@elgora/cli 7.2.3 → 7.4.0

package/dist/cli.js

@@ -5,6 +5,10 @@ import path4 from "path";
 import { config as loadDotenv } from "dotenv";
 import { ZodError as ZodError2 } from "zod";
 
+// src/check-page.ts
+import { readFile } from "fs/promises";
+import { text as readStdinText } from "stream/consumers";
+
 // ../../packages/core/src/argv-flags.ts
 function extractFlagValue(argv, flag) {
   const remaining = [];
@@ -63,10 +67,13 @@ function safeDecodeUtf8(bytes) {
 }
 
 // ../../packages/core/src/constants.ts
+var BOUNTY_CHALLENGE_PROFILE = "elgora_markdown_bounty_challenge_v0";
+var WINNER_TAKE_ALL_PAYOUT_POLICY = "winner_take_all";
 var SUBMISSION_ENCRYPTION_TYPE = "guardian_timelock_hpke_aes_256_gcm_v0";
 var ZERO_BYTES32 = "0x0000000000000000000000000000000000000000000000000000000000000000";
 
 // ../../packages/core/src/bounty-challenge-markdown.ts
+var FRONTMATTER_DELIMITER = "---";
 var MAX_BOUNTY_CHALLENGE_MARKDOWN_CHARACTERS = 1e6;
 var BOUNTY_CHALLENGE_FRONTMATTER_KEYS = [
   "profile",
@@ -74,15 +81,307 @@ var BOUNTY_CHALLENGE_FRONTMATTER_KEYS = [
   "submission_deadline",
   "payout_policy"
 ];
-var ALLOWED_FRONTMATTER_KEYS = BOUNTY_CHALLENGE_FRONTMATTER_KEYS.join(", ");
+var BOUNTY_CHALLENGE_OPTIONAL_FRONTMATTER_KEYS = [
+  "constraints"
+];
+var ALLOWED_FRONTMATTER_KEYS = [
+  ...BOUNTY_CHALLENGE_FRONTMATTER_KEYS,
+  ...BOUNTY_CHALLENGE_OPTIONAL_FRONTMATTER_KEYS
+].join(", ");
 var ALLOWED_FRONTMATTER_KEYS_MESSAGE = `Use only the v0 template frontmatter keys: ${ALLOWED_FRONTMATTER_KEYS}`;
+var DEPLOYMENT_OWNED_FRONTMATTER_KEYS = /* @__PURE__ */ new Set([
+  "chain_id",
+  "token_address",
+  "hub_address",
+  "guardian_recipients_commitment",
+  "guardian_settlement_signer",
+  "treasury_recipient",
+  "treasury_fee_bps",
+  "guardian_fee_recipient",
+  "guardian_fee_bps",
+  "timelock_reveal_delay_seconds",
+  "timelock_network",
+  "timelock_chain_hash",
+  "storage_provider",
+  "artifact_storage_bucket"
+]);
+var BountyChallengeSpecValidationError = class extends Error {
+  issues;
+  constructor(issues) {
+    super("Invalid BountyChallengeSpec Markdown");
+    this.name = "BountyChallengeSpecValidationError";
+    this.issues = issues;
+  }
+};
 var markdownSchema = z.string().min(1, "Markdown body must not be empty").max(
   MAX_BOUNTY_CHALLENGE_MARKDOWN_CHARACTERS,
   `Markdown body must be at most ${MAX_BOUNTY_CHALLENGE_MARKDOWN_CHARACTERS} characters`
 );
+function parseBountyChallengeMarkdown(input) {
+  const markdown = parseMarkdownInput(input);
+  const lines = normalizedLines(markdown);
+  const issues = [];
+  const { frontmatterLines, bodyLines } = splitFrontmatter(lines, issues);
+  const { scalarLines, constraints } = splitConstraintsBlock(
+    frontmatterLines,
+    issues
+  );
+  const publicationTerms = parsePublicationTermsFrontmatter(
+    scalarLines,
+    issues
+  );
+  validateChallengeBody(bodyLines, issues);
+  if (issues.length > 0 || publicationTerms === null) {
+    throw new BountyChallengeSpecValidationError(issues);
+  }
+  return { markdown, publicationTerms, constraints };
+}
 function deriveBountyChallengeContentCommitment(content) {
   return keccak256(toBytes(content));
 }
+function parseMarkdownInput(input) {
+  const parsed = markdownSchema.safeParse(input);
+  if (!parsed.success) {
+    throw new BountyChallengeSpecValidationError(
+      parsed.error.issues.map((issue) => ({
+        path: issue.path.join("."),
+        message: issue.message
+      }))
+    );
+  }
+  return parsed.data;
+}
+function splitFrontmatter(lines, issues) {
+  if (lines[0] !== FRONTMATTER_DELIMITER) {
+    issues.push({
+      path: "frontmatter",
+      message: "Document must start with v0 frontmatter delimited by ---"
+    });
+    return { frontmatterLines: [], bodyLines: lines };
+  }
+  const closingIndex = lines.findIndex(
+    (line, index) => index > 0 && line === FRONTMATTER_DELIMITER
+  );
+  if (closingIndex === -1) {
+    issues.push({
+      path: "frontmatter",
+      message: "Frontmatter must close with --- before the H1 title"
+    });
+    return { frontmatterLines: lines.slice(1), bodyLines: [] };
+  }
+  return {
+    frontmatterLines: lines.slice(1, closingIndex),
+    bodyLines: lines.slice(closingIndex + 1)
+  };
+}
+function splitConstraintsBlock(lines, issues) {
+  const scalarLines = [];
+  const constraints = [];
+  let seenConstraintsBlock = false;
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    if (line.trim() !== "constraints:") {
+      scalarLines.push({ text: line, index });
+      continue;
+    }
+    if (seenConstraintsBlock) {
+      issues.push({
+        path: "frontmatter.constraints",
+        message: 'Frontmatter key "constraints" must appear exactly once'
+      });
+    }
+    seenConstraintsBlock = true;
+    const seenKeys = /* @__PURE__ */ new Set();
+    while (index + 1 < lines.length) {
+      const entry = lines[index + 1] ?? "";
+      if (entry.trim().length === 0) break;
+      if (!/^\s+\S/.test(entry)) break;
+      index += 1;
+      const match = entry.trim().match(/^([a-z][a-z0-9_]*):\s*(.+)$/);
+      const key = match?.[1];
+      const rawValue = match?.[2];
+      if (key === void 0 || rawValue === void 0) {
+        issues.push({
+          path: `frontmatter.constraints.line_${index + 2}`,
+          message: "Constraint entries must use snake_case_key: value"
+        });
+        continue;
+      }
+      if (seenKeys.has(key)) {
+        issues.push({
+          path: `frontmatter.constraints.${key}`,
+          message: `Constraint "${key}" must appear exactly once`
+        });
+        continue;
+      }
+      seenKeys.add(key);
+      const value = normalizeFrontmatterScalar(
+        rawValue,
+        `frontmatter.constraints.${key}`,
+        issues
+      );
+      if (value !== null) {
+        constraints.push({ key, value, line: index + 2 });
+      }
+    }
+    if (constraints.length === 0 && seenKeys.size === 0) {
+      issues.push({
+        path: "frontmatter.constraints",
+        message: "Remove the empty constraints block, or add at least one indented constraint entry"
+      });
+    }
+  }
+  return { scalarLines, constraints };
+}
+function parsePublicationTermsFrontmatter(lines, issues) {
+  const values = /* @__PURE__ */ new Map();
+  let foundUnsupportedKey = false;
+  for (const { text: line, index } of lines) {
+    if (line.trim().length === 0) continue;
+    const match = line.match(/^([a-z][a-z0-9_]*):\s*(.*)$/);
+    if (!match) {
+      issues.push({
+        path: `frontmatter.line_${index + 2}`,
+        message: "Frontmatter entries must use snake_case_key: value"
+      });
+      continue;
+    }
+    const rawKey = match[1];
+    const rawValue = match[2];
+    if (rawKey === void 0 || rawValue === void 0) {
+      issues.push({
+        path: `frontmatter.line_${index + 2}`,
+        message: "Frontmatter entries must use snake_case_key: value"
+      });
+      continue;
+    }
+    if (!isBountyChallengeFrontmatterKey(rawKey)) {
+      if (DEPLOYMENT_OWNED_FRONTMATTER_KEYS.has(rawKey)) {
+        if (!foundUnsupportedKey) {
+          issues.push({
+            path: "frontmatter",
+            message: ALLOWED_FRONTMATTER_KEYS_MESSAGE
+          });
+          foundUnsupportedKey = true;
+        }
+      } else {
+        issues.push({
+          path: `frontmatter.${rawKey}`,
+          message: `Remove frontmatter key "${rawKey}"; use only the v0 template frontmatter keys: ${ALLOWED_FRONTMATTER_KEYS}`
+        });
+      }
+      continue;
+    }
+    if (values.has(rawKey)) {
+      issues.push({
+        path: `frontmatter.${rawKey}`,
+        message: `Frontmatter key "${rawKey}" must appear exactly once`
+      });
+      continue;
+    }
+    const value = normalizeFrontmatterScalar(
+      rawValue,
+      `frontmatter.${rawKey}`,
+      issues
+    );
+    if (value !== null) values.set(rawKey, value);
+  }
+  for (const key of BOUNTY_CHALLENGE_FRONTMATTER_KEYS) {
+    if (!values.has(key)) {
+      issues.push({
+        path: `frontmatter.${key}`,
+        message: `Add required frontmatter key "${key}"`
+      });
+    }
+  }
+  const profile = values.get("profile");
+  if (profile !== void 0 && profile !== BOUNTY_CHALLENGE_PROFILE) {
+    issues.push({
+      path: "frontmatter.profile",
+      message: `Must equal ${BOUNTY_CHALLENGE_PROFILE}`
+    });
+  }
+  const payoutPolicy = values.get("payout_policy");
+  if (payoutPolicy !== void 0 && payoutPolicy !== WINNER_TAKE_ALL_PAYOUT_POLICY) {
+    issues.push({
+      path: "frontmatter.payout_policy",
+      message: `Must equal ${WINNER_TAKE_ALL_PAYOUT_POLICY}`
+    });
+  }
+  const submissionDeadline = parsePositiveSafeIntegerFrontmatter(
+    values.get("submission_deadline"),
+    "frontmatter.submission_deadline",
+    issues
+  );
+  const escrowAmount = parsePositiveIntegerStringFrontmatter(
+    values.get("escrow_amount"),
+    "frontmatter.escrow_amount",
+    issues
+  );
+  if (profile !== BOUNTY_CHALLENGE_PROFILE || payoutPolicy !== WINNER_TAKE_ALL_PAYOUT_POLICY || escrowAmount === null || submissionDeadline === null) {
+    return null;
+  }
+  return {
+    profile,
+    escrowAmount,
+    submissionDeadline,
+    payoutPolicy
+  };
+}
+function normalizeFrontmatterScalar(rawValue, path5, issues) {
+  const value = rawValue.trim();
+  if (value.length === 0) {
+    issues.push({ path: path5, message: "Frontmatter value must not be empty" });
+    return null;
+  }
+  const quote = value[0];
+  if (quote !== '"' && quote !== "'") return value;
+  if (value.length < 2 || value.at(-1) !== quote) {
+    issues.push({
+      path: path5,
+      message: "Quoted frontmatter values must close with the same quote"
+    });
+    return null;
+  }
+  return value.slice(1, -1);
+}
+function parsePositiveSafeIntegerFrontmatter(value, path5, issues) {
+  if (value === void 0) return null;
+  if (!isPositiveInteger(value)) {
+    issues.push({ path: path5, message: "Must be a positive integer" });
+    return null;
+  }
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    issues.push({ path: path5, message: "Must be a positive safe integer" });
+    return null;
+  }
+  return parsed;
+}
+function parsePositiveIntegerStringFrontmatter(value, path5, issues) {
+  if (value === void 0) return null;
+  if (!isPositiveInteger(value)) {
+    issues.push({ path: path5, message: "Must be positive token smallest units" });
+    return null;
+  }
+  return value;
+}
+function validateChallengeBody(lines, issues) {
+  if (!lines.some((line) => line.trim().length > 0)) {
+    issues.push({
+      path: "body",
+      message: "Add the Markdown challenge after frontmatter"
+    });
+  }
+}
+function normalizedLines(markdown) {
+  return markdown.split("\n").map((line) => line.replace(/\r$/, ""));
+}
+function isBountyChallengeFrontmatterKey(value) {
+  return BOUNTY_CHALLENGE_FRONTMATTER_KEYS.includes(
+    value
+  );
+}
 
