safehands-pharos 1.4.0 → 1.5.0

package/dist/lib/signer/index.d.ts

@@ -1,25 +1,25 @@
-import type { Account } from "viem";
-export type SignerMode = "none" | "env" | "managed-testnet" | "external-signer" | "x402-env";
-export type SignerPurpose = "write" | "x402";
-export interface SignerResult {
-    account: Account;
-    address: `0x${string}`;
-    mode: SignerMode;
-}
-export interface SignerFailure {
-    error: {
-        code: string;
-        message: string;
-    };
-}
-export type GetSignerResult = SignerResult | SignerFailure;
-export declare function isSignerFailure(r: GetSignerResult): r is SignerFailure;
-/**
- * Get a signer for write/payment operations.
- * Priority for x402: managed wallet > X402_SIGNER_PRIVATE_KEY > PRIVATE_KEY fallback.
- * Priority for writes: managed wallet > PRIVATE_KEY fallback.
- */
-export declare function getSigner(agentId?: string, options?: {
-    purpose?: SignerPurpose;
-}): Promise<GetSignerResult>;
+import type { Account } from "viem";
+export type SignerMode = "none" | "env" | "managed-testnet" | "external-signer" | "x402-env";
+export type SignerPurpose = "write" | "x402";
+export interface SignerResult {
+    account: Account;
+    address: `0x${string}`;
+    mode: SignerMode;
+}
+export interface SignerFailure {
+    error: {
+        code: string;
+        message: string;
+    };
+}
+export type GetSignerResult = SignerResult | SignerFailure;
+export declare function isSignerFailure(r: GetSignerResult): r is SignerFailure;
+/**
+ * Get a signer for write/payment operations.
+ * Priority for x402: managed wallet > X402_SIGNER_PRIVATE_KEY > PRIVATE_KEY fallback.
+ * Priority for writes: managed wallet > PRIVATE_KEY fallback.
+ */
+export declare function getSigner(agentId?: string, options?: {
+    purpose?: SignerPurpose;
+}): Promise<GetSignerResult>;
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/signer/index.js

@@ -1,89 +1,89 @@
-// ─── SignerProvider ─────────────────────────────────────────────────────
-// Abstraction layer for signing. Tools never read process.env.PRIVATE_KEY
-// directly — they request a signer through this provider.
-// ────────────────────────────────────────────────────────────────────────
-import { privateKeyToAccount } from "viem/accounts";
-import { walletStore, decryptKey, getEffectiveEncryptionKey } from "../wallet/index.js";
-export function isSignerFailure(r) {
-    return "error" in r;
-}
-function normalizePrivateKey(pk) {
-    return (pk.startsWith("0x") ? pk : `0x${pk}`);
-}
-function accountFromEnvKey(envName, mode) {
-    const pk = process.env[envName];
-    if (!pk)
-        return null;
-    try {
-        const account = privateKeyToAccount(normalizePrivateKey(pk));
-        return { account, address: account.address, mode };
-    }
-    catch {
-        return {
-            error: {
-                code: "INVALID_PRIVATE_KEY",
-                message: `${envName} is not a valid private key.`,
-            },
-        };
-    }
-}
-async function accountFromManagedWallet(agentId) {
-    const walletMode = process.env.WALLET_MODE || "none";
-    if (walletMode !== "managed-testnet" || !agentId)
-        return null;
-    if (process.env.WALLET_STORE_PATH && !process.env.WALLET_ENCRYPTION_KEY) {
-        return {
-            error: {
-                code: "WALLET_ENCRYPTION_KEY_REQUIRED",
-                message: "WALLET_ENCRYPTION_KEY is required when WALLET_STORE_PATH is used for persistent managed-testnet wallets.",
-            },
-        };
-    }
-    const stored = await walletStore.get(agentId);
-    if (!stored)
-        return null;
-    try {
-        const privateKey = decryptKey(stored.encryptedKey, getEffectiveEncryptionKey());
-        const account = privateKeyToAccount(normalizePrivateKey(privateKey));
-        return { account, address: account.address, mode: "managed-testnet" };
-    }
-    catch {
-        return {
-            error: {
-                code: "NO_SIGNER_AVAILABLE",
-                message: "Managed wallet key could not be decrypted for signing. Check WALLET_ENCRYPTION_KEY matches the key used when the wallet was created.",
-            },
-        };
-    }
-}
-/**
- * Get a signer for write/payment operations.
