otto-intel-mcp 0.1.2 → 0.1.4

package/dist/execution-policy-compatibility.d.ts

@@ -0,0 +1,34 @@
+/** SHA-256 over the canonical JSON of a policy rule list. */
+export declare function policyRulesDigest(rules: unknown): string;
+export interface LegacyCompatibleCompositePolicyPin {
+    readonly policyId: string;
+    readonly policyName: string;
+    readonly policyDigest: string;
+    readonly legacyRulesDigest: string;
+    readonly nativeRulesDigest: string;
+    readonly legacyRuleCount: number;
+}
+export interface LegacyCompatibleCompositePolicyRecord {
+    readonly id: string;
+    readonly description?: string;
+    readonly scope: string;
+    readonly rules: unknown;
+}
+export interface LegacyCompatibleCompositeIdentity {
+    readonly policyId: string;
+    readonly policyName: string;
+    readonly policyDigest: string;
+    readonly legacyRulesDigest: string;
+    readonly nativeRulesDigest: string;
+    readonly legacyRuleCount: number;
+    readonly nativeRuleCount: number;
+}
+/**
+ * Exact compatibility identities only. This does not change a provider policy or activate a new rail.
+ * The Muse identity preserves the five v2 rules; its separate provider-acceptance gate stays closed.
+ */
+export declare const MODEL_B_COMPOSITE_V3_COMPATIBILITY_PINS: readonly LegacyCompatibleCompositePolicyPin[];
+/** Pure validator used by activation review and focused mutation tests. */
+export declare function validateLegacyCompatibleCompositePolicy(policy: LegacyCompatibleCompositePolicyRecord, pin: LegacyCompatibleCompositePolicyPin, expectedLegacyRulesDigest: string, expectedLegacyRuleCount: number): LegacyCompatibleCompositeIdentity | null;
+/** Production lookup. There is deliberately no runtime or environment pin injection seam. */
+export declare function readBackPinnedLegacyCompatibleCompositePolicy(policy: LegacyCompatibleCompositePolicyRecord, expectedLegacyRulesDigest: string, expectedLegacyRuleCount: number): LegacyCompatibleCompositeIdentity | null;

package/dist/execution-policy-compatibility.js

@@ -0,0 +1,76 @@
+/** Exact, compile-time compatibility pins for projecting a composite policy to legacy callers. */
+import { createHash } from 'node:crypto';
+/** Sorted keys, undefined dropped, hex strings lowercased; arrays retain their order. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const item = value[key];
+            if (item !== undefined)
+                out[key] = canonical(item);
+        }
+        return out;
+    }
+    if (typeof value === 'string' && /^0x[0-9a-fA-F]+$/.test(value))
+        return value.toLowerCase();
+    return value;
+}
+/** SHA-256 over the canonical JSON of a policy rule list. */
+export function policyRulesDigest(rules) {
+    return createHash('sha256').update(JSON.stringify(canonical(rules))).digest('hex');
+}
+/**
+ * Exact compatibility identities only. This does not change a provider policy or activate a new rail.
+ * The Muse identity preserves the five v2 rules; its separate provider-acceptance gate stays closed.
