@elgora/cli 10.0.0 → 10.2.0

package/README.md

@@ -34,7 +34,7 @@ answer.
   another AI review, or reviews them first.
 - `poster:open-winning-submission` retrieves the finalized winning Submission
   for the funding Poster and decrypts it locally.
-- `check-page <bounty_challenge_md_path|->` checks structural conformance offline,
+- `check-challenge <bounty_challenge_md_path|->` checks structural conformance offline,
   returns an issue list and exits non-zero on failure. It needs no wallet or
   network and does not replace hosted semantic readiness review.
 - `spec-commitment` reproduces the challenge's `spec_commitment` offline.
@@ -65,8 +65,11 @@ time, so it stays correct however the CLI was installed.
 Posters use `ELGORA_POSTER_PRIVATE_KEY`. Solvers should normally use
 `--solver-address` and sign the emitted EIP-712 requests and prepared
 transaction with an external wallet; `ELGORA_SOLVER_PRIVATE_KEY` is an optional
-local testing convenience. Claimants can use `--claimant-address`, or
-`ELGORA_CLAIMANT_PRIVATE_KEY` for a local test wallet.
+local testing convenience. Each emitted `typed_data` is in the
+`eth_signTypedData_v4` shape, with `EIP712Domain` in its types; for ethers v6,
+delete `types.EIP712Domain` before passing it to `signTypedData`. Claimants can
+use `--claimant-address`, or `ELGORA_CLAIMANT_PRIVATE_KEY` for a local test
+wallet.
 
 Guardian commands use two different kinds of secret:
 
@@ -86,9 +89,9 @@ needs.
 
 ## Deployment configuration
 
-Since 8.0.0 the default deployment is **Base mainnet** (`base`, chain `8453`),
-which escrows real USDC. Elgora's staging deployment runs on **Base Sepolia**
-(`base-sepolia`, chain `84532`) behind `https://staging.elgora.ai`. A run that
+The default deployment is **Base mainnet** (`base`, chain `8453`), which
+escrows real USDC. Elgora's testnet deployment runs on **Base Sepolia**
+(`base-sepolia`, chain `84532`) behind `https://testnet.elgora.ai`. A run that
 selects no network prints one stderr line saying it used the default.
 
 Every command accepts `--network <name|chain id>`, which selects the deployment
@@ -99,9 +102,9 @@ passed — for that run only:
 
 ```sh
 elgora-cli guardian:judgeable                        # Base mainnet, the default
-elgora-cli claim --network base-sepolia 7            # staging, by name
+elgora-cli claim --network base-sepolia 7            # testnet, by name
 elgora-cli claim --network 84532 7                   # the same, by chain id
-export ELGORA_CHAIN_ID=84532                         # staging for every run in this shell
+export ELGORA_CHAIN_ID=84532                         # testnet for every run in this shell
 ```
 
 The chain's public RPC, the ElgoraHub address, the escrow token, and the subgraph
@@ -115,7 +118,7 @@ targeting a deployment this CLI release does not know about, and do not mix
 addresses or endpoints from different deployments.
 
 The API follows the chain too: `https://elgora.ai` for `base` and
-`https://staging.elgora.ai` for `base-sepolia`. Commands that use the public API
+`https://testnet.elgora.ai` for `base-sepolia`. Commands that use the public API
 accept `--api-base-url <url>`, which wins over `ELGORA_API_BASE_URL` and that
 default for one invocation — for example to reach a Vercel preview. Point it at
 an API serving the deployment you selected.

package/dist/cli.js

@@ -5,7 +5,7 @@ import path4 from "path";
 import { config as loadDotenv } from "dotenv";
 import { ZodError as ZodError2 } from "zod";
 
-// src/check-page.ts
+// src/check-challenge.ts
 import { readFile } from "fs/promises";
 import { text as readStdinText } from "stream/consumers";
 
@@ -72,6 +72,7 @@ var WINNER_TAKE_ALL_PAYOUT_POLICY = "winner_take_all";
 var SUBMISSION_ENCRYPTION_TYPE = "guardian_timelock_hpke_aes_256_gcm_v0";
 var ZERO_BYTES32 = "0x0000000000000000000000000000000000000000000000000000000000000000";
 var READINESS_APPROVAL_VALIDITY_SECONDS = 7 * 24 * 60 * 60;
+var READINESS_TIMEOUT_MS = 12e4;
 
