@manifest-network/manifest-agent-core 0.10.0 → 0.11.0

package/dist/internals/evaluate-readiness-from-fred.js

@@ -0,0 +1,94 @@
+import { evaluateReadiness } from "./evaluate-readiness.js";
+//#region src/internals/evaluate-readiness-from-fred.ts
+/**
+* Translate fred's snake_case `CheckDeploymentReadinessResult` into
+* the canonical `EvaluateReadinessInputs` (camelCase + context) and
+* invoke `evaluateReadiness`. Returns the typed `Readiness` verdict
+* the orchestrator gates on (`status === 'block'` → INVALID_CONFIG).
+*
+* @param raw            fred's wire response (snake_case, readonly).
+* @param gasPrice       Gas-price string from `clientManager.getConfig().gasPrice`
+*                       (e.g. `'1umfx'`). Required by the evaluator's
+*                       wallet-gas check; defaulted upstream when absent.
+* @param denomMap       Pre-loaded `DenomMap` for humanization. Pass
+*                       `EMPTY_DENOM_MAP` when no chain-data file is
+*                       configured.
+* @param tenantAddress  Canonical tenant address from the orchestrator's
+*                       address-source consistency guard. PREFERRED over
+*                       `raw.tenant` so a fred response whose `tenant`
+*                       differs (configuration drift / replayed mock)
+*                       does NOT silently route the verdict against a
+*                       different wallet.
+*/
+function evaluateReadinessFromFredResponse(raw, gasPrice, denomMap, tenantAddress) {
+	const skuNames = new Set(raw.available_sku_names);
+	if (raw.sku !== null) skuNames.add(raw.sku.name);
+	return evaluateReadiness({
+		tenant: tenantAddress,
+		image: raw.image,
+		size: raw.size,
+		walletBalances: toCoinArray(raw.wallet_balances),
+		credits: translateCredits(raw),
+		sku: translateSku(raw.sku),
+		availableSkuNames: [...skuNames],
+		gasPrice,
+		denomMap
+	});
+}
+/**
+* Translate fred's `credits` object + top-level `current_balance` /
+* `hours_remaining` into the evaluator's nested `credits` input shape.
+*
+* Null preservation: when fred returns `credits: null`, the translator
+* returns null even if `current_balance` / `hours_remaining` are
+* present at the top level — synthesizing a credits object from the
+* stray fields would suppress the "no credit account funded" warn
+* rule the evaluator owns.
+*/
+function translateCredits(raw) {
+	if (raw.credits === null) return null;
+	const out = {};
+	if (Array.isArray(raw.credits.available_balances)) out.availableBalances = toCoinArray(raw.credits.available_balances);
+	if (Array.isArray(raw.credits.balances)) out.balances = toCoinArray(raw.credits.balances);
+	if (raw.current_balance !== void 0) out.currentBalance = toCoinArray(raw.current_balance);
+	if (raw.hours_remaining !== void 0) out.hoursRemaining = raw.hours_remaining;
+	return out;
+}
+/**
+* Translate fred's `SkuSummary | null` into the evaluator's
+* `{ name: string; price: Coin } | null`.
+*
+* Drops fred-only fields (`uuid`, `provider_uuid`, `active`). Coerces
+* a price-less SKU to `null` — the evaluator's `sku.price` is required
+* (`Coin`), so an SKU without price is structurally invalid input.
+* Without this coercion the evaluator would treat the SKU as truthy
+* and crash accessing `price.amount`.
+*/
+function translateSku(sku) {
+	if (sku === null) return null;
+	if (sku.price === void 0) return null;
+	return {
+		name: sku.name,
+		price: {
+			denom: sku.price.denom,
+			amount: sku.price.amount
+		}
+	};
+}
+/**
+* Spread a readonly Coin-shaped array into a mutable Coin[]. The
+* evaluator's `EvaluateReadinessInputs.walletBalances` / credit-balance
+* arrays are mutable; fred's wire shapes are `ReadonlyArray<...>`. A
+* shallow copy is sufficient — each element is a frozen-ish `{denom,
+* amount}` value tuple, never mutated by the evaluator.
+*/
+function toCoinArray(arr) {
+	return arr.map((c) => ({
+		denom: c.denom,
+		amount: c.amount
+	}));
+}
+//#endregion
+export { evaluateReadinessFromFredResponse };
+
+//# sourceMappingURL=evaluate-readiness-from-fred.js.map

package/dist/internals/evaluate-readiness-from-fred.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-readiness-from-fred.js","names":[],"sources":["../../src/internals/evaluate-readiness-from-fred.ts"],"sourcesContent":["/**\n * Translator: fred's `CheckDeploymentReadinessResult` (snake_case wire\n * shape) → canonical `evaluateReadiness`'s `EvaluateReadinessInputs`\n * (camelCase + deploy-app context). ENG-185 sub-PR B, item 1.\n *\n * Replaces the always-`'ok'` stub `evaluateReadinessFromRaw` previously\n * inlined in `deploy-app.ts`. With this translator wired in, the\n * `status === 'block'` short-circuit at BOTH call sites\n * (`deploy-app.ts` L207 initial-spec + L327 post-edit recall) fires\n * correctly, killing the silent \"always proceed\" path the stub kept open.\n *\n * Three concerns the translator owns:\n *\n *   1. **Field renames** — snake_case → camelCase across all 9 fred\n *      top-level fields the evaluator consumes (`wallet_balances` →\n *      `walletBalances`, `available_sku_names` → `availableSkuNames`,\n *      `credits.available_balances` → `credits.availableBalances`, etc.).\n *\n *   2. **Folding top-level → nested** — fred's `getBalance` emits\n *      `current_balance` and `hours_remaining` ALONGSIDE `credits`\n *      (top-level on the response); the evaluator's input nests them\n *      INSIDE `credits` as `currentBalance` / `hoursRemaining`. The\n *      translator moves them across the boundary.\n *\n *      Guard: when fred returns `credits: null`, the translator\n *      preserves null — synthesizing a credits object from the stray\n *      top-level fields would bypass the evaluator's\n *      `credits === null` warn rule (\"No credit account funded for\n *      compute leases\").\n *\n *   3. **Context injection** — `gasPrice`, `denomMap`, and `tenant`\n *      come from the orchestrator's scope (not from fred). For\n *      `tenant`, the translator deliberately IGNORES `raw.tenant` and\n *      uses the `tenantAddress` arg: the orchestrator already resolved\n *      and validated the canonical wallet/client address via the\n *      address-source consistency guard (deploy-app.ts L154-161).\n *\n * Also: drops fred sku fields `uuid` / `provider_uuid` / `active` (the\n * evaluator only needs `name` + `price`), and coerces a price-less\n * SKU to `null` — `EvaluateReadinessInputs.sku` requires `price: Coin`,\n * so an SKU without price is structurally not a valid input.\n */\n\nimport type { CheckDeploymentReadinessResult } from '@manifest-network/manifest-mcp-fred';\nimport type { Coin, Readiness } from '../types.js';\nimport {\n  type EvaluateReadinessInputs,\n  evaluateReadiness,\n} from './evaluate-readiness.js';\nimport type { DenomMap } from './humanize-denom.js';\n\n/**\n * Translate fred's snake_case `CheckDeploymentReadinessResult` into\n * the canonical `EvaluateReadinessInputs` (camelCase + context) and\n * invoke `evaluateReadiness`. Returns the typed `Readiness` verdict\n * the orchestrator gates on (`status === 'block'` → INVALID_CONFIG).\n *\n * @param raw            fred's wire response (snake_case, readonly).\n * @param gasPrice       Gas-price string from `clientManager.getConfig().gasPrice`\n *                       (e.g. `'1umfx'`). Required by the evaluator's\n *                       wallet-gas check; defaulted upstream when absent.\n * @param denomMap       Pre-loaded `DenomMap` for humanization. Pass\n *                       `EMPTY_DENOM_MAP` when no chain-data file is\n *                       configured.\n * @param tenantAddress  Canonical tenant address from the orchestrator's\n *                       address-source consistency guard. PREFERRED over\n *                       `raw.tenant` so a fred response whose `tenant`\n *                       differs (configuration drift / replayed mock)\n *                       does NOT silently route the verdict against a\n *                       different wallet.\n */\nexport function evaluateReadinessFromFredResponse(\n  raw: CheckDeploymentReadinessResult,\n  gasPrice: string,\n  denomMap: DenomMap,\n  tenantAddress: string,\n): Readiness {\n  // Union `raw.sku.name` into the names list (Copilot #3319670583).\n  // Fred caps `available_sku_names` at `MAX_SKU_NAMES_RETURNED = 50`\n  // (`packages/fred/src/tools/checkDeploymentReadiness.ts`); when the\n  // chain has >50 SKUs and the user's requested size falls past the\n  // slice, the evaluator's SKU-availability rule false-blocks even\n  // though fred already resolved the SKU into `raw.sku`. Folding\n  // `raw.sku.name` into the set closes the gap. Set handles dedupe\n  // (`raw.sku.name` may already be in the first-50 list).