@elgora/cli 9.1.0 → 10.1.0

package/dist/cli.js

@@ -71,6 +71,8 @@ var BOUNTY_CHALLENGE_PROFILE = "elgora_markdown_bounty_challenge_v0";
 var WINNER_TAKE_ALL_PAYOUT_POLICY = "winner_take_all";
 var SUBMISSION_ENCRYPTION_TYPE = "guardian_timelock_hpke_aes_256_gcm_v0";
 var ZERO_BYTES32 = "0x0000000000000000000000000000000000000000000000000000000000000000";
+var READINESS_APPROVAL_VALIDITY_SECONDS = 7 * 24 * 60 * 60;
+var READINESS_TIMEOUT_MS = 12e4;
 
 // ../../packages/core/src/bounty-challenge-markdown.ts
 var FRONTMATTER_DELIMITER = "---";
@@ -384,107 +386,37 @@ function isBountyChallengeFrontmatterKey(value) {
 }
 
 // ../../packages/core/src/bounty-publication-response.ts
-import { isHex as isHex3 } from "viem";
-import { z as z3 } from "zod";
-
-// ../../packages/core/src/auth/readiness-signoff.ts
-import {
-  isAddressEqual,
-  isHex as isHex2,
-  recoverTypedDataAddress,
-  size as size2
-} from "viem";
+import { isHex as isHex2 } from "viem";
 import { z as z2 } from "zod";
-
-// ../../packages/core/src/auth/eip712.ts
-var API_REQUEST_APPROVAL_PRIMARY_TYPE = "ApiRequestApproval";
-var API_REQUEST_APPROVAL_TYPES = {
-  ApiRequestApproval: [
-    { name: "endpointId", type: "string" },
-    { name: "audience", type: "string" },
-    { name: "bodyHash", type: "bytes32" },
-    { name: "query", type: "string" },
-    { name: "blockNumber", type: "uint256" },
-    { name: "blockHash", type: "bytes32" }
-  ]
-};
-function buildElgoraEip712Domain(params) {
-  return {
-    name: "Elgora",
-    version: "1",
-    chainId: params.chainId,
-    verifyingContract: params.hubAddress
-  };
-}
-function buildApiRequestApprovalTypedData(params) {
-  return {
-    domain: buildElgoraEip712Domain({
-      chainId: params.chainId,
-      hubAddress: params.hubAddress
-    }),
-    types: API_REQUEST_APPROVAL_TYPES,
-    primaryType: API_REQUEST_APPROVAL_PRIMARY_TYPE,
-    message: params.message
-  };
-}
-function endpointIdFor(input) {
-  return `${input.method.toUpperCase()} ${input.path}`;
-}
-function audienceFor(host) {
-  return host.toLowerCase();
-}
-function queryFor(query) {
-  return new URLSearchParams(query).toString();
-}
-
-// ../../packages/core/src/auth/readiness-signoff.ts
-var READINESS_APPROVAL_VALIDITY_SECONDS = 7 * 24 * 60 * 60;
-var bytes32Schema = z2.string().refine(isHexBytes32).transform((value) => value);
-var timestampSchema = z2.number().int().nonnegative().max(9999999999);
-var readinessSignoffMessageSchema = z2.object({
-  audience: z2.string().min(1).max(512),
+var addressSchema = z2.string().refine(isHexAddress, "Must be a 20-byte EVM address").transform((value) => value);
+var bytes32Schema = z2.string().refine(isHexBytes32, "Must be a bytes32 hex string").transform((value) => value);
+var hexBytesSchema = z2.string().refine(isHex2, "Must be hex-encoded calldata").transform((value) => value);
+var bountyChallengeContentRecordSchema = z2.object({
+  content_kind: z2.literal("bounty_challenge_spec"),
   spec_commitment: bytes32Schema,
-  reviewer_hash: bytes32Schema,
-  model: z2.string().min(1).max(256),
-  issued_at: timestampSchema,
-  expires_at: timestampSchema
-}).strict();
-var signatureSchema = z2.string().refine((value) => isHex2(value) && size2(value) === 65).transform((value) => value);
-var readinessSignoffSchema = readinessSignoffMessageSchema.extend({ signature: signatureSchema }).refine((signoff) => signoff.expires_at > signoff.issued_at, {
-  path: ["expires_at"],
-  message: "Must expire after issuance"
-});
-
-// ../../packages/core/src/bounty-publication-response.ts
-var addressSchema = z3.string().refine(isHexAddress, "Must be a 20-byte EVM address").transform((value) => value);
-var bytes32Schema2 = z3.string().refine(isHexBytes32, "Must be a bytes32 hex string").transform((value) => value);
-var hexBytesSchema = z3.string().refine(isHex3, "Must be hex-encoded calldata").transform((value) => value);
-var bountyChallengeContentRecordSchema = z3.object({
-  content_kind: z3.literal("bounty_challenge_spec"),
-  spec_commitment: bytes32Schema2,
-  byte_length: z3.number().int().positive(),
+  byte_length: z2.number().int().positive(),
   token_address: addressSchema,
-  created_at: z3.string().datetime({ offset: true })
+  created_at: z2.string().datetime({ offset: true })
 }).strict();
-var bountyPublicationResponseSchema = z3.object({
+var bountyPublicationResponseSchema = z2.object({
   content_record: bountyChallengeContentRecordSchema,
-  create_bounty_transaction: z3.object({
-    chain_id: z3.number().int().positive(),
+  create_bounty_transaction: z2.object({
+    chain_id: z2.number().int().positive(),
     to: addressSchema,
-    value: z3.literal("0"),
+    value: z2.literal("0"),
     data: hexBytesSchema,
-    function_name: z3.literal("create_bounty"),
-    args: z3.object({
-      spec_commitment: bytes32Schema2,
-      escrow_amount: z3.string().refine(isPositiveInteger),
-      submission_deadline: z3.number().int().positive()
+    function_name: z2.literal("create_bounty"),
+    args: z2.object({
+      spec_commitment: bytes32Schema,
+      escrow_amount: z2.string().refine(isPositiveInteger),
+      submission_deadline: z2.number().int().positive()
     }).strict()
   }).strict(),
-  protocol_fee_policy: z3.object({
+  protocol_fee_policy: z2.object({
     treasury_recipient: addressSchema,
-    treasury_fee_bps: z3.number().int().min(0).max(1e4),
+    treasury_fee_bps: z2.number().int().min(0).max(1e4),
     guardian_fee_recipient: addressSchema,
-    guardian_fee_bps: z3.number().int().min(0).max(1e4)
+    guardian_fee_bps: z2.number().int().min(0).max(1e4)
   }).strict()
 }).strict().superRefine((response, context) => {
   if (response.content_record.spec_commitment !== response.create_bounty_transaction.args.spec_commitment) {
@@ -495,47 +427,33 @@ var bountyPublicationResponseSchema = z3.object({
     });
   }
 });
-var priorIssueSchema = z3.object({
-  issue_index: z3.number().int().nonnegative(),
-  message: z3.string().trim().min(1).max(1500)
+var priorIssueSchema = z2.object({
+  issue_index: z2.number().int().nonnegative(),
+  message: z2.string().trim().min(1).max(1500)
 }).strict();
 var priorIssueStatusSchema = priorIssueSchema.extend({
-  status: z3.enum(["resolved", "open"])
+  status: z2.enum(["resolved", "open"])
 }).strict();
-var readinessFindingSchema = z3.object({
-  path: z3.string().trim().min(1).max(120),
-  message: z3.string().trim().min(1).max(1500),
-  code: z3.string().min(1).optional(),
-  anchor: z3.string().trim().min(1).max(120).optional(),
-  hazard: z3.boolean().optional()
+var readinessFindingSchema = z2.object({
+  path: z2.string().trim().min(1).max(120),
+  message: z2.string().trim().min(1).max(1500),
+  code: z2.string().min(1).optional(),
+  anchor: z2.string().trim().min(1).max(120).optional(),
+  hazard: z2.boolean().optional()
 });
 var MAX_READINESS_FINDINGS = 20;
-var bountyReviewResponseSchema = z3.object({
-  content_record: bountyChallengeContentRecordSchema,
-  readiness: z3.object({
-    decision: z3.literal("ready"),
-    signoff: readinessSignoffSchema,
+var bountyReviewResponseSchema = z2.object({
+  content_record: bountyChallengeContentRecordSchema.omit({ created_at: true }),
+  readiness: z2.object({
+    decision: z2.literal("ready"),
+    // Publication reuses the approval of these exact bytes until then.
+    approved_until: z2.string().datetime({ offset: true }),
     // The dissenting pass's findings on a ready check; never blocking.
-    // Optional because servers before three-pass review do not send it.
-    warnings: z3.array(readinessFindingSchema).max(MAX_READINESS_FINDINGS).optional(),
-    prior_issues_resolved: z3.array(priorIssueSchema),
-    prior_issues_open: z3.array(priorIssueSchema)
+    warnings: z2.array(readinessFindingSchema).max(MAX_READINESS_FINDINGS),
+    prior_issues_resolved: z2.array(priorIssueSchema),
+    prior_issues_open: z2.array(priorIssueSchema)
   })
-}).superRefine((response, context) => {
-  if (response.readiness.signoff.spec_commitment.toLowerCase() !== response.content_record.spec_commitment.toLowerCase()) {
-    context.addIssue({
-      code: "custom",
-      path: ["readiness", "signoff", "spec_commitment"],
-      message: "Must match content_record.spec_commitment"
-    });
-  }
 });
-var readinessSignerResponseSchema = z3.object({
-  signer_address: addressSchema,
-  reviewer_hash: bytes32Schema2,
-  configured_model: z3.string().min(1),
-  audience: z3.string().min(1)
-}).strict();
 
