://…/v2/<key>`) and the request body. A
+ * keyed provider URL (Alchemy, Infura) IS a secret, and every tool handler's failure path would
+ * otherwise paste it into the model's context — measured in the first review of this package:
+ * `preflightDeposit` with a fake Alchemy key → `findings[]` contained the key verbatim.
+ *
+ * Preference order: viem's own `shortMessage` (never carries the URL), followed by viem's `details`
+ * when present — that is where a JSON-RPC error body's own sentence lives (a provider at its monthly
+ * cap says "Monthly capacity limit exceeded" there, and `shortMessage` alone is the useless
+ * "RPC Request failed."; measured in review) → the first line of the message with any `URL:` /
+ * `Request body:` / `http(s)://…` content masked → the error's name.
+ */
+export function describeError(e, max = 200) {
+    const anyE = e;
+    let s;
+    if (anyE && typeof anyE.shortMessage === "string" && anyE.shortMessage.length > 0) {
+        s = anyE.shortMessage;
+        if (typeof anyE.details === "string" && anyE.details.length > 0 && !s.includes(anyE.details))
+            s = `${s} ${anyE.details}`;
+    }
+    else if (anyE && typeof anyE.message === "string" && anyE.message.length > 0)
+        s = anyE.message;
+    else
+        s = String(e);
+    s = redactEndpoints(s);
+    const firstLine = s.split("\n").find((l) => l.trim().length > 0) ?? s;
+    return firstLine.length > max ? `${firstLine.slice(0, max)}…` : firstLine;
+}
+/**
+ * The VALUES we are protecting, supplied by whoever resolved them. Registered rather than passed,
+ * so every existing `redactEndpoints`/`describeError` call site is covered without threading a
+ * parameter through the library. A FUNCTION, not an array: the environment can change inside a
+ * process (tests do it), and a snapshot taken at import time would go stale.
+ */
+let secretSource = () => [];
+/** Register the source of known-secret values. Called by the MCP server at build time. */
+export function registerSecretSource(f) {
+    secretSource = f;
+}
+/**
+ * Mask literal secret VALUES wherever they appear, in any shape.
+ *
+ * 🔴 This is the PRIMARY defence and the pattern rules below are the backstop — the inverse of the
+ * original design, which had only a backstop. Measured by review against a real viem client
+ * and a real HTTP server: a provider that rejects a key and ECHOES IT BACK in the response body
+ * puts it in viem's `Details:` line as prose inside JSON — no scheme, no errno, no header keyword,
+ * so every shape rule misses it and the key reaches tool output. Patterns chase shapes forever;
+ * that was the third new shape in one day. We KNOW the value (`rpcUrlFromEnv` resolved it), so we
+ * match on the literal we are protecting instead of on where we guessed it would sit.
+ *
+ * Short values are ignored: a 2-character path segment like `v2` is not a secret and masking it
+ * would destroy every message it appears in.
+ *
+ * ⚠️ THE BOUNDARY IS CHOSEN, NOT MISSED. Value matching masks the literal and its percent-decoded
+ * form. It does NOT mask an arbitrary re-encoding — an upper-cased key, a base64 of the key, or one
+ * split across whitespace. No implementation can, and attempting it would over-redact wildly; those
+ * are the residual the shape rules below exist for (review).
+ *
+ * ⚠️ VALUE MASKING IS A PROPERTY OF THE SERVER, NOT OF THIS LIBRARY. `registerSecretSource` is
+ * called by the MCP server in `buildServer()`. A consumer importing `describeError`/`redactEndpoints`
+ * directly gets `secretSource = () => []` and therefore the shape rules only — which degrades safely
+ * and is the documented backstop, but is not inherited.
+ */
+export function redactSecrets(s, secrets = secretSource()) {
+    let out = s;
+    for (const sec of secrets) {
+        if (!sec || sec.length < 8)
+            continue;
+        out = out.split(sec).join("<redacted>"); // split/join: no regex escaping hazard
+    }
+    return out;
+}
+/** Mask every http(s) URL and the viem `URL:` / `Request body:` lines in a string. Exported for the tool boundary. */
+export function redactEndpoints(s) {
+    return redactSecrets(s)
+        // ANY scheme://… — not just http(s). A ws:// or wss:// endpoint carries the same key.