\n  const skuNames = new Set(raw.available_sku_names);\n  if (raw.sku !== null) skuNames.add(raw.sku.name);\n\n  return evaluateReadiness({\n    tenant: tenantAddress,\n    image: raw.image,\n    size: raw.size,\n    walletBalances: toCoinArray(raw.wallet_balances),\n    credits: translateCredits(raw),\n    sku: translateSku(raw.sku),\n    availableSkuNames: [...skuNames],\n    gasPrice,\n    denomMap,\n  });\n}\n\n/**\n * Translate fred's `credits` object + top-level `current_balance` /\n * `hours_remaining` into the evaluator's nested `credits` input shape.\n *\n * Null preservation: when fred returns `credits: null`, the translator\n * returns null even if `current_balance` / `hours_remaining` are\n * present at the top level — synthesizing a credits object from the\n * stray fields would suppress the \"no credit account funded\" warn\n * rule the evaluator owns.\n */\nfunction translateCredits(\n  raw: CheckDeploymentReadinessResult,\n): EvaluateReadinessInputs['credits'] {\n  if (raw.credits === null) return null;\n  // Defensive emission: only write a field when fred actually supplied\n  // it. Fred's `CheckDeploymentReadinessResult` declares `balances` /\n  // `available_balances` as required, but the evaluator's input shape\n  // accepts both as OPTIONAL — and skipping the field on absent input\n  // is preferable to surfacing a `.map of undefined` crash if a mock or\n  // upstream variant elides the field. The evaluator's source-of-truth\n  // precedence (availableBalances → balances → currentBalance → []) is\n  // already CJS-parity-correct for partial credits objects.\n  const out: NonNullable<EvaluateReadinessInputs['credits']> = {};\n  if (Array.isArray(raw.credits.available_balances)) {\n    out.availableBalances = toCoinArray(raw.credits.available_balances);\n  }\n  if (Array.isArray(raw.credits.balances)) {\n    out.balances = toCoinArray(raw.credits.balances);\n  }\n  if (raw.current_balance !== undefined) {\n    out.currentBalance = toCoinArray(raw.current_balance);\n  }\n  if (raw.hours_remaining !== undefined) {\n    out.hoursRemaining = raw.hours_remaining;\n  }\n  return out;\n}\n\n/**\n * Translate fred's `SkuSummary | null` into the evaluator's\n * `{ name: string; price: Coin } | null`.\n *\n * Drops fred-only fields (`uuid`, `provider_uuid`, `active`). Coerces\n * a price-less SKU to `null` — the evaluator's `sku.price` is required\n * (`Coin`), so an SKU without price is structurally invalid input.\n * Without this coercion the evaluator would treat the SKU as truthy\n * and crash accessing `price.amount`.\n */\nfunction translateSku(\n  sku: CheckDeploymentReadinessResult['sku'],\n): EvaluateReadinessInputs['sku'] {\n  if (sku === null) return null;\n  if (sku.price === undefined) return null;\n  return {\n    name: sku.name,\n    price: { denom: sku.price.denom, amount: sku.price.amount },\n  };\n}\n\n/**\n * Spread a readonly Coin-shaped array into a mutable Coin[]. The\n * evaluator's `EvaluateReadinessInputs.walletBalances` / credit-balance\n * arrays are mutable; fred's wire shapes are `ReadonlyArray<...>`. A\n * shallow copy is sufficient — each element is a frozen-ish `{denom,\n * amount}` value tuple, never mutated by the evaluator.\n */\nfunction toCoinArray(\n  arr: ReadonlyArray<{ readonly denom: string; readonly amount: string }>,\n): Coin[] {\n  return arr.map((c) => ({ denom: c.denom, amount: c.amount }));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuEA,SAAgB,kCACd,KACA,UACA,UACA,eACW;CASX,MAAM,WAAW,IAAI,IAAI,IAAI,oBAAoB;AACjD,KAAI,IAAI,QAAQ,KAAM,UAAS,IAAI,IAAI,IAAI,KAAK;AAEhD,QAAO,kBAAkB;EACvB,QAAQ;EACR,OAAO,IAAI;EACX,MAAM,IAAI;EACV,gBAAgB,YAAY,IAAI,gBAAgB;EAChD,SAAS,iBAAiB,IAAI;EAC9B,KAAK,aAAa,IAAI,IAAI;EAC1B,mBAAmB,CAAC,GAAG,SAAS;EAChC;EACA;EACD,CAAC;;;;;;;;;;;;AAaJ,SAAS,iBACP,KACoC;AACpC,KAAI,IAAI,YAAY,KAAM,QAAO;CASjC,MAAM,MAAuD,EAAE;AAC/D,KAAI,MAAM,QAAQ,IAAI,QAAQ,mBAAmB,CAC/C,KAAI,oBAAoB,YAAY,IAAI,QAAQ,mBAAmB;AAErE,KAAI,MAAM,QAAQ,IAAI,QAAQ,SAAS,CACrC,KAAI,WAAW,YAAY,IAAI,QAAQ,SAAS;AAElD,KAAI,IAAI,oBAAoB,KAAA,EAC1B,KAAI,iBAAiB,YAAY,IAAI,gBAAgB;AAEvD,KAAI,IAAI,oBAAoB,KAAA,EAC1B,KAAI,iBAAiB,IAAI;AAE3B,QAAO;;;;;;;;;;;;AAaT,SAAS,aACP,KACgC;AAChC,KAAI,QAAQ,KAAM,QAAO;AACzB,KAAI,IAAI,UAAU,KAAA,EAAW,QAAO;AACpC,QAAO;EACL,MAAM,IAAI;EACV,OAAO;GAAE,OAAO,IAAI,MAAM;GAAO,QAAQ,IAAI,MAAM;GAAQ;EAC5D;;;;;;;;;AAUH,SAAS,YACP,KACQ;AACR,QAAO,IAAI,KAAK,OAAO;EAAE,OAAO,EAAE;EAAO,QAAQ,EAAE;EAAQ,EAAE"}

package/dist/internals/format-success.js.map

@@ -1 +1 @@
-{"version":3,"file":"format-success.js","names":["decodeLeaseState"],"sources":["../../src/internals/format-success.ts"],"sourcesContent":["import {\n  extractRunningEndpoints,\n  formatEndpointAsIngress,\n  normalizeFredUrl,\n  type RunningEndpoint,\n} from './connection.js';\nimport { decode as decodeLeaseState } from './lease-state.js';\n\n/**\n * Render the user-facing \"Deployed.\" block for a successful `deployApp` run.\n *\n * Takes `lease-uuid` and `deploy_response` via the typed `FormatSuccessInput`.\n *\n * Output is plain text suitable for direct chat display. Designed to be\n * printed verbatim by `deployApp` (and downstream renderers) — no\n * paraphrasing or surrounding prose.\n *\n * **Lease-state decoding:** `deploy_response.state` may be an integer (raw\n * chain emit) or a `LEASE_STATE_*` string (codec.toJSON form). Both flow\n * through `lease-state.ts:decode`. Unknown values render as\n * `UNKNOWN(<raw>)` so the raw remains visible.\n *\n * **Multi-instance / multi-service stacks** emit `Ingresses:` followed by\n * one bare FQDN per UNIQUE FQDN across running instances. Instances\n * sharing an FQDN (e.g. replicas behind one subdomain) are deduped by\n * `extractRunningEndpoints`.\n *\n * **Custom-domain line** is emitted BEFORE the Ingress block when the\n * deploy response carries a `custom_domain` (the set-domain tx confirmed\n * alongside create-lease). The \"(provisioning)\" qualifier reflects that\n * the chain tx confirmed but the provider may still be issuing the cert.\n *\n * **Provider rendering**: the CJS once attempted to resolve a friendly\n * provider name via `browse_catalog` and dropped it when upstream's\n * catalog shape carried no `name` field. The TS port keeps the\n * `provider_uuid` rendering for the same reason — if upstream later adds\n * `name`, restore via a thin helper.\n */\n\n/** RFC 4122 UUID — 36 chars, hex + 4 hyphens, lowercase or upper. */\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n/** Deploy response shape consumed by `formatSuccess`. Subset of fred's `mcp__manifest-fred__deploy_app` response. */\nexport interface DeployResponse {\n  /** Chain lease state — int (raw) or `LEASE_STATE_*` string (codec). */\n  state?: number | string;\n  /** Provider UUID — rendered as-is (catalog has no friendly-name field). */\n  provider_uuid?: string;\n  /** Custom domain attached to the lease item; populated when set-domain confirmed. */\n  custom_domain?: string;\n  /** Provider connection payload — walked by `connection.ts`. */\n  connection?: unknown;\n  /**\n   * Top-level URL — legacy fallback when provider reports\n   * `connection.host` / `connection.ports` shape rather than\n   * `connection.instances`. Used when no FQDN can be extracted from\n   * `connection`. Defensive: `classify-deploy-response.ts:43-51,76-80`\n   * already defends against the same legacy shape; mirroring here keeps\n   * the renderer consistent with the classifier so a fred response of\n   * `{ url: 'https://app.example.com/' }` renders an Ingress line\n   * rather than `(none …)`.\n   */\n  url?: string;\n}\n\nexport interface FormatSuccessInput {\n  /** Validated lease UUID (RFC 4122 v1-v5). */\n  leaseUuid: string;\n  /** Deploy response from `deploy_app` (or equivalent atomic broadcast). */\n  deployResponse: DeployResponse;\n}\n\nexport function formatSuccess(input: FormatSuccessInput): string {\n  if (!UUID_RE.test(input.leaseUuid)) {\n    throw new TypeError(\n      `formatSuccess: leaseUuid must be a UUID; got \"${input.leaseUuid}\"`,\n    );\n  }\n  if (\n    input.deployResponse === null ||\n    typeof input.deployResponse !== 'object'\n  ) {\n    throw new TypeError(\n      'formatSuccess: deployResponse must be a non-null object',\n    );\n  }\n\n  const dr = input.deployResponse;\n  const providerName =\n    typeof dr.provider_uuid === 'string' && dr.provider_uuid.length > 0\n      ? dr.provider_uuid\n      : '(unknown)';\n  const stateName = decodeStateName(dr.state);\n  const endpoints = extractRunningEndpoints(dr.connection);\n  const ingresses = endpoints\n    .map(formatEndpointAsIngress)\n    .filter((s): s is string => typeof s === 'string' && s.length > 0);\n  // Copilot review fix (PR #58 r3250192778): the custom-domain block's\n  // TLS note (\\\"the Ingress URL below works immediately\\\") promises a\n  // URL that may not exist when `connection.instances` is empty AND\n  // there's no top-level `url`. Compute ingress availability up-front\n  // so the custom-domain block can branch its second line accordingly.