+ */
+export const MODEL_B_COMPOSITE_V3_COMPATIBILITY_PINS = Object.freeze([Object.freeze({
+        policyId: 'df85c39c-9f86-462f-a4cd-409b24ba243a',
+        policyName: 'OTTO model b and research fence v1',
+        policyDigest: 'e17570b83e1a573dcb1506ccf3d28f2dd50a8d76d1331ddebc7b78d349094aee',
+        legacyRulesDigest: '426165e3fe1631d8d8dca5f52ab3ccc78bb2d63ab2e12c73b7c077e6d49941d8',
+        nativeRulesDigest: '2061be246a4ac84121026afa78c74e54644f007804d255933762dd3e7e2afa9f',
+        legacyRuleCount: 5,
+    })]);
+const DIGEST = /^[0-9a-f]{64}$/;
+/** Pure validator used by activation review and focused mutation tests. */
+export function validateLegacyCompatibleCompositePolicy(policy, pin, expectedLegacyRulesDigest, expectedLegacyRuleCount) {
+    if (policy.scope !== 'project' ||
+        policy.id !== pin.policyId ||
+        policy.description !== pin.policyName ||
+        !Array.isArray(policy.rules) ||
+        !Number.isSafeInteger(expectedLegacyRuleCount) ||
+        expectedLegacyRuleCount <= 0 ||
+        pin.legacyRuleCount !== expectedLegacyRuleCount ||
+        !DIGEST.test(expectedLegacyRulesDigest) ||
+        !DIGEST.test(pin.policyDigest) ||
+        !DIGEST.test(pin.legacyRulesDigest) ||
+        !DIGEST.test(pin.nativeRulesDigest) ||
+        pin.legacyRulesDigest !== expectedLegacyRulesDigest ||
+        policy.rules.length <= expectedLegacyRuleCount)
+        return null;
+    const legacyRules = policy.rules.slice(0, expectedLegacyRuleCount);
+    const nativeRules = policy.rules.slice(expectedLegacyRuleCount);
+    if (policyRulesDigest(policy.rules) !== pin.policyDigest ||
+        policyRulesDigest(legacyRules) !== expectedLegacyRulesDigest ||
+        policyRulesDigest(nativeRules) !== pin.nativeRulesDigest)
+        return null;
+    return Object.freeze({
+        policyId: pin.policyId,
+        policyName: pin.policyName,
+        policyDigest: pin.policyDigest,
+        legacyRulesDigest: pin.legacyRulesDigest,
+        nativeRulesDigest: pin.nativeRulesDigest,
+        legacyRuleCount: pin.legacyRuleCount,
+        nativeRuleCount: nativeRules.length,
+    });
+}
+/** Production lookup. There is deliberately no runtime or environment pin injection seam. */
+export function readBackPinnedLegacyCompatibleCompositePolicy(policy, expectedLegacyRulesDigest, expectedLegacyRuleCount) {
+    const matches = MODEL_B_COMPOSITE_V3_COMPATIBILITY_PINS
+        .map((pin) => validateLegacyCompatibleCompositePolicy(policy, pin, expectedLegacyRulesDigest, expectedLegacyRuleCount))
+        .filter((match) => match !== null);
+    return matches.length === 1 ? matches[0] : null;
+}
+//# sourceMappingURL=execution-policy-compatibility.js.map

package/dist/execution-registration.d.ts

@@ -1,6 +1,6 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
-import { ensureDelegationFence, readDelegationStatus, revokeDelegation } from './execution-delegation-admin.js';
+import { ensureDelegationFence, readDelegationStatus, reserveDelegationCap, revokeDelegation } from './execution-delegation-admin.js';
 import { type ExecutionToolDefinition } from './execution-tool-definitions.js';
 import { type ExecutionToolRuntime } from './execution-tools.js';
 export declare const EXECUTION_TOOL_ANNOTATIONS: Readonly<{
@@ -11,6 +11,7 @@ export declare const EXECUTION_TOOL_ANNOTATIONS: Readonly<{
 }>;
 export declare function executionErrorResult(error: unknown): CallToolResult;
 export declare function callExecutionDefinition(runtime: ExecutionToolRuntime, definition: ExecutionToolDefinition, rawInput: unknown, signal?: AbortSignal): Promise<CallToolResult>;
+export declare function callYieldDefinition(prepare: (runtime: ExecutionToolRuntime, rawInput: unknown, signal?: AbortSignal) => Promise<unknown>, runtime: ExecutionToolRuntime, rawInput: unknown, signal?: AbortSignal): Promise<CallToolResult>;
 /** A failure that is not a refusal is an upstream fault; nothing of it is relayed. */
 export declare function delegatedErrorResult(error: unknown): CallToolResult;
 /** The caller comes ONLY from the request headers; a value placed in the arguments is never consulted. */
