otto-intel-mcp 0.1.2 → 0.1.3

package/dist/execution-delegation.js

@@ -31,6 +31,20 @@
  *
  * Nothing here logs the header, the secret, or a credential. Refusals are machine-readable codes; upstream
  * error bodies are never relayed.
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE THREAT MODEL THE PER-SWAP CAP GATE (step 5b) ENFORCES (Founder ruling, 2026-09-03, verbatim)
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * "The per-person delegation cap protects every delegated send that goes through Otto's page
+ * (/app/delegate) and Otto's CLI (otto-execute delegate). A permission a person mints or revokes
+ * directly against Coinbase with their own login, outside Otto's page and CLI, is OUT OF SCOPE: Otto
+ * cannot distinguish it (CDP returns no grant identity, only an expiry) and does not defend against it;
+ * the CDP project-scope $5,000 ceiling remains the hard backstop for every permission. The delegated
+ * agent never holds the person's login."
+ *
+ * Note the direction that holds even out of the model: a grant Otto has no CONFIRMED record for
+ * authorises NOTHING here — it is refused by name, never admitted at the shared ceiling. An
+ * out-of-model actor can therefore shorten what Otto may do for them, never widen it.
  */
 import { createHash, timingSafeEqual } from 'node:crypto';
 import { getAddress } from 'viem';
@@ -38,7 +52,9 @@ import { CDP_CAPABILITIES, CdpDelegatedSigner, DelegatedPlanHaltedError, createC
 import { isAdapterRefusal } from './adapter/refusal.js';
 import { defaultAdapterPolicy, verifySwapEnvelope } from './adapter/verify.js';
 import { DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, } from './execution-delegated-definition.js';
-import { assertWithinModelBFence, MODEL_B_CHAIN_ID, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_PER_SWAP_CAP_USD, MODEL_B_POLICY_NAME_V1, readBackModelBFence, } from './execution-delegation-policy.js';
+import { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
+import { assertWithinModelBFence, assertWithinUserPerSwapCap, MODEL_B_CHAIN_ID, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_PER_SWAP_CAP_USD, MODEL_B_POLICY_VERSION, assertWithdrawWithinModelBFence, modelBWithdrawToken, MODEL_B_INPUT_TOKENS_V1, readBackModelBFence, } from './execution-delegation-policy.js';
+import { createDelegationCapStore, resolveDelegationMintEnabled, } from './execution-delegation-cap-store.js';
 import { EXECUTION_REFUSAL_CODES, ExecutionRefusal, isExecutionRefusal, refuse, } from './execution-errors.js';
 import { artifactCommitmentDigest, canonicalJson, } from './execution-types.js';
 import { DELEGATED_SUBMISSION_GRACE_MS, preparedHere } from './prepared-artifacts.js';
@@ -357,15 +373,32 @@ function verifiedResult(input, user, verified, sent, fence, expiresAt) {
             block_number: step.block_number,
             gas_used: step.gas_used,
         })),
+        /**
+         * 🔴 TWO NUMBERS, BECAUSE THERE ARE TWO FACTS. `per_swap_cap_usd` is the ENGINE's — the constant
+         * compiled into the one project-scope policy, the same for every delegated user, and the only one
+         * Coinbase enforces. `user_cap_usd` is what THIS person chose when they minted, enforced by this
+         * server alone. Reporting only the second would describe the CDP fence as something it is not;
+         * reporting only the first would hide the number that actually bounded this send.
+         */
         fence: Object.freeze({
             policy_id: fence.id,
-            policy_name: MODEL_B_POLICY_NAME_V1,
+            policy_name: fence.name,
             rules_digest: fence.rulesDigest,
             per_swap_cap_usd: MODEL_B_PER_SWAP_CAP_USD,
+            user_cap_usd: fence.userCapUsd,
         }),
         delegation: Object.freeze({ expires_at: expiresAt }),
         verification: Object.freeze({
-            checks: verified.checks.map((check) => check.id),
+            /**
+             * The verifier's checks, plus the ROUTE the constructor recorded in the envelope (`route_tool:<lifi
+             * tool>` and `route_simulated:<true|false>` assertion ids), so the receipt says which venue executed.
+             * Carried as check strings because the receipt's wire shape is validated `.strict()` by the shipped
+             * dApp until cut #3 — a new field would break the page that is live today.
+             */
+            checks: [
+                ...verified.checks.map((check) => check.id),
+                ...input.envelope.assertions.map((a) => a.id).filter((id) => id.startsWith('route_')),
+            ],
             gross: verified.gross.toString(),
             min_amount_out: verified.minAmountOut.toString(),
             otto_fee_atomic: verified.ottoFee.toString(),
@@ -427,13 +460,19 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
         const fence = readBackModelBFence(await services.rig.listProjectPolicies());
         if (!fence.present)
             return refuse('DELEGATION_FENCE_ABSENT', `the Model-B project policy is not in force (${fence.reason}): ${fence.detail}`);
-        // 3. GRANT active past the envelope's own expiry; fail-closed once revocation was ever requested here.
-        if (revocationRequested(services.rig.rig, input.userId)) {
-            return refuse('DELEGATION_NOT_ACTIVE', 'revocation was requested for this end user on this server; nothing is submitted for them again');
-        }
+        // 3. GRANT active past the envelope's own expiry; fail-closed once revocation was requested for IT.
         const grant = await services.rig.rig.readDelegation(input.userId);
         if (!grant)
             return refuse('DELEGATION_NOT_ACTIVE', 'no active delegation reads back for this end user');
+        /**
+         * 🔴 PER GRANT, NOT PER USER (gate finding, HIGH — round 3). The marker used to be a sticky set of
+         * user ids, so once revoke was offered in every screen state a Stop press on a screen with no grant
+         * bricked every later permission that person minted. It names the grant now, so a revoke stops
+         * exactly what it was aimed at.