 // ../../packages/core/src/bounty-publication-response.ts
 import { isHex as isHex2 } from "viem";
@@ -144,22 +443,42 @@ function resolveSupportedChain(chainId) {
 }
 var FOUNDRY_CHAIN_ID = foundry.id;
 
-// ../../packages/core/src/deployments.ts
-import { baseSepolia as baseSepolia2 } from "viem/chains";
-var DEPLOYMENTS = {
-  [baseSepolia2.id]: {
-    ELGORA_HUB_ADDRESS: "0x2f97b5f616495c2e923f39a46648eb783c053ad7",
-    ELGORA_ESCROW_TOKEN_ADDRESS: "0x036cbd53842c5426634e7929541ec2318f3dcf7e",
-    payoutSchemeAddress: "0x752d4305b8567b777d479dfa9847dc4f5ffb5750",
-    ELGORA_SUBGRAPH_ENDPOINT: "https://api.goldsky.com/api/public/project_cmqz9ta0fx8bu01xt0om3fo75/subgraphs/elgora-elgorahub/testnet-production/gn",
-    deployBlock: 46353511,
-    deployTransaction: "0xed3d3c8af3c69f9f8d4ec47da7179fe4b89bd4a4cd8d8232dbbd3d3f3d38e74b",
-    sourceCommit: "1377da5c38dc5c90d8608ffa3cb15ad6f8567a01"
+// ../../packages/core/src/submission-encryption.ts
+import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
+import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+import { concatBytes, keccak256 as keccak2562, toBytes as toBytes2 } from "viem";
+import { z as z3 } from "zod";
+
+// ../../packages/core/src/base64.ts
+var BASE64_ENCODE_CHUNK_BYTES = 3 * 16384;
+var FROM_CHAR_CODE_MAX_ARGUMENTS = 4096;
+function bytesToBase64Url(bytes) {
+  const chunks = [];
+  for (let offset = 0; offset < bytes.length; offset += BASE64_ENCODE_CHUNK_BYTES) {
+    const chunk = bytes.subarray(offset, offset + BASE64_ENCODE_CHUNK_BYTES);
+    let binary = "";
+    for (let index = 0; index < chunk.length; index += FROM_CHAR_CODE_MAX_ARGUMENTS) {
+      binary += String.fromCharCode(
+        ...chunk.subarray(index, index + FROM_CHAR_CODE_MAX_ARGUMENTS)
+      );
+    }
+    chunks.push(
+      btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "")
+    );
   }
-};
-var DEFAULT_CHAIN_ID = baseSepolia2.id;
-function getDeployment(chainId) {
-  return DEPLOYMENTS[chainId];
+  return chunks.join("");
+}
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  return base64ToBytes(padded);
+}
+function base64ToBytes(value) {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
 }
 
 // ../../packages/core/src/json.ts
@@ -193,33 +512,6 @@ function canonicalizeJson(value) {
   throw new Error("Unsupported JSON value");
 }
 
