safehands-pharos 1.4.0 → 2.6.0

package/dist/init.js

@@ -1,66 +1,128 @@
-import * as readline from "readline/promises";
-import { writeFileSync, existsSync, readFileSync } from "fs";
-import { resolve } from "path";
-export async function runInit() {
-    console.log("\n🛡️  Welcome to SafeHands-Pharos Setup Wizard\n");
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-    });
-    const envPath = resolve(process.cwd(), ".env");
-    let existingEnv = "";
-    if (existsSync(envPath)) {
-        existingEnv = readFileSync(envPath, "utf-8");
-    }
-    const ansWrite = await rl.question("1. Do you want your AI Agent to execute write operations (Swap, Transfer, Approve)? (y/N): ");
-    const enableWrite = ansWrite.trim().toLowerCase() === "y";
-    let pk = "";
-    if (enableWrite) {
-        pk = await rl.question("2. Enter your Pharos Testnet Private Key (leave blank to auto-generate a managed agent wallet instead): ");
-    }
-    const ansBackup = await rl.question("3. Do you want to enable persistent local backups for auto-generated agent wallets? (y/N): ");
-    const enableBackup = ansBackup.trim().toLowerCase() === "y";
-    const dodoKey = await rl.question("4. (Optional) Enter your DODO API Key for live testnet routing (press Enter to skip): ");
-    rl.close();
-    // Build .env content
-    let newEnv = "";
-    newEnv += `WRITE_TOOLS_ENABLED=${enableWrite ? "true" : "false"}\n`;
-    if (pk.trim()) {
-        newEnv += `WALLET_MODE=env\n`;
-        newEnv += `PRIVATE_KEY=${pk.trim()}\n`;
-    }
-    else if (enableWrite) {
-        newEnv += `WALLET_MODE=managed-testnet\n`;
-    }
-    else {
-        newEnv += `WALLET_MODE=none\n`;
-    }
-    if (enableBackup) {
-        newEnv += `WALLET_STORE_PATH=./.agents/wallets.json\n`;
-    }
-    if (dodoKey.trim()) {
-        newEnv += `DODO_API_KEY=${dodoKey.trim()}\n`;
-    }
-    // Preserve existing lines if they don't conflict (basic merge)
-    const finalEnvLines = [];
-    const generatedKeys = ["WRITE_TOOLS_ENABLED", "WALLET_MODE", "PRIVATE_KEY", "WALLET_STORE_PATH", "DODO_API_KEY"];
-    if (existingEnv) {
-        const lines = existingEnv.split("\n");
-        for (const line of lines) {
-            const key = line.split("=")[0];
-            if (key && !generatedKeys.includes(key)) {
-                finalEnvLines.push(line);
-            }
-        }
-    }
-    const finalContent = finalEnvLines.join("\n") + "\n" + newEnv;
-    writeFileSync(envPath, finalContent.trim() + "\n");
-    console.log("\n✅ Configuration saved to .env!");
-    if (!pk.trim() && enableWrite) {
-        console.log("   Since you enabled write tools without providing a Private Key,");
-        console.log("   SafeHands will use 'managed-testnet' mode.");
-        console.log("   Run 'npx safehands-pharos skill create_agent_wallet --input-json \"{}\"' to generate one.");
-    }
-    console.log("🚀 SafeHands is ready to protect your AI Agent!\n");
-}
+import * as readline from "readline/promises";
+import { writeFileSync, existsSync, readFileSync, mkdirSync } from "fs";
+import { resolve, join, dirname } from "path";
+import { randomBytes } from "crypto";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+import { encryptKey } from "./lib/wallet/index.js";
+export async function runInit() {
+    console.log("\n🛡️  Welcome to SafeHands-Pharos Setup Wizard\n");
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    const envPath = resolve(process.cwd(), ".env");
+    let existingEnv = "";
+    if (existsSync(envPath)) {
+        existingEnv = readFileSync(envPath, "utf-8");
+    }
+    const ansWrite = await rl.question("1. Do you want your AI Agent to execute write operations (Swap, Transfer, Approve)? (y/N): ");
+    const enableWrite = ansWrite.trim().toLowerCase() === "y";
+    let pk = "";
+    if (enableWrite) {
+        pk = await rl.question("2. Enter your Pharos Mainnet Private Key (leave blank to auto-generate a managed agent wallet instead): ");
+    }
+    const ansBackup = await rl.question("3. Do you want to enable persistent local backups for auto-generated agent wallets? (y/N): ");
+    const enableBackup = ansBackup.trim().toLowerCase() === "y";
+    const dodoKey = await rl.question("4. (Optional) Enter your DODO API Key for live mainnet routing (press Enter to skip): ");
+    const goldskyUrl = await rl.question("5. (Optional) Enter your Goldsky Subgraph URL for historical data (press Enter to skip): ");
+    rl.close();
+    // Build .env content
+    let newEnv = "";
+    newEnv += `WRITE_TOOLS_ENABLED=${enableWrite ? "true" : "false"}\n`;
+    if (pk.trim()) {
+        newEnv += `WALLET_MODE=env\n`;
+        newEnv += `PRIVATE_KEY=${pk.trim()}\n`;
+    }
+    else if (enableWrite) {
+        newEnv += `WALLET_MODE=managed-mainnet\n`;
+    }
+    else {