 // ../../packages/core/src/chain-registry.ts
 import { base, baseSepolia, foundry } from "viem/chains";
@@ -559,7 +477,7 @@ var FOUNDRY_CHAIN_ID = foundry.id;
 import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
 import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
 import { concatBytes, keccak256 as keccak2562, toBytes as toBytes2 } from "viem";
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 
 // ../../packages/core/src/base64.ts
 var BASE64_ENCODE_CHUNK_BYTES = 3 * 16384;
@@ -645,42 +563,42 @@ var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
 var SOLVER_SUBMISSION_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var MEDIA_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
 var KEY_ID_RE = /^[A-Za-z0-9][ -~]*$/;
-var base64UrlSchema = z4.string().regex(BASE64URL_RE);
-var lowerAddressSchema = z4.string().refine(isLowercaseHexAddress);
-var bytes32Schema3 = z4.string().refine(isLowercaseBytes32);
-var sha256HexSchema = z4.string().refine(isSha256Hex);
-var keyIdSchema = z4.string().min(1).max(128).regex(KEY_ID_RE);
-var artifactNameSchema = z4.string().max(
+var base64UrlSchema = z3.string().regex(BASE64URL_RE);
+var lowerAddressSchema = z3.string().refine(isLowercaseHexAddress);
+var bytes32Schema2 = z3.string().refine(isLowercaseBytes32);
+var sha256HexSchema = z3.string().refine(isSha256Hex);
+var keyIdSchema = z3.string().min(1).max(128).regex(KEY_ID_RE);
+var artifactNameSchema = z3.string().max(
   MAX_SOLVER_SUBMISSION_NAME_CHARACTERS,
   `Artifact filename exceeds ${MAX_SOLVER_SUBMISSION_NAME_CHARACTERS} ASCII characters (including extension). Solvers may shorten it only if the published challenge permits, before the deadline.`
 ).regex(SOLVER_SUBMISSION_NAME_RE);
-var mediaTypeSchema = z4.string().regex(MEDIA_TYPE_RE);
-var bountyIdSchema = z4.string().refine(isBountyId);
-var chainIdSchema = z4.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
-var privateArtifactContextSchema = z4.strictObject({
-  type: z4.literal("solver_submission"),
+var mediaTypeSchema = z3.string().regex(MEDIA_TYPE_RE);
+var bountyIdSchema = z3.string().refine(isBountyId);
+var chainIdSchema = z3.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
+var privateArtifactContextSchema = z3.strictObject({
+  type: z3.literal("solver_submission"),
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   bounty_id: bountyIdSchema,
   actor_address: lowerAddressSchema
 });
-var guardianRecipientSchema = z4.strictObject({
+var guardianRecipientSchema = z3.strictObject({
   key_id: keyIdSchema,
-  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   public_key: base64UrlSchema.length(
     43,
     "public_key must encode a 32-byte X25519 public key"
   )
 });
-var guardianRecipientPrivateKeySchema = z4.strictObject({
+var guardianRecipientPrivateKeySchema = z3.strictObject({
   key_id: keyIdSchema,
-  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   private_key: base64UrlSchema.length(
     43,
     "private_key must encode a 32-byte X25519 private key"
   )
 });
-var guardianRecipientsSchema = z4.array(guardianRecipientSchema).min(1).superRefine((recipients, ctx) => {
+var guardianRecipientsSchema = z3.array(guardianRecipientSchema).min(1).superRefine((recipients, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (const recipient of recipients) {
     if (seen.has(recipient.key_id)) {
@@ -693,24 +611,24 @@ var guardianRecipientsSchema = z4.array(guardianRecipientSchema).min(1).superRef
     seen.add(recipient.key_id);
   }
 });
-var guardianRecipientPrivateKeysSchema = z4.array(guardianRecipientPrivateKeySchema).min(1);
-var artifactManifestEntrySchema = z4.strictObject({
+var guardianRecipientPrivateKeysSchema = z3.array(guardianRecipientPrivateKeySchema).min(1);
+var artifactManifestEntrySchema = z3.strictObject({
   name: artifactNameSchema,
   media_type: mediaTypeSchema,
-  size_bytes: z4.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER),
+  size_bytes: z3.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER),
   sha256: sha256HexSchema
 });
-var privateArtifactPublicManifestSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND),
+var privateArtifactPublicManifestSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND),
   context: privateArtifactContextSchema
 });
 var encryptedBundleArtifactSchema = artifactManifestEntrySchema.extend({
   bytes: base64UrlSchema
 });
-var privateArtifactEncryptedBundleSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
+var privateArtifactEncryptedBundleSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
   context: privateArtifactContextSchema,
-  artifacts: z4.array(encryptedBundleArtifactSchema).min(1).max(
+  artifacts: z3.array(encryptedBundleArtifactSchema).min(1).max(
     MAX_SOLVER_SUBMISSION_FILES,
     `Submission exceeds the maximum of ${MAX_SOLVER_SUBMISSION_FILES} files.`
   ).refine(
@@ -718,33 +636,33 @@ var privateArtifactEncryptedBundleSchema = z4.strictObject({
     "artifact names must be unique case-insensitively"
   )
 });
-var privateArtifactRevealPolicySchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_REVEAL_POLICY_KIND),
-  network: z4.string().min(1),
-  chain_hash: z4.string().min(1),
-  round: z4.string().refine(isPositiveInteger),
-  not_before: z4.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER)
+var privateArtifactRevealPolicySchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_REVEAL_POLICY_KIND),
+  network: z3.string().min(1),
+  chain_hash: z3.string().min(1),
+  round: z3.string().refine(isPositiveInteger),
+  not_before: z3.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER)
 });
-var wrappedRecipientKeySchema = z4.strictObject({
+var wrappedRecipientKeySchema = z3.strictObject({
   key_id: keyIdSchema,
-  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   enc: base64UrlSchema,
   ciphertext: base64UrlSchema
 });
-var wrappedKeyBagSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND),
-  keys: z4.array(wrappedRecipientKeySchema).min(1)
+var wrappedKeyBagSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND),
+  keys: z3.array(wrappedRecipientKeySchema).min(1)
 });
-var privateArtifactEnvelopeSchema = z4.strictObject({
-  kind: z4.literal(PRIVATE_ARTIFACT_ENVELOPE_KIND),
-  alg: z4.literal(SUBMISSION_ENCRYPTION_TYPE),
+var privateArtifactEnvelopeSchema = z3.strictObject({
+  kind: z3.literal(PRIVATE_ARTIFACT_ENVELOPE_KIND),
+  alg: z3.literal(SUBMISSION_ENCRYPTION_TYPE),
   context: privateArtifactContextSchema,
   public_manifest: privateArtifactPublicManifestSchema,
   public_manifest_sha256: sha256HexSchema,
   encrypted_bundle_sha256: sha256HexSchema,
   ciphertext_sha256: sha256HexSchema,
   guardian_recipients: guardianRecipientsSchema,
-  guardian_recipients_commitment: bytes32Schema3,
+  guardian_recipients_commitment: bytes32Schema2,
   reveal_policy: privateArtifactRevealPolicySchema,
   envelope_nonce: base64UrlSchema.length(
     22,
@@ -752,7 +670,7 @@ var privateArtifactEnvelopeSchema = z4.strictObject({
   ),
   iv: base64UrlSchema.length(16, "iv must encode 12 bytes"),
   wrapped_key_bag: base64UrlSchema,
-  ciphertext_locator: z4.string().min(1)
+  ciphertext_locator: z3.string().min(1)
 });
 function parsePrivateArtifactEnvelope(input) {
   return privateArtifactEnvelopeSchema.parse(input);
@@ -810,11 +728,11 @@ var x25519PrivateKeySchema = base64UrlSchema.length(
   43,
   "must encode a 32-byte X25519 private key"
 );
-var winningSolutionDeliveryContextSchema = z4.strictObject({
+var winningSolutionDeliveryContextSchema = z3.strictObject({
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   bounty_id: bountyIdSchema,
-  submission_commitment: bytes32Schema3
+  submission_commitment: bytes32Schema2
 });
 async function generateX25519KeyPair(input) {
   const suite = createHpkeSuite();
@@ -891,7 +809,7 @@ function buildWinningSolutionDeliveryInfo(contextCommitment) {
 var GUARDIAN_ROSTER_KEY_PROOF_INFO = "elgora/guardian-roster-key-proof/hpke-fixture/v0";
 var GUARDIAN_ROSTER_KEY_PROOF_MESSAGE_TYPE = "elgora_guardian_roster_key_proof_v0";
 var GUARDIAN_ROSTER_KEY_PROOF_FIXTURE_BYTES = 32;
-var guardianRosterKeyProofContextSchema = z4.strictObject({
+var guardianRosterKeyProofContextSchema = z3.strictObject({
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   proposed_account: lowerAddressSchema,
@@ -1219,7 +1137,7 @@ async function wrapAesKeyForRecipients(input) {
 }
 async function openAesKeyForRecipient(input) {
   const suite = createHpkeSuite();
-  const wrappedKeys = z4.array(wrappedRecipientKeySchema).parse(input.wrappedKeys);
+  const wrappedKeys = z3.array(wrappedRecipientKeySchema).parse(input.wrappedKeys);
   const privateKeys = guardianRecipientPrivateKeysSchema.parse(
     input.privateKeys
   );
@@ -1615,7 +1533,7 @@ var DEPLOYMENTS = {
     ELGORA_ESCROW_TOKEN_ADDRESS: "0x036cbd53842c5426634e7929541ec2318f3dcf7e",
     payoutSchemeAddress: "0x752d4305b8567b777d479dfa9847dc4f5ffb5750",
     ELGORA_SUBGRAPH_ENDPOINT: "https://api.goldsky.com/api/public/project_cmtu7wslg04s501ovc2je3beh/subgraphs/elgora-elgorahub/testnet-production/gn",
-    ELGORA_API_BASE_URL: "https://staging.elgora.ai",
+    ELGORA_API_BASE_URL: "https://testnet.elgora.ai",
     deployBlock: 46353511,
     deployTransaction: "0xed3d3c8af3c69f9f8d4ec47da7179fe4b89bd4a4cd8d8232dbbd3d3f3d38e74b",
     sourceCommit: "1377da5c38dc5c90d8608ffa3cb15ad6f8567a01"
@@ -3930,7 +3848,7 @@ function settlementAmounts(escrowAmount, treasuryFeeBps, guardianFeeBps) {
 import { zeroAddress } from "viem";
 
