dexe-mcp 0.8.3 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 0.9.0 — 2026-06-02
+
+### Security hardening (red-team audit remediation)
+
+Remediates the `dexe-mcp@0.7.2` red-team audit. The 1 CRITICAL (C-2) was guarded
+in 0.8.3; this release closes the MCP-fixable HIGH/MEDIUM/LOW findings. Each fix
+shipped as its own PR with a locking regression test, CI green throughout.
+
+#### Fixed — builders & numeric safety
+- **H-8 / H-9** — amount/id fields are validated (`^[0-9]+$`) before `BigInt()`
+  (`src/lib/amount.ts`), so empty/hex/negative values no longer silently
+  mis-encode; documented the on-chain `from18Safe` 18-decimal normalization on
+  the token-sale `buy` builders.
+- **H-4** — `apply_to_dao`'s short-treasury branch transfers what the treasury
+  holds (not the full amount) and mints the shortfall, so the proposal no longer
+  reverts on execution.
+- **H-10** — tier `vestingPercentage` is scaled by `PRECISION` (×1e25); raw
+  values no longer silently disable vesting, and out-of-`[0,100]` is rejected.
+- **W29** — OTC `buyer_buy` approves the exact amount, never `MAX_UINT256`.
+- **W39** — `read_staking_info` ABI matches the deployed `IStakingProposal`
+  (9-field `StakingInfoView`, 8-field `TierUserInfo`); a decode mismatch is
+  surfaced, not silently emptied.
+
+#### Fixed — disclosure, decode & data channels
+- **W36** — RPC provider API keys are redacted from tool output and errors
+  (`src/lib/redact.ts`); `get_config` masks the keyed RPC URL.
+- **H-13 / W24** — attacker-controlled on-chain/IPFS strings are sanitized
+  before rendering (`src/lib/sanitize.ts`): control chars escaped, NFKC
+  normalized, non-ASCII flagged — defeats prompt-injection / newline-forgery /
+  homoglyph spoofing.
+- **C-1 (decode-no-recursion)** — `decode_calldata` / `decode_proposal`
+  recursively unwrap nested `multicall` / `createProposal` / … and flag
+  privileged selectors.
+- **W20** — `ipfs_fetch` verifies fetched bytes against the requested CID
+  (raw/json codecs) and rejects a mismatch.
+- **W21 / L-6** — the Graph API key is only sent as a Bearer to trusted
+  `*.thegraph.com` hosts.
+
+#### Fixed — signer, flow & infra
+- **H-12** — broadcasts are serialized per chain (no nonce collision);
+  `tx_status` distinguishes `not_found` from `pending`.
+- **W10** — the composite flow verifies `govPool` against the canonical
+  `PoolRegistry` and approves the exact deposit amount, not `MAX_UINT256`.
+- **H-1 / H-2** — protocol bootstrap runs `npm install --ignore-scripts` and
+  supports pinning the clone via `DEXE_PROTOCOL_REF`.
+- **H-3** — `markdownToSlate` rejects input over a length cap
+  (`DEXE_MAX_DESCRIPTION_LEN`, default 16384) before the super-linear parse.
+- **L-1** — the Safe-TX propose path now applies the B6 (allowlist) + B7
+  (value-cap) guards.
+
+#### Added
+- `dexe_proposal_vote_and_execute` gains a `dryRun` flag (preview without
+  broadcasting), matching `dexe_proposal_create`.
+- Protocol-property advisories (`src/lib/protocolAdvisories.ts`) surfaced in the
+  `change_voting_settings`, `change_math_model`, and `custom_abi` previews.
+- New env vars: `DEXE_PROTOCOL_REF`, `DEXE_MAX_DESCRIPTION_LEN`.
+
+### Docs
+- **`docs/ESCALATION-DEXE.md`** — contract-level findings (C-2, H-11,
+  `executionDelay=0`, `changeVotePower`, PolynomialPower) for the DeXe protocol
+  team, with root cause, contract fix, and MCP mitigation.
+- **`docs/SECURITY.md`** — security posture and remediation summary.
+
+### Notes
+- `list_gov_contract_types` PoolRegistry source path corrected to
+  `contracts/factory/PoolRegistry.sol`.
+- Verified non-bugs (no change): H-5 (`cap=0` already guarded as uncapped),
+  H-7 (the `uniswap.json` timelock is the correct Uniswap Timelock).
+- Tool surface unchanged: still **153 tools across 19 groups**.
+
 ## 0.8.3 — 2026-06-01
 
 ### Security: guardrail against C-2 (DEFAULT-routing allowlist bypass)

package/README.md

@@ -296,6 +296,7 @@ Supply-chain hardening is enforced in CI. See [SECURITY.md](SECURITY.md) for the
 - **npm provenance.** Releases publish with `npm publish --provenance`; verify with `npm audit signatures` against an installed copy.
 - **Reproducible installs.** A `verify-lockfile` CI job installs strictly from the committed `package-lock.json` and fails on any drift.
 - **Continuous scanning.** CodeQL (SAST) runs on every PR and weekly; OSSF Scorecard runs weekly and on push to `main`; Dependency Review runs on every PR.
+- **Audit remediation (v0.9.0).** Closes the MCP-fixable findings from an independent red-team audit — numeric-input guards, RPC-key redaction, untrusted-data sanitization, recursive decode, exact-amount approvals, per-chain nonce serialization, IPFS content-hash verification, and an `--ignore-scripts` bootstrap. Contract-level findings are escalated in [`docs/ESCALATION-DEXE.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/ESCALATION-DEXE.md); per-finding detail in [`CHANGELOG.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/CHANGELOG.md).
 