+         */
+        if (revocationRequested(services.rig.rig, input.userId, grant.expiresAt)) {
+            return refuse('DELEGATION_NOT_ACTIVE', 'revocation was requested for this delegation on this server; nothing is submitted under it');
+        }
         const expiresAtMs = Date.parse(grant.expiresAt);
         const validUntilMs = Date.parse(input.envelope.valid_until);
         if (!Number.isFinite(expiresAtMs) ||
@@ -500,10 +539,176 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
                 throw refusal;
             throw error;
         }
-        assertWithinModelBFence(verified, services.fenceBound?.perSwapCapUsd, services.fenceBound?.inputTokens);
+        /**
+         * 🔴 v2 — TWO SHAPES THROUGH ONE GATE. A delegated plan spends either an allow-listed INPUT token (a swap,
+         * or a Yield Copilot DEPOSIT, which is a swap into vault shares) — capped in USD by the engine fence and
+         * by the person's own recorded cap — or a registry vault SHARE token (a Yield Copilot WITHDRAW: shares →
+         * USDC, back to the signing account). A withdraw returns the person's own assets to the person and never
+         * increases exposure, so the person's per-swap cap does not apply to it: the cap checks below run with a
+         * gross of ZERO (which still validates the recorded cap's sanity). What bounds a withdraw is the engine's
+         * share cap (`assertWithdrawWithinModelBFence`) and the verifier's receiver pin, and it is admitted ONLY
+         * under fence v2 and ONLY for a permission minted under cap ruleset v2 (the person consented to withdraws).
+         */
+        const inputTokens = services.fenceBound?.inputTokens ?? MODEL_B_INPUT_TOKENS_V1;
+        // A withdraw is recognised by its INPUT being a registry share token; anything else takes the swap path
+        // (and a token outside the allow-list is refused there, by the original message).
+        const isWithdraw = modelBWithdrawToken(verified.token) !== undefined;
+        let capGross;
+        let capToken;
+        if (isWithdraw) {
+            if (fence.version < 2) {
+                return refuse('DELEGATION_OUTSIDE_FENCE', `a delegated vault withdraw needs fence v${MODEL_B_POLICY_VERSION}; the project fence is v${fence.version} — nothing is submitted`);
+            }
+            assertWithdrawWithinModelBFence({
+                token: verified.token,
+                spender: verified.spender,
+                gross: verified.gross,
+                outputToken: verified.outputToken,
+            });
+            capGross = 0n;
+            capToken = MODEL_B_INPUT_TOKENS_V1[0];
+        }
+        else {
+            const bound = assertWithinModelBFence(verified, services.fenceBound?.perSwapCapUsd, inputTokens);
+            capGross = verified.gross;
+            capToken = bound.token;
+        }
+        /**
+         * 5b. THE SEND GATE (Founder word `delegate cap choice`; ROUND 4, built to the codex gate's own
+         * prescription after it NO-GO'd rounds 1–3).
+         *
+         * ══════════════════════════════════════════════════════════════════════════════════════════════
+         * 🔴 WHAT THIS REFUSES, AND WHY IT IS A CONFIRMED RECORD RATHER THAN A ROW
+         * ══════════════════════════════════════════════════════════════════════════════════════════════
+         * Round 3 read a durable row keyed by `(userId, grant.expiresAt)`. The gate's two CRITICALs:
+         *
+         *   "The durable row still authenticates an expiry, not a grant … it does not require a successful
+         *    confirmation, the reservation's mintKey, or an active-grant pointer."
+         *   "Confirmation is not an enforcement gate. Reserve writes the complete enforceable capability;
+         *    confirm writes no state at all."
+         *
+         * So a reservation was a bearer capability: anyone who could ask CDP for a grant at that instant —
+         * the agent CLI, an SDK client, a second tab — inherited the cap without confirming.
+         *
+         * The gate now asks for the CONFIRMED-ACTIVE record and nothing else. A reserved, superseded,
+         * revoked or expired record is not returned by `readActive` at all, so:
+         *
+         *   · a grant minted at a reserved instant WITHOUT confirming is refused `DELEGATION_CAP_UNCONFIRMED`;
+         *   · a grant that is not the one the confirmed record names — an old expiry reused, a permission
+         *     minted elsewhere — is refused `DELEGATION_CAP_MISMATCH`;
+         *   · a record from a NEWER cap ruleset than this worker implements is refused
+         *     `DELEGATION_CAP_RULESET_STALE`, which is what stops a rolling deploy's older binary executing
+         *     a new permission at the shared ceiling.
+         *
+         * None of them fall back to the engine's $5,000: "missing means the ceiling" would turn every one of
+         * these into a silent widening of somebody's permission.
+         *
+         * 🔴 AND IT IS RE-DERIVED FROM CURRENT DURABLE STATE ON EVERY READ, never from a boot-time map, so a
+         * process that missed another's confirmation still sees it — and a store that cannot be read THROWS
+         * rather than answering "nothing is confirmed", because those two have opposite consequences.
+         */
+        const readActiveCap = async () => {
+            if (!services.capStore.available) {
+                return refuse('DELEGATION_CAP_STORE_UNAVAILABLE', `the per-swap cap for this delegation cannot be read, so what the user agreed to is unknown; nothing is submitted (${services.capStore.unavailableReason ?? 'store unavailable'})`);
+            }
+            let active;
+            try {
+                active = await services.capStore.readActive(input.userId, runtime.nowMs());
+            }
+            catch {
+                return refuse('DELEGATION_CAP_STORE_UNAVAILABLE', 'the per-swap cap for this delegation could not be read, so what the user agreed to is unknown; nothing is submitted');
+            }
+            if (!active) {
+                return refuse('DELEGATION_CAP_UNCONFIRMED', 'no confirmed permission stands for this end user on this server, so what they agreed to is unknown; nothing is submitted — mint the permission again on the delegation page');
+            }
+            if (active.requiredVersion > MODEL_B_CAP_RULESET_VERSION) {
+                return refuse('DELEGATION_CAP_RULESET_STALE', `this permission requires cap ruleset v${active.requiredVersion} and this server implements v${MODEL_B_CAP_RULESET_VERSION}; nothing is submitted until the newer build is serving`);
+            }
+            /**
+             * 🔴 THE CONFIRMED RECORD MUST NAME THE GRANT THAT IS ACTUALLY LIVE. Without this the record would
+             * be a standing authorisation for whatever grant the user happens to hold, which is the round-3
+             * defect one layer up.
+             */
+            if (Date.parse(active.expiresAt) !== expiresAtMs) {
+                return refuse('DELEGATION_CAP_MISMATCH', 'the delegation that reads back is not the one this permission was confirmed for; nothing is submitted — mint the permission again on the delegation page');
+            }
+            return {
+                capUsd: active.perSwapCapUsd,
+                expiresAt: active.expiresAt,
+                requiredVersion: active.requiredVersion,
+            };
+        };
+        const active = await readActiveCap();
+        const userCapUsd = active.capUsd;
+        if (isWithdraw && active.requiredVersion < 2) {
+            return refuse('DELEGATION_WITHDRAW_UNCONSENTED', `this permission was minted under cap ruleset v${active.requiredVersion}, before vault withdraws existed; nothing is submitted — mint the permission again on the delegation page`);
+        }
+        assertWithinUserPerSwapCap(capGross, userCapUsd, capToken);
+        /**
+         * 🔴 AND IT IS RE-CHECKED BEFORE EVERY STEP, AND AGAIN AFTER THE TRANSACTION IS BUILT.
