otto-intel-mcp 0.1.0

package/dist/execution-errors.js

@@ -0,0 +1,128 @@
+export const EXECUTION_REFUSAL_CODES = [
+    'ATTRIBUTION_MISSING',
+    /**
+     * The total take on the route exceeds the configured aggregate cap, while Otto's own
+     * attribution is present, exactly-valued, and correctly addressed.
+     *
+     * Kept distinct from `ATTRIBUTION_MISSING` on purpose: the configured cap sits exactly on the
+     * live aggregate (LI.FI platform 15 bps + Otto 10 bps = the 25 bps cap), so any upstream
+     * pricing move — a platform rate change, a relay fee appearing on a route, a new finality
+     * tier — takes the route over the cap. That is an upstream repricing to investigate, not a
+     * fee-integrity attack, and reporting both under one code would make a total outage
+     * indistinguishable from someone tampering with Otto's fee.
+     */
+    'LIFI_FEE_CAP_EXCEEDED',
+    'ACCOUNT_BINDING_MISMATCH',
+    'DIGEST_MISMATCH',
+    'ARTIFACT_INVALID',
+    'STALE_ARTIFACT',
+    'EXECUTION_RATE_LIMITED',
+    'EXECUTION_CONCURRENCY_FULL',
+    'UNSUPPORTED_ACCOUNT_PROFILE',
+    'LIFI_QUOTE_FAILED',
+    'LIFI_QUOTE_INVALID',
+    'UNSUPPORTED_LIFI_ROUTE',
+    /** A public Polymarket CLOB metadata read failed outright (transport, HTTP, or non-JSON). */
+    'POLYMARKET_METADATA_FAILED',
+    /** The read succeeded but the body is not a shape the constructor may act on. */
+    'POLYMARKET_METADATA_INVALID',
+    /** The market, tick size, price, or size is outside what this constructor supports by name. */
+    'UNSUPPORTED_POLYMARKET_MARKET',
+    /** The constructed order failed a decode-back assertion on the exact bytes to be signed. */
+    'POLYMARKET_ORDER_INVALID',
+    /**
+     * The live builder registry no longer carries the RULED rates. Distinct from
+     * `ATTRIBUTION_MISSING` on purpose: Otto's attribution is present and enabled, but the rate value
+     * in force is not the one the config version documents, and the value itself is a Founder ruling
+     * (spec §13 — the taker-rate flip waits on the `/builder/trades` volume pull). The constructor
+     * refuses rather than guessing which rate the caller is about to pay.
+     */
+    'POLYMARKET_BUILDER_FEE_UNRULED',
+    /** A public Hyperliquid info read failed outright (transport, HTTP, or non-JSON). */
+    'HYPERLIQUID_META_FAILED',
+    /** The read succeeded but the perp universe is not a shape the constructor may act on. */
+    'HYPERLIQUID_META_INVALID',
+    /**
+     * The asset, price, or size is outside what the venue accepts, by name: an unknown or delisted
+     * perp, a price off the venue's own significant-figure/decimal grid, or a size finer than the
+     * asset's `szDecimals`. Refused rather than rounded — a rounded price is a different order than
+     * the one the caller asked for, and this constructor never signs the caller into one.
+     */
+    'UNSUPPORTED_HYPERLIQUID_MARKET',
+    /**
+     * The constructed L1 action failed a decode-back assertion against the SDK's own normalized
+     * action, its canonical msgpack key order, or the declared EIP-712 signing fields.
+     *
+     * NOTE for the Hyperliquid rail: `ATTRIBUTION_MISSING` is deliberately NOT raised for an absent
+     * builder field. The builder `{b, f}` is spec'd and VALUELESS today (spec §7.2/§12, Founder-ruled
+     * 2026-08-17): its value waits on the Step-0 `approveBuilderFee` reversal. An absent builder is
+     * therefore the ruled state, not a defect, and refusing a well-formed order over it would violate
+     * P0 liveness (§7.0). The pending state is disclosed in the envelope instead.
+     */
+    'HYPERLIQUID_ORDER_INVALID',
+    /* ── Delegated send (`otto_submit_under_delegation`, Model B browser plane) ─────────────────── */
