dexe-mcp 0.19.0 → 0.20.1

package/dist/lib/avatarImage.js

@@ -0,0 +1,199 @@
+/**
+ * Deterministic raster avatar renderer.
+ *
+ * Replaces the old SVG identicon: the DeXe serving chain (Go ipfs-cache →
+ * R2 `<descCid>.jpeg` with hardcoded image/jpeg) only renders real raster
+ * bytes, so we rasterize the same design — 1–2 initials over a hash-coloured
+ * diagonal gradient — and encode an actual JPEG. Pure JS: RGBA buffer +
+ * embedded 8x8 bitmap font + jpeg-js. No canvas, no native deps.
+ *
+ * Same daoName → byte-identical output (all constants fixed, no randomness).
+ */
+import jpegJs from "jpeg-js";
+/** djb2-style hash → unsigned 32-bit. Kept identical to the legacy SVG identicon so re-generated avatars keep their colours. */
+export function hashString(s) {
+    let h = 5381;
+    for (let i = 0; i < s.length; i++)
+        h = ((h << 5) + h + s.charCodeAt(i)) >>> 0;
+    return h >>> 0;
+}
+/** First 1–2 alphanumeric characters of the DAO name, uppercased ("?" fallback). */
+export function avatarInitials(daoName) {
+    const cleaned = daoName.replace(/[^\p{L}\p{N}]/gu, "");
+    return (cleaned.slice(0, 2) || "?").toUpperCase();
+}
+/**
+ * 8x8 bitmap font (font8x8_basic, public domain — Daniel Hepper).
+ * Row bytes top→bottom; bit n of a row = pixel at x=n (LSB is the LEFT column).
+ */
+const FONT_8X8 = {
+    "0": [0x3e, 0x63, 0x73, 0x7b, 0x6f, 0x67, 0x3e, 0x00],
+    "1": [0x0c, 0x0e, 0x0c, 0x0c, 0x0c, 0x0c, 0x3f, 0x00],
+    "2": [0x1e, 0x33, 0x30, 0x1c, 0x06, 0x33, 0x3f, 0x00],
+    "3": [0x1e, 0x33, 0x30, 0x1c, 0x30, 0x33, 0x1e, 0x00],
+    "4": [0x38, 0x3c, 0x36, 0x33, 0x7f, 0x30, 0x78, 0x00],
+    "5": [0x3f, 0x03, 0x1f, 0x30, 0x30, 0x33, 0x1e, 0x00],
+    "6": [0x1c, 0x06, 0x03, 0x1f, 0x33, 0x33, 0x1e, 0x00],
+    "7": [0x3f, 0x33, 0x30, 0x18, 0x0c, 0x0c, 0x0c, 0x00],
+    "8": [0x1e, 0x33, 0x33, 0x1e, 0x33, 0x33, 0x1e, 0x00],
+    "9": [0x1e, 0x33, 0x33, 0x3e, 0x30, 0x18, 0x0e, 0x00],
+    A: [0x0c, 0x1e, 0x33, 0x33, 0x3f, 0x33, 0x33, 0x00],
+    B: [0x3f, 0x66, 0x66, 0x3e, 0x66, 0x66, 0x3f, 0x00],
+    C: [0x3c, 0x66, 0x03, 0x03, 0x03, 0x66, 0x3c, 0x00],
+    D: [0x1f, 0x36, 0x66, 0x66, 0x66, 0x36, 0x1f, 0x00],
+    E: [0x7f, 0x46, 0x16, 0x1e, 0x16, 0x46, 0x7f, 0x00],
+    F: [0x7f, 0x46, 0x16, 0x1e, 0x16, 0x06, 0x0f, 0x00],
+    G: [0x3c, 0x66, 0x03, 0x03, 0x73, 0x66, 0x7c, 0x00],
+    H: [0x33, 0x33, 0x33, 0x3f, 0x33, 0x33, 0x33, 0x00],
+    I: [0x1e, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x1e, 0x00],
+    J: [0x78, 0x30, 0x30, 0x30, 0x33, 0x33, 0x1e, 0x00],
+    K: [0x67, 0x66, 0x36, 0x1e, 0x36, 0x66, 0x67, 0x00],
+    L: [0x0f, 0x06, 0x06, 0x06, 0x46, 0x66, 0x7f, 0x00],
+    M: [0x63, 0x77, 0x7f, 0x7f, 0x6b, 0x63, 0x63, 0x00],
+    N: [0x63, 0x67, 0x6f, 0x7b, 0x73, 0x63, 0x63, 0x00],
+    O: [0x1c, 0x36, 0x63, 0x63, 0x63, 0x36, 0x1c, 0x00],
+    P: [0x3f, 0x66, 0x66, 0x3e, 0x06, 0x06, 0x0f, 0x00],
+    Q: [0x1e, 0x33, 0x33, 0x33, 0x3b, 0x1e, 0x38, 0x00],
+    R: [0x3f, 0x66, 0x66, 0x3e, 0x36, 0x66, 0x67, 0x00],
+    S: [0x1e, 0x33, 0x07, 0x0e, 0x38, 0x33, 0x1e, 0x00],
+    T: [0x3f, 0x2d, 0x0c, 0x0c, 0x0c, 0x0c, 0x1e, 0x00],
+    U: [0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x3f, 0x00],
+    V: [0x33, 0x33, 0x33, 0x33, 0x33, 0x1e, 0x0c, 0x00],
+    W: [0x63, 0x63, 0x63, 0x6b, 0x7f, 0x77, 0x63, 0x00],
+    X: [0x63, 0x63, 0x36, 0x1c, 0x1c, 0x36, 0x63, 0x00],
+    Y: [0x33, 0x33, 0x33, 0x1e, 0x0c, 0x0c, 0x1e, 0x00],
+    Z: [0x7f, 0x63, 0x31, 0x18, 0x4c, 0x66, 0x7f, 0x00],
+    "?": [0x1e, 0x33, 0x30, 0x18, 0x0c, 0x00, 0x0c, 0x00],
+};
+/** hsl (deg, 0–1, 0–1) → [r, g, b] 0–255. Matches CSS hsl() as used by the legacy SVG. */
+function hslToRgb(h, s, l) {
+    const c = (1 - Math.abs(2 * l - 1)) * s;
+    const hp = ((h % 360) + 360) % 360 / 60;
+    const x = c * (1 - Math.abs((hp % 2) - 1));
+    let r = 0;
+    let g = 0;
+    let b = 0;
+    if (hp < 1)
+        [r, g, b] = [c, x, 0];
+    else if (hp < 2)
+        [r, g, b] = [x, c, 0];
+    else if (hp < 3)
+        [r, g, b] = [0, c, x];
+    else if (hp < 4)
+        [r, g, b] = [0, x, c];
+    else if (hp < 5)
+        [r, g, b] = [x, 0, c];
+    else
+        [r, g, b] = [c, 0, x];
+    const m = l - c / 2;
+    return [Math.round((r + m) * 255), Math.round((g + m) * 255), Math.round((b + m) * 255)];
+}
+const GLYPH_GAP_COLS = 2; // font-pixel columns between two initials
+const BLOCK_WIDTH_RATIO = 0.62; // initials block ≈ 62% of image width
+const JPEG_QUALITY = 90;
+const SUPERSAMPLE = 2;
+/**
