@elgora/cli 9.1.0 → 10.0.0

package/README.md

@@ -27,10 +27,11 @@ answer.
 
 ## Commands
 
-- `poster:review` checks a bounty page and saves its readiness certificate
-  with `--signoff-out <file>`. Rejected pages print the full issue list and exit 2.
-- `poster:publish-fund` requires `--signoff <file>`, publishes those exact
-  approved `bounty_challenge.md` bytes, and funds the new bounty without another AI review.
+- `poster:review` checks a bounty page; Elgora keeps the approval for those
+  exact bytes. Rejected pages print the full issue list and exit 2.
+- `poster:publish-fund` publishes the exact `bounty_challenge.md` bytes and
+  funds the new bounty. It reuses the saved approval for those bytes without
+  another AI review, or reviews them first.
 - `poster:open-winning-submission` retrieves the finalized winning Submission
   for the funding Poster and decrypts it locally.
 - `check-page <bounty_challenge_md_path|->` checks structural conformance offline,

package/dist/cli.js

@@ -71,6 +71,7 @@ var BOUNTY_CHALLENGE_PROFILE = "elgora_markdown_bounty_challenge_v0";
 var WINNER_TAKE_ALL_PAYOUT_POLICY = "winner_take_all";
 var SUBMISSION_ENCRYPTION_TYPE = "guardian_timelock_hpke_aes_256_gcm_v0";
 var ZERO_BYTES32 = "0x0000000000000000000000000000000000000000000000000000000000000000";
+var READINESS_APPROVAL_VALIDITY_SECONDS = 7 * 24 * 60 * 60;
 
 // ../../packages/core/src/bounty-challenge-markdown.ts
 var FRONTMATTER_DELIMITER = "---";
@@ -384,107 +385,37 @@ function isBountyChallengeFrontmatterKey(value) {
 }
 
 // ../../packages/core/src/bounty-publication-response.ts
-import { isHex as isHex3 } from "viem";
-import { z as z3 } from "zod";
-
-// ../../packages/core/src/auth/readiness-signoff.ts
-import {
-  isAddressEqual,
-  isHex as isHex2,
-  recoverTypedDataAddress,
-  size as size2
-} from "viem";
+import { isHex as isHex2 } from "viem";
 import { z as z2 } from "zod";
-
-// ../../packages/core/src/auth/eip712.ts
-var API_REQUEST_APPROVAL_PRIMARY_TYPE = "ApiRequestApproval";
-var API_REQUEST_APPROVAL_TYPES = {
-  ApiRequestApproval: [
-    { name: "endpointId", type: "string" },
-    { name: "audience", type: "string" },
-    { name: "bodyHash", type: "bytes32" },
-    { name: "query", type: "string" },
-    { name: "blockNumber", type: "uint256" },
-    { name: "blockHash", type: "bytes32" }
-  ]
-};
-function buildElgoraEip712Domain(params) {
-  return {
-    name: "Elgora",
-    version: "1",
-    chainId: params.chainId,
-    verifyingContract: params.hubAddress
-  };
-}
-function buildApiRequestApprovalTypedData(params) {
-  return {
-    domain: buildElgoraEip712Domain({
-      chainId: params.chainId,
-      hubAddress: params.hubAddress
-    }),
-    types: API_REQUEST_APPROVAL_TYPES,
-    primaryType: API_REQUEST_APPROVAL_PRIMARY_TYPE,
-    message: params.message
-  };
-}
-function endpointIdFor(input) {
-  return `${input.method.toUpperCase()} ${input.path}`;
-}
-function audienceFor(host) {
-  return host.toLowerCase();
-}
-function queryFor(query) {
-  return new URLSearchParams(query).toString();
-}
-
-// ../../packages/core/src/auth/readiness-signoff.ts
-var READINESS_APPROVAL_VALIDITY_SECONDS = 7 * 24 * 60 * 60;
-var bytes32Schema = z2.string().refine(isHexBytes32).transform((value) => value);
-var timestampSchema = z2.number().int().nonnegative().max(9999999999);
-var readinessSignoffMessageSchema = z2.object({
-  audience: z2.string().min(1).max(512),
+var addressSchema = z2.string().refine(isHexAddress, "Must be a 20-byte EVM address").transform((value) => value);
+var bytes32Schema = z2.string().refine(isHexBytes32, "Must be a bytes32 hex string").transform((value) => value);
+var hexBytesSchema = z2.string().refine(isHex2, "Must be hex-encoded calldata").transform((value) => value);
+var bountyChallengeContentRecordSchema = z2.object({
+  content_kind: z2.literal("bounty_challenge_spec"),
   spec_commitment: bytes32Schema,
-  reviewer_hash: bytes32Schema,
-  model: z2.string().min(1).max(256),
-  issued_at: timestampSchema,
-  expires_at: timestampSchema
-}).strict();
-var signatureSchema = z2.string().refine((value) => isHex2(value) && size2(value) === 65).transform((value) => value);
-var readinessSignoffSchema = readinessSignoffMessageSchema.extend({ signature: signatureSchema }).refine((signoff) => signoff.expires_at > signoff.issued_at, {
-  path: ["expires_at"],
-  message: "Must expire after issuance"
-});
-
-// ../../packages/core/src/bounty-publication-response.ts
-var addressSchema = z3.string().refine(isHexAddress, "Must be a 20-byte EVM address").transform((value) => value);
-var bytes32Schema2 = z3.string().refine(isHexBytes32, "Must be a bytes32 hex string").transform((value) => value);
-var hexBytesSchema = z3.string().refine(isHex3, "Must be hex-encoded calldata").transform((value) => value);
-var bountyChallengeContentRecordSchema = z3.object({
-  content_kind: z3.literal("bounty_challenge_spec"),
-  spec_commitment: bytes32Schema2,
-  byte_length: z3.number().int().positive(),
+  byte_length: z2.number().int().positive(),
   token_address: addressSchema,
-  created_at: z3.string().datetime({ offset: true })
+  created_at: z2.string().datetime({ offset: true })
 }).strict();
-var bountyPublicationResponseSchema = z3.object({
+var bountyPublicationResponseSchema = z2.object({
   content_record: bountyChallengeContentRecordSchema,
-  create_bounty_transaction: z3.object({
-    chain_id: z3.number().int().positive(),
+  create_bounty_transaction: z2.object({
+    chain_id: z2.number().int().positive(),
     to: addressSchema,
-    value: z3.literal("0"),
+    value: z2.literal("0"),
     data: hexBytesSchema,
-    function_name: z3.literal("create_bounty"),
-    args: z3.object({
-      spec_commitment: bytes32Schema2,
-      escrow_amount: z3.string().refine(isPositiveInteger),
-      submission_deadline: z3.number().int().positive()
+    function_name: z2.literal("create_bounty"),
+    args: z2.object({
+      spec_commitment: bytes32Schema,
+      escrow_amount: z2.string().refine(isPositiveInteger),
+      submission_deadline: z2.number().int().positive()
     }).strict()
   }).strict(),
-  protocol_fee_policy: z3.object({
+  protocol_fee_policy: z2.object({
     treasury_recipient: addressSchema,
-    treasury_fee_bps: z3.number().int().min(0).max(1e4),
+    treasury_fee_bps: z2.number().int().min(0).max(1e4),
     guardian_fee_recipient: addressSchema,
-    guardian_fee_bps: z3.number().int().min(0).max(1e4)
+    guardian_fee_bps: z2.number().int().min(0).max(1e4)
   }).strict()
 }).strict().superRefine((response, context) => {
   if (response.content_record.spec_commitment !== response.create_bounty_transaction.args.spec_commitment) {
@@ -495,47 +426,33 @@ var bountyPublicationResponseSchema = z3.object({
     });
   }
 });
-var priorIssueSchema = z3.object({
-  issue_index: z3.number().int().nonnegative(),
-  message: z3.string().trim().min(1).max(1500)
+var priorIssueSchema = z2.object({
+  issue_index: z2.number().int().nonnegative(),
+  message: z2.string().trim().min(1).max(1500)
 }).strict();
 var priorIssueStatusSchema = priorIssueSchema.extend({
-  status: z3.enum(["resolved", "open"])
+  status: z2.enum(["resolved", "open"])
 }).strict();
-var readinessFindingSchema = z3.object({
-  path: z3.string().trim().min(1).max(120),
-  message: z3.string().trim().min(1).max(1500),
-  code: z3.string().min(1).optional(),
-  anchor: z3.string().trim().min(1).max(120).optional(),
-  hazard: z3.boolean().optional()
+var readinessFindingSchema = z2.object({
+  path: z2.string().trim().min(1).max(120),
+  message: z2.string().trim().min(1).max(1500),
+  code: z2.string().min(1).optional(),
+  anchor: z2.string().trim().min(1).max(120).optional(),
+  hazard: z2.boolean().optional()
 });
 var MAX_READINESS_FINDINGS = 20;
-var bountyReviewResponseSchema = z3.object({
-  content_record: bountyChallengeContentRecordSchema,
-  readiness: z3.object({
-    decision: z3.literal("ready"),
-    signoff: readinessSignoffSchema,
+var bountyReviewResponseSchema = z2.object({
+  content_record: bountyChallengeContentRecordSchema.omit({ created_at: true }),
+  readiness: z2.object({
+    decision: z2.literal("ready"),
+    // Publication reuses the approval of these exact bytes until then.
+    approved_until: z2.string().datetime({ offset: true }),
     // The dissenting pass's findings on a ready check; never blocking.
-    // Optional because servers before three-pass review do not send it.
-    warnings: z3.array(readinessFindingSchema).max(MAX_READINESS_FINDINGS).optional(),
-    prior_issues_resolved: z3.array(priorIssueSchema),
-    prior_issues_open: z3.array(priorIssueSchema)
+    warnings: z2.array(readinessFindingSchema).max(MAX_READINESS_FINDINGS),
+    prior_issues_resolved: z2.array(priorIssueSchema),
+    prior_issues_open: z2.array(priorIssueSchema)
   })
-}).superRefine((response, context) => {
-  if (response.readiness.signoff.spec_commitment.toLowerCase() !== response.content_record.spec_commitment.toLowerCase()) {
-    context.addIssue({
-      code: "custom",
-      path: ["readiness", "signoff", "spec_commitment"],
-      message: "Must match content_record.spec_commitment"
-    });
-  }
 });
-var readinessSignerResponseSchema = z3.object({
-  signer_address: addressSchema,
-  reviewer_hash: bytes32Schema2,
-  configured_model: z3.string().min(1),
-  audience: z3.string().min(1)
-}).strict();
 
