safehands-pharos 1.4.0 → 2.6.0

package/dist/tools/checkTokenSecurity.js

@@ -1,96 +1,241 @@
-// ─── Tool: check_token_security ─────────────────────────────────────────
-// Fetches token security intelligence from GoPlus Security API.
-// ────────────────────────────────────────────────────────────────────────
-import { z } from "zod";
-import { isAddress } from "viem";
-import { CHAIN_ID, PHAROS_ENVIRONMENT } from "../lib/constants.js";
-import { fetchWithTimeoutAndRetry } from "../lib/http.js";
-import { classifyExternalError, fail, ok } from "../lib/toolResponse.js";
-export const checkTokenSecuritySchema = z.object({
-    tokenAddress: z.string(),
-    chainId: z.number().optional().default(CHAIN_ID),
-});
-export const checkTokenSecurityTool = {
-    name: "check_token_security",
-    description: "Check token contract security (honeypot, mintable, ownership privileges, tax) via GoPlus Security API.",
-    inputSchema: checkTokenSecuritySchema,
-};
-export async function handleCheckTokenSecurity(raw) {
-    const input = checkTokenSecuritySchema.parse(raw);
-    const address = input.tokenAddress.toLowerCase().trim();
-    const chainId = input.chainId;
-    if (!isAddress(address)) {
-        return fail("INVALID_TOKEN_ADDRESS", `Invalid token address: ${input.tokenAddress}`, false, "check_token_security");
-    }
-    // GoPlus does not index Pharos Atlantic Testnet (chain 688689). Return a clear diagnostic
-    // rather than a confusing empty result from the API.
-    if (chainId === CHAIN_ID) {
-        return fail("CHAIN_NOT_SUPPORTED_BY_GOPLUS", `GoPlus Security API does not support Pharos Atlantic Testnet (chain ${CHAIN_ID}). ` +
-            "Token security data is unavailable for this chain. Use token_registry_status to check " +
-            "whether a token address is canonical, custom, or unknown on Pharos.", false, "check_token_security");
-    }
-    const url = `https://api.gopluslabs.io/api/v1/token_security/${chainId}?contract_addresses=${address}`;
-    try {
-        const res = await fetchWithTimeoutAndRetry(url, { timeoutMs: 10_000, retries: 2, retryDelayMs: 300 });
-        if (!res.ok) {
-            throw new Error(`GoPlus API returned status ${res.status}`);
-        }
-        const data = (await res.json());
-        if (data.code !== 1 || !data.result || !data.result[address]) {
-            return fail("TOKEN_SECURITY_DATA_UNAVAILABLE", data.message || "Token security data is not available for this contract on the specified chain.", true, "goplus_api");
-        }
-        const details = data.result[address];
-        const isHoneypot = details.is_honeypot === "1";
-        const buyTax = parseFloat(details.buy_tax || "0") * 100;
-        const sellTax = parseFloat(details.sell_tax || "0") * 100;
-        const isMintable = details.is_mintable === "1";
-        const transferPausable = details.transfer_pausable === "1";
-        let riskScore = 0;
-        const flags = [];
-        if (isHoneypot) {
-            riskScore += 80;
-            flags.push("Honeypot contract detected - buy at your own peril (cannot sell)");
-        }
-        if (buyTax > 10) {
-            riskScore += 15;
-            flags.push(`High buy tax: ${buyTax.toFixed(2)}%`);
-        }
-        if (sellTax > 10) {
-            riskScore += 15;
-            flags.push(`High sell tax: ${sellTax.toFixed(2)}%`);
-        }
-        if (isMintable) {
-            riskScore += 10;
-            flags.push("Token is mintable by owner/creator");
-        }
-        if (transferPausable) {
-            riskScore += 15;
-            flags.push("Trading/transfers can be paused by owner");
-        }
-        const safetyScore = Math.max(0, 100 - riskScore);
-        return ok({
-            chainId,
-            environment: chainId === CHAIN_ID ? PHAROS_ENVIRONMENT : "custom-chain",
-            isMainnet: false,
-            tokenAddress: address,
-            securityProfile: {
-                safetyScore,
-                isHoneypot,
-                buyTaxPercent: buyTax,
-                sellTaxPercent: sellTax,
-                isMintable,
-                transferPausable,
-                isProxy: details.is_proxy === "1",
-                ownerAddress: details.owner_address || "0x0000000000000000000000000000000000000000",
-                creatorAddress: details.creator_address || "0x0000000000000000000000000000000000000000",
-            },
-            flags,
-            source: "goplus_api",
-            sourceStatus: "ok",
-        });
-    }
-    catch (err) {
-        return classifyExternalError("goplus_api", err);
-    }
-}
+// ─── Tool: check_token_security ─────────────────────────────────────────
+// Fetches token security intelligence from GoPlus Security API.