- * Priority for x402: managed wallet > X402_SIGNER_PRIVATE_KEY > PRIVATE_KEY fallback.
- * Priority for writes: managed wallet > PRIVATE_KEY fallback.
- */
-export async function getSigner(agentId, options = {}) {
-    const purpose = options.purpose || "write";
-    const managed = await accountFromManagedWallet(agentId);
-    if (managed)
-        return managed;
-    if (purpose === "x402") {
-        const x402Env = accountFromEnvKey("X402_SIGNER_PRIVATE_KEY", "x402-env");
-        if (x402Env)
-            return x402Env;
-    }
-    const walletMode = process.env.WALLET_MODE || "none";
-    if (walletMode === "env" || process.env.PRIVATE_KEY) {
-        const env = accountFromEnvKey("PRIVATE_KEY", "env");
-        if (env)
-            return env;
-    }
-    return {
-        error: {
-            code: "NO_SIGNER_AVAILABLE",
-            message: purpose === "x402"
-                ? "No x402 signer available. Use WALLET_MODE=managed-testnet with agentId, X402_SIGNER_PRIVATE_KEY, or PRIVATE_KEY as testnet developer fallback."
-                : "No signer available. Use WALLET_MODE=managed-testnet with agentId, or WALLET_MODE=env with PRIVATE_KEY for testnet developer mode.",
-        },
-    };
-}
+// ─── SignerProvider ─────────────────────────────────────────────────────
+// Abstraction layer for signing. Tools never read process.env.PRIVATE_KEY
+// directly — they request a signer through this provider.
+// ────────────────────────────────────────────────────────────────────────
+import { privateKeyToAccount } from "viem/accounts";
+import { walletStore, decryptKey, getEffectiveEncryptionKey } from "../wallet/index.js";
+export function isSignerFailure(r) {
+    return "error" in r;
+}
+function normalizePrivateKey(pk) {
+    return (pk.startsWith("0x") ? pk : `0x${pk}`);
+}
+function accountFromEnvKey(envName, mode) {
+    const pk = process.env[envName];
+    if (!pk)
+        return null;
+    try {
+        const account = privateKeyToAccount(normalizePrivateKey(pk));
+        return { account, address: account.address, mode };
+    }
+    catch {
+        return {
+            error: {
+                code: "INVALID_PRIVATE_KEY",
+                message: `${envName} is not a valid private key.`,
+            },
+        };
+    }
+}
+async function accountFromManagedWallet(agentId) {
+    const walletMode = process.env.WALLET_MODE || "none";
+    if (walletMode !== "managed-testnet" || !agentId)
+        return null;
+    if (process.env.WALLET_STORE_PATH && !process.env.WALLET_ENCRYPTION_KEY) {
+        return {
+            error: {
+                code: "WALLET_ENCRYPTION_KEY_REQUIRED",
+                message: "WALLET_ENCRYPTION_KEY is required when WALLET_STORE_PATH is used for persistent managed-testnet wallets.",
+            },
+        };
+    }
+    const stored = await walletStore.get(agentId);
+    if (!stored)
+        return null;
+    try {
+        const privateKey = decryptKey(stored.encryptedKey, getEffectiveEncryptionKey());
+        const account = privateKeyToAccount(normalizePrivateKey(privateKey));
+        return { account, address: account.address, mode: "managed-testnet" };
+    }
+    catch {
+        return {
+            error: {
+                code: "NO_SIGNER_AVAILABLE",
+                message: "Managed wallet key could not be decrypted for signing. Check WALLET_ENCRYPTION_KEY matches the key used when the wallet was created.",
+            },
+        };
+    }
+}
+/**
+ * Get a signer for write/payment operations.