 // ../../packages/core/src/api/bounty-preparation.ts
-import { ZodError, z as z5 } from "zod";
+import { ZodError, z as z4 } from "zod";
 
 // ../../packages/core/src/submission-timelock.ts
 import {
@@ -4191,7 +4109,7 @@ import {
   getAbiItem as getAbiItem2,
   parseAbi,
   parseSignature,
-  recoverTypedDataAddress as recoverTypedDataAddress2
+  recoverTypedDataAddress
 } from "viem";
 var ELGORA_HUB_ERRORS = ELGORA_HUB_ABI.filter(
   (item) => item.type === "error"
@@ -4348,7 +4266,7 @@ async function prepareAuthorizedCreateBountyTransaction(input) {
     if (unsupported) return null;
     throw error;
   }
-  if ((await recoverTypedDataAddress2({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
+  if ((await recoverTypedDataAddress({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
     throw new Error("USDC authorization was not signed by the funding Poster.");
   }
   const { r, s, yParity } = parseSignature(signature);
@@ -4424,14 +4342,14 @@ var BoundaryValidationError = class extends Error {
     this.issues = issues;
   }
 };
-var artifactUploadUrlRequestSchema = z5.object({
-  ciphertext_sha256: z5.string().refine(isSha256Hex),
-  ciphertext_byte_length: z5.number().int().positive().max(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)
+var artifactUploadUrlRequestSchema = z4.object({
+  ciphertext_sha256: z4.string().refine(isSha256Hex),
+  ciphertext_byte_length: z4.number().int().positive().max(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)
 }).strict();
 
 // ../../packages/core/src/api/config.ts
 import { createHash } from "crypto";
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 function withDeploymentEnvDefaults(env) {
   const merged = { ...env };
   const setIfBlank = (key, value) => {
@@ -4452,11 +4370,11 @@ function withDeploymentEnvDefaults(env) {
   setIfBlank("ELGORA_SUBGRAPH_ENDPOINT", deployment?.ELGORA_SUBGRAPH_ENDPOINT);
   return merged;
 }
-var chainIdField = z6.coerce.number().int().positive().refine((chainId) => SUPPORTED_CHAINS[chainId] !== void 0, {
+var chainIdField = z5.coerce.number().int().positive().refine((chainId) => SUPPORTED_CHAINS[chainId] !== void 0, {
   message: `ELGORA_CHAIN_ID must be a supported chain: ${Object.keys(SUPPORTED_CHAINS).join(", ")}`
 });
-var hubAddressField = z6.string().refine(isHexAddress, "ELGORA_HUB_ADDRESS must be a 20-byte EVM address").transform((value) => value.toLowerCase());
-var publicDeploymentEnvSchema = z6.object({
+var hubAddressField = z5.string().refine(isHexAddress, "ELGORA_HUB_ADDRESS must be a 20-byte EVM address").transform((value) => value.toLowerCase());
+var publicDeploymentEnvSchema = z5.object({
   ELGORA_CHAIN_ID: chainIdField,
   ELGORA_HUB_ADDRESS: hubAddressField
 });
@@ -4472,50 +4390,42 @@ function loadPublicDeploymentConfig(env = process.env) {
 var envShape = {
   ELGORA_CHAIN_ID: chainIdField,
   ELGORA_HUB_ADDRESS: hubAddressField,
-  ELGORA_ESCROW_TOKEN_ADDRESS: z6.string().refine(
+  ELGORA_ESCROW_TOKEN_ADDRESS: z5.string().refine(
     isHexAddress,
     "ELGORA_ESCROW_TOKEN_ADDRESS must be a 20-byte EVM address"
   ).transform((value) => value.toLowerCase()),
-  ELGORA_TIMELOCK_REVEAL_DELAY_SECONDS: z6.coerce.number().int().nonnegative().default(DEFAULT_TIMELOCK_REVEAL_DELAY_SECONDS),
-  ELGORA_RPC_URL: z6.string().min(1, "ELGORA_RPC_URL is required"),
+  ELGORA_TIMELOCK_REVEAL_DELAY_SECONDS: z5.coerce.number().int().nonnegative().default(DEFAULT_TIMELOCK_REVEAL_DELAY_SECONDS),
+  ELGORA_RPC_URL: z5.string().min(1, "ELGORA_RPC_URL is required"),
   /**
    * Only consulted for a chain with no recorded deployment — a local anvil
    * stack, whose addresses change on every deploy. A recorded deployment's
    * scheme always wins, because settlement validation compares against it.
    */
-  ELGORA_PAYOUT_SCHEME_ADDRESS: z6.string().refine(
+  ELGORA_PAYOUT_SCHEME_ADDRESS: z5.string().refine(
     isHexAddress,
     "ELGORA_PAYOUT_SCHEME_ADDRESS must be a 20-byte EVM address"
   ).transform((value) => value.toLowerCase()).optional(),
-  ELGORA_DATABASE_URL: z6.string().min(1, "ELGORA_DATABASE_URL is required"),
-  ELGORA_SUBGRAPH_ENDPOINT: z6.string().min(1, "ELGORA_SUBGRAPH_ENDPOINT is required"),
-  ELGORA_ARTIFACT_STORAGE_ENDPOINT: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_ENDPOINT is required"),
-  ELGORA_ARTIFACT_STORAGE_REGION: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_REGION is required"),
-  ELGORA_ARTIFACT_STORAGE_BUCKET: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_BUCKET is required"),
-  ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID is required"),
-  ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY is required"),
-  ELGORA_DELIVERY_PUBLIC_KEY: z6.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
-  ELGORA_DELIVERY_PRIVATE_KEY: z6.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
+  ELGORA_DATABASE_URL: z5.string().min(1, "ELGORA_DATABASE_URL is required"),
+  ELGORA_SUBGRAPH_ENDPOINT: z5.string().min(1, "ELGORA_SUBGRAPH_ENDPOINT is required"),
+  ELGORA_ARTIFACT_STORAGE_ENDPOINT: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_ENDPOINT is required"),
+  ELGORA_ARTIFACT_STORAGE_REGION: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_REGION is required"),
+  ELGORA_ARTIFACT_STORAGE_BUCKET: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_BUCKET is required"),
+  ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID is required"),
+  ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY is required"),
+  ELGORA_DELIVERY_PUBLIC_KEY: z5.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
+  ELGORA_DELIVERY_PRIVATE_KEY: z5.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
 };
-var readinessAudienceSchema = z6.string().trim().toLowerCase().min(1).max(512).refine((host) => {
-  try {
-    const url = new URL(`https://${host}`);
-    return url.host === host && url.pathname === "/" && !url.username && !url.password && !url.search && !url.hash;
-  } catch {
-    return false;
-  }
-}, "Must be a canonical hostname with optional port, without a URL path");
 var publicationEnvShape = {
   ELGORA_CHAIN_ID: envShape.ELGORA_CHAIN_ID,
   ELGORA_HUB_ADDRESS: envShape.ELGORA_HUB_ADDRESS,
   ELGORA_ESCROW_TOKEN_ADDRESS: envShape.ELGORA_ESCROW_TOKEN_ADDRESS,
   ELGORA_DATABASE_URL: envShape.ELGORA_DATABASE_URL,
   ELGORA_SUBGRAPH_ENDPOINT: envShape.ELGORA_SUBGRAPH_ENDPOINT,
-  ELGORA_PUBLICATION_REVIEW_ENABLED: z6.string().trim().toLowerCase().pipe(z6.enum(["true", "false"])).default("true").transform((value) => value === "true"),
-  ELGORA_READINESS_TIMEOUT_MS: z6.coerce.number().int().min(1).max(12e4).default(12e4)
+  ELGORA_PUBLICATION_REVIEW_ENABLED: z5.string().trim().toLowerCase().pipe(z5.enum(["true", "false"])).default("true").transform((value) => value === "true"),
+  ELGORA_READINESS_TIMEOUT_MS: z5.coerce.number().int().min(1).max(READINESS_TIMEOUT_MS).default(READINESS_TIMEOUT_MS)
 };
-var envSchema = z6.object(envShape);
-var bountyPublicationEnvSchema = z6.object(publicationEnvShape);
+var envSchema = z5.object(envShape);
+var bountyPublicationEnvSchema = z5.object(publicationEnvShape);
 
 // ../../packages/core/src/api/elgora-hub-error-catalog.ts
 import { decodeErrorResult } from "viem";
@@ -4530,81 +4440,81 @@ var ELGORA_HUB_FEE_POLICY_ABI = [
 ];
 