+ * Render the avatar and encode as JPEG. `size` is the output square in px.
+ * Renders at 2x and box-downscales, so glyph edges pick up light smoothing
+ * when the pixel scale is odd.
+ */
+export function renderAvatarJpeg(daoName, size = 512) {
+    const h = hashString(daoName);
+    const hue1 = h % 360;
+    const hue2 = (hue1 + 40 + ((h >>> 8) % 80)) % 360;
+    const c1 = hslToRgb(hue1, 0.7, 0.55);
+    const c2 = hslToRgb(hue2, 0.7, 0.35);
+    const big = size * SUPERSAMPLE;
+    const rgba = new Uint8Array(big * big * 4);
+    // Diagonal gradient, top-left c1 → bottom-right c2 (same axis as the old
+    // SVG linearGradient x1=0,y1=0 → x2=1,y2=1).
+    const denom = 2 * (big - 1) || 1;
+    for (let y = 0; y < big; y++) {
+        for (let x = 0; x < big; x++) {
+            const t = (x + y) / denom;
+            const i = (y * big + x) * 4;
+            rgba[i] = Math.round(c1[0] + (c2[0] - c1[0]) * t);
+            rgba[i + 1] = Math.round(c1[1] + (c2[1] - c1[1]) * t);
+            rgba[i + 2] = Math.round(c1[2] + (c2[2] - c1[2]) * t);
+            rgba[i + 3] = 255;
+        }
+    }
+    // Initials, centered, white. font8x8 glyphs lean into the low columns, so
+    // crop each glyph to its used column range before laying out — otherwise
+    // the block sits visibly off-center.
+    const initials = avatarInitials(daoName);
+    const glyphs = [...initials].map((ch) => FONT_8X8[ch] ?? FONT_8X8["?"]);
+    const bounds = glyphs.map((glyph) => {
+        let mask = 0;
+        for (const row of glyph)
+            mask |= row;
+        if (mask === 0)
+            return { minCol: 0, width: 8 };
+        let minCol = 0;
+        while (((mask >> minCol) & 1) === 0)
+            minCol++;
+        let maxCol = 7;
+        while (((mask >> maxCol) & 1) === 0)
+            maxCol--;
+        return { minCol, width: maxCol - minCol + 1 };
+    });
+    const blockCols = bounds.reduce((sum, b) => sum + b.width, 0) + (glyphs.length - 1) * GLYPH_GAP_COLS;
+    // Clamp by height too: a single narrow glyph (e.g. "I", cropped width 4)
+    // would otherwise scale past the canvas vertically and clip at the top.
+    // Same ratio on both axes keeps margins consistent.
+    const scale = Math.max(1, Math.min(Math.floor((big * BLOCK_WIDTH_RATIO) / blockCols), Math.floor((big * BLOCK_WIDTH_RATIO) / 8)));
+    const blockW = blockCols * scale;
+    const blockH = 8 * scale;
+    const originX = (big - blockW) >> 1;
+    const originY = (big - blockH) >> 1;
+    let glyphX = originX;
+    glyphs.forEach((glyph, gi) => {
+        const { minCol, width } = bounds[gi];
+        for (let row = 0; row < 8; row++) {
+            const bits = glyph[row];
+            if (bits === 0)
+                continue;
+            for (let col = minCol; col < minCol + width; col++) {
+                if (((bits >> col) & 1) === 0)
+                    continue;
+                const px = glyphX + (col - minCol) * scale;
+                const py = originY + row * scale;
+                for (let dy = 0; dy < scale; dy++) {
+                    const rowBase = (py + dy) * big;
+                    for (let dx = 0; dx < scale; dx++) {
+                        const i = (rowBase + px + dx) * 4;
+                        rgba[i] = 255;
+                        rgba[i + 1] = 255;
+                        rgba[i + 2] = 255;
+                    }
+                }
+            }
+        }
+        glyphX += (width + GLYPH_GAP_COLS) * scale;
+    });
+    // Box-downscale SUPERSAMPLE× → final size.
+    const out = Buffer.alloc(size * size * 4);
+    const n = SUPERSAMPLE * SUPERSAMPLE;
+    for (let y = 0; y < size; y++) {
+        for (let x = 0; x < size; x++) {
+            let r = 0;
+            let g = 0;
+            let b = 0;
+            for (let dy = 0; dy < SUPERSAMPLE; dy++) {
+                for (let dx = 0; dx < SUPERSAMPLE; dx++) {
+                    const i = ((y * SUPERSAMPLE + dy) * big + x * SUPERSAMPLE + dx) * 4;
+                    r += rgba[i];
+                    g += rgba[i + 1];
+                    b += rgba[i + 2];
+                }
+            }
+            const o = (y * size + x) * 4;
+            out[o] = Math.round(r / n);
+            out[o + 1] = Math.round(g / n);
+            out[o + 2] = Math.round(b / n);
+            out[o + 3] = 255;
+        }
+    }
+    return jpegJs.encode({ data: out, width: size, height: size }, JPEG_QUALITY).data;
+}
+//# sourceMappingURL=avatarImage.js.map