+ * Priority for x402: managed wallet > X402_SIGNER_PRIVATE_KEY > PRIVATE_KEY fallback.
+ * Priority for writes: managed wallet > PRIVATE_KEY fallback.
+ */
+export async function getSigner(agentId, options = {}) {
+    const purpose = options.purpose || "write";
+    const managed = await accountFromManagedWallet(agentId);
+    if (managed)
+        return managed;
+    if (purpose === "x402") {
+        const x402Env = accountFromEnvKey("X402_SIGNER_PRIVATE_KEY", "x402-env");
+        if (x402Env)
+            return x402Env;
+    }
+    const walletMode = process.env.WALLET_MODE || "none";
+    if (walletMode === "env" || process.env.PRIVATE_KEY) {
+        const env = accountFromEnvKey("PRIVATE_KEY", "env");
+        if (env)
+            return env;
+    }
+    return {
+        error: {
+            code: "NO_SIGNER_AVAILABLE",
+            message: purpose === "x402"
+                ? "No x402 signer available. Use WALLET_MODE=managed-testnet with agentId, X402_SIGNER_PRIVATE_KEY, or PRIVATE_KEY as testnet developer fallback."
+                : "No signer available. Use WALLET_MODE=managed-testnet with agentId, or WALLET_MODE=env with PRIVATE_KEY for testnet developer mode.",
+        },
+    };
+}
 //# sourceMappingURL=index.js.map

package/dist/lib/testDodoLive.d.ts

@@ -1,2 +1,2 @@
-export {};
+export {};
 //# sourceMappingURL=testDodoLive.d.ts.map

package/dist/lib/testDodoLive.js

@@ -1,105 +1,105 @@
-// ─── Live DODO/FaroSwap Verification ───────────────────────────────────
-// Tests DODO API reachability if DODO_API_KEY is present.
-// Skips cleanly if API key is missing.
-// ────────────────────────────────────────────────────────────────────────
-import { DODO_API_BASE, DODO_API_KEY } from "./constants.js";
-import { getDodoRoute } from "./dodoApi.js";
-const results = [];
-async function main() {
-    console.log("═══════════════════════════════════════════════════════════");
-    console.log("  SafeHands — DODO/FaroSwap Live Verification");
-    console.log("═══════════════════════════════════════════════════════════");
-    console.log(`  DODO API Base: ${DODO_API_BASE}`);
-    const maskedKey = DODO_API_KEY ? `pub_****${DODO_API_KEY.slice(-4)}` : "NOT SET";
-    console.log(`  API Key:       ${maskedKey}`);
-    console.log("");
-    if (!DODO_API_KEY) {
-        console.log("  ⏭️  SKIPPED_MISSING_DODO_API_KEY — set DODO_API_KEY to enable live DODO checks.");
-        results.push({
-            name: "dodo_api_route_check",
-            status: "SKIPPED_MISSING_DODO_API_KEY",
-            detail: "DODO_API_KEY env var not set. This is expected for CI/demo environments.",
-        });
-    }
-    else {
-        // Try a read-only route quote
-        try {
-            const quote = await getDodoRoute({
-                fromToken: "PHRS",
-                toToken: "USDC",
-                amountHuman: "0.000001",
-                walletAddress: "0x0000000000000000000000000000000000000001",
-            });
-            if (quote.routeAvailable && parseFloat(quote.amountOut) > 0) {
-                results.push({
-                    name: "dodo_api_route_check",
-                    status: "PASS",
-                    detail: `Route found: 0.000001 PHRS → ${quote.amountOut} USDC`,
-                });
-            }
-            else {
-                results.push({
-                    name: "dodo_api_route_check",
-                    status: "NO_ROUTE_AVAILABLE",
-                    detail: `API reachable. No route available (may be no liquidity).`,
-                });
-            }
-        }
-        catch (err) {
-            const msg = err.message || String(err);
-            if (msg.includes("DODO_API_AUTH_REQUIRED")) {