+        newEnv += `WALLET_MODE=none\n`;
+    }
+    if (enableBackup) {
+        newEnv += `WALLET_STORE_PATH=./.agents/wallets.json\n`;
+    }
+    if (dodoKey.trim()) {
+        newEnv += `DODO_API_KEY=${dodoKey.trim()}\n`;
+    }
+    if (goldskyUrl.trim()) {
+        newEnv += `GOLDSKY_SUBGRAPH_URL=${goldskyUrl.trim()}\n`;
+    }
+    // Inject canonical mainnet contract addresses
+    newEnv += `SAFEHANDS_REGISTRY_ADDRESS=0x428e02bf85412e7242d991cd6725ec59e8b06c8d\n`;
+    newEnv += `SAFEHANDS_ATTESTATION_ADDRESS=0x71a7a87b3b1ab6d86204cad691bb32fd75b4588c\n`;
+    // Preserve existing lines if they don't conflict (basic merge)
+    const finalEnvLines = [];
+    const generatedKeys = ["WRITE_TOOLS_ENABLED", "WALLET_MODE", "PRIVATE_KEY", "WALLET_STORE_PATH", "DODO_API_KEY", "GOLDSKY_SUBGRAPH_URL", "SAFEHANDS_REGISTRY_ADDRESS", "SAFEHANDS_ATTESTATION_ADDRESS"];
+    if (existingEnv) {
+        const lines = existingEnv.split("\n");
+        for (const line of lines) {
+            const key = line.split("=")[0];
+            if (key && !generatedKeys.includes(key)) {
+                finalEnvLines.push(line);
+            }
+        }
+    }
+    const finalContent = finalEnvLines.join("\n") + "\n" + newEnv;
+    writeFileSync(envPath, finalContent.trim() + "\n");
+    console.log("\n✅ Configuration saved to .env!");
+    if (!pk.trim() && enableWrite) {
+        // Auto-create wallet + encryption key + store path
+        const storePath = resolve(process.cwd(), "./.agents/wallets.json");
+        const keyPath = join(dirname(storePath), ".key");
+        // Ensure .agents/ directory exists
+        mkdirSync(dirname(storePath), { recursive: true });
+        // Generate or load encryption key
+        let encKey;
+        if (existsSync(keyPath)) {
+            encKey = readFileSync(keyPath, "utf-8").trim();
+        }
+        else {
+            encKey = randomBytes(32).toString("hex");
+            writeFileSync(keyPath, encKey, { mode: 0o600 });
+        }
+        // Auto-create wallet
+        const privateKey = generatePrivateKey();
+        const account = privateKeyToAccount(privateKey);
+        const encrypted = encryptKey(privateKey, encKey);
+        const walletData = {};
+        if (existsSync(storePath)) {
+            try {
+                Object.assign(walletData, JSON.parse(readFileSync(storePath, "utf-8")));
+            }
+            catch { }
+        }
+        walletData["default"] = {
+            agentId: "default",
+            address: account.address,
+            encryptedKey: encrypted,
+            environment: "pacific-mainnet",
+            chainId: 1672,
+            isMainnet: true,
+            createdAt: new Date().toISOString(),
+        };
+        writeFileSync(storePath, JSON.stringify(walletData, null, 2), "utf-8");
+        // Append auto-generated config to .env
+        const appendLines = [
+            `WALLET_STORE_PATH=./.agents/wallets.json`,
+        ];
+        const currentEnv = readFileSync(envPath, "utf-8");
+        if (!currentEnv.includes("WALLET_STORE_PATH")) {
+            writeFileSync(envPath, currentEnv.trimEnd() + "\n" + appendLines.join("\n") + "\n");
+        }
+        console.log("");
+        console.log(`   🛡️  Agent wallet created automatically!`);
+        console.log(`   Address: ${account.address}`);
+        console.log("");
+        console.log(`   Next step: fund your wallet with PROS on Mainnet for gas:`);
+        console.log(`   (No faucet available on mainnet. Transfer PROS to your wallet address.)`);
+        console.log("");
+        console.log(`   Wallet is encrypted (AES-256-GCM) and stored at .agents/wallets.json`);
+        console.log(`   Encryption key saved to .agents/.key; do not share or delete this file.`);
+    }
+    else if (pk.trim() && enableWrite) {
+        console.log("   Wallet mode: env (using your private key)");
+    }
+    console.log("\n🚀 SafeHands is ready to protect your AI Agent!\n");
+}
 //# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IAEjE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,WAAW,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IAE1D,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0GAA0G,CAAC,CAAC;IACrI,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC,CAAC;IACnI,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IAE5D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;IAE5H,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,qBAAqB;IACrB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,IAAI,uBAAuB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC;IAEpE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAAC;QAC9B,MAAM,IAAI,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACzC,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,oBAAoB,CAAC;IACjC,