\n  const hasIngress =\n    ingresses.length > 0 || (typeof dr.url === 'string' && dr.url.length > 0);\n\n  const lines: string[] = [\n    'Deployed.',\n    `  Provider:      ${providerName}`,\n    `  Lease UUID:    ${input.leaseUuid}`,\n    `  Lease Status:  ${stateName}`,\n  ];\n\n  // Custom-domain block — chain tx confirmed, provider may still be\n  // provisioning. Present BEFORE Ingress so the user sees the requested\n  // endpoint first, alongside the immediately-working provider FQDN (if\n  // any). The TLS note's \"Ingress URL below works immediately\" promise\n  // only fires when an Ingress is actually present (r3250192778).\n  if (typeof dr.custom_domain === 'string' && dr.custom_domain.length > 0) {\n    lines.push(`  Custom domain (provisioning):  https://${dr.custom_domain}/`);\n    lines.push(\n      hasIngress\n        ? '    — TLS may take a few minutes; the Ingress URL below works immediately.'\n        : '    — TLS may take a few minutes.',\n    );\n  }\n\n  if (ingresses.length === 0) {\n    // Legacy fallback: when no FQDN can be extracted from `connection`\n    // (e.g. providers reporting the older `connection.host` / `ports`\n    // shape rather than `connection.instances`), fred may still surface\n    // the URL at the top level. `normalizeFredUrl` is the shared helper\n    // (mirrored across `classify-deploy-response.ts`, this renderer,\n    // and `deploy-app.ts`'s `DeployResult.urls` fallback). The\n    // `(none …)` fallback stays for the truly-empty case.\n    if (typeof dr.url === 'string' && dr.url.length > 0) {\n      lines.push(`  Ingress:       ${normalizeFredUrl(dr.url)}`);\n    } else {\n      lines.push(\n        '  Ingress:       (none — service is internal or no FQDN reported)',\n      );\n    }\n  } else if (ingresses.length === 1) {\n    lines.push(`  Ingress:       ${ingresses[0]}`);\n  } else {\n    lines.push('  Ingresses:');\n    for (const fqdn of ingresses) {\n      lines.push(`    - ${fqdn}`);\n    }\n  }\n  lines.push('');\n  lines.push(\n    `For logs / status:  /manifest-agent:troubleshoot-deployment ${input.leaseUuid}`,\n  );\n\n  return lines.join('\\n');\n}\n\n/**\n * Return the user-facing form of a lease state. The `LEASE_STATE_` prefix\n * is stripped for display (e.g. `LEASE_STATE_ACTIVE` → `ACTIVE`). Unknown\n * decodes render as `UNKNOWN(<raw>)` so the raw remains visible; absent\n * state renders as `(unknown)`.\n */\nfunction decodeStateName(state: number | string | undefined): string {\n  if (state === undefined) return '(unknown)';\n  const canonical = decodeLeaseState(state);\n  if (canonical !== undefined) {\n    return canonical.slice('LEASE_STATE_'.length);\n  }\n  return `UNKNOWN(${String(state)})`;\n}\n\n// Re-export for callers that want to walk endpoints themselves without\n// re-importing from `./connection.js`. Keeps `format-success.ts` the\n// single consumer-facing entry for success-rendering plumbing.\nexport type { RunningEndpoint };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,UACJ;AAgCF,SAAgB,cAAc,OAAmC;AAC/D,KAAI,CAAC,QAAQ,KAAK,MAAM,UAAU,CAChC,OAAM,IAAI,UACR,iDAAiD,MAAM,UAAU,GAClE;AAEH,KACE,MAAM,mBAAmB,QACzB,OAAO,MAAM,mBAAmB,SAEhC,OAAM,IAAI,UACR,0DACD;CAGH,MAAM,KAAK,MAAM;CACjB,MAAM,eACJ,OAAO,GAAG,kBAAkB,YAAY,GAAG,cAAc,SAAS,IAC9D,GAAG,gBACH;CACN,MAAM,YAAY,gBAAgB,GAAG,MAAM;CAE3C,MAAM,YADY,wBAAwB,GAAG,WAAW,CAErD,IAAI,wBAAwB,CAC5B,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE;CAMpE,MAAM,aACJ,UAAU,SAAS,KAAM,OAAO,GAAG,QAAQ,YAAY,GAAG,IAAI,SAAS;CAEzE,MAAM,QAAkB;EACtB;EACA,oBAAoB;EACpB,oBAAoB,MAAM;EAC1B,oBAAoB;EACrB;AAOD,KAAI,OAAO,GAAG,kBAAkB,YAAY,GAAG,cAAc,SAAS,GAAG;AACvE,QAAM,KAAK,4CAA4C,GAAG,cAAc,GAAG;AAC3E,QAAM,KACJ,aACI,+EACA,oCACL;;AAGH,KAAI,UAAU,WAAW,EAQvB,KAAI,OAAO,GAAG,QAAQ,YAAY,GAAG,IAAI,SAAS,EAChD,OAAM,KAAK,oBAAoB,iBAAiB,GAAG,IAAI,GAAG;KAE1D,OAAM,KACJ,oEACD;UAEM,UAAU,WAAW,EAC9B,OAAM,KAAK,oBAAoB,UAAU,KAAK;MACzC;AACL,QAAM,KAAK,eAAe;AAC1B,OAAK,MAAM,QAAQ,UACjB,OAAM,KAAK,SAAS,OAAO;;AAG/B,OAAM,KAAK,GAAG;AACd,OAAM,KACJ,+DAA+D,MAAM,YACtE;AAED,QAAO,MAAM,KAAK,KAAK;;;;;;;;AASzB,SAAS,gBAAgB,OAA4C;AACnE,KAAI,UAAU,KAAA,EAAW,QAAO;CAChC,MAAM,YAAYA,OAAiB,MAAM;AACzC,KAAI,cAAc,KAAA,EAChB,QAAO,UAAU,MAAM,GAAsB;AAE/C,QAAO,WAAW,OAAO,MAAM,CAAC"}
+{"version":3,"file":"format-success.js","names":["decodeLeaseState"],"sources":["../../src/internals/format-success.ts"],"sourcesContent":["import {\n  extractRunningEndpoints,\n  formatEndpointAsIngress,\n  normalizeFredUrl,\n  type RunningEndpoint,\n} from './connection.js';\nimport { decode as decodeLeaseState } from './lease-state.js';\n\n/**\n * Render the user-facing \"Deployed.\" block for a successful `deployApp` run.\n *\n * Takes `lease-uuid` and `deploy_response` via the typed `FormatSuccessInput`.\n *\n * Output is plain text suitable for direct chat display. Designed to be\n * printed verbatim by `deployApp` (and downstream renderers) — no\n * paraphrasing or surrounding prose.\n *\n * **Lease-state decoding:** `deploy_response.state` may be an integer (raw\n * chain emit) or a `LEASE_STATE_*` string (codec.toJSON form). Both flow\n * through `lease-state.ts:decode`. Unknown values render as\n * `UNKNOWN(<raw>)` so the raw remains visible.\n *\n * **Multi-instance / multi-service stacks** emit `Ingresses:` followed by\n * one bare FQDN per UNIQUE FQDN across running instances. Instances\n * sharing an FQDN (e.g. replicas behind one subdomain) are deduped by\n * `extractRunningEndpoints`.\n *\n * **Custom-domain line** is emitted BEFORE the Ingress block when the\n * deploy response carries a `custom_domain` (the set-domain tx confirmed\n * alongside create-lease). The \"(provisioning)\" qualifier reflects that\n * the chain tx confirmed but the provider may still be issuing the cert.\n *\n * **Provider rendering**: the CJS once attempted to resolve a friendly\n * provider name via `browse_catalog` and dropped it when upstream's\n * catalog shape carried no `name` field. The TS port keeps the\n * `provider_uuid` rendering for the same reason — if upstream later adds\n * `name`, restore via a thin helper.\n */\n\n/** RFC 4122 UUID — 36 chars, hex + 4 hyphens, lowercase or upper. */\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n/** Deploy response shape consumed by `formatSuccess`. Subset of fred's `mcp__manifest-fred__deploy_app` response. */\nexport interface DeployResponse {\n  /** Chain lease state — int (raw) or `LEASE_STATE_*` string (codec). */\n  state?: number | string;\n  /** Provider UUID — rendered as-is (catalog has no friendly-name field). */\n  provider_uuid?: string;\n  /** Custom domain attached to the lease item; populated when set-domain confirmed. */\n  custom_domain?: string;\n  /** Provider connection payload — walked by `connection.ts`. */\n  connection?: unknown;\n  /**\n   * Top-level URL — legacy fallback when provider reports\n   * `connection.host` / `connection.ports` shape rather than\n   * `connection.instances`. Used when no FQDN can be extracted from\n   * `connection`. Defensive: `classify-deploy-response.ts:43-51,76-80`\n   * already defends against the same legacy shape; mirroring here keeps\n   * the renderer consistent with the classifier so a fred response of\n   * `{ url: 'https://app.example.com/' }` renders an Ingress line\n   * rather than `(none …)`.\n   */\n  url?: string;\n}\n\nexport interface FormatSuccessInput {\n  /** Validated lease UUID (RFC 4122 v1-v5). */\n  leaseUuid: string;\n  /** Deploy response from `deploy_app` (or equivalent atomic broadcast). */\n  deployResponse: DeployResponse;\n}\n\nexport function formatSuccess(input: FormatSuccessInput): string {\n  if (!UUID_RE.test(input.leaseUuid)) {\n    throw new TypeError(\n      `formatSuccess: leaseUuid must be a UUID; got \"${input.leaseUuid}\"`,\n    );\n  }\n  if (\n    input.deployResponse === null ||\n    typeof input.deployResponse !== 'object'\n  ) {\n    throw new TypeError(\n      'formatSuccess: deployResponse must be a non-null object',\n    );\n  }\n\n  const dr = input.deployResponse;\n  const providerName =\n    typeof dr.provider_uuid === 'string' && dr.provider_uuid.length > 0\n      ? dr.provider_uuid\n      : '(unknown)';\n  const stateName = decodeStateName(dr.state);\n  const endpoints = extractRunningEndpoints(dr.connection);\n  const ingresses = endpoints\n    .map(formatEndpointAsIngress)\n    .filter((s): s is string => typeof s === 'string' && s.length > 0);\n  // Copilot review fix (PR #58 r3250192778): the custom-domain block's\n  // TLS note (\\\"the Ingress URL below works immediately\\\") promises a\n  // URL that may not exist when `connection.instances` is empty AND\n  // there's no top-level `url`. Compute ingress availability up-front\n  // so the custom-domain block can branch its second line accordingly.