 // ../../packages/core/src/chain-registry.ts
 import { base, baseSepolia, foundry } from "viem/chains";
@@ -559,7 +476,7 @@ var FOUNDRY_CHAIN_ID = foundry.id;
 import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
 import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
 import { concatBytes, keccak256 as keccak2562, toBytes as toBytes2 } from "viem";
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 
 // ../../packages/core/src/base64.ts
 var BASE64_ENCODE_CHUNK_BYTES = 3 * 16384;
@@ -645,42 +562,42 @@ var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
 var SOLVER_SUBMISSION_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var MEDIA_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
 var KEY_ID_RE = /^[A-Za-z0-9][ -~]*$/;
-var base64UrlSchema = z4.string().regex(BASE64URL_RE);
-var lowerAddressSchema = z4.string().refine(isLowercaseHexAddress);
-var bytes32Schema3 = z4.string().refine(isLowercaseBytes32);
-var sha256HexSchema = z4.string().refine(isSha256Hex);
-var keyIdSchema = z4.string().min(1).max(128).regex(KEY_ID_RE);
-var artifactNameSchema = z4.string().max(
+var base64UrlSchema = z3.string().regex(BASE64URL_RE);
+var lowerAddressSchema = z3.string().refine(isLowercaseHexAddress);
+var bytes32Schema2 = z3.string().refine(isLowercaseBytes32);
+var sha256HexSchema = z3.string().refine(isSha256Hex);
+var keyIdSchema = z3.string().min(1).max(128).regex(KEY_ID_RE);
+var artifactNameSchema = z3.string().max(
   MAX_SOLVER_SUBMISSION_NAME_CHARACTERS,
   `Artifact filename exceeds ${MAX_SOLVER_SUBMISSION_NAME_CHARACTERS} ASCII characters (including extension). Solvers may shorten it only if the published challenge permits, before the deadline.`
 ).regex(SOLVER_SUBMISSION_NAME_RE);
-var mediaTypeSchema = z4.string().regex(MEDIA_TYPE_RE);
-var bountyIdSchema = z4.string().refine(isBountyId);
-var chainIdSchema = z4.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
-var privateArtifactContextSchema = z4.strictObject({
-  type: z4.literal("solver_submission"),
+var mediaTypeSchema = z3.string().regex(MEDIA_TYPE_RE);
+var bountyIdSchema = z3.string().refine(isBountyId);
+var chainIdSchema = z3.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
+var privateArtifactContextSchema = z3.strictObject({
+  type: z3.literal("solver_submission"),
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   bounty_id: bountyIdSchema,
   actor_address: lowerAddressSchema
 });
-var guardianRecipientSchema = z4.strictObject({
+var guardianRecipientSchema = z3.strictObject({
   key_id: keyIdSchema,
-  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   public_key: base64UrlSchema.length(
     43,
     "public_key must encode a 32-byte X25519 public key"
   )
 });
-var guardianRecipientPrivateKeySchema = z4.strictObject({
+var guardianRecipientPrivateKeySchema = z3.strictObject({
   key_id: keyIdSchema,
-  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   private_key: base64UrlSchema.length(
     43,
     "private_key must encode a 32-byte X25519 private key"
   )
 });
-var guardianRecipientsSchema = z4.array(guardianRecipientSchema).min(1).superRefine((recipients, ctx) => {
+var guardianRecipientsSchema = z3.array(guardianRecipientSchema).min(1).superRefine((recipients, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (const recipient of recipients) {
     if (seen.has(recipient.key_id)) {
@@ -693,24 +610,24 @@ var guardianRecipientsSchema = z4.array(guardianRecipientSchema).min(1).superRef
     seen.add(recipient.key_id);
   }
 });
-var guardianRecipientPrivateKeysSchema = z4.array(guardianRecipientPrivateKeySchema).min(1);
-var artifactManifestEntrySchema = z4.strictObject({
+var guardianRecipientPrivateKeysSchema = z3.array(guardianRecipientPrivateKeySchema).min(1);
+var artifactManifestEntrySchema = z3.strictObject({
   name: artifactNameSchema,
   media_type: mediaTypeSchema,
-  size_bytes: z4.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER),
+  size_bytes: z3.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER),
   sha256: sha256HexSchema
 });
-var privateArtifactPublicManifestSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND),
+var privateArtifactPublicManifestSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND),
   context: privateArtifactContextSchema
 });
 var encryptedBundleArtifactSchema = artifactManifestEntrySchema.extend({
   bytes: base64UrlSchema
 });
-var privateArtifactEncryptedBundleSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
+var privateArtifactEncryptedBundleSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
   context: privateArtifactContextSchema,
-  artifacts: z4.array(encryptedBundleArtifactSchema).min(1).max(
+  artifacts: z3.array(encryptedBundleArtifactSchema).min(1).max(
     MAX_SOLVER_SUBMISSION_FILES,
     `Submission exceeds the maximum of ${MAX_SOLVER_SUBMISSION_FILES} files.`
   ).refine(
@@ -718,33 +635,33 @@ var privateArtifactEncryptedBundleSchema = z4.strictObject({
     "artifact names must be unique case-insensitively"
   )
 });
-var privateArtifactRevealPolicySchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_REVEAL_POLICY_KIND),
-  network: z4.string().min(1),
-  chain_hash: z4.string().min(1),
-  round: z4.string().refine(isPositiveInteger),
-  not_before: z4.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER)
+var privateArtifactRevealPolicySchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_REVEAL_POLICY_KIND),
+  network: z3.string().min(1),
+  chain_hash: z3.string().min(1),
+  round: z3.string().refine(isPositiveInteger),
+  not_before: z3.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER)
 });
-var wrappedRecipientKeySchema = z4.strictObject({
+var wrappedRecipientKeySchema = z3.strictObject({
   key_id: keyIdSchema,
-  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   enc: base64UrlSchema,
   ciphertext: base64UrlSchema
 });
-var wrappedKeyBagSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND),
-  keys: z4.array(wrappedRecipientKeySchema).min(1)
+var wrappedKeyBagSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND),
+  keys: z3.array(wrappedRecipientKeySchema).min(1)
 });
-var privateArtifactEnvelopeSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_ENVELOPE_KIND),
-  alg: z4.literal(SUBMISSION_ENCRYPTION_TYPE),
+var privateArtifactEnvelopeSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_ENVELOPE_KIND),
+  alg: z3.literal(SUBMISSION_ENCRYPTION_TYPE),
   context: privateArtifactContextSchema,
   public_manifest: privateArtifactPublicManifestSchema,
   public_manifest_sha256: sha256HexSchema,
   encrypted_bundle_sha256: sha256HexSchema,
   ciphertext_sha256: sha256HexSchema,
   guardian_recipients: guardianRecipientsSchema,
-  guardian_recipients_commitment: bytes32Schema3,
+  guardian_recipients_commitment: bytes32Schema2,
   reveal_policy: privateArtifactRevealPolicySchema,
   envelope_nonce: base64UrlSchema.length(
     22,
@@ -752,7 +669,7 @@ var privateArtifactEnvelopeSchema = z4.strictObject({
   ),
   iv: base64UrlSchema.length(16, "iv must encode 12 bytes"),
   wrapped_key_bag: base64UrlSchema,
-  ciphertext_locator: z4.string().min(1)
+  ciphertext_locator: z3.string().min(1)
 });
 function parsePrivateArtifactEnvelope(input) {
   return privateArtifactEnvelopeSchema.parse(input);
@@ -810,11 +727,11 @@ var x25519PrivateKeySchema = base64UrlSchema.length(
   43,
   "must encode a 32-byte X25519 private key"
 );
-var winningSolutionDeliveryContextSchema = z4.strictObject({
+var winningSolutionDeliveryContextSchema = z3.strictObject({
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   bounty_id: bountyIdSchema,
-  submission_commitment: bytes32Schema3
+  submission_commitment: bytes32Schema2
 });
 async function generateX25519KeyPair(input) {
   const suite = createHpkeSuite();
@@ -891,7 +808,7 @@ function buildWinningSolutionDeliveryInfo(contextCommitment) {
 var GUARDIAN_ROSTER_KEY_PROOF_INFO = "elgora/guardian-roster-key-proof/hpke-fixture/v0";
 var GUARDIAN_ROSTER_KEY_PROOF_MESSAGE_TYPE = "elgora_guardian_roster_key_proof_v0";
 var GUARDIAN_ROSTER_KEY_PROOF_FIXTURE_BYTES = 32;
-var guardianRosterKeyProofContextSchema = z4.strictObject({
+var guardianRosterKeyProofContextSchema = z3.strictObject({
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   proposed_account: lowerAddressSchema,
@@ -1219,7 +1136,7 @@ async function wrapAesKeyForRecipients(input) {
 }
 async function openAesKeyForRecipient(input) {
   const suite = createHpkeSuite();
-  const wrappedKeys = z4.array(wrappedRecipientKeySchema).parse(input.wrappedKeys);
+  const wrappedKeys = z3.array(wrappedRecipientKeySchema).parse(input.wrappedKeys);
   const privateKeys = guardianRecipientPrivateKeysSchema.parse(
     input.privateKeys
   );
@@ -3930,7 +3847,7 @@ function settlementAmounts(escrowAmount, treasuryFeeBps, guardianFeeBps) {
 import { zeroAddress } from "viem";
 