+    /** The server holds no CDP developer credentials; the tool does not register without them. */
+    'DELEGATION_UNAVAILABLE',
+    /** The per-request caller header is missing or not accepted — refused before anything is parsed or read. */
+    'DELEGATION_UNAUTHORIZED',
+    /** The input does not satisfy the delegated-send schema (floor stated, Base, EOA). */
+    'DELEGATION_INPUT_INVALID',
+    /** One delegated plan at a time per end user; another is in flight. */
+    'DELEGATION_BUSY',
+    /** The SAME artifact is being submitted right now (a retry raced its first submission). */
+    'DELEGATION_ARTIFACT_IN_FLIGHT',
+    /**
+     * The artifact was not prepared by THIS server process (or its freshness window has passed): the submission
+     * record that makes a retry safe cannot exist here — prepare again. Fail-closed across a rolling replacement.
+     */
+    'ARTIFACT_NOT_PREPARED_HERE',
+    /**
+     * The prepare was refused: this process already holds its maximum of LIVE prepared artifacts (the delegated
+     * tool's prepared-here registry). Nothing already issued is dropped to make room — retry after some expire.
+     */
+    'PREPARED_ARTIFACT_CAPACITY',
+    /** The prepare minted an id this process already holds for DIFFERENT content (an entropy collision): refused, never issued unregistered. */
+    'ARTIFACT_ID_COLLISION',
+    /** The artifact was already submitted on this server with a DIFFERENT request (user, account or intent); nothing is re-sent — prepare again. */
+    'DELEGATION_REPLAY_MISMATCH',
+    /** The Model-B project policy is not in force — absent, renamed, or its rules no longer digest to v1. */
+    'DELEGATION_FENCE_ABSENT',
+    /** A DIFFERENT project-scope policy is installed (Coinbase allows one); never overwritten or deleted — refused by name. */
+    'DELEGATION_FENCE_FOREIGN',
+    /** More than one project-scope policy read back (Coinbase allows one): an anomalous snapshot — nothing judged, nothing written. */
+    'DELEGATION_FENCE_AMBIGUOUS',
+    /** The installed fence is a NEWER version of our lineage than this server knows; never downgraded. */
+    'DELEGATION_FENCE_NEWER',
+    /** The CDP access token does not resolve to an end user; no upstream detail is relayed. */
+    'DELEGATION_TOKEN_INVALID',
+    /** The revoke was issued but the grant still reads back; the user is fail-closed on this server regardless. */
+    'DELEGATION_REVOKE_NOT_CONFIRMED',
+    /** No active delegation for the end user, or it expires before the envelope does, or revocation was requested here. */
+    'DELEGATION_NOT_ACTIVE',
+    /** CDP reports no end user with this id. */
+    'DELEGATION_USER_UNKNOWN',
+    /** A verified plan the fence would refuse anyway: input token not allow-listed, spender not the reviewed diamond, gross over the per-swap cap. */
+    'DELEGATION_OUTSIDE_FENCE',
+    /** The user-side verifier refused the envelope with an adapter code the constructor does not share; the message carries `[CODE]`. */
+    'DELEGATED_PLAN_REFUSED',
+    /** The plan halted mid-way; the message reports the failed step and whether the allowance clear read back zero. */
+    'DELEGATED_PLAN_HALTED',
+    /** A CDP or chain read/write failed outright; no upstream body is relayed. */
+    'DELEGATION_UPSTREAM_FAILED',
+];
+/** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
+export class ExecutionRefusal extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ExecutionRefusal';
+    }
+}
+export function refuse(code, message) {
+    throw new ExecutionRefusal(code, message);
+}
+export function isExecutionRefusal(error) {
+    return error instanceof ExecutionRefusal;
+}
+//# sourceMappingURL=execution-errors.js.map