-                results.push({
-                    name: "dodo_api_route_check",
-                    status: "DODO_API_AUTH_REQUIRED",
-                    detail: msg,
-                });
-            }
-            else if (msg.includes("DODO_API_UNAVAILABLE") || msg.includes("DODO_API_RATE_LIMITED") || msg.includes("fetch failed") || msg.includes("network timeout")) {
-                results.push({
-                    name: "dodo_api_route_check",
-                    status: "DODO_API_UNAVAILABLE",
-                    detail: `Network/timeout/rate-limited: ${msg}`,
-                });
-            }
-            else {
-                results.push({
-                    name: "dodo_api_route_check",
-                    status: "FAIL",
-                    detail: msg,
-                });
-            }
-        }
-    }
-    // Router address verification status
-    results.push({
-        name: "dodo_approve_address_status",
-        status: "PASS",
-        detail: "0x4Cf317b8918FbE8A890c01eDAb7d548555Ac2cE9 — PROJECT_CONFIGURED (not verified by official FaroSwap/DODO docs)",
-    });
-    results.push({
-        name: "dodo_route_proxy_status",
-        status: "PASS",
-        detail: "0x819829e5CF6e19F9fED92F6b4CC1edF45a2cC4A2 — PROJECT_CONFIGURED (not verified by official FaroSwap/DODO docs)",
-    });
-    // Print results
-    console.log(`\n${"#".padStart(2)} ${"Status".padEnd(32)} ${"Check".padEnd(34)} Detail`);
-    console.log("─".repeat(110));
-    for (const [i, r] of results.entries()) {
-        const icon = r.status === "PASS" ? "✅" : r.status.startsWith("SKIPPED") ? "⏭️" : "❌";
-        console.log(`${String(i + 1).padStart(2)} ${icon} ${r.status.padEnd(29)} ${r.name.padEnd(34)} ${r.detail.slice(0, 80)}`);
-    }
-    const failed = results.filter(r => r.status === "FAIL");
-    console.log("─".repeat(110));
-    console.log(`${results.filter(r => r.status === "PASS").length}/${results.length} checks passed, ${results.filter(r => r.status.startsWith("SKIPPED")).length} skipped.`);
-    if (failed.length > 0) {
-        console.error("\nFailed:");
-        for (const f of failed)
-            console.error(`  - ${f.name}: ${f.detail}`);
-        process.exit(1);
-    }
-}
-main().catch((err) => {
-    console.error("❌ Unexpected error:", err);
-    process.exit(1);
-});
+// ─── Live DODO/FaroSwap Verification ───────────────────────────────────
+// Tests DODO API reachability if DODO_API_KEY is present.
+// Skips cleanly if API key is missing.
+// ────────────────────────────────────────────────────────────────────────
+import { DODO_API_BASE, DODO_API_KEY } from "./constants.js";
+import { getDodoRoute } from "./dodoApi.js";
+const results = [];
+async function main() {
+    console.log("═══════════════════════════════════════════════════════════");
+    console.log("  SafeHands — DODO/FaroSwap Live Verification");
+    console.log("═══════════════════════════════════════════════════════════");
+    console.log(`  DODO API Base: ${DODO_API_BASE}`);
+    const maskedKey = DODO_API_KEY ? `pub_****${DODO_API_KEY.slice(-4)}` : "NOT SET";
+    console.log(`  API Key:       ${maskedKey}`);
+    console.log("");
+    if (!DODO_API_KEY) {
+        console.log("  ⏭️  SKIPPED_MISSING_DODO_API_KEY — set DODO_API_KEY to enable live DODO checks.");
+        results.push({
+            name: "dodo_api_route_check",
+            status: "SKIPPED_MISSING_DODO_API_KEY",
+            detail: "DODO_API_KEY env var not set. This is expected for CI/demo environments.",
+        });
+    }
+    else {
+        // Try a read-only route quote
+        try {
+            const quote = await getDodoRoute({