 // ../../packages/core/src/bounty-challenge-markdown.ts
 var FRONTMATTER_DELIMITER = "---";
@@ -1532,7 +1533,7 @@ var DEPLOYMENTS = {
     ELGORA_ESCROW_TOKEN_ADDRESS: "0x036cbd53842c5426634e7929541ec2318f3dcf7e",
     payoutSchemeAddress: "0x752d4305b8567b777d479dfa9847dc4f5ffb5750",
     ELGORA_SUBGRAPH_ENDPOINT: "https://api.goldsky.com/api/public/project_cmtu7wslg04s501ovc2je3beh/subgraphs/elgora-elgorahub/testnet-production/gn",
-    ELGORA_API_BASE_URL: "https://staging.elgora.ai",
+    ELGORA_API_BASE_URL: "https://testnet.elgora.ai",
     deployBlock: 46353511,
     deployTransaction: "0xed3d3c8af3c69f9f8d4ec47da7179fe4b89bd4a4cd8d8232dbbd3d3f3d38e74b",
     sourceCommit: "1377da5c38dc5c90d8608ffa3cb15ad6f8567a01"
@@ -1543,16 +1544,16 @@ function getDeployment(chainId) {
   return DEPLOYMENTS[chainId];
 }
 
-// src/check-page.ts
-var CHECK_PAGE_USAGE = "Usage: elgora-cli check-page <bounty_challenge_md_path>\n   or: elgora-cli check-page -";
+// src/check-challenge.ts
+var CHECK_CHALLENGE_USAGE = "Usage: elgora-cli check-challenge <bounty_challenge_md_path>\n   or: elgora-cli check-challenge -";
 async function main(_env = process.env, argv = process.argv.slice(2)) {
   const markdown = await readBountyChallengeMarkdown(argv);
   const { issues, profile } = checkChallengeConformance(markdown);
   console.log(
     JSON.stringify({
-      event: issues.length === 0 ? "check_page.structure_conforming" : "check_page.issues",
+      event: issues.length === 0 ? "check_challenge.structure_conforming" : "check_challenge.issues",
       profile: profile?.profile ?? null,
-      // Named so a caller cannot read a clean result as "this page is safe".
+      // Named so a caller cannot read a clean result as "this challenge is safe".
       checked: "structure",
       issues: issues.map((issue) => ({
         code: issue.code,
@@ -1568,7 +1569,7 @@ async function main(_env = process.env, argv = process.argv.slice(2)) {
 async function readBountyChallengeMarkdown(argv) {
   const path5 = argv[0];
   if (!path5) {
-    throw new Error(CHECK_PAGE_USAGE);
+    throw new Error(CHECK_CHALLENGE_USAGE);
   }
   if (path5 === "-") {
     return readStdinText(process.stdin);
@@ -4414,14 +4415,6 @@ var envShape = {
   ELGORA_DELIVERY_PUBLIC_KEY: z5.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
   ELGORA_DELIVERY_PRIVATE_KEY: z5.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
 };
-var readinessAudienceSchema = z5.string().trim().toLowerCase().min(1).max(512).refine((host) => {
-  try {
-    const url = new URL(`https://${host}`);
-    return url.host === host && url.pathname === "/" && !url.username && !url.password && !url.search && !url.hash;
-  } catch {
-    return false;
-  }
-}, "Must be a canonical hostname with optional port, without a URL path");
 var publicationEnvShape = {
   ELGORA_CHAIN_ID: envShape.ELGORA_CHAIN_ID,
   ELGORA_HUB_ADDRESS: envShape.ELGORA_HUB_ADDRESS,
@@ -4429,7 +4422,7 @@ var publicationEnvShape = {
   ELGORA_DATABASE_URL: envShape.ELGORA_DATABASE_URL,
   ELGORA_SUBGRAPH_ENDPOINT: envShape.ELGORA_SUBGRAPH_ENDPOINT,
   ELGORA_PUBLICATION_REVIEW_ENABLED: z5.string().trim().toLowerCase().pipe(z5.enum(["true", "false"])).default("true").transform((value) => value === "true"),
-  ELGORA_READINESS_TIMEOUT_MS: z5.coerce.number().int().min(1).max(12e4).default(12e4)
+  ELGORA_READINESS_TIMEOUT_MS: z5.coerce.number().int().min(1).max(READINESS_TIMEOUT_MS).default(READINESS_TIMEOUT_MS)
 };
 var envSchema = z5.object(envShape);
 var bountyPublicationEnvSchema = z5.object(publicationEnvShape);
@@ -4726,23 +4719,6 @@ import {
   fallback,
   http
 } from "viem";
-
-// ../../packages/core/src/auth/freshness.ts
-var API_REQUEST_APPROVAL_ANCHOR_LAG_SECONDS = 6;
-var FALLBACK_BLOCK_TIME_MS = 2e3;
-function blockTimeMsFor(chainId) {
-  const chain = chainId === void 0 ? void 0 : SUPPORTED_CHAINS[chainId];
-  return chain?.blockTime ?? FALLBACK_BLOCK_TIME_MS;
-}
-function blocksForSeconds(seconds, chainId) {
-  const blocks = Math.ceil(seconds * 1e3 / blockTimeMsFor(chainId));
-  return BigInt(Math.max(1, blocks));
-}
-function apiRequestApprovalAnchorLagBlocks(chainId) {
-  return blocksForSeconds(API_REQUEST_APPROVAL_ANCHOR_LAG_SECONDS, chainId);
-}
-
-// ../../packages/core/src/chain-client.ts
 var RPC_RETRY_COUNT = 3;
 function createChainTransport(chainId, rpcUrl) {
   const publicRpcUrl = resolveSupportedChain(chainId).rpcUrls.default.http[0];
@@ -4776,13 +4752,6 @@ function assertChainId(actual, expected) {
     throw new Error(`RPC returned chain_id ${actual}, expected ${expected}`);
   }
 }
-async function fetchSignableBlock(client) {
-  const offset = apiRequestApprovalAnchorLagBlocks(client.chain?.id);
-  const head = await client.getBlockNumber();
-  const anchorNumber = head > offset ? head - offset : 0n;
-  const anchor = await client.getBlock({ blockNumber: anchorNumber });
-  return { number: anchor.number, hash: anchor.hash };
-}
 async function assertHubDeployment(client, chainId, hubAddress) {
   const [actualChainId, hubCode] = await Promise.all([
     client.getChainId(),
@@ -5363,22 +5332,37 @@ import {
   recoverTypedDataAddress as recoverTypedDataAddress2
 } from "viem";
 