 // ../../packages/core/src/api/bounty-preparation.ts
-import { ZodError, z as z5 } from "zod";
+import { ZodError, z as z4 } from "zod";
 
 // ../../packages/core/src/submission-timelock.ts
 import {
@@ -4191,7 +4108,7 @@ import {
   getAbiItem as getAbiItem2,
   parseAbi,
   parseSignature,
-  recoverTypedDataAddress as recoverTypedDataAddress2
+  recoverTypedDataAddress
 } from "viem";
 var ELGORA_HUB_ERRORS = ELGORA_HUB_ABI.filter(
   (item) => item.type === "error"
@@ -4348,7 +4265,7 @@ async function prepareAuthorizedCreateBountyTransaction(input) {
     if (unsupported) return null;
     throw error;
   }
-  if ((await recoverTypedDataAddress2({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
+  if ((await recoverTypedDataAddress({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
     throw new Error("USDC authorization was not signed by the funding Poster.");
   }
   const { r, s, yParity } = parseSignature(signature);
@@ -4424,14 +4341,14 @@ var BoundaryValidationError = class extends Error {
     this.issues = issues;
   }
 };
-var artifactUploadUrlRequestSchema = z5.object({
-  ciphertext_sha256: z5.string().refine(isSha256Hex),
-  ciphertext_byte_length: z5.number().int().positive().max(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)
+var artifactUploadUrlRequestSchema = z4.object({
+  ciphertext_sha256: z4.string().refine(isSha256Hex),
+  ciphertext_byte_length: z4.number().int().positive().max(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)
 }).strict();
 