@@ -47,7 +48,7 @@ declare const DELEGATION_ADMIN_TOOLS: readonly [{
     readonly definition: Readonly<{
         name: "otto_delegation_status";
         title: "Read one end user's delegation status (token-bound)";
-        description: `Read back, for the end user identified by a CDP access token, their CDP accounts, whether the Model-B fence is present, and whether an active delegation reads back (with its expiry). Arguments: { accessToken } \u2014 the server resolves the user from the token; a client-sent user id is refused. Output is bound to that user; nothing about any other user is returned. ${string}`;
+        description: `Read back, for the end user identified by a CDP access token, their CDP accounts, whether the Model-B fence is present, and whether an active delegation reads back (with its expiry and the per-swap cap recorded for it). Arguments: { accessToken } \u2014 the server resolves the user from the token; a client-sent user id is refused. delegation.per_swap_cap_usd is the number THIS user chose at mint time; it is ABSENT when no cap is recorded for the grant, which means the delegated send will refuse it \u2014 say so rather than showing the shared ceiling. fence.per_swap_cap_usd is that shared ceiling and is never a per-user number. Output is bound to that user; nothing about any other user is returned. ${string}`;
         inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
         strictInputSchema: import("zod").ZodObject<{
             accessToken: import("zod").ZodString;
@@ -64,8 +65,11 @@ declare const DELEGATION_ADMIN_TOOLS: readonly [{
             delegation: import("zod").ZodObject<{
                 active: import("zod").ZodBoolean;
                 expires_at: import("zod").ZodOptional<import("zod").ZodString>;
+                per_swap_cap_usd: import("zod").ZodOptional<import("zod").ZodNumber>;
             }, import("zod/v4/core").$strict>;
             revocation_requested_here: import("zod").ZodBoolean;
+            ruleset_version: import("zod").ZodNumber;
+            mint_enabled: import("zod").ZodBoolean;
         }, import("zod/v4/core").$strict>;
         annotations: Readonly<{
             readOnlyHint: true;
@@ -104,8 +108,56 @@ declare const DELEGATION_ADMIN_TOOLS: readonly [{
         }>;
     }>;
     readonly run: typeof revokeDelegation;
+}, {
+    readonly definition: Readonly<{
+        name: "otto_delegation_cap";
+        title: "Confirm an in-flight legacy Model B cap (new reservations retired)";
+        description: `Legacy Model B cap confirmation. New { phase: "reserve" } requests are retired and refused before any claim or reservation is written. { phase: "confirm", accessToken, mintKey } remains available for a permission already minted against a prior reservation: the server re-reads CDP and confirms only the exact still-current claim and reserved expiry. A mismatch or Stop overlap remains unconfirmed; a fresh explicit Stop handles the current grant. Without a confirmed per-user cap, delegated sends refuse. This tool does not issue new permissions. ${string}`;
+        inputSchema: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
+        strictInputSchema: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            phase: import("zod").ZodLiteral<"reserve">;
+            accessToken: import("zod").ZodString;
+            perSwapCapUsd: import("zod").ZodNumber;
+            requestedDays: import("zod").ZodNumber;
+            mintKey: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            phase: import("zod").ZodLiteral<"confirm">;
+            accessToken: import("zod").ZodString;
+            mintKey: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>], "phase">;
+        outputSchema: import("zod").ZodObject<{
+            phase: import("zod").ZodEnum<{
+                reserve: "reserve";
+                confirm: "confirm";
+            }>;
+            user_id: import("zod").ZodString;
+            expires_at: import("zod").ZodString;
+            mint_expires_at: import("zod").ZodOptional<import("zod").ZodString>;