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,4CAA4C,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAC/C,CAAC;IAED,+DAA+D;IAC/D,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,CAAC,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC;IAEjH,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;IAC9D,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IAEjE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,WAAW,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IAE1D,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0GAA0G,CAAC,CAAC;IACrI,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC,CAAC;IACnI,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IAE5D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC,CAAC;IAElI,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,qBAAqB;IACrB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,IAAI,uBAAuB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC;IAEpE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAAC;QAC9B,MAAM,IAAI,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACzC,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,+BAA+B,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,oBAAoB,CAAC;IACjC,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,4CAA4C,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAC/C,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,wBAAwB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC;IAC1D,CAAC;IAED,8CAA8C;IAC9C,MAAM,IAAI,yEAAyE,CAAC;IACpF,MAAM,IAAI,4EAA4E,CAAC;IAEvF,+DAA+D;IAC/D,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,CAAC,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,+BAA+B,CAAC,CAAC;IAExM,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;IAC9D,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC9B,mDAAmD;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjD,mCAAmC;QACnC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnD,kCAAkC;QAClC,IAAI,MAAc,CAAC;QACnB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,qBAAqB;QACrB,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QAC3F,CAAC;QACD,UAAU,CAAC,SAAS,CAAC,GAAG;YACtB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,SAAS;YACvB,WAAW,EAAE,iBAAiB;YAC9B,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAEvE,uCAAuC;QACvC,MAAM,WAAW,GAAG;YAClB,0CAA0C;SAC3C,CAAC;QACF,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9C,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC5F,CAAC;SAAM,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/analysis/approval.d.ts

@@ -0,0 +1,29 @@
+import { type AddressTrustEvidence } from "../ecosystemRegistry.js";
+import { type CanonicalContractEvidence } from "./contractIntel.js";
+import { type TokenRegistryEvidence } from "./pharosTokens.js";
+import { type AnalyzerResult } from "./types.js";
+export declare const APPROVE_SELECTOR = "0x095ea7b3";
+export interface ApprovalAnalysisDetails {
+    isApproval: boolean;
+    selector: string | null;
+    token: string | null;
+    spender: string | null;
+    spenderKnown: boolean;
+    spenderLabel: string | null;
+    isPermit2Spender: boolean;
+    amountRaw: string | null;
+    unlimited: boolean;
+    isRevoke: boolean;
+    /** Per-network canonical recognition of the spender (null when not canonical). */
+    canonicalContractEvidence: CanonicalContractEvidence | null;
+    /** Per-network token-registry evidence for the approved token (null when unknown). */
+    tokenRegistryEvidence: TokenRegistryEvidence | null;
+    /** Ecosystem-registry match for the spender — recognition only unless verifiedCanonical. */
+    spenderRegistryRecognition: AddressTrustEvidence | null;
+}
+/**
+ * @param data  ERC-20 calldata (expected approve(address,uint256))
+ * @param token optional token contract address the approval targets
+ */
+export declare function analyzeApproval(data: string, token?: string): AnalyzerResult<ApprovalAnalysisDetails>;
+//# sourceMappingURL=approval.d.ts.map

package/dist/lib/analysis/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../../src/lib/analysis/approval.ts"],"names":[],"mappings":"AASA,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAA6B,KAAK,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,gBAAgB,eAAe,CAAC;AA6C7C,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,kFAAkF;IAClF,yBAAyB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC5D,sFAAsF;IACtF,qBAAqB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpD,4FAA4F;IAC5F,0BAA0B,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,CA6GrG"}

package/dist/lib/analysis/approval.js

@@ -0,0 +1,162 @@
+// ─── Approval Analyzer (read-only) ─────────────────────────────────────
+// Decodes ERC-20 approve(address,uint256) calldata and classifies risk. Permit2
+// is recognized; deep Permit2 (PermitSingle/PermitBatch) decode is Experimental.