 // ../../packages/core/src/api/solver-submission-responses.ts
-import { isHex as isHex4 } from "viem";
-import { z as z7 } from "zod";
-var hexAddressSchema = z7.string().refine(isHexAddress, "Must be a hex-encoded address");
-var hexBytes32Schema = z7.string().refine(isHexBytes32, "Must be 32-byte hex");
-var hexDataSchema = z7.string().refine((value) => isHex4(value), "Must be hex-encoded calldata");
-var artifactUploadUrlResponseSchema = z7.object({
-  locator: z7.string().min(1),
-  upload_url: z7.string().min(1),
-  method: z7.literal("PUT"),
-  expires_at: z7.string().min(1)
+import { isHex as isHex3 } from "viem";
+import { z as z6 } from "zod";
+var hexAddressSchema = z6.string().refine(isHexAddress, "Must be a hex-encoded address");
+var hexBytes32Schema = z6.string().refine(isHexBytes32, "Must be 32-byte hex");
+var hexDataSchema = z6.string().refine((value) => isHex3(value), "Must be hex-encoded calldata");
+var artifactUploadUrlResponseSchema = z6.object({
+  locator: z6.string().min(1),
+  upload_url: z6.string().min(1),
+  method: z6.literal("PUT"),
+  expires_at: z6.string().min(1)
 });
-var solverSubmissionPrepareResponseSchema = z7.object({
-  content_record: z7.object({
-    content_kind: z7.literal(SOLVER_SUBMISSION_CONTENT_KIND),
+var solverSubmissionPrepareResponseSchema = z6.object({
+  content_record: z6.object({
+    content_kind: z6.literal(SOLVER_SUBMISSION_CONTENT_KIND),
     submission_commitment: hexBytes32Schema,
-    byte_length: z7.number().int().nonnegative(),
-    created_at: z7.string().min(1)
+    byte_length: z6.number().int().nonnegative(),
+    created_at: z6.string().min(1)
   }),
-  submit_transaction: z7.object({
-    chain_id: z7.number().int().positive(),
+  submit_transaction: z6.object({
+    chain_id: z6.number().int().positive(),
     to: hexAddressSchema,
-    value: z7.literal("0"),
+    value: z6.literal("0"),
     data: hexDataSchema,
-    function_name: z7.literal("submit"),
-    args: z7.object({
-      bounty_id: z7.string().min(1),
+    function_name: z6.literal("submit"),
+    args: z6.object({
+      bounty_id: z6.string().min(1),
       submission_commitment: hexBytes32Schema,
       guardian_roster_hash: hexBytes32Schema,
-      extra_data: z7.literal("0x")
+      extra_data: z6.literal("0x")
     })
   })
 });
-var solverSubmissionContentResponseSchema = z7.object({
-  content_record: z7.object({
-    bounty_id: z7.string().min(1),
-    canonical_json: z7.string().min(1)
+var solverSubmissionContentResponseSchema = z6.object({
+  content_record: z6.object({
+    bounty_id: z6.string().min(1),
+    canonical_json: z6.string().min(1)
   }),
-  ciphertext_download_url: z7.string().min(1),
-  expires_at: z7.string().min(1)
+  ciphertext_download_url: z6.string().min(1),
+  expires_at: z6.string().min(1)
 });
-var bountyGuardianRosterResponseSchema = z7.object({
-  bounty: z7.object({
+var bountyGuardianRosterResponseSchema = z6.object({
+  bounty: z6.object({
     guardian_roster_hash: hexBytes32Schema,
-    guardian_roster: z7.array(
-      z7.object({
-        name: z7.string(),
+    guardian_roster: z6.array(
+      z6.object({
+        name: z6.string(),
         account: hexAddressSchema,
-        encryption_public_key: z7.string().min(1)
+        encryption_public_key: z6.string().min(1)
       })
     ).min(1)
   })
 });
 
 // ../../packages/core/src/api/verification-records.ts
-import { z as z8 } from "zod";
-var hexAddressSchema2 = z8.string().refine(isHexAddress, "Must be a hex-encoded address").transform((value) => value.toLowerCase());
-var hexBytes32Schema2 = z8.string().refine(isHexBytes32, "Must be 32-byte hex").transform((value) => value.toLowerCase());
-var integerStringSchema = z8.string().regex(/^(0|[1-9][0-9]*)$/);
-var verdictEntrySchema = z8.object({
-  name: z8.string().min(1),
-  outcome: z8.enum(["awarded", "no_valid_submission"]).nullable(),
+import { z as z7 } from "zod";
+var hexAddressSchema2 = z7.string().refine(isHexAddress, "Must be a hex-encoded address").transform((value) => value.toLowerCase());
+var hexBytes32Schema2 = z7.string().refine(isHexBytes32, "Must be 32-byte hex").transform((value) => value.toLowerCase());
+var integerStringSchema = z7.string().regex(/^(0|[1-9][0-9]*)$/);
+var verdictEntrySchema = z7.object({
+  name: z7.string().min(1),
+  outcome: z7.enum(["awarded", "no_valid_submission"]).nullable(),
   winner: hexAddressSchema2.nullable(),
   report_commitment: hexBytes32Schema2.nullable(),
-  committed_at: z8.string().datetime({ offset: true }).nullable(),
-  supporting: z8.boolean()
+  committed_at: z7.string().datetime({ offset: true }).nullable(),
+  supporting: z7.boolean()
 }).strict();
-var formattedVerificationRecordSchema = z8.object({
-  chain_id: z8.number().int().positive(),
+var formattedVerificationRecordSchema = z7.object({
+  chain_id: z7.number().int().positive(),
   hub_address: hexAddressSchema2,
   bounty_id: integerStringSchema,
-  status: z8.enum(["awarded", "no_valid_submission", "timed_out"]),
+  status: z7.enum(["awarded", "no_valid_submission", "timed_out"]),
   spec_commitment: hexBytes32Schema2,
   winner: hexAddressSchema2.nullable(),
-  verdicts: z8.record(z8.string(), verdictEntrySchema),
-  settlement: z8.object({
+  verdicts: z7.record(z7.string(), verdictEntrySchema),
+  settlement: z7.object({
     escrow_amount: integerStringSchema,
     settlement_recipient: hexAddressSchema2,
     settlement_amount: integerStringSchema,
@@ -4615,10 +4525,10 @@ var formattedVerificationRecordSchema = z8.object({
     settled_tx_hash: hexBytes32Schema2,
     settled_block_number: integerStringSchema
   }).strict(),
-  content_record: z8.object({
-    spec_content_byte_length: z8.number().int().positive()
+  content_record: z7.object({
+    spec_content_byte_length: z7.number().int().positive()
   }).strict(),
-  verified_at: z8.string().datetime({ offset: true })
+  verified_at: z7.string().datetime({ offset: true })
 }).strict();
 function parseBountyVerificationRecord(input, expected) {
   const slice = input;
@@ -4640,79 +4550,79 @@ function parseBountyVerificationRecord(input, expected) {
 }
 
 // ../../packages/core/src/api/winning-solution-delivery.ts
-import { z as z9 } from "zod";
-var hexBytes32Schema3 = z9.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value !== ZERO_BYTES32, "Must not be zero").transform((value) => value.toLowerCase());
-var hexAddressSchema3 = z9.string().refine((value) => /^0x[0-9a-fA-F]{40}$/.test(value), "Must be an address").transform((value) => value.toLowerCase());
-var deliveryKeyIdSchema = z9.string().min(1).max(128);
-var winningSolutionWrappedKeySchema = z9.strictObject({
-  enc: z9.string().min(1),
-  ciphertext: z9.string().min(1)
+import { z as z8 } from "zod";
+var hexBytes32Schema3 = z8.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value !== ZERO_BYTES32, "Must not be zero").transform((value) => value.toLowerCase());
+var hexAddressSchema3 = z8.string().refine((value) => /^0x[0-9a-fA-F]{40}$/.test(value), "Must be an address").transform((value) => value.toLowerCase());
+var deliveryKeyIdSchema = z8.string().min(1).max(128);
+var winningSolutionWrappedKeySchema = z8.strictObject({
+  enc: z8.string().min(1),
+  ciphertext: z8.string().min(1)
 });
-var deliveryWrapRequestSchema = z9.strictObject({
+var deliveryWrapRequestSchema = z8.strictObject({
   solver_address: hexAddressSchema3,
   submission_commitment: hexBytes32Schema3,
   wrapped_key: winningSolutionWrappedKeySchema
 });
-var deliveryWrapRecordSchema = z9.strictObject({
-  bounty_id: z9.string().min(1),
+var deliveryWrapRecordSchema = z8.strictObject({
+  bounty_id: z8.string().min(1),
   guardian_address: hexAddressSchema3,
   solver_address: hexAddressSchema3,
   submission_commitment: hexBytes32Schema3,
   delivery_key_id: deliveryKeyIdSchema,
-  created_at: z9.string().min(1)
+  created_at: z8.string().min(1)
 });
-var deliveryWrapResponseSchema = z9.strictObject({
-  status: z9.literal("stored"),
+var deliveryWrapResponseSchema = z8.strictObject({
+  status: z8.literal("stored"),
   wrap: deliveryWrapRecordSchema
 });
-var deliveryRetrieveRequestSchema = z9.strictObject({
+var deliveryRetrieveRequestSchema = z8.strictObject({
   poster_ephemeral_public_key: x25519PublicKeySchema
 });
-var deliveryRetrieveResponseSchema = z9.strictObject({
+var deliveryRetrieveResponseSchema = z8.strictObject({
   submission_commitment: hexBytes32Schema3,
   wrapped_key: winningSolutionWrappedKeySchema
 });
-var deliveryStatusResponseSchema = z9.strictObject({
-  exists: z9.boolean()
+var deliveryStatusResponseSchema = z8.strictObject({
+  exists: z8.boolean()
 });
-var deliveryKeyConfigResponseSchema = z9.strictObject({
+var deliveryKeyConfigResponseSchema = z8.strictObject({
   delivery_key_id: deliveryKeyIdSchema,
-  public_key: z9.string().min(1)
+  public_key: z8.string().min(1)
 });
 
