otto-intel-mcp 0.1.2 → 0.1.3

package/dist/execution-tools.d.ts

@@ -1,9 +1,13 @@
 import { type ExecutionServiceConfig } from './execution-config.js';
 import { type DelegationServices } from './execution-delegation.js';
+import { type RouteSimulator } from './adapter/route-simulator.js';
+import { type PrepareSwapInput } from './execution-tool-definitions.js';
 import { type BridgeExecutionEnvelope, type ExecutionEnvelope, type HyperliquidExecutionEnvelope, type PolymarketExecutionEnvelope } from './execution-types.js';
 import { type HyperliquidInfoClient } from './hyperliquid-info-client.js';
 import { type UnsignedHyperliquidAction, type UnsignedHyperliquidActionRequest } from './hyperliquid-order-builder.js';
-import { type LiFiQuoteClient } from './lifi-execution-client.js';
+import { type LiFiQuote, type LiFiQuoteClient } from './lifi-execution-client.js';
+import type { YieldVaultReader } from './yield-deposit-definition.js';
+import type { EquityOracleReader } from './stock-buy-definition.js';
 import { type PolymarketClobClient } from './polymarket-clob-client.js';
 import { type UnsignedPolymarketOrder, type UnsignedPolymarketOrderRequest } from './polymarket-order-builder.js';
 /** The order-construction seam: request in, unsigned SDK-built order out. */
@@ -37,8 +41,27 @@ export interface ExecutionToolRuntime {
      * this process prepared (`prepared-artifacts.ts`).
      */
     readonly delegation?: DelegationServices;
+    /**
+     * Proves a quoted swap's calldata executes from the signing account BEFORE it is prepared
+     * (`adapter/route-simulator.ts`). Present on a server booted with a Base RPC (the delegated rail's);
+     * absent elsewhere, in which case the envelope records `route_simulated:false`.
+     */
+    readonly routeSimulator?: RouteSimulator;
+    /**
+     * The one on-chain read `otto_prepare_yield_deposit` needs (the vault's own `previewDeposit`), present
+     * on the hosted service over the delegation rig's Base public client; injectable so the parity guard is
+     * mutation-provable. Absent → the yield constructor refuses by name, nothing is prepared.
+     */
+    readonly yieldVaultReader?: YieldVaultReader;
+    /**
+     * The one on-chain read `otto_prepare_stock_buy` needs (the equity's Chainlink mark), present on the
+     * hosted service over the same Base public client; injectable so the parity guard is mutation-provable.
+     * Absent → the stock constructor refuses by name, nothing is prepared.
+     */
+    readonly equityOracleReader?: EquityOracleReader;
 }
 export interface ExecutionRuntimeOverrides {
+    readonly routeSimulator?: RouteSimulator;
     readonly quoteClient?: LiFiQuoteClient;
     readonly clobClient?: PolymarketClobClient;
     readonly polymarketOrderBuilder?: PolymarketOrderBuilder;
@@ -48,6 +71,8 @@ export interface ExecutionRuntimeOverrides {
     readonly entropy?: () => Uint8Array;
     readonly clientOrderIdEntropy?: () => Uint8Array;
     readonly delegation?: DelegationServices;
+    readonly yieldVaultReader?: YieldVaultReader;
+    readonly equityOracleReader?: EquityOracleReader;
 }
 export declare function createExecutionToolRuntime(config: ExecutionServiceConfig, overrides?: ExecutionRuntimeOverrides): ExecutionToolRuntime;
 export declare function createExecutionToolRuntimeFromEnv(env?: NodeJS.ProcessEnv): ExecutionToolRuntime | undefined;
@@ -58,7 +83,25 @@ export declare function createExecutionToolRuntimeFromEnv(env?: NodeJS.ProcessEn
  * the tool.
  */
 export declare function createExecutionToolRuntimeWithDelegationFromEnv(env?: NodeJS.ProcessEnv): Promise<ExecutionToolRuntime | undefined>;
+/** How many LI.FI tools the constructor will try before it refuses: the first quote plus two re-quotes. */
+export declare const MAX_ROUTE_ATTEMPTS: 3;
 export declare function prepareSwap(runtime: ExecutionToolRuntime, rawInput: unknown, signal?: AbortSignal): Promise<ExecutionEnvelope>;
+/**
+ * The route-set and fee pre-checks, then ONE LI.FI quote for the parsed swap input. Split from
+ * `prepareSwapFromQuote` so a constructor that must read the quote itself (the Yield Copilot deposit:
+ * expected shares, the router's floor, the fee lines) quotes exactly once and builds the envelope from
+ * that same quote — a second quote could route through a different tool and carry a different floor.