+// ────────────────────────────────────────────────────────────────────────
+import { z } from "zod";
+import { isAddress } from "viem";
+import { CHAIN_ID, IS_MAINNET, PHAROS_ENVIRONMENT, SAFEHANDS_USER_AGENT, activeTokenMap } from "../lib/constants.js";
+import { fetchWithTimeoutAndRetry } from "../lib/http.js";
+import { classifyExternalError, fail, ok } from "../lib/toolResponse.js";
+export const checkTokenSecuritySchema = z.object({
+    tokenAddress: z.string(),
+    chainId: z.number().optional().default(CHAIN_ID),
+});
+export const checkTokenSecurityTool = {
+    name: "check_token_security",
+    description: "Check token contract security (honeypot, mintable, ownership privileges, tax) via GoPlus Security API.",
+    inputSchema: checkTokenSecuritySchema,
+};
+/**
+ * GoPlus base URL — env-configurable via GOPLUS_API_BASE (same variable the
+ * hosted Anvita engine honors), defaulting to the keyless public API. Read at
+ * call time so tests/operators can repoint it without a process restart.
+ */
+function goplusApiBase() {
+    return (process.env.GOPLUS_API_BASE || "https://api.gopluslabs.io").replace(/\/+$/, "");
+}
+// GOPLUS_API_BASE is operator-controlled, so both GoPlus call sites go through the
+// SSRF-safe layer (DNS-pinned, blocklist-enforcing) instead of bare fetch. The
+// security check keeps the stronger retry budget; identity enrichment stays
+// single-attempt with a short timeout (see fetchGoplusTokenIdentity).
+function fetchGoplus(url) {
+    return fetchWithTimeoutAndRetry(url, {
+        timeoutMs: 10_000,
+        retries: 2,
+        retryDelayMs: 300,
+        headers: {
+            accept: "application/json",
+            "user-agent": SAFEHANDS_USER_AGENT,
+        },
+    });
+}
+// ─── GoPlus schema parsing (fail-closed) ───────────────────────────────
+// GoPlus's Pharos (chain 1672) support is new and its response schema is still
+// maturing. GoPlus encodes booleans as "1"/"0" strings; we tolerate numeric/boolean
+// drift too, so a retyped value can't make a real honeypot read as false. Crucially,
+// if the honeypot decision field is absent or in an unrecognized shape,
+// interpretGoplusTokenResult returns null so the caller FAILS CLOSED — it never scores
+// an unreadable response as safetyScore=100 (an effective ALLOW on data never assessed).
+function goplusTruthy(v) {
+    return v === "1" || v === 1 || v === true;
+}
+function goplusFlagKnown(v) {
+    return v === "1" || v === "0" || v === 1 || v === 0 || v === true || v === false;
+}
+// Untrusted external strings, display-only: trim + cap; absent/non-string → undefined.
+// Identity metadata never influences any fail-closed decision.
+function optionalString(v) {
+    return typeof v === "string" && v.trim() ? v.trim().slice(0, 128) : undefined;
+}
+/**
+ * Parse a GoPlus token_security result entry into a normalized profile, or return
+ * `null` when the schema is unrecognized (the honeypot decision field is missing or
+ * not a boolean-ish value). Pure + synchronous so the fail-open guard is unit-testable
+ * with no network. Callers MUST treat null as "data unavailable" and fail closed.