 // ../../packages/core/src/api/written-verdicts.ts
 import { keccak256 as keccak2564, toBytes as toBytes3, zeroAddress as zeroAddress2 } from "viem";
-import { z as z10 } from "zod";
+import { z as z9 } from "zod";
 var WRITTEN_VERDICT_FORMAT_VERSION = 0;
 var FRONTMATTER_DELIMITER2 = "---";
-var decimalSchema = z10.string().regex(/^[1-9][0-9]*$/, "Must be a positive integer").transform(Number).refine(Number.isSafeInteger, "Must be a safe integer");
-var bountyIdSchema2 = z10.string().regex(/^(0|[1-9][0-9]*)$/, "Must be a non-negative integer");
-var addressSchema2 = z10.string().refine(isHexAddress, "Must be a hex-encoded address").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
-var bytes32Schema4 = z10.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
+var decimalSchema = z9.string().regex(/^[1-9][0-9]*$/, "Must be a positive integer").transform(Number).refine(Number.isSafeInteger, "Must be a safe integer");
+var bountyIdSchema2 = z9.string().regex(/^(0|[1-9][0-9]*)$/, "Must be a non-negative integer");
+var addressSchema2 = z9.string().refine(isHexAddress, "Must be a hex-encoded address").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
+var bytes32Schema3 = z9.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
 var commonFields = {
-  format_version: z10.literal(WRITTEN_VERDICT_FORMAT_VERSION.toString()).transform(() => WRITTEN_VERDICT_FORMAT_VERSION),
+  format_version: z9.literal(WRITTEN_VERDICT_FORMAT_VERSION.toString()).transform(() => WRITTEN_VERDICT_FORMAT_VERSION),
   chain_id: decimalSchema,
   hub_address: addressSchema2,
   bounty_id: bountyIdSchema2,
-  verdict_body: z10.string().refine((value) => value.trim().length > 0, "Must not be empty")
+  verdict_body: z9.string().refine((value) => value.trim().length > 0, "Must not be empty")
 };
-var writtenVerdictSchema = z10.discriminatedUnion("outcome", [
-  z10.object({
+var writtenVerdictSchema = z9.discriminatedUnion("outcome", [
+  z9.object({
     ...commonFields,
-    outcome: z10.literal("awarded"),
+    outcome: z9.literal("awarded"),
     winner: addressSchema2.refine(
       (value) => value !== zeroAddress2,
       "Must not be the zero address"
     ),
-    awarded_submission_commitment: bytes32Schema4.refine(
+    awarded_submission_commitment: bytes32Schema3.refine(
       (value) => value !== ZERO_BYTES32,
       "Must not be zero bytes"
     )
   }).strict(),
-  z10.object({
+  z9.object({
     ...commonFields,
-    outcome: z10.literal("no_valid_submission"),
-    winner: z10.literal(zeroAddress2)
+    outcome: z9.literal("no_valid_submission"),
+    winner: z9.literal(zeroAddress2)
   }).strict()
 ]);
 function buildWrittenVerdictMarkdown(input) {
@@ -4809,23 +4719,6 @@ import {
   fallback,
   http
 } from "viem";
-
-// ../../packages/core/src/auth/freshness.ts
-var API_REQUEST_APPROVAL_ANCHOR_LAG_SECONDS = 6;
-var FALLBACK_BLOCK_TIME_MS = 2e3;
-function blockTimeMsFor(chainId) {
-  const chain = chainId === void 0 ? void 0 : SUPPORTED_CHAINS[chainId];
-  return chain?.blockTime ?? FALLBACK_BLOCK_TIME_MS;
-}
-function blocksForSeconds(seconds, chainId) {
-  const blocks = Math.ceil(seconds * 1e3 / blockTimeMsFor(chainId));
-  return BigInt(Math.max(1, blocks));
-}
-function apiRequestApprovalAnchorLagBlocks(chainId) {
-  return blocksForSeconds(API_REQUEST_APPROVAL_ANCHOR_LAG_SECONDS, chainId);
-}
-
-// ../../packages/core/src/chain-client.ts
 var RPC_RETRY_COUNT = 3;
 function createChainTransport(chainId, rpcUrl) {
   const publicRpcUrl = resolveSupportedChain(chainId).rpcUrls.default.http[0];
@@ -4859,13 +4752,6 @@ function assertChainId(actual, expected) {
     throw new Error(`RPC returned chain_id ${actual}, expected ${expected}`);
   }
 }
-async function fetchSignableBlock(client) {
-  const offset = apiRequestApprovalAnchorLagBlocks(client.chain?.id);
-  const head = await client.getBlockNumber();
-  const anchorNumber = head > offset ? head - offset : 0n;
-  const anchor = await client.getBlock({ blockNumber: anchorNumber });
-  return { number: anchor.number, hash: anchor.hash };
-}
 async function assertHubDeployment(client, chainId, hubAddress) {
   const [actualChainId, hubCode] = await Promise.all([
     client.getChainId(),
@@ -5215,10 +5101,10 @@ var ApiRequestError = class extends Error {
     this.retryAfterMs = input.retryAfterMs;
   }
 };
-async function postText(url, body, contentType, authorization, headers = {}) {
+async function postText(url, body, contentType, authorization) {
   const response = await fetch(url, {
     method: "POST",
-    headers: { ...headers, "content-type": contentType, authorization },
+    headers: { "content-type": contentType, authorization },
     body
   });
   return parseJsonResponse(url, response);
@@ -5378,7 +5264,7 @@ function toArrayBuffer(bytes) {
 import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 
 // ../../packages/core/src/auth/authorization-header.ts
-import { isAddress as isAddress3, isHex as isHex5 } from "viem";
+import { isAddress as isAddress3, isHex as isHex4 } from "viem";
 var ELGORA_APPROVAL_AUTH_SCHEME = "Elgora-Approval";
 var FIELD_SEPARATOR = "~";
 function encodeApiRequestApprovalHeader(fields) {
@@ -5391,45 +5277,92 @@ function encodeApiRequestApprovalHeader(fields) {
   return `${ELGORA_APPROVAL_AUTH_SCHEME} ${btoa(payload)}`;
 }
 
-// ../../packages/core/src/auth/readiness-signoff-header.ts
-var ELGORA_READINESS_SIGNOFF_HEADER = "Elgora-Readiness-Signoff";
-function encodeReadinessSignoffHeader(signoff) {
-  const bytes = new TextEncoder().encode(
-    JSON.stringify(readinessSignoffSchema.parse(signoff))
-  );
-  return btoa(String.fromCharCode(...bytes));
+// ../../packages/core/src/auth/eip712.ts
+var API_REQUEST_APPROVAL_PRIMARY_TYPE = "ApiRequestApproval";
+var API_REQUEST_APPROVAL_TYPES = {
+  ApiRequestApproval: [
+    { name: "endpointId", type: "string" },
+    { name: "audience", type: "string" },
+    { name: "bodyHash", type: "bytes32" },
+    { name: "query", type: "string" },
+    { name: "blockNumber", type: "uint256" },
+    { name: "blockHash", type: "bytes32" }
+  ]
+};
+function buildElgoraEip712Domain(params) {
+  return {
+    name: "Elgora",
+    version: "1",
+    chainId: params.chainId,
+    verifyingContract: params.hubAddress
+  };
+}
+function buildApiRequestApprovalTypedData(params) {
+  return {
+    domain: buildElgoraEip712Domain({
+      chainId: params.chainId,
+      hubAddress: params.hubAddress
+    }),
+    types: API_REQUEST_APPROVAL_TYPES,
+    primaryType: API_REQUEST_APPROVAL_PRIMARY_TYPE,
+    message: params.message
+  };
+}
+function endpointIdFor(input) {
+  return `${input.method.toUpperCase()} ${input.path}`;
+}
+function audienceFor(host) {
+  return host.toLowerCase();
+}
+function queryFor(query) {
+  return new URLSearchParams(query).toString();
 }
 
 // ../../packages/core/src/auth/request-approval.ts
 import {
   hashTypedData,
-  isAddressEqual as isAddressEqual3,
+  isAddressEqual as isAddressEqual2,
   keccak256 as keccak2565,
   toBytes as toBytes4
 } from "viem";
 
 // ../../packages/core/src/auth/signature.ts
 import {
-  isAddressEqual as isAddressEqual2,
-  recoverTypedDataAddress as recoverTypedDataAddress3
+  isAddressEqual,
+  recoverTypedDataAddress as recoverTypedDataAddress2
 } from "viem";
 
+// ../../packages/core/src/auth/request-approval.ts
+function typedDataForRequest(request, block) {
+  const bodyBytes = typeof request.body === "string" ? toBytes4(request.body) : request.body;
+  return buildApiRequestApprovalTypedData({
+    chainId: request.domain.chainId,
+    hubAddress: request.domain.hubAddress,
+    message: {
+      endpointId: request.endpointId,
+      audience: audienceFor(request.host),
+      bodyHash: keccak2565(bodyBytes),
+      query: queryFor(request.query),
+      blockNumber: block.number,
+      blockHash: block.hash
+    }
+  });
+}
+
 // ../../packages/core/src/auth/request-approval-header.ts
-import { keccak256 as keccak2566, toBytes as toBytes5 } from "viem";
+import { z as z10 } from "zod";
 async function buildAuthorizationHeader(params) {
   const url = new URL(params.requestUrl);
-  const typedData = buildApiRequestApprovalTypedData({
-    chainId: params.chainId,
-    hubAddress: params.hubAddress,
-    message: {
+  const typedData = typedDataForRequest(
+    {
       endpointId: endpointIdFor({ method: params.method, path: url.pathname }),
-      audience: audienceFor(url.host),
-      bodyHash: keccak2566(toBytes5(params.body ?? "")),
-      query: queryFor(url.search),
-      blockNumber: params.block.number,
-      blockHash: params.block.hash
-    }
-  });
+      host: url.host,
+      query: url.search,
+      body: params.body ?? "",
+      domain: { chainId: params.chainId, hubAddress: params.hubAddress }
+    },
+    params.block
+  );
   const signature = await params.sign(typedData);
   return encodeApiRequestApprovalHeader({
     address: params.address,
@@ -5438,6 +5371,31 @@ async function buildAuthorizationHeader(params) {
     blockHash: params.block.hash
   });
 }
+async function authorizeRequest(params) {
+  return buildAuthorizationHeader({
+    ...params,
+    block: await readChallengeBlock(params)
+  });
+}
+var challengeBlockSchema = z10.object({
+  error: z10.object({ block_number: z10.string(), block_hash: z10.string() })
+});
+async function readChallengeBlock(params) {
+  const response = await fetch(params.requestUrl, {
+    method: params.method,
+    headers: params.contentType ? { "content-type": params.contentType } : {},
+    body: params.method.toUpperCase() === "GET" ? null : params.body ?? ""
+  });
+  if (response.status !== 401) {
+    throw new Error(
+      `Expected an approval challenge (401) from ${params.requestUrl}, got ${response.status}.`
+    );
+  }
+  const { block_number, block_hash } = challengeBlockSchema.parse(
+    await response.json()
+  ).error;
+  return { number: BigInt(block_number), hash: block_hash };
+}
 