package/dist/lib/avatarImage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarImage.js","sourceRoot":"","sources":["../../src/lib/avatarImage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,gIAAgI;AAChI,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,QAAQ,GAAsC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACrD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACtD,CAAC;AAEF,0FAA0F;AAC1F,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,GAAG,CAAC;QAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SAC7B,IAAI,EAAE,GAAG,CAAC;QAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SAClC,IAAI,EAAE,GAAG,CAAC;QAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SAClC,IAAI,EAAE,GAAG,CAAC;QAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SAClC,IAAI,EAAE,GAAG,CAAC;QAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;;QAClC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,0CAA0C;AACpE,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,sCAAsC;AACtE,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAI,GAAG,GAAG;IAC1D,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;IAClD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAErC,MAAM,GAAG,GAAG,IAAI,GAAG,WAAW,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;IAE3C,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,IAAI,IAAI,GAAG,CAAC;QACrC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,EAAE,CAAC;QAC9C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC;IACrG,yEAAyE;IACzE,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,iBAAiB,CAAC,GAAG,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CACvG,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,EAAE,CAAE,CAAC;QACtC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;YACzB,IAAI,IAAI,KAAK,CAAC;gBAAE,SAAS;YACzB,KAAK,IAAI,GAAG,GAAG,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACxC,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC;gBAC3C,MAAM,EAAE,GAAG,OAAO,GAAG,GAAG,GAAG,KAAK,CAAC;gBACjC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;oBAClC,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;oBAChC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;wBAClC,MAAM,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;wBAClC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;wBACd,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;wBAClB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,WAAW,GAAG,WAAW,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;gBACxC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;oBACxC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,WAAW,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;oBACpE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC;oBACd,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;oBAClB,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC"}