+ */
+export declare function quoteSwap(runtime: ExecutionToolRuntime, input: PrepareSwapInput, signal?: AbortSignal): Promise<ExecutableSwapQuote>;
+/** A LI.FI quote as `quoteSwap` returns it: the quote plus the route facts the envelope records. */
+export type ExecutableSwapQuote = LiFiQuote & {
+    readonly route: {
+        readonly tool: string;
+        readonly simulated: boolean;
+    };
+};
+/** Decode, assert and commit the envelope for a parsed swap input over the quote `quoteSwap` returned for it. */
+export declare function prepareSwapFromQuote(runtime: ExecutionToolRuntime, input: PrepareSwapInput, quote: LiFiQuote | ExecutableSwapQuote): ExecutionEnvelope;
 /**
  * Build the ordered source-chain plan for a cross-chain native-USDC bridge over the enumerated v1
  * Circle-CCTP route set. Prepare-only: the plan is handed to the caller's own custody to sign.

package/dist/execution-tools.js

@@ -4,6 +4,7 @@ import { attributedFeeAmount, HL_BUILDER_ATTRIBUTION_STATUS, HYPERLIQUID_L1_SIGN
 import { refuse } from './execution-errors.js';
 import { createDelegationServicesFromEnv, } from './execution-delegation.js';
 import { recordPreparedArtifact } from './prepared-artifacts.js';
+import { createRouteSimulator } from './adapter/route-simulator.js';
 import { swapIntentDigestInput } from './execution-intent.js';
 import { BRIDGE_EXECUTION_ENVELOPE_SCHEMA, EXECUTION_ENVELOPE_SCHEMA, HYPERLIQUID_EXECUTION_ENVELOPE_SCHEMA, POLYMARKET_EXECUTION_ENVELOPE_SCHEMA, PREPARE_BRIDGE_INPUT_SCHEMA, PREPARE_PERP_ORDER_INPUT_SCHEMA, PREPARE_POLYMARKET_ORDER_INPUT_SCHEMA, PREPARE_SWAP_INPUT_SCHEMA, } from './execution-tool-definitions.js';
 import { accountBinding, artifactCommitmentDigest, bridgeAccountBinding, createArtifactId, executionDigest, hyperliquidAccountBinding, polymarketAccountBinding, } from './execution-types.js';
@@ -11,8 +12,12 @@ import { RestHyperliquidInfoClient, } from './hyperliquid-info-client.js';
 import { assertHyperliquidBracketCoherent, assertHyperliquidPriceOnGrid, assertHyperliquidSizeOnGrid, decodeAndAssertHyperliquidAction, hyperliquidSigningDeclaration, } from './hyperliquid-order-assertions.js';
 import { buildUnsignedHyperliquidOrderAction, } from './hyperliquid-order-builder.js';
 import { decodeAndAssertLiFiBridge } from './lifi-bridge-assertions.js';
-import { RestLiFiQuoteClient } from './lifi-execution-client.js';
+import { RestLiFiQuoteClient, } from './lifi-execution-client.js';
 import { decodeAndAssertLiFiSwap } from './lifi-swap-assertions.js';
+import { modelBWithdrawToken } from './execution-delegation-policy.js';
+import { viemYieldVaultReader } from './yield-withdraw.js';
+import { viemEquityOracleReader } from './stock-buy-oracle.js';
+import { EXECUTABLE_EQUITY_TOKEN_SET } from './executable-equities.js';
 import { RestPolymarketClobClient } from './polymarket-clob-client.js';
 import { assertPolymarketBuilderAttributionRuled, assertPolymarketPriceOnTick, decodeAndAssertPolymarketOrder, polymarketAtomicUnits, } from './polymarket-order-assertions.js';
 import { buildUnsignedPolymarketOrder, } from './polymarket-order-builder.js';
@@ -31,6 +36,9 @@ export function createExecutionToolRuntime(config, overrides = {}) {
         entropy: overrides.entropy ?? (() => randomBytes(10)),
         clientOrderIdEntropy: overrides.clientOrderIdEntropy ?? (() => randomBytes(16)),
         ...(overrides.delegation ? { delegation: overrides.delegation } : {}),
+        ...(overrides.routeSimulator ? { routeSimulator: overrides.routeSimulator } : {}),
+        ...(overrides.yieldVaultReader ? { yieldVaultReader: overrides.yieldVaultReader } : {}),
+        ...(overrides.equityOracleReader ? { equityOracleReader: overrides.equityOracleReader } : {}),
     });
 }
 export function createExecutionToolRuntimeFromEnv(env = process.env) {
@@ -52,8 +60,21 @@ export async function createExecutionToolRuntimeWithDelegationFromEnv(env = proc
         }
         return undefined;
     }
-    return createExecutionToolRuntime(config, delegation ? { delegation } : {});
+    // The delegated rail's Base client doubles as the route simulator's view of the chain (#2125) and as
+    // the yield constructor's vault read and the stock constructor's Chainlink read (#2129).