+// Never approves, signs, or sends.
+// ────────────────────────────────────────────────────────────────────────
+import { decodeFunctionData, getAddress, isAddress } from "viem";
+import { isUnlimitedApprovalAmount } from "../policy/actionPolicyEngine.js";
+import { CHAIN_ID } from "../constants.js";
+import { addressTrustEvidence } from "../ecosystemRegistry.js";
+import { canonicalContractEvidence } from "./contractIntel.js";
+import { tokenRegistryEvidence } from "./pharosTokens.js";
+import { makeResult } from "./types.js";
+export const APPROVE_SELECTOR = "0x095ea7b3";
+const PERMIT2_ADDRESS = "0x000000000022d473030f116ddee9f6b43ac78ba3";
+const APPROVE_ABI = [
+    {
+        name: "approve",
+        type: "function",
+        stateMutability: "nonpayable",
+        inputs: [
+            { name: "spender", type: "address" },
+            { name: "amount", type: "uint256" },
+        ],
+        outputs: [{ name: "", type: "bool" }],
+    },
+];
+/**
+ * Spender trust, registry-driven only. "known" (risk-relaxing) requires either
+ * per-network canonical-infrastructure metadata or a VERIFIED allow_eligible
+ * registry contract on the active chain. Any other registry match is
+ * recognition-only and NEVER relaxes risk (truth-model rule: recognition is not
+ * proof). The former hardcoded DODO/FaroSwap "known spender" entries are gone —
+ * those addresses are testnet-provenance, absent from the registry, and were an
+ * unearned trust signal on mainnet.
+ */
+function classifySpender(spender) {
+    const valid = isAddress(spender);
+    const canonical = valid ? canonicalContractEvidence(spender) : null;
+    const lower = spender.toLowerCase();
+    const isPermit2 = lower === PERMIT2_ADDRESS;
+    const registry = valid ? addressTrustEvidence(spender, CHAIN_ID) : null;
+    const registryRecognition = registry && (registry.recognized || registry.note) ? registry : null;
+    if (canonical)
+        return { known: true, label: canonical.name, isPermit2, canonical, registryRecognition };
+    if (registry?.verifiedCanonical) {
+        return { known: true, label: registry.contractLabel ?? registry.itemName, isPermit2, canonical: null, registryRecognition };
+    }
+    return { known: false, label: registryRecognition?.contractLabel ?? null, isPermit2, canonical: null, registryRecognition };
+}
+/**
+ * @param data  ERC-20 calldata (expected approve(address,uint256))
+ * @param token optional token contract address the approval targets
+ */
+export function analyzeApproval(data, token) {
+    const reasons = [];
+    const warnings = [];
+    const hex = (data?.startsWith("0x") ? data : `0x${data ?? ""}`).toLowerCase();
+    const selector = hex.length >= 10 ? hex.slice(0, 10) : null;
+    // Read-only metadata only — a known token NEVER makes a risky approval safe.