package/dist/lib/imageSniff.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Magic-byte sniffing for avatar uploads.
+ *
+ * The DeXe serving chain is unforgiving about content type: the Go
+ * `ipfs-cache` service copies DAO avatar bytes to R2 under `<descCid>.jpeg`
+ * with a hardcoded `image/jpeg` content-type and no byte inspection, and the
+ * app.dexe.io `<img>` has no error fallback after a successful GET. Raster
+ * bytes (JPEG/PNG/WebP/GIF) survive that because browsers content-sniff
+ * rasters inside `<img>`; SVG does not — browsers never sniff SVG, so SVG
+ * bytes labeled `image/jpeg` render as a broken image. Hence: validate what
+ * the caller claims against what the bytes actually are.
+ */
+export type SniffedImageFormat = "jpeg" | "png" | "webp" | "gif" | "svg" | "html" | "unknown";
+export type RasterFormat = Extract<SniffedImageFormat, "jpeg" | "png" | "webp" | "gif">;
+/** Identify an image (or image impostor) by its magic bytes. */
+export declare function sniffImageFormat(bytes: Uint8Array): SniffedImageFormat;
+/**
+ * Gate for every avatar upload path. Returns the detected raster format and
+ * its true MIME type, or throws an actionable error for anything that would
+ * end up as a permanently broken avatar on app.dexe.io.
+ */
+export declare function assertRasterAvatar(bytes: Uint8Array): {
+    format: RasterFormat;
+    mime: string;
+};
+/**
+ * Best-effort remote validation for avatar CIDs passed **by reference**
+ * (dexe_ipfs_upload_dao_metadata / dexe_ipfs_update_dao_metadata /
+ * dexe_dao_create take an avatarCID that was pinned elsewhere, so the local
+ * byte gate never saw it). Fetches the first KB of `<cid>/<fileName>` off the
+ * gateway chain and sniffs it.
+ *
+ * Verdicts:
+ * - `{ ok: true }`                 — bytes fetched, real raster.
+ * - `{ ok: false, error }`         — bytes fetched, NOT a raster → hard-block.
+ * - `{ ok: true, warning }`        — unreachable/timeout (fresh pins often
+ *   haven't propagated to gateways yet) → proceed, surface the warning.
+ */
+export declare function checkAvatarCidBytes(cid: string, fileName: string, gateways: string[], perRequestTimeoutMs?: number): Promise<{
+    ok: boolean;
+    error?: string;
+    warning?: string;
+}>;
+//# sourceMappingURL=imageSniff.d.ts.map

package/dist/lib/imageSniff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imageSniff.d.ts","sourceRoot":"","sources":["../../src/lib/imageSniff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAE9F,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;AAmBxF,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAuBtE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA0B5F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAAE,EAClB,mBAAmB,SAAO,GACzB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2C5D"}