 // ../../packages/core/src/api/config.ts
 import { createHash } from "crypto";
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 function withDeploymentEnvDefaults(env) {
   const merged = { ...env };
   const setIfBlank = (key, value) => {
@@ -4452,11 +4369,11 @@ function withDeploymentEnvDefaults(env) {
   setIfBlank("ELGORA_SUBGRAPH_ENDPOINT", deployment?.ELGORA_SUBGRAPH_ENDPOINT);
   return merged;
 }
-var chainIdField = z6.coerce.number().int().positive().refine((chainId) => SUPPORTED_CHAINS[chainId] !== void 0, {
+var chainIdField = z5.coerce.number().int().positive().refine((chainId) => SUPPORTED_CHAINS[chainId] !== void 0, {
   message: `ELGORA_CHAIN_ID must be a supported chain: ${Object.keys(SUPPORTED_CHAINS).join(", ")}`
 });
-var hubAddressField = z6.string().refine(isHexAddress, "ELGORA_HUB_ADDRESS must be a 20-byte EVM address").transform((value) => value.toLowerCase());
-var publicDeploymentEnvSchema = z6.object({
+var hubAddressField = z5.string().refine(isHexAddress, "ELGORA_HUB_ADDRESS must be a 20-byte EVM address").transform((value) => value.toLowerCase());
+var publicDeploymentEnvSchema = z5.object({
   ELGORA_CHAIN_ID: chainIdField,
   ELGORA_HUB_ADDRESS: hubAddressField
 });
@@ -4472,32 +4389,32 @@ function loadPublicDeploymentConfig(env = process.env) {
 var envShape = {
   ELGORA_CHAIN_ID: chainIdField,
   ELGORA_HUB_ADDRESS: hubAddressField,
-  ELGORA_ESCROW_TOKEN_ADDRESS: z6.string().refine(
+  ELGORA_ESCROW_TOKEN_ADDRESS: z5.string().refine(
     isHexAddress,
     "ELGORA_ESCROW_TOKEN_ADDRESS must be a 20-byte EVM address"
   ).transform((value) => value.toLowerCase()),
-  ELGORA_TIMELOCK_REVEAL_DELAY_SECONDS: z6.coerce.number().int().nonnegative().default(DEFAULT_TIMELOCK_REVEAL_DELAY_SECONDS),
-  ELGORA_RPC_URL: z6.string().min(1, "ELGORA_RPC_URL is required"),
+  ELGORA_TIMELOCK_REVEAL_DELAY_SECONDS: z5.coerce.number().int().nonnegative().default(DEFAULT_TIMELOCK_REVEAL_DELAY_SECONDS),
+  ELGORA_RPC_URL: z5.string().min(1, "ELGORA_RPC_URL is required"),
   /**
    * Only consulted for a chain with no recorded deployment — a local anvil
    * stack, whose addresses change on every deploy. A recorded deployment's
    * scheme always wins, because settlement validation compares against it.
    */
-  ELGORA_PAYOUT_SCHEME_ADDRESS: z6.string().refine(
+  ELGORA_PAYOUT_SCHEME_ADDRESS: z5.string().refine(
     isHexAddress,
     "ELGORA_PAYOUT_SCHEME_ADDRESS must be a 20-byte EVM address"
   ).transform((value) => value.toLowerCase()).optional(),
-  ELGORA_DATABASE_URL: z6.string().min(1, "ELGORA_DATABASE_URL is required"),
-  ELGORA_SUBGRAPH_ENDPOINT: z6.string().min(1, "ELGORA_SUBGRAPH_ENDPOINT is required"),
-  ELGORA_ARTIFACT_STORAGE_ENDPOINT: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_ENDPOINT is required"),
-  ELGORA_ARTIFACT_STORAGE_REGION: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_REGION is required"),
-  ELGORA_ARTIFACT_STORAGE_BUCKET: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_BUCKET is required"),
-  ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID is required"),
-  ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY is required"),
-  ELGORA_DELIVERY_PUBLIC_KEY: z6.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
-  ELGORA_DELIVERY_PRIVATE_KEY: z6.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
+  ELGORA_DATABASE_URL: z5.string().min(1, "ELGORA_DATABASE_URL is required"),
+  ELGORA_SUBGRAPH_ENDPOINT: z5.string().min(1, "ELGORA_SUBGRAPH_ENDPOINT is required"),
+  ELGORA_ARTIFACT_STORAGE_ENDPOINT: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_ENDPOINT is required"),
+  ELGORA_ARTIFACT_STORAGE_REGION: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_REGION is required"),
+  ELGORA_ARTIFACT_STORAGE_BUCKET: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_BUCKET is required"),
+  ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID is required"),
+  ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY is required"),
+  ELGORA_DELIVERY_PUBLIC_KEY: z5.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
+  ELGORA_DELIVERY_PRIVATE_KEY: z5.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
 };
-var readinessAudienceSchema = z6.string().trim().toLowerCase().min(1).max(512).refine((host) => {
+var readinessAudienceSchema = z5.string().trim().toLowerCase().min(1).max(512).refine((host) => {
   try {
     const url = new URL(`https://${host}`);
     return url.host === host && url.pathname === "/" && !url.username && !url.password && !url.search && !url.hash;
@@ -4511,11 +4428,11 @@ var publicationEnvShape = {
   ELGORA_ESCROW_TOKEN_ADDRESS: envShape.ELGORA_ESCROW_TOKEN_ADDRESS,
   ELGORA_DATABASE_URL: envShape.ELGORA_DATABASE_URL,
   ELGORA_SUBGRAPH_ENDPOINT: envShape.ELGORA_SUBGRAPH_ENDPOINT,
-  ELGORA_PUBLICATION_REVIEW_ENABLED: z6.string().trim().toLowerCase().pipe(z6.enum(["true", "false"])).default("true").transform((value) => value === "true"),
-  ELGORA_READINESS_TIMEOUT_MS: z6.coerce.number().int().min(1).max(12e4).default(12e4)
+  ELGORA_PUBLICATION_REVIEW_ENABLED: z5.string().trim().toLowerCase().pipe(z5.enum(["true", "false"])).default("true").transform((value) => value === "true"),
+  ELGORA_READINESS_TIMEOUT_MS: z5.coerce.number().int().min(1).max(12e4).default(12e4)
 };
-var envSchema = z6.object(envShape);
-var bountyPublicationEnvSchema = z6.object(publicationEnvShape);
+var envSchema = z5.object(envShape);
+var bountyPublicationEnvSchema = z5.object(publicationEnvShape);
 
 // ../../packages/core/src/api/elgora-hub-error-catalog.ts
 import { decodeErrorResult } from "viem";
@@ -4530,81 +4447,81 @@ var ELGORA_HUB_FEE_POLICY_ABI = [
 ];
 