+ */
+export function interpretGoplusTokenResult(details) {
+    if (!details || typeof details !== "object")
+        return null;
+    const d = details;
+    if (!goplusFlagKnown(d.is_honeypot))
+        return null; // schema drift → fail closed, never "safe"
+    const zero = "0x0000000000000000000000000000000000000000";
+    return {
+        tokenName: optionalString(d.token_name),
+        tokenSymbol: optionalString(d.token_symbol),
+        isHoneypot: goplusTruthy(d.is_honeypot),
+        buyTaxPercent: (parseFloat(String(d.buy_tax ?? "")) || 0) * 100,
+        sellTaxPercent: (parseFloat(String(d.sell_tax ?? "")) || 0) * 100,
+        isMintable: goplusTruthy(d.is_mintable),
+        transferPausable: goplusTruthy(d.transfer_pausable),
+        isProxy: goplusTruthy(d.is_proxy),
+        ownerAddress: (typeof d.owner_address === "string" && d.owner_address) || zero,
+        creatorAddress: (typeof d.creator_address === "string" && d.creator_address) || zero,
+    };
+}
+/**
+ * Best-effort, DISPLAY-ONLY token identity from GoPlus. Reads ONLY token_name /
+ * token_symbol and deliberately ignores the security schema: a payload that
+ * check_token_security fails closed on (e.g. is_honeypot missing) can still carry
+ * identity metadata. Never throws — returns {} on any timeout/network/parse failure.
+ * Unlike the security check (which keeps the stronger fetchGoplus retry path),
+ * this is optional enrichment: a single attempt with a short 3s timeout so it
+ * cannot make token_registry_status slow.
+ * MUST NOT be used for risk scoring, policy decisions, write gates, or
+ * allow/block logic; it does not verify anything about the token.
+ */
+export async function fetchGoplusTokenIdentity(tokenAddress, chainId = CHAIN_ID) {
+    const address = tokenAddress.toLowerCase().trim();
+    if (!isAddress(address))
+        return {};
+    try {
+        const res = await fetchWithTimeoutAndRetry(`${goplusApiBase()}/api/v1/token_security/${chainId}?contract_addresses=${address}`, {
+            timeoutMs: 3_000,
+            retries: 0,
+            headers: {
+                accept: "application/json",
+                "user-agent": SAFEHANDS_USER_AGENT,
+            },
+        });
+        if (!res.ok)
+            return {};
+        const data = (await res.json());
+        const d = data?.result?.[address];
+        if (!d || typeof d !== "object")
+            return {};
+        return {
+            tokenName: optionalString(d.token_name),
+            tokenSymbol: optionalString(d.token_symbol),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Network metadata for the tool response, derived from the ACTIVE network
+ * instead of a hardcoded `isMainnet: true` (which misreported on
+ * atlantic-testnet). Unknown chains report false. Pure + exported for tests.
+ */
+export function tokenSecurityNetworkMetadata(chainId) {
+    return {
+        chainId,
+        environment: chainId === CHAIN_ID ? PHAROS_ENVIRONMENT : "custom-chain",
+        isMainnet: chainId === CHAIN_ID ? IS_MAINNET : false,
+    };
+}
+export async function handleCheckTokenSecurity(raw) {
+    const input = checkTokenSecuritySchema.parse(raw);
+    const address = input.tokenAddress.toLowerCase().trim();
+    const chainId = input.chainId;
+    if (!isAddress(address)) {
+        return fail("INVALID_TOKEN_ADDRESS", `Invalid token address: ${input.tokenAddress}`, false, "check_token_security");
+    }
+    // GoPlus supports Pharos Mainnet (chain 1672) — a third-party claim; results are
+    // risk intel, never identity. Base URL honors GOPLUS_API_BASE like the hosted
+    // Anvita engine, so both runtimes point at the same configurable truth source.
+    const url = `${goplusApiBase()}/api/v1/token_security/${chainId}?contract_addresses=${address}`;
+    try {
+        const res = await fetchGoplus(url);
+        if (!res.ok) {
+            throw new Error(`GoPlus API returned status ${res.status}`);
+        }
+        const data = (await res.json());
+        if (data.code !== 1 || !data.result || !data.result[address]) {
+            return fail("TOKEN_SECURITY_DATA_UNAVAILABLE", data.message || "Token security data is not available for this contract on the specified chain.", true, "goplus_api");
+        }
+        const details = data.result[address];
+        // Refuse to score an unrecognized GoPlus schema as "safe" — fail closed.