\n  const hasIngress =\n    ingresses.length > 0 || (typeof dr.url === 'string' && dr.url.length > 0);\n\n  const lines: string[] = [\n    'Deployed.',\n    `  Provider:      ${providerName}`,\n    `  Lease UUID:    ${input.leaseUuid}`,\n    `  Lease Status:  ${stateName}`,\n  ];\n\n  // Custom-domain block — chain tx confirmed, provider may still be\n  // provisioning. Present BEFORE Ingress so the user sees the requested\n  // endpoint first, alongside the immediately-working provider FQDN (if\n  // any). The TLS note's \"Ingress URL below works immediately\" promise\n  // only fires when an Ingress is actually present (r3250192778).\n  if (typeof dr.custom_domain === 'string' && dr.custom_domain.length > 0) {\n    lines.push(`  Custom domain (provisioning):  https://${dr.custom_domain}/`);\n    lines.push(\n      hasIngress\n        ? '    — TLS may take a few minutes; the Ingress URL below works immediately.'\n        : '    — TLS may take a few minutes.',\n    );\n  }\n\n  if (ingresses.length === 0) {\n    // Legacy fallback: when no FQDN can be extracted from `connection`\n    // (e.g. providers reporting the older `connection.host` / `ports`\n    // shape rather than `connection.instances`), fred may still surface\n    // the URL at the top level. `normalizeFredUrl` is the shared helper\n    // (mirrored across `classify-deploy-response.ts`, this renderer,\n    // and `deploy-app.ts`'s `DeployResult.urls` fallback). The\n    // `(none …)` fallback stays for the truly-empty case.\n    if (typeof dr.url === 'string' && dr.url.length > 0) {\n      lines.push(`  Ingress:       ${normalizeFredUrl(dr.url)}`);\n    } else {\n      lines.push(\n        '  Ingress:       (none — service is internal or no FQDN reported)',\n      );\n    }\n  } else if (ingresses.length === 1) {\n    lines.push(`  Ingress:       ${ingresses[0]}`);\n  } else {\n    lines.push('  Ingresses:');\n    for (const fqdn of ingresses) {\n      lines.push(`    - ${fqdn}`);\n    }\n  }\n  lines.push('');\n  lines.push(\n    `For logs / status:  /manifest-agent:troubleshoot-deployment ${input.leaseUuid}`,\n  );\n\n  return lines.join('\\n');\n}\n\n/**\n * Return the user-facing form of a lease state. The `LEASE_STATE_` prefix\n * is stripped for display (e.g. `LEASE_STATE_ACTIVE` → `ACTIVE`). Unknown\n * decodes render as `UNKNOWN(<raw>)` so the raw remains visible; absent\n * state renders as `(unknown)`.\n */\nfunction decodeStateName(state: number | string | undefined): string {\n  if (state === undefined) return '(unknown)';\n  const canonical = decodeLeaseState(state);\n  if (canonical !== undefined) {\n    return canonical.slice('LEASE_STATE_'.length);\n  }\n  return `UNKNOWN(${String(state)})`;\n}\n\n// Re-export for callers that want to walk endpoints themselves without\n// re-importing from `./connection.js`. Keeps `format-success.ts` the\n// single consumer-facing entry for success-rendering plumbing.\nexport type { RunningEndpoint };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,UACJ;AAgCF,SAAgB,cAAc,OAAmC;AAC/D,KAAI,CAAC,QAAQ,KAAK,MAAM,UAAU,CAChC,OAAM,IAAI,UACR,iDAAiD,MAAM,UAAU,GAClE;AAEH,KACE,MAAM,mBAAmB,QACzB,OAAO,MAAM,mBAAmB,SAEhC,OAAM,IAAI,UACR,0DACD;CAGH,MAAM,KAAK,MAAM;CACjB,MAAM,eACJ,OAAO,GAAG,kBAAkB,YAAY,GAAG,cAAc,SAAS,IAC9D,GAAG,gBACH;CACN,MAAM,YAAY,gBAAgB,GAAG,MAAM;CAE3C,MAAM,YADY,wBAAwB,GAAG,WAClB,CACxB,IAAI,wBAAwB,CAC5B,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE;CAMpE,MAAM,aACJ,UAAU,SAAS,KAAM,OAAO,GAAG,QAAQ,YAAY,GAAG,IAAI,SAAS;CAEzE,MAAM,QAAkB;EACtB;EACA,oBAAoB;EACpB,oBAAoB,MAAM;EAC1B,oBAAoB;EACrB;AAOD,KAAI,OAAO,GAAG,kBAAkB,YAAY,GAAG,cAAc,SAAS,GAAG;AACvE,QAAM,KAAK,4CAA4C,GAAG,cAAc,GAAG;AAC3E,QAAM,KACJ,aACI,+EACA,oCACL;;AAGH,KAAI,UAAU,WAAW,EAQvB,KAAI,OAAO,GAAG,QAAQ,YAAY,GAAG,IAAI,SAAS,EAChD,OAAM,KAAK,oBAAoB,iBAAiB,GAAG,IAAI,GAAG;KAE1D,OAAM,KACJ,oEACD;UAEM,UAAU,WAAW,EAC9B,OAAM,KAAK,oBAAoB,UAAU,KAAK;MACzC;AACL,QAAM,KAAK,eAAe;AAC1B,OAAK,MAAM,QAAQ,UACjB,OAAM,KAAK,SAAS,OAAO;;AAG/B,OAAM,KAAK,GAAG;AACd,OAAM,KACJ,+DAA+D,MAAM,YACtE;AAED,QAAO,MAAM,KAAK,KAAK;;;;;;;;AASzB,SAAS,gBAAgB,OAA4C;AACnE,KAAI,UAAU,KAAA,EAAW,QAAO;CAChC,MAAM,YAAYA,OAAiB,MAAM;AACzC,KAAI,cAAc,KAAA,EAChB,QAAO,UAAU,MAAM,GAAsB;AAE/C,QAAO,WAAW,OAAO,MAAM,CAAC"}

package/dist/internals/guarded-fetch.d.ts

@@ -1,138 +1,2 @@
-//#region src/internals/guarded-fetch.d.ts
-/**
- * SSRF-guarded `fetch` factory. A Node-native undici Dispatcher that
- * DNS-resolves once at connect time and rejects any address whose
- * `ipaddr.js` range is not `'unicast'`.
- *
- * Why DIY rather than `request-filtering-agent`: the library only works with
- * `http`/`https`.Agent (legacy http API) and explicitly does NOT plug into
- * undici / native `fetch` per its v3.2.0 README. Re-routing the same
- * blocking semantics through undici's Dispatcher hook lets agent-core's
- * `inspectImage` (and future consumers) use native `fetch` while preserving
- * the same SSRF posture.
- *
- * Design (architect-blessed):
- * - **`ipaddr.js`'s `range()` is the source of truth.** Same approach as
- *   `request-filtering-agent`: block any IP whose range is not `'unicast'`.
- *   This covers loopback / private / link-local / multicast / broadcast /
- *   reserved / carrier-grade-NAT / unspecified / ipv4Mapped / etc. via the
- *   library's well-maintained RFC-classification table.
- * - **IPv4-mapped IPv6 normalization** (security-critical). An attacker
- *   writing `::ffff:127.0.0.1` would otherwise sit in `ipaddr.js`'s
- *   `'ipv4Mapped'` IPv6 range — coincidentally blocked, but for the
- *   structural reason ("v4-mapped form") rather than the security reason
- *   ("loopback target"). We normalize first so the block is justified.
- *   Without this step, a v4-mapped form of a PUBLIC IPv4 (`::ffff:8.8.8.8`)
- *   would also be blocked (wrong outcome — public IP is fine via
- *   v4-mapped). Normalization gets both cases right.
- * - **DNS-resolve INSIDE the connect hook** to close the TOCTOU window
- *   between resolve and TCP connect. The resolved IP gets substituted as
- *   the connect hostname so the kernel doesn't re-resolve.
- * - **Module-level singleton Dispatcher**, lazy-instantiated on first
- *   `createGuardedFetch()` invocation. Mirrors the CJS singleton-agent
- *   pattern; avoids the aggressive `setGlobalDispatcher()` side-effect.
- * - **Construction-time runtime check** (`typeof process === 'undefined'`)
- *   throws a clear error on browser/Deno so the failure is actionable, not
- *   a confusing mid-fetch module-resolution error.
- * - **Redirect safety:** undici re-fires the connect hook on every cross-
- *   host redirect; same-host redirects reuse the checked socket. The fetch
- *   closure does NOT need `redirect: 'manual'` — default `follow` is safe
- *   by construction.
- *
- * Blocked-range exports (`BLOCKED_RANGES_IPV4`, `BLOCKED_RANGES_IPV6`) are
- * provided for audit + test purposes: they enumerate the `ipaddr.js`
- * `range()` classifications we treat as non-`unicast` with their RFC
- * citations, so a reviewer can grep the code without consulting the
- * `ipaddr.js` source.
- *
- * Cross-platform note: agent-core's `tsdown.config.ts` targets
- * `platform: 'neutral'`. `ipaddr.js` is isomorphic (pure JS, no node:*
- * imports), so the static import is fine. `undici` and `node:dns/promises`
- * + `node:net` are Node-only — dynamic-imported INSIDE the lazy singleton
- * creation so the package stays importable from browsers / Deno (calling
- * `createGuardedFetch()` from those throws the construction-time error
- * with actionable guidance).
- */
-type GuardedFetch = typeof fetch;
-/**
- * `ipaddr.js`-classified IPv4 range labels we block (i.e., everything
- * except `'unicast'`). Exposed as a module-level constant so the audit
- * trail is greppable and a future range-list update is a focused edit.
- *
- * RFC citations included for each label for audit visibility — `ipaddr.js`
- * owns the actual CIDR tables that map IPs to these labels.
- */
-declare const BLOCKED_RANGES_IPV4: ReadonlyArray<{
-  readonly range: string;
-  readonly rfc: string;
-}>;
-/**
- * `ipaddr.js`-classified IPv6 range labels we block. Note: `'ipv4Mapped'`
- * is NOT included here because we normalize IPv4-mapped IPv6 addresses to
- * their underlying IPv4 form BEFORE the range check — otherwise a v4-
- * mapped form of a public IP (`::ffff:8.8.8.8`) would be wrongly blocked,
- * and a v4-mapped form of a private IP (`::ffff:127.0.0.1`) would be
- * blocked only structurally (not for the security reason).