-// ../../packages/core/src/submission-encryption.ts
-import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
-import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
-import { concatBytes, keccak256 as keccak2562, toBytes as toBytes2 } from "viem";
-import { z as z3 } from "zod";
-
-// ../../packages/core/src/base64.ts
-function bytesToBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function base64UrlToBytes(value) {
-  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
-  return base64ToBytes(padded);
-}
-function base64ToBytes(value) {
-  const binary = atob(value);
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.charCodeAt(index);
-  }
-  return bytes;
-}
-
 // ../../packages/core/src/submission-encryption.ts
 var PRIVATE_ARTIFACT_ENVELOPE_KIND = "elgora_private_artifact_envelope_v0";
 var PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND = "elgora_private_artifact_public_manifest_v0";
@@ -228,13 +520,17 @@ var PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND = "elgora_private_artifact_wrapped_key
 var PRIVATE_ARTIFACT_REVEAL_POLICY_KIND = "drand_timelock_reveal_policy_v0";
 var PRIVATE_ARTIFACT_HPKE_SUITE = "hpke-dhkem-x25519-hkdf-sha256+hkdf-sha256+aes-256-gcm@1";
 var MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES = 50 * 1024 * 1024;
+var MAX_SOLVER_SUBMISSION_FILES = 500;
+var MAX_SOLVER_SUBMISSION_NAME_CHARACTERS = 255;
+var MAX_SOLVER_SUBMISSION_ARTIFACT_BYTES = 37 * 1024 * 1024;
+var MAX_SOLVER_SUBMISSION_EXTRACTED_BYTES = 250 * 1e3 * 1e3;
 var PRIVATE_ARTIFACT_HPKE_INFO_PREFIX = "elgora/private-artifact-envelope/hpke-aes-key/v0";
 var AES_256_KEY_BYTES = 32;
 var AES_GCM_IV_BYTES = 12;
 var PRIVATE_ARTIFACT_NONCE_BYTES = 16;
 var AES_GCM_TAG_BITS = 128;
 var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
-var SAFE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var SOLVER_SUBMISSION_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var MEDIA_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
 var KEY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
 var base64UrlSchema = z3.string().regex(BASE64URL_RE);
@@ -242,7 +538,10 @@ var lowerAddressSchema = z3.string().refine(isLowercaseHexAddress);
 var bytes32Schema2 = z3.string().refine(isLowercaseBytes32);
 var sha256HexSchema = z3.string().refine(isSha256Hex);
 var keyIdSchema = z3.string().min(1).max(128).regex(KEY_ID_RE);
-var artifactNameSchema = z3.string().regex(SAFE_NAME_RE);
+var artifactNameSchema = z3.string().max(
+  MAX_SOLVER_SUBMISSION_NAME_CHARACTERS,
+  `Artifact filename exceeds ${MAX_SOLVER_SUBMISSION_NAME_CHARACTERS} ASCII characters (including extension). Solvers may shorten it only if the published challenge permits, before the deadline.`
+).regex(SOLVER_SUBMISSION_NAME_RE);
 var mediaTypeSchema = z3.string().regex(MEDIA_TYPE_RE);
 var bountyIdSchema = z3.string().refine(isBountyId);
 var chainIdSchema = z3.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
@@ -299,7 +598,10 @@ var encryptedBundleArtifactSchema = artifactManifestEntrySchema.extend({
 var privateArtifactEncryptedBundleSchema = z3.strictObject({
   kind: z3.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
   context: privateArtifactContextSchema,
-  artifacts: z3.array(encryptedBundleArtifactSchema).min(1).refine(
+  artifacts: z3.array(encryptedBundleArtifactSchema).min(1).max(
+    MAX_SOLVER_SUBMISSION_FILES,
+    `Submission exceeds the maximum of ${MAX_SOLVER_SUBMISSION_FILES} files.`
+  ).refine(
     (artifacts) => new Set(artifacts.map((artifact) => artifact.name.toLowerCase())).size === artifacts.length,
     "artifact names must be unique case-insensitively"
   )
@@ -849,8 +1151,8 @@ async function openAesKeyForRecipient(input) {
   });
 }
 async function encryptAes256Gcm(input) {
-  const crypto = getWebCrypto();
-  const key = await crypto.subtle.importKey(
+  const crypto2 = getWebCrypto();
+  const key = await crypto2.subtle.importKey(
     "raw",
     toArrayBufferView(input.rawAesKey),
     "AES-GCM",
@@ -858,7 +1160,7 @@ async function encryptAes256Gcm(input) {
     ["encrypt"]
   );
   return toUint8Array(
-    await crypto.subtle.encrypt(
+    await crypto2.subtle.encrypt(
       {
         name: "AES-GCM",
         iv: toArrayBufferView(input.iv),
@@ -871,8 +1173,8 @@ async function encryptAes256Gcm(input) {
   );
 }
 async function decryptAes256Gcm(input) {
-  const crypto = getWebCrypto();
-  const key = await crypto.subtle.importKey(
+  const crypto2 = getWebCrypto();
+  const key = await crypto2.subtle.importKey(
     "raw",
     toArrayBufferView(input.rawAesKey),
     "AES-GCM",
@@ -881,7 +1183,7 @@ async function decryptAes256Gcm(input) {
   );
   try {
     return toUint8Array(
-      await crypto.subtle.decrypt(
+      await crypto2.subtle.decrypt(
         {
           name: "AES-GCM",
           iv: toArrayBufferView(input.iv),
@@ -959,6 +1261,277 @@ function compareCanonicalStrings(left, right) {
   return 0;
 }
 