package/dist/lib/imageSniff.js

@@ -0,0 +1,145 @@
+/**
+ * Magic-byte sniffing for avatar uploads.
+ *
+ * The DeXe serving chain is unforgiving about content type: the Go
+ * `ipfs-cache` service copies DAO avatar bytes to R2 under `<descCid>.jpeg`
+ * with a hardcoded `image/jpeg` content-type and no byte inspection, and the
+ * app.dexe.io `<img>` has no error fallback after a successful GET. Raster
+ * bytes (JPEG/PNG/WebP/GIF) survive that because browsers content-sniff
+ * rasters inside `<img>`; SVG does not — browsers never sniff SVG, so SVG
+ * bytes labeled `image/jpeg` render as a broken image. Hence: validate what
+ * the caller claims against what the bytes actually are.
+ */
+const RASTER_MIME = {
+    jpeg: "image/jpeg",
+    png: "image/png",
+    webp: "image/webp",
+    gif: "image/gif",
+};
+const PNG_SIG = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+function startsWith(bytes, sig, offset = 0) {
+    if (bytes.length < offset + sig.length)
+        return false;
+    for (let i = 0; i < sig.length; i++) {
+        if (bytes[offset + i] !== sig[i])
+            return false;
+    }
+    return true;
+}
+/** Identify an image (or image impostor) by its magic bytes. */
+export function sniffImageFormat(bytes) {
+    if (startsWith(bytes, [0xff, 0xd8, 0xff]))
+        return "jpeg";
+    if (startsWith(bytes, PNG_SIG))
+        return "png";
+    if (startsWith(bytes, [0x47, 0x49, 0x46, 0x38, 0x37, 0x61]) || startsWith(bytes, [0x47, 0x49, 0x46, 0x38, 0x39, 0x61])) {
+        return "gif";
+    }
+    // RIFF....WEBP
+    if (startsWith(bytes, [0x52, 0x49, 0x46, 0x46]) && startsWith(bytes, [0x57, 0x45, 0x42, 0x50], 8)) {
+        return "webp";
+    }
+    // Text-based impostors: skip BOM + leading whitespace (trimStart strips
+    // U+FEFF too — it's spec whitespace), look at the first tag.
+    const head = Buffer.from(bytes.slice(0, 512))
+        .toString("utf8")
+        .trimStart()
+        .toLowerCase();
+    if (head.startsWith("<?xml") || head.startsWith("<svg"))
+        return "svg";
+    if (head.startsWith("<!doctype")) {
+        // `<!DOCTYPE svg ...>` is a legal SVG prologue — don't call it HTML.
+        return /^<!doctype\s+svg/.test(head) ? "svg" : "html";
+    }
+    if (head.startsWith("<html"))
+        return "html";
+    return "unknown";
+}
+/**
+ * Gate for every avatar upload path. Returns the detected raster format and
+ * its true MIME type, or throws an actionable error for anything that would
+ * end up as a permanently broken avatar on app.dexe.io.
+ */
+export function assertRasterAvatar(bytes) {
+    const format = sniffImageFormat(bytes);
+    switch (format) {
+        case "jpeg":
+        case "png":
+        case "webp":
+        case "gif":
+            return { format, mime: RASTER_MIME[format] };
+        case "svg":
+            throw new Error("Avatar bytes are SVG, which never renders on app.dexe.io: the ipfs-cache service serves DAO avatars " +
+                "with a hardcoded image/jpeg content-type and browsers refuse SVG bytes labeled image/jpeg. " +
+                "Provide real raster bytes (JPEG/PNG/WebP/GIF), or use dexe_dao_generate_avatar to get a valid JPEG.");
+        case "html":
+            throw new Error("Avatar bytes look like an HTML page, not an image — most likely a gateway error/directory-listing page " +
+                "was downloaded instead of the image file. Re-fetch the image (use the full <cid>/<fileName> path, " +
+                "not the bare CID) and upload the actual raster bytes.");
+        default:
+            throw new Error("Avatar bytes are not a recognized raster image — expected JPEG (FF D8 FF), PNG, WebP, or GIF magic bytes. " +
+                "Check that the base64 payload is the image file itself (not a data: URL wrapper or a truncated buffer).");
+    }
+}
+/**
+ * Best-effort remote validation for avatar CIDs passed **by reference**
+ * (dexe_ipfs_upload_dao_metadata / dexe_ipfs_update_dao_metadata /
+ * dexe_dao_create take an avatarCID that was pinned elsewhere, so the local
+ * byte gate never saw it). Fetches the first KB of `<cid>/<fileName>` off the
+ * gateway chain and sniffs it.
+ *
+ * Verdicts:
+ * - `{ ok: true }`                 — bytes fetched, real raster.
+ * - `{ ok: false, error }`         — bytes fetched, NOT a raster → hard-block.
+ * - `{ ok: true, warning }`        — unreachable/timeout (fresh pins often
+ *   haven't propagated to gateways yet) → proceed, surface the warning.
+ */
+export async function checkAvatarCidBytes(cid, fileName, gateways, perRequestTimeoutMs = 4000) {
+    const pinataGatewayToken = process.env.DEXE_PINATA_GATEWAY_TOKEN?.trim();
+    for (const gw of gateways.slice(0, 3)) {
+        const base = gw.replace(/\/+$/, "").replace(/\/ipfs$/, "");
+        const url = `${base}/ipfs/${cid}/${fileName}`;
+        const controller = new AbortController();
+        const t = setTimeout(() => controller.abort(), perRequestTimeoutMs);
+        try {
+            const headers = { Range: "bytes=0-1023" };
+            let host = null;
+            try {
+                host = new URL(base).hostname;
+            }
+            catch {
+                host = null;
+            }
+            if (pinataGatewayToken && host && (host === "mypinata.cloud" || host.endsWith(".mypinata.cloud"))) {
+                headers["x-pinata-gateway-token"] = pinataGatewayToken;
+            }
+            const res = await fetch(url, { headers, signal: controller.signal });
+            if (!res.ok)
+                continue;
+            const head = new Uint8Array(await res.arrayBuffer());
+            try {
+                assertRasterAvatar(head);
+                return { ok: true };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: `avatarCID ${cid}/${fileName} does not contain a usable avatar: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+        }
+        catch {
+            // gateway unreachable/timeout — try the next one
+        }
+        finally {
+            clearTimeout(t);
+        }
+    }
+    return {
+        ok: true,
+        warning: `avatar bytes at ${cid}/${fileName} were not reachable on any configured gateway (fresh pins can take a while ` +
+            `to propagate) — byte validation skipped. If this CID did not come from dexe_ipfs_upload_avatar or ` +
+            `dexe_dao_generate_avatar, verify it is a real raster image.`,
+    };
+}
+//# sourceMappingURL=imageSniff.js.map