+                fromToken: "PHRS",
+                toToken: "USDC",
+                amountHuman: "0.000001",
+                walletAddress: "0x0000000000000000000000000000000000000001",
+            });
+            if (quote.routeAvailable && parseFloat(quote.amountOut) > 0) {
+                results.push({
+                    name: "dodo_api_route_check",
+                    status: "PASS",
+                    detail: `Route found: 0.000001 PHRS → ${quote.amountOut} USDC`,
+                });
+            }
+            else {
+                results.push({
+                    name: "dodo_api_route_check",
+                    status: "NO_ROUTE_AVAILABLE",
+                    detail: `API reachable. No route available (may be no liquidity).`,
+                });
+            }
+        }
+        catch (err) {
+            const msg = err.message || String(err);
+            if (msg.includes("DODO_API_AUTH_REQUIRED")) {
+                results.push({
+                    name: "dodo_api_route_check",
+                    status: "DODO_API_AUTH_REQUIRED",
+                    detail: msg,
+                });
+            }
+            else if (msg.includes("DODO_API_UNAVAILABLE") || msg.includes("DODO_API_RATE_LIMITED") || msg.includes("fetch failed") || msg.includes("network timeout")) {
+                results.push({
+                    name: "dodo_api_route_check",
+                    status: "DODO_API_UNAVAILABLE",
+                    detail: `Network/timeout/rate-limited: ${msg}`,
+                });
+            }
+            else {
+                results.push({
+                    name: "dodo_api_route_check",
+                    status: "FAIL",
+                    detail: msg,
+                });
+            }
+        }
+    }
+    // Router address verification status
+    results.push({
+        name: "dodo_approve_address_status",
+        status: "PASS",
+        detail: "0x4Cf317b8918FbE8A890c01eDAb7d548555Ac2cE9 — PROJECT_CONFIGURED (not verified by official FaroSwap/DODO docs)",
+    });
+    results.push({
+        name: "dodo_route_proxy_status",
+        status: "PASS",
+        detail: "0x819829e5CF6e19F9fED92F6b4CC1edF45a2cC4A2 — PROJECT_CONFIGURED (not verified by official FaroSwap/DODO docs)",
+    });
+    // Print results
+    console.log(`\n${"#".padStart(2)} ${"Status".padEnd(32)} ${"Check".padEnd(34)} Detail`);
+    console.log("─".repeat(110));
+    for (const [i, r] of results.entries()) {
+        const icon = r.status === "PASS" ? "✅" : r.status.startsWith("SKIPPED") ? "⏭️" : "❌";
+        console.log(`${String(i + 1).padStart(2)} ${icon} ${r.status.padEnd(29)} ${r.name.padEnd(34)} ${r.detail.slice(0, 80)}`);
+    }
+    const failed = results.filter(r => r.status === "FAIL");
+    console.log("─".repeat(110));
+    console.log(`${results.filter(r => r.status === "PASS").length}/${results.length} checks passed, ${results.filter(r => r.status.startsWith("SKIPPED")).length} skipped.`);
+    if (failed.length > 0) {
+        console.error("\nFailed:");
+        for (const f of failed)
+            console.error(`  - ${f.name}: ${f.detail}`);
+        process.exit(1);
+    }
+}
+main().catch((err) => {
+    console.error("❌ Unexpected error:", err);
+    process.exit(1);
+});
 //# sourceMappingURL=testDodoLive.js.map

package/dist/lib/testLiveSafehands.d.ts

@@ -1,2 +1,2 @@
-export {};
+export {};
 //# sourceMappingURL=testLiveSafehands.d.ts.map

package/dist/lib/testLiveSafehands.js

@@ -1,93 +1,93 @@
-// ─── Live SafeHands CLI Verification ───────────────────────────────────
-// Runs real CLI safety checks without broadcasting transactions.
-// All checks are read-only or dry-run preflight checks.