+            per_swap_cap_usd: import("zod").ZodNumber;
+            state: import("zod").ZodEnum<{
+                revoked: "revoked";
+                superseded: "superseded";
+                reserved: "reserved";
+                confirmed_active: "confirmed_active";
+                expired: "expired";
+                legacy: "legacy";
+            }>;
+            ruleset_version: import("zod").ZodNumber;
+            recorded: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strict>;
+        annotations: Readonly<{
+            readOnlyHint: false;
+            destructiveHint: false;
+            idempotentHint: true;
+            openWorldHint: true;
+        }>;
+    }>;
+    readonly run: typeof reserveDelegationCap;
 }];
 export declare function callDelegationAdminDefinition(runtime: ExecutionToolRuntime, run: (typeof DELEGATION_ADMIN_TOOLS)[number]['run'], rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined): Promise<CallToolResult>;
+export declare function callDelegationOperationsDefinition(runtime: ExecutionToolRuntime, rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined): Promise<CallToolResult>;
+export declare function callDelegationReconcileDefinition(runtime: ExecutionToolRuntime, rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined): Promise<CallToolResult>;
+export declare function callDelegationExitDefinition(runtime: ExecutionToolRuntime, rawInput: unknown, headers: Readonly<Record<string, string | string[] | undefined>> | undefined): Promise<CallToolResult>;
 export interface ExecutionCallAdmission {
     run(call: () => Promise<CallToolResult>): Promise<CallToolResult>;
 }

package/dist/execution-registration.js

@@ -1,10 +1,26 @@
+import { callLpUserOp } from './lp-userop-registration.js';
+import { LP_USEROP_TOOL_DEFINITION } from './lp-userop-mcp-definition.js';
+import { callNativeYieldUserOp } from './native-yield-userop-registration.js';
+import { NATIVE_USEROP_TOOL_DEFINITION } from './native-yield-userop-mcp-definition.js';
+import { callSponsoredAccount } from './execution-sponsored-registration.js';
+import { SPONSORED_TOOL_DEFINITION } from './execution-sponsored-mcp-definition.js';
 import { ExecutionRefusal, isExecutionRefusal } from './execution-errors.js';
 import { DELEGATED_EXECUTION_TOOL_DEFINITION, DELEGATED_TOOL_ANNOTATIONS, } from './execution-delegated-definition.js';
 import { callerFromHeaders, submitUnderDelegation } from './execution-delegation.js';
-import { DELEGATION_FENCE_STATUS_TOOL_DEFINITION, DELEGATION_FENCE_TOOL_DEFINITION, DELEGATION_REVOKE_TOOL_DEFINITION, DELEGATION_STATUS_TOOL_DEFINITION, } from './execution-delegation-admin-definition.js';
-import { ensureDelegationFence, readDelegationFenceStatus, readDelegationStatus, revokeDelegation, } from './execution-delegation-admin.js';
+import { DELEGATION_CAP_TOOL_DEFINITION, DELEGATION_FENCE_STATUS_TOOL_DEFINITION, DELEGATION_FENCE_TOOL_DEFINITION, DELEGATION_REVOKE_TOOL_DEFINITION, DELEGATION_STATUS_TOOL_DEFINITION, } from './execution-delegation-admin-definition.js';
+import { ensureDelegationFence, readDelegationFenceStatus, readDelegationStatus, reserveDelegationCap, revokeDelegation, } from './execution-delegation-admin.js';
+import { DELEGATION_OPERATIONS_TOOL_DEFINITION, DELEGATION_RECONCILE_TOOL_DEFINITION, } from './execution-delegation-operations-definition.js';
+import { readDelegationOperations, reconcileDelegationOperation } from './execution-delegation-operations.js';
+import { DELEGATION_EXIT_TOOL_DEFINITION, } from './execution-delegation-exit-definition.js';
+import { runDelegationExit } from './execution-delegation-exit.js';
 import { EXECUTION_TOOL_DEFINITIONS, } from './execution-tool-definitions.js';
-import { prepareBridge, preparePerpOrder, preparePolymarketOrder, prepareSwap, } from './execution-tools.js';
+import { YIELD_DEPOSIT_TOOL_DEFINITION } from './yield-deposit-definition.js';
+import { prepareYieldDeposit } from './yield-deposit.js';
+import { STOCK_BUY_TOOL_DEFINITION } from './stock-buy-definition.js';
+import { prepareStockBuy } from './stock-buy.js';