- */
-declare const BLOCKED_RANGES_IPV6: ReadonlyArray<{
-  readonly range: string;
-  readonly rfc: string;
-}>;
-/**
- * SSRF block-check for a single IP string. **Allow-list policy:** only
- * ipaddr.js's `'unicast'` classification is permitted; every other range
- * label is blocked.
- *
- * The prior deny-list implementation iterated BLOCKED_RANGES_* and let
- * anything not explicitly enumerated fall through as "allowed" — a
- * security-critical bias error. IPv6 categories like `6to4` (which can
- * wrap loopback or RFC 1918 IPs as `2002:7f00::/24` etc.), `teredo`,
- * `rfc6052` (NAT64), and `discard` were ALL un-named and therefore
- * allowed-by-omission. Under the allow-list policy, these all
- * default-deny along with any future ipaddr.js classification we
- * haven't audited.
- *
- * Returned `{range, rfc}` descriptor sources:
- *   - **Named in BLOCKED_RANGES_IPV4 / BLOCKED_RANGES_IPV6** → returns
- *     that entry verbatim (carries the audited RFC citation).
- *   - **Unknown non-unicast label** → synthesizes
- *     `{range: <label>, rfc: 'ipaddr.js classification (default-deny non-unicast)'}`.
- *     The audit string is generic but the block decision is correct;
- *     a future PR can promote frequently-seen labels into
- *     BLOCKED_RANGES_* with proper RFC citations.
- *
- * IPv4-mapped IPv6 addresses (`::ffff:1.2.3.4`) are normalized to their
- * IPv4 form before the range check so the security verdict tracks the
- * underlying IP, not the structural wrapping.
- *
- * Throws `Error` on unparseable input — callers should catch and treat
- * "unparseable" as "block" (defense-in-depth — better to refuse than to
- * pass through to network on garbage input).
- */
-declare function isBlocked(ipString: string): {
-  range: string;
-  rfc: string;
-} | null;
-/**
- * Build the SSRF-guarded fetch closure. Construction-time runtime check
- * gates Node-only — browser / Deno consumers either pass their own
- * `opts.fetch` to consumers like `inspectImage` or accept this error.
- *
- * The returned function matches `typeof fetch` and lazy-instantiates the
- * undici Dispatcher on first invocation. Subsequent calls share the
- * cached singleton.
- *
- * **Important: uses undici's own `fetch`**, not Node's built-in. Node's
- * built-in fetch is backed by its bundled undici, which is pinned to
- * Node's release-cycle version (Node 22 → undici 6.x). The npm-installed
- * `undici` package may be newer, and the Dispatcher protocol between
- * versions isn't guaranteed compatible (we observed "invalid
- * onRequestStart method" when mixing Node 22's fetch with undici@8 Agent).
- * Routing through undici's own fetch (same package version as the Agent)
- * sidesteps the mismatch. The function signature stays identical to
- * Node's `fetch` so consumers can't tell the difference.
- */
-declare function createGuardedFetch(): GuardedFetch;
-//#endregion
-export { BLOCKED_RANGES_IPV4, BLOCKED_RANGES_IPV6, GuardedFetch, createGuardedFetch, isBlocked };
-//# sourceMappingURL=guarded-fetch.d.ts.map
+import { BLOCKED_RANGES_IPV4, BLOCKED_RANGES_IPV6, GuardedFetch, createGuardedFetch, isBlocked } from "@manifest-network/manifest-mcp-core";
+export { BLOCKED_RANGES_IPV4, BLOCKED_RANGES_IPV6, type GuardedFetch, createGuardedFetch, isBlocked };

package/dist/internals/guarded-fetch.js

@@ -1,242 +1,2 @@
-import ipaddr from "ipaddr.js";
-//#region src/internals/guarded-fetch.ts
-/**
-* `ipaddr.js`-classified IPv4 range labels we block (i.e., everything
-* except `'unicast'`). Exposed as a module-level constant so the audit
-* trail is greppable and a future range-list update is a focused edit.
-*
-* RFC citations included for each label for audit visibility — `ipaddr.js`
-* owns the actual CIDR tables that map IPs to these labels.
-*/
-const BLOCKED_RANGES_IPV4 = [
-	{
-		range: "unspecified",
-		rfc: "RFC 1122 §3.2.1.3 — 0.0.0.0/8 (this network / meta)"
-	},
-	{
-		range: "private",
-		rfc: "RFC 1918 — 10/8, 172.16/12, 192.168/16 (private)"
-	},
-	{
-		range: "loopback",
-		rfc: "RFC 5735 — 127/8 (loopback)"
-	},
-	{
-		range: "linkLocal",
-		rfc: "RFC 3927 — 169.254/16 (link-local, incl. AWS/GCP/Azure metadata at 169.254.169.254)"
-	},
-	{
-		range: "carrierGradeNat",
-		rfc: "RFC 6598 — 100.64/10 (carrier-grade NAT)"
-	},
-	{
-		range: "broadcast",
-		rfc: "RFC 919 — 255.255.255.255 (limited broadcast)"
-	},
-	{
-		range: "multicast",
-		rfc: "RFC 5771 — 224/4 (multicast)"
-	},
-	{
-		range: "reserved",
-		rfc: "RFC 1112 / 6890 — 240/4, 192.0.0/24, 198.18/15 etc. (reserved)"
-	}
-];
-/**
-* `ipaddr.js`-classified IPv6 range labels we block. Note: `'ipv4Mapped'`
-* is NOT included here because we normalize IPv4-mapped IPv6 addresses to
-* their underlying IPv4 form BEFORE the range check — otherwise a v4-
-* mapped form of a public IP (`::ffff:8.8.8.8`) would be wrongly blocked,
-* and a v4-mapped form of a private IP (`::ffff:127.0.0.1`) would be
-* blocked only structurally (not for the security reason).
-*/
-const BLOCKED_RANGES_IPV6 = [
-	{
-		range: "unspecified",
-		rfc: "RFC 4291 — :: (unspecified)"
-	},
-	{
-		range: "loopback",
-		rfc: "RFC 4291 — ::1/128 (loopback)"
-	},
-	{
-		range: "linkLocal",
-		rfc: "RFC 4291 — fe80::/10 (link-local)"
-	},
-	{
-		range: "uniqueLocal",
-		rfc: "RFC 4193 — fc00::/7 (unique local / private)"
-	},
-	{
-		range: "multicast",
-		rfc: "RFC 4291 — ff00::/8 (multicast)"
-	},
-	{
-		range: "reserved",
-		rfc: "RFC 4291 / 5156 — various reserved blocks"
-	}
-];
-/**
-* SSRF block-check for a single IP string. **Allow-list policy:** only
-* ipaddr.js's `'unicast'` classification is permitted; every other range
-* label is blocked.
-*
-* The prior deny-list implementation iterated BLOCKED_RANGES_* and let
-* anything not explicitly enumerated fall through as "allowed" — a
-* security-critical bias error. IPv6 categories like `6to4` (which can
-* wrap loopback or RFC 1918 IPs as `2002:7f00::/24` etc.), `teredo`,
-* `rfc6052` (NAT64), and `discard` were ALL un-named and therefore
-* allowed-by-omission. Under the allow-list policy, these all
-* default-deny along with any future ipaddr.js classification we
-* haven't audited.
-*
-* Returned `{range, rfc}` descriptor sources:
-*   - **Named in BLOCKED_RANGES_IPV4 / BLOCKED_RANGES_IPV6** → returns
-*     that entry verbatim (carries the audited RFC citation).
-*   - **Unknown non-unicast label** → synthesizes
-*     `{range: <label>, rfc: 'ipaddr.js classification (default-deny non-unicast)'}`.
-*     The audit string is generic but the block decision is correct;
-*     a future PR can promote frequently-seen labels into
-*     BLOCKED_RANGES_* with proper RFC citations.
-*
-* IPv4-mapped IPv6 addresses (`::ffff:1.2.3.4`) are normalized to their
-* IPv4 form before the range check so the security verdict tracks the
-* underlying IP, not the structural wrapping.
-*
-* Throws `Error` on unparseable input — callers should catch and treat
-* "unparseable" as "block" (defense-in-depth — better to refuse than to
-* pass through to network on garbage input).
-*/
-function isBlocked(ipString) {
-	let parsed = ipaddr.parse(ipString);
-	if (parsed.kind() === "ipv6") {
-		const v6 = parsed;
-		if (v6.isIPv4MappedAddress()) parsed = v6.toIPv4Address();
-	}
-	const rangeLabel = parsed.range();
-	if (rangeLabel === "unicast") return null;
-	const named = (parsed.kind() === "ipv4" ? BLOCKED_RANGES_IPV4 : BLOCKED_RANGES_IPV6).find((r) => r.range === rangeLabel);
-	if (named) return named;
-	return {
-		range: rangeLabel,
-		rfc: "ipaddr.js classification (default-deny non-unicast)"
-	};
-}
-/**
-* Cache the in-flight Promise (not the resolved value) so concurrent first-
-* call racers share the same construction and don't double-build the
-* undici Agent. Resolves to the singleton DispatcherCache. After
-* resolution, subsequent calls await the already-settled Promise (cheap).
-*/
-let cachedP;
-/**
-* Build the SSRF-guarded fetch closure. Construction-time runtime check
-* gates Node-only — browser / Deno consumers either pass their own
-* `opts.fetch` to consumers like `inspectImage` or accept this error.
-*
-* The returned function matches `typeof fetch` and lazy-instantiates the
-* undici Dispatcher on first invocation. Subsequent calls share the
-* cached singleton.
-*
-* **Important: uses undici's own `fetch`**, not Node's built-in. Node's
-* built-in fetch is backed by its bundled undici, which is pinned to
-* Node's release-cycle version (Node 22 → undici 6.x). The npm-installed
-* `undici` package may be newer, and the Dispatcher protocol between
-* versions isn't guaranteed compatible (we observed "invalid
-* onRequestStart method" when mixing Node 22's fetch with undici@8 Agent).
-* Routing through undici's own fetch (same package version as the Agent)
-* sidesteps the mismatch. The function signature stays identical to
-* Node's `fetch` so consumers can't tell the difference.