-// ────────────────────────────────────────────────────────────────────────
-import { spawnSync } from "node:child_process";
-import { join } from "node:path";
-import { existsSync } from "node:fs";
-const results = [];
-function runCli(args) {
-    const entry = join(process.cwd(), "dist", "index.js");
-    if (!existsSync(entry)) {
-        console.error("❌ dist/index.js not found. Run: npm run build");
-        process.exit(1);
-    }
-    const result = spawnSync(process.execPath, [entry, ...args], {
-        cwd: process.cwd(),
-        env: { ...process.env, WALLET_MODE: "none", WRITE_TOOLS_ENABLED: "false", PRIVATE_KEY: "" },
-        encoding: "utf8",
-        timeout: 30_000,
-    });
-    return { exitCode: result.status ?? 1, stdout: result.stdout || "", stderr: result.stderr || "" };
-}
-function parseJson(stdout) {
-    try {
-        return JSON.parse(stdout.trim());
-    }
-    catch {
-        return null;
-    }
-}
-function check(name, args, expected, validator) {
-    const { stdout } = runCli(args);
-    const json = parseJson(stdout);
-    const passed = json !== null && validator(json);
-    const actual = json !== null
-        ? (json.success ? `success: ${JSON.stringify(json.data).slice(0, 120)}` : `error: ${json.error?.code}`)
-        : `invalid JSON: ${stdout.slice(0, 100)}`;
-    results.push({ name, status: passed ? "PASS" : "FAIL", expected, actual });
-}
-console.log("═══════════════════════════════════════════════════════════");
-console.log("  SafeHands — Live CLI Verification (read-only)");
-console.log("═══════════════════════════════════════════════════════════");
-console.log("");
-// 1. Wallet health — no wallet configured
-check("wallet_health_no_wallet", ["skill", "safehands_wallet_health", "--input-json", "{}"], "valid JSON with status NOT_READY or DEGRADED", (json) => json.success && ["NOT_READY", "DEGRADED"].includes(json.data?.status));
-// 2. Token registry — Pharos Skill Engine USDC (DOCS_VERIFIED_FROM_PHAROS_SKILL_ENGINE)
-check("token_registry_skill_engine_usdc", ["skill", "token_registry_status", "--input-json", JSON.stringify({ tokenAddress: "0xE0BE08c77f415F577A1B3A9aD7a1Df1479564ec8" })], "SKILL_ENGINE_CANONICAL_TOKEN with DOCS_VERIFIED_FROM_PHAROS_SKILL_ENGINE", (json) => json.success && json.data?.status === "SKILL_ENGINE_CANONICAL_TOKEN" && json.data?.verificationStatus === "DOCS_VERIFIED_FROM_PHAROS_SKILL_ENGINE");
-// 3. Token registry — Circle USDC (ALTERNATE_SOURCE_TOKEN)
-check("token_registry_circle_usdc", ["skill", "token_registry_status", "--input-json", JSON.stringify({ tokenAddress: "0xcfC8330f4BCAB529c625D12781b1C19466A9Fc8B" })], "ALTERNATE_SOURCE_TOKEN with CIRCLE_REFERENCED_USDC", (json) => json.success && json.data?.status === "ALTERNATE_SOURCE_TOKEN" && json.data?.verificationStatus === "CIRCLE_REFERENCED_USDC");
-// 4. Token registry — USDT (DOCS_VERIFIED)
-check("token_registry_usdt_docs_verified", ["skill", "token_registry_status", "--input-json", JSON.stringify({ tokenAddress: "0xE7E84B8B4f39C507499c40B4ac199B050e2882d5" })], "CANONICAL_TESTNET_TOKEN with DOCS_VERIFIED", (json) => json.success && json.data?.status === "CANONICAL_TESTNET_TOKEN" && json.data?.verificationStatus === "DOCS_VERIFIED");
-// 5. Preflight — unlimited approval → BLOCK
-check("preflight_block_unlimited_approval", ["skill", "safehands_preflight_check", "--input-json", JSON.stringify({
-        actionType: "approve_token",
-        chainId: 688689,
-        tokenAddress: "0xE0BE08c77f415F577A1B3A9aD7a1Df1479564ec8",
-        targetAddress: "0x0000000000000000000000000000000000000001",
-        amount: "unlimited",