 ## License
 

package/dist/bootstrap.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Build the `git clone` args. H-1/H-2: when `DEXE_PROTOCOL_REF` is set we pin
+ * the checkout to that branch/tag instead of cloning the floating default-branch
+ * HEAD, so the runtime sources are reproducible and an upstream HEAD move can't
+ * silently change what is compiled and executed via `hardhat.config.js`.
+ */
+export declare function buildCloneArgs(repoUrl: string, dir: string, ref?: string): string[];
+/**
+ * Build the `npm install` args. H-1/H-2: `--ignore-scripts` blocks any
+ * preinstall/postinstall/prepare lifecycle script in the cloned tree (or a
+ * transitive dependency) from executing arbitrary code as the MCP user on the
+ * first build.
+ */
+export declare function buildNpmInstallArgs(prefixArgs: readonly string[]): string[];
 /**
  * Cheap, synchronous resolution of where the DeXe-Protocol checkout *should*
  * live. **Does not** clone or install anything — safe to call at MCP startup.

package/dist/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAqCA;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAO1D;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG1E"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAKnF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE3E;AA0BD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAO1D;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG1E"}

package/dist/bootstrap.js

@@ -8,6 +8,28 @@ const execFileAsync = promisify(execFile);
 const REPO_URL = "https://github.com/dexe-network/DeXe-Protocol.git";
 const CACHE_DIR_NAME = "dexe-mcp";
 const CHECKOUT_DIR = "DeXe-Protocol";
+/**
+ * Build the `git clone` args. H-1/H-2: when `DEXE_PROTOCOL_REF` is set we pin
+ * the checkout to that branch/tag instead of cloning the floating default-branch
+ * HEAD, so the runtime sources are reproducible and an upstream HEAD move can't
+ * silently change what is compiled and executed via `hardhat.config.js`.
+ */
+export function buildCloneArgs(repoUrl, dir, ref) {
+    const args = ["clone", "--depth", "1"];
+    if (ref && ref.trim())
+        args.push("--branch", ref.trim());
+    args.push(repoUrl, dir);
+    return args;
+}
+/**
+ * Build the `npm install` args. H-1/H-2: `--ignore-scripts` blocks any
+ * preinstall/postinstall/prepare lifecycle script in the cloned tree (or a
+ * transitive dependency) from executing arbitrary code as the MCP user on the
+ * first build.
+ */
+export function buildNpmInstallArgs(prefixArgs) {
+    return [...prefixArgs, "install", "--ignore-scripts", "--no-audit", "--no-fund"];
+}
 /**
  * Returns the platform-appropriate cache directory for dexe-mcp.
  *
@@ -106,7 +128,7 @@ export async function ensureBuildReady(protocolPath) {
                 log(`Cloning DeXe-Protocol (shallow, ~200 MB) into ${protocolPath} …`);
                 log("This only happens once. Subsequent calls will be instant.");
                 try {
-                    await execFileAsync("git", ["clone", "--depth", "1", REPO_URL, CHECKOUT_DIR], { cwd: cacheDir, windowsHide: true });
+                    await execFileAsync("git", buildCloneArgs(REPO_URL, CHECKOUT_DIR, process.env.DEXE_PROTOCOL_REF), { cwd: cacheDir, windowsHide: true });
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
@@ -123,7 +145,7 @@ export async function ensureBuildReady(protocolPath) {
                 if (npm.binDir)
                     log(`Prepending ${npm.binDir} to child PATH for npx/npm resolution`);
                 try {
-                    await execFileAsync(npm.command, [...npm.prefixArgs, "install", "--no-audit", "--no-fund"], {
+                    await execFileAsync(npm.command, buildNpmInstallArgs(npm.prefixArgs), {
                         cwd: protocolPath,
                         windowsHide: true,
                         maxBuffer: 64 * 1024 * 1024,