+        const profile = interpretGoplusTokenResult(details);
+        if (!profile) {
+            return fail("TOKEN_SECURITY_DATA_UNAVAILABLE", "GoPlus returned an unrecognized token-security schema for this contract (honeypot signal missing or not boolean). Failing closed: token treated as unreviewed, not safe.", true, "goplus_api");
+        }
+        const { isHoneypot, buyTaxPercent: buyTax, sellTaxPercent: sellTax, isMintable, transferPausable } = profile;
+        let riskScore = 0;
+        const flags = [];
+        if (isHoneypot) {
+            riskScore += 80;
+            flags.push("Honeypot contract detected - buy at your own peril (cannot sell)");
+        }
+        if (buyTax > 10) {
+            riskScore += 15;
+            flags.push(`High buy tax: ${buyTax.toFixed(2)}%`);
+        }
+        if (sellTax > 10) {
+            riskScore += 15;
+            flags.push(`High sell tax: ${sellTax.toFixed(2)}%`);
+        }
+        if (isMintable) {
+            riskScore += 10;
+            flags.push("Token is mintable by owner/creator");
+        }
+        if (transferPausable) {
+            riskScore += 15;
+            flags.push("Trading/transfers can be paused by owner");
+        }
+        const safetyScore = Math.max(0, 100 - riskScore);
+        return ok({
+            ...tokenSecurityNetworkMetadata(chainId),
+            tokenAddress: address,
+            tokenName: profile.tokenName,
+            tokenSymbol: profile.tokenSymbol,
+            securityProfile: {
+                safetyScore,
+                isHoneypot,
+                buyTaxPercent: buyTax,
+                sellTaxPercent: sellTax,
+                isMintable,
+                transferPausable,
+                isProxy: profile.isProxy,
+                ownerAddress: profile.ownerAddress,
+                creatorAddress: profile.creatorAddress,
+            },
+            flags,
+            source: "goplus_api",
+            sourceStatus: "ok",
+        });
+    }
+    catch (err) {
+        return classifyExternalError("goplus_api", err);
+    }
+}
+/** Address is a canonical token in the active-network registry (identity verified). */
+function isRegistryToken(address) {
+    const a = address.toLowerCase();
+    return Object.values(activeTokenMap()).some((v) => typeof v === "string" && v.toLowerCase() === a);
+}
+export async function evaluateTokenSecurityGate(tokenAddress, chainId = CHAIN_ID) {
+    if (!isAddress(tokenAddress)) {
+        // Unresolvable token → nothing reviewable → fail closed (not caller-confirmable).
+        return { verdict: "review", policyStatus: "unavailable", flags: [], detail: "Token address could not be resolved for security review." };
+    }
+    const res = await handleCheckTokenSecurity({ tokenAddress, chainId });
+    if (!res.success) {
+        // GoPlus unavailable / token not indexed → nothing was reviewed. Registry-canonical
+        // tokens stay caller-confirmable (identity verified on the official token registry);
+        // everything else is "unavailable" and the write gate fails closed on it.
+        if (isRegistryToken(tokenAddress)) {
+            return { verdict: "review", policyStatus: "unknown", flags: [], detail: `${res.error.message} Token address matches the official active-network token registry: identity verified; GoPlus intel unavailable.` };
+        }
+        return { verdict: "review", policyStatus: "unavailable", flags: [], detail: res.error.message };
+    }
+    const data = res.data;
+    const p = data.securityProfile;
+    if (p.isHoneypot || p.sellTaxPercent >= 25 || p.buyTaxPercent >= 25) {
+        return { verdict: "block", policyStatus: "unknown", flags: data.flags, safetyScore: p.safetyScore, detail: "Token flagged as honeypot or extreme-tax by GoPlus." };
+    }
+    if (p.safetyScore < 70 || p.transferPausable || data.flags.length > 0) {
+        return { verdict: "review", policyStatus: "unknown", flags: data.flags, safetyScore: p.safetyScore };
+    }
+    return { verdict: "ok", policyStatus: "ok", flags: data.flags, safetyScore: p.safetyScore };
+}
 //# sourceMappingURL=checkTokenSecurity.js.map

package/dist/tools/checkTokenSecurity.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkTokenSecurity.js","sourceRoot":"","sources":["../../src/tools/checkTokenSecurity.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,gEAAgE;AAChE,2EAA2E;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAEzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,wGAAwG;IAC1G,WAAW,EAAE,wBAAwB;CACtC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAA4B;IACzE,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,uBAAuB,EAAE,0BAA0B,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACtH,CAAC;IAED,0FAA0F;IAC1F,qDAAqD;IACrD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,+BAA+B,EAC/B,uEAAuE,QAAQ,KAAK;YAClF,wFAAwF;YACxF,qEAAqE,EACvE,KAAK,EACL,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,mDAAmD,OAAO,uBAAuB,OAAO,EAAE,CAAC;IAEvG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;QAEvC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CACT,iCAAiC,EACjC,IAAI,CAAC,OAAO,IAAI,gFAAgF,EAChG,IAAI,EACJ,YAAY,CACb,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;QACxD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC;QAC/C,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,KAAK,GAAG,CAAC;QAE3D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;YAChB,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;YACjB,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAEjD,OAAO,EAAE,CAAC;YACR,OAAO;YACP,WAAW,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc;YACvE,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,OAAO;YACrB,eAAe,EAAE;gBACf,WAAW;gBACX,UAAU;gBACV,aAAa,EAAE,MAAM;gBACrB,cAAc,EAAE,OAAO;gBACvB,UAAU;gBACV,gBAAgB;gBAChB,OAAO,EAAE,OAAO,CAAC,QAAQ,KAAK,GAAG;gBACjC,YAAY,EAAE,OAAO,CAAC,aAAa,IAAI,4CAA4C;gBACnF,cAAc,EAAE,OAAO,CAAC,eAAe,IAAI,4CAA4C;aACxF;YACD,KAAK;YACL,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}