+         *
+         * The plan is three transactions. `beforeEachStep` re-reads the grant and the confirmed record
+         * between them, which catches a revoke-and-re-mint from another tab. The gate found the remaining
+         * window: "the final asynchronous grant/cap check still happens before transaction construction …
+         * only a synchronous abort check precedes raw submission. A revoke/re-mint to a narrower cap during
+         * transaction building therefore escapes the last authoritative check."
+         *
+         * So the async re-read stores what it saw, and a SYNCHRONOUS assertion over that value runs after
+         * the nonce/fee/gas round trips and immediately before the hand-off. It cannot await — awaiting is
+         * what opened the window — so what it closes is the interval between the last read and the send,
+         * using the freshest value that exists. The irreducible residual is the network round trip itself,
+         * which no vendor CAS is offered to close.
+         */
+        let lastSeenCapUsd = userCapUsd;
+        let lastSeenRequiredVersion = active.requiredVersion;
+        let lastSeenGrantOk = true;
+        /** Re-read the grant and the confirmed record; record what was seen. Used by both hooks below. */
+        const refreshSeen = async () => {
+            const current = await services.rig.rig.readDelegation(input.userId);
+            lastSeenGrantOk = current !== undefined && Date.parse(current.expiresAt) === expiresAtMs;
+            if (!lastSeenGrantOk)
+                return;
+            const seen = await readActiveCap();
+            lastSeenCapUsd = seen.capUsd;
+            lastSeenRequiredVersion = seen.requiredVersion;
+        };
+        /** A withdraw's consent is re-asserted wherever the cap is (codex gate r1: true at all three points). */
+        const assertWithdrawConsent = () => {
+            if (isWithdraw && lastSeenRequiredVersion < 2) {
+                return refuse('DELEGATION_WITHDRAW_UNCONSENTED', 'the confirmed permission changed to one minted before vault withdraws existed; the remaining steps are not submitted');
+            }
+        };
+        /** Between steps: the plan must still be admissible before the next one is even built. */
+        const beforeEachStep = async () => {
+            await refreshSeen();
+            if (!lastSeenGrantOk) {
+                return refuse('DELEGATION_NOT_ACTIVE', 'the delegation changed while the plan was in flight; the remaining steps are not submitted');
+            }
+            assertWithdrawConsent();
+            assertWithinUserPerSwapCap(capGross, lastSeenCapUsd, capToken);
+        };
+        /**
+         * 🔴 AND AGAIN AFTER THE TRANSACTION IS BUILT — the window the gate named. The nonce, fee and gas
+         * round trips take real time, and a revoke or a narrower re-mint landing inside them was invisible
+         * to the check between steps. This one runs after construction; the synchronous assertion below then
+         * acts on what it found, with nothing awaited between it and the hand-off.
+         */
+        const afterBuild = refreshSeen;
+        const beforeSubmit = () => {
+            if (!lastSeenGrantOk) {
+                return refuse('DELEGATION_NOT_ACTIVE', 'the delegation changed while this transaction was being built; it is not submitted');
+            }
+            assertWithdrawConsent();
+            assertWithinUserPerSwapCap(capGross, lastSeenCapUsd, capToken);
+        };
         // 6. SEND.
         const signer = new CdpDelegatedSigner(services.rig.rig, user, {
             sealedWait: services.sealedWait,
+            beforeEachStep,
+            afterBuild,
+            beforeSubmit,
+            // The grant this plan is bound to: the revocation marker is per grant, so the signer names one.
+            grantExpiresAt: grant.expiresAt,
         });
         let sent;
         try {
@@ -516,7 +721,7 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
             submission.state = { kind: 'halted', refusal };
             throw refusal;
         }
-        const result = verifiedResult(input, user, verified, sent, fence, grant.expiresAt);
+        const result = verifiedResult(input, user, verified, sent, { id: fence.id, rulesDigest: fence.rulesDigest, userCapUsd, name: fence.name }, grant.expiresAt);
         submission.state = { kind: 'sent', result };
         return result;
     }
@@ -576,7 +781,17 @@ export async function openDelegationServicesFromEnv(env) {
     }
     return Object.freeze({
         rig: createDelegationRig(cdp, pub),
+        pub,
         serverSecret: env.serverSecret,
+        // 🔴 An unconfigured store does NOT stop the boot — it opens UNAVAILABLE, and every delegated send
+        // then refuses `DELEGATION_CAP_STORE_UNAVAILABLE` by name. Refusing to boot would also take down the
+        // read-only tools (status, revoke, the public fence promise) and, in particular, the REVOKE that lets
+        // a person withdraw authority — the one control that must never be collateral damage.
+        capStore: await createDelegationCapStore(),
+        // Default FALSE in code: an operator who never sets the variable gets the paused surface, never an
+        // unfenced first rollout. Read once at boot, so a mid-life environment change needs a redeploy —
+        // which is exactly what the rollout runbook does.