package/dist/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,QAAQ,GAAG,mDAAmD,CAAC;AACrE,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,SAAS,GACb,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACnD,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO,SAAS,IAAI,cAAc,CAAC;AACrC,CAAC;AAED,yEAAyE;AACzE,sDAAsD;AACtD,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IACzD,IAAI,YAAY,CAAC,YAAY,CAAC;QAAE,OAAO;IACvC,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;YAExD,IAAI,QAAQ,EAAE,CAAC;gBACb,iEAAiE;gBACjE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,sCAAsC,CACnF,CAAC;gBACJ,CAAC;gBACD,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;oBACpD,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,EACpD,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,sBAAsB,YAAY,wDAAwD,CAC3F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,sBAAsB,YAAY,qEAAqE,CACxG,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CACb,kJAAkJ,CACnJ,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,iDAAiD,YAAY,IAAI,CAAC,CAAC;gBACvE,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,aAAa,CACjB,KAAK,EACL,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EACjD,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CACrC,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,MAAM,IAAI,KAAK,CACb,8EAA8E,GAAG,EAAE,CACpF,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACzB,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,yFAAyF,CAAC,CAAC;gBAC/F,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;gBACzB,GAAG,CACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,uBAAuB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;oBAC5C,CAAC,CAAC,SAAS,GAAG,CAAC,OAAO,6BAA6B,CACtD,CAAC;gBACF,IAAI,GAAG,CAAC,MAAM;oBAAE,GAAG,CAAC,cAAc,GAAG,CAAC,MAAM,uCAAuC,CAAC,CAAC;gBACrF,IAAI,CAAC;oBACH,MAAM,aAAa,CACjB,GAAG,CAAC,OAAO,EACX,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,EACzD;wBACE,GAAG,EAAE,YAAY;wBACjB,WAAW,EAAE,IAAI;wBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;wBAC3B,8DAA8D;wBAC9D,qDAAqD;wBACrD,KAAK,EAAE,GAAG,CAAC,UAAU;wBACrB,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;qBACnC,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,KAAK;wBAChD,uEAAuE;wBACvE,+DAA+D,GAAG,EAAE,CACvE,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,cAAc,CAAC;AACxB,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,QAAQ,GAAG,mDAAmD,CAAC;AACrE,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,GAAW,EAAE,GAAY;IACvE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B;IAC/D,OAAO,CAAC,GAAG,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,SAAS,GACb,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACnD,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO,SAAS,IAAI,cAAc,CAAC;AACrC,CAAC;AAED,yEAAyE;AACzE,sDAAsD;AACtD,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IACzD,IAAI,YAAY,CAAC,YAAY,CAAC;QAAE,OAAO;IACvC,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;YAExD,IAAI,QAAQ,EAAE,CAAC;gBACb,iEAAiE;gBACjE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,sCAAsC,CACnF,CAAC;gBACJ,CAAC;gBACD,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;oBACpD,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,EACpD,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,sBAAsB,YAAY,wDAAwD,CAC3F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,sBAAsB,YAAY,qEAAqE,CACxG,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CACb,kJAAkJ,CACnJ,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,iDAAiD,YAAY,IAAI,CAAC,CAAC;gBACvE,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,aAAa,CACjB,KAAK,EACL,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EACrE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CACrC,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,MAAM,IAAI,KAAK,CACb,8EAA8E,GAAG,EAAE,CACpF,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACzB,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,yFAAyF,CAAC,CAAC;gBAC/F,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;gBACzB,GAAG,CACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,uBAAuB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;oBAC5C,CAAC,CAAC,SAAS,GAAG,CAAC,OAAO,6BAA6B,CACtD,CAAC;gBACF,IAAI,GAAG,CAAC,MAAM;oBAAE,GAAG,CAAC,cAAc,GAAG,CAAC,MAAM,uCAAuC,CAAC,CAAC;gBACrF,IAAI,CAAC;oBACH,MAAM,aAAa,CACjB,GAAG,CAAC,OAAO,EACX,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EACnC;wBACE,GAAG,EAAE,YAAY;wBACjB,WAAW,EAAE,IAAI;wBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;wBAC3B,8DAA8D;wBAC9D,qDAAqD;wBACrD,KAAK,EAAE,GAAG,CAAC,UAAU;wBACrB,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;qBACnC,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,KAAK;wBAChD,uEAAuE;wBACvE,+DAA+D,GAAG,EAAE,CACvE,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/diag/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/diag/checks.ts"],"names":[],"mappings":"AACA,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE9F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AACnD,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAqBlF"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/diag/checks.ts"],"names":[],"mappings":"AACA,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE9F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AACnD,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAqBlF"}

package/dist/diag/checks.js

@@ -1,6 +1,7 @@
 import { resolve as dnsResolve } from "node:dns/promises";
 import { ENV_REGISTRY } from "../env/schema.js";
 import { parseEnv } from "../env/parse.js";
+import { maskUrl, redactUrlCredentials } from "../lib/redact.js";
 /**
  * Run every diagnostic check in parallel, gather results.
  *
@@ -80,7 +81,7 @@ function rpcReachabilityChecks(config, timeoutMs) {
                     id: `rpc.reachable.${chain.chainId}`,
                     category: "network",
                     status: "warn",
-                    message: `RPC ${chain.rpcUrl} timed out after ${timeoutMs}ms`,
+                    message: `RPC ${maskUrl(chain.rpcUrl)} timed out after ${timeoutMs}ms`,
                     remediation: "Check connectivity. If intermittent, ignore. Otherwise pick a different RPC at https://chainlist.org.",
                 };
             }
@@ -89,7 +90,7 @@ function rpcReachabilityChecks(config, timeoutMs) {
                     id: `rpc.reachable.${chain.chainId}`,
                     category: "network",
                     status: "fail",
-                    message: `RPC ${chain.rpcUrl} unreachable: ${res.error}`,
+                    message: `RPC ${maskUrl(chain.rpcUrl)} unreachable: ${redactUrlCredentials(String(res.error))}`,
                     remediation: "Replace the RPC URL. Browse alternatives at https://chainlist.org and restart the MCP.",
                 };
             }
@@ -101,14 +102,14 @@ function rpcReachabilityChecks(config, timeoutMs) {
                     category: "network",
                     status: "fail",
                     message: `RPC returned chainId=${got ?? "?"} but configured chainId=${chain.chainId}`,
-                    remediation: `RPC at ${chain.rpcUrl} is for the wrong chain. Replace it.`,
+                    remediation: `RPC at ${maskUrl(chain.rpcUrl)} is for the wrong chain. Replace it.`,
                 };
             }
             return {
                 id: `rpc.reachable.${chain.chainId}`,
                 category: "network",
                 status: "pass",
-                message: `eth_chainId=${chain.chainId} (${chain.rpcUrl})`,
+                message: `eth_chainId=${chain.chainId} (${maskUrl(chain.rpcUrl)})`,
             };
         })());
     }