+    const tokenEvidence = token ? tokenRegistryEvidence(token) : null;
+    const notApproval = (msg) => makeResult({
+        analyzer: "approval",
+        decision: "REQUIRE_CONFIRMATION",
+        internalDecision: "REQUIRE_CONFIRMATION",
+        riskLevel: "UNKNOWN",
+        reasons: [msg],
+        warnings: [],
+        analyzerStatus: "unavailable",
+        details: { isApproval: false, selector, token: token ?? null, spender: null, spenderKnown: false, spenderLabel: null, isPermit2Spender: false, amountRaw: null, unlimited: false, isRevoke: false, canonicalContractEvidence: null, tokenRegistryEvidence: tokenEvidence, spenderRegistryRecognition: null },
+    });
+    if (selector !== APPROVE_SELECTOR) {
+        return notApproval(`Calldata is not an ERC-20 approve (selector ${selector ?? "n/a"}).`);
+    }
+    let spender;
+    let amount;
+    try {
+        const decoded = decodeFunctionData({ abi: APPROVE_ABI, data: hex });
+        spender = getAddress(decoded.args[0]);
+        amount = decoded.args[1];
+    }
+    catch {
+        return makeResult({
+            analyzer: "approval",
+            decision: "REQUIRE_CONFIRMATION",
+            internalDecision: "REQUIRE_CONFIRMATION",
+            riskLevel: "MEDIUM",
+            reasons: ["approve() calldata could not be decoded: malformed approval."],
+            warnings: ["Malformed approval calldata."],
+            analyzerStatus: "partial",
+            details: { isApproval: true, selector, token: token ?? null, spender: null, spenderKnown: false, spenderLabel: null, isPermit2Spender: false, amountRaw: null, unlimited: false, isRevoke: false, canonicalContractEvidence: null, tokenRegistryEvidence: tokenEvidence, spenderRegistryRecognition: null },
+        });
+    }
+    const unlimited = isUnlimitedApprovalAmount(amount.toString());
+    const isRevoke = amount === 0n;
+    const { known, label, isPermit2, canonical, registryRecognition } = classifySpender(spender);
+    if (isPermit2)
+        warnings.push("Spender is Permit2: Permit2-based approvals can later authorize transfers via signatures (deep Permit2 decode is Experimental).");
+    if (!known && registryRecognition?.recognized) {
+        warnings.push(`Spender matches ecosystem-registry entry "${registryRecognition.contractLabel}" (${registryRecognition.verificationStatus}); recognition only, not a safety signal.`);
+    }
+    else if (!known && registryRecognition?.note) {
+        warnings.push(registryRecognition.note);
+    }
+    let internalDecision;
+    let riskLevel;
+    if (!isAddress(spender)) {
+        internalDecision = "BLOCK";
+        riskLevel = "CRITICAL";
+        reasons.push("Spender address is invalid.");
+    }
+    else if (isRevoke) {
+        internalDecision = "ALLOW";
+        riskLevel = "LOW";
+        reasons.push(`Zero approval: revoking the allowance for ${spender}${label ? ` (${label})` : ""}.`);
+    }
+    else if (unlimited && !known) {
+        internalDecision = "BLOCK";
+        riskLevel = "CRITICAL";
+        reasons.push(`Unlimited approval to an unknown spender (${spender}); blocked.`);
+    }
+    else if (unlimited && known) {
+        internalDecision = "REQUIRE_CONFIRMATION";
+        riskLevel = "HIGH";
+        reasons.push(`Unlimited approval to a known spender (${label}); high risk, confirm intent.`);
+    }
+    else if (!known) {
+        internalDecision = "REQUIRE_CONFIRMATION";
+        riskLevel = "MEDIUM";
+        reasons.push(`Approval (amount ${amount.toString()}) to an unknown spender (${spender}); confirm before approving.`);
+    }
+    else {
+        internalDecision = "ALLOW";
+        riskLevel = "LOW";
+        reasons.push(`Limited approval (amount ${amount.toString()}) to a known spender (${label}).`);
+    }
+    return makeResult({
+        analyzer: "approval",
+        decision: internalDecision,
+        internalDecision,
+        riskLevel,
+        reasons,
+        warnings,
+        analyzerStatus: "ok",
+        experimental: isPermit2 || undefined,
+        details: {
+            isApproval: true,
+            selector,
+            token: token ?? null,
+            spender,
+            spenderKnown: known,
+            spenderLabel: label,
+            isPermit2Spender: isPermit2,
+            amountRaw: amount.toString(),
+            unlimited,
+            isRevoke,
+            canonicalContractEvidence: canonical,