 // ../../packages/core/src/api/solver-submission-responses.ts
-import { isHex as isHex4 } from "viem";
-import { z as z7 } from "zod";
-var hexAddressSchema = z7.string().refine(isHexAddress, "Must be a hex-encoded address");
-var hexBytes32Schema = z7.string().refine(isHexBytes32, "Must be 32-byte hex");
-var hexDataSchema = z7.string().refine((value) => isHex4(value), "Must be hex-encoded calldata");
-var artifactUploadUrlResponseSchema = z7.object({
-  locator: z7.string().min(1),
-  upload_url: z7.string().min(1),
-  method: z7.literal("PUT"),
-  expires_at: z7.string().min(1)
+import { isHex as isHex3 } from "viem";
+import { z as z6 } from "zod";
+var hexAddressSchema = z6.string().refine(isHexAddress, "Must be a hex-encoded address");
+var hexBytes32Schema = z6.string().refine(isHexBytes32, "Must be 32-byte hex");
+var hexDataSchema = z6.string().refine((value) => isHex3(value), "Must be hex-encoded calldata");
+var artifactUploadUrlResponseSchema = z6.object({
+  locator: z6.string().min(1),
+  upload_url: z6.string().min(1),
+  method: z6.literal("PUT"),
+  expires_at: z6.string().min(1)
 });
-var solverSubmissionPrepareResponseSchema = z7.object({
-  content_record: z7.object({
-    content_kind: z7.literal(SOLVER_SUBMISSION_CONTENT_KIND),
+var solverSubmissionPrepareResponseSchema = z6.object({
+  content_record: z6.object({
+    content_kind: z6.literal(SOLVER_SUBMISSION_CONTENT_KIND),
     submission_commitment: hexBytes32Schema,
-    byte_length: z7.number().int().nonnegative(),
-    created_at: z7.string().min(1)
+    byte_length: z6.number().int().nonnegative(),
+    created_at: z6.string().min(1)
   }),
-  submit_transaction: z7.object({
-    chain_id: z7.number().int().positive(),
+  submit_transaction: z6.object({
+    chain_id: z6.number().int().positive(),
     to: hexAddressSchema,
-    value: z7.literal("0"),
+    value: z6.literal("0"),
     data: hexDataSchema,
-    function_name: z7.literal("submit"),
-    args: z7.object({
-      bounty_id: z7.string().min(1),
+    function_name: z6.literal("submit"),
+    args: z6.object({
+      bounty_id: z6.string().min(1),
       submission_commitment: hexBytes32Schema,
       guardian_roster_hash: hexBytes32Schema,
-      extra_data: z7.literal("0x")
+      extra_data: z6.literal("0x")
     })
   })
 });
-var solverSubmissionContentResponseSchema = z7.object({
-  content_record: z7.object({
-    bounty_id: z7.string().min(1),
-    canonical_json: z7.string().min(1)
+var solverSubmissionContentResponseSchema = z6.object({
+  content_record: z6.object({
+    bounty_id: z6.string().min(1),
+    canonical_json: z6.string().min(1)
   }),
-  ciphertext_download_url: z7.string().min(1),
-  expires_at: z7.string().min(1)
+  ciphertext_download_url: z6.string().min(1),
+  expires_at: z6.string().min(1)
 });
-var bountyGuardianRosterResponseSchema = z7.object({
-  bounty: z7.object({
+var bountyGuardianRosterResponseSchema = z6.object({
+  bounty: z6.object({
     guardian_roster_hash: hexBytes32Schema,
-    guardian_roster: z7.array(
-      z7.object({
-        name: z7.string(),
+    guardian_roster: z6.array(
+      z6.object({
+        name: z6.string(),
         account: hexAddressSchema,
-        encryption_public_key: z7.string().min(1)
+        encryption_public_key: z6.string().min(1)
       })
     ).min(1)
   })
 });
 
 // ../../packages/core/src/api/verification-records.ts
-import { z as z8 } from "zod";
-var hexAddressSchema2 = z8.string().refine(isHexAddress, "Must be a hex-encoded address").transform((value) => value.toLowerCase());
-var hexBytes32Schema2 = z8.string().refine(isHexBytes32, "Must be 32-byte hex").transform((value) => value.toLowerCase());
-var integerStringSchema = z8.string().regex(/^(0|[1-9][0-9]*)$/);
-var verdictEntrySchema = z8.object({
-  name: z8.string().min(1),
-  outcome: z8.enum(["awarded", "no_valid_submission"]).nullable(),
+import { z as z7 } from "zod";
+var hexAddressSchema2 = z7.string().refine(isHexAddress, "Must be a hex-encoded address").transform((value) => value.toLowerCase());
+var hexBytes32Schema2 = z7.string().refine(isHexBytes32, "Must be 32-byte hex").transform((value) => value.toLowerCase());
+var integerStringSchema = z7.string().regex(/^(0|[1-9][0-9]*)$/);
+var verdictEntrySchema = z7.object({
+  name: z7.string().min(1),
+  outcome: z7.enum(["awarded", "no_valid_submission"]).nullable(),
   winner: hexAddressSchema2.nullable(),
   report_commitment: hexBytes32Schema2.nullable(),
-  committed_at: z8.string().datetime({ offset: true }).nullable(),
-  supporting: z8.boolean()
+  committed_at: z7.string().datetime({ offset: true }).nullable(),
+  supporting: z7.boolean()
 }).strict();
-var formattedVerificationRecordSchema = z8.object({
-  chain_id: z8.number().int().positive(),
+var formattedVerificationRecordSchema = z7.object({
+  chain_id: z7.number().int().positive(),
   hub_address: hexAddressSchema2,
   bounty_id: integerStringSchema,
-  status: z8.enum(["awarded", "no_valid_submission", "timed_out"]),
+  status: z7.enum(["awarded", "no_valid_submission", "timed_out"]),
   spec_commitment: hexBytes32Schema2,
   winner: hexAddressSchema2.nullable(),
-  verdicts: z8.record(z8.string(), verdictEntrySchema),
-  settlement: z8.object({
+  verdicts: z7.record(z7.string(), verdictEntrySchema),
+  settlement: z7.object({
     escrow_amount: integerStringSchema,
     settlement_recipient: hexAddressSchema2,
     settlement_amount: integerStringSchema,
@@ -4615,10 +4532,10 @@ var formattedVerificationRecordSchema = z8.object({
     settled_tx_hash: hexBytes32Schema2,
     settled_block_number: integerStringSchema
   }).strict(),
-  content_record: z8.object({
-    spec_content_byte_length: z8.number().int().positive()
+  content_record: z7.object({
+    spec_content_byte_length: z7.number().int().positive()
   }).strict(),
-  verified_at: z8.string().datetime({ offset: true })
+  verified_at: z7.string().datetime({ offset: true })
 }).strict();
 function parseBountyVerificationRecord(input, expected) {
   const slice = input;
@@ -4640,79 +4557,79 @@ function parseBountyVerificationRecord(input, expected) {
 }
 