+// ../../packages/core/src/protocol-profile.ts
+var PROTOCOL_PROFILE_V0 = Object.freeze({
+  profile: BOUNTY_CHALLENGE_PROFILE,
+  submission: Object.freeze({
+    maxCiphertextBytes: MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES,
+    maxExtractedBytes: MAX_SOLVER_SUBMISSION_EXTRACTED_BYTES,
+    maxFiles: MAX_SOLVER_SUBMISSION_FILES,
+    filename: Object.freeze({
+      maxCharacters: MAX_SOLVER_SUBMISSION_NAME_CHARACTERS,
+      firstCharacter: "letter_or_digit",
+      allowedCharacters: "letters_digits_dot_underscore_hyphen",
+      caseInsensitivelyUnique: true
+    }),
+    layout: Object.freeze({
+      flat: true,
+      regularFilesOnly: true,
+      allowsSubdirectories: false,
+      allowsSymlinks: false,
+      allowsEmpty: false,
+      allowsArchivedDirectoryEntries: false,
+      allowsArchivedPathTraversal: false
+    }),
+    externalReferences: false
+  }),
+  challenge: Object.freeze({
+    maxMarkdownCharacters: MAX_BOUNTY_CHALLENGE_MARKDOWN_CHARACTERS,
+    requiredFrontmatterKeys: Object.freeze([
+      ...BOUNTY_CHALLENGE_FRONTMATTER_KEYS
+    ]),
+    optionalFrontmatterKeys: Object.freeze([
+      ...BOUNTY_CHALLENGE_OPTIONAL_FRONTMATTER_KEYS
+    ]),
+    payoutPolicies: Object.freeze([WINNER_TAKE_ALL_PAYOUT_POLICY])
+  }),
+  encryption: Object.freeze({
+    type: SUBMISSION_ENCRYPTION_TYPE
+  }),
+  tightenable: Object.freeze({
+    max_extracted_bytes: Object.freeze({
+      comparison: "at_most",
+      profileValue: MAX_SOLVER_SUBMISSION_EXTRACTED_BYTES
+    }),
+    max_files: Object.freeze({
+      comparison: "at_most",
+      profileValue: MAX_SOLVER_SUBMISSION_FILES
+    }),
+    allowed_extensions: Object.freeze({ comparison: "subset" }),
+    required_files: Object.freeze({ comparison: "filename_list" })
+  })
+});
+var PROTOCOL_PROFILES = /* @__PURE__ */ new Map([
+  [PROTOCOL_PROFILE_V0.profile, PROTOCOL_PROFILE_V0]
+]);
+var CURRENT_PROTOCOL_PROFILE = PROTOCOL_PROFILE_V0;
+var PROTOCOL_PROFILE_VERSIONS = Object.freeze([
+  ...PROTOCOL_PROFILES.keys()
+]);
+function getProtocolProfile(version) {
+  return PROTOCOL_PROFILES.get(version) ?? null;
+}
+
+// ../../packages/core/src/challenge-conformance.ts
+function checkChallengeConformance(input, profile = CURRENT_PROTOCOL_PROFILE) {
+  const issues = [];
+  const parsed = typeof input === "string" ? readFrontmatter(input, issues) : input;
+  const pinned = parsed === null ? null : resolveProfile(parsed.publicationTerms.profile, profile, issues);
+  if (parsed !== null && pinned !== null) {
+    checkTightenings(parsed.constraints, pinned, issues);
+  }
+  return { issues, profile: pinned };
+}
+function readFrontmatter(markdown, issues) {
+  try {
+    return parseBountyChallengeMarkdown(markdown);
+  } catch (error) {
+    if (!(error instanceof BountyChallengeSpecValidationError)) throw error;
+    for (const issue of error.issues) {
+      issues.push({
+        code: "frontmatter_invalid",
+        anchor: issue.path,
+        path: issue.path,
+        message: issue.message
+      });
+    }
+    return null;
+  }
+}
+function resolveProfile(declared, fallback, issues) {
+  const pinned = getProtocolProfile(declared) ?? (declared === fallback.profile ? fallback : null);
+  if (pinned === null) {
+    issues.push({
+      code: "profile_unknown",
+      anchor: "frontmatter.profile",
+      path: "frontmatter.profile",
+      message: `Unknown protocol profile "${declared}". A bounty can only pin a published profile version.`
+    });
+  }
+  return pinned;
+}
+function checkTightenings(constraints, profile, issues) {
+  for (const constraint of constraints) {
+    const anchor = `frontmatter.constraints.${constraint.key}`;
+    const rule = profile.tightenable[constraint.key];
+    if (rule === void 0) {
+      issues.push({
+        code: "tightening_unknown_key",
+        anchor,
+        path: anchor,
+        message: `"${constraint.key}" is not a constraint a challenge may narrow. A Poster sets bounty parameters; protocol invariants and agent procedure are not among them. Tightenable: ${Object.keys(profile.tightenable).join(", ")}.`
+      });
+      continue;
+    }
+    if (rule.comparison === "at_most") {
+      checkNumericTightening(constraint, rule, anchor, issues);
+      continue;
+    }
+    checkListTightening(constraint, rule, profile, anchor, issues);
+  }
+}
+function checkNumericTightening(constraint, rule, anchor, issues) {
+  const ceiling = rule.profileValue;
+  if (ceiling === void 0) return;
+  if (!/^\d+$/.test(constraint.value)) {
+    issues.push({
+      code: "tightening_malformed",
+      anchor,
+      path: anchor,
+      message: `"${constraint.key}" must be a positive integer, written in full without units or separators.`
+    });
+    return;
+  }
+  const value = Number(constraint.value);
+  if (value <= 0 || !Number.isSafeInteger(value)) {
+    issues.push({
+      code: "tightening_malformed",
+      anchor,
+      path: anchor,
+      message: `"${constraint.key}" must be a positive integer below ${ceiling}.`
+    });
+    return;
+  }
+  if (value >= ceiling) {
+    issues.push({
+      code: "tightening_exceeds_profile",
+      anchor,
+      path: anchor,
+      message: `"${constraint.key}" is ${value}, which does not narrow the protocol value of ${ceiling}. A challenge may lower a limit and may never raise or restate one.`
+    });
+  }
+}
+function checkListTightening(constraint, rule, profile, anchor, issues) {
+  const members = parseInlineList(constraint.value);
+  if (members === null || members.length === 0) {
+    issues.push({
+      code: "tightening_malformed",
+      anchor,
+      path: anchor,
+      message: `"${constraint.key}" must be a non-empty inline list, written as [a, b].`
+    });
+    return;
+  }
+  if (rule.comparison === "subset") {
+    const malformed2 = members.filter(
+      (member) => !/^\.[A-Za-z0-9][A-Za-z0-9.]*$/.test(member)
+    );
+    if (malformed2.length > 0) {
+      issues.push({
+        code: "tightening_malformed",
+        anchor,
+        path: anchor,
+        message: `"${constraint.key}" entries must be filename extensions including the dot: ${malformed2.join(", ")}.`
+      });
+    }
+    return;
+  }
+  const { filename, maxFiles } = profile.submission;
+  const malformed = members.filter(
+    (member) => member.length > filename.maxCharacters || !SOLVER_SUBMISSION_NAME_RE.test(member)
+  );
+  if (malformed.length > 0) {
+    issues.push({
+      code: "tightening_malformed",
+      anchor,
+      path: anchor,
+      message: `"${constraint.key}" names files that do not satisfy the profile's filename rule: ${malformed.join(", ")}.`
+    });
+    return;
+  }
+  if (filename.caseInsensitivelyUnique) {
+    const seen = /* @__PURE__ */ new Set();
+    const collisions = /* @__PURE__ */ new Set();
+    for (const member of members) {
+      const folded = member.toLowerCase();
+      if (seen.has(folded)) collisions.add(folded);
+      seen.add(folded);
+    }
+    if (collisions.size > 0) {
+      issues.push({
+        code: "tightening_malformed",
+        anchor,
+        path: anchor,
+        message: `"${constraint.key}" names files that differ only in case: ${[...collisions].join(", ")}. A Submission's filenames are unique case-insensitively, so no Solver could satisfy this set.`
+      });
+      return;
+    }
+  }
+  if (members.length > maxFiles) {
+    issues.push({
+      code: "tightening_exceeds_profile",
+      anchor,
+      path: anchor,
+      message: `"${constraint.key}" requires ${members.length} files, above the profile's ceiling of ${maxFiles}.`
+    });
+  }
+}
+function parseInlineList(value) {
+  if (!value.startsWith("[") || !value.endsWith("]")) return null;
+  return value.slice(1, -1).split(",").map((member) => member.trim().replace(/^["']|["']$/g, "")).filter((member) => member.length > 0);
+}
+
+// ../../packages/core/src/deployments.ts
+import { baseSepolia as baseSepolia2 } from "viem/chains";
+var DEPLOYMENTS = {
+  [baseSepolia2.id]: {
+    ELGORA_HUB_ADDRESS: "0x2f97b5f616495c2e923f39a46648eb783c053ad7",
+    ELGORA_ESCROW_TOKEN_ADDRESS: "0x036cbd53842c5426634e7929541ec2318f3dcf7e",
+    payoutSchemeAddress: "0x752d4305b8567b777d479dfa9847dc4f5ffb5750",
+    ELGORA_SUBGRAPH_ENDPOINT: "https://api.goldsky.com/api/public/project_cmtu7wslg04s501ovc2je3beh/subgraphs/elgora-elgorahub/testnet-production/gn",
+    deployBlock: 46353511,
+    deployTransaction: "0xed3d3c8af3c69f9f8d4ec47da7179fe4b89bd4a4cd8d8232dbbd3d3f3d38e74b",
+    sourceCommit: "1377da5c38dc5c90d8608ffa3cb15ad6f8567a01"
+  }
+};
+var DEFAULT_CHAIN_ID = baseSepolia2.id;
+function getDeployment(chainId) {
+  return DEPLOYMENTS[chainId];
+}
+
+// src/check-page.ts
+var CHECK_PAGE_USAGE = "Usage: elgora-cli check-page <bounty_challenge_md_path>\n   or: elgora-cli check-page -";
+async function main(_env = process.env, argv = process.argv.slice(2)) {
+  const markdown = await readBountyChallengeMarkdown(argv);
+  const { issues, profile } = checkChallengeConformance(markdown);
+  console.log(
+    JSON.stringify({
+      event: issues.length === 0 ? "check_page.structure_conforming" : "check_page.issues",
+      profile: profile?.profile ?? null,
+      // Named so a caller cannot read a clean result as "this page is safe".
+      checked: "structure",
+      issues: issues.map((issue) => ({
+        code: issue.code,
+        anchor: issue.anchor,
+        message: issue.message
+      }))
+    })
+  );
+  if (issues.length > 0) {
+    process.exitCode = 1;
+  }
+}
+async function readBountyChallengeMarkdown(argv) {
+  const path5 = argv[0];
+  if (!path5) {
+    throw new Error(CHECK_PAGE_USAGE);
+  }
+  if (path5 === "-") {
+    return readStdinText(process.stdin);
+  }
+  return readFile(path5, "utf8");
+}
+
 // ../../packages/core/src/api/artifact-storage.ts
 var ArtifactTooLargeError = class extends Error {
   code = "artifact_too_large";
@@ -3481,12 +4054,24 @@ async function classifyBeaconFetch(operation) {
 }
 