+import { YIELD_WITHDRAW_TOOL_DEFINITION } from './yield-withdraw-definition.js';
+import { prepareYieldWithdraw } from './yield-withdraw.js';
+import { prepareBridge, preparePolymarketOrder, prepareSwap, } from './execution-tools.js';
 export const EXECUTION_TOOL_ANNOTATIONS = Object.freeze({
     readOnlyHint: true,
     destructiveHint: false,
@@ -39,13 +55,25 @@ export async function callExecutionDefinition(runtime, definition, rawInput, sig
             case 'otto_prepare_polymarket_order':
                 return successResult(await preparePolymarketOrder(runtime, rawInput, signal));
             case 'otto_prepare_perp_order':
-                return successResult(await preparePerpOrder(runtime, rawInput, signal));
+                throw new ExecutionRefusal('HYPERLIQUID_RETIRED', 'Hyperliquid trading is retired from public MCP; existing-account recovery uses the protected recovery interface');
         }
     }
     catch (error) {
         return executionErrorResult(error);
     }
 }
+export async function callYieldDefinition(prepare, runtime, rawInput, signal) {
+    try {
+        const output = await prepare(runtime, rawInput, signal);
+        return {
+            content: [{ type: 'text', text: stringify(output) }],
+            structuredContent: output,
+        };
+    }
+    catch (error) {
+        return executionErrorResult(error);
+    }
+}
 function delegatedSuccessResult(result) {
     return {
         content: [{ type: 'text', text: stringify(result) }],
@@ -72,6 +100,7 @@ const DELEGATION_ADMIN_TOOLS = [
     { definition: DELEGATION_FENCE_TOOL_DEFINITION, run: ensureDelegationFence },
     { definition: DELEGATION_STATUS_TOOL_DEFINITION, run: readDelegationStatus },
     { definition: DELEGATION_REVOKE_TOOL_DEFINITION, run: revokeDelegation },
+    { definition: DELEGATION_CAP_TOOL_DEFINITION, run: reserveDelegationCap },
 ];
 export async function callDelegationAdminDefinition(runtime, run, rawInput, headers) {
     try {
@@ -85,6 +114,42 @@ export async function callDelegationAdminDefinition(runtime, run, rawInput, head
         return delegatedErrorResult(error);
     }
 }
+export async function callDelegationOperationsDefinition(runtime, rawInput, headers) {
+    try {
+        const result = await readDelegationOperations(runtime, rawInput, callerFromHeaders(headers));
+        return {
+            content: [{ type: 'text', text: stringify(result) }],
+            structuredContent: result,
+        };
+    }
+    catch (error) {
+        return delegatedErrorResult(error);
+    }
+}
+export async function callDelegationReconcileDefinition(runtime, rawInput, headers) {
+    try {
+        const result = await reconcileDelegationOperation(runtime, rawInput, callerFromHeaders(headers));
+        return {
+            content: [{ type: 'text', text: stringify(result) }],
+            structuredContent: result,
+        };
+    }
+    catch (error) {
+        return delegatedErrorResult(error);
+    }
+}
+export async function callDelegationExitDefinition(runtime, rawInput, headers) {
+    try {
+        const result = await runDelegationExit(runtime, rawInput, callerFromHeaders(headers));
+        return {
+            content: [{ type: 'text', text: stringify(result) }],
+            structuredContent: result,
+        };
+    }
+    catch (error) {
+        return delegatedErrorResult(error);
+    }
+}
 export function registerExecutionTools(server, runtime, admission) {
     // The freshness window is stated in the description from the runtime's OWN config — never a literal:
     // the 0.1.1 docs said "10 minutes" (the ceiling) while every hosted envelope carried 5 (the default),
@@ -107,9 +172,49 @@ export function registerExecutionTools(server, runtime, admission) {
             return admission ? admission.run(call) : call();
         });
     }
+    // The Yield Copilot deposit constructor: registered where the delegated services are (it needs the
+    // rig's Base client for the vault's previewDeposit), read-only like every other prepare tool.
+    // Registered wherever the delegated set is; without a vault reader the tool refuses by name.