+// ../../packages/core/src/auth/request-approval.ts
+function typedDataForRequest(request, block) {
+  const bodyBytes = typeof request.body === "string" ? toBytes4(request.body) : request.body;
+  return buildApiRequestApprovalTypedData({
+    chainId: request.domain.chainId,
+    hubAddress: request.domain.hubAddress,
+    message: {
+      endpointId: request.endpointId,
+      audience: audienceFor(request.host),
+      bodyHash: keccak2565(bodyBytes),
+      query: queryFor(request.query),
+      blockNumber: block.number,
+      blockHash: block.hash
+    }
+  });
+}
+
 // ../../packages/core/src/auth/request-approval-header.ts
-import { keccak256 as keccak2566, toBytes as toBytes5 } from "viem";
+import { z as z10 } from "zod";
 async function buildAuthorizationHeader(params) {
   const url = new URL(params.requestUrl);
-  const typedData = buildApiRequestApprovalTypedData({
-    chainId: params.chainId,
-    hubAddress: params.hubAddress,
-    message: {
+  const typedData = typedDataForRequest(
+    {
       endpointId: endpointIdFor({ method: params.method, path: url.pathname }),
-      audience: audienceFor(url.host),
-      bodyHash: keccak2566(toBytes5(params.body ?? "")),
-      query: queryFor(url.search),
-      blockNumber: params.block.number,
-      blockHash: params.block.hash
-    }
-  });
+      host: url.host,
+      query: url.search,
+      body: params.body ?? "",
+      domain: { chainId: params.chainId, hubAddress: params.hubAddress }
+    },
+    params.block
+  );
   const signature = await params.sign(typedData);
   return encodeApiRequestApprovalHeader({
     address: params.address,
@@ -5387,6 +5371,31 @@ async function buildAuthorizationHeader(params) {
     blockHash: params.block.hash
   });
 }
+async function authorizeRequest(params) {
+  return buildAuthorizationHeader({
+    ...params,
+    block: await readChallengeBlock(params)
+  });
+}
+var challengeBlockSchema = z10.object({
+  error: z10.object({ block_number: z10.string(), block_hash: z10.string() })
+});
+async function readChallengeBlock(params) {
+  const response = await fetch(params.requestUrl, {
+    method: params.method,
+    headers: params.contentType ? { "content-type": params.contentType } : {},
+    body: params.method.toUpperCase() === "GET" ? null : params.body ?? ""
+  });
+  if (response.status !== 401) {
+    throw new Error(
+      `Expected an approval challenge (401) from ${params.requestUrl}, got ${response.status}.`
+    );
+  }
+  const { block_number, block_hash } = challengeBlockSchema.parse(
+    await response.json()
+  ).error;
+  return { number: BigInt(block_number), hash: block_hash };
+}
 