 // ../../packages/core/src/api/elgorahub.ts
-import { encodeFunctionData, getAbiItem as getAbiItem2 } from "viem";
+import {
+  BaseError,
+  bytesToHex,
+  ContractFunctionRevertedError,
+  ContractFunctionZeroDataError,
+  domainSeparator,
+  encodeFunctionData,
+  getAbiItem as getAbiItem2,
+  parseAbi,
+  parseSignature,
+  recoverTypedDataAddress
+} from "viem";
 var ELGORA_HUB_ERRORS = ELGORA_HUB_ABI.filter(
   (item) => item.type === "error"
 );
 var ELGORA_HUB_CREATE_BOUNTY_ABI = [
   getAbiItem2({ abi: ELGORA_HUB_ABI, name: "createBounty" }),
+  getAbiItem2({ abi: ELGORA_HUB_ABI, name: "createBountyWithAuthorization" }),
   ...ELGORA_HUB_ERRORS
 ];
 var ELGORA_HUB_SUBMIT_ABI = [
@@ -3546,6 +4131,117 @@ var ELGORA_HUB_ADD_GUARDIAN_ABI = [
   getAbiItem2({ abi: ELGORA_HUB_ABI, name: "addGuardian" }),
   ...ELGORA_HUB_ERRORS
 ];
+var RECEIVE_AUTHORIZATION_TYPES = {
+  ReceiveWithAuthorization: [
+    { name: "from", type: "address" },
+    { name: "to", type: "address" },
+    { name: "value", type: "uint256" },
+    { name: "validAfter", type: "uint256" },
+    { name: "validBefore", type: "uint256" },
+    { name: "nonce", type: "bytes32" }
+  ]
+};
+var USDC_DOMAIN_ABI = parseAbi([
+  "function name() view returns (string)",
+  "function version() view returns (string)",
+  "function DOMAIN_SEPARATOR() view returns (bytes32)"
+]);
+async function prepareAuthorizedCreateBountyTransaction(input) {
+  const { transaction, publicClient, poster, tokenAddress } = input;
+  if (await publicClient.getChainId() !== transaction.chain_id) {
+    throw new Error("Funding RPC is on the wrong chain.");
+  }
+  const code = await publicClient.getCode({ address: poster });
+  if (code && code !== "0x") return null;
+  let name;
+  let version;
+  let tokenDomain;
+  try {
+    [name, version, tokenDomain] = await Promise.all([
+      publicClient.readContract({
+        address: tokenAddress,
+        abi: USDC_DOMAIN_ABI,
+        functionName: "name"
+      }),
+      publicClient.readContract({
+        address: tokenAddress,
+        abi: USDC_DOMAIN_ABI,
+        functionName: "version"
+      }),
+      publicClient.readContract({
+        address: tokenAddress,
+        abi: USDC_DOMAIN_ABI,
+        functionName: "DOMAIN_SEPARATOR"
+      })
+    ]);
+  } catch (error) {
+    if (error instanceof BaseError && error.walk(
+      (cause) => cause instanceof ContractFunctionRevertedError || cause instanceof ContractFunctionZeroDataError
+    ))
+      return null;
+    throw error;
+  }
+  const block = await publicClient.getBlock();
+  const authorization = {
+    domain: {
+      name,
+      version,
+      chainId: transaction.chain_id,
+      verifyingContract: tokenAddress
+    },
+    types: RECEIVE_AUTHORIZATION_TYPES,
+    primaryType: "ReceiveWithAuthorization",
+    message: {
+      from: poster,
+      to: transaction.to,
+      value: BigInt(transaction.args.escrow_amount),
+      validAfter: 0n,
+      validBefore: block.timestamp + 600n,
+      nonce: bytesToHex(crypto.getRandomValues(new Uint8Array(32)))
+    }
+  };
+  if (domainSeparator({ domain: authorization.domain }).toLowerCase() !== tokenDomain.toLowerCase()) {
+    throw new Error("USDC authorization domain does not match the token.");
+  }
+  let signature;
+  try {
+    signature = await input.sign(authorization);
+  } catch (error) {
+    const seen = /* @__PURE__ */ new Set();
+    let current = error;
+    let unsupported = false;
+    while (current && typeof current === "object" && !seen.has(current)) {
+      seen.add(current);
+      const cause = current;
+      if (cause.code === 4001 || cause.name === "UserRejectedRequestError")
+        throw error;
+      unsupported ||= cause.code === 4200 || cause.code === -32601 || cause.code === -32004;
+      current = cause.cause;
+    }
+    if (unsupported) return null;
+    throw error;
+  }
+  if ((await recoverTypedDataAddress({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
+    throw new Error("USDC authorization was not signed by the funding Poster.");
+  }
+  const { r, s, yParity } = parseSignature(signature);
+  const { validAfter, validBefore, nonce } = authorization.message;
+  return {
+    chain_id: transaction.chain_id,
+    to: transaction.to,
+    value: "0",
+    data: encodeFunctionData({
+      abi: ELGORA_HUB_CREATE_BOUNTY_ABI,
+      functionName: "createBountyWithAuthorization",
+      args: [
+        transaction.args.spec_commitment,
+        authorization.message.value,
+        BigInt(transaction.args.submission_deadline),
+        { validAfter, validBefore, nonce, v: yParity + 27, r, s }
+      ]
+    })
+  };
+}
 function encodeAddGuardianTransaction(input) {
   return {
     chain_id: input.chainId,
@@ -3699,15 +4395,34 @@ var ELGORA_HUB_FEE_POLICY_ABI = [
 // ../../packages/core/src/api/orchestrator-readiness.ts
 import { z as z6 } from "zod";
 var MAX_ORCHESTRATOR_ISSUES = 20;
-var boundedText = (maxLength) => z6.string().trim().min(1).max(maxLength);
 var readinessIssueSchema = z6.object({
-  path: boundedText(120),
-  message: boundedText(500)
+  path: z6.string().trim().min(1).max(120),
+  message: z6.string().trim().min(1).max(1500),
+  code: z6.enum([
+    "acceptance_undecidable",
+    "winner_unresolved",
+    "source_unidentified",
+    "domain_underspecified",
+    "platform_conflict",
+    "operative_instruction",
+    "placeholder_unreplaced",
+    "unsafe_content"
+  ]),
+  anchor: z6.string().trim().min(1).max(120),
+  hazard: z6.boolean()
 }).strict();
 var readinessResponseSchema = z6.object({
-  judgeable: z6.boolean(),
-  issues: z6.array(readinessIssueSchema).max(MAX_ORCHESTRATOR_ISSUES)
+  issues: z6.array(readinessIssueSchema).max(MAX_ORCHESTRATOR_ISSUES),
+  judgeable: z6.boolean()
 }).strict();
+var READINESS_OUTPUT_JSON_SCHEMA = z6.toJSONSchema(readinessResponseSchema, {
+  override: ({ jsonSchema }) => {
+    delete jsonSchema.minLength;
+    delete jsonSchema.maxLength;
+    delete jsonSchema.maxItems;
+  }
+});
+delete READINESS_OUTPUT_JSON_SCHEMA.$schema;
 var providerMessageSchema = z6.object({
   id: z6.string().optional(),
   choices: z6.array(
@@ -3875,7 +4590,7 @@ var deliveryKeyConfigResponseSchema = z9.strictObject({
 import { keccak256 as keccak2564, toBytes as toBytes3, zeroAddress as zeroAddress2 } from "viem";
 import { z as z10 } from "zod";
 var WRITTEN_VERDICT_FORMAT_VERSION = 0;
-var FRONTMATTER_DELIMITER = "---";
+var FRONTMATTER_DELIMITER2 = "---";
 var decimalSchema = z10.string().regex(/^[1-9][0-9]*$/, "Must be a positive integer").transform(Number).refine(Number.isSafeInteger, "Must be a safe integer");
 var bountyIdSchema2 = z10.string().regex(/^(0|[1-9][0-9]*)$/, "Must be a non-negative integer");
 var addressSchema2 = z10.string().refine(isHexAddress, "Must be a hex-encoded address").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
@@ -3907,7 +4622,7 @@ var writtenVerdictSchema = z10.discriminatedUnion("outcome", [
   }).strict()
 ]);
 function buildWrittenVerdictMarkdown(input) {
-  const common = `${FRONTMATTER_DELIMITER}
+  const common = `${FRONTMATTER_DELIMITER2}
 format_version: ${WRITTEN_VERDICT_FORMAT_VERSION}
 chain_id: ${input.config.chainId}
 hub_address: ${input.config.hubAddress.toLowerCase()}
@@ -3917,7 +4632,7 @@ outcome: ${input.outcome}`;
 awarded_submission_commitment: ${input.awardedSubmissionCommitment.toLowerCase()}` : `winner: ${zeroAddress2}`;
   const markdown = `${common}
 ${position}
-${FRONTMATTER_DELIMITER}
+${FRONTMATTER_DELIMITER2}
 ${input.verdictBody}`;
   parseWrittenVerdictMarkdown(markdown);
   return markdown;
@@ -3928,11 +4643,11 @@ function deriveReportCommitment(markdown) {
 function parseWrittenVerdictMarkdown(markdown) {
   const closingDelimiter = markdown.indexOf(
     `
-${FRONTMATTER_DELIMITER}
+${FRONTMATTER_DELIMITER2}
 `,
-    FRONTMATTER_DELIMITER.length + 1
+    FRONTMATTER_DELIMITER2.length + 1
   );
-  if (!markdown.startsWith(`${FRONTMATTER_DELIMITER}
+  if (!markdown.startsWith(`${FRONTMATTER_DELIMITER2}
 `) || closingDelimiter < 0) {
     throw invalidWrittenVerdict(
       "frontmatter",
@@ -3940,12 +4655,12 @@ ${FRONTMATTER_DELIMITER}
     );
   }
   const frontmatter = markdown.slice(
-    FRONTMATTER_DELIMITER.length + 1,
+    FRONTMATTER_DELIMITER2.length + 1,
     closingDelimiter
   );
   const rawVerdict = {
     verdict_body: markdown.slice(
-      closingDelimiter + FRONTMATTER_DELIMITER.length + 2
+      closingDelimiter + FRONTMATTER_DELIMITER2.length + 2
     )
   };
   for (const [index, line] of frontmatter.split("\n").entries()) {
@@ -4018,14 +4733,12 @@ function assertChainId(actual, expected) {
     throw new Error(`RPC returned chain_id ${actual}, expected ${expected}`);
   }
 }
+var SIGNING_BLOCK_OFFSET = 3n;
 async function fetchSignableBlock(client) {
-  const block = await client.getBlock();
-  if (block.hash === null) {
-    throw new Error(
-      "The latest block has no hash yet \u2014 retry signing in a moment."
-    );
-  }
-  return { number: block.number, hash: block.hash };
+  const head = await client.getBlockNumber();
+  const anchorNumber = head > SIGNING_BLOCK_OFFSET ? head - SIGNING_BLOCK_OFFSET : 0n;
+  const anchor = await client.getBlock({ blockNumber: anchorNumber });
+  return { number: anchor.number, hash: anchor.hash };
 }
 async function assertHubDeployment(client, chainId, hubAddress) {
   const [actualChainId, hubCode] = await Promise.all([
@@ -4068,7 +4781,7 @@ function withDeploymentDefaults(env) {
 