package/dist/execution-index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * execution-index.ts — the CONSUMER-SIDE entry (`otto-intel-mcp/execution`): what a signing adapter
+ * needs to verify and bind a prepare-only artifact — schemas, digest/commitment/freshness/binding
+ * assertions, the refusal class, the ruled attribution constants, and the intent normalizer — and
+ * NOTHING that constructs: no tool catalog, no prepare functions, no quote clients, no venue SDKs.
+ * (The root index pulls the hosted app and is not importable from a published install.)
+ */
+export { EXECUTION_ARTIFACT_SCHEMA, EXECUTION_ENVELOPE_SCHEMA, PREPARE_SWAP_INPUT_SCHEMA, } from './execution-tool-definitions.js';
+export type { PrepareSwapInput } from './execution-tool-definitions.js';
+export { swapIntentDigestInput } from './execution-intent.js';
+export { artifactCommitmentDigest, assertArtifactAccountBinding, assertArtifactCommitment, assertArtifactEnvelope, assertArtifactFresh, assertArtifactPayloadDigest, executionDigest, MAX_ARTIFACT_TTL_MS, } from './execution-types.js';
+export type { AccountProfile, ExecutionArtifact, ExecutionEnvelope, ExecutionPayload, } from './execution-types.js';
+export { ExecutionRefusal, EXECUTION_REFUSAL_CODES } from './execution-errors.js';
+export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, type DelegationPolicyRecord, type ModelBFenceReadBack, } from './execution-delegation-policy.js';
+export { DELEGATED_EXECUTION_TOOL_NAME, DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, DELEGATED_SEND_RESULT_SCHEMA, type DelegatedSendResult, type SubmitUnderDelegationInput, } from './execution-delegated-definition.js';
+export { DEFAULT_LIFI_AGGREGATE_FEE_CAP_RATE, DEFAULT_LIFI_FEE_BPS, DEFAULT_LIFI_FEE_CONFIG_VERSION, DEFAULT_LIFI_PLATFORM_FEE_RECIPIENT, DEFAULT_OTTO_LIFI_FEE_RECIPIENT, LIFI_DIAMOND_ADDRESS, LIFI_FEE_FORWARDERS_BY_CHAIN, LIFI_FEE_FORWARDER_V1, LIFI_FEE_FORWARDER_V1_MAINNET, LIFI_FEE_FORWARDER_V2, LIFI_INTEGRATOR, isReviewedLiFiFeeForwarder, reviewedLiFiFeeForwarders, unreviewedFeeForwarderMessage, } from './execution-config.js';
+export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, type DelegationFenceResult, type DelegationFenceStatusResult, type DelegationRevokeResult, type DelegationStatusResult, } from './execution-delegation-admin-definition.js';