+            tokenRegistryEvidence: tokenEvidence,
+            spenderRegistryRecognition: registryRecognition,
+        },
+    });
+}
+//# sourceMappingURL=approval.js.map

package/dist/lib/analysis/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../src/lib/analysis/approval.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,gFAAgF;AAChF,iFAAiF;AACjF,mCAAmC;AACnC,2EAA2E;AAE3E,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAA6B,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAkC,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAA8B,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAuB,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAC7C,MAAM,eAAe,GAAG,4CAA4C,CAAC;AAErE,MAAM,WAAW,GAAG;IAClB;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;YACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;SACpC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,OAAe;IAOtC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,KAAK,eAAe,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,mBAAmB,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,IAAI,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACxG,IAAI,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,aAAa,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;AAC9H,CAAC;AAqBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,6EAA6E;IAC7E,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,MAAM,WAAW,GAAG,CAAC,GAAW,EAA2C,EAAE,CAC3E,UAAU,CAA0B;QAClC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,sBAAsB;QAChC,gBAAgB,EAAE,sBAAsB;QACxC,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,CAAC,GAAG,CAAC;QACd,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,aAAa;QAC7B,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,0BAA0B,EAAE,IAAI,EAAE;KAC7S,CAAC,CAAC;IAEL,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC,+CAA+C,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,GAAoB,EAAE,CAAC,CAAC;QACrF,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC,CAAC;QAChD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAA0B;YACzC,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,sBAAsB;YAChC,gBAAgB,EAAE,sBAAsB;YACxC,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,CAAC,8DAA8D,CAAC;YACzE,QAAQ,EAAE,CAAC,8BAA8B,CAAC;YAC1C,cAAc,EAAE,SAAS;YACzB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,0BAA0B,EAAE,IAAI,EAAE;SAC5S,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7F,IAAI,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,iIAAiI,CAAC,CAAC;IAChK,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,UAAU,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CACX,6CAA6C,mBAAmB,CAAC,aAAa,MAAM,mBAAmB,CAAC,kBAAkB,2CAA2C,CACtK,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,IAAI,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,gBAA4D,CAAC;IACjE,IAAI,SAAsC,CAAC;IAE3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,gBAAgB,GAAG,OAAO,CAAC;QAC3B,SAAS,GAAG,UAAU,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9C,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,gBAAgB,GAAG,OAAO,CAAC;QAC3B,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,6CAA6C,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,gBAAgB,GAAG,OAAO,CAAC;QAC3B,SAAS,GAAG,UAAU,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,6CAA6C,OAAO,aAAa,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,gBAAgB,GAAG,sBAAsB,CAAC;QAC1C,SAAS,GAAG,MAAM,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,0CAA0C,KAAK,+BAA+B,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,gBAAgB,GAAG,sBAAsB,CAAC;QAC1C,SAAS,GAAG,QAAQ,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,4BAA4B,OAAO,8BAA8B,CAAC,CAAC;IACvH,CAAC;SAAM,CAAC;QACN,gBAAgB,GAAG,OAAO,CAAC;QAC3B,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,UAAU,CAA0B;QACzC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,gBAAgB;QAC1B,gBAAgB;QAChB,SAAS;QACT,OAAO;QACP,QAAQ;QACR,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,SAAS,IAAI,SAAS;QACpC,OAAO,EAAE;YACP,UAAU,EAAE,IAAI;YAChB,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,OAAO;YACP,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,KAAK;YACnB,gBAAgB,EAAE,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC5B,SAAS;YACT,QAAQ;YACR,yBAAyB,EAAE,SAAS;YACpC,qBAAqB,EAAE,aAAa;YACpC,0BAA0B,EAAE,mBAAmB;SAChD;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/analysis/calldata.d.ts

@@ -0,0 +1,60 @@
+import { type CanonicalContractEvidence } from "./contractIntel.js";