 // ../../packages/core/src/winning-solution-delivery.ts
 async function wrapWinningSolutionKey(input) {
@@ -5446,14 +5404,13 @@ async function wrapWinningSolutionKey(input) {
     apiBaseUrl: input.config.apiBaseUrl
   });
   const contentPathname = `/api/bounties/${input.bountyId}/submissions/${input.submissionCommitment}/content`;
-  const contentAuthorization = await buildAuthorizationHeader({
+  const contentAuthorization = await authorizeRequest({
     requestUrl: new URL(contentPathname, input.config.apiBaseUrl).toString(),
     method: "GET",
     body: "",
     chainId: input.config.chainId,
     hubAddress: input.config.hubAddress,
     address: input.owner.address,
-    block: await fetchSignableBlock(input.publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const { content_record, ciphertext_download_url } = solverSubmissionContentResponseSchema.parse(
@@ -5505,14 +5462,14 @@ async function wrapWinningSolutionKey(input) {
     submission_commitment: input.submissionCommitment,
     wrapped_key: opened.wrapped_key
   });
-  const authorization = await buildAuthorizationHeader({
+  const authorization = await authorizeRequest({
     requestUrl: requestUrl.toString(),
     method: "POST",
+    contentType: "application/json",
     body,
     chainId: input.config.chainId,
     hubAddress: input.config.hubAddress,
     address: input.owner.address,
-    block: await fetchSignableBlock(input.publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const responseBody = await postText(
@@ -5555,14 +5512,13 @@ async function main3(env = process.env, argv = process.argv.slice(2)) {
     bountyId: args.bountyId,
     submissionCommitment: args.submissionCommitment
   });
-  const authorization = await buildAuthorizationHeader({
+  const authorization = await authorizeRequest({
     requestUrl: new URL(pathname, config.apiBaseUrl).toString(),
     method: "GET",
     body: "",
     chainId: config.chainId,
     hubAddress: config.hubAddress,
     address: account.address,
-    block: await fetchSignableBlock(publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const { content_record, ciphertext_download_url } = await requestSubmissionContent({
@@ -5744,7 +5700,6 @@ async function main4(env = process.env, argv = process.argv.slice(2)) {
       privateKey: guardianAccountPrivateKey,
       address: account.address
     },
-    publicClient,
     guardianPrivateKeys
   });
   console.log(
@@ -6905,14 +6860,13 @@ async function main7(env = process.env, argv = process.argv.slice(2)) {
   }
   if (args.outcome === "awarded") {
     const contentPathname = `/api/bounties/${args.bountyId.toString()}/submissions/${args.awardedSubmissionCommitment}/content`;
-    const contentAuthorization = await buildAuthorizationHeader({
+    const contentAuthorization = await authorizeRequest({
       requestUrl: new URL(contentPathname, config.apiBaseUrl).toString(),
       method: "GET",
       body: "",
       chainId: config.chainId,
       hubAddress: config.hubAddress,
       address: account.address,
-      block: await fetchSignableBlock(publicClient),
       sign: (typedData) => account.signTypedData(typedData)
     });
     await assertCheckedSubmission({
@@ -6959,14 +6913,14 @@ async function main7(env = process.env, argv = process.argv.slice(2)) {
   }
   const pathname = `/api/written-verdicts/${reportCommitment}`;
   const requestUrl = new URL(pathname, config.apiBaseUrl);
-  const authorization = await buildAuthorizationHeader({
+  const authorization = await authorizeRequest({
     requestUrl: requestUrl.toString(),
     method: "POST",
+    contentType: MARKDOWN_CONTENT_TYPE,
     body: markdown,
     chainId: config.chainId,
     hubAddress: config.hubAddress,
     address: account.address,
-    block: await fetchSignableBlock(publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   await postText(requestUrl, markdown, MARKDOWN_CONTENT_TYPE, authorization);
@@ -7121,14 +7075,14 @@ var NETWORKS = [
   {
     name: "base-sepolia",
     chainId: baseSepolia3.id,
-    label: "Base Sepolia testnet, Elgora's staging deployment"
+    label: "Base Sepolia, test USDC"
   },
   { name: "local", chainId: foundry3.id, label: "a local Anvil stack" }
 ];
 var NETWORK_CHAIN_IDS = Object.fromEntries(
   NETWORKS.map(({ name, chainId }) => [name, chainId])
 );
-var STAGING_NETWORK = NETWORKS.find(
+var TESTNET_NETWORK = NETWORKS.find(
   ({ chainId }) => chainId === baseSepolia3.id
 );
 var NETWORK_NAMES_HINT = NETWORKS.map(
@@ -7138,15 +7092,15 @@ function describeChain(chainId) {
   const network = NETWORKS.find((candidate) => candidate.chainId === chainId);
   return network ? `${network.name} (${network.label})` : `chain ${chainId}`;
 }
-var STAGING_HINT = `add ${NETWORK_FLAG} ${STAGING_NETWORK.name} or set ELGORA_CHAIN_ID=${STAGING_NETWORK.chainId}`;
+var TESTNET_HINT = `add ${NETWORK_FLAG} ${TESTNET_NETWORK.name} or set ELGORA_CHAIN_ID=${TESTNET_NETWORK.chainId}`;
 var DEFAULT_NETWORK_HELP_LINES = [
   `Default: ${describeChain(DEFAULT_CHAIN_ID)}.`,
-  `Staging: ${describeChain(STAGING_NETWORK.chainId)};`,
-  `  ${STAGING_HINT}.`
+  `Testnet: ${describeChain(TESTNET_NETWORK.chainId)};`,
+  `  ${TESTNET_HINT}.`
 ];
 function defaultNetworkNotice(env) {
   if (env.ELGORA_CHAIN_ID?.trim()) return void 0;
-  return `elgora-cli: using the default network, ${describeChain(DEFAULT_CHAIN_ID)}. For staging, ${STAGING_HINT}.`;
+  return `elgora-cli: using the default network, ${describeChain(DEFAULT_CHAIN_ID)}. For testnet, ${TESTNET_HINT}.`;
 }
 function applyNetworkFlag(env, argv) {
   const present = argv.some(
@@ -7173,7 +7127,7 @@ function resolveChainId(selector) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "9.1.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "10.1.0" : "0.0.0-dev";
 var CLI_NODE_ENGINES = true ? ">=24 <25" : ">=24 <25";
 