package/dist/diag/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/diag/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAgD,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAqB3C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;QAChD,cAAc,CAAC,SAAS,CAAC;QACzB,mBAAmB,CAAC,SAAS,CAAC;QAC9B,GAAG,cAAc,CAAC,SAAS,CAAC;QAC5B,YAAY,CAAC,SAAS,CAAC;KACxB,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAyB,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,GAAG,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QACD,+CAA+C;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAE9E,SAAS,qBAAqB,CAC5B,MAA8B,EAC9B,SAAiB;IAEjB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CACN,CAAC,KAAK,IAAiC,EAAE;YACvC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,KAAK,CAAC,MAAM,EACZ;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;aACnF,EACD,SAAS,CACV,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;oBACpC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,OAAO,KAAK,CAAC,MAAM,oBAAoB,SAAS,IAAI;oBAC7D,WAAW,EACT,uGAAuG;iBAC1G,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;oBACpC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,OAAO,KAAK,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE;oBACxD,WAAW,EACT,wFAAwF;iBAC3F,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAI,GAAG,CAAC,IAAwC,EAAE,MAAM,CAAC;YAClE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;oBACpC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,wBAAwB,GAAG,IAAI,GAAG,2BAA2B,KAAK,CAAC,OAAO,EAAE;oBACrF,WAAW,EAAE,UAAU,KAAK,CAAC,MAAM,sCAAsC;iBAC1E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;gBACpC,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,eAAe,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,GAAG;aAC1D,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,kDAAkD,EAClD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE,EAC9D,SAAS,CACV,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gCAAgC,SAAS,KAAK;SACxD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wBAAwB,GAAG,CAAC,KAAK,EAAE;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C,GAAG,CAAC,MAAM,EAAE;YAChE,WAAW,EACT,qHAAqH;SACxH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC1F,CAAC;AAED,8EAA8E;AAE9E,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IAClD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sCAAsC;YAC/C,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;YAChB,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;SACvF,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kBAAkB,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7F,WAAW,EACT,+GAA+G;SAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA8H;QACzI,EAAE,GAAG,EAAE,yBAAyB,EAAE,EAAE,EAAE,gBAAgB,EAAE;QACxD,EAAE,GAAG,EAAE,8BAA8B,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAClE,EAAE,GAAG,EAAE,gCAAgC,EAAE,EAAE,EAAE,uBAAuB,EAAE;KACvE,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,GAAG,CAAC,IAAI,CACN,CAAC,KAAK,IAAiC,EAAE;YACvC,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YAC/E,IAAI,MAAM;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,GAAG,EACH,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAC9E,SAAS,CACV,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;oBACvB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,YAAY;iBAC9B,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;oBACvB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,EAAE;iBAClC,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACtB,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;oBACvB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,kBAAkB,GAAG,CAAC,MAAM,EAAE;oBAC/C,WAAW,EACT,oFAAoF;iBACvF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;gBACvB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,YAAY,CAAC,SAAiB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,YAAY;SAC5B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,KAAK,GAAG,CAAC,KAAK,EAAE;SAChC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,SAAS,sBAAsB;IAC7B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,kBAAkB;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,iBAAiB;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,IAAI,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,iBAAiB;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sBAAsB,IAAI,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uBAAuB,IAAI,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,SAAS,qBAAqB,CAAC,MAA8B;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0EAA0E;YACnF,WAAW,EAAE,2DAA2D;SACzE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACrF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,IAAiB,EACjB,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,GAAY,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/diag/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAgD,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAoBjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;QAChD,cAAc,CAAC,SAAS,CAAC;QACzB,mBAAmB,CAAC,SAAS,CAAC;QAC9B,GAAG,cAAc,CAAC,SAAS,CAAC;QAC5B,YAAY,CAAC,SAAS,CAAC;KACxB,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAyB,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,GAAG,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QACD,+CAA+C;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAE9E,SAAS,qBAAqB,CAC5B,MAA8B,EAC9B,SAAiB;IAEjB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CACN,CAAC,KAAK,IAAiC,EAAE;YACvC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,KAAK,CAAC,MAAM,EACZ;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;aACnF,EACD,SAAS,CACV,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;oBACpC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,SAAS,IAAI;oBACtE,WAAW,EACT,uGAAuG;iBAC1G,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;oBACpC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;oBAC/F,WAAW,EACT,wFAAwF;iBAC3F,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAI,GAAG,CAAC,IAAwC,EAAE,MAAM,CAAC;YAClE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;oBACpC,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,wBAAwB,GAAG,IAAI,GAAG,2BAA2B,KAAK,CAAC,OAAO,EAAE;oBACrF,WAAW,EAAE,UAAU,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,sCAAsC;iBACnF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;gBACpC,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,eAAe,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;aACnE,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,kDAAkD,EAClD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE,EAC9D,SAAS,CACV,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gCAAgC,SAAS,KAAK;SACxD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wBAAwB,GAAG,CAAC,KAAK,EAAE;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C,GAAG,CAAC,MAAM,EAAE;YAChE,WAAW,EACT,qHAAqH;SACxH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC1F,CAAC;AAED,8EAA8E;AAE9E,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IAClD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sCAAsC;YAC/C,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;YAChB,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;SACvF,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kBAAkB,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7F,WAAW,EACT,+GAA+G;SAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA8H;QACzI,EAAE,GAAG,EAAE,yBAAyB,EAAE,EAAE,EAAE,gBAAgB,EAAE;QACxD,EAAE,GAAG,EAAE,8BAA8B,EAAE,EAAE,EAAE,qBAAqB,EAAE;QAClE,EAAE,GAAG,EAAE,gCAAgC,EAAE,EAAE,EAAE,uBAAuB,EAAE;KACvE,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,GAAG,CAAC,IAAI,CACN,CAAC,KAAK,IAAiC,EAAE;YACvC,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YAC/E,IAAI,MAAM;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,GAAG,EACH,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAC9E,SAAS,CACV,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;oBACvB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,YAAY;iBAC9B,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;oBACvB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,EAAE;iBAClC,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACtB,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;oBACvB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,kBAAkB,GAAG,CAAC,MAAM,EAAE;oBAC/C,WAAW,EACT,oFAAoF;iBACvF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY;gBACvB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,YAAY,CAAC,SAAiB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,YAAY;SAC5B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,KAAK,GAAG,CAAC,KAAK,EAAE;SAChC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,SAAS,sBAAsB;IAC7B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,kBAAkB;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,iBAAiB;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,IAAI,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,iBAAiB;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sBAAsB,IAAI,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uBAAuB,IAAI,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,SAAS,qBAAqB,CAAC,MAA8B;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0EAA0E;YACnF,WAAW,EAAE,2DAA2D;SACzE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACrF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,IAAiB,EACjB,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,GAAY,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/lib/amount.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Strict parsing of user-supplied unsigned-integer (wei / id) strings.
+ *
+ * `BigInt()` silently accepts inputs that are almost never what the caller
+ * intended, producing a structurally-valid but semantically-wrong calldata:
+ *
+ *   BigInt("")      === 0n     → a blank amount field becomes a 0-value tx
+ *   BigInt("   ")   === 0n     → whitespace likewise coerces to 0
+ *   BigInt("0x10")  === 16n    → a hex string is reinterpreted as a number
+ *   BigInt("-5")    === -5n    → a negative wraps to a huge uint256 on-chain
+ *
+ * and `BigInt("1.5")` throws an opaque `SyntaxError` with no field context.
+ *
+ * This guard accepts only a plain base-10, non-negative integer string and
+ * returns the parsed `bigint`; otherwise it throws a clear, field-named error.
+ * Builders run inside the MCP tool callback, so a throw surfaces to the caller
+ * as a normal error result rather than a silent mis-encode.
+ *
+ * Use this everywhere a user-provided amount / id / nftId string flows into
+ * `BigInt(...)` before being encoded into transaction calldata.
+ */
+export declare function parseUintString(value: string, field?: string): bigint;
+//# sourceMappingURL=amount.d.ts.map