+        mintEnabled: resolveDelegationMintEnabled(),
         ...(env.publicProjectId ? { publicProjectId: env.publicProjectId } : {}),
     });
 }

package/dist/execution-errors.d.ts

@@ -1,4 +1,4 @@
-export declare const EXECUTION_REFUSAL_CODES: readonly ["ATTRIBUTION_MISSING", "LIFI_FEE_CAP_EXCEEDED", "ACCOUNT_BINDING_MISMATCH", "DIGEST_MISMATCH", "ARTIFACT_INVALID", "STALE_ARTIFACT", "EXECUTION_RATE_LIMITED", "EXECUTION_CONCURRENCY_FULL", "UNSUPPORTED_ACCOUNT_PROFILE", "LIFI_QUOTE_FAILED", "LIFI_QUOTE_INVALID", "UNSUPPORTED_LIFI_ROUTE", "POLYMARKET_METADATA_FAILED", "POLYMARKET_METADATA_INVALID", "UNSUPPORTED_POLYMARKET_MARKET", "POLYMARKET_ORDER_INVALID", "POLYMARKET_BUILDER_FEE_UNRULED", "HYPERLIQUID_META_FAILED", "HYPERLIQUID_META_INVALID", "UNSUPPORTED_HYPERLIQUID_MARKET", "HYPERLIQUID_ORDER_INVALID", "DELEGATION_UNAVAILABLE", "DELEGATION_UNAUTHORIZED", "DELEGATION_INPUT_INVALID", "DELEGATION_BUSY", "DELEGATION_ARTIFACT_IN_FLIGHT", "ARTIFACT_NOT_PREPARED_HERE", "PREPARED_ARTIFACT_CAPACITY", "ARTIFACT_ID_COLLISION", "DELEGATION_REPLAY_MISMATCH", "DELEGATION_FENCE_ABSENT", "DELEGATION_FENCE_FOREIGN", "DELEGATION_FENCE_AMBIGUOUS", "DELEGATION_FENCE_NEWER", "DELEGATION_TOKEN_INVALID", "DELEGATION_REVOKE_NOT_CONFIRMED", "DELEGATION_NOT_ACTIVE", "DELEGATION_EXPIRY_EXCEEDS_BOUND", "DELEGATION_USER_UNKNOWN", "DELEGATION_OUTSIDE_FENCE", "DELEGATED_PLAN_REFUSED", "DELEGATED_PLAN_HALTED", "DELEGATION_UPSTREAM_FAILED"];
+export declare const EXECUTION_REFUSAL_CODES: readonly ["ATTRIBUTION_MISSING", "LIFI_FEE_CAP_EXCEEDED", "ACCOUNT_BINDING_MISMATCH", "DIGEST_MISMATCH", "ARTIFACT_INVALID", "STALE_ARTIFACT", "EXECUTION_RATE_LIMITED", "EXECUTION_CONCURRENCY_FULL", "UNSUPPORTED_ACCOUNT_PROFILE", "LIFI_QUOTE_FAILED", "LIFI_QUOTE_INVALID", "UNSUPPORTED_LIFI_ROUTE", "POLYMARKET_METADATA_FAILED", "POLYMARKET_METADATA_INVALID", "UNSUPPORTED_POLYMARKET_MARKET", "POLYMARKET_ORDER_INVALID", "POLYMARKET_BUILDER_FEE_UNRULED", "HYPERLIQUID_META_FAILED", "HYPERLIQUID_META_INVALID", "UNSUPPORTED_HYPERLIQUID_MARKET", "HYPERLIQUID_ORDER_INVALID", "DELEGATION_UNAVAILABLE", "DELEGATION_UNAUTHORIZED", "DELEGATION_INPUT_INVALID", "DELEGATION_BUSY", "DELEGATION_ARTIFACT_IN_FLIGHT", "ARTIFACT_NOT_PREPARED_HERE", "PREPARED_ARTIFACT_CAPACITY", "ARTIFACT_ID_COLLISION", "DELEGATION_REPLAY_MISMATCH", "DELEGATION_FENCE_ABSENT", "DELEGATION_FENCE_FOREIGN", "DELEGATION_FENCE_AMBIGUOUS", "DELEGATION_FENCE_NEWER", "DELEGATION_TOKEN_INVALID", "DELEGATION_REVOKE_NOT_CONFIRMED", "DELEGATION_NOT_ACTIVE", "DELEGATION_EXPIRY_EXCEEDS_BOUND", "DELEGATION_USER_UNKNOWN", "DELEGATION_OUTSIDE_FENCE", "DELEGATION_ABOVE_USER_CAP", "DELEGATION_CAP_UNRECORDED", "DELEGATION_CAP_GRANT_CHANGED", "DELEGATION_CAP_EXPIRY_UNAVAILABLE", "DELEGATION_CAP_UNCONFIRMED", "DELEGATION_CAP_MISMATCH", "DELEGATION_CAP_RULESET_STALE", "DELEGATION_CAP_SUPERSEDED", "DELEGATION_CAP_STORE_UNAVAILABLE", "DELEGATION_MINT_PAUSED", "DELEGATION_CAP_CANCELLED", "DELEGATED_PLAN_REFUSED", "DELEGATED_PLAN_HALTED", "DELEGATION_UPSTREAM_FAILED", "YIELD_MARKET_UNKNOWN", "YIELD_REGISTRY_MISMATCH", "YIELD_PREVIEW_UNAVAILABLE", "YIELD_DEPOSIT_PARITY", "YIELD_WITHDRAW_PARITY", "DELEGATION_WITHDRAW_UNCONSENTED", "EQUITY_UNKNOWN", "EQUITY_REGISTRY_MISMATCH", "EQUITY_ORACLE_UNAVAILABLE", "EQUITY_ORACLE_FROZEN", "STOCK_BUY_PARITY"];
 export type ExecutionRefusalCode = (typeof EXECUTION_REFUSAL_CODES)[number];
 /** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
 export declare class ExecutionRefusal extends Error {

package/dist/execution-errors.js

@@ -109,12 +109,110 @@ export const EXECUTION_REFUSAL_CODES = [
     'DELEGATION_USER_UNKNOWN',
     /** A verified plan the fence would refuse anyway: input token not allow-listed, spender not the reviewed diamond, gross over the per-swap cap. */
     'DELEGATION_OUTSIDE_FENCE',
+    /**
+     * The plan is inside the ENGINE's fence but over the per-swap cap THIS USER chose when they minted.
+     * Deliberately distinct from `DELEGATION_OUTSIDE_FENCE`: that code means "Coinbase would refuse this
+     * too"; this one means "the engine would have signed it and Otto did not, because the person set a
+     * lower number." Conflating them would make the user's own choice indistinguishable from the shared
+     * ceiling, and no test could tell whether the chosen cap was ever consulted.
+     */
+    'DELEGATION_ABOVE_USER_CAP',
+    /**
+     * The grant that reads back from CDP carries NO recorded per-swap cap on this server, so what the person
+     * agreed to is unknown. Fail-closed: nothing is submitted, and the remedy is a fresh mint (which records
+     * one). Never defaulted to the ceiling — a grant minted for $10 must not become a $5,000 grant because
+     * its record could not be found.
+     */
+    'DELEGATION_CAP_UNRECORDED',
+    /**
+     * CONFIRM FAILED: the instant CDP reports for the live grant is not the instant this mint RESERVED.