package/dist/execution-index.js

@@ -0,0 +1,16 @@
+/**
+ * execution-index.ts — the CONSUMER-SIDE entry (`otto-intel-mcp/execution`): what a signing adapter
+ * needs to verify and bind a prepare-only artifact — schemas, digest/commitment/freshness/binding
+ * assertions, the refusal class, the ruled attribution constants, and the intent normalizer — and
+ * NOTHING that constructs: no tool catalog, no prepare functions, no quote clients, no venue SDKs.
+ * (The root index pulls the hosted app and is not importable from a published install.)
+ */
+export { EXECUTION_ARTIFACT_SCHEMA, EXECUTION_ENVELOPE_SCHEMA, PREPARE_SWAP_INPUT_SCHEMA, } from './execution-tool-definitions.js';
+export { swapIntentDigestInput } from './execution-intent.js';
+export { artifactCommitmentDigest, assertArtifactAccountBinding, assertArtifactCommitment, assertArtifactEnvelope, assertArtifactFresh, assertArtifactPayloadDigest, executionDigest, MAX_ARTIFACT_TTL_MS, } from './execution-types.js';
+export { ExecutionRefusal, EXECUTION_REFUSAL_CODES } from './execution-errors.js';
+export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, } from './execution-delegation-policy.js';
+export { DELEGATED_EXECUTION_TOOL_NAME, DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, DELEGATED_SEND_RESULT_SCHEMA, } from './execution-delegated-definition.js';
+export { DEFAULT_LIFI_AGGREGATE_FEE_CAP_RATE, DEFAULT_LIFI_FEE_BPS, DEFAULT_LIFI_FEE_CONFIG_VERSION, DEFAULT_LIFI_PLATFORM_FEE_RECIPIENT, DEFAULT_OTTO_LIFI_FEE_RECIPIENT, LIFI_DIAMOND_ADDRESS, LIFI_FEE_FORWARDERS_BY_CHAIN, LIFI_FEE_FORWARDER_V1, LIFI_FEE_FORWARDER_V1_MAINNET, LIFI_FEE_FORWARDER_V2, LIFI_INTEGRATOR, isReviewedLiFiFeeForwarder, reviewedLiFiFeeForwarders, unreviewedFeeForwarderMessage, } from './execution-config.js';
+export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, } from './execution-delegation-admin-definition.js';
+//# sourceMappingURL=execution-index.js.map