 // ../../packages/core/src/api/winning-solution-delivery.ts
-import { z as z9 } from "zod";
-var hexBytes32Schema3 = z9.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value !== ZERO_BYTES32, "Must not be zero").transform((value) => value.toLowerCase());
-var hexAddressSchema3 = z9.string().refine((value) => /^0x[0-9a-fA-F]{40}$/.test(value), "Must be an address").transform((value) => value.toLowerCase());
-var deliveryKeyIdSchema = z9.string().min(1).max(128);
-var winningSolutionWrappedKeySchema = z9.strictObject({
-  enc: z9.string().min(1),
-  ciphertext: z9.string().min(1)
+import { z as z8 } from "zod";
+var hexBytes32Schema3 = z8.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value !== ZERO_BYTES32, "Must not be zero").transform((value) => value.toLowerCase());
+var hexAddressSchema3 = z8.string().refine((value) => /^0x[0-9a-fA-F]{40}$/.test(value), "Must be an address").transform((value) => value.toLowerCase());
+var deliveryKeyIdSchema = z8.string().min(1).max(128);
+var winningSolutionWrappedKeySchema = z8.strictObject({
+  enc: z8.string().min(1),
+  ciphertext: z8.string().min(1)
 });
-var deliveryWrapRequestSchema = z9.strictObject({
+var deliveryWrapRequestSchema = z8.strictObject({
   solver_address: hexAddressSchema3,
   submission_commitment: hexBytes32Schema3,
   wrapped_key: winningSolutionWrappedKeySchema
 });
-var deliveryWrapRecordSchema = z9.strictObject({
-  bounty_id: z9.string().min(1),
+var deliveryWrapRecordSchema = z8.strictObject({
+  bounty_id: z8.string().min(1),
   guardian_address: hexAddressSchema3,
   solver_address: hexAddressSchema3,
   submission_commitment: hexBytes32Schema3,
   delivery_key_id: deliveryKeyIdSchema,
-  created_at: z9.string().min(1)
+  created_at: z8.string().min(1)
 });
-var deliveryWrapResponseSchema = z9.strictObject({
-  status: z9.literal("stored"),
+var deliveryWrapResponseSchema = z8.strictObject({
+  status: z8.literal("stored"),
   wrap: deliveryWrapRecordSchema
 });
-var deliveryRetrieveRequestSchema = z9.strictObject({
+var deliveryRetrieveRequestSchema = z8.strictObject({
   poster_ephemeral_public_key: x25519PublicKeySchema
 });
-var deliveryRetrieveResponseSchema = z9.strictObject({
+var deliveryRetrieveResponseSchema = z8.strictObject({
   submission_commitment: hexBytes32Schema3,
   wrapped_key: winningSolutionWrappedKeySchema
 });
-var deliveryStatusResponseSchema = z9.strictObject({
-  exists: z9.boolean()
+var deliveryStatusResponseSchema = z8.strictObject({
+  exists: z8.boolean()
 });
-var deliveryKeyConfigResponseSchema = z9.strictObject({
+var deliveryKeyConfigResponseSchema = z8.strictObject({
   delivery_key_id: deliveryKeyIdSchema,
-  public_key: z9.string().min(1)
+  public_key: z8.string().min(1)
 });
 
 // ../../packages/core/src/api/written-verdicts.ts
 import { keccak256 as keccak2564, toBytes as toBytes3, zeroAddress as zeroAddress2 } from "viem";
-import { z as z10 } from "zod";
+import { z as z9 } from "zod";
 var WRITTEN_VERDICT_FORMAT_VERSION = 0;
 var FRONTMATTER_DELIMITER2 = "---";
-var decimalSchema = z10.string().regex(/^[1-9][0-9]*$/, "Must be a positive integer").transform(Number).refine(Number.isSafeInteger, "Must be a safe integer");
-var bountyIdSchema2 = z10.string().regex(/^(0|[1-9][0-9]*)$/, "Must be a non-negative integer");
-var addressSchema2 = z10.string().refine(isHexAddress, "Must be a hex-encoded address").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
-var bytes32Schema4 = z10.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
+var decimalSchema = z9.string().regex(/^[1-9][0-9]*$/, "Must be a positive integer").transform(Number).refine(Number.isSafeInteger, "Must be a safe integer");
+var bountyIdSchema2 = z9.string().regex(/^(0|[1-9][0-9]*)$/, "Must be a non-negative integer");
+var addressSchema2 = z9.string().refine(isHexAddress, "Must be a hex-encoded address").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
+var bytes32Schema3 = z9.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
 var commonFields = {
-  format_version: z10.literal(WRITTEN_VERDICT_FORMAT_VERSION.toString()).transform(() => WRITTEN_VERDICT_FORMAT_VERSION),
+  format_version: z9.literal(WRITTEN_VERDICT_FORMAT_VERSION.toString()).transform(() => WRITTEN_VERDICT_FORMAT_VERSION),
   chain_id: decimalSchema,
   hub_address: addressSchema2,
   bounty_id: bountyIdSchema2,
-  verdict_body: z10.string().refine((value) => value.trim().length > 0, "Must not be empty")
+  verdict_body: z9.string().refine((value) => value.trim().length > 0, "Must not be empty")
 };
-var writtenVerdictSchema = z10.discriminatedUnion("outcome", [
-  z10.object({
+var writtenVerdictSchema = z9.discriminatedUnion("outcome", [
+  z9.object({
     ...commonFields,
-    outcome: z10.literal("awarded"),
+    outcome: z9.literal("awarded"),
     winner: addressSchema2.refine(
       (value) => value !== zeroAddress2,
       "Must not be the zero address"
     ),
-    awarded_submission_commitment: bytes32Schema4.refine(
+    awarded_submission_commitment: bytes32Schema3.refine(
       (value) => value !== ZERO_BYTES32,
       "Must not be zero bytes"
     )
   }).strict(),
-  z10.object({
+  z9.object({
     ...commonFields,
-    outcome: z10.literal("no_valid_submission"),
-    winner: z10.literal(zeroAddress2)
+    outcome: z9.literal("no_valid_submission"),
+    winner: z9.literal(zeroAddress2)
   }).strict()
 ]);
 function buildWrittenVerdictMarkdown(input) {
@@ -5215,10 +5132,10 @@ var ApiRequestError = class extends Error {
     this.retryAfterMs = input.retryAfterMs;
   }
 };
-async function postText(url, body, contentType, authorization, headers = {}) {
+async function postText(url, body, contentType, authorization) {
   const response = await fetch(url, {
     method: "POST",
-    headers: { ...headers, "content-type": contentType, authorization },
+    headers: { "content-type": contentType, authorization },
     body
   });
   return parseJsonResponse(url, response);
@@ -5378,7 +5295,7 @@ function toArrayBuffer(bytes) {
 import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 
 // ../../packages/core/src/auth/authorization-header.ts
-import { isAddress as isAddress3, isHex as isHex5 } from "viem";
+import { isAddress as isAddress3, isHex as isHex4 } from "viem";
 var ELGORA_APPROVAL_AUTH_SCHEME = "Elgora-Approval";
 var FIELD_SEPARATOR = "~";
 function encodeApiRequestApprovalHeader(fields) {
@@ -5391,27 +5308,59 @@ function encodeApiRequestApprovalHeader(fields) {
   return `${ELGORA_APPROVAL_AUTH_SCHEME} ${btoa(payload)}`;
 }
 