+     *
+     * Round 3 makes `(userId, expiry)` a grant identity by construction — the server picks a whole second no
+     * durable row for that user occupies, writes the cap against it, and the page mints with exactly that
+     * second. This code is what happens when that construction does not hold: either another actor's grant
+     * is what reads back (replaced between the reservation and the mint), or CDP stored something other than
+     * what was asked for. Both mean the live permission is not the one this cap was chosen for, so nothing is
+     * blessed and the fresh grant is REVOKED rather than left standing with a cap it was never matched to.
+     */
+    'DELEGATION_CAP_GRANT_CHANGED',
+    /**
+     * The offset ladder found no free whole-second instant at or before the requested expiry within its
+     * bound. Nothing is reserved and nothing is minted: handing out an instant a reservation already holds
+     * would put two permissions on one enforcement key, which is the collision this design removes.
+     */
+    'DELEGATION_CAP_EXPIRY_UNAVAILABLE',
+    /**
+     * 🔴 THE SEND GATE (round 4). No CONFIRMED-ACTIVE record stands for this end user, so no permission
+     * has completed `reserved → confirmed_active` on this server. A reservation on its own authorises
+     * NOTHING: that is what stops a grant minted at a reserved instant by any client — the agent CLI, an
+     * SDK caller, a second tab — from inheriting a cap it never confirmed. Never defaulted to the ceiling.
+     */
+    'DELEGATION_CAP_UNCONFIRMED',
+    /**
+     * A confirmed-active record stands, but the grant CDP reports right now is not the one it names. The
+     * live permission is a different one — replaced, or minted elsewhere — so nothing is submitted under
+     * it. Distinct from `DELEGATION_CAP_UNCONFIRMED`: that means nothing was ever confirmed; this means
+     * something was, and it is not what is live.
+     */
+    'DELEGATION_CAP_MISMATCH',
+    /**
+     * The record requires a NEWER cap ruleset than this worker implements. A rolling deploy runs two
+     * binaries at once, and the Coinbase fence is identical on both — so an older worker that cannot
+     * honour a per-user cap would execute a new permission at the shared ceiling. It refuses instead.
+     */
+    'DELEGATION_CAP_RULESET_STALE',
+    /**
+     * The reservation was confirmed once and a later confirmation replaced it. It is never revived: a
+     * superseded permission returning to active is a replaced cap coming back, and on a wider number that
+     * is the widening this unit exists to prevent.
+     */
+    'DELEGATION_CAP_SUPERSEDED',
+    /**
+     * The per-swap cap store itself is unavailable — no durable path is configured, or it could not be read.
+     * Every delegated send refuses while that is true, because an unreadable store is indistinguishable from
+     * an empty one and the difference decides whether a user's cap is honoured.
+     */
+    'DELEGATION_CAP_STORE_UNAVAILABLE',
+    /**
+     * This worker is not creating NEW permissions right now (`DELEGATION_MINT_ENABLED` is not set true) —
+     * the staged first deployment. It gates the RESERVE only: a permission that already stands keeps
+     * working under its own cap, an in-flight mint can still be confirmed, and revoke always works.
+     */
+    'DELEGATION_MINT_PAUSED',
+    /**
+     * The person pressed Stop while this permission was being created, so the reservation it was minted
+     * against was cancelled. The fresh grant is revoked and nothing is confirmed for it. Never a retry:
+     * a Stop that leaves a permission behind is not a Stop.
+     */
+    'DELEGATION_CAP_CANCELLED',
     /** The user-side verifier refused the envelope with an adapter code the constructor does not share; the message carries `[CODE]`. */
     'DELEGATED_PLAN_REFUSED',
     /** The plan halted mid-way; the message reports the failed step and whether the allowance clear read back zero. */
     'DELEGATED_PLAN_HALTED',
     /** A CDP or chain read/write failed outright; no upstream body is relayed. */
     'DELEGATION_UPSTREAM_FAILED',
+    /** `otto_prepare_yield_deposit`: the executableMarketId names no executable Morpho market in this server's registry. */
+    'YIELD_MARKET_UNKNOWN',
+    /** The caller's registryCommitment is not the commitment recomputed over the CURRENT registry record (stale or foreign row). */
+    'YIELD_REGISTRY_MISMATCH',
+    /** The vault's own previewDeposit could not be read, so deposit parity cannot be checked; nothing is prepared. */
+    'YIELD_PREVIEW_UNAVAILABLE',
+    /** The route quotes fewer shares than the vault's own previewDeposit by more than the pinned tolerance. */
+    'YIELD_DEPOSIT_PARITY',
+    /** `otto_prepare_yield_withdraw`: the route quotes less USDC than the vault's own previewRedeem by more than the pinned tolerance. */
+    'YIELD_WITHDRAW_PARITY',
+    /** A delegated vault withdraw under a permission minted before cap ruleset v2 (no consent to withdraws); re-mint. */
+    'DELEGATION_WITHDRAW_UNCONSENTED',
+    /** `otto_prepare_stock_buy`: the executableEquityId names no executable equity in this server's registry (or the row fails its own pins). */
+    'EQUITY_UNKNOWN',
+    /** The caller's registryCommitment is not the commitment recomputed over the CURRENT equity record (stale or foreign row). */
+    'EQUITY_REGISTRY_MISMATCH',
+    /** The equity's Chainlink feed could not be read (or reads non-positive), so price parity cannot be checked; nothing is prepared. */
+    'EQUITY_ORACLE_UNAVAILABLE',
+    /** The equity's Chainlink mark is older than the pinned frozen threshold (feeds hold their last value off-hours); a delegated buy waits for a live reference. */
+    'EQUITY_ORACLE_FROZEN',
+    /** The route's gross implied price exceeds the equity's own Chainlink mark by more than the pinned tolerance. */
+    'STOCK_BUY_PARITY',
 ];
 /** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
 export class ExecutionRefusal extends Error {

package/dist/execution-index.d.ts

@@ -11,7 +11,8 @@ export { swapIntentDigestInput } from './execution-intent.js';