package/dist/lib/amount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"amount.d.ts","sourceRoot":"","sources":["../../src/lib/amount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,MAAM,CASvE"}

package/dist/lib/amount.js

@@ -0,0 +1,30 @@
+/**
+ * Strict parsing of user-supplied unsigned-integer (wei / id) strings.
+ *
+ * `BigInt()` silently accepts inputs that are almost never what the caller
+ * intended, producing a structurally-valid but semantically-wrong calldata:
+ *
+ *   BigInt("")      === 0n     → a blank amount field becomes a 0-value tx
+ *   BigInt("   ")   === 0n     → whitespace likewise coerces to 0
+ *   BigInt("0x10")  === 16n    → a hex string is reinterpreted as a number
+ *   BigInt("-5")    === -5n    → a negative wraps to a huge uint256 on-chain
+ *
+ * and `BigInt("1.5")` throws an opaque `SyntaxError` with no field context.
+ *
+ * This guard accepts only a plain base-10, non-negative integer string and
+ * returns the parsed `bigint`; otherwise it throws a clear, field-named error.
+ * Builders run inside the MCP tool callback, so a throw surfaces to the caller
+ * as a normal error result rather than a silent mis-encode.
+ *
+ * Use this everywhere a user-provided amount / id / nftId string flows into
+ * `BigInt(...)` before being encoded into transaction calldata.
+ */
+export function parseUintString(value, field = "amount") {
+    if (typeof value !== "string" || !/^[0-9]+$/.test(value)) {
+        throw new Error(`Invalid ${field}: ${JSON.stringify(value)}. ` +
+            `Expected a base-10 wei/id integer string — digits only, ` +
+            `no decimals, hex (0x…), sign, whitespace, or empty value.`);
+    }
+    return BigInt(value);
+}
+//# sourceMappingURL=amount.js.map

package/dist/lib/amount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"amount.js","sourceRoot":"","sources":["../../src/lib/amount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAK,GAAG,QAAQ;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI;YAC5C,0DAA0D;YAC1D,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/lib/broadcastGuards.d.ts

@@ -35,6 +35,16 @@ export declare class BroadcastGuardError extends Error {
 }
 /** Reset the B10 window. Test-only. */
 export declare function __resetBroadcastWindow(): void;
+/**
+ * B6 + B7: the stateless destination-allowlist and value-cap checks. Unlike B9
+ * (sim) and B10 (rate limit), these are safe to apply to ANY signed/queued tx —
+ * including a Safe-TX-Service propose (L-1), which previously signed and queued
+ * without any guard.
+ */
+export declare function assertAllowlistAndValueCap(tx: {
+    to: string;
+    value: string;
+}, cfg: DexeConfig): void;
 export declare function runBroadcastGuards(tx: BroadcastTx, cfg: DexeConfig, opts?: {
     skipSimulation?: boolean;
 }): Promise<void>;

package/dist/lib/broadcastGuards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broadcastGuards.d.ts","sourceRoot":"","sources":["../../src/lib/broadcastGuards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yFAAyF;AACzF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM;CAKlB;AASD,uCAAuC;AACvC,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CA6Ef"}
+{"version":3,"file":"broadcastGuards.d.ts","sourceRoot":"","sources":["../../src/lib/broadcastGuards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yFAAyF;AACzF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM;CAKlB;AASD,uCAAuC;AACvC,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CAwBnG;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAwDf"}