+        .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s"'`)\]]+/gi, "<rpc endpoint>")
+        // DNS and socket failures name a BARE host, sometimes with the keyed path still attached
+        // (`getaddrinfo ENOTFOUND base-mainnet.g.alchemy.com/v2/KEY`) — no scheme for the rule above.
+        // ⚠️ The token after an errno must be HOST-SHAPED. `\S+` ate whatever followed: `ETIMEDOUT
+        // after 30000ms` became `ETIMEDOUT <rpc endpoint> 30000ms`, fabricating a redaction in a
+        // message containing no endpoint at all (review). Loopback and private ranges are
+        // never secrets and are exactly what a developer needs to see (anvil not running).
+        .replace(/\b(ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ECONNRESET|ETIMEDOUT)\s+((?:[a-z0-9-]+\.)+[a-z]{2,}(?::\d+)?(?:\/\S*)?)/gi, (m, errno, host) => /^(localhost|127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/i.test(host) ? m : `${errno} <rpc endpoint>`)
+        // a key can travel as a header rather than in the URL
+        .replace(/\b(x-api-key|api[-_]?key|authorization)\b\s*[:=]\s*.*/gi, "$1: <redacted>")
+        .replace(/^\s*(URL|Request body|Raw Call Arguments):.*$/gim, "")
+        .replace(/\n{2,}/g, "\n");
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU,EAAE,GAAG,GAAG,GAAG;IACjD,MAAM,IAAI,GAAG,CAA4F,CAAC;IAC1G,IAAI,CAAS,CAAC;IACd,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACtB,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IAC3H,CAAC;SAAM,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;;QAC5F,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,IAAI,YAAY,GAA4B,GAAG,EAAE,CAAC,EAAE,CAAC;AAErD,0FAA0F;AAC1F,MAAM,UAAU,oBAAoB,CAAC,CAA0B;IAC7D,YAAY,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,UAA6B,YAAY,EAAE;IAClF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACrC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,OAAO,aAAa,CAAC,CAAC,CAAC;QACrB,sFAAsF;SACrF,OAAO,CAAC,wCAAwC,EAAE,gBAAgB,CAAC;QACpE,yFAAyF;QACzF,8FAA8F;QAC9F,2FAA2F;QAC3F,yFAAyF;QACzF,kFAAkF;QAClF,mFAAmF;SAClF,OAAO,CACN,+GAA+G,EAC/G,CAAC,CAAC,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACjC,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,iBAAiB,CAC7G;QACD,sDAAsD;SACrD,OAAO,CAAC,yDAAyD,EAAE,gBAAgB,CAAC;SACpF,OAAO,CAAC,kDAAkD,EAAE,EAAE,CAAC;SAC/D,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/registry-schema.d.ts

@@ -0,0 +1,127 @@
+import { z } from "zod";
+export declare const chassisSchema: z.ZodEnum<{
+    "morpho-v2": "morpho-v2";
+    fusion: "fusion";
+    enzyme: "enzyme";
+}>;
+export type Chassis = z.infer<typeof chassisSchema>;
+/**
+ * Which chassis expose a standard ERC-4626 `deposit`/`redeem` to a depositor. Enzyme does not
+ * (`buyShares` via the comptroller), which is what every refusal path in this client is measured
+ * against: build, pre-flight, the MCP boundary and the default-vault rule all discriminate on it.
+ */
+export declare const erc4626Chassis: ReadonlySet<Chassis>;
+/**
+ * Whose contract the depositor's USDC actually enters.
+ * - `morpho`: a public third-party Morpho vault, reached directly. No row uses it today (Tempora vaults only).
+ * - `tempora`: a Tempora fund vault (the product; each fund joins as it goes live).
+ */
+export declare const backendSchema: z.ZodEnum<{
+    morpho: "morpho";
+    tempora: "tempora";
+}>;
+export type Backend = z.infer<typeof backendSchema>;
+/**
+ * Whether a third party can deposit is a MEASUREMENT, not a config flag. `maxDeposit()` lies on
+ * two of the three live chassis (Fusion returns uint256.max behind a whitelist; Morpho V2 returns 0
+ * on an open vault), so the only honest value is the result of a simulated `deposit` from a
+ * stranger, stamped with when and how it was taken.