package/dist/lib/imageSniff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imageSniff.js","sourceRoot":"","sources":["../../src/lib/imageSniff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,GAAiC;IAChD,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEjE,SAAS,UAAU,CAAC,KAAiB,EAAE,GAAa,EAAE,MAAM,GAAG,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,eAAe;IACf,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC1C,QAAQ,CAAC,MAAM,CAAC;SAChB,SAAS,EAAE;SACX,WAAW,EAAE,CAAC;IACjB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,qEAAqE;QACrE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,KAAK,KAAK;YACR,MAAM,IAAI,KAAK,CACb,sGAAsG;gBACpG,6FAA6F;gBAC7F,qGAAqG,CACxG,CAAC;QACJ,KAAK,MAAM;YACT,MAAM,IAAI,KAAK,CACb,yGAAyG;gBACvG,oGAAoG;gBACpG,uDAAuD,CAC1D,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CACb,4GAA4G;gBAC1G,yGAAyG,CAC5G,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,QAAgB,EAChB,QAAkB,EAClB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACzE,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YAClE,IAAI,IAAI,GAAkB,IAAI,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YACD,IAAI,kBAAkB,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBAClG,OAAO,CAAC,wBAAwB,CAAC,GAAG,kBAAkB,CAAC;YACzD,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,aAAa,GAAG,IAAI,QAAQ,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBAC5H,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EACL,mBAAmB,GAAG,IAAI,QAAQ,6EAA6E;YAC/G,oGAAoG;YACpG,6DAA6D;KAChE,CAAC;AACJ,CAAC"}

package/dist/lib/qr.d.ts

@@ -20,7 +20,7 @@ export declare function renderQr(text: string): Promise<RenderedQr>;
 /** External fallback image URL for clients that can render neither ASCII nor an image block. */
 export declare function qrFallbackUrl(uri: string): string;
 /** One MCP `content[]` item — text or image. Kept loose to match the tool call sites. */
-type PairingContent = {
+export type PairingContent = {
     type: "text";
     text: string;
 } | {
@@ -28,6 +28,14 @@ type PairingContent = {
     data: string;
     mimeType: string;
 };
+/**
+ * Just the scannable part of a pairing response: a captioned ASCII QR text
+ * block plus an `image/png` block. Composite write flows attach these to
+ * their no-signer responses so the QR renders inline exactly like
+ * `dexe_wc_connect` — the JSON envelope stays the caller's business.
+ * Empty array when QR rendering is unavailable.
+ */
+export declare function wcQrBlocks(uri: string): Promise<PairingContent[]>;
 /**
  * Build the MCP `content[]` for a WalletConnect pairing response, shared by
  * `dexe_wc_connect` and `dexe_tx_send`'s auto-pairing branch so the QR + the
@@ -39,5 +47,4 @@ type PairingContent = {
  *      `renderHint` telling the assistant to echo the ASCII block verbatim.
  */
 export declare function wcPairingContent(uri: string, chainId: number, extra?: Record<string, unknown>): Promise<PairingContent[]>;
-export {};
 //# sourceMappingURL=qr.d.ts.map