 // src/claim.ts
 var CLAIMANT_ADDRESS_FLAG = "--claimant-address";
-async function main(env = process.env, argv = process.argv.slice(2)) {
+async function main2(env = process.env, argv = process.argv.slice(2)) {
   const args = readClaimArgs(argv);
   const config = loadClaimConfig(env, args.claimantAddress);
   const account = config.claimantPrivateKey ? privateKeyToAccount(config.claimantPrivateKey) : null;
@@ -4470,12 +5183,16 @@ function formatApiError(body) {
     const apiError = body.error;
     const parts = [String(apiError.message)];
     if (Array.isArray(apiError.issues) && apiError.issues.length > 0) {
-      parts.push(`issues: ${JSON.stringify(apiError.issues)}`);
+      for (const issue of apiError.issues) {
+        if (!issue || typeof issue !== "object" || typeof issue.message !== "string")
+          continue;
+        parts.push(`${issue.path || "request"}: ${issue.message}`);
+      }
     }
     if (apiError.next_action !== void 0 && apiError.next_action !== null) {
       parts.push(`next action: ${String(apiError.next_action)}`);
     }
-    return parts.join(" \u2014 ");
+    return parts.join("\n");
   }
   return JSON.stringify(body);
 }
@@ -4579,7 +5296,7 @@ import {
 // ../../packages/core/src/auth/signature.ts
 import {
   isAddressEqual,
-  recoverTypedDataAddress
+  recoverTypedDataAddress as recoverTypedDataAddress2
 } from "viem";
 
 // ../../packages/core/src/auth/request-approval-header.ts
@@ -4700,7 +5417,7 @@ import { mkdir, writeFile } from "fs/promises";
 import path from "path";
 import { privateKeyToAccount as privateKeyToAccount3 } from "viem/accounts";
 var DEFAULT_OUTPUT_ROOT = "./guardian-open";
-async function main2(env = process.env, argv = process.argv.slice(2)) {
+async function main3(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
   const envWithDefaults = withDeploymentDefaults(env);
   const config = loadClientDeploymentConfig(
@@ -4791,7 +5508,11 @@ async function main2(env = process.env, argv = process.argv.slice(2)) {
       bounty_id: args.bountyId,
       solver: args.solver,
       submission_commitment: args.submissionCommitment,
-      artifact_count: opened.artifacts.length
+      artifact_count: opened.artifacts.length,
+      // The budget the Guardian has to vet these artifacts against before
+      // extracting any archive among them. Reported here so it comes from the
+      // running client rather than a possibly older copy of the skill.
+      max_extracted_bytes: MAX_SOLVER_SUBMISSION_EXTRACTED_BYTES
     })
   );
 }
@@ -4857,7 +5578,7 @@ function readGuardianPrivateKeys(env) {
 
 // src/guardian-deliver-key.ts
 var USAGE = "Usage: elgora-cli guardian:deliver-key <bounty_id> <solver> <submission_commitment>";
-async function main3(env = process.env, argv = process.argv.slice(2)) {
+async function main4(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl, argv: positionalArgs } = extractApiBaseUrlFlag(argv);
   const { bountyId, solver, submissionCommitment } = readArgs(positionalArgs);
   const envWithDefaults = withDeploymentDefaults(env);
@@ -4999,6 +5720,7 @@ var VERDICT_FIELDS = `
   awardedSubmissionCommitment
   reportCommitment
   payoutData
+  committedTxHash
   committedAt
   updatedAt
 `;
@@ -5458,6 +6180,7 @@ function mapVerdict(row) {
     ),
     reportCommitment: asHex(record.reportCommitment, "reportCommitment"),
     payoutData: asHex(record.payoutData, "payoutData"),
+    committedTxHash: asHex(record.committedTxHash, "committedTxHash"),
     committedAt: asString(record.committedAt, "committedAt"),
     updatedAt: asString(record.updatedAt, "updatedAt")
   };
@@ -5686,7 +6409,7 @@ function asNullableOutcome(value, field) {
 
 // src/guardian-judgeable.ts
 import { zeroAddress as zeroAddress3 } from "viem";
-async function main4(env = process.env, argv = process.argv.slice(2)) {
+async function main5(env = process.env, argv = process.argv.slice(2)) {
   const guardian = readGuardianAddress(argv);
   const config = readConfig(withDeploymentDefaults(env));
   const snapshot = await createElgoraSubgraphClient({
@@ -5780,10 +6503,10 @@ function requiredUrl(env, name) {
 }
 
 // src/guardian-prove-roster-key.ts
-import { readFile } from "fs/promises";
-import { text as readStdinText } from "stream/consumers";
+import { readFile as readFile2 } from "fs/promises";
+import { text as readStdinText2 } from "stream/consumers";
 import { privateKeyToAccount as privateKeyToAccount5 } from "viem/accounts";
-async function main5(env = process.env, argv = process.argv.slice(2)) {
+async function main6(env = process.env, argv = process.argv.slice(2)) {
   const [path5] = argv;
   if (!path5) {
     throw new Error(
@@ -5791,7 +6514,7 @@ async function main5(env = process.env, argv = process.argv.slice(2)) {
     );
   }
   const challenge = parseChallenge(
-    path5 === "-" ? await readStdinText(process.stdin) : await readFile(path5, "utf8")
+    path5 === "-" ? await readStdinText2(process.stdin) : await readFile2(path5, "utf8")
   );
   const envWithDefaults = withDeploymentDefaults(env);
   const { chainId, hubAddress } = loadPublicDeploymentConfig(envWithDefaults);
@@ -5858,7 +6581,7 @@ function parseChallenge(text) {
 }
 
 // src/guardian-verdict.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { zeroAddress as zeroAddress4 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount6 } from "viem/accounts";
 var OUTCOME = {
@@ -5895,7 +6618,7 @@ function parseVerdictArgs(argv) {
   }
   throw usageError();
 }
-async function main6(env = process.env, argv = process.argv.slice(2)) {
+async function main7(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: positionalArgs } = extractApiBaseUrlFlag(argv);
   const args = parseVerdictArgs(positionalArgs);
   const envWithDefaults = withDeploymentDefaults(env);
@@ -5915,7 +6638,7 @@ async function main6(env = process.env, argv = process.argv.slice(2)) {
   const publicClient = createChainPublicClient(config.chainId, rpcUrl);
   const walletClient = createChainWalletClient(config.chainId, rpcUrl, account);
   await assertHubDeployment(publicClient, config.chainId, config.hubAddress);
-  const verdictBody = await readFile2(args.verdictBodyPath, "utf8");
+  const verdictBody = await readFile3(args.verdictBodyPath, "utf8");
   const markdown = args.outcome === "awarded" ? buildWrittenVerdictMarkdown({
     config,
     bountyId: args.bountyId,
@@ -6184,7 +6907,7 @@ import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import path2 from "path";
 import { privateKeyToAccount as privateKeyToAccount7 } from "viem/accounts";
 var DEFAULT_OUTPUT_ROOT2 = "./winning-submission";
-async function main7(env = process.env, argv = process.argv.slice(2)) {
+async function main8(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
   const args = readPosterOpenWinningSubmissionArgs(remainingArgv);
   const envWithDefaults = withDeploymentDefaults(env);
@@ -6323,25 +7046,26 @@ function required3(env, name) {
 }
 