+    return createExecutionToolRuntime(config, {
+        ...(delegation
+            ? {
+                delegation,
+                yieldVaultReader: viemYieldVaultReader(delegation.rig.rig.pub),
+                equityOracleReader: viemEquityOracleReader(delegation.rig.rig.pub),
+            }
+            : {}),
+        ...(delegation?.pub ? { routeSimulator: createRouteSimulator(delegation.pub) } : {}),
+    });
 }
+/** How many LI.FI tools the constructor will try before it refuses: the first quote plus two re-quotes. */
+export const MAX_ROUTE_ATTEMPTS = 3;
 function normalizedAddress(value) {
     return getAddress(value.toLowerCase());
 }
@@ -135,6 +156,29 @@ function capabilityFor(profile) {
 }
 export async function prepareSwap(runtime, rawInput, signal) {
     const input = PREPARE_SWAP_INPUT_SCHEMA.parse(rawInput);
+    /**
+     * 🔴 REGISTRY VAULT SHARES ARE EXCLUSIVE TO THE YIELD CONSTRUCTORS (codex gate r1 HIGH 2). A generic swap
+     * whose input or output is a Yield Copilot vault share would reach the delegated gate as an
+     * indistinguishable `operation: 'swap'` artifact and be admitted as a deposit/withdraw WITHOUT the registry
+     * commitment and the vault-parity guard the yield constructors run. So this public constructor refuses that
+     * token class by name; `otto_prepare_yield_deposit` / `otto_prepare_yield_withdraw` are the only paths.
+     */
+    for (const token of [input.fromToken, input.toToken]) {
+        if (modelBWithdrawToken(normalizedAddress(token))) {
+            return refuse('UNSUPPORTED_LIFI_ROUTE', `${token} is a Yield Copilot vault share token; use otto_prepare_yield_deposit / otto_prepare_yield_withdraw, which pin the registry row and check vault parity`);
+        }
+        // Same discipline for the executable equities (2026-09-03): a generic swap into a B20 token would
+        // reach the delegated gate as an indistinguishable swap artifact WITHOUT the registry commitment,
+        // the Chainlink price-parity guard and the freshness gate. The stock constructor is the only path.
+        if (EXECUTABLE_EQUITY_TOKEN_SET.has(token.toLowerCase())) {
+            return refuse('UNSUPPORTED_LIFI_ROUTE', `${token} is an executable tokenized equity; use otto_prepare_stock_buy, which pins the registry row and checks price parity against the equity's own Chainlink mark`);
+        }
+    }
+    const quote = await quoteSwap(runtime, input, signal);
+    return prepareSwapFromQuote(runtime, input, quote);
+}
+/** The swap's account profile, normalized; refuses a profile whose chain is not the swap's chain. */
+function swapProfile(input) {
     const profile = {
         kind: input.accountProfile.kind,
         address: normalizedAddress(input.accountProfile.address),
@@ -143,24 +187,114 @@ export async function prepareSwap(runtime, rawInput, signal) {
     if (profile.chainId !== input.chainId) {
         return refuse('ACCOUNT_BINDING_MISMATCH', 'account profile chain does not match swap chain');
     }
+    return profile;
+}
+/**
+ * The route-set and fee pre-checks, then ONE LI.FI quote for the parsed swap input. Split from
+ * `prepareSwapFromQuote` so a constructor that must read the quote itself (the Yield Copilot deposit:
+ * expected shares, the router's floor, the fee lines) quotes exactly once and builds the envelope from
+ * that same quote — a second quote could route through a different tool and carry a different floor.