+    if (runtime.delegation) {
+        for (const yieldTool of [
+            { definition: YIELD_DEPOSIT_TOOL_DEFINITION, prepare: prepareYieldDeposit },
+            { definition: YIELD_WITHDRAW_TOOL_DEFINITION, prepare: prepareYieldWithdraw },
+            // The tokenized-stock buy constructor rides the same registration block: it needs the rig's
+            // Base client for the equity's Chainlink mark; without a reader it refuses by name.
+            { definition: STOCK_BUY_TOOL_DEFINITION, prepare: prepareStockBuy },
+        ]) {
+            const { definition, prepare } = yieldTool;
+            server.registerTool(definition.name, {
+                title: definition.title,
+                description: definition.description + freshness,
+                inputSchema: definition.inputSchema,
+                outputSchema: definition.outputSchema,
+                annotations: EXECUTION_TOOL_ANNOTATIONS,
+            }, (input, extra) => {
+                const call = () => callYieldDefinition(prepare, runtime, input, extra.signal);
+                return admission ? admission.run(call) : call();
+            });
+        }
+    }
     // The one tool that submits: registered only when the runtime carries the delegated services, with
     // its own (non-read-only) annotations, through the same per-identity admission as the prepare tools.
     if (runtime.delegation) {
+        const sponsored = SPONSORED_TOOL_DEFINITION;
+        server.registerTool(sponsored.name, {
+            title: sponsored.title, description: sponsored.description, inputSchema: sponsored.inputSchema,
+            outputSchema: sponsored.outputSchema, annotations: sponsored.annotations,
+        }, (input, extra) => {
+            const call = () => callSponsoredAccount(runtime, input, extra.requestInfo?.headers);
+            return admission ? admission.run(call) : call();
+        });
+        const nativeUserOp = NATIVE_USEROP_TOOL_DEFINITION;
+        server.registerTool(nativeUserOp.name, {
+            title: nativeUserOp.title, description: nativeUserOp.description, inputSchema: nativeUserOp.inputSchema,
+            outputSchema: nativeUserOp.outputSchema, annotations: nativeUserOp.annotations,
+        }, (input, extra) => {
+            const call = () => callNativeYieldUserOp(runtime, input, extra.requestInfo?.headers);
+            return admission ? admission.run(call) : call();
+        });
         const definition = DELEGATED_EXECUTION_TOOL_DEFINITION;
         server.registerTool(definition.name, {
             title: definition.title,
@@ -148,7 +253,7 @@ export function registerExecutionTools(server, runtime, admission) {
                 return admission ? admission.run(call) : call();
             });
         }
-        // The three admin tools (PR-1b): fence ensure-by-digest, token-bound status, developer-side revoke.
+        // The four admin tools: fence ensure-by-digest, token-bound status, developer-side revoke and cap state.
         for (const { definition: admin, run } of DELEGATION_ADMIN_TOOLS) {
             server.registerTool(admin.name, {
                 title: admin.title,
@@ -161,6 +266,47 @@ export function registerExecutionTools(server, runtime, admission) {
                 return admission ? admission.run(call) : call();
             });
         }
+        const operations = DELEGATION_OPERATIONS_TOOL_DEFINITION;
+        server.registerTool(operations.name, {
+            title: operations.title,
+            description: operations.description,
+            inputSchema: operations.inputSchema,
+            outputSchema: operations.outputSchema,
+            annotations: operations.annotations,
+        }, (input, extra) => {
+            const call = () => callDelegationOperationsDefinition(runtime, input, extra.requestInfo?.headers);