-        approvalAmount: "max",
-    })], "decision=BLOCK", (json) => json.success && json.data?.decision === "BLOCK");
-// 6. Preflight — mainnet action → BLOCK
-check("preflight_block_mainnet", ["skill", "safehands_preflight_check", "--input-json", JSON.stringify({
-        actionType: "send_payment",
-        chainId: 1,
-        isMainnet: true,
-        targetAddress: "0x0000000000000000000000000000000000000001",
-        amount: "0.001",
-    })], "decision=BLOCK", (json) => json.success && json.data?.decision === "BLOCK");
-// 7. Preflight — safe testnet action → ALLOW or WARN (not BLOCK)
-check("preflight_allow_testnet", ["skill", "safehands_preflight_check", "--input-json", JSON.stringify({
-        actionType: "send_payment",
-        chainId: 688689,
-        isMainnet: false,
-        amount: "0.001",
-        recipient: "0x000000000000000000000000000000000000dEaD",
-    })], "decision=ALLOW or WARN (not BLOCK)", (json) => json.success && json.data?.decision !== "BLOCK");
-// Print results
-console.log(`\n${"#".padStart(2)} ${"Status".padEnd(8)} ${"Check".padEnd(42)} Expected`);
-console.log("─".repeat(100));
-for (const [i, r] of results.entries()) {
-    const icon = r.status === "PASS" ? "✅" : "❌";
-    console.log(`${String(i + 1).padStart(2)} ${icon} ${r.status.padEnd(5)} ${r.name.padEnd(42)} ${r.expected}`);
-}
-const failed = results.filter(r => r.status === "FAIL");
-console.log("─".repeat(100));
-console.log(`${results.length - failed.length}/${results.length} live CLI checks passed.`);
-if (failed.length > 0) {
-    console.error("\nFailed checks:");
-    for (const f of failed)
-        console.error(`  - ${f.name}: got ${f.actual}`);
-    process.exit(1);
-}
+// ─── Live SafeHands CLI Verification ───────────────────────────────────
+// Runs real CLI safety checks without broadcasting transactions.
+// All checks are read-only or dry-run preflight checks.
+// ────────────────────────────────────────────────────────────────────────
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+const results = [];
+function runCli(args) {
+    const entry = join(process.cwd(), "dist", "index.js");
+    if (!existsSync(entry)) {
+        console.error("❌ dist/index.js not found. Run: npm run build");
+        process.exit(1);
+    }
+    const result = spawnSync(process.execPath, [entry, ...args], {
+        cwd: process.cwd(),
+        env: { ...process.env, WALLET_MODE: "none", WRITE_TOOLS_ENABLED: "false", PRIVATE_KEY: "" },
+        encoding: "utf8",
+        timeout: 30_000,
+    });
+    return { exitCode: result.status ?? 1, stdout: result.stdout || "", stderr: result.stderr || "" };
+}
+function parseJson(stdout) {
+    try {
+        return JSON.parse(stdout.trim());
+    }
+    catch {
+        return null;
+    }
+}
+function check(name, args, expected, validator) {
+    const { stdout } = runCli(args);
+    const json = parseJson(stdout);
+    const passed = json !== null && validator(json);
+    const actual = json !== null
+        ? (json.success ? `success: ${JSON.stringify(json.data).slice(0, 120)}` : `error: ${json.error?.code}`)
+        : `invalid JSON: ${stdout.slice(0, 100)}`;
+    results.push({ name, status: passed ? "PASS" : "FAIL", expected, actual });
+}
+console.log("═══════════════════════════════════════════════════════════");
+console.log("  SafeHands — Live CLI Verification (read-only)");
+console.log("═══════════════════════════════════════════════════════════");
+console.log("");
+// 1. Wallet health — no wallet configured