 // ../../packages/core/src/winning-solution-delivery.ts
 async function wrapWinningSolutionKey(input) {
@@ -5395,14 +5404,13 @@ async function wrapWinningSolutionKey(input) {
     apiBaseUrl: input.config.apiBaseUrl
   });
   const contentPathname = `/api/bounties/${input.bountyId}/submissions/${input.submissionCommitment}/content`;
-  const contentAuthorization = await buildAuthorizationHeader({
+  const contentAuthorization = await authorizeRequest({
     requestUrl: new URL(contentPathname, input.config.apiBaseUrl).toString(),
     method: "GET",
     body: "",
     chainId: input.config.chainId,
     hubAddress: input.config.hubAddress,
     address: input.owner.address,
-    block: await fetchSignableBlock(input.publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const { content_record, ciphertext_download_url } = solverSubmissionContentResponseSchema.parse(
@@ -5454,14 +5462,14 @@ async function wrapWinningSolutionKey(input) {
     submission_commitment: input.submissionCommitment,
     wrapped_key: opened.wrapped_key
   });
-  const authorization = await buildAuthorizationHeader({
+  const authorization = await authorizeRequest({
     requestUrl: requestUrl.toString(),
     method: "POST",
+    contentType: "application/json",
     body,
     chainId: input.config.chainId,
     hubAddress: input.config.hubAddress,
     address: input.owner.address,
-    block: await fetchSignableBlock(input.publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const responseBody = await postText(
@@ -5504,14 +5512,13 @@ async function main3(env = process.env, argv = process.argv.slice(2)) {
     bountyId: args.bountyId,
     submissionCommitment: args.submissionCommitment
   });
-  const authorization = await buildAuthorizationHeader({
+  const authorization = await authorizeRequest({
     requestUrl: new URL(pathname, config.apiBaseUrl).toString(),
     method: "GET",
     body: "",
     chainId: config.chainId,
     hubAddress: config.hubAddress,
     address: account.address,
-    block: await fetchSignableBlock(publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const { content_record, ciphertext_download_url } = await requestSubmissionContent({
@@ -5693,7 +5700,6 @@ async function main4(env = process.env, argv = process.argv.slice(2)) {
       privateKey: guardianAccountPrivateKey,
       address: account.address
     },
-    publicClient,
     guardianPrivateKeys
   });
   console.log(
@@ -6854,14 +6860,13 @@ async function main7(env = process.env, argv = process.argv.slice(2)) {
   }
   if (args.outcome === "awarded") {
     const contentPathname = `/api/bounties/${args.bountyId.toString()}/submissions/${args.awardedSubmissionCommitment}/content`;
-    const contentAuthorization = await buildAuthorizationHeader({
+    const contentAuthorization = await authorizeRequest({
       requestUrl: new URL(contentPathname, config.apiBaseUrl).toString(),
       method: "GET",
       body: "",
       chainId: config.chainId,
       hubAddress: config.hubAddress,
       address: account.address,
-      block: await fetchSignableBlock(publicClient),
       sign: (typedData) => account.signTypedData(typedData)
     });
     await assertCheckedSubmission({
@@ -6908,14 +6913,14 @@ async function main7(env = process.env, argv = process.argv.slice(2)) {
   }
   const pathname = `/api/written-verdicts/${reportCommitment}`;
   const requestUrl = new URL(pathname, config.apiBaseUrl);
-  const authorization = await buildAuthorizationHeader({
+  const authorization = await authorizeRequest({
     requestUrl: requestUrl.toString(),
     method: "POST",
+    contentType: MARKDOWN_CONTENT_TYPE,
     body: markdown,
     chainId: config.chainId,
     hubAddress: config.hubAddress,
     address: account.address,
-    block: await fetchSignableBlock(publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   await postText(requestUrl, markdown, MARKDOWN_CONTENT_TYPE, authorization);
@@ -7070,14 +7075,14 @@ var NETWORKS = [
   {
     name: "base-sepolia",
     chainId: baseSepolia3.id,
-    label: "Base Sepolia testnet, Elgora's staging deployment"
+    label: "Base Sepolia, test USDC"
   },
   { name: "local", chainId: foundry3.id, label: "a local Anvil stack" }
 ];
 var NETWORK_CHAIN_IDS = Object.fromEntries(
   NETWORKS.map(({ name, chainId }) => [name, chainId])
 );
-var STAGING_NETWORK = NETWORKS.find(
+var TESTNET_NETWORK = NETWORKS.find(
   ({ chainId }) => chainId === baseSepolia3.id
 );
 var NETWORK_NAMES_HINT = NETWORKS.map(
@@ -7087,15 +7092,15 @@ function describeChain(chainId) {
   const network = NETWORKS.find((candidate) => candidate.chainId === chainId);
   return network ? `${network.name} (${network.label})` : `chain ${chainId}`;
 }
-var STAGING_HINT = `add ${NETWORK_FLAG} ${STAGING_NETWORK.name} or set ELGORA_CHAIN_ID=${STAGING_NETWORK.chainId}`;
+var TESTNET_HINT = `add ${NETWORK_FLAG} ${TESTNET_NETWORK.name} or set ELGORA_CHAIN_ID=${TESTNET_NETWORK.chainId}`;
 var DEFAULT_NETWORK_HELP_LINES = [
   `Default: ${describeChain(DEFAULT_CHAIN_ID)}.`,
-  `Staging: ${describeChain(STAGING_NETWORK.chainId)};`,
-  `  ${STAGING_HINT}.`
+  `Testnet: ${describeChain(TESTNET_NETWORK.chainId)};`,
+  `  ${TESTNET_HINT}.`
 ];
 function defaultNetworkNotice(env) {
   if (env.ELGORA_CHAIN_ID?.trim()) return void 0;
-  return `elgora-cli: using the default network, ${describeChain(DEFAULT_CHAIN_ID)}. For staging, ${STAGING_HINT}.`;
+  return `elgora-cli: using the default network, ${describeChain(DEFAULT_CHAIN_ID)}. For testnet, ${TESTNET_HINT}.`;
 }
 function applyNetworkFlag(env, argv) {
   const present = argv.some(
@@ -7122,8 +7127,8 @@ function resolveChainId(selector) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "10.0.0" : "0.0.0-dev";
-var CLI_NODE_ENGINES = true ? ">=24 <25" : ">=24 <25";
+var CLI_VERSION = true ? "10.2.0" : "0.0.0-dev";
+var CLI_NODE_ENGINES = true ? "24.x || 26.x" : "24.x || 26.x";
 