package/dist/execution-intent.d.ts

@@ -0,0 +1,14 @@
+/**
+ * execution-intent.ts — the normalized swap intent whose digest is the envelope's `intent_digest`.
+ *
+ * Dependency-light on purpose (schema + viem address normalization only) so a consuming adapter can
+ * import it through `otto-intel-mcp/execution` without pulling the constructor's quote clients or
+ * venue SDKs. The constructor (`execution-tools.ts`) uses THIS function, so there is exactly one
+ * implementation of the normalization on both sides of the seam.
+ */
+/**
+ * Parse the raw `otto_prepare_swap` input exactly as the constructor does (strict schema, trimmed
+ * strings, checksummed addresses) and return the object the constructor digests. A caller that kept
+ * its exact request can recompute `intent_digest` from it.
+ */
+export declare function swapIntentDigestInput(rawInput: unknown): Record<string, unknown>;

package/dist/execution-intent.js

@@ -0,0 +1,36 @@
+/**
+ * execution-intent.ts — the normalized swap intent whose digest is the envelope's `intent_digest`.
+ *
+ * Dependency-light on purpose (schema + viem address normalization only) so a consuming adapter can
+ * import it through `otto-intel-mcp/execution` without pulling the constructor's quote clients or
+ * venue SDKs. The constructor (`execution-tools.ts`) uses THIS function, so there is exactly one
+ * implementation of the normalization on both sides of the seam.
+ */
+import { getAddress } from 'viem';
+import { PREPARE_SWAP_INPUT_SCHEMA } from './execution-tool-definitions.js';
+/**
+ * Parse the raw `otto_prepare_swap` input exactly as the constructor does (strict schema, trimmed
+ * strings, checksummed addresses) and return the object the constructor digests. A caller that kept
+ * its exact request can recompute `intent_digest` from it.
+ */
+export function swapIntentDigestInput(rawInput) {
+    const input = PREPARE_SWAP_INPUT_SCHEMA.parse(rawInput);
+    const address = getAddress(input.accountProfile.address);
+    return {
+        accountProfile: {
+            kind: input.accountProfile.kind,
+            address,
+            chainId: input.accountProfile.chainId,
+        },
+        chainId: input.chainId,
+        fromToken: getAddress(input.fromToken),
+        toToken: getAddress(input.toToken),
+        fromAmount: input.fromAmount,
+        slippage: {
+            maxBps: input.slippage.maxBps,
+            ...(input.slippage.minAmountOut ? { minAmountOut: input.slippage.minAmountOut } : {}),
+        },
+        ...(input.client_ref ? { client_ref: input.client_ref } : {}),
+    };
+}
+//# sourceMappingURL=execution-intent.js.map