+{"version":3,"file":"checkTokenSecurity.js","sourceRoot":"","sources":["../../src/tools/checkTokenSecurity.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,gEAAgE;AAChE,2EAA2E;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAEzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,wGAAwG;IAC1G,WAAW,EAAE,wBAAwB;CACtC,CAAC;AAEF;;;;GAIG;AACH,SAAS,aAAa;IACpB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,mFAAmF;AACnF,+EAA+E;AAC/E,4EAA4E;AAC5E,sEAAsE;AACtE,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,wBAAwB,CAAC,GAAG,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,GAAG;QACjB,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,oBAAoB;SACnC;KACF,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,oFAAoF;AACpF,qFAAqF;AACrF,wEAAwE;AACxE,uFAAuF;AACvF,yFAAyF;AACzF,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC5C,CAAC;AACD,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;AACnF,CAAC;AAED,uFAAuF;AACvF,+DAA+D;AAC/D,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC7F,MAAM,IAAI,GAAG,4CAA4C,CAAC;IAC1D,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;QACvC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;QAC3C,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACvC,aAAa,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;QAC/D,cAAc,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;QACjE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACvC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACnD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI;QAC9E,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,IAAI;KACrF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAAoB,EACpB,OAAO,GAAG,QAAQ;IAElB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,wBAAwB,CACxC,GAAG,aAAa,EAAE,0BAA0B,OAAO,uBAAuB,OAAO,EAAE,EACnF;YACE,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,CAAC;YACV,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,oBAAoB;aACnC;SACF,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;YACvC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAK1D,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc;QACvE,SAAS,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAA4B;IACzE,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,uBAAuB,EAAE,0BAA0B,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACtH,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,0BAA0B,OAAO,uBAAuB,OAAO,EAAE,CAAC;IAEhG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;QAEvC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CACT,iCAAiC,EACjC,IAAI,CAAC,OAAO,IAAI,gFAAgF,EAChG,IAAI,EACJ,YAAY,CACb,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAErC,yEAAyE;QACzE,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CACT,iCAAiC,EACjC,0KAA0K,EAC1K,IAAI,EACJ,YAAY,CACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;QAE7G,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;YAChB,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;YACjB,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,SAAS,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAEjD,OAAO,EAAE,CAAC;YACR,GAAG,4BAA4B,CAAC,OAAO,CAAC;YACxC,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE;gBACf,WAAW;gBACX,UAAU;gBACV,aAAa,EAAE,MAAM;gBACrB,cAAc,EAAE,OAAO;gBACvB,UAAU;gBACV,gBAAgB;gBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC;YACD,KAAK;YACL,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AA2BD,uFAAuF;AACvF,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,YAAoB,EACpB,OAAO,GAAG,QAAQ;IAElB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,kFAAkF;QAClF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;IAC3I,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,oFAAoF;QACpF,qFAAqF;QACrF,0EAA0E;QAC1E,IAAI,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,iHAAiH,EAAE,CAAC;QAClN,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAGhB,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;IAE/B,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,cAAc,IAAI,EAAE,IAAI,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACrK,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,GAAG,EAAE,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9F,CAAC"}

package/dist/tools/createAgentWallet.d.ts

@@ -1,27 +1,31 @@
-import { z } from "zod";
-import { type ToolResponse } from "../lib/toolResponse.js";
-export declare const createAgentWalletSchema: z.ZodObject<{
-    agentId: z.ZodString;
-    overwrite: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-}, "strip", z.ZodTypeAny, {
-    agentId: string;
-    overwrite: boolean;
-}, {
-    agentId: string;
-    overwrite?: boolean | undefined;