+check("wallet_health_no_wallet", ["skill", "safehands_wallet_health", "--input-json", "{}"], "valid JSON with status NOT_READY or DEGRADED", (json) => json.success && ["NOT_READY", "DEGRADED"].includes(json.data?.status));
+// 2. Token registry — Pharos Skill Engine USDC (DOCS_VERIFIED_FROM_PHAROS_SKILL_ENGINE)
+check("token_registry_skill_engine_usdc", ["skill", "token_registry_status", "--input-json", JSON.stringify({ tokenAddress: "0xE0BE08c77f415F577A1B3A9aD7a1Df1479564ec8" })], "SKILL_ENGINE_CANONICAL_TOKEN with DOCS_VERIFIED_FROM_PHAROS_SKILL_ENGINE", (json) => json.success && json.data?.status === "SKILL_ENGINE_CANONICAL_TOKEN" && json.data?.verificationStatus === "DOCS_VERIFIED_FROM_PHAROS_SKILL_ENGINE");
+// 3. Token registry — Circle USDC (ALTERNATE_SOURCE_TOKEN)
+check("token_registry_circle_usdc", ["skill", "token_registry_status", "--input-json", JSON.stringify({ tokenAddress: "0xcfC8330f4BCAB529c625D12781b1C19466A9Fc8B" })], "ALTERNATE_SOURCE_TOKEN with CIRCLE_REFERENCED_USDC", (json) => json.success && json.data?.status === "ALTERNATE_SOURCE_TOKEN" && json.data?.verificationStatus === "CIRCLE_REFERENCED_USDC");
+// 4. Token registry — USDT (DOCS_VERIFIED)
+check("token_registry_usdt_docs_verified", ["skill", "token_registry_status", "--input-json", JSON.stringify({ tokenAddress: "0xE7E84B8B4f39C507499c40B4ac199B050e2882d5" })], "CANONICAL_TESTNET_TOKEN with DOCS_VERIFIED", (json) => json.success && json.data?.status === "CANONICAL_TESTNET_TOKEN" && json.data?.verificationStatus === "DOCS_VERIFIED");
+// 5. Preflight — unlimited approval → BLOCK
+check("preflight_block_unlimited_approval", ["skill", "safehands_preflight_check", "--input-json", JSON.stringify({
+        actionType: "approve_token",
+        chainId: 688689,
+        tokenAddress: "0xE0BE08c77f415F577A1B3A9aD7a1Df1479564ec8",
+        targetAddress: "0x0000000000000000000000000000000000000001",
+        amount: "unlimited",
+        approvalAmount: "max",
+    })], "decision=BLOCK", (json) => json.success && json.data?.decision === "BLOCK");
+// 6. Preflight — mainnet action → BLOCK
+check("preflight_block_mainnet", ["skill", "safehands_preflight_check", "--input-json", JSON.stringify({
+        actionType: "send_payment",
+        chainId: 1,
+        isMainnet: true,
+        targetAddress: "0x0000000000000000000000000000000000000001",
+        amount: "0.001",
+    })], "decision=BLOCK", (json) => json.success && json.data?.decision === "BLOCK");
+// 7. Preflight — safe testnet action → ALLOW or WARN (not BLOCK)
+check("preflight_allow_testnet", ["skill", "safehands_preflight_check", "--input-json", JSON.stringify({
+        actionType: "send_payment",
+        chainId: 688689,
+        isMainnet: false,
+        amount: "0.001",
+        recipient: "0x000000000000000000000000000000000000dEaD",
+    })], "decision=ALLOW or WARN (not BLOCK)", (json) => json.success && json.data?.decision !== "BLOCK");
+// Print results
+console.log(`\n${"#".padStart(2)} ${"Status".padEnd(8)} ${"Check".padEnd(42)} Expected`);
+console.log("─".repeat(100));
+for (const [i, r] of results.entries()) {
+    const icon = r.status === "PASS" ? "✅" : "❌";
+    console.log(`${String(i + 1).padStart(2)} ${icon} ${r.status.padEnd(5)} ${r.name.padEnd(42)} ${r.expected}`);
+}
+const failed = results.filter(r => r.status === "FAIL");
+console.log("─".repeat(100));
+console.log(`${results.length - failed.length}/${results.length} live CLI checks passed.`);
+if (failed.length > 0) {
+    console.error("\nFailed checks:");
+    for (const f of failed)
+        console.error(`  - ${f.name}: got ${f.actual}`);
+    process.exit(1);
+}
 //# sourceMappingURL=testLiveSafehands.js.map