+import { type TokenRegistryEvidence } from "./pharosTokens.js";
+import { type AnalyzerResult } from "./types.js";
+export declare const PERMIT_SELECTOR = "0xd505accf";
+export declare const PERMIT2_APPROVE_SELECTOR = "0x87517c45";
+export declare const SET_APPROVAL_FOR_ALL_SELECTOR = "0xa22cb465";
+export declare const TRANSFER_FROM_SELECTOR = "0x23b872dd";
+export declare const TRANSFER_SELECTOR = "0xa9059cbb";
+export declare const INCREASE_ALLOWANCE_SELECTOR = "0x39509351";
+export declare const DECREASE_ALLOWANCE_SELECTOR = "0xa457c2d7";
+export declare const TRANSFER_OWNERSHIP_SELECTOR = "0xf2fde38b";
+export declare const RENOUNCE_OWNERSHIP_SELECTOR = "0x715018a6";
+export declare const UPGRADE_TO_SELECTOR = "0x3659cfe6";
+export declare const UPGRADE_TO_AND_CALL_SELECTOR = "0x4f1ef286";
+export declare const CHANGE_ADMIN_SELECTOR = "0x8f283970";
+/**
+ * Selectors this analyzer decodes on its own (i.e. everything EXCEPT approve,
+ * which analyzeApproval owns, and MultiSend, which analyzeSafeTx owns). The
+ * guardian dispatch uses this to decide when to add the calldata analyzer.
+ */
+export declare const DECODABLE_CALLDATA_SELECTORS: ReadonlySet<string>;
+/** True when `analyzeCalldata` can decode this selector (approve delegates in-analyzer). */
+export declare function isDecodableCalldataSelector(selector: string | null): boolean;
+export type CalldataCategory = "approval" | "transfer" | "admin" | "unknown";
+export interface CalldataAnalysisDetails {
+    method: string | null;
+    selector: string | null;
+    category: CalldataCategory;
+    /** Token contract the call targets (Permit2 approve carries it inline; else the passed `token`). */
+    token: string | null;
+    /** Approval/permit spender (approve/permit/permit2/increase/decrease). */
+    spender: string | null;
+    /** setApprovalForAll operator. */
+    operator: string | null;
+    /** transfer/transferFrom recipient. */
+    recipient: string | null;
+    /** transferFrom source. */
+    from: string | null;
+    amountRaw: string | null;
+    unlimited: boolean;
+    isRevoke: boolean;
+    /** setApprovalForAll approved flag (null for other methods). */
+    approved: boolean | null;
+    /** Whether the spender/operator is a recognized canonical/configured address. */
+    counterpartyKnown: boolean;
+    counterpartyLabel: string | null;
+    /** Whether the recipient is on the operator denylist. */
+    recipientDenylisted: boolean;
+    /** True for the non-exhaustive dangerous-admin dictionary. */
+    dangerous: boolean;
+    canonicalContractEvidence: CanonicalContractEvidence | null;
+    tokenRegistryEvidence: TokenRegistryEvidence | null;
+}
+/**
+ * Decode and risk-classify a single calldata payload.
+ * @param data  0x-prefixed calldata
+ * @param token optional token contract address the call targets (for metadata + Permit2 token)
+ */
+export declare function analyzeCalldata(data: string, token?: string): AnalyzerResult<CalldataAnalysisDetails>;
+//# sourceMappingURL=calldata.d.ts.map

package/dist/lib/analysis/calldata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calldata.d.ts","sourceRoot":"","sources":["../../../src/lib/analysis/calldata.ts"],"names":[],"mappings":"AAkBA,OAAO,EAA6B,KAAK,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG7D,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,wBAAwB,eAAe,CAAC;AACrD,eAAO,MAAM,6BAA6B,eAAe,CAAC;AAC1D,eAAO,MAAM,sBAAsB,eAAe,CAAC;AACnD,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,2BAA2B,eAAe,CAAC;AACxD,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAGxD,eAAO,MAAM,2BAA2B,eAAe,CAAC;AACxD,eAAO,MAAM,2BAA2B,eAAe,CAAC;AACxD,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AACzD,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAOlD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAa3D,CAAC;AAEH,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAG5E;AAkCD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oGAAoG;IACpG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uCAAuC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,iFAAiF;IACjF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,yDAAyD;IACzD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,yBAAyB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC5D,qBAAqB,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACrD;AA6DD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAqIrG"}