+ */
+export async function quoteSwap(runtime, input, signal) {
+    const profile = swapProfile(input);
     if (!reviewedLiFiFeeForwarders(input.chainId)) {
         return refuse('UNSUPPORTED_LIFI_ROUTE', 'chain is outside the reviewed LI.FI v1 route set');
     }
-    const fromToken = normalizedAddress(input.fromToken);
-    const toToken = normalizedAddress(input.toToken);
     const fromAmount = BigInt(input.fromAmount);
     if (attributedFeeAmount(fromAmount, runtime.config.lifiFee) <= 0n) {
         return refuse('UNSUPPORTED_LIFI_ROUTE', 'input amount is too small for the configured Otto fee');
     }
-    const quote = await runtime.quoteClient.getSameChainSwapQuote({
-        chainId: input.chainId,
-        fromToken,
-        toToken,
-        fromAmount: input.fromAmount,
-        sender: profile.address,
-        receiver: profile.address,
-        maxSlippageBps: input.slippage.maxBps,
-    }, signal);
+    /**
+     * ══════════════════════════════════════════════════════════════════════════════════════════════
+     * 🔴 A ROUTE IS QUOTED ONLY ONCE IT HAS BEEN SEEN TO EXECUTE (2026-09-03, the first live delegated swap)
+     * ══════════════════════════════════════════════════════════════════════════════════════════════
+     * LI.FI picks the exchange tool per quote. That day it picked KyberSwap for a $1 USDC→WETH swap, and
+     * the diamond call reverted deterministically — at any gas, on a fresh quote too — while the same
+     * request through SushiSwap executed. Every assertion the constructor makes is about SHAPE (selector,
+     * receiver, fee, minimum output); none of them can see that a tool's calldata fails inside the diamond.
+     *
+     * So, on a server that has a chain view (the delegated rail's Base client), the quoted swap step is
+     * SIMULATED from the executing account with its preconditions overridden (balance and allowance to the
+     * spender — neither exists at prepare time). A route that reverts is re-quoted with that tool DENIED,
+     * bounded to `MAX_ROUTE_ATTEMPTS` tools; if none executes the quote refuses and names them. A
+     * simulation that cannot be run (no layout for the token, a node that ignores overrides) refuses too —
+     * an unproven route is not prepared on a server that was supposed to prove it.
+     *
+     * It lives HERE, in the one quote every swap-shaped constructor takes — the public swap and the Yield
+     * Copilot deposit/withdraw alike — so the quote a caller reads (expected shares, the floor, the fee
+     * lines) IS the quote that was proven, and `prepareSwapFromQuote` builds the envelope from exactly it.
+     * The proven tool and whether it was simulated ride on the returned quote (`route`), are recorded in
+     * the envelope's assertions, and the delegated receipt repeats them, so the receipt says which venue
+     * executed. A server without a chain view (the prepare-only x402 constructor) quotes as before and
+     * records `route_simulated:false`.
+     */
+    const fromToken = normalizedAddress(input.fromToken);
+    const toToken = normalizedAddress(input.toToken);
+    const denied = [];
+    for (let attempt = 1; attempt <= MAX_ROUTE_ATTEMPTS; attempt += 1) {
+        const quote = await runtime.quoteClient.getSameChainSwapQuote({
+            chainId: input.chainId,
+            fromToken,
+            toToken,
+            fromAmount: input.fromAmount,
+            sender: profile.address,
+            receiver: profile.address,
+            maxSlippageBps: input.slippage.maxBps,
+            // A COPY: the quote client must never see this list grow after it answered.
+            ...(denied.length > 0 ? { denyExchanges: Object.freeze([...denied]) } : {}),
+        }, signal);
+        const routeTool = typeof quote.tool === 'string' && quote.tool.trim() ? quote.tool.trim().slice(0, 48) : 'unknown';
+        if (!runtime.routeSimulator) {
+            return Object.freeze({ ...quote, route: Object.freeze({ tool: routeTool, simulated: false }) });
+        }
+        /**
+         * 🔴 SHAPE BEFORE SIMULATION (merge gate 2026-09-04). The quote is decoded and asserted HERE, on the
+         * quote-stage input, before the node sees it: a quote whose spender or target is not the diamond, whose
+         * selector, receiver, fee or floor is wrong, is refused by the assertion — it is never simulated, and a
+         * simulation that failed only because the quote's own `approvalAddress` was wrong can never deny a
+         * healthy tool. What the node simulates is the ASSERTED transaction and spender, the same bytes
+         * `prepareSwapFromQuote` asserts again (with the caller's floor) when it builds the envelope.