 export { artifactCommitmentDigest, assertArtifactAccountBinding, assertArtifactCommitment, assertArtifactEnvelope, assertArtifactFresh, assertArtifactPayloadDigest, executionDigest, MAX_ARTIFACT_TTL_MS, } from './execution-types.js';
 export type { AccountProfile, ExecutionArtifact, ExecutionEnvelope, ExecutionPayload, } from './execution-types.js';
 export { ExecutionRefusal, EXECUTION_REFUSAL_CODES } from './execution-errors.js';
-export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, type DelegationPolicyRecord, type ModelBFenceReadBack, } from './execution-delegation-policy.js';
+export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_DELEGATION_EXPIRY_MIN_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_MINT_EXPIRY_FILLER_MS, mintExpiryFor, MODEL_B_PER_SWAP_CAP_MIN_USD, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, boundedPerSwapCap, assertWithinUserPerSwapCap, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, MODEL_B_POLICY_NAME_V2, MODEL_B_POLICY_NAME, MODEL_B_POLICY_DIGEST_V2, MODEL_B_POLICY_DIGEST, MODEL_B_POLICY_DIGEST_BY_NAME, MODEL_B_POLICY_ACCEPTED_VERSIONS, MODEL_B_WITHDRAW_TOKENS_V2, MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC, assertWithdrawWithinModelBFence, fenceIsCurrent, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, type DelegationPolicyRecord, type ModelBFenceReadBack, } from './execution-delegation-policy.js';
 export { DELEGATED_EXECUTION_TOOL_NAME, DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, DELEGATED_SEND_RESULT_SCHEMA, type DelegatedSendResult, type SubmitUnderDelegationInput, } from './execution-delegated-definition.js';
 export { DEFAULT_LIFI_AGGREGATE_FEE_CAP_RATE, DEFAULT_LIFI_FEE_BPS, DEFAULT_LIFI_FEE_CONFIG_VERSION, DEFAULT_LIFI_PLATFORM_FEE_RECIPIENT, DEFAULT_OTTO_LIFI_FEE_RECIPIENT, LIFI_DIAMOND_ADDRESS, LIFI_FEE_FORWARDERS_BY_CHAIN, LIFI_FEE_FORWARDER_V1, LIFI_FEE_FORWARDER_V1_MAINNET, LIFI_FEE_FORWARDER_V2, LIFI_INTEGRATOR, isReviewedLiFiFeeForwarder, reviewedLiFiFeeForwarders, unreviewedFeeForwarderMessage, } from './execution-config.js';
-export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, type DelegationFenceResult, type DelegationFenceStatusResult, type DelegationRevokeResult, type DelegationStatusResult, } from './execution-delegation-admin-definition.js';
+export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_CAP_INPUT_SCHEMA, DELEGATION_CAP_RESULT_SCHEMA, DELEGATION_CAP_TOOL_NAME, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, type DelegationCapResult, type DelegationFenceResult, type DelegationFenceStatusResult, type DelegationRevokeResult, type DelegationStatusResult, } from './execution-delegation-admin-definition.js';
+export { CAP_EXPIRY_MAX_OFFSET_STEPS, DELEGATION_CAP_STORE_PATH_ENV, DelegationCapExpiryUnavailableError, MINT_KEY_PATTERN, createDelegationCapStore, firstFreeExpiryMs, inMemoryDelegationCapStore, resolveDelegationCapStorePath, unavailableDelegationCapStore, wholeSecondMs, type DelegationCapRecord, type DelegationCapReservation, type DelegationCapStore, } from './execution-delegation-cap-store.js';

package/dist/execution-index.js

@@ -9,8 +9,9 @@ export { EXECUTION_ARTIFACT_SCHEMA, EXECUTION_ENVELOPE_SCHEMA, PREPARE_SWAP_INPU
 export { swapIntentDigestInput } from './execution-intent.js';
 export { artifactCommitmentDigest, assertArtifactAccountBinding, assertArtifactCommitment, assertArtifactEnvelope, assertArtifactFresh, assertArtifactPayloadDigest, executionDigest, MAX_ARTIFACT_TTL_MS, } from './execution-types.js';
 export { ExecutionRefusal, EXECUTION_REFUSAL_CODES } from './execution-errors.js';
-export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, } from './execution-delegation-policy.js';
+export { MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_DELEGATION_EXPIRY_MIN_DAYS, MODEL_B_INPUT_TOKENS_V1, MODEL_B_MINT_EXPIRY_FILLER_MS, mintExpiryFor, MODEL_B_PER_SWAP_CAP_MIN_USD, MODEL_B_PER_SWAP_CAP_USD, boundedDelegationExpiry, boundedPerSwapCap, assertWithinUserPerSwapCap, MODEL_B_POLICY_DIGEST_V1, MODEL_B_POLICY_NAME_V1, MODEL_B_POLICY_NAME_V2, MODEL_B_POLICY_NAME, MODEL_B_POLICY_DIGEST_V2, MODEL_B_POLICY_DIGEST, MODEL_B_POLICY_DIGEST_BY_NAME, MODEL_B_POLICY_ACCEPTED_VERSIONS, MODEL_B_WITHDRAW_TOKENS_V2, MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC, assertWithdrawWithinModelBFence, fenceIsCurrent, modelBProjectPolicyBody, modelBProjectPolicyRules, policyRulesDigest, readBackModelBFence, } from './execution-delegation-policy.js';
 export { DELEGATED_EXECUTION_TOOL_NAME, DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, DELEGATED_SEND_RESULT_SCHEMA, } from './execution-delegated-definition.js';
 export { DEFAULT_LIFI_AGGREGATE_FEE_CAP_RATE, DEFAULT_LIFI_FEE_BPS, DEFAULT_LIFI_FEE_CONFIG_VERSION, DEFAULT_LIFI_PLATFORM_FEE_RECIPIENT, DEFAULT_OTTO_LIFI_FEE_RECIPIENT, LIFI_DIAMOND_ADDRESS, LIFI_FEE_FORWARDERS_BY_CHAIN, LIFI_FEE_FORWARDER_V1, LIFI_FEE_FORWARDER_V1_MAINNET, LIFI_FEE_FORWARDER_V2, LIFI_INTEGRATOR, isReviewedLiFiFeeForwarder, reviewedLiFiFeeForwarders, unreviewedFeeForwarderMessage, } from './execution-config.js';
-export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, } from './execution-delegation-admin-definition.js';
+export { DELEGATION_ADMIN_TOOL_NAMES, DELEGATION_CAP_INPUT_SCHEMA, DELEGATION_CAP_RESULT_SCHEMA, DELEGATION_CAP_TOOL_NAME, DELEGATION_FENCE_INPUT_SCHEMA, DELEGATION_FENCE_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_INPUT_SCHEMA, DELEGATION_FENCE_STATUS_RESULT_SCHEMA, DELEGATION_FENCE_STATUS_TOOL_NAME, DELEGATION_FENCE_TOOL_NAME, DELEGATION_REVOKE_INPUT_SCHEMA, DELEGATION_REVOKE_RESULT_SCHEMA, DELEGATION_REVOKE_TOOL_NAME, DELEGATION_STATUS_INPUT_SCHEMA, DELEGATION_STATUS_RESULT_SCHEMA, DELEGATION_STATUS_TOOL_NAME, } from './execution-delegation-admin-definition.js';
+export { CAP_EXPIRY_MAX_OFFSET_STEPS, DELEGATION_CAP_STORE_PATH_ENV, DelegationCapExpiryUnavailableError, MINT_KEY_PATTERN, createDelegationCapStore, firstFreeExpiryMs, inMemoryDelegationCapStore, resolveDelegationCapStorePath, unavailableDelegationCapStore, wholeSecondMs, } from './execution-delegation-cap-store.js';
 //# sourceMappingURL=execution-index.js.map

package/dist/execution-registration.d.ts