+            return admission ? admission.run(call) : call();
+        });
+        const reconcile = DELEGATION_RECONCILE_TOOL_DEFINITION;
+        server.registerTool(reconcile.name, {
+            title: reconcile.title,
+            description: reconcile.description,
+            inputSchema: reconcile.inputSchema,
+            outputSchema: reconcile.outputSchema,
+            annotations: reconcile.annotations,
+        }, (input, extra) => {
+            const call = () => callDelegationReconcileDefinition(runtime, input, extra.requestInfo?.headers);
+            return admission ? admission.run(call) : call();
+        });
+        const exit = DELEGATION_EXIT_TOOL_DEFINITION;
+        server.registerTool(exit.name, {
+            title: exit.title,
+            description: exit.description,
+            inputSchema: exit.inputSchema,
+            outputSchema: exit.outputSchema,
+            annotations: exit.annotations,
+        }, (input, extra) => {
+            const call = () => callDelegationExitDefinition(runtime, input, extra.requestInfo?.headers);
+            return admission ? admission.run(call) : call();
+        });
+        const lpUserOp = LP_USEROP_TOOL_DEFINITION;
+        server.registerTool(lpUserOp.name, {
+            title: lpUserOp.title, description: lpUserOp.description, inputSchema: lpUserOp.inputSchema,
+            outputSchema: lpUserOp.outputSchema, annotations: lpUserOp.annotations,
+        }, (input, extra) => {
+            const call = () => callLpUserOp(runtime, input, extra.requestInfo?.headers);
+            return admission ? admission.run(call) : call();
+        });
     }
 }
 //# sourceMappingURL=execution-registration.js.map

package/dist/execution-sponsored-account-profile.d.ts

@@ -0,0 +1,32 @@
+/** Fixed-block, read-only proof for the reviewed same-address sponsored account family. */
+import { type Address, type Hex, type PublicClient } from 'viem';
+export declare const SPONSORED_ACCOUNT_PROXY: `0x${string}`;
+export declare const SPONSORED_ACCOUNT_IMPLEMENTATION: `0x${string}`;
+export declare const SPONSORED_ACCOUNT_ENTRY_POINT: `0x${string}`;
+export declare const SPONSORED_ACCOUNT_IMPLEMENTATION_SLOT: `0x${string}`;
+/** The caller must first validate its own strict, reviewed source/terms schema. */
+export interface SponsoredAccountProfile {
+    readonly chainId: number;
+    readonly account: Address;
+    readonly delegate: Address;
+    readonly delegateCodeHash: string;
+    readonly implementation: Address;
+    readonly implementationCodeHash: string;
+    readonly entryPoint: Address;
+    readonly entryPointCodeHash: string;
+    readonly paymaster: Address;
+    readonly paymasterCodeHash: string;
+    readonly ownerProfile: {
+        readonly ownerAtIndex0: string;
+    };
+}
+export type SponsoredAccountProfileFailure = 'CHAIN' | 'CODE' | 'IMPLEMENTATION_CHANGED' | 'OWNER_PROFILE_CHANGED' | 'ENTRY_POINT_CHANGED' | 'REORG';
+export declare class SponsoredAccountProfileError extends Error {
+    readonly reason: SponsoredAccountProfileFailure;
+    constructor(reason: SponsoredAccountProfileFailure);
+}
+/** No transport, grant or journal authority is created by these public-chain reads. */
+export declare function assertSponsoredAccountProfile(client: PublicClient, terms: SponsoredAccountProfile, blockNumber: bigint, blockHash: Hex, additionalCodePins?: readonly {
+    readonly address: Address;
+    readonly codeHash: string;
+}[]): Promise<void>;

package/dist/execution-sponsored-account-profile.js

@@ -0,0 +1,59 @@
+/** Fixed-block, read-only proof for the reviewed same-address sponsored account family. */
+import { getAddress, keccak256, parseAbi, stringToHex, toHex } from 'viem';
+export const SPONSORED_ACCOUNT_PROXY = getAddress('0x7702cb554e6bFb442cb743A7dF23154544a7176C');
+export const SPONSORED_ACCOUNT_IMPLEMENTATION = getAddress('0x000100abaad02f1cfC8Bbe32bD5a564817339E72');