 // src/node-engines.ts
@@ -7240,24 +7194,51 @@ function compareVersions(left, right) {
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import path2 from "path";
 import { privateKeyToAccount as privateKeyToAccount7 } from "viem/accounts";
-var DEFAULT_OUTPUT_ROOT2 = "./winning-submission";
-async function main8(env = process.env, argv = process.argv.slice(2)) {
-  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
-  const args = readPosterOpenWinningSubmissionArgs(remainingArgv);
-  const envWithDefaults = withDeploymentDefaults(env);
-  const config = loadClientDeploymentConfig(
-    envWithDefaults,
-    apiBaseUrlOverride
-  );
-  const rpcUrl = required3(envWithDefaults, "ELGORA_RPC_URL");
-  const posterPrivateKey = envWithDefaults.ELGORA_POSTER_PRIVATE_KEY?.trim();
-  if (!posterPrivateKey || !isHexBytes32(posterPrivateKey)) {
+
+// src/poster-request.ts
+import { readFile as readFile4 } from "fs/promises";
+import { text as readStdinText3 } from "stream/consumers";
+function loadPosterConfig(env, apiBaseUrlOverride) {
+  const defaults = withDeploymentDefaults(env);
+  const clientConfig = loadClientDeploymentConfig(defaults, apiBaseUrlOverride);
+  const rpcUrl = defaults.ELGORA_RPC_URL?.trim();
+  if (!rpcUrl) throw new Error("ELGORA_RPC_URL is required");
+  const privateKey = env.ELGORA_POSTER_PRIVATE_KEY?.trim();
+  if (!privateKey || !isHexBytes32(privateKey)) {
     throw new Error(
       "ELGORA_POSTER_PRIVATE_KEY must be a 32-byte hex private key"
     );
   }
-  const account = privateKeyToAccount7(posterPrivateKey.toLowerCase());
-  const publicClient = createChainPublicClient(config.chainId, rpcUrl);
+  return {
+    ...clientConfig,
+    rpcUrl,
+    posterPrivateKey: privateKey
+  };
+}
+async function readBountyChallengeMarkdown2(path5) {
+  return path5 === "-" ? readStdinText3(process.stdin) : readFile4(path5, "utf8");
+}
+async function signPosterRequest(input) {
+  return authorizeRequest({
+    requestUrl: input.requestUrl.toString(),
+    method: "POST",
+    contentType: "text/markdown",
+    body: input.markdown,
+    chainId: input.config.chainId,
+    hubAddress: input.config.hubAddress,
+    address: input.account.address,
+    sign: (typedData) => input.account.signTypedData(typedData)
+  });
+}
+
+// src/poster-open-winning-submission.ts
+var DEFAULT_OUTPUT_ROOT2 = "./winning-submission";
+async function main8(env = process.env, argv = process.argv.slice(2)) {
+  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
+  const args = readPosterOpenWinningSubmissionArgs(remainingArgv);
+  const config = loadPosterConfig(env, apiBaseUrlOverride);
+  const account = privateKeyToAccount7(config.posterPrivateKey);
+  const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
   await assertHubDeployment(publicClient, config.chainId, config.hubAddress);
   const ephemeral = await generateX25519KeyPair();
   const retrieveUrl = new URL(
@@ -7267,14 +7248,14 @@ async function main8(env = process.env, argv = process.argv.slice(2)) {
   const retrieveBody = JSON.stringify({
     poster_ephemeral_public_key: ephemeral.public_key
   });
-  const retrieveAuthorization = await buildAuthorizationHeader({
+  const retrieveAuthorization = await authorizeRequest({
     requestUrl: retrieveUrl.toString(),
     method: "POST",
+    contentType: "application/json",
     body: retrieveBody,
     chainId: config.chainId,
     hubAddress: config.hubAddress,
     address: account.address,
-    block: await fetchSignableBlock(publicClient),
     sign: (typedData) => account.signTypedData(typedData)
   });
   const retrieved = deliveryRetrieveResponseSchema.parse(
@@ -7297,14 +7278,13 @@ async function main8(env = process.env, argv = process.argv.slice(2)) {
   });
   try {
     const contentPathname = `/api/bounties/${args.bountyId}/submissions/${retrieved.submission_commitment}/content`;
-    const contentAuthorization = await buildAuthorizationHeader({
+    const contentAuthorization = await authorizeRequest({
       requestUrl: new URL(contentPathname, config.apiBaseUrl).toString(),
       method: "GET",
       body: "",
       chainId: config.chainId,
       hubAddress: config.hubAddress,
       address: account.address,
-      block: await fetchSignableBlock(publicClient),
       sign: (typedData) => account.signTypedData(typedData)
     });
     const { content_record, ciphertext_download_url } = solverSubmissionContentResponseSchema.parse(
@@ -7373,80 +7353,18 @@ function readPosterOpenWinningSubmissionArgs(argv) {
     ...outputDir ? { outputDir } : {}
   };
 }
-function required3(env, name) {
-  const value = env[name]?.trim();
-  if (!value) throw new Error(`${name} is required`);
-  return value;
-}
 
 // src/publish-fund.ts
-import { readFile as readFile5 } from "fs/promises";
 import {
   decodeFunctionData,
-  parseAbi as parseAbi2,
+  erc20Abi,
   parseEventLogs
 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount8 } from "viem/accounts";
-
-// src/poster-request.ts
-import { readFile as readFile4 } from "fs/promises";
-import { text as readStdinText3 } from "stream/consumers";
-function loadPosterConfig(env, apiBaseUrlOverride) {
-  const defaults = withDeploymentDefaults(env);
-  const clientConfig = loadClientDeploymentConfig(defaults, apiBaseUrlOverride);
-  const rpcUrl = defaults.ELGORA_RPC_URL?.trim();
-  if (!rpcUrl) throw new Error("ELGORA_RPC_URL is required");
-  const privateKey = env.ELGORA_POSTER_PRIVATE_KEY?.trim();
-  if (!privateKey || !isHexBytes32(privateKey)) {
-    throw new Error(
-      "ELGORA_POSTER_PRIVATE_KEY must be a 32-byte hex private key"
-    );
-  }
-  return {
-    ...clientConfig,
-    rpcUrl,
-    posterPrivateKey: privateKey
-  };
-}
-function takeFlag(argv, flag, usage) {
-  const uses = argv.filter(
-    (arg) => arg === flag || arg.startsWith(`${flag}=`)
-  ).length;
-  const extracted = extractFlagValue(argv, flag);
-  if (uses > 1 || uses === 1 && (!extracted.value || extracted.value.startsWith("--")))
-    throw new Error(usage);
-  return extracted;
-}
-async function readBountyChallengeMarkdown2(path5) {
-  return path5 === "-" ? readStdinText3(process.stdin) : readFile4(path5, "utf8");
-}
-async function signPosterRequest(input) {
-  return buildAuthorizationHeader({
-    requestUrl: input.requestUrl.toString(),
-    method: "POST",
-    body: input.markdown,
-    chainId: input.config.chainId,
-    hubAddress: input.config.hubAddress,
-    address: input.account.address,
-    block: await fetchSignableBlock(input.publicClient),
-    sign: (typedData) => input.account.signTypedData(typedData)
-  });
-}
-
-// src/publish-fund.ts
-var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path|-> --signoff <file>";
-var usdcAbi = parseAbi2([
-  "function approve(address spender,uint256 value) returns (bool)",
-  "function balanceOf(address account) view returns (uint256)"
-]);
+var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path|->";
 async function main9(env = process.env, argv = process.argv.slice(2)) {
-  const { apiBaseUrl: apiBaseUrlOverride, argv: afterApiBaseUrl } = extractApiBaseUrlFlag(argv);
-  const { value: signoffPath, argv: remainingArgv } = takeFlag(
-    afterApiBaseUrl,
-    "--signoff",
-    PUBLISH_FUND_USAGE
-  );
-  if (!signoffPath || remainingArgv.length !== 1 || !remainingArgv[0])
+  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
+  if (remainingArgv.length !== 1 || !remainingArgv[0])
     throw new Error(PUBLISH_FUND_USAGE);
   const config = loadPosterConfig(env, apiBaseUrlOverride);
   const escrowTokenAddress = withDeploymentDefaults(env).ELGORA_ESCROW_TOKEN_ADDRESS?.trim();
@@ -7462,17 +7380,6 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   const localSpecCommitment = deriveBountyChallengeContentCommitment(
     bountyChallengeMarkdown
   );
-  const signoff = readinessSignoffSchema.parse(
-    JSON.parse(await readFile5(signoffPath, "utf8"))
-  );
-  if (signoff.spec_commitment.toLowerCase() !== localSpecCommitment) {
-    throw new Error(
-      "Readiness sign-off does not match the exact bounty_challenge.md bytes. Run poster:review again."
-    );
-  }
-  if (signoff.expires_at <= Math.floor(Date.now() / 1e3)) {
-    throw new Error("Readiness sign-off has expired. Run poster:review again.");
-  }
   const account = privateKeyToAccount8(config.posterPrivateKey);
   const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
   const walletClient = createChainWalletClient(
@@ -7490,14 +7397,12 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
     requestUrl,
     markdown: bountyChallengeMarkdown,
     config,
-    account,
-    publicClient
+    account
   });
   const prepared = await requestPreparePublication({
     requestUrl: requestUrl.toString(),
     markdown: bountyChallengeMarkdown,
-    authorization,
-    signoff: encodeReadinessSignoffHeader(signoff)
+    authorization
   });
   if (prepared.content_record.spec_commitment !== localSpecCommitment) {
     throw new Error(
@@ -7527,7 +7432,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
     publicClient.getBalance({ address: account.address }),
     publicClient.readContract({
       address: tokenAddress,
-      abi: usdcAbi,
+      abi: erc20Abi,
       functionName: "balanceOf",
       args: [account.address]
     })
@@ -7564,7 +7469,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   } else {
     const approveHash = await walletClient.writeContract({
       address: tokenAddress,
-      abi: usdcAbi,
+      abi: erc20Abi,
       functionName: "approve",
       args: [config.hubAddress, escrowAmount]
     });
@@ -7637,40 +7542,39 @@ async function requestPreparePublication(input) {
     new URL(input.requestUrl),
     input.markdown,
     "text/markdown",
-    input.authorization,
-    { [ELGORA_READINESS_SIGNOFF_HEADER]: input.signoff }
+    input.authorization
   );
   return bountyPublicationResponseSchema.parse(body);
 }
 
 // src/required-env.ts
-function missingRequiredEnv(required4, env) {
-  return required4.filter((envName) => !env[envName]?.trim());
+function missingRequiredEnv(required3, env) {
+  return required3.filter((envName) => !env[envName]?.trim());
 }
 
 // src/review.ts
-import { writeFile as writeFile3 } from "fs/promises";
-import { resolve } from "path";
 import { privateKeyToAccount as privateKeyToAccount9 } from "viem/accounts";
-var USAGE2 = "Usage: elgora-cli poster:review <path|-> [--previous <commitment>] [--signoff-out <file>]";
+var USAGE2 = "Usage: elgora-cli poster:review <path|-> [--previous <commitment>]";
+function takeFlag(argv, flag, usage) {
+  const uses = argv.filter(
+    (arg) => arg === flag || arg.startsWith(`${flag}=`)
+  ).length;
+  const extracted = extractFlagValue(argv, flag);
+  if (uses > 1 || uses === 1 && (!extracted.value || extracted.value.startsWith("--")))
+    throw new Error(usage);
+  return extracted;
+}
 async function main10(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl, argv: args } = extractApiBaseUrlFlag(argv);
-  const { value: previous, argv: afterPrevious } = takeFlag(
+  const { value: previous, argv: paths } = takeFlag(
     args,
     "--previous",
     "--previous must be one bytes32 page commitment"
   );
   if (previous && !isHexBytes32(previous))
     throw new Error("--previous must be one bytes32 page commitment");
-  const { value: signoffOut, argv: paths } = takeFlag(
-    afterPrevious,
-    "--signoff-out",
-    USAGE2
-  );
   if (paths.length !== 1 || !paths[0] || paths[0].startsWith("--"))
     throw new Error(USAGE2);
-  if (signoffOut && paths[0] !== "-" && resolve(signoffOut) === resolve(paths[0]))
-    throw new Error("--signoff-out must not overwrite the bounty draft");
   const config = loadPosterConfig(env, apiBaseUrl);
   const markdown = await readBountyChallengeMarkdown2(paths[0]);
   const commitment = deriveBountyChallengeContentCommitment(markdown);
@@ -7691,8 +7595,7 @@ async function main10(env = process.env, argv = process.argv.slice(2)) {
     requestUrl,
     markdown,
     config,
-    account,
-    publicClient
+    account
   });
   let response;
   try {
@@ -7719,18 +7622,12 @@ async function main10(env = process.env, argv = process.argv.slice(2)) {
       "Elgora API returned a review for different bounty_challenge.md bytes"
     );
   }
-  if (signoffOut)
-    await writeFile3(
-      signoffOut,
-      `${JSON.stringify(response.readiness.signoff, null, 2)}
-`
-    );
   console.log(
     JSON.stringify({
       event: "review.ready",
       spec_commitment: commitment,
-      signoff: response.readiness.signoff,
-      warnings: response.readiness.warnings ?? [],
+      approved_until: response.readiness.approved_until,
+      warnings: response.readiness.warnings,
       prior_issues_resolved: response.readiness.prior_issues_resolved,
       prior_issues_open: response.readiness.prior_issues_open
     })
@@ -7960,8 +7857,8 @@ function usageError3() {
 }
 