 // src/node-engines.ts
 function unsupportedNodeMessage(running = process.versions.node, range = CLI_NODE_ENGINES) {
@@ -7189,24 +7194,51 @@ function compareVersions(left, right) {
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import path2 from "path";
 import { privateKeyToAccount as privateKeyToAccount7 } from "viem/accounts";
-var DEFAULT_OUTPUT_ROOT2 = "./winning-submission";
-async function main8(env = process.env, argv = process.argv.slice(2)) {
-  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
-  const args = readPosterOpenWinningSubmissionArgs(remainingArgv);
-  const envWithDefaults = withDeploymentDefaults(env);
-  const config = loadClientDeploymentConfig(
-    envWithDefaults,
-    apiBaseUrlOverride
-  );
-  const rpcUrl = required3(envWithDefaults, "ELGORA_RPC_URL");
-  const posterPrivateKey = envWithDefaults.ELGORA_POSTER_PRIVATE_KEY?.trim();
-  if (!posterPrivateKey || !isHexBytes32(posterPrivateKey)) {
+
+// src/poster-request.ts
+import { readFile as readFile4 } from "fs/promises";
+import { text as readStdinText3 } from "stream/consumers";
+function loadPosterConfig(env, apiBaseUrlOverride) {
+  const defaults = withDeploymentDefaults(env);
+  const clientConfig = loadClientDeploymentConfig(defaults, apiBaseUrlOverride);
+  const rpcUrl = defaults.ELGORA_RPC_URL?.trim();
+  if (!rpcUrl) throw new Error("ELGORA_RPC_URL is required");
+  const privateKey = env.ELGORA_POSTER_PRIVATE_KEY?.trim();
+  if (!privateKey || !isHexBytes32(privateKey)) {
     throw new Error(
       "ELGORA_POSTER_PRIVATE_KEY must be a 32-byte hex private key"
     );
   }
-  const account = privateKeyToAccount7(posterPrivateKey.toLowerCase());
-  const publicClient = createChainPublicClient(config.chainId, rpcUrl);
+  return {
+    ...clientConfig,
+    rpcUrl,
+    posterPrivateKey: privateKey
+  };
+}
+async function readBountyChallengeMarkdown2(path5) {
+  return path5 === "-" ? readStdinText3(process.stdin) : readFile4(path5, "utf8");
+}
+async function signPosterRequest(input) {
+  return authorizeRequest({
+    requestUrl: input.requestUrl.toString(),
+    method: "POST",
+    contentType: "text/markdown",
+    body: input.markdown,
+    chainId: input.config.chainId,
+    hubAddress: input.config.hubAddress,
+    address: input.account.address,
+    sign: (typedData) => input.account.signTypedData(typedData)
+  });
+}
+
+// src/poster-open-winning-submission.ts
+var DEFAULT_OUTPUT_ROOT2 = "./winning-submission";
+async function main8(env = process.env, argv = process.argv.slice(2)) {
+  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
+  const args = readPosterOpenWinningSubmissionArgs(remainingArgv);
+  const config = loadPosterConfig(env, apiBaseUrlOverride);
+  const account = privateKeyToAccount7(config.posterPrivateKey);
+  const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
   await assertHubDeployment(publicClient, config.chainId, config.hubAddress);
   const ephemeral = await generateX25519KeyPair();
   const retrieveUrl = new URL(
@@ -7216,14 +7248,14 @@ async function main8(env = process.env, argv = process.argv.slice(2)) {
   const retrieveBody = JSON.stringify({
     poster_ephemeral_public_key: ephemeral.public_key
   });
-  const retrieveAuthorization = await buildAuthorizationHeader({
+  const retrieveAuthorization = await authorizeRequest({
     requestUrl: retrieveUrl.toString(),
     method: "POST",
+    contentType: "application/json",
     body: retrieveBody,
     chainId: config.chainId,
     hubAddress: config.hubAddress,
     address: account.address,
-    block: await fetchSignableBlock(publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const retrieved = deliveryRetrieveResponseSchema.parse(
@@ -7246,14 +7278,13 @@ async function main8(env = process.env, argv = process.argv.slice(2)) {
   });
   try {
     const contentPathname = `/api/bounties/${args.bountyId}/submissions/${retrieved.submission_commitment}/content`;
-    const contentAuthorization = await buildAuthorizationHeader({
+    const contentAuthorization = await authorizeRequest({
       requestUrl: new URL(contentPathname, config.apiBaseUrl).toString(),
       method: "GET",
       body: "",
       chainId: config.chainId,
       hubAddress: config.hubAddress,
       address: account.address,
-      block: await fetchSignableBlock(publicClient),
       sign: (typedData) => account.signTypedData(typedData)
     });
     const { content_record, ciphertext_download_url } = solverSubmissionContentResponseSchema.parse(
@@ -7322,62 +7353,15 @@ function readPosterOpenWinningSubmissionArgs(argv) {
     ...outputDir ? { outputDir } : {}
   };
 }
-function required3(env, name) {
-  const value = env[name]?.trim();
-  if (!value) throw new Error(`${name} is required`);
-  return value;
-}
 