-// ../../packages/core/src/auth/readiness-signoff-header.ts
-var ELGORA_READINESS_SIGNOFF_HEADER = "Elgora-Readiness-Signoff";
-function encodeReadinessSignoffHeader(signoff) {
-  const bytes = new TextEncoder().encode(
-    JSON.stringify(readinessSignoffSchema.parse(signoff))
-  );
-  return btoa(String.fromCharCode(...bytes));
+// ../../packages/core/src/auth/eip712.ts
+var API_REQUEST_APPROVAL_PRIMARY_TYPE = "ApiRequestApproval";
+var API_REQUEST_APPROVAL_TYPES = {
+  ApiRequestApproval: [
+    { name: "endpointId", type: "string" },
+    { name: "audience", type: "string" },
+    { name: "bodyHash", type: "bytes32" },
+    { name: "query", type: "string" },
+    { name: "blockNumber", type: "uint256" },
+    { name: "blockHash", type: "bytes32" }
+  ]
+};
+function buildElgoraEip712Domain(params) {
+  return {
+    name: "Elgora",
+    version: "1",
+    chainId: params.chainId,
+    verifyingContract: params.hubAddress
+  };
+}
+function buildApiRequestApprovalTypedData(params) {
+  return {
+    domain: buildElgoraEip712Domain({
+      chainId: params.chainId,
+      hubAddress: params.hubAddress
+    }),
+    types: API_REQUEST_APPROVAL_TYPES,
+    primaryType: API_REQUEST_APPROVAL_PRIMARY_TYPE,
+    message: params.message
+  };
+}
+function endpointIdFor(input) {
+  return `${input.method.toUpperCase()} ${input.path}`;
+}
+function audienceFor(host) {
+  return host.toLowerCase();
+}
+function queryFor(query) {
+  return new URLSearchParams(query).toString();
 }
 
 // ../../packages/core/src/auth/request-approval.ts
 import {
   hashTypedData,
-  isAddressEqual as isAddressEqual3,
+  isAddressEqual as isAddressEqual2,
   keccak256 as keccak2565,
   toBytes as toBytes4
 } from "viem";
 
 // ../../packages/core/src/auth/signature.ts
 import {
-  isAddressEqual as isAddressEqual2,
-  recoverTypedDataAddress as recoverTypedDataAddress3
+  isAddressEqual,
+  recoverTypedDataAddress as recoverTypedDataAddress2
 } from "viem";
 
 // ../../packages/core/src/auth/request-approval-header.ts
@@ -7173,7 +7122,7 @@ function resolveChainId(selector) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "9.1.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "10.0.0" : "0.0.0-dev";
 var CLI_NODE_ENGINES = true ? ">=24 <25" : ">=24 <25";
 
 // src/node-engines.ts
@@ -7380,7 +7329,6 @@ function required3(env, name) {
 }
 
 // src/publish-fund.ts
-import { readFile as readFile5 } from "fs/promises";
 import {
   decodeFunctionData,
   parseAbi as parseAbi2,
@@ -7408,15 +7356,6 @@ function loadPosterConfig(env, apiBaseUrlOverride) {
     posterPrivateKey: privateKey
   };
 }
-function takeFlag(argv, flag, usage) {
-  const uses = argv.filter(
-    (arg) => arg === flag || arg.startsWith(`${flag}=`)
-  ).length;
-  const extracted = extractFlagValue(argv, flag);
-  if (uses > 1 || uses === 1 && (!extracted.value || extracted.value.startsWith("--")))
-    throw new Error(usage);
-  return extracted;
-}
 async function readBountyChallengeMarkdown2(path5) {
   return path5 === "-" ? readStdinText3(process.stdin) : readFile4(path5, "utf8");
 }
@@ -7434,19 +7373,14 @@ async function signPosterRequest(input) {
 }
 
 // src/publish-fund.ts
-var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path|-> --signoff <file>";
+var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path|->";
 var usdcAbi = parseAbi2([
   "function approve(address spender,uint256 value) returns (bool)",
   "function balanceOf(address account) view returns (uint256)"
 ]);
 async function main9(env = process.env, argv = process.argv.slice(2)) {
-  const { apiBaseUrl: apiBaseUrlOverride, argv: afterApiBaseUrl } = extractApiBaseUrlFlag(argv);
-  const { value: signoffPath, argv: remainingArgv } = takeFlag(
-    afterApiBaseUrl,
-    "--signoff",
-    PUBLISH_FUND_USAGE
-  );
-  if (!signoffPath || remainingArgv.length !== 1 || !remainingArgv[0])
+  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
+  if (remainingArgv.length !== 1 || !remainingArgv[0])
     throw new Error(PUBLISH_FUND_USAGE);
   const config = loadPosterConfig(env, apiBaseUrlOverride);
   const escrowTokenAddress = withDeploymentDefaults(env).ELGORA_ESCROW_TOKEN_ADDRESS?.trim();
@@ -7462,17 +7396,6 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   const localSpecCommitment = deriveBountyChallengeContentCommitment(
     bountyChallengeMarkdown
   );
-  const signoff = readinessSignoffSchema.parse(
-    JSON.parse(await readFile5(signoffPath, "utf8"))
-  );
-  if (signoff.spec_commitment.toLowerCase() !== localSpecCommitment) {
-    throw new Error(
-      "Readiness sign-off does not match the exact bounty_challenge.md bytes. Run poster:review again."
-    );
-  }
-  if (signoff.expires_at <= Math.floor(Date.now() / 1e3)) {
-    throw new Error("Readiness sign-off has expired. Run poster:review again.");
-  }
   const account = privateKeyToAccount8(config.posterPrivateKey);
   const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
   const walletClient = createChainWalletClient(
@@ -7496,8 +7419,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   const prepared = await requestPreparePublication({
     requestUrl: requestUrl.toString(),
     markdown: bountyChallengeMarkdown,
-    authorization,
-    signoff: encodeReadinessSignoffHeader(signoff)
+    authorization
   });
   if (prepared.content_record.spec_commitment !== localSpecCommitment) {
     throw new Error(
@@ -7637,8 +7559,7 @@ async function requestPreparePublication(input) {
     new URL(input.requestUrl),
     input.markdown,
     "text/markdown",
-    input.authorization,
-    { [ELGORA_READINESS_SIGNOFF_HEADER]: input.signoff }
+    input.authorization
   );
   return bountyPublicationResponseSchema.parse(body);
 }
@@ -7649,28 +7570,28 @@ function missingRequiredEnv(required4, env) {
 }
 