+export const SPONSORED_ACCOUNT_ENTRY_POINT = getAddress('0x5FF137D4b0FDCD49DcA30c7CF57E578a026d2789');
+export const SPONSORED_ACCOUNT_IMPLEMENTATION_SLOT = toHex(BigInt(keccak256(stringToHex('eip1967.proxy.implementation'))) - 1n, { size: 32 });
+const ACCOUNT_ABI = parseAbi([
+    'function nextOwnerIndex() view returns(uint256)',
+    'function ownerCount() view returns(uint256)',
+    'function ownerAtIndex(uint256 index) view returns(bytes)',
+    'function isOwnerAddress(address account) view returns(bool)',
+    'function entryPoint() view returns(address)',
+]);
+export class SponsoredAccountProfileError extends Error {
+    reason;
+    constructor(reason) {
+        super(`SPONSORED_ACCOUNT_PROFILE_${reason}`);
+        this.reason = reason;
+        this.name = 'SponsoredAccountProfileError';
+    }
+}
+function ensure(value, reason) {
+    if (!value)
+        throw new SponsoredAccountProfileError(reason);
+}
+const same = (left, right) => left.toLowerCase() === right.toLowerCase();
+/** No transport, grant or journal authority is created by these public-chain reads. */
+export async function assertSponsoredAccountProfile(client, terms, blockNumber, blockHash, additionalCodePins = []) {
+    ensure(await client.getChainId() === terms.chainId, 'CHAIN');
+    const targets = [
+        [terms.delegate, terms.delegateCodeHash], [terms.entryPoint, terms.entryPointCodeHash],
+        [terms.implementation, terms.implementationCodeHash], [terms.paymaster, terms.paymasterCodeHash],
+        ...additionalCodePins.map(pin => [pin.address, pin.codeHash]),
+    ];
+    const [ownerCode, ...codes] = await Promise.all([
+        client.getCode({ address: terms.account, blockNumber }),
+        ...targets.map(([address]) => client.getCode({ address, blockNumber })),
+    ]);
+    ensure(ownerCode?.toLowerCase() === '0xef0100' + terms.delegate.slice(2).toLowerCase() &&
+        codes.every((code, index) => code && code !== '0x' && same(keccak256(code), targets[index][1])), 'CODE');
+    // The EOA's slot is its delegated execution context; the proxy singleton's slot is unrelated.
+    const implementationSlot = await client.getStorageAt({ address: terms.account,
+        slot: SPONSORED_ACCOUNT_IMPLEMENTATION_SLOT, blockNumber });
+    ensure(implementationSlot?.toLowerCase() === '0x' + '0'.repeat(24) + terms.implementation.slice(2).toLowerCase(), 'IMPLEMENTATION_CHANGED');
+    const [nextOwnerIndex, ownerCount, ownerAtIndex0, isOwnerAddress, implementationEntryPoint, accountEntryPoint] = await Promise.all([
+        client.readContract({ address: terms.account, abi: ACCOUNT_ABI, functionName: 'nextOwnerIndex', blockNumber }),
+        client.readContract({ address: terms.account, abi: ACCOUNT_ABI, functionName: 'ownerCount', blockNumber }),
+        client.readContract({ address: terms.account, abi: ACCOUNT_ABI, functionName: 'ownerAtIndex', args: [0n], blockNumber }),
+        client.readContract({ address: terms.account, abi: ACCOUNT_ABI, functionName: 'isOwnerAddress', args: [terms.account], blockNumber }),
+        client.readContract({ address: terms.implementation, abi: ACCOUNT_ABI, functionName: 'entryPoint', blockNumber }),
+        client.readContract({ address: terms.account, abi: ACCOUNT_ABI, functionName: 'entryPoint', blockNumber }),
+    ]);
+    ensure(nextOwnerIndex === 1n && ownerCount === 1n && same(ownerAtIndex0, terms.ownerProfile.ownerAtIndex0) &&
+        isOwnerAddress === true, 'OWNER_PROFILE_CHANGED');
+    ensure(same(implementationEntryPoint, terms.entryPoint) && same(accountEntryPoint, terms.entryPoint), 'ENTRY_POINT_CHANGED');
+    const anchor = await client.getBlock({ blockNumber });
+    ensure(anchor.number === blockNumber && anchor.hash === blockHash, 'REORG');
+}
+//# sourceMappingURL=execution-sponsored-account-profile.js.map