 // src/publish-fund.ts
 import {
   decodeFunctionData,
-  parseAbi as parseAbi2,
+  erc20Abi,
   parseEventLogs
 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount8 } from "viem/accounts";
-
-// src/poster-request.ts
-import { readFile as readFile4 } from "fs/promises";
-import { text as readStdinText3 } from "stream/consumers";
-function loadPosterConfig(env, apiBaseUrlOverride) {
-  const defaults = withDeploymentDefaults(env);
-  const clientConfig = loadClientDeploymentConfig(defaults, apiBaseUrlOverride);
-  const rpcUrl = defaults.ELGORA_RPC_URL?.trim();
-  if (!rpcUrl) throw new Error("ELGORA_RPC_URL is required");
-  const privateKey = env.ELGORA_POSTER_PRIVATE_KEY?.trim();
-  if (!privateKey || !isHexBytes32(privateKey)) {
-    throw new Error(
-      "ELGORA_POSTER_PRIVATE_KEY must be a 32-byte hex private key"
-    );
-  }
-  return {
-    ...clientConfig,
-    rpcUrl,
-    posterPrivateKey: privateKey
-  };
-}
-async function readBountyChallengeMarkdown2(path5) {
-  return path5 === "-" ? readStdinText3(process.stdin) : readFile4(path5, "utf8");
-}
-async function signPosterRequest(input) {
-  return buildAuthorizationHeader({
-    requestUrl: input.requestUrl.toString(),
-    method: "POST",
-    body: input.markdown,
-    chainId: input.config.chainId,
-    hubAddress: input.config.hubAddress,
-    address: input.account.address,
-    block: await fetchSignableBlock(input.publicClient),
-    sign: (typedData) => input.account.signTypedData(typedData)
-  });
-}
-
-// src/publish-fund.ts
 var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path|->";
-var usdcAbi = parseAbi2([
-  "function approve(address spender,uint256 value) returns (bool)",
-  "function balanceOf(address account) view returns (uint256)"
-]);
 async function main9(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
   if (remainingArgv.length !== 1 || !remainingArgv[0])
@@ -7413,8 +7397,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
     requestUrl,
     markdown: bountyChallengeMarkdown,
     config,
-    account,
-    publicClient
+    account
   });
   const prepared = await requestPreparePublication({
     requestUrl: requestUrl.toString(),
@@ -7449,7 +7432,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
     publicClient.getBalance({ address: account.address }),
     publicClient.readContract({
       address: tokenAddress,
-      abi: usdcAbi,
+      abi: erc20Abi,
       functionName: "balanceOf",
       args: [account.address]
     })
@@ -7486,7 +7469,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   } else {
     const approveHash = await walletClient.writeContract({
       address: tokenAddress,
-      abi: usdcAbi,
+      abi: erc20Abi,
       functionName: "approve",
       args: [config.hubAddress, escrowAmount]
     });
@@ -7565,8 +7548,8 @@ async function requestPreparePublication(input) {
 }
 