-}>;
-export type CreateAgentWalletParams = z.infer<typeof createAgentWalletSchema>;
-interface CreateAgentWalletData {
-    agentId: string;
-    address: string;
-    environment: string;
-    chainId: number;
-    isMainnet: boolean;
-    isTestnet: boolean;
-    createdAt: string;
-    warning: string;
-    instructions: string;
-}
-export declare function handleCreateAgentWallet(params: CreateAgentWalletParams): Promise<ToolResponse<CreateAgentWalletData>>;
-export {};
+import { z } from "zod";
+import { type ToolResponse } from "../lib/toolResponse.js";
+export declare const createAgentWalletSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    overwrite: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    agentId: string;
+    overwrite: boolean;
+}, {
+    agentId: string;
+    overwrite?: boolean | undefined;
+}>;
+export type CreateAgentWalletParams = z.infer<typeof createAgentWalletSchema>;
+interface CreateAgentWalletData {
+    agentId: string;
+    address: string;
+    environment: string;
+    chainId: number;
+    isMainnet: boolean;
+    createdAt: string;
+    warning: string;
+    instructions: string;
+    riskRegistryVersion: "safehands-registry";
+    riskRegistryAddress: string;
+    riskRegistryAuthorized: boolean;
+    riskRegistryAuthTxHash: string | null;
+    riskRegistryMessage: string;
+}
+export declare function handleCreateAgentWallet(params: unknown): Promise<ToolResponse<CreateAgentWalletData>>;
+export {};
 //# sourceMappingURL=createAgentWallet.d.ts.map

package/dist/tools/createAgentWallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAgentWallet.d.ts","sourceRoot":"","sources":["../../src/tools/createAgentWallet.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAIrE,eAAO,MAAM,uBAAuB;;;;;;;;;EAWlC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,UAAU,qBAAqB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAqD9C"}
+{"version":3,"file":"createAgentWallet.d.ts","sourceRoot":"","sources":["../../src/tools/createAgentWallet.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKrE,eAAO,MAAM,uBAAuB;;;;;;;;;EAWlC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,UAAU,qBAAqB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAiF9C"}

package/dist/tools/createAgentWallet.js

@@ -1,59 +1,88 @@
-// ─── create_agent_wallet ────────────────────────────────────────────────
-// Creates a new managed testnet agent wallet.
-// Private key is AES-256-GCM encrypted before storage, never returned in response.
-// ────────────────────────────────────────────────────────────────────────
-import { z } from "zod";
-import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
-import { ok, fail } from "../lib/toolResponse.js";
-import { walletStore, encryptKey, usesPersistentWalletStore, getEffectiveEncryptionKey } from "../lib/wallet/index.js";
-import { CHAIN_ID, PHAROS_ENVIRONMENT, IS_MAINNET } from "../lib/constants.js";
-export const createAgentWalletSchema = z.object({
-    agentId: z
-        .string()
-        .min(1)
-        .max(64)
-        .describe("Unique identifier for this agent wallet (e.g. 'trading-agent-1')"),
-    overwrite: z
-        .boolean()
-        .optional()
-        .default(false)
-        .describe("If true, overwrite existing wallet for this agentId"),
-});
-export async function handleCreateAgentWallet(params) {
-    const { agentId, overwrite } = params;
-    // Check if wallet already exists
-    const existing = await walletStore.get(agentId);
-    if (existing && !overwrite) {
-        return fail("WALLET_ALREADY_EXISTS", `A wallet for agentId '${agentId}' already exists. Use overwrite:true to replace it, or use get_agent_wallet to retrieve it.`, false, "wallet_store");
-    }
-    if (usesPersistentWalletStore() && !process.env.WALLET_ENCRYPTION_KEY) {
-        return fail("WALLET_ENCRYPTION_KEY_REQUIRED", "WALLET_ENCRYPTION_KEY is required when WALLET_STORE_PATH is used. Use in-memory store for local tests or provide a testnet-only encryption key.", false, "wallet_store");
-    }
-    // Generate new wallet
-    const privateKey = generatePrivateKey();
-    const account = privateKeyToAccount(privateKey);
-    // Encrypt key before storage (AES-256-GCM)
-    const encryptedKey = encryptKey(privateKey, getEffectiveEncryptionKey());
-    // Store wallet
-    await walletStore.set(agentId, {
-        agentId,
-        address: account.address,
-        encryptedKey,
-        environment: "atlantic-testnet",
-        chainId: 688689,
-        isMainnet: false,
-        createdAt: new Date().toISOString(),
-    });
-    return ok({
-        agentId,
-        address: account.address,
-        environment: PHAROS_ENVIRONMENT,
-        chainId: CHAIN_ID,
-        isMainnet: IS_MAINNET,
-        isTestnet: true,
-        createdAt: new Date().toISOString(),
-        warning: "This is a TESTNET wallet only. Never use for mainnet funds. Private key is AES-256-GCM encrypted locally — testnet-grade, not KMS/Vault.",
-        instructions: `Fund this wallet with testnet PHRS from https://testnet.pharosnetwork.xyz/ before executing write operations. Set WRITE_TOOLS_ENABLED=true to enable transactions.`,
-    });
-}
+// ─── create_agent_wallet ────────────────────────────────────────────────
+// Creates a new managed testnet agent wallet.