 // src/publish-fund.ts
-import { readFile as readFile3 } from "fs/promises";
-import { text as readStdinText2 } from "stream/consumers";
+import { readFile as readFile4 } from "fs/promises";
+import { text as readStdinText3 } from "stream/consumers";
 import {
-  parseAbi,
+  decodeFunctionData,
+  parseAbi as parseAbi2,
   parseEventLogs
 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount8 } from "viem/accounts";
 var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path>\n   or: elgora-cli poster:publish-fund -";
-var usdcAbi = parseAbi([
+var usdcAbi = parseAbi2([
   "function approve(address spender,uint256 value) returns (bool)",
   "function balanceOf(address account) view returns (uint256)"
 ]);
-async function main8(env = process.env, argv = process.argv.slice(2)) {
+async function main9(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
   const config = loadPublishFundConfig(
     withDeploymentDefaults(env),
     apiBaseUrlOverride
   );
-  const bountyChallengeMarkdown = await readBountyChallengeMarkdown(remainingArgv);
+  const bountyChallengeMarkdown = await readBountyChallengeMarkdown2(remainingArgv);
   const account = privateKeyToAccount8(config.posterPrivateKey);
   const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
   const walletClient = createChainWalletClient(
@@ -6415,35 +7139,58 @@ async function main8(env = process.env, argv = process.argv.slice(2)) {
       `Poster has insufficient escrow token balance on chain ${config.chainId}: required=${escrowAmount.toString()} available=${usdcBalance.toString()}`
     );
   }
-  const approveHash = await walletClient.writeContract({
-    address: config.escrowTokenAddress,
-    abi: usdcAbi,
-    functionName: "approve",
-    args: [config.hubAddress, escrowAmount]
-  });
-  const approveReceipt = await publicClient.waitForTransactionReceipt({
-    hash: approveHash
+  const authorized = await prepareAuthorizedCreateBountyTransaction({
+    transaction: prepared.create_bounty_transaction,
+    tokenAddress: config.escrowTokenAddress,
+    poster: account.address,
+    publicClient,
+    sign: (typedData) => account.signTypedData(typedData)
   });
-  if (approveReceipt.status !== "success") {
-    throw new Error(`approve transaction reverted: ${approveHash}`);
+  let createBountyHash;
+  if (authorized) {
+    const call = decodeFunctionData({
+      abi: ELGORA_HUB_CREATE_BOUNTY_ABI,
+      data: authorized.data
+    });
+    if (call.functionName !== "createBountyWithAuthorization") {
+      throw new Error("Expected an authorization funding call.");
+    }
+    createBountyHash = await walletClient.writeContract({
+      address: authorized.to,
+      abi: ELGORA_HUB_CREATE_BOUNTY_ABI,
+      ...call
+    });
+  } else {
+    const approveHash = await walletClient.writeContract({
+      address: config.escrowTokenAddress,
+      abi: usdcAbi,
+      functionName: "approve",
+      args: [config.hubAddress, escrowAmount]
+    });
+    const approveReceipt = await publicClient.waitForTransactionReceipt({
+      hash: approveHash
+    });
+    if (approveReceipt.status !== "success") {
+      throw new Error(`approve transaction reverted: ${approveHash}`);
+    }
+    console.log(
+      JSON.stringify({
+        event: "publish_fund.usdc_approved",
+        tx_hash: approveHash,
+        block_number: approveReceipt.blockNumber.toString()
+      })
+    );
+    createBountyHash = await walletClient.writeContract({
+      address: config.hubAddress,
+      abi: ELGORA_HUB_CREATE_BOUNTY_ABI,
+      functionName: "createBounty",
+      args: [
+        localSpecCommitment,
+        escrowAmount,
+        BigInt(prepared.create_bounty_transaction.args.submission_deadline)
+      ]
+    });
   }
-  console.log(
-    JSON.stringify({
-      event: "publish_fund.usdc_approved",
-      tx_hash: approveHash,
-      block_number: approveReceipt.blockNumber.toString()
-    })
-  );
-  const createBountyHash = await walletClient.writeContract({
-    address: config.hubAddress,
-    abi: ELGORA_HUB_CREATE_BOUNTY_ABI,
-    functionName: "createBounty",
-    args: [
-      localSpecCommitment,
-      escrowAmount,
-      BigInt(prepared.create_bounty_transaction.args.submission_deadline)
-    ]
-  });
   const createBountyReceipt = await publicClient.waitForTransactionReceipt({
     hash: createBountyHash
   });
@@ -6493,15 +7240,15 @@ async function requestPreparePublication(input) {
   );
   return bountyPublicationResponseSchema.parse(body);
 }
-async function readBountyChallengeMarkdown(argv) {
+async function readBountyChallengeMarkdown2(argv) {
   const path5 = argv[0];
   if (!path5) {
     throw new Error(PUBLISH_FUND_USAGE);
   }
   if (path5 === "-") {
-    return readStdinText2(process.stdin);
+    return readStdinText3(process.stdin);
   }
-  return readFile3(path5, "utf8");
+  return readFile4(path5, "utf8");
 }
 function loadPublishFundConfig(env, apiBaseUrlOverride) {
   const clientConfig = loadClientDeploymentConfig(env, apiBaseUrlOverride);
@@ -6534,7 +7281,7 @@ import { isAddress as isAddress4 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount9 } from "viem/accounts";
 var ROSTER_ADMIN_ADDRESS_FLAG = "--roster-admin-address";
 var ENCRYPTION_PUBLIC_KEY_RE = /^[A-Za-z0-9_-]{43}$/;
-async function main9(env = process.env, argv = process.argv.slice(2)) {
+async function main10(env = process.env, argv = process.argv.slice(2)) {
   const args = parseRosterAddGuardianArgs(argv);
   const config = loadRosterAddGuardianConfig(env, args.rosterAdminAddress);
   const account = config.rosterAdminPrivateKey ? privateKeyToAccount9(config.rosterAdminPrivateKey) : null;
@@ -6691,7 +7438,7 @@ function usageError2() {
 // src/roster-prepare-guardian-proof.ts
 import { isAddress as isAddress5 } from "viem";
 var ENCRYPTION_PUBLIC_KEY_RE2 = /^[A-Za-z0-9_-]{43}$/;
-async function main10(env = process.env, argv = process.argv.slice(2)) {
+async function main11(env = process.env, argv = process.argv.slice(2)) {
   const args = parseArgs(argv);
   const envWithDefaults = withDeploymentDefaults(env);
   const { chainId, hubAddress } = loadPublicDeploymentConfig(envWithDefaults);
@@ -6738,17 +7485,17 @@ function usageError3() {
 }
 
 // src/roster-verify-guardian-proof.ts
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 import { isAddress as isAddress6, isHex as isHex5, recoverMessageAddress } from "viem";
-async function main11(_env = process.env, argv = process.argv.slice(2)) {
+async function main12(_env = process.env, argv = process.argv.slice(2)) {
   const [preparedPath, responsePath] = argv;
   if (!preparedPath || !responsePath) {
     throw new Error(
       "Usage: elgora-cli roster:verify-guardian-proof <prepared_json_path> <response_json_path>"
     );
   }
-  const prepared = parsePrepared(await readFile4(preparedPath, "utf8"));
-  const response = parseResponse(await readFile4(responsePath, "utf8"));
+  const prepared = parsePrepared(await readFile5(preparedPath, "utf8"));
+  const response = parseResponse(await readFile5(responsePath, "utf8"));
   const fixture = base64UrlToBytes(prepared.fixture);
   const signedPayload = buildGuardianRosterKeyProofSignedPayload(
     prepared.message,
@@ -6830,11 +7577,11 @@ function get(value, key) {
 }
 
 // src/spec-commitment.ts
-import { readFile as readFile5 } from "fs/promises";
-import { text as readStdinText3 } from "stream/consumers";
+import { readFile as readFile6 } from "fs/promises";
+import { text as readStdinText4 } from "stream/consumers";
 var SPEC_COMMITMENT_USAGE = "Usage: elgora-cli spec-commitment <bounty_challenge_md_path>\n   or: elgora-cli spec-commitment -";
-async function main12(_env = process.env, argv = process.argv.slice(2)) {
-  const markdown = await readBountyChallengeMarkdown2(argv);
+async function main13(_env = process.env, argv = process.argv.slice(2)) {
+  const markdown = await readBountyChallengeMarkdown3(argv);
   const specCommitment = deriveBountyChallengeContentCommitment(markdown);
   console.log(
     JSON.stringify({
@@ -6844,19 +7591,19 @@ async function main12(_env = process.env, argv = process.argv.slice(2)) {
     })
   );
 }
-async function readBountyChallengeMarkdown2(argv) {
+async function readBountyChallengeMarkdown3(argv) {
   const path5 = argv[0];
   if (!path5) {
     throw new Error(SPEC_COMMITMENT_USAGE);
   }
   if (path5 === "-") {
-    return readStdinText3(process.stdin);
+    return readStdinText4(process.stdin);
   }
-  return readFile5(path5, "utf8");
+  return readFile6(path5, "utf8");
 }
 