 // src/required-env.ts
-function missingRequiredEnv(required4, env) {
-  return required4.filter((envName) => !env[envName]?.trim());
+function missingRequiredEnv(required3, env) {
+  return required3.filter((envName) => !env[envName]?.trim());
 }
 
 // src/review.ts
@@ -7586,10 +7569,10 @@ async function main10(env = process.env, argv = process.argv.slice(2)) {
   const { value: previous, argv: paths } = takeFlag(
     args,
     "--previous",
-    "--previous must be one bytes32 page commitment"
+    "--previous must be one bytes32 challenge commitment"
   );
   if (previous && !isHexBytes32(previous))
-    throw new Error("--previous must be one bytes32 page commitment");
+    throw new Error("--previous must be one bytes32 challenge commitment");
   if (paths.length !== 1 || !paths[0] || paths[0].startsWith("--"))
     throw new Error(USAGE2);
   const config = loadPosterConfig(env, apiBaseUrl);
@@ -7612,8 +7595,7 @@ async function main10(env = process.env, argv = process.argv.slice(2)) {
     requestUrl,
     markdown,
     config,
-    account,
-    publicClient
+    account
   });
   let response;
   try {
@@ -7996,7 +7978,7 @@ async function readBountyChallengeMarkdown3(argv) {
 import { readdir, readFile as readFile7, stat } from "fs/promises";
 import path3 from "path";
 import { createInterface } from "readline";
-import { isAddress as isAddress7 } from "viem";
+import { getTypesForEIP712Domain, isAddress as isAddress7, stringify } from "viem";
 import { privateKeyToAccount as privateKeyToAccount11 } from "viem/accounts";
 