package/dist/lib/qr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qr.d.ts","sourceRoot":"","sources":["../../src/lib/qr.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAqBD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBhE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,yFAAyF;AACzF,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,cAAc,EAAE,CAAC,CAkC3B"}
+{"version":3,"file":"qr.d.ts","sourceRoot":"","sources":["../../src/lib/qr.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAqBD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBhE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,yFAAyF;AACzF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAavE;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,cAAc,EAAE,CAAC,CAwB3B"}

package/dist/lib/qr.js

@@ -54,6 +54,27 @@ export async function renderQr(text) {
 export function qrFallbackUrl(uri) {
     return `https://api.qrserver.com/v1/create-qr-code/?size=400x400&data=${encodeURIComponent(uri)}`;
 }
+/**
+ * Just the scannable part of a pairing response: a captioned ASCII QR text
+ * block plus an `image/png` block. Composite write flows attach these to
+ * their no-signer responses so the QR renders inline exactly like
+ * `dexe_wc_connect` — the JSON envelope stays the caller's business.
+ * Empty array when QR rendering is unavailable.
+ */
+export async function wcQrBlocks(uri) {
+    const { ascii, pngBase64 } = await renderQr(uri);
+    const blocks = [];
+    if (ascii) {
+        blocks.push({
+            type: "text",
+            text: `📱 Scan with your phone wallet (MetaMask / Trust / Rainbow):\n\n${ascii}`,
+        });
+    }
+    if (pngBase64) {
+        blocks.push({ type: "image", data: pngBase64, mimeType: "image/png" });
+    }
+    return blocks;
+}
 /**
  * Build the MCP `content[]` for a WalletConnect pairing response, shared by
  * `dexe_wc_connect` and `dexe_tx_send`'s auto-pairing branch so the QR + the
@@ -65,17 +86,8 @@ export function qrFallbackUrl(uri) {
  *      `renderHint` telling the assistant to echo the ASCII block verbatim.
  */
 export async function wcPairingContent(uri, chainId, extra) {
-    const { ascii, pngBase64 } = await renderQr(uri);
-    const content = [];
-    if (ascii) {
-        content.push({
-            type: "text",
-            text: `📱 Scan with your phone wallet (MetaMask / Trust / Rainbow):\n\n${ascii}`,
-        });
-    }
-    if (pngBase64) {
-        content.push({ type: "image", data: pngBase64, mimeType: "image/png" });
-    }
+    const content = await wcQrBlocks(uri);
+    const hasAscii = content.some((c) => c.type === "text");
     content.push({
         type: "text",
         text: JSON.stringify({
@@ -83,7 +95,7 @@ export async function wcPairingContent(uri, chainId, extra) {
             chainId,
             uri,
             qrFallbackUrl: qrFallbackUrl(uri),
-            renderHint: ascii
+            renderHint: hasAscii
                 ? "Echo the ASCII QR block above VERBATIM in a code block so the user can scan it. Do not summarize or redraw it."
                 : "QR rendering unavailable — show the user `qrFallbackUrl` to open a scannable image, or `uri` to paste into their wallet.",
             next: "Approve the session on your phone, then poll dexe_wc_status until `connected` is true.",