@@ -1,6 +1,6 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
-import { ensureDelegationFence, readDelegationStatus, revokeDelegation } from './execution-delegation-admin.js';
+import { ensureDelegationFence, readDelegationStatus, reserveDelegationCap, revokeDelegation } from './execution-delegation-admin.js';
 import { type ExecutionToolDefinition } from './execution-tool-definitions.js';
 import { type ExecutionToolRuntime } from './execution-tools.js';
 export declare const EXECUTION_TOOL_ANNOTATIONS: Readonly<{
@@ -11,6 +11,7 @@ export declare const EXECUTION_TOOL_ANNOTATIONS: Readonly<{
 }>;
 export declare function executionErrorResult(error: unknown): CallToolResult;
 export declare function callExecutionDefinition(runtime: ExecutionToolRuntime, definition: ExecutionToolDefinition, rawInput: unknown, signal?: AbortSignal): Promise<CallToolResult>;
+export declare function callYieldDefinition(prepare: (runtime: ExecutionToolRuntime, rawInput: unknown, signal?: AbortSignal) => Promise<unknown>, runtime: ExecutionToolRuntime, rawInput: unknown, signal?: AbortSignal): Promise<CallToolResult>;
 /** A failure that is not a refusal is an upstream fault; nothing of it is relayed. */
 export declare function delegatedErrorResult(error: unknown): CallToolResult;
 /** The caller comes ONLY from the request headers; a value placed in the arguments is never consulted. */
@@ -47,7 +48,7 @@ declare const DELEGATION_ADMIN_TOOLS: readonly [{
     readonly definition: Readonly<{
         name: "otto_delegation_status";
         title: "Read one end user's delegation status (token-bound)";
-        description: `Read back, for the end user identified by a CDP access token, their CDP accounts, whether the Model-B fence is present, and whether an active delegation reads back (with its expiry). Arguments: { accessToken } \u2014 the server resolves the user from the token; a client-sent user id is refused. Output is bound to that user; nothing about any other user is returned. ${string}`;
+        description: `Read back, for the end user identified by a CDP access token, their CDP accounts, whether the Model-B fence is present, and whether an active delegation reads back (with its expiry and the per-swap cap recorded for it). Arguments: { accessToken } \u2014 the server resolves the user from the token; a client-sent user id is refused. delegation.per_swap_cap_usd is the number THIS user chose at mint time; it is ABSENT when no cap is recorded for the grant, which means the delegated send will refuse it \u2014 say so rather than showing the shared ceiling. fence.per_swap_cap_usd is that shared ceiling and is never a per-user number. Output is bound to that user; nothing about any other user is returned. ${string}`;
         inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
         strictInputSchema: import("zod").ZodObject<{
             accessToken: import("zod").ZodString;
@@ -64,8 +65,11 @@ declare const DELEGATION_ADMIN_TOOLS: readonly [{
             delegation: import("zod").ZodObject<{
                 active: import("zod").ZodBoolean;
                 expires_at: import("zod").ZodOptional<import("zod").ZodString>;
+                per_swap_cap_usd: import("zod").ZodOptional<import("zod").ZodNumber>;
             }, import("zod/v4/core").$strict>;
             revocation_requested_here: import("zod").ZodBoolean;
+            ruleset_version: import("zod").ZodNumber;
+            mint_enabled: import("zod").ZodBoolean;
         }, import("zod/v4/core").$strict>;
         annotations: Readonly<{
             readOnlyHint: true;
@@ -104,6 +108,51 @@ declare const DELEGATION_ADMIN_TOOLS: readonly [{
         }>;
     }>;
     readonly run: typeof revokeDelegation;
+}, {
+    readonly definition: Readonly<{
+        name: "otto_delegation_cap";
+        title: "Reserve the expiry a delegation is minted with, record the chosen per-swap cap against it, then confirm the mint";
+        description: `TWO PHASES, both header authed, both resolving the end user from the access token. { phase: "reserve", accessToken, perSwapCapUsd, requestedDays, mintKey } picks a whole-second expiry instant at or BEFORE the requested duration that no durable row for this user already occupies, writes the chosen cap (whole USD, 1\u20265000) against it, and answers { expires_at, mint_expires_at, per_swap_cap_usd, recorded }. Call createDelegation with mint_expires_at EXACTLY as given \u2014 it is the reserved instant plus a one-millisecond filler, because CDP refuses an expiry ending .000 and truncates the filler away \u2014 and with mintKey as the idempotencyKey. Then { phase: "confirm", accessToken, mintKey } re-reads the grant from CDP and refuses (DELEGATION_CAP_GRANT_CHANGED) unless the instant CDP reports IS the reserved one, revoking the fresh grant when it is not. Why this shape: Coinbase issues no grant id and a send can learn nothing about a live grant except its expiry, so the expiry is made an identity BY CONSTRUCTION \u2014 reserved server-side, recorded before the mint, asserted after it. Until a reservation exists, otto_submit_under_delegation refuses that delegation (DELEGATION_CAP_UNRECORDED) rather than falling back to the 5000 USD ceiling. A reservation is IMMUTABLE per mint key \u2014 pressing again returns the same instant and the cap already in force, so raising a cap means minting a new permission (which the user is told replaces the old one). Coinbase's engine cannot hold this number: end-user accounts are fenced by ONE project-scope policy shared by every delegated user, so a lower per-user cap is enforced by Otto's server alone. ${string}`;
+        inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
+        strictInputSchema: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            phase: import("zod").ZodLiteral<"reserve">;
+            accessToken: import("zod").ZodString;
+            perSwapCapUsd: import("zod").ZodNumber;
+            requestedDays: import("zod").ZodNumber;
+            mintKey: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            phase: import("zod").ZodLiteral<"confirm">;
+            accessToken: import("zod").ZodString;
+            mintKey: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>], "phase">;