+ */
+export declare const depositOpenSchema: z.ZodObject<{
+    open: z.ZodBoolean;
+    method: z.ZodLiteral<"simulated-deposit-from-stranger">;
+    measuredAtBlock: z.ZodNumber;
+    measuredAtIso: z.ZodString;
+    reason: z.ZodOptional<z.ZodEnum<{
+        WHITELIST_GATED: "WHITELIST_GATED";
+        NOT_ALLOWLISTED: "NOT_ALLOWLISTED";
+        NOT_ERC4626: "NOT_ERC4626";
+        PAUSED: "PAUSED";
+        REVERTED_OTHER: "REVERTED_OTHER";
+    }>>;
+    detail: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const vaultEntrySchema: z.ZodObject<{
+    symbol: z.ZodString;
+    name: z.ZodString;
+    warning: z.ZodString;
+    chainId: z.ZodLiteral<8453>;
+    address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+    chassis: z.ZodEnum<{
+        "morpho-v2": "morpho-v2";
+        fusion: "fusion";
+        enzyme: "enzyme";
+    }>;
+    backend: z.ZodEnum<{
+        morpho: "morpho";
+        tempora: "tempora";
+    }>;
+    isDefault: z.ZodDefault<z.ZodBoolean>;
+    asset: z.ZodObject<{
+        address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+        symbol: z.ZodString;
+        decimals: z.ZodNumber;
+    }, z.core.$strip>;
+    shareDecimals: z.ZodNumber;
+    depositOpen: z.ZodObject<{
+        open: z.ZodBoolean;
+        method: z.ZodLiteral<"simulated-deposit-from-stranger">;
+        measuredAtBlock: z.ZodNumber;
+        measuredAtIso: z.ZodString;
+        reason: z.ZodOptional<z.ZodEnum<{
+            WHITELIST_GATED: "WHITELIST_GATED";
+            NOT_ALLOWLISTED: "NOT_ALLOWLISTED";
+            NOT_ERC4626: "NOT_ERC4626";
+            PAUSED: "PAUSED";
+            REVERTED_OTHER: "REVERTED_OTHER";
+        }>>;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    deployedAtBlock: z.ZodOptional<z.ZodNumber>;
+    notes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type VaultEntry = z.infer<typeof vaultEntrySchema>;
+export declare const registrySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    reconciledAtIso: z.ZodString;
+    vaults: z.ZodArray<z.ZodObject<{
+        symbol: z.ZodString;
+        name: z.ZodString;
+        warning: z.ZodString;
+        chainId: z.ZodLiteral<8453>;
+        address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+        chassis: z.ZodEnum<{
+            "morpho-v2": "morpho-v2";
+            fusion: "fusion";
+            enzyme: "enzyme";
+        }>;
+        backend: z.ZodEnum<{
+            morpho: "morpho";
+            tempora: "tempora";
+        }>;
+        isDefault: z.ZodDefault<z.ZodBoolean>;
+        asset: z.ZodObject<{
+            address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+            symbol: z.ZodString;
+            decimals: z.ZodNumber;
+        }, z.core.$strip>;
+        shareDecimals: z.ZodNumber;
+        depositOpen: z.ZodObject<{
+            open: z.ZodBoolean;
+            method: z.ZodLiteral<"simulated-deposit-from-stranger">;
+            measuredAtBlock: z.ZodNumber;
+            measuredAtIso: z.ZodString;
+            reason: z.ZodOptional<z.ZodEnum<{
+                WHITELIST_GATED: "WHITELIST_GATED";
+                NOT_ALLOWLISTED: "NOT_ALLOWLISTED";
+                NOT_ERC4626: "NOT_ERC4626";
+                PAUSED: "PAUSED";
+                REVERTED_OTHER: "REVERTED_OTHER";
+            }>>;
+            detail: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        deployedAtBlock: z.ZodOptional<z.ZodNumber>;
+        notes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Registry = z.infer<typeof registrySchema>;