 // src/roster-verify-guardian-proof.ts
-import { readFile as readFile6 } from "fs/promises";
-import { isAddress as isAddress6, isHex as isHex6, recoverMessageAddress } from "viem";
+import { readFile as readFile5 } from "fs/promises";
+import { isAddress as isAddress6, isHex as isHex5, recoverMessageAddress } from "viem";
 async function main13(_env = process.env, argv = process.argv.slice(2)) {
   const [preparedPath, responsePath] = argv;
   if (!preparedPath || !responsePath) {
@@ -7969,8 +7866,8 @@ async function main13(_env = process.env, argv = process.argv.slice(2)) {
       "Usage: elgora-cli roster:verify-guardian-proof <prepared_json_path> <response_json_path>"
     );
   }
-  const prepared = parsePrepared(await readFile6(preparedPath, "utf8"));
-  const response = parseResponse(await readFile6(responsePath, "utf8"));
+  const prepared = parsePrepared(await readFile5(preparedPath, "utf8"));
+  const response = parseResponse(await readFile5(responsePath, "utf8"));
   const fixture = base64UrlToBytes(prepared.fixture);
   const signedPayload = buildGuardianRosterKeyProofSignedPayload(
     prepared.message,
@@ -8034,7 +7931,7 @@ function parseResponse(text) {
   }
   const guardianAccount = get(parsed, "guardian_account");
   const signature = get(parsed, "signature");
-  if (typeof guardianAccount !== "string" || !isAddress6(guardianAccount) || typeof signature !== "string" || !isHex6(signature) || signature.length !== 132) {
+  if (typeof guardianAccount !== "string" || !isAddress6(guardianAccount) || typeof signature !== "string" || !isHex5(signature) || signature.length !== 132) {
     throw new Error(
       "Guardian response JSON must be the unmodified stdout of guardian:prove-roster-key"
     );
@@ -8052,7 +7949,7 @@ function get(value, key) {
 }
 
 // src/spec-commitment.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { text as readStdinText4 } from "stream/consumers";
 var SPEC_COMMITMENT_USAGE = "Usage: elgora-cli spec-commitment <bounty_challenge_md_path>\n   or: elgora-cli spec-commitment -";
 async function main14(_env = process.env, argv = process.argv.slice(2)) {
@@ -8074,23 +7971,23 @@ async function readBountyChallengeMarkdown3(argv) {
   if (path5 === "-") {
     return readStdinText4(process.stdin);
   }
-  return readFile7(path5, "utf8");
+  return readFile6(path5, "utf8");
 }
 
 // src/submit.ts
-import { readdir, readFile as readFile8, stat } from "fs/promises";
+import { readdir, readFile as readFile7, stat } from "fs/promises";
 import path3 from "path";
 import { createInterface } from "readline";
-import { isAddress as isAddress7 } from "viem";
+import { getTypesForEIP712Domain, isAddress as isAddress7, stringify } from "viem";
 import { privateKeyToAccount as privateKeyToAccount11 } from "viem/accounts";
 
 // src/external-api-approval-signer.ts
-import { isHex as isHex7 } from "viem";
+import { isHex as isHex6 } from "viem";
 function createExternalApiApprovalSigner(input) {
   return async (typedData) => {
     input.writePrompt(input.renderPrompt(typedData));
     const signature = (await input.readSignature())?.trim();
-    if (!signature || signature === "0x" || !isHex7(signature)) {
+    if (!signature || signature === "0x" || !isHex6(signature)) {
       throw new Error(
         "External signer must return one non-empty 0x-prefixed hex signature line on stdin"
       );
@@ -8161,19 +8058,16 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
       return next.done ? void 0 : next.value;
     }
   });
-  const authorizeRequest = async (requestUrl, body) => {
-    const block = await fetchSignableBlock(publicClient);
-    return buildAuthorizationHeader({
-      requestUrl: requestUrl.toString(),
-      method: "POST",
-      body,
-      chainId: config.chainId,
-      hubAddress: config.hubAddress,
-      address: solver,
-      block,
-      sign: signApproval
-    });
-  };
+  const authorizeSubmitRequest = (requestUrl, body) => authorizeRequest({
+    requestUrl: requestUrl.toString(),
+    method: "POST",
+    body,
+    contentType: "application/json",
+    chainId: config.chainId,
+    hubAddress: config.hubAddress,
+    address: solver,
+    sign: signApproval
+  });
   const rosterResponse = await requestBountyGuardianRoster({
     apiBaseUrl: config.apiBaseUrl,
     bountyId: bountyIdText
@@ -8220,7 +8114,7 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
         solver,
         ciphertextSha256: envelope.ciphertext_sha256,
         ciphertextByteLength: ciphertext.byteLength,
-        authorizeRequest
+        authorizeRequest: authorizeSubmitRequest
       });
       if (uploadUrl.locator !== envelope.ciphertext_locator) {
         throw new Error(
@@ -8241,7 +8135,7 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
         bountyId: bountyIdText,
         solver,
         envelope,
-        authorizeRequest
+        authorizeRequest: authorizeSubmitRequest
       });
     } finally {
       externalApprovalInput?.close();
@@ -8340,14 +8234,19 @@ async function main15(env = process.env, argv = process.argv.slice(2)) {
 }
 function createExternalApprovalSigner(input) {
   return createExternalApiApprovalSigner({
-    renderPrompt: (typedData) => JSON.stringify(
-      {
-        event: "submit.approval_required",
-        solver: input.solver.toLowerCase(),
-        typed_data: typedData
-      },
-      (_key, value) => typeof value === "bigint" ? value.toString() : value
-    ),
+    // The eth_signTypedData_v4 shape: its types carry EIP712Domain, which
+    // MetaMask-style signers need to hash the domain. The signed hash is the same.
+    renderPrompt: (typedData) => stringify({
+      event: "submit.approval_required",
+      solver: input.solver.toLowerCase(),
+      typed_data: {
+        ...typedData,
+        types: {
+          EIP712Domain: getTypesForEIP712Domain({ domain: typedData.domain }),
+          ...typedData.types
+        }
+      }
+    }),
     writePrompt: input.writePrompt,
     readSignature: input.readSignature
   });
@@ -8485,7 +8384,7 @@ function extractSolverAddressFlag(argv) {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === SOLVER_ADDRESS_FLAG) {
-      solverAddress = argv[i + 1];
+      solverAddress = argv[i + 1] ?? "";
       i++;
       continue;
     }
@@ -8530,7 +8429,7 @@ async function readArtifactDirectory(artifactDir) {
   }
   return Promise.all(
     entries.map(async (entry) => {
-      const bytes = await readFile8(path3.join(artifactDir, entry.name));
+      const bytes = await readFile7(path3.join(artifactDir, entry.name));
       return {
         name: entry.name,
         media_type: guessMediaType(entry.name),
@@ -8599,7 +8498,7 @@ async function requestPrepareSubmission(input) {
           })
         );
       }
-      await new Promise((resolve2) => setTimeout(resolve2, retryDelay));
+      await new Promise((resolve) => setTimeout(resolve, retryDelay));
     }
   }
 }
@@ -8807,9 +8706,9 @@ var COMMAND_HELP = {
     apiBaseUrlFlag: true
   },
   "poster:review": {
-    usage: "elgora-cli poster:review <path|-> [--previous <commitment>] [--signoff-out <file>]",
-    title: "Review a bounty page and save its readiness certificate.",
-    description: "Send the exact Markdown for a signed readiness review. Ready prints\n  review.ready; --signoff-out saves the certificate for publication.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous page commitment with the signed request.",
+    usage: "elgora-cli poster:review <path|-> [--previous <commitment>]",
+    title: "Review a bounty page before publishing it.",
+    description: "Sign and send the exact Markdown for a readiness review. Ready prints\n  review.ready; Elgora keeps the approval for these exact bytes.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous page commitment with the signed request.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",
@@ -8820,9 +8719,9 @@ var COMMAND_HELP = {
     apiBaseUrlFlag: true
   },
   "poster:publish-fund": {
-    usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|-> --signoff <file>",
+    usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|->",
     title: "Publish an approved challenge and fund its bounty.",
-    description: "Read the exact approved bounty_challenge.md bytes and its saved certificate.\n  Publishing checks the certificate and never runs another AI review.\n  Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
+    description: "Read the exact approved bounty_challenge.md bytes. Publishing reuses\n  their saved approval without another AI review, or reviews them first.\n  Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",