package/dist/lib/broadcastGuards.js

@@ -20,7 +20,13 @@ const broadcastTimestamps = [];
 export function __resetBroadcastWindow() {
     broadcastTimestamps.length = 0;
 }
-export async function runBroadcastGuards(tx, cfg, opts) {
+/**
+ * B6 + B7: the stateless destination-allowlist and value-cap checks. Unlike B9
+ * (sim) and B10 (rate limit), these are safe to apply to ANY signed/queued tx —
+ * including a Safe-TX-Service propose (L-1), which previously signed and queued
+ * without any guard.
+ */
+export function assertAllowlistAndValueCap(tx, cfg) {
     // ---- B6: destination allowlist ----------------------------------------
     if (cfg.signerAllowlist && cfg.signerAllowlist.length > 0) {
         const to = tx.to.toLowerCase();
@@ -37,6 +43,10 @@ export async function runBroadcastGuards(tx, cfg, opts) {
                 `Refusing to broadcast.`);
         }
     }
+}
+export async function runBroadcastGuards(tx, cfg, opts) {
+    // ---- B6 + B7: destination allowlist & value cap -----------------------
+    assertAllowlistAndValueCap(tx, cfg);
     // ---- B9: auto-simulation (eth_call preflight) -------------------------
     // Reuses the shared sim core; aborts before spending gas if the call would
     // revert. Must run against the SAME chain the broadcast targets — otherwise

package/dist/lib/broadcastGuards.js.map

@@ -1 +1 @@
-{"version":3,"file":"broadcastGuards.js","sourceRoot":"","sources":["../../src/lib/broadcastGuards.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAiCxD,yFAAyF;AACzF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,KAAa,EACtB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,UAAK,GAAL,KAAK,CAAQ;QAItB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AAChC,MAAM,mBAAmB,GAAa,EAAE,CAAC;AAEzC,uCAAuC;AACvC,MAAM,UAAU,sBAAsB;IACpC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAe,EACf,GAAe,EACf,IAAmC;IAEnC,0EAA0E;IAC1E,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,eAAe,EAAE,CAAC,EAAE,qCAAqC,GAAG,CAAC,eAAe,CAAC,MAAM,aAAa;gBAC9F,wBAAwB,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,SAAS,CAAC,CAAC,QAAQ,EAAE,iDAAiD,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ;gBAC5G,wBAAwB,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;QAC1B,MAAM,MAAM,GACV,EAAE,CAAC,OAAO,KAAK,GAAG,CAAC,cAAc;YAC/B,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACtC,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,IAAI,EAAE,EAAE,CAAC,IAAI;SACd,CAAC,CAAC;QACH,6EAA6E;QAC7E,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,iDAAiD,GAAG,CAAC,YAAY,IAAI,SAAS,IAAI;gBAChF,+BAA+B,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,GAAG,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,yBAAyB,CAAC;QAC1C,MAAM,aAAa,CAAC,GAAG,EAAE;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC;YAC5B,OAAO,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAE,GAAG,MAAM,EAAE,CAAC;gBAC1E,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,mBAAmB,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxD,MAAM,IAAI,mBAAmB,CAC3B,KAAK,EACL,iCAAiC,GAAG,oDAAoD;oBACtF,aAAa,KAAK,IAAI,CACzB,CAAC;YACJ,CAAC;YACD,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"broadcastGuards.js","sourceRoot":"","sources":["../../src/lib/broadcastGuards.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAiCxD,yFAAyF;AACzF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,KAAa,EACtB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,UAAK,GAAL,KAAK,CAAQ;QAItB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AAChC,MAAM,mBAAmB,GAAa,EAAE,CAAC;AAEzC,uCAAuC;AACvC,MAAM,UAAU,sBAAsB;IACpC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAiC,EAAE,GAAe;IAC3F,0EAA0E;IAC1E,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,eAAe,EAAE,CAAC,EAAE,qCAAqC,GAAG,CAAC,eAAe,CAAC,MAAM,aAAa;gBAC9F,wBAAwB,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,SAAS,CAAC,CAAC,QAAQ,EAAE,iDAAiD,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ;gBAC5G,wBAAwB,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAe,EACf,GAAe,EACf,IAAmC;IAEnC,0EAA0E;IAC1E,0BAA0B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAEpC,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;QAC1B,MAAM,MAAM,GACV,EAAE,CAAC,OAAO,KAAK,GAAG,CAAC,cAAc;YAC/B,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACtC,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,IAAI,EAAE,EAAE,CAAC,IAAI;SACd,CAAC,CAAC;QACH,6EAA6E;QAC7E,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,iDAAiD,GAAG,CAAC,YAAY,IAAI,SAAS,IAAI;gBAChF,+BAA+B,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,GAAG,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,yBAAyB,CAAC;QAC1C,MAAM,aAAa,CAAC,GAAG,EAAE;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC;YAC5B,OAAO,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAE,GAAG,MAAM,EAAE,CAAC;gBAC1E,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,mBAAmB,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxD,MAAM,IAAI,mBAAmB,CAC3B,KAAK,EACL,iCAAiC,GAAG,oDAAoD;oBACtF,aAAa,KAAK,IAAI,CACzB,CAAC;YACJ,CAAC;YACD,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/lib/decoders.d.ts