+         */
+        const asserted = decodeAndAssertLiFiSwap({
+            quote,
+            profile,
+            chainId: input.chainId,
+            fromToken,
+            toToken,
+            fromAmount,
+            maxSlippageBps: input.slippage.maxBps,
+            minAmountOut: input.slippage.minAmountOut ? BigInt(input.slippage.minAmountOut) : undefined,
+            config: runtime.config,
+        });
+        const simulation = await runtime.routeSimulator.simulate({
+            from: profile.address,
+            to: asserted.transaction.to,
+            data: asserted.transaction.data,
+            value: BigInt(asserted.transaction.value),
+            token: fromToken,
+            spender: asserted.approvalSpender,
+            amount: fromAmount,
+        });
+        if (simulation.outcome === 'ok') {
+            return Object.freeze({ ...quote, route: Object.freeze({ tool: routeTool, simulated: true }) });
+        }
+        if (simulation.outcome === 'unavailable') {
+            return refuse('UNSUPPORTED_LIFI_ROUTE', `[ROUTE_SIMULATION_UNAVAILABLE] the quoted route could not be simulated from ${profile.address}, so it is not prepared: ${simulation.detail}`);
+        }
+        denied.push(routeTool);
+        // A tool LI.FI did not name cannot be denied on the next quote; re-asking would only repeat it.
+        if (attempt === MAX_ROUTE_ATTEMPTS || routeTool === 'unknown') {
+            return refuse('UNSUPPORTED_LIFI_ROUTE', `[ROUTE_SIMULATION_REVERTED] no LI.FI route executes from ${profile.address} for this swap: tried ${denied.join(', ')} (last: ${simulation.detail})`);
+        }
+    }
+    return refuse('UNSUPPORTED_LIFI_ROUTE', 'no LI.FI quote was obtained');
+}
+/** Decode, assert and commit the envelope for a parsed swap input over the quote `quoteSwap` returned for it. */
+export function prepareSwapFromQuote(runtime, input, quote) {
+    const profile = swapProfile(input);
+    const fromToken = normalizedAddress(input.fromToken);
+    const toToken = normalizedAddress(input.toToken);
+    const fromAmount = BigInt(input.fromAmount);
     const asserted = decodeAndAssertLiFiSwap({
         quote,
         profile,
@@ -172,6 +306,13 @@ export async function prepareSwap(runtime, rawInput, signal) {
         minAmountOut: input.slippage.minAmountOut ? BigInt(input.slippage.minAmountOut) : undefined,
         config: runtime.config,
     });
+    // The route facts `quoteSwap` proved; a bare quote (a caller that quoted elsewhere) was not simulated.
+    const route = quote.route ?? {
+        tool: typeof quote.tool === 'string' && quote.tool.trim() ? quote.tool.trim().slice(0, 48) : 'unknown',
+        simulated: false,
+    };
+    const routeTool = route.tool;
+    const routeSimulated = route.simulated;
     const capability = capabilityFor(profile);
     const approvalCalldata = (amount) => encodeFunctionData({
         abi: ERC20_APPROVE_ABI,
@@ -230,6 +371,9 @@ export async function prepareSwap(runtime, rawInput, signal) {
         },
         assertions: [
             ...asserted.assertions,
+            // The route that was prepared, and whether it was proven to execute — repeated on the delegated receipt.
+            { id: `route_tool:${routeTool}`, result: 'passed' },
+            { id: `route_simulated:${routeSimulated}`, result: 'passed' },
             { id: 'payload_digest_committed', result: 'passed' },
             { id: 'erc20_allowance_reset_ordered', result: 'passed' },
             { id: 'artifact_expiry_committed', result: 'passed' },

package/dist/lifi-execution-client.d.ts

@@ -39,6 +39,12 @@ export interface SameChainSwapQuoteRequest {
     readonly sender: string;
     readonly receiver: string;
     readonly maxSlippageBps: number;
+    /**
+     * LI.FI exchange tools the quote must NOT route through. Set by the constructor when a tool's
+     * calldata failed the prepare-time simulation (2026-09-03: KyberSwap reverted from the diamond while
+     * SushiSwap executed); never a caller seam.
+     */
+    readonly denyExchanges?: readonly string[];
 }
 export interface CrossChainBridgeQuoteRequest {
     readonly fromChainId: number;

package/dist/lifi-execution-client.js

@@ -65,6 +65,9 @@ export function buildLiFiQuoteUrl(request, config) {
     ];
     for (const [name, value] of semanticFields)
         url.searchParams.append(name, value);
+    if (request.denyExchanges && request.denyExchanges.length > 0) {
+        url.searchParams.append('denyExchanges', request.denyExchanges.join(','));
+    }
     url.searchParams.append('integrator', LIFI_INTEGRATOR);
     url.searchParams.append('fee', config.lifiFee.decimal);
     return url;