-*/
-function createGuardedFetch() {
-	if (typeof process === "undefined" || !process.versions?.node) throw new Error("createGuardedFetch requires a Node.js runtime. On browser/Deno consumers, pass `opts.fetch` directly with your own SSRF-guarded implementation. See agent-core README.");
-	return async (input, init) => {
-		if (!cachedP) cachedP = buildSsrfDispatcher().catch((err) => {
-			cachedP = void 0;
-			throw err;
-		});
-		const c = await cachedP;
-		const initWithDispatcher = {
-			...init ?? {},
-			dispatcher: c.dispatcher
-		};
-		return c.fetch(input, initWithDispatcher);
-	};
-}
-/**
-* Lazy dynamic-import of Node-only modules so the package stays importable
-* from non-Node consumers. The runtime check in `createGuardedFetch`
-* already gates Node-only — this function is only reached on Node.
-*
-* Returns BOTH the dispatcher and undici's own `fetch` so the
-* `createGuardedFetch` closure can route through undici directly (avoiding
-* Node-bundled-undici vs npm-undici Dispatcher protocol mismatches).
-*/
-async function buildSsrfDispatcher() {
-	const [undici, dnsModule, netModule] = await Promise.all([
-		import("undici"),
-		import("node:dns/promises"),
-		import("node:net")
-	]);
-	const baseConnect = undici.buildConnector({});
-	return {
-		dispatcher: new undici.Agent({ connect: (options, callback) => {
-			const hostname = options.hostname ?? "";
-			resolveAndCheck(hostname, netModule, dnsModule).then((resolved) => {
-				if (resolved.blocked) {
-					callback(/* @__PURE__ */ new Error(`SSRF blocked: ${hostname} resolves to ${resolved.ip} which is in blocked range '${resolved.blocked.range}' (${resolved.blocked.rfc})`), null);
-					return;
-				}
-				baseConnect({
-					...options,
-					hostname: resolved.ip
-				}, callback);
-			}).catch((err) => {
-				const msg = err instanceof Error ? err.message : String(err);
-				callback(/* @__PURE__ */ new Error(`SSRF blocked: refused to connect to ${hostname}: ${msg}`), null);
-			});
-		} }),
-		fetch: undici.fetch
-	};
-}
-/**
-* Resolve the connection target's IP and check against the blocked-range
-* sets. Handles three input cases:
-*   1. Hostname is already an IP literal → check directly (no DNS lookup).
-*   2. Hostname is an FQDN → resolve via `dns.lookup` (returns first
-*      address; matches Node's default connection behavior).
-*   3. Resolution failure → throws, which the caller's `.catch` translates
-*      into a fail-closed SSRF-block error.
-*
-* **DELIBERATE DIVERGENCE FROM SPEC** — architect's spec said
-* `dns.resolve4` / `dns.resolve6`; this implementation uses `dns.lookup`.
-* Rationale: `dns.lookup` matches the kernel's actual connection-time
-* resolution path (hosts file + nsswitch.conf + DNS in order), so the IP
-* we check IS the IP the kernel would connect to. Using `resolve4/6`
-* would consult DNS only and miss the hosts-file path — if an attacker
-* could write to `/etc/hosts` (root only) the check would be incomplete
-* because the kernel's actual connect would use a different address than
-* the one we checked. Per threat model: hosts-file writes require root,
-* so an attacker capable of writing there already owns the machine; this
-* is "fixing the right problem" — the check should track what the kernel
-* does, not its own model of resolution.
-*
-* Documented in PR 2 description for reviewer awareness. If the threat
-* model expands to include shared-host scenarios where attacker-controlled
-* hosts entries are realistic, switch to `resolve4/6` and accept the
-* connect-time-mismatch risk.
-*/
-async function resolveAndCheck(hostname, netModule, dnsModule) {
-	let ip;
-	if (netModule.isIP(hostname) !== 0) ip = hostname;
-	else ip = (await dnsModule.lookup(hostname, { verbatim: true })).address;
-	const blocked = isBlocked(ip);
-	return {
-		ip,
-		blocked
-	};
-}
-//#endregion
+import { BLOCKED_RANGES_IPV4, BLOCKED_RANGES_IPV6, createGuardedFetch, isBlocked } from "@manifest-network/manifest-mcp-core";
 export { BLOCKED_RANGES_IPV4, BLOCKED_RANGES_IPV6, createGuardedFetch, isBlocked };
-
-//# sourceMappingURL=guarded-fetch.js.map

package/dist/internals/humanize-denom.js.map

@@ -1 +1 @@
-{"version":3,"file":"humanize-denom.js","names":[],"sources":["../../src/internals/humanize-denom.ts"],"sourcesContent":["/**\n * Convert chain-side coin amounts (always in the smallest unit) into the\n * human-readable display the user actually wants to see — e.g.\n * `1800000 factory/.../upwr` → `1.8 PWR`, `0.057738 PWR` built from\n * `57738 factory/.../upwr`, etc.\n *\n * The denom → symbol mapping is sourced from a chain registry JSON file\n * (`{ feeTokens: [{ denom, symbol, ... }] }` — every token the chain\n * accepts as gas). Callers pass the chain-data file path and forward the\n * resulting `DenomMap` to whichever helper renders balances; this module\n * just reads, parses, and looks up.\n *\n * Conversion factor: cosmos convention is 6 decimals for `u`-prefixed\n * tokens (umfx, upwr — including factory-wrapped variants). Anything else\n * is rendered untouched (denom kept as-is, amount printed as integer)\n * because we can't safely guess its exponent.\n *\n * **Dynamic node-import discipline** (mirrors `guarded-fetch.ts` +\n * `save-manifest.ts`): the `node:fs` import is deferred to call time so\n * module load doesn't violate the package's `platform: 'neutral'` build\n * target. `loadChainDenomMap` is therefore async; consumers must\n * `await` the result. The other 3 exports (`humanizeCoin`,\n * `humanizeBalances`, `denomToSymbol`) remain pure-sync since they take\n * a pre-loaded `DenomMap` as input.\n *\n * Exports (all 4 preserved per qa-engineer's review pin — PR 2's internal\n * callers use a subset; PR 3 will surface the rest):\n *   - `loadChainDenomMap(chainDataFilePath?)` (ASYNC) — returns\n *     `Promise<DenomMap>`. Missing / unreadable path → no-op map\n *     (lookup always returns `null`). Read failures emit `console.warn`\n *     matching the connection.ts precedent from PR 1.\n *   - `humanizeCoin(amount, denom, denomMap)` — `\"<amount> <symbol>\"` or\n *     `\"<amount> <denom>\"` on unknown denom.\n *   - `humanizeBalances(coins, denomMap)` — joins multiple coins with\n *     `\", \"`. Empty array → `\"(empty)\"` literal.\n *   - `denomToSymbol(denom, denomMap)` — bare symbol or raw denom fallback.\n */\n\nimport type { DenomLookup, DenomMap } from '../types.js';\n\n// Re-export the public types for convenience to existing internal consumers\n// (this file's pre-PR-3 history exported DenomLookup + DenomMap directly).\n// Public consumers should import from `@manifest-network/manifest-agent-core`\n// (which re-exports `../types.js`); internal consumers can use either path.\nexport type { DenomLookup, DenomMap };\n\nconst KNOWN_EXPONENT = 6;\n\n/**\n * No-op `DenomMap` for callers without chain-data context. All lookups\n * return `null`; `humanizeCoin` falls back to raw on-chain denoms.\n * Exported so synchronous decision functions (e.g. `evaluateReadiness`)\n * can default to it without needing to invoke the async loader.\n */\nexport const EMPTY_DENOM_MAP: DenomMap = { lookup: () => null, raw: null };\n\nexport async function loadChainDenomMap(\n  chainDataFilePath?: string,\n): Promise<DenomMap> {\n  if (!chainDataFilePath) return EMPTY_DENOM_MAP;\n  if (\n    typeof process === 'undefined' ||\n    typeof process.versions?.node !== 'string'\n  ) {\n    // Lazy node-only dep — refuse outside Node-like runtimes rather than\n    // silently no-op'ing (which would hide a misconfiguration).\n    throw new Error(\n      'loadChainDenomMap: chainDataFilePath requires a Node.js runtime (node:fs unavailable in this environment)',\n    );\n  }\n  let raw: unknown;\n  try {\n    const { readFileSync } = await import('node:fs');\n    raw = JSON.parse(readFileSync(chainDataFilePath, 'utf8'));\n  } catch (err) {\n    // CJS parity: warn loudly when a path was passed but read/parse failed.\n    // A corrupted chain file silently downgrades all balance/fee rendering to\n    // raw chain denoms across the package, and the user only notices because\n    // the DeploymentPlan looks weird (\"0.000037 PWR\" vs \"37 upwr\"). Matches\n    // connection.ts's `console.warn` default established in PR 1.