@@ -10,6 +10,14 @@ export interface DecodedCall {
     args: Record<string, unknown>;
     /** Raw positional args — useful for agents that want the tuple directly. */
     argsArray: unknown[];
+    /** True if this selector is a C-2-class privileged accounting function. */
+    privileged?: boolean;
+    /**
+     * Calls discovered inside this call's calldata args — e.g. the inner calls of
+     * a `multicall(bytes[])`, or the actions of a nested `createProposal`. Lets a
+     * reviewer see hidden privileged calls instead of just the wrapper (C-1).
+     */
+    nested?: DecodedCall[];
 }
 export interface DecodedProposalAction {
     side: "for" | "against";
@@ -28,10 +36,22 @@ export declare class CalldataDecoder {
      * is tried. Otherwise every artifact whose selector matches is tried in
      * turn; the first successful parse wins (with alternatives in `.alternatives`).
      */
+    static readonly MAX_NEST_DEPTH = 4;
+    /**
+     * Decode calldata and recursively unwrap any well-formed nested calldata
+     * found in its arguments — `multicall(bytes[])`, a nested `createProposal`'s
+     * `ProposalAction[]`, `tryExecute`, etc. The decoded `primary` carries a
+     * `privileged` flag for C-2-class selectors and a `nested` tree so a reviewer
+     * reading the text sees hidden inner calls, not just the wrapper (C-1).
+     */
     decodeCalldata(data: string, contractName?: string): {
         primary: DecodedCall | null;
         alternatives: DecodedCall[];
     };
+    private decodeEnriched;
+    /** Walk decoded args; recurse into any value that is itself well-formed calldata. */
+    private collectNested;
+    private decodeOnce;
     /**
      * Given a ProposalAction tuple, find the executor contract and decode `data`
      * against its ABI. Strategy: try to find an artifact whose runtime bytecode

package/dist/lib/decoders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decoders.d.ts","sourceRoot":"","sources":["../../src/lib/decoders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,iGAAiG;IACjG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,4EAA4E;IAC5E,SAAS,EAAE,OAAO,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,aAAa;IAG3C;;;;OAIG;IACH,cAAc,CACZ,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB;QAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,WAAW,EAAE,CAAA;KAAE;IA4C/D;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAAM,EAAE;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;KACzB,GAAG,qBAAqB;CAU1B"}
+{"version":3,"file":"decoders.d.ts","sourceRoot":"","sources":["../../src/lib/decoders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,WAAW,WAAW;IAC1B,iGAAiG;IACjG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,4EAA4E;IAC5E,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,aAAa;IAG3C;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,cAAc,KAAK;IAEnC;;;;;;OAMG;IACH,cAAc,CACZ,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB;QAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,WAAW,EAAE,CAAA;KAAE;IAI/D,OAAO,CAAC,cAAc;IAiBtB,qFAAqF;IACrF,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,UAAU;IA+ClB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAAM,EAAE;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;KACzB,GAAG,qBAAqB;CAU1B"}

package/dist/lib/decoders.js

@@ -1,4 +1,5 @@
 import { Interface } from "ethers";
+import { findForbiddenSelector } from "./dangerousSelectors.js";
 export class CalldataDecoder {
     artifacts;
     selectors;
@@ -11,7 +12,46 @@ export class CalldataDecoder {
      * is tried. Otherwise every artifact whose selector matches is tried in
      * turn; the first successful parse wins (with alternatives in `.alternatives`).
      */
+    static MAX_NEST_DEPTH = 4;
+    /**
+     * Decode calldata and recursively unwrap any well-formed nested calldata
+     * found in its arguments — `multicall(bytes[])`, a nested `createProposal`'s
+     * `ProposalAction[]`, `tryExecute`, etc. The decoded `primary` carries a
+     * `privileged` flag for C-2-class selectors and a `nested` tree so a reviewer
+     * reading the text sees hidden inner calls, not just the wrapper (C-1).
+     */
     decodeCalldata(data, contractName) {
+        return this.decodeEnriched(data, contractName, 0);
+    }
+    decodeEnriched(data, contractName, depth) {
+        const res = this.decodeOnce(data, contractName);
+        if (res.primary) {
+            res.primary.privileged = findForbiddenSelector(res.primary.selector) != null;
+            if (depth < CalldataDecoder.MAX_NEST_DEPTH) {
+                const nested = [];
+                this.collectNested(res.primary.argsArray, depth + 1, nested);
+                if (nested.length > 0)
+                    res.primary.nested = nested;
+            }
+        }
+        return res;
+    }
+    /** Walk decoded args; recurse into any value that is itself well-formed calldata. */
+    collectNested(value, depth, out) {
+        if (typeof value === "string") {
+            if (looksLikeCalldata(value)) {
+                const r = this.decodeEnriched(value, undefined, depth);
+                if (r.primary)
+                    out.push(r.primary);
+            }
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const el of value)
+                this.collectNested(el, depth, out);
+        }
+    }
+    decodeOnce(data, contractName) {
         if (!data || data.length < 10 || !data.startsWith("0x")) {
             return { primary: null, alternatives: [] };
         }
@@ -119,4 +159,16 @@ function normalize(v) {
     }
     return v;
 }
+/**
+ * Heuristic: does `v` look like ABI calldata (a 4-byte selector followed by
+ * whole 32-byte words)? This filters out addresses (20 bytes), bytes32 hashes,
+ * and arbitrary blobs, so recursion only follows real nested calls.
+ */
+function looksLikeCalldata(v) {
+    if (!/^0x[0-9a-fA-F]+$/.test(v))
+        return false;
+    if (v.length < 10)
+        return false; // need at least the 4-byte selector
+    return (v.length - 10) % 64 === 0; // selector + N 32-byte words
+}
 //# sourceMappingURL=decoders.js.map