package/dist/execution-registration.d.ts

@@ -0,0 +1,113 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { ensureDelegationFence, readDelegationStatus, revokeDelegation } from './execution-delegation-admin.js';
+import { type ExecutionToolDefinition } from './execution-tool-definitions.js';
+import { type ExecutionToolRuntime } from './execution-tools.js';
+export declare const EXECUTION_TOOL_ANNOTATIONS: Readonly<{
+    readOnlyHint: true;
+    destructiveHint: false;
+    idempotentHint: false;
+    openWorldHint: true;
+}>;
+export declare function executionErrorResult(error: unknown): CallToolResult;
+export declare function callExecutionDefinition(runtime: ExecutionToolRuntime, definition: ExecutionToolDefinition, rawInput: unknown, signal?: AbortSignal): Promise<CallToolResult>;
+/** A failure that is not a refusal is an upstream fault; nothing of it is relayed. */
+export declare function delegatedErrorResult(error: unknown): CallToolResult;
+/** The caller comes ONLY from the request headers; a value placed in the arguments is never consulted. */
+export declare function callDelegatedDefinition(runtime: ExecutionToolRuntime, rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined, signal?: AbortSignal): Promise<CallToolResult>;
+/** The admin tools: the same header → caller path, the same error translation, per-tool handlers. */
+declare const DELEGATION_ADMIN_TOOLS: readonly [{
+    readonly definition: Readonly<{
+        name: "otto_delegation_fence";
+        title: "Ensure the Model-B project policy (the delegation fence) is installed and reads back as v-current";
+        description: `Idempotent ensure-by-digest of the ONE CDP project-scope policy that fences every delegated send, then a read-back. Writes only when no project policy exists (creates it) or when the existing one is Otto's own lineage with stale rules (updates it in place). REFUSES BY NAME if a different project-scope policy is installed \u2014 it is never overwritten or deleted. Never downgrades a newer fence. An OPS action: at most one ensure runs project-wide at a time, never during a rolling deploy, never from the dApp (the mint gate reads fence.present from otto_delegation_status). Arguments: {}. Output: the policy id, versioned name, rules digest and the per-swap cap; the tool fails unless the fence reads back present under the written id. ${string}`;
+        inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
+        strictInputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+        outputSchema: import("zod").ZodObject<{
+            status: import("zod").ZodLiteral<"present">;
+            action: import("zod").ZodEnum<{
+                unchanged: "unchanged";
+                created: "created";
+                updated: "updated";
+            }>;
+            policy_id: import("zod").ZodString;
+            policy_name: import("zod").ZodString;
+            rules_digest: import("zod").ZodString;
+            per_swap_cap_usd: import("zod").ZodLiteral<5000>;
+        }, import("zod/v4/core").$strict>;
+        annotations: Readonly<{
+            readOnlyHint: false;
+            destructiveHint: false;
+            idempotentHint: true;
+            openWorldHint: true;
+        }>;
+    }>;
+    readonly run: typeof ensureDelegationFence;
+}, {
+    readonly definition: Readonly<{
+        name: "otto_delegation_status";
+        title: "Read one end user's delegation status (token-bound)";
+        description: `Read back, for the end user identified by a CDP access token, their CDP accounts, whether the Model-B fence is present, and whether an active delegation reads back (with its expiry). Arguments: { accessToken } \u2014 the server resolves the user from the token; a client-sent user id is refused. Output is bound to that user; nothing about any other user is returned. ${string}`;
+        inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
+        strictInputSchema: import("zod").ZodObject<{
+            accessToken: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+        outputSchema: import("zod").ZodObject<{
+            user_id: import("zod").ZodString;
+            addresses: import("zod").ZodArray<import("zod").ZodString>;
+            fence: import("zod").ZodObject<{
+                present: import("zod").ZodBoolean;
+                policy_name: import("zod").ZodString;
+                per_swap_cap_usd: import("zod").ZodLiteral<5000>;
+                rules_digest: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strict>;
+            delegation: import("zod").ZodObject<{
+                active: import("zod").ZodBoolean;
+                expires_at: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strict>;
+            revocation_requested_here: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strict>;
+        annotations: Readonly<{
+            readOnlyHint: true;
+            destructiveHint: false;
+            idempotentHint: true;
+            openWorldHint: true;
+        }>;
+    }>;
+    readonly run: typeof readDelegationStatus;
+}, {
+    readonly definition: Readonly<{
+        name: "otto_delegation_revoke";
+        title: "Revoke one end user's delegation, developer-side, confirmed by read-back";
+        description: `Revoke the end user's delegation from Otto's side and confirm by read-back that it no longer exists; from then on this server submits nothing for that user (fail-closed, even if the read-back had failed). Arguments: EITHER { accessToken } (the user path \u2014 the server resolves the user from the token) OR { userId, support_reason } (the support path, for an operator holding the server secret; the reason is logged, the token never is). ${string}`;
+        inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
+        strictInputSchema: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+            accessToken: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            userId: import("zod").ZodString;
+            support_reason: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>]>;
+        outputSchema: import("zod").ZodObject<{
+            user_id: import("zod").ZodString;
+            revoked: import("zod").ZodLiteral<true>;
+            reads_back: import("zod").ZodLiteral<false>;
+            path: import("zod").ZodEnum<{
+                user: "user";
+                support: "support";
+            }>;
+        }, import("zod/v4/core").$strict>;
+        annotations: Readonly<{
+            readOnlyHint: false;
+            destructiveHint: true;
+            idempotentHint: true;
+            openWorldHint: true;
+        }>;
+    }>;
+    readonly run: typeof revokeDelegation;
+}];
+export declare function callDelegationAdminDefinition(runtime: ExecutionToolRuntime, run: (typeof DELEGATION_ADMIN_TOOLS)[number]['run'], rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined): Promise<CallToolResult>;
+export interface ExecutionCallAdmission {
+    run(call: () => Promise<CallToolResult>): Promise<CallToolResult>;
+}
+export declare function registerExecutionTools(server: McpServer, runtime: ExecutionToolRuntime, admission?: ExecutionCallAdmission): void;
+export {};