\n    const message = err instanceof Error ? err.message : String(err);\n    console.warn(\n      `humanize-denom: failed to load ${chainDataFilePath}: ${message}; ` +\n        `balances and fees will render with raw on-chain denoms.`,\n    );\n    return EMPTY_DENOM_MAP;\n  }\n\n  // Normalize the feeTokens list into a denom → { symbol, exponent } map.\n  // Every Manifest fee token uses 6 decimals (the leading `u` is the micro\n  // prefix). Tokens not in feeTokens are unknown to us; the fallback branch\n  // in humanizeCoin handles them.\n  const map = new Map<string, DenomLookup>();\n  if (raw !== null && typeof raw === 'object') {\n    const feeTokens = (raw as { feeTokens?: unknown }).feeTokens;\n    if (Array.isArray(feeTokens)) {\n      for (const t of feeTokens) {\n        if (\n          t !== null &&\n          typeof t === 'object' &&\n          typeof (t as { denom?: unknown }).denom === 'string' &&\n          typeof (t as { symbol?: unknown }).symbol === 'string'\n        ) {\n          const token = t as { denom: string; symbol: string };\n          map.set(token.denom, {\n            symbol: token.symbol,\n            exponent: KNOWN_EXPONENT,\n          });\n        }\n      }\n    }\n  }\n\n  return {\n    lookup: (denom) => {\n      if (typeof denom !== 'string') return null;\n      return map.get(denom) ?? null;\n    },\n    raw,\n  };\n}\n\n/**\n * Convert a smallest-unit amount string → human decimal string with up to\n * `exponent` decimals, trimming trailing zeros for readability. Uses BigInt\n * for the integer part so precision survives large balances; only the\n * fractional remainder is divided.\n *\n * Exported for unit testing of the scaling logic in isolation (mirrors the\n * CJS's `_fmtScaledAmount` test hook).\n */\nexport function _fmtScaledAmount(amount: string, exponent: number): string {\n  let digits: bigint;\n  try {\n    digits = BigInt(amount);\n  } catch {\n    return String(amount);\n  }\n  const negative = digits < 0n;\n  if (negative) digits = -digits;\n  const divisor = 10n ** BigInt(exponent);\n  const whole = digits / divisor;\n  const frac = digits % divisor;\n  const fracStr = frac.toString().padStart(exponent, '0').replace(/0+$/, '');\n  let out = fracStr.length > 0 ? `${whole}.${fracStr}` : `${whole}`;\n  if (negative) out = `-${out}`;\n  return out;\n}\n\n/**\n * Render a single coin as `\"<amount> <symbol>\"` (when the denom is in the\n * map) or `\"<amount> <denom>\"` verbatim (when unknown). Falls back to\n * `\"<amount>\"` only when `denom` is null/undefined.\n */\nexport function humanizeCoin(\n  amount: string,\n  denom: string | null | undefined,\n  denomMap: DenomMap,\n): string {\n  if (denom === undefined || denom === null) return `${amount}`;\n  const lookup = denomMap.lookup(denom);\n  if (lookup) {\n    return `${_fmtScaledAmount(amount, lookup.exponent)} ${lookup.symbol}`;\n  }\n  // Best-effort unknown-denom rendering — keep the raw denom so the user\n  // can still identify it, and don't guess at scaling.\n  return `${amount} ${denom}`;\n}\n\n/**\n * Join multiple coins with `\", \"` (space after comma). Empty array →\n * literal `\"(empty)\"` per CJS parity.\n */\nexport function humanizeBalances(\n  balances: ReadonlyArray<{ denom?: string; amount?: string | null }> | unknown,\n  denomMap: DenomMap,\n): string {\n  if (!Array.isArray(balances) || balances.length === 0) return '(empty)';\n  return balances\n    .map((b) => {\n      const amount =\n        b !== null && typeof b === 'object' && 'amount' in b && b.amount != null\n          ? String(b.amount)\n          : '0';\n      const denom =\n        b !== null && typeof b === 'object' && 'denom' in b\n          ? (b.denom as string | null | undefined)\n          : undefined;\n      return humanizeCoin(amount, denom, denomMap);\n    })\n    .join(', ');\n}\n\n/**\n * Return the friendly symbol for a chain denom (`\"umfx\"` → `\"MFX\"`) via\n * the same lookup `humanizeCoin` uses. Falls back to the raw denom on\n * unknown input. Avoids the brittle pattern of formatting `\"0 MFX\"` and\n * string-splitting to recover `\"MFX\"`.\n */\nexport function denomToSymbol(\n  denom: string | null | undefined,\n  denomMap: DenomMap,\n): string {\n  if (!denom) return String(denom ?? '');\n  const lookup = denomMap.lookup(denom);\n  return lookup?.symbol ?? denom;\n}\n"],"mappings":";AA8CA,MAAM,iBAAiB;;;;;;;AAQvB,MAAa,kBAA4B;CAAE,cAAc;CAAM,KAAK;CAAM;AAE1E,eAAsB,kBACpB,mBACmB;AACnB,KAAI,CAAC,kBAAmB,QAAO;AAC/B,KACE,OAAO,YAAY,eACnB,OAAO,QAAQ,UAAU,SAAS,SAIlC,OAAM,IAAI,MACR,4GACD;CAEH,IAAI;AACJ,KAAI;EACF,MAAM,EAAE,iBAAiB,MAAM,OAAO;AACtC,QAAM,KAAK,MAAM,aAAa,mBAAmB,OAAO,CAAC;UAClD,KAAK;EAMZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,UAAQ,KACN,kCAAkC,kBAAkB,IAAI,QAAQ,2DAEjE;AACD,SAAO;;CAOT,MAAM,sBAAM,IAAI,KAA0B;AAC1C,KAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;EAC3C,MAAM,YAAa,IAAgC;AACnD,MAAI,MAAM,QAAQ,UAAU;QACrB,MAAM,KAAK,UACd,KACE,MAAM,QACN,OAAO,MAAM,YACb,OAAQ,EAA0B,UAAU,YAC5C,OAAQ,EAA2B,WAAW,UAC9C;IACA,MAAM,QAAQ;AACd,QAAI,IAAI,MAAM,OAAO;KACnB,QAAQ,MAAM;KACd,UAAU;KACX,CAAC;;;;AAMV,QAAO;EACL,SAAS,UAAU;AACjB,OAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAO,IAAI,IAAI,MAAM,IAAI;;EAE3B;EACD;;;;;;;;;;;AAYH,SAAgB,iBAAiB,QAAgB,UAA0B;CACzE,IAAI;AACJ,KAAI;AACF,WAAS,OAAO,OAAO;SACjB;AACN,SAAO,OAAO,OAAO;;CAEvB,MAAM,WAAW,SAAS;AAC1B,KAAI,SAAU,UAAS,CAAC;CACxB,MAAM,UAAU,OAAO,OAAO,SAAS;CACvC,MAAM,QAAQ,SAAS;CAEvB,MAAM,WADO,SAAS,SACD,UAAU,CAAC,SAAS,UAAU,IAAI,CAAC,QAAQ,OAAO,GAAG;CAC1E,IAAI,MAAM,QAAQ,SAAS,IAAI,GAAG,MAAM,GAAG,YAAY,GAAG;AAC1D,KAAI,SAAU,OAAM,IAAI;AACxB,QAAO;;;;;;;AAQT,SAAgB,aACd,QACA,OACA,UACQ;AACR,KAAI,UAAU,KAAA,KAAa,UAAU,KAAM,QAAO,GAAG;CACrD,MAAM,SAAS,SAAS,OAAO,MAAM;AACrC,KAAI,OACF,QAAO,GAAG,iBAAiB,QAAQ,OAAO,SAAS,CAAC,GAAG,OAAO;AAIhE,QAAO,GAAG,OAAO,GAAG;;;;;;AAOtB,SAAgB,iBACd,UACA,UACQ;AACR,KAAI,CAAC,MAAM,QAAQ,SAAS,IAAI,SAAS,WAAW,EAAG,QAAO;AAC9D,QAAO,SACJ,KAAK,MAAM;AASV,SAAO,aAPL,MAAM,QAAQ,OAAO,MAAM,YAAY,YAAY,KAAK,EAAE,UAAU,OAChE,OAAO,EAAE,OAAO,GAChB,KAEJ,MAAM,QAAQ,OAAO,MAAM,YAAY,WAAW,IAC7C,EAAE,QACH,KAAA,GAC6B,SAAS;GAC5C,CACD,KAAK,KAAK;;;;;;;;AASf,SAAgB,cACd,OACA,UACQ;AACR,KAAI,CAAC,MAAO,QAAO,OAAO,SAAS,GAAG;AAEtC,QADe,SAAS,OAAO,MAAM,EACtB,UAAU"}
+{"version":3,"file":"humanize-denom.js","names":[],"sources":["../../src/internals/humanize-denom.ts"],"sourcesContent":["/**\n * Convert chain-side coin amounts (always in the smallest unit) into the\n * human-readable display the user actually wants to see — e.g.\n * `1800000 factory/.../upwr` → `1.8 PWR`, `0.057738 PWR` built from\n * `57738 factory/.../upwr`, etc.\n *\n * The denom → symbol mapping is sourced from a chain registry JSON file\n * (`{ feeTokens: [{ denom, symbol, ... }] }` — every token the chain\n * accepts as gas). Callers pass the chain-data file path and forward the\n * resulting `DenomMap` to whichever helper renders balances; this module\n * just reads, parses, and looks up.\n *\n * Conversion factor: cosmos convention is 6 decimals for `u`-prefixed\n * tokens (umfx, upwr — including factory-wrapped variants). Anything else\n * is rendered untouched (denom kept as-is, amount printed as integer)\n * because we can't safely guess its exponent.\n *\n * **Dynamic node-import discipline** (mirrors `guarded-fetch.ts` +\n * `save-manifest.ts`): the `node:fs` import is deferred to call time so\n * module load doesn't violate the package's `platform: 'neutral'` build\n * target. `loadChainDenomMap` is therefore async; consumers must\n * `await` the result. The other 3 exports (`humanizeCoin`,\n * `humanizeBalances`, `denomToSymbol`) remain pure-sync since they take\n * a pre-loaded `DenomMap` as input.\n *\n * Exports (all 4 preserved per qa-engineer's review pin — PR 2's internal\n * callers use a subset; PR 3 will surface the rest):\n *   - `loadChainDenomMap(chainDataFilePath?)` (ASYNC) — returns\n *     `Promise<DenomMap>`. Missing / unreadable path → no-op map\n *     (lookup always returns `null`). Read failures emit `console.warn`\n *     matching the connection.ts precedent from PR 1.\n *   - `humanizeCoin(amount, denom, denomMap)` — `\"<amount> <symbol>\"` or\n *     `\"<amount> <denom>\"` on unknown denom.\n *   - `humanizeBalances(coins, denomMap)` — joins multiple coins with\n *     `\", \"`. Empty array → `\"(empty)\"` literal.