 // src/submit.ts
-import { readdir, readFile as readFile6, stat } from "fs/promises";
+import { readdir, readFile as readFile7, stat } from "fs/promises";
 import path3 from "path";
 import { createInterface } from "readline";
 import { isAddress as isAddress7 } from "viem";
@@ -6910,7 +7657,7 @@ var MEDIA_TYPE_BY_EXTENSION = {
   diff: "text/x-diff"
 };
 var DEFAULT_MEDIA_TYPE = "application/octet-stream";
-async function main13(env = process.env, argv = process.argv.slice(2)) {
+async function main14(env = process.env, argv = process.argv.slice(2)) {
   const { solverAddress, argv: argvWithoutSolverAddress } = extractSolverAddressFlag(argv);
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argvWithoutSolverAddress);
   const config = loadSubmitConfig(env, apiBaseUrlOverride, solverAddress);
@@ -6987,7 +7734,7 @@ async function main13(env = process.env, argv = process.argv.slice(2)) {
   });
   if (ciphertext.byteLength > MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES) {
     throw new Error(
-      `Encrypted submission is ${ciphertext.byteLength} bytes and exceeds Elgora's 50 MiB encrypted submission limit. Reduce the final artifact package before submitting.`
+      `Encrypted submission is ${ciphertext.byteLength} bytes and exceeds Elgora's ${formatMebibytes(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)} encrypted submission limit. Reduce the final artifact package before submitting.`
     );
   }
   const prepared = await (async () => {
@@ -7274,18 +8021,23 @@ async function readArtifactDirectory(artifactDir) {
   if (entries.length === 0) {
     throw new Error(`No files found in artifact directory: ${artifactDir}`);
   }
+  if (entries.length > MAX_SOLVER_SUBMISSION_FILES) {
+    throw new Error(
+      `Artifact directory holds ${entries.length} files and exceeds Elgora's maximum of ${MAX_SOLVER_SUBMISSION_FILES} files per Submission. Combine them into fewer files, if the challenge allows it, before submitting.`
+    );
+  }
   let plaintextByteLength = 0;
   for (const entry of entries) {
     plaintextByteLength += (await stat(path3.join(artifactDir, entry.name))).size;
-    if (plaintextByteLength > MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES) {
+    if (plaintextByteLength > MAX_SOLVER_SUBMISSION_ARTIFACT_BYTES) {
       throw new Error(
-        `Artifact directory exceeds Elgora's 50 MiB encrypted submission limit before packaging. Reduce the final artifact package before submitting.`
+        `Artifact directory exceeds Elgora's ${formatMebibytes(MAX_SOLVER_SUBMISSION_ARTIFACT_BYTES)} of files per Submission, which is what fits the ${formatMebibytes(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)} encrypted submission limit once packaged. Reduce the final artifact package before submitting.`
       );
     }
   }
   return Promise.all(
     entries.map(async (entry) => {
-      const bytes = await readFile6(path3.join(artifactDir, entry.name));
+      const bytes = await readFile7(path3.join(artifactDir, entry.name));
       return {
         name: entry.name,
         media_type: guessMediaType(entry.name),
@@ -7294,6 +8046,9 @@ async function readArtifactDirectory(artifactDir) {
     })
   );
 }
+function formatMebibytes(byteLength) {
+  return `${byteLength / 1024 / 1024} MiB`;
+}
 function guessMediaType(fileName) {
   const extension = path3.extname(fileName).slice(1).toLowerCase();
   return MEDIA_TYPE_BY_EXTENSION[extension] ?? DEFAULT_MEDIA_TYPE;
@@ -7395,7 +8150,7 @@ function readTimelockRevealDelaySeconds(env) {
 
 // src/verification-record.ts
 var VERIFICATION_RECORD_USAGE = "Usage: elgora-cli verification-record <bounty_id>";
-async function main14(env = process.env, argv = process.argv.slice(2)) {
+async function main15(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
   const args = readVerificationRecordArgs(remainingArgv);
   const envWithDefaults = withDeploymentDefaults(env);
@@ -7460,6 +8215,9 @@ function usageError4() {
   return new Error(VERIFICATION_RECORD_USAGE);
 }
 
+// src/version.ts
+var CLI_VERSION = true ? "7.4.0" : "0.0.0-dev";
+
 // src/cli.ts
 var dotenvPath = path4.resolve(process.env.DOTENV_CONFIG_PATH ?? ".env");
 var dotenvResult = loadDotenv({
@@ -7471,20 +8229,21 @@ process.stderr.write(
 `
 );
 var COMMANDS = {
-  "guardian:judgeable": main4,
-  "guardian:open": main2,
-  "guardian:prove-roster-key": main5,
-  "guardian:verdict": main6,
-  "guardian:deliver-key": main3,
-  "poster:open-winning-submission": main7,
-  "poster:publish-fund": main8,
-  "roster:add-guardian": main9,
-  "roster:prepare-guardian-proof": main10,
-  "roster:verify-guardian-proof": main11,
-  "solver:submit": main13,
-  claim: main,
-  "spec-commitment": main12,
-  "verification-record": main14
+  "guardian:judgeable": main5,
+  "guardian:open": main3,
+  "guardian:prove-roster-key": main6,
+  "guardian:verdict": main7,
+  "guardian:deliver-key": main4,
+  "poster:open-winning-submission": main8,
+  "poster:publish-fund": main9,
+  "roster:add-guardian": main10,
+  "roster:prepare-guardian-proof": main11,
+  "roster:verify-guardian-proof": main12,
+  "solver:submit": main14,
+  claim: main2,
+  "check-page": main,
+  "spec-commitment": main13,
+  "verification-record": main15
 };
 var COMMAND_HELP = {
   "guardian:judgeable": {
@@ -7556,7 +8315,7 @@ var COMMAND_HELP = {
   "poster:publish-fund": {
     usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|->",
     title: "Publish an approved challenge and fund its bounty.",
-    description: "Read the exact approved bounty_challenge.md bytes, publish them through\n  Elgora's API, approve the escrow token, and create the bounty on\n  ElgoraHub. Pass '-' to read the challenge from stdin.",
+    description: "Read the exact approved bounty_challenge.md bytes and publish them through\n  Elgora's API. Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",
@@ -7621,6 +8380,12 @@ var COMMAND_HELP = {
     required: [],
     defaulted: ["ELGORA_CHAIN_ID", "ELGORA_HUB_ADDRESS", "ELGORA_RPC_URL"]
   },
+  "check-page": {
+    usage: "elgora-cli check-page <bounty_challenge_md_path|->",
+    title: "Check a challenge page's structure against Elgora's rules.",
+    description: "Run the same structural module the API runs before its readiness\n  review: frontmatter, a known profile, and every declared tightening.\n  Reports each issue with a stable code and the field that fixes it,\n  and exits non-zero when any is found. A Guardian runs this against a\n  bounty's committed bytes before judging, because a page can reach\n  chain without passing publication. It checks structure only: whether\n  the page tries to instruct you, or carries unsafe content, is a\n  reading you make yourself. Pass '-' to read from stdin. Makes no\n  network call and needs no configuration or secret.",
+    required: []
+  },
   "spec-commitment": {
     usage: "elgora-cli spec-commitment <bounty_challenge_md_path|->",
     title: "Reproduce a challenge's spec_commitment offline.",
@@ -7648,6 +8413,11 @@ async function run(rawArgv) {
     printUsage();
     return;
   }
+  if (subcommand === "--version" || subcommand === "-v" || subcommand === "version") {
+    process.stdout.write(`${CLI_VERSION}
+`);
+    return;
+  }
   if (subcommand === "help") {
     printCommandHelpOrUsage(rest[0]);
     return;
@@ -7680,7 +8450,8 @@ function printUsage() {
       `Every command accepts ${NETWORK_FLAG} <name|chain id> to select the`,
       `deployment for that invocation. Supported: ${NETWORK_NAMES_HINT}.`,
       "",
-      "Run `elgora-cli help <command>` for exact arguments and configuration."
+      "Run `elgora-cli help <command>` for exact arguments and configuration.",
+      "Run `elgora-cli --version` to print this release's version."
     ].join("\n")}
 `
   );
@@ -7733,7 +8504,7 @@ run(process.argv.slice(2)).catch((error) => {
 function formatCliError(error) {
   if (error instanceof ZodError2) {
     return renderError(
-      "invalid environment configuration",
+      "invalid input",
       error.issues.map((issue) => ({
         path: issue.path.join("."),
         message: issue.message