+        outputSchema: import("zod").ZodObject<{
+            phase: import("zod").ZodEnum<{
+                reserve: "reserve";
+                confirm: "confirm";
+            }>;
+            user_id: import("zod").ZodString;
+            expires_at: import("zod").ZodString;
+            mint_expires_at: import("zod").ZodOptional<import("zod").ZodString>;
+            per_swap_cap_usd: import("zod").ZodNumber;
+            state: import("zod").ZodEnum<{
+                legacy: "legacy";
+                reserved: "reserved";
+                confirmed_active: "confirmed_active";
+                superseded: "superseded";
+                revoked: "revoked";
+                expired: "expired";
+            }>;
+            ruleset_version: import("zod").ZodNumber;
+            recorded: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strict>;
+        annotations: Readonly<{
+            readOnlyHint: false;
+            destructiveHint: false;
+            idempotentHint: true;
+            openWorldHint: true;
+        }>;
+    }>;
+    readonly run: typeof reserveDelegationCap;
 }];
 export declare function callDelegationAdminDefinition(runtime: ExecutionToolRuntime, run: (typeof DELEGATION_ADMIN_TOOLS)[number]['run'], rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined): Promise<CallToolResult>;
 export interface ExecutionCallAdmission {

package/dist/execution-registration.js

@@ -1,9 +1,15 @@
 import { ExecutionRefusal, isExecutionRefusal } from './execution-errors.js';
 import { DELEGATED_EXECUTION_TOOL_DEFINITION, DELEGATED_TOOL_ANNOTATIONS, } from './execution-delegated-definition.js';
 import { callerFromHeaders, submitUnderDelegation } from './execution-delegation.js';
-import { DELEGATION_FENCE_STATUS_TOOL_DEFINITION, DELEGATION_FENCE_TOOL_DEFINITION, DELEGATION_REVOKE_TOOL_DEFINITION, DELEGATION_STATUS_TOOL_DEFINITION, } from './execution-delegation-admin-definition.js';
-import { ensureDelegationFence, readDelegationFenceStatus, readDelegationStatus, revokeDelegation, } from './execution-delegation-admin.js';
+import { DELEGATION_CAP_TOOL_DEFINITION, DELEGATION_FENCE_STATUS_TOOL_DEFINITION, DELEGATION_FENCE_TOOL_DEFINITION, DELEGATION_REVOKE_TOOL_DEFINITION, DELEGATION_STATUS_TOOL_DEFINITION, } from './execution-delegation-admin-definition.js';
+import { ensureDelegationFence, readDelegationFenceStatus, readDelegationStatus, reserveDelegationCap, revokeDelegation, } from './execution-delegation-admin.js';
 import { EXECUTION_TOOL_DEFINITIONS, } from './execution-tool-definitions.js';
+import { YIELD_DEPOSIT_TOOL_DEFINITION } from './yield-deposit-definition.js';
+import { prepareYieldDeposit } from './yield-deposit.js';
+import { STOCK_BUY_TOOL_DEFINITION } from './stock-buy-definition.js';
+import { prepareStockBuy } from './stock-buy.js';
+import { YIELD_WITHDRAW_TOOL_DEFINITION } from './yield-withdraw-definition.js';
+import { prepareYieldWithdraw } from './yield-withdraw.js';
 import { prepareBridge, preparePerpOrder, preparePolymarketOrder, prepareSwap, } from './execution-tools.js';
 export const EXECUTION_TOOL_ANNOTATIONS = Object.freeze({
     readOnlyHint: true,
@@ -46,6 +52,18 @@ export async function callExecutionDefinition(runtime, definition, rawInput, sig
         return executionErrorResult(error);
     }
 }
+export async function callYieldDefinition(prepare, runtime, rawInput, signal) {
+    try {
+        const output = await prepare(runtime, rawInput, signal);
+        return {
+            content: [{ type: 'text', text: stringify(output) }],
+            structuredContent: output,
+        };
+    }
+    catch (error) {
+        return executionErrorResult(error);
+    }
+}
 function delegatedSuccessResult(result) {
     return {
         content: [{ type: 'text', text: stringify(result) }],
@@ -72,6 +90,7 @@ const DELEGATION_ADMIN_TOOLS = [
     { definition: DELEGATION_FENCE_TOOL_DEFINITION, run: ensureDelegationFence },
     { definition: DELEGATION_STATUS_TOOL_DEFINITION, run: readDelegationStatus },
     { definition: DELEGATION_REVOKE_TOOL_DEFINITION, run: revokeDelegation },
+    { definition: DELEGATION_CAP_TOOL_DEFINITION, run: reserveDelegationCap },
 ];
 export async function callDelegationAdminDefinition(runtime, run, rawInput, headers) {
     try {
@@ -107,6 +126,30 @@ export function registerExecutionTools(server, runtime, admission) {
             return admission ? admission.run(call) : call();
         });
     }
+    // The Yield Copilot deposit constructor: registered where the delegated services are (it needs the
+    // rig's Base client for the vault's previewDeposit), read-only like every other prepare tool.
+    // Registered wherever the delegated set is; without a vault reader the tool refuses by name.
+    if (runtime.delegation) {
+        for (const yieldTool of [
+            { definition: YIELD_DEPOSIT_TOOL_DEFINITION, prepare: prepareYieldDeposit },
+            { definition: YIELD_WITHDRAW_TOOL_DEFINITION, prepare: prepareYieldWithdraw },
+            // The tokenized-stock buy constructor rides the same registration block: it needs the rig's
+            // Base client for the equity's Chainlink mark; without a reader it refuses by name.
+            { definition: STOCK_BUY_TOOL_DEFINITION, prepare: prepareStockBuy },
+        ]) {
+            const { definition, prepare } = yieldTool;
+            server.registerTool(definition.name, {
+                title: definition.title,
+                description: definition.description + freshness,
+                inputSchema: definition.inputSchema,
+                outputSchema: definition.outputSchema,
+                annotations: EXECUTION_TOOL_ANNOTATIONS,
+            }, (input, extra) => {
+                const call = () => callYieldDefinition(prepare, runtime, input, extra.signal);
+                return admission ? admission.run(call) : call();
+            });
+        }
+    }
     // The one tool that submits: registered only when the runtime carries the delegated services, with
     // its own (non-read-only) annotations, through the same per-identity admission as the prepare tools.
     if (runtime.delegation) {