\n *   - `denomToSymbol(denom, denomMap)` — bare symbol or raw denom fallback.\n */\n\nimport type { DenomLookup, DenomMap } from '../types.js';\n\n// Re-export the public types for convenience to existing internal consumers\n// (this file's pre-PR-3 history exported DenomLookup + DenomMap directly).\n// Public consumers should import from `@manifest-network/manifest-agent-core`\n// (which re-exports `../types.js`); internal consumers can use either path.\nexport type { DenomLookup, DenomMap };\n\nconst KNOWN_EXPONENT = 6;\n\n/**\n * No-op `DenomMap` for callers without chain-data context. All lookups\n * return `null`; `humanizeCoin` falls back to raw on-chain denoms.\n * Exported so synchronous decision functions (e.g. `evaluateReadiness`)\n * can default to it without needing to invoke the async loader.\n */\nexport const EMPTY_DENOM_MAP: DenomMap = { lookup: () => null, raw: null };\n\nexport async function loadChainDenomMap(\n  chainDataFilePath?: string,\n): Promise<DenomMap> {\n  if (!chainDataFilePath) return EMPTY_DENOM_MAP;\n  if (\n    typeof process === 'undefined' ||\n    typeof process.versions?.node !== 'string'\n  ) {\n    // Lazy node-only dep — refuse outside Node-like runtimes rather than\n    // silently no-op'ing (which would hide a misconfiguration).\n    throw new Error(\n      'loadChainDenomMap: chainDataFilePath requires a Node.js runtime (node:fs unavailable in this environment)',\n    );\n  }\n  let raw: unknown;\n  try {\n    const { readFileSync } = await import('node:fs');\n    raw = JSON.parse(readFileSync(chainDataFilePath, 'utf8'));\n  } catch (err) {\n    // CJS parity: warn loudly when a path was passed but read/parse failed.\n    // A corrupted chain file silently downgrades all balance/fee rendering to\n    // raw chain denoms across the package, and the user only notices because\n    // the DeploymentPlan looks weird (\"0.000037 PWR\" vs \"37 upwr\"). Matches\n    // connection.ts's `console.warn` default established in PR 1.\n    const message = err instanceof Error ? err.message : String(err);\n    console.warn(\n      `humanize-denom: failed to load ${chainDataFilePath}: ${message}; ` +\n        `balances and fees will render with raw on-chain denoms.`,\n    );\n    return EMPTY_DENOM_MAP;\n  }\n\n  // Normalize the feeTokens list into a denom → { symbol, exponent } map.\n  // Every Manifest fee token uses 6 decimals (the leading `u` is the micro\n  // prefix). Tokens not in feeTokens are unknown to us; the fallback branch\n  // in humanizeCoin handles them.\n  const map = new Map<string, DenomLookup>();\n  if (raw !== null && typeof raw === 'object') {\n    const feeTokens = (raw as { feeTokens?: unknown }).feeTokens;\n    if (Array.isArray(feeTokens)) {\n      for (const t of feeTokens) {\n        if (\n          t !== null &&\n          typeof t === 'object' &&\n          typeof (t as { denom?: unknown }).denom === 'string' &&\n          typeof (t as { symbol?: unknown }).symbol === 'string'\n        ) {\n          const token = t as { denom: string; symbol: string };\n          map.set(token.denom, {\n            symbol: token.symbol,\n            exponent: KNOWN_EXPONENT,\n          });\n        }\n      }\n    }\n  }\n\n  return {\n    lookup: (denom) => {\n      if (typeof denom !== 'string') return null;\n      return map.get(denom) ?? null;\n    },\n    raw,\n  };\n}\n\n/**\n * Convert a smallest-unit amount string → human decimal string with up to\n * `exponent` decimals, trimming trailing zeros for readability. Uses BigInt\n * for the integer part so precision survives large balances; only the\n * fractional remainder is divided.\n *\n * Exported for unit testing of the scaling logic in isolation (mirrors the\n * CJS's `_fmtScaledAmount` test hook).\n */\nexport function _fmtScaledAmount(amount: string, exponent: number): string {\n  let digits: bigint;\n  try {\n    digits = BigInt(amount);\n  } catch {\n    return String(amount);\n  }\n  const negative = digits < 0n;\n  if (negative) digits = -digits;\n  const divisor = 10n ** BigInt(exponent);\n  const whole = digits / divisor;\n  const frac = digits % divisor;\n  const fracStr = frac.toString().padStart(exponent, '0').replace(/0+$/, '');\n  let out = fracStr.length > 0 ? `${whole}.${fracStr}` : `${whole}`;\n  if (negative) out = `-${out}`;\n  return out;\n}\n\n/**\n * Render a single coin as `\"<amount> <symbol>\"` (when the denom is in the\n * map) or `\"<amount> <denom>\"` verbatim (when unknown). Falls back to\n * `\"<amount>\"` only when `denom` is null/undefined.\n */\nexport function humanizeCoin(\n  amount: string,\n  denom: string | null | undefined,\n  denomMap: DenomMap,\n): string {\n  if (denom === undefined || denom === null) return `${amount}`;\n  const lookup = denomMap.lookup(denom);\n  if (lookup) {\n    return `${_fmtScaledAmount(amount, lookup.exponent)} ${lookup.symbol}`;\n  }\n  // Best-effort unknown-denom rendering — keep the raw denom so the user\n  // can still identify it, and don't guess at scaling.\n  return `${amount} ${denom}`;\n}\n\n/**\n * Join multiple coins with `\", \"` (space after comma). Empty array →\n * literal `\"(empty)\"` per CJS parity.\n */\nexport function humanizeBalances(\n  balances: ReadonlyArray<{ denom?: string; amount?: string | null }> | unknown,\n  denomMap: DenomMap,\n): string {\n  if (!Array.isArray(balances) || balances.length === 0) return '(empty)';\n  return balances\n    .map((b) => {\n      const amount =\n        b !== null && typeof b === 'object' && 'amount' in b && b.amount != null\n          ? String(b.amount)\n          : '0';\n      const denom =\n        b !== null && typeof b === 'object' && 'denom' in b\n          ? (b.denom as string | null | undefined)\n          : undefined;\n      return humanizeCoin(amount, denom, denomMap);\n    })\n    .join(', ');\n}\n\n/**\n * Return the friendly symbol for a chain denom (`\"umfx\"` → `\"MFX\"`) via\n * the same lookup `humanizeCoin` uses. Falls back to the raw denom on\n * unknown input. Avoids the brittle pattern of formatting `\"0 MFX\"` and\n * string-splitting to recover `\"MFX\"`.\n */\nexport function denomToSymbol(\n  denom: string | null | undefined,\n  denomMap: DenomMap,\n): string {\n  if (!denom) return String(denom ?? '');\n  const lookup = denomMap.lookup(denom);\n  return lookup?.symbol ?? denom;\n}\n"],"mappings":";AA8CA,MAAM,iBAAiB;;;;;;;AAQvB,MAAa,kBAA4B;CAAE,cAAc;CAAM,KAAK;CAAM;AAE1E,eAAsB,kBACpB,mBACmB;AACnB,KAAI,CAAC,kBAAmB,QAAO;AAC/B,KACE,OAAO,YAAY,eACnB,OAAO,QAAQ,UAAU,SAAS,SAIlC,OAAM,IAAI,MACR,4GACD;CAEH,IAAI;AACJ,KAAI;EACF,MAAM,EAAE,iBAAiB,MAAM,OAAO;AACtC,QAAM,KAAK,MAAM,aAAa,mBAAmB,OAAO,CAAC;UAClD,KAAK;EAMZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,UAAQ,KACN,kCAAkC,kBAAkB,IAAI,QAAQ,2DAEjE;AACD,SAAO;;CAOT,MAAM,sBAAM,IAAI,KAA0B;AAC1C,KAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;EAC3C,MAAM,YAAa,IAAgC;AACnD,MAAI,MAAM,QAAQ,UAAU;QACrB,MAAM,KAAK,UACd,KACE,MAAM,QACN,OAAO,MAAM,YACb,OAAQ,EAA0B,UAAU,YAC5C,OAAQ,EAA2B,WAAW,UAC9C;IACA,MAAM,QAAQ;AACd,QAAI,IAAI,MAAM,OAAO;KACnB,QAAQ,MAAM;KACd,UAAU;KACX,CAAC;;;;AAMV,QAAO;EACL,SAAS,UAAU;AACjB,OAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAO,IAAI,IAAI,MAAM,IAAI;;EAE3B;EACD;;;;;;;;;;;AAYH,SAAgB,iBAAiB,QAAgB,UAA0B;CACzE,IAAI;AACJ,KAAI;AACF,WAAS,OAAO,OAAO;SACjB;AACN,SAAO,OAAO,OAAO;;CAEvB,MAAM,WAAW,SAAS;AAC1B,KAAI,SAAU,UAAS,CAAC;CACxB,MAAM,UAAU,OAAO,OAAO,SAAS;CACvC,MAAM,QAAQ,SAAS;CAEvB,MAAM,WADO,SAAS,SACD,UAAU,CAAC,SAAS,UAAU,IAAI,CAAC,QAAQ,OAAO,GAAG;CAC1E,IAAI,MAAM,QAAQ,SAAS,IAAI,GAAG,MAAM,GAAG,YAAY,GAAG;AAC1D,KAAI,SAAU,OAAM,IAAI;AACxB,QAAO;;;;;;;AAQT,SAAgB,aACd,QACA,OACA,UACQ;AACR,KAAI,UAAU,KAAA,KAAa,UAAU,KAAM,QAAO,GAAG;CACrD,MAAM,SAAS,SAAS,OAAO,MAAM;AACrC,KAAI,OACF,QAAO,GAAG,iBAAiB,QAAQ,OAAO,SAAS,CAAC,GAAG,OAAO;AAIhE,QAAO,GAAG,OAAO,GAAG;;;;;;AAOtB,SAAgB,iBACd,UACA,UACQ;AACR,KAAI,CAAC,MAAM,QAAQ,SAAS,IAAI,SAAS,WAAW,EAAG,QAAO;AAC9D,QAAO,SACJ,KAAK,MAAM;AASV,SAAO,aAPL,MAAM,QAAQ,OAAO,MAAM,YAAY,YAAY,KAAK,EAAE,UAAU,OAChE,OAAO,EAAE,OAAO,GAChB,KAEJ,MAAM,QAAQ,OAAO,MAAM,YAAY,WAAW,IAC7C,EAAE,QACH,KAAA,GAC6B,SAAS;GAC5C,CACD,KAAK,KAAK;;;;;;;;AASf,SAAgB,cACd,OACA,UACQ;AACR,KAAI,CAAC,MAAO,QAAO,OAAO,SAAS,GAAG;AAEtC,QADe,SAAS,OAAO,MAClB,EAAE,UAAU"}