 // src/review.ts
-import { writeFile as writeFile3 } from "fs/promises";
-import { resolve } from "path";
 import { privateKeyToAccount as privateKeyToAccount9 } from "viem/accounts";
-var USAGE2 = "Usage: elgora-cli poster:review <path|-> [--previous <commitment>] [--signoff-out <file>]";
+var USAGE2 = "Usage: elgora-cli poster:review <path|-> [--previous <commitment>]";
+function takeFlag(argv, flag, usage) {
+  const uses = argv.filter(
+    (arg) => arg === flag || arg.startsWith(`${flag}=`)
+  ).length;
+  const extracted = extractFlagValue(argv, flag);
+  if (uses > 1 || uses === 1 && (!extracted.value || extracted.value.startsWith("--")))
+    throw new Error(usage);
+  return extracted;
+}
 async function main10(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl, argv: args } = extractApiBaseUrlFlag(argv);
-  const { value: previous, argv: afterPrevious } = takeFlag(
+  const { value: previous, argv: paths } = takeFlag(
     args,
     "--previous",
     "--previous must be one bytes32 page commitment"
   );
   if (previous && !isHexBytes32(previous))
     throw new Error("--previous must be one bytes32 page commitment");
-  const { value: signoffOut, argv: paths } = takeFlag(
-    afterPrevious,
-    "--signoff-out",
-    USAGE2
-  );
   if (paths.length !== 1 || !paths[0] || paths[0].startsWith("--"))
     throw new Error(USAGE2);
-  if (signoffOut && paths[0] !== "-" && resolve(signoffOut) === resolve(paths[0]))
-    throw new Error("--signoff-out must not overwrite the bounty draft");
   const config = loadPosterConfig(env, apiBaseUrl);
   const markdown = await readBountyChallengeMarkdown2(paths[0]);
   const commitment = deriveBountyChallengeContentCommitment(markdown);
@@ -7719,18 +7640,12 @@ async function main10(env = process.env, argv = process.argv.slice(2)) {
       "Elgora API returned a review for different bounty_challenge.md bytes"
     );
   }
-  if (signoffOut)
-    await writeFile3(
-      signoffOut,
-      `${JSON.stringify(response.readiness.signoff, null, 2)}
-`
-    );
   console.log(
     JSON.stringify({
       event: "review.ready",
       spec_commitment: commitment,
-      signoff: response.readiness.signoff,
-      warnings: response.readiness.warnings ?? [],
+      approved_until: response.readiness.approved_until,
+      warnings: response.readiness.warnings,
       prior_issues_resolved: response.readiness.prior_issues_resolved,
       prior_issues_open: response.readiness.prior_issues_open
     })
@@ -7960,8 +7875,8 @@ function usageError3() {
 }
 
 // src/roster-verify-guardian-proof.ts
-import { readFile as readFile6 } from "fs/promises";
-import { isAddress as isAddress6, isHex as isHex6, recoverMessageAddress } from "viem";
+import { readFile as readFile5 } from "fs/promises";
+import { isAddress as isAddress6, isHex as isHex5, recoverMessageAddress } from "viem";
 async function main13(_env = process.env, argv = process.argv.slice(2)) {
   const [preparedPath, responsePath] = argv;
   if (!preparedPath || !responsePath) {
@@ -7969,8 +7884,8 @@ async function main13(_env = process.env, argv = process.argv.slice(2)) {
       "Usage: elgora-cli roster:verify-guardian-proof <prepared_json_path> <response_json_path>"
     );
   }
-  const prepared = parsePrepared(await readFile6(preparedPath, "utf8"));
-  const response = parseResponse(await readFile6(responsePath, "utf8"));
+  const prepared = parsePrepared(await readFile5(preparedPath, "utf8"));
+  const response = parseResponse(await readFile5(responsePath, "utf8"));
   const fixture = base64UrlToBytes(prepared.fixture);
   const signedPayload = buildGuardianRosterKeyProofSignedPayload(
     prepared.message,
@@ -8034,7 +7949,7 @@ function parseResponse(text) {
   }
   const guardianAccount = get(parsed, "guardian_account");
   const signature = get(parsed, "signature");
-  if (typeof guardianAccount !== "string" || !isAddress6(guardianAccount) || typeof signature !== "string" || !isHex6(signature) || signature.length !== 132) {
+  if (typeof guardianAccount !== "string" || !isAddress6(guardianAccount) || typeof signature !== "string" || !isHex5(signature) || signature.length !== 132) {
     throw new Error(
       "Guardian response JSON must be the unmodified stdout of guardian:prove-roster-key"
     );
@@ -8052,7 +7967,7 @@ function get(value, key) {
 }
 
 // src/spec-commitment.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { text as readStdinText4 } from "stream/consumers";
 var SPEC_COMMITMENT_USAGE = "Usage: elgora-cli spec-commitment <bounty_challenge_md_path>\n   or: elgora-cli spec-commitment -";
 async function main14(_env = process.env, argv = process.argv.slice(2)) {
@@ -8074,23 +7989,23 @@ async function readBountyChallengeMarkdown3(argv) {
   if (path5 === "-") {
     return readStdinText4(process.stdin);
   }
-  return readFile7(path5, "utf8");
+  return readFile6(path5, "utf8");
 }
 
 // src/submit.ts
-import { readdir, readFile as readFile8, stat } from "fs/promises";
+import { readdir, readFile as readFile7, stat } from "fs/promises";
 import path3 from "path";
 import { createInterface } from "readline";
 import { isAddress as isAddress7 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount11 } from "viem/accounts";
 
 // src/external-api-approval-signer.ts
-import { isHex as isHex7 } from "viem";
+import { isHex as isHex6 } from "viem";
 function createExternalApiApprovalSigner(input) {
   return async (typedData) => {
     input.writePrompt(input.renderPrompt(typedData));
     const signature = (await input.readSignature())?.trim();
-    if (!signature || signature === "0x" || !isHex7(signature)) {
+    if (!signature || signature === "0x" || !isHex6(signature)) {
       throw new Error(
         "External signer must return one non-empty 0x-prefixed hex signature line on stdin"
       );
@@ -8530,7 +8445,7 @@ async function readArtifactDirectory(artifactDir) {
   }
   return Promise.all(
     entries.map(async (entry) => {
-      const bytes = await readFile8(path3.join(artifactDir, entry.name));
+      const bytes = await readFile7(path3.join(artifactDir, entry.name));
       return {
         name: entry.name,
         media_type: guessMediaType(entry.name),
@@ -8599,7 +8514,7 @@ async function requestPrepareSubmission(input) {
           })
         );
       }
-      await new Promise((resolve2) => setTimeout(resolve2, retryDelay));
+      await new Promise((resolve) => setTimeout(resolve, retryDelay));
     }
   }
 }
@@ -8807,9 +8722,9 @@ var COMMAND_HELP = {
     apiBaseUrlFlag: true
   },
   "poster:review": {
-    usage: "elgora-cli poster:review <path|-> [--previous <commitment>] [--signoff-out <file>]",
-    title: "Review a bounty page and save its readiness certificate.",
-    description: "Send the exact Markdown for a signed readiness review. Ready prints\n  review.ready; --signoff-out saves the certificate for publication.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous page commitment with the signed request.",
+    usage: "elgora-cli poster:review <path|-> [--previous <commitment>]",
+    title: "Review a bounty page before publishing it.",
+    description: "Sign and send the exact Markdown for a readiness review. Ready prints\n  review.ready; Elgora keeps the approval for these exact bytes.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous page commitment with the signed request.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",
@@ -8820,9 +8735,9 @@ var COMMAND_HELP = {
     apiBaseUrlFlag: true
   },
   "poster:publish-fund": {
-    usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|-> --signoff <file>",
+    usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|->",
     title: "Publish an approved challenge and fund its bounty.",
-    description: "Read the exact approved bounty_challenge.md bytes and its saved certificate.\n  Publishing checks the certificate and never runs another AI review.\n  Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
+    description: "Read the exact approved bounty_challenge.md bytes. Publishing reuses\n  their saved approval without another AI review, or reviews them first.\n  Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elgora/cli",
-  "version": "9.1.0",
+  "version": "10.0.0",
   "description": "Command-line client for Elgora, a decentralized bounty marketplace for science. Lets Posters, Solvers, and Guardians interact with Elgora's public API and on-chain contracts.",
   "type": "module",
   "license": "MIT",