package/dist/lib/qr.js.map

@@ -1 +1 @@
-{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/lib/qr.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,IAAI,MAAqC,CAAC;AAE1C,KAAK,UAAU,UAAU;IACvB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAA4B,CAAC;QAChE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAA8C,CAAC;QAC/D,MAAM,SAAS,GACb,CAAC,OAAQ,GAA8B,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,GAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7G,CAAC,GAAG,IAAI,OAAQ,GAA8B,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,GAA6B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvH,MAAM,GAAG,SAAS,IAAI,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAEjD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,kFAAkF;QAClF,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,iEAAiE,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;AACpG,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,OAAe,EACf,KAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,mEAAmE,KAAK,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;YACE,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,GAAG;YACH,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,UAAU,EAAE,KAAK;gBACf,CAAC,CAAC,gHAAgH;gBAClH,CAAC,CAAC,0HAA0H;YAC9H,IAAI,EAAE,wFAAwF;YAC9F,GAAG,KAAK;SACT,EACD,IAAI,EACJ,CAAC,CACF;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/lib/qr.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,IAAI,MAAqC,CAAC;AAE1C,KAAK,UAAU,UAAU;IACvB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAA4B,CAAC;QAChE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAA8C,CAAC;QAC/D,MAAM,SAAS,GACb,CAAC,OAAQ,GAA8B,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,GAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7G,CAAC,GAAG,IAAI,OAAQ,GAA8B,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,GAA6B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvH,MAAM,GAAG,SAAS,IAAI,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAEjD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,kFAAkF;QAClF,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,iEAAiE,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;AACpG,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,mEAAmE,KAAK,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,OAAe,EACf,KAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAExD,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;YACE,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,GAAG;YACH,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,UAAU,EAAE,QAAQ;gBAClB,CAAC,CAAC,gHAAgH;gBAClH,CAAC,CAAC,0HAA0H;YAC9H,IAAI,EAAE,wFAAwF;YAC9F,GAAG,KAAK;SACT,EACD,IAAI,EACJ,CAAC,CACF;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/tools/daoCreate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daoCreate.d.ts","sourceRoot":"","sources":["../../src/tools/daoCreate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAMpE,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AA6CvD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,MAAM,CAAC,CAAC;AASrE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,QAAQ,GAAG,YAAY,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAsDnF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,eAAe,GAAG;IACtD,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA6BA;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,oBAAoB,EACxB,KAAK,CAAC,EAAE,UAAU,GACjB,IAAI,CAgRN"}
+{"version":3,"file":"daoCreate.d.ts","sourceRoot":"","sources":["../../src/tools/daoCreate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAMpE,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AA+CvD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,MAAM,CAAC,CAAC;AASrE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,QAAQ,GAAG,YAAY,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAsDnF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,eAAe,GAAG;IACtD,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA6BA;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,oBAAoB,EACxB,KAAK,CAAC,EAAE,UAAU,GACjB,IAAI,CAwRN"}

package/dist/tools/daoCreate.js

@@ -5,10 +5,12 @@ import { PinataClient } from "../lib/ipfs.js";
 import { markdownToSlate } from "../lib/markdownToSlate.js";
 import { resolveChain } from "../config.js";
 import { pinataUploadHint } from "../lib/requireEnv.js";
-import { sendOrCollect } from "./flow.js";
+import { attachPairingQr, sendOrCollect } from "./flow.js";
 import { buildDeployGovPool, DeployParamsSchema } from "./daoDeploy.js";
 import { checkDeployCap, checkUserKeeperAsset, checkTreasuryRemainder, checkLinearInitData, checkQuorumReachable, assertPreflight, } from "../lib/preflight.js";
 import { quorumPctFromRaw } from "../lib/quorumRisk.js";
+import { checkAvatarCidBytes } from "../lib/imageSniff.js";
+import { resolveGateways } from "./ipfs.js";
 /**
  * `dexe_dao_create` — the one-call DAO deploy composite. Two ways to call it:
  *
@@ -326,6 +328,14 @@ export function registerDaoCreateTools(server, ctx, signer, wc, state) {
             documents: [],
         };
         if (input.avatarCID) {
+            // avatarCID arrives by reference — the upload tools validate their own
+            // bytes, but nothing forces the caller to have used them. Best-effort
+            // fetch + sniff; hard-block only on confirmed non-raster bytes (an SVG
+            // here becomes a permanently broken avatar on app.dexe.io).
+            const avatarCheck = await checkAvatarCidBytes(input.avatarCID, input.avatarFileName, resolveGateways(ctx));
+            if (!avatarCheck.ok) {
+                return err(avatarCheck.error ?? "avatarCID failed raster validation");
+            }
             daoMeta.avatarCID = input.avatarCID;
             daoMeta.avatarFileName = input.avatarFileName;
             daoMeta.avatarUrl = `https://${input.avatarCID}.ipfs.dweb.link/${input.avatarFileName}`;
@@ -373,7 +383,7 @@ export function registerDaoCreateTools(server, ctx, signer, wc, state) {
                 /* ignore */
             }
         }
-        return ok({
+        return attachPairingQr(ok({
             mode: result.mode,
             daoName: input.daoName,
             chainId,
@@ -385,7 +395,7 @@ export function registerDaoCreateTools(server, ctx, signer, wc, state) {
             steps: result.steps,
             ...(result.enableWrites ? { enableWrites: result.enableWrites } : {}),
             ...(result.pairing ? { pairing: result.pairing } : {}),
-        });
+        }), result.pairingContent);
     });
 }
 //# sourceMappingURL=daoCreate.js.map