 // src/external-api-approval-signer.ts
@@ -8076,19 +8058,16 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
       return next.done ? void 0 : next.value;
     }
   });
-  const authorizeRequest = async (requestUrl, body) => {
-    const block = await fetchSignableBlock(publicClient);
-    return buildAuthorizationHeader({
-      requestUrl: requestUrl.toString(),
-      method: "POST",
-      body,
-      chainId: config.chainId,
-      hubAddress: config.hubAddress,
-      address: solver,
-      block,
-      sign: signApproval
-    });
-  };
+  const authorizeSubmitRequest = (requestUrl, body) => authorizeRequest({
+    requestUrl: requestUrl.toString(),
+    method: "POST",
+    body,
+    contentType: "application/json",
+    chainId: config.chainId,
+    hubAddress: config.hubAddress,
+    address: solver,
+    sign: signApproval
+  });
   const rosterResponse = await requestBountyGuardianRoster({
     apiBaseUrl: config.apiBaseUrl,
     bountyId: bountyIdText
@@ -8135,7 +8114,7 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
         solver,
         ciphertextSha256: envelope.ciphertext_sha256,
         ciphertextByteLength: ciphertext.byteLength,
-        authorizeRequest
+        authorizeRequest: authorizeSubmitRequest
       });
       if (uploadUrl.locator !== envelope.ciphertext_locator) {
         throw new Error(
@@ -8156,7 +8135,7 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
         bountyId: bountyIdText,
         solver,
         envelope,
-        authorizeRequest
+        authorizeRequest: authorizeSubmitRequest
       });
     } finally {
       externalApprovalInput?.close();
@@ -8255,14 +8234,19 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
 }
 function createExternalApprovalSigner(input) {
   return createExternalApiApprovalSigner({
-    renderPrompt: (typedData) => JSON.stringify(
-      {
-        event: "submit.approval_required",
-        solver: input.solver.toLowerCase(),
-        typed_data: typedData
-      },
-      (_key, value) => typeof value === "bigint" ? value.toString() : value
-    ),
+    // The eth_signTypedData_v4 shape: its types carry EIP712Domain, which
+    // MetaMask-style signers need to hash the domain. The signed hash is the same.
+    renderPrompt: (typedData) => stringify({
+      event: "submit.approval_required",
+      solver: input.solver.toLowerCase(),
+      typed_data: {
+        ...typedData,
+        types: {
+          EIP712Domain: getTypesForEIP712Domain({ domain: typedData.domain }),
+          ...typedData.types
+        }
+      }
+    }),
     writePrompt: input.writePrompt,
     readSignature: input.readSignature
   });
@@ -8400,7 +8384,7 @@ function extractSolverAddressFlag(argv) {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === SOLVER_ADDRESS_FLAG) {
-      solverAddress = argv[i + 1];
+      solverAddress = argv[i + 1] ?? "";
       i++;
       continue;
     }
@@ -8650,7 +8634,7 @@ var COMMANDS = {
   "roster:verify-guardian-proof": main13,
   "solver:submit": main15,
   claim: main2,
-  "check-page": main,
+  "check-challenge": main,
   "spec-commitment": main14,
   "verification-record": main16
 };
@@ -8723,8 +8707,8 @@ var COMMAND_HELP = {
   },
   "poster:review": {
     usage: "elgora-cli poster:review <path|-> [--previous <commitment>]",
-    title: "Review a bounty page before publishing it.",
-    description: "Sign and send the exact Markdown for a readiness review. Ready prints\n  review.ready; Elgora keeps the approval for these exact bytes.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous page commitment with the signed request.",
+    title: "Review a challenge before publishing it.",
+    description: "Sign and send the exact Markdown for a readiness review. Ready prints\n  review.ready; Elgora keeps the approval for these exact bytes.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous challenge commitment with the signed request.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",
@@ -8802,10 +8786,10 @@ var COMMAND_HELP = {
     required: [],
     defaulted: ["ELGORA_CHAIN_ID", "ELGORA_HUB_ADDRESS", "ELGORA_RPC_URL"]
   },
-  "check-page": {
-    usage: "elgora-cli check-page <bounty_challenge_md_path|->",
-    title: "Check a challenge page's structure against Elgora's rules.",
-    description: "Run the same structural module the API runs before its readiness\n  review: frontmatter, a known profile, and every declared tightening.\n  Reports each issue with a stable code and the field that fixes it,\n  and exits non-zero when any is found. A Guardian runs this against a\n  bounty's committed bytes before judging, because a page can reach\n  chain without passing publication. It checks structure only: whether\n  the page tries to instruct you, or carries unsafe content, is a\n  reading you make yourself. Pass '-' to read from stdin. Makes no\n  network call and needs no configuration or secret.",
+  "check-challenge": {
+    usage: "elgora-cli check-challenge <bounty_challenge_md_path|->",
+    title: "Check a challenge's structure against Elgora's rules.",
+    description: "Run the same structural module the API runs before its readiness\n  review: frontmatter, a known profile, and every declared tightening.\n  Reports each issue with a stable code and the field that fixes it,\n  and exits non-zero when any is found. A Guardian runs this against a\n  bounty's committed bytes before judging, because a challenge can reach\n  chain without passing publication. It checks structure only: whether\n  the challenge tries to instruct you, or carries unsafe content, is a\n  reading you make yourself. Pass '-' to read from stdin. Makes no\n  network call and needs no configuration or secret.",
     required: []
   },
   "spec-commitment": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elgora/cli",
-  "version": "10.0.0",
+  "version": "10.2.0",
   "description": "Command-line client for Elgora, a decentralized bounty marketplace for science. Lets Posters, Solvers, and Guardians interact with Elgora's public API and on-chain contracts.",
   "type": "module",
   "license": "MIT",
@@ -19,7 +19,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=24 <25"
+    "node": "24.x || 26.x"
   },
   "scripts": {
     "build": "tsup && chmod +x dist/cli.js",