+// Private key is AES-256-GCM encrypted before storage, never returned in response.
+// ────────────────────────────────────────────────────────────────────────
+import { z } from "zod";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+import { ok, fail } from "../lib/toolResponse.js";
+import { walletStore, encryptKey, usesPersistentWalletStore, getEffectiveEncryptionKey } from "../lib/wallet/index.js";
+import { CHAIN_ID, PHAROS_ENVIRONMENT, IS_MAINNET, SAFEHANDS_REGISTRY_ADDRESS } from "../lib/constants.js";
+import { tryAutoAuthorize } from "../lib/safeHandsRegistry.js";
+export const createAgentWalletSchema = z.object({
+    agentId: z
+        .string()
+        .min(1)
+        .max(64)
+        .describe("Unique identifier for this agent wallet (e.g. 'trading-agent-1')"),
+    overwrite: z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe("If true, overwrite existing wallet for this agentId"),
+});
+export async function handleCreateAgentWallet(params) {
+    let parsed;
+    try {
+        parsed = createAgentWalletSchema.parse(params);
+    }
+    catch (err) {
+        const msg = err instanceof Error && "issues" in err
+            ? err.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+            : String(err);
+        return fail("VALIDATION_ERROR", `create_agent_wallet input validation failed: ${msg}`, false, "create_agent_wallet");
+    }
+    const { agentId, overwrite } = parsed;
+    // Check if wallet already exists
+    const existing = await walletStore.get(agentId);
+    if (existing && !overwrite) {
+        return fail("WALLET_ALREADY_EXISTS", `A wallet for agentId '${agentId}' already exists. Use overwrite:true to replace it, or use get_agent_wallet to retrieve it.`, false, "wallet_store");
+    }
+    if (usesPersistentWalletStore() && !process.env.WALLET_ENCRYPTION_KEY) {
+        return fail("WALLET_ENCRYPTION_KEY_REQUIRED", "WALLET_ENCRYPTION_KEY is required when WALLET_STORE_PATH is used. Use in-memory store for local tests or provide a mainnet-only encryption key.", false, "wallet_store");
+    }
+    // Generate new wallet
+    const privateKey = generatePrivateKey();
+    const account = privateKeyToAccount(privateKey);
+    // Encrypt key before storage (AES-256-GCM)
+    const encryptedKey = encryptKey(privateKey, getEffectiveEncryptionKey());
+    // Store wallet
+    await walletStore.set(agentId, {
+        agentId,
+        address: account.address,
+        encryptedKey,
+        environment: "pacific-mainnet",
+        chainId: 1672,
+        isMainnet: true,
+        createdAt: new Date().toISOString(),
+    });
+    // Optional auto-authorization in SafeHandsRegistry.
+    // Gated by AUTO_AUTHORIZE_AGENT_WALLET + RISK_REGISTRY_OWNER_PRIVATE_KEY (handled
+    // inside tryAutoAuthorize). Wallet creation always succeeds even if this is
+    // disabled or fails — the wallet is simply not yet authorized for managed execution.
+    const auth = await tryAutoAuthorize(account.address);
+    const riskRegistryAuthorized = auth.riskRegistryAuthorized;
+    const riskRegistryAuthTxHash = auth.authorizationTxHash ?? null;
+    const riskRegistryMessage = riskRegistryAuthorized
+        ? (auth.autoAuthorized
+            ? "Wallet auto-authorized in SafeHandsRegistry and ready for managed execution once funded."