package/dist/execution-registration.js

@@ -0,0 +1,161 @@
+import { ExecutionRefusal, isExecutionRefusal } from './execution-errors.js';
+import { DELEGATED_EXECUTION_TOOL_DEFINITION, DELEGATED_TOOL_ANNOTATIONS, } from './execution-delegated-definition.js';
+import { callerFromHeaders, submitUnderDelegation } from './execution-delegation.js';
+import { DELEGATION_FENCE_STATUS_TOOL_DEFINITION, DELEGATION_FENCE_TOOL_DEFINITION, DELEGATION_REVOKE_TOOL_DEFINITION, DELEGATION_STATUS_TOOL_DEFINITION, } from './execution-delegation-admin-definition.js';
+import { ensureDelegationFence, readDelegationFenceStatus, readDelegationStatus, revokeDelegation, } from './execution-delegation-admin.js';
+import { EXECUTION_TOOL_DEFINITIONS, } from './execution-tool-definitions.js';
+import { prepareBridge, preparePerpOrder, preparePolymarketOrder, prepareSwap, } from './execution-tools.js';
+export const EXECUTION_TOOL_ANNOTATIONS = Object.freeze({
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true,
+});
+function stringify(value) {
+    return JSON.stringify(value, (_key, item) => typeof item === 'bigint' ? item.toString() : item);
+}
+function successResult(envelope) {
+    return {
+        content: [{ type: 'text', text: stringify(envelope) }],
+        structuredContent: envelope,
+    };
+}
+export function executionErrorResult(error) {
+    const refusal = isExecutionRefusal(error)
+        ? { code: error.code, message: error.message }
+        : { code: 'LIFI_QUOTE_FAILED', message: 'execution preparation failed' };
+    return {
+        isError: true,
+        content: [{ type: 'text', text: stringify({ status: 'refused', ...refusal }) }],
+    };
+}
+export async function callExecutionDefinition(runtime, definition, rawInput, signal) {
+    try {
+        switch (definition.name) {
+            case 'otto_prepare_swap':
+                return successResult(await prepareSwap(runtime, rawInput, signal));
+            case 'otto_prepare_bridge':
+                return successResult(await prepareBridge(runtime, rawInput, signal));
+            case 'otto_prepare_polymarket_order':
+                return successResult(await preparePolymarketOrder(runtime, rawInput, signal));
+            case 'otto_prepare_perp_order':
+                return successResult(await preparePerpOrder(runtime, rawInput, signal));
+        }
+    }
+    catch (error) {
+        return executionErrorResult(error);
+    }
+}
+function delegatedSuccessResult(result) {
+    return {
+        content: [{ type: 'text', text: stringify(result) }],
+        structuredContent: result,
+    };
+}
+/** A failure that is not a refusal is an upstream fault; nothing of it is relayed. */
+export function delegatedErrorResult(error) {
+    return executionErrorResult(isExecutionRefusal(error)
+        ? error
+        : new ExecutionRefusal('DELEGATION_UPSTREAM_FAILED', 'delegated submission failed'));
+}
+/** The caller comes ONLY from the request headers; a value placed in the arguments is never consulted. */
+export async function callDelegatedDefinition(runtime, rawInput, headers, signal) {
+    try {
+        return delegatedSuccessResult(await submitUnderDelegation(runtime, rawInput, callerFromHeaders(headers), signal));
+    }
+    catch (error) {
+        return delegatedErrorResult(error);
+    }
+}
+/** The admin tools: the same header → caller path, the same error translation, per-tool handlers. */
+const DELEGATION_ADMIN_TOOLS = [
+    { definition: DELEGATION_FENCE_TOOL_DEFINITION, run: ensureDelegationFence },
+    { definition: DELEGATION_STATUS_TOOL_DEFINITION, run: readDelegationStatus },
+    { definition: DELEGATION_REVOKE_TOOL_DEFINITION, run: revokeDelegation },
+];
+export async function callDelegationAdminDefinition(runtime, run, rawInput, headers) {
+    try {
+        const result = await run(runtime, rawInput, callerFromHeaders(headers));
+        return {
+            content: [{ type: 'text', text: stringify(result) }],
+            structuredContent: result,
+        };
+    }
+    catch (error) {
+        return delegatedErrorResult(error);
+    }
+}
+export function registerExecutionTools(server, runtime, admission) {
+    for (const definition of EXECUTION_TOOL_DEFINITIONS) {
+        server.registerTool(definition.name, {
+            title: definition.title,
+            description: definition.description,
+            inputSchema: definition.inputSchema,
+            outputSchema: definition.outputSchema,
+            annotations: EXECUTION_TOOL_ANNOTATIONS,
+        }, 
+        // The definition list is heterogeneous (one input schema per prepare tool), so the SDK
+        // cannot infer a single handler signature. Each tool re-parses its own strict schema inside
+        // `callExecutionDefinition`, which is the validation of record either way.
+        (input, extra) => {
+            const call = () => callExecutionDefinition(runtime, definition, input, extra.signal);
+            return admission ? admission.run(call) : call();
+        });
+    }
+    // The one tool that submits: registered only when the runtime carries the delegated services, with
+    // its own (non-read-only) annotations, through the same per-identity admission as the prepare tools.
+    if (runtime.delegation) {
+        const definition = DELEGATED_EXECUTION_TOOL_DEFINITION;
+        server.registerTool(definition.name, {
+            title: definition.title,
+            description: definition.description,
+            inputSchema: definition.inputSchema,
+            outputSchema: definition.outputSchema,
+            annotations: DELEGATED_TOOL_ANNOTATIONS,
+        }, (input, extra) => {
+            const call = () => callDelegatedDefinition(runtime, input, extra.requestInfo?.headers, extra.signal);
+            return admission ? admission.run(call) : call();
+        });
+        // The one PUBLIC delegation tool (PR-2a): the fence's public promise, no header, read-only. It carries
+        // Otto's public CDP project id (the authority the agent CLI binds its mint to), so it registers ONLY
+        // when OTTO_CDP_PROJECT_ID is set — with no id to publish there is no binding to make.
+        if (runtime.delegation.publicProjectId) {
+            const pub = DELEGATION_FENCE_STATUS_TOOL_DEFINITION;
+            server.registerTool(pub.name, {
+                title: pub.title,
+                description: pub.description,
+                inputSchema: pub.inputSchema,
+                outputSchema: pub.outputSchema,
+                annotations: pub.annotations,
+            }, () => {
+                const call = async () => {
+                    try {
+                        const status = await readDelegationFenceStatus(runtime);
+                        return {
+                            content: [{ type: 'text', text: stringify(status) }],
+                            structuredContent: status,
+                        };
+                    }
+                    catch (error) {
+                        return delegatedErrorResult(error);
+                    }
+                };
+                return admission ? admission.run(call) : call();
+            });
+        }
+        // The three admin tools (PR-1b): fence ensure-by-digest, token-bound status, developer-side revoke.
+        for (const { definition: admin, run } of DELEGATION_ADMIN_TOOLS) {
+            server.registerTool(admin.name, {
+                title: admin.title,
+                description: admin.description,
+                inputSchema: admin.inputSchema,
+                outputSchema: admin.outputSchema,
+                annotations: admin.annotations,
+            }, (input, extra) => {
+                const call = () => callDelegationAdminDefinition(runtime, run, input, extra.requestInfo?.headers);
+                return admission ? admission.run(call) : call();
+            });
+        }
+    }
+}
+//# sourceMappingURL=execution-registration.js.map