package/dist/lib/decoders.js.map

@@ -1 +1 @@
-{"version":3,"file":"decoders.js","sourceRoot":"","sources":["../../src/lib/decoders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAe,MAAM,QAAQ,CAAC;AAyBhD,MAAM,OAAO,eAAe;IAEP;IACA;IAFnB,YACmB,SAAoB,EACpB,SAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,cAAS,GAAT,SAAS,CAAe;IACxC,CAAC;IAEJ;;;;OAIG;IACH,cAAc,CACZ,IAAY,EACZ,YAAqB;QAErB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM,CAAC,YAAY;wBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,GAAG,GAAG;qBACP;oBACD,YAAY,EAAE,EAAE;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACtF,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;oBAC7E,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAKpB;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAuB,EAAE,IAAY;IAC1D,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,SAAS,CAAC,GAAkD,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5E,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,KAAwB;IAC9D,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,kFAAkF;QAClF,MAAM,QAAQ,GAAG,CAAW,CAAC;QAC7B,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3C,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"decoders.js","sourceRoot":"","sources":["../../src/lib/decoders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAe,MAAM,QAAQ,CAAC;AAGhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA+BhE,MAAM,OAAO,eAAe;IAEP;IACA;IAFnB,YACmB,SAAoB,EACpB,SAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,cAAS,GAAT,SAAS,CAAe;IACxC,CAAC;IAEJ;;;;OAIG;IACH,MAAM,CAAU,cAAc,GAAG,CAAC,CAAC;IAEnC;;;;;;OAMG;IACH,cAAc,CACZ,IAAY,EACZ,YAAqB;QAErB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,cAAc,CACpB,IAAY,EACZ,YAAgC,EAChC,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;YAC7E,IAAI,KAAK,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAkB,EAAE,CAAC;gBACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,qFAAqF;IAC7E,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,GAAkB;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,CAAC,OAAO;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,EAAE,IAAI,KAAK;gBAAE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,IAAY,EACZ,YAAqB;QAErB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM,CAAC,YAAY;wBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,GAAG,GAAG;qBACP;oBACD,YAAY,EAAE,EAAE;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACtF,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;oBAC7E,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAKpB;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;;AAGH,SAAS,aAAa,CAAC,GAAuB,EAAE,IAAY;IAC1D,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,SAAS,CAAC,GAAkD,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5E,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,KAAwB;IAC9D,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,kFAAkF;QAClF,MAAM,QAAQ,GAAG,CAAW,CAAC;QAC7B,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3C,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,oCAAoC;IACrE,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,6BAA6B;AAClE,CAAC"}

package/dist/lib/ipfs.d.ts

@@ -1,3 +1,4 @@
+import { CID } from "multiformats/cid";
 /**
  * Public IPFS gateways (dweb.link, ipfs.io, cf-ipfs.com, …) are unreliable —
  * frequent 502s, rate limits, and extended outages in 2025/2026. We do NOT
@@ -21,8 +22,21 @@ export interface IpfsFetchResult {
     json: unknown | null;
     /** Total attempts made (including failures before success). */
     attempts: number;
+    /**
+     * True if the bytes were hash-verified against the requested CID (raw/json
+     * codecs). False when the codec (dag-pb / unixfs) can't be cheaply verified
+     * without full DAG reconstruction — content-addressing was NOT confirmed.
+     */
+    verified: boolean;
 }
 export declare function fetchIpfs(cid: string, cfg: IpfsFetchConfig): Promise<IpfsFetchResult>;
+/**
+ * W20 content-address check. Returns "verified" when sha256(bytes) reproduces
+ * the requested CID, "mismatch" when it doesn't (tampered / MitM gateway), and
+ * "unverifiable" for codecs whose CID is over a DAG rather than the raw bytes
+ * (dag-pb / unixfs) — those need full DAG reconstruction we don't perform here.
+ */
+export declare function verifyCidBytes(parsedCid: CID, bytes: Uint8Array): Promise<"verified" | "mismatch" | "unverifiable">;
 export interface CidInfo {
     cid: string;
     version: 0 | 1;

package/dist/lib/ipfs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ipfs.d.ts","sourceRoot":"","sources":["../../src/lib/ipfs.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAO,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,gEAAgE;IAChE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,eAAe,CAAC,CAkD1B;AAID,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoB/C;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED,iEAAiE;AACjE,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhE;AAED,iEAAiE;AACjE,wBAAsB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAyBD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAIxC,4DAA4D;IACtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,OAAO,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC3D,OAAO,CAAC,eAAe,CAAC;IA0BrB,OAAO,CACX,KAAK,EAAE,UAAU,EACjB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7F,OAAO,CAAC,eAAe,CAAC;CAiC5B"}
+{"version":3,"file":"ipfs.d.ts","sourceRoot":"","sources":["../../src/lib/ipfs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAOvC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAO,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,gEAAgE;IAChE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,eAAe,CAAC,CAiE1B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,GAAG,EACd,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,cAAc,CAAC,CAMnD;AAID,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoB/C;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED,iEAAiE;AACjE,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhE;AAED,iEAAiE;AACjE,wBAAsB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAyBD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAIxC,4DAA4D;IACtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,OAAO,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC3D,OAAO,CAAC,eAAe,CAAC;IA0BrB,OAAO,CACX,KAAK,EAAE,UAAU,EACjB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7F,OAAO,CAAC,eAAe,CAAC;CAiC5B"}