+            : "Wallet is already authorized in SafeHandsRegistry.")
+        : `Wallet is NOT yet authorized for managed execution. ${auth.authorizationReason ?? ""} ` +
+            `The SafeHandsRegistry owner must call setAuthorizedAgent(${account.address}, true), ` +
+            `or set AUTO_AUTHORIZE_AGENT_WALLET=true with RISK_REGISTRY_OWNER_PRIVATE_KEY.`;
+    return ok({
+        agentId,
+        address: account.address,
+        environment: PHAROS_ENVIRONMENT,
+        chainId: CHAIN_ID,
+        isMainnet: IS_MAINNET,
+        createdAt: new Date().toISOString(),
+        warning: "Managed mainnet wallet. Use a DEDICATED low-value operator wallet, never a primary wallet. Private key is AES-256-GCM encrypted locally, not KMS/HSM-grade.",
+        instructions: `Fund this wallet with PROS for gas. Managed execution stays disabled until you opt in with WRITE_TOOLS_ENABLED=true and MANAGED_WALLET_ENABLED=true.`,
+        riskRegistryVersion: "safehands-registry",
+        riskRegistryAddress: SAFEHANDS_REGISTRY_ADDRESS,
+        riskRegistryAuthorized,
+        riskRegistryAuthTxHash,
+        riskRegistryMessage,
+    });
+}
 //# sourceMappingURL=createAgentWallet.js.map

package/dist/tools/createAgentWallet.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAgentWallet.js","sourceRoot":"","sources":["../../src/tools/createAgentWallet.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,8CAA8C;AAC9C,mFAAmF;AACnF,2EAA2E;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAqB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,qDAAqD,CAAC;CACnE,CAAC,CAAC;AAgBH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA+B;IAE/B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEtC,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uBAAuB,EACvB,yBAAyB,OAAO,6FAA6F,EAC7H,KAAK,EACL,cAAc,CACf,CAAC;IACJ,CAAC;IAED,IAAI,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACtE,OAAO,IAAI,CACT,gCAAgC,EAChC,iJAAiJ,EACjJ,KAAK,EACL,cAAc,CACf,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEhD,2CAA2C;IAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAEzE,eAAe;IACf,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY;QACZ,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,OAAO,EAAE,CAAC;QACR,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EACL,0IAA0I;QAC5I,YAAY,EAAE,oKAAoK;KACnL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"createAgentWallet.js","sourceRoot":"","sources":["../../src/tools/createAgentWallet.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,8CAA8C;AAC9C,mFAAmF;AACnF,2EAA2E;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAqB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,qDAAqD,CAAC;CACnE,CAAC,CAAC;AAoBH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAe;IAEf,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,IAAI,QAAQ,IAAI,GAAG;YACjD,CAAC,CAAE,GAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC,kBAAkB,EAAE,gDAAgD,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEtC,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uBAAuB,EACvB,yBAAyB,OAAO,6FAA6F,EAC7H,KAAK,EACL,cAAc,CACf,CAAC;IACJ,CAAC;IAED,IAAI,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACtE,OAAO,IAAI,CACT,gCAAgC,EAChC,iJAAiJ,EACjJ,KAAK,EACL,cAAc,CACf,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEhD,2CAA2C;IAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAEzE,eAAe;IACf,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY;QACZ,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,oDAAoD;IACpD,kFAAkF;IAClF,4EAA4E;IAC5E,qFAAqF;IACrF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,CAAC;IAC3D,MAAM,sBAAsB,GAAG,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAChE,MAAM,mBAAmB,GAAG,sBAAsB;QAChD,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc;YAClB,CAAC,CAAC,0FAA0F;YAC5F,CAAC,CAAC,oDAAoD,CAAC;QAC3D,CAAC,CAAC,uDAAuD,IAAI,CAAC,mBAAmB,IAAI,EAAE,GAAG;YACxF,4DAA4D,OAAO,CAAC,OAAO,WAAW;YACtF,+EAA+E,CAAC;IAEpF,OAAO,EAAE,CAAC;QACR,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EACL,6JAA6J;QAC/J,YAAY,EAAE,sJAAsJ;QACpK,mBAAmB,EAAE,oBAAoB;QACzC,mBAAmB,EAAE,0BAA0B;QAC/C,sBAAsB;QACtB,sBAAsB;QACtB,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC"}