safehands-pharos 1.5.0 → 2.6.0

package/dist/lib/policy/agentPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentPolicy.js","sourceRoot":"","sources":["../../../src/lib/policy/agentPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAwBpC,MAAM,CAAC,MAAM,eAAe,GAA0D;IACpF,YAAY,EAAE;QACZ,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE;YACN,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,GAAG;YAChB,iBAAiB,EAAE,GAAG;YACtB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,IAAI;SACtB;QACD,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,KAAK;YAC/B,4BAA4B,EAAE,KAAK;SACpC;KACF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,cAAc,EAAE,GAAG;YACnB,WAAW,EAAE,IAAI;YACjB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,IAAI;SACtB;QACD,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,KAAK;YAC/B,4BAA4B,EAAE,QAAQ;SACvC;KACF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,MAAM;YACnB,iBAAiB,EAAE,MAAM;YACzB,kBAAkB,EAAE,GAAG;YACvB,eAAe,EAAE,KAAK;SACvB;QACD,KAAK,EAAE;YACL,kBAAkB,EAAE,IAAI;YACxB,wBAAwB,EAAE,IAAI;YAC9B,4BAA4B,EAAE,MAAM;SACrC;KACF;CACF,CAAC;AAEF,SAAS,cAAc;IACrB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,+EAA+E,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAClH,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,wBAAwB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,4BAA4B,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAAsC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3G,OAAO;QACL,OAAO,EAAE,OAAwB;QACjC,MAAM,EAAE,CAAiC;QACzC,KAAK,EAAE,CAAgC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAAa,EAAE,IAAY;IACxD,OAAO,CAAC,IAAI,CACV,sBAAsB,KAAK,kHAAkH,IAAI,kCAAkC,CACpL,CAAC;IACF,OAAO,eAAe,CAAC,YAAY,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC3E,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;YACpD,OAAO,qBAAqB,CAAC,UAAU,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;QACpD,OAAO,qBAAqB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAmB;IAClE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAmB;IAEnB,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QACpD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9C,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC5D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/lib/policy/policyPresets.d.ts

@@ -0,0 +1,30 @@
+import { type GuardianPolicy } from "../../agent/agentPolicyResolver.js";
+export type PolicyPreset = "standard" | "strict" | "agent" | "x402-preflight";
+export declare const PRESET_NAMES: readonly PolicyPreset[];
+/** Bump when preset semantics change. Surfaced (never secret) in responses/metrics. */
+export declare const POLICY_VERSION = "p8c-2026.06";
+export declare const PRESETS: Readonly<Record<PolicyPreset, GuardianPolicy>>;
+export declare function isPreset(value: unknown): value is PolicyPreset;
+export declare function presetPolicy(name: PolicyPreset): GuardianPolicy;
+/**
+ * True iff `candidate` is equal-or-stricter than `baseline`: every numeric limit
+ * is ≤ baseline, the safety booleans are not weaker, and it adds no extra trusted
+ * entries. Used both at load (presets vs `standard`) and at request resolution.
+ */
+export declare function assertNotWeaker(candidate: GuardianPolicy, baseline: GuardianPolicy): boolean;
+/**
+ * Resolve the effective preset NAME (tighten-only). Precedence:
+ *   serverDefault = env (SAFEHANDS_POLICY_PRESET) → endpointDefault → "standard".
+ * A request preset is honored only if it is a valid preset that is equal-or-stricter
+ * than the server default; otherwise the server default wins (a request can never
+ * loosen policy).
+ */
+export declare function resolvePresetName(requestPreset: unknown, endpointDefault?: PolicyPreset, envPreset?: string): PolicyPreset;
+/**
+ * Sanitize request-supplied policy overrides onto a server policy: TIGHTEN-ONLY.
+ * Numeric limits may only be lowered; safety booleans may only be set toward safer
+ * (true); request-supplied trusted lists are IGNORED (server-config only) so public
+ * callers can never add an approval/transfer bypass.
+ */
+export declare function sanitizeRequestPolicy(serverPolicy: GuardianPolicy, overrides: unknown): GuardianPolicy;
+//# sourceMappingURL=policyPresets.d.ts.map

package/dist/lib/policy/policyPresets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyPresets.d.ts","sourceRoot":"","sources":["../../../src/lib/policy/policyPresets.ts"],"names":[],"mappings":"AAaA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEjG,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAE9E,eAAO,MAAM,YAAY,EAAE,SAAS,YAAY,EAAsD,CAAC;AAEvG,uFAAuF;AACvF,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAS5C,eAAO,MAAM,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CA+BlE,CAAC;AAEF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAE9D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAS5F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,OAAO,EACtB,eAAe,GAAE,YAAyB,EAC1C,SAAS,CAAC,EAAE,MAAM,GACjB,YAAY,CAMd;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,GAAG,cAAc,CAkBtG"}

package/dist/lib/policy/policyPresets.js

@@ -0,0 +1,124 @@
+// ─── SafeHands Policy Presets ─────────────────────────────────────
+// Named presets are `GuardianPolicy` configs fed to the EXISTING escalate-only
+// `applyPolicy` (agentPolicyResolver) — so no preset or request can ever weaken
+// the analyzer's decision (a BLOCK stays a BLOCK by construction). On top of that
+// structural guarantee:
+//   • every preset is equal-or-stricter than `standard` (assertNotWeaker, tested),
+//   • preset resolution is TIGHTEN-ONLY (a request may only pick an equal/stricter
+//     preset than the server default),
+//   • `sanitizeRequestPolicy` clamps request overrides to tighten-only and drops
+//     request-supplied trusted lists (public callers can never add a bypass).
+// Pure + offline. No signing/wallet/write primitives.
+// ────────────────────────────────────────────────────────────────────────
+import { DEFAULT_BACKEND_POLICY } from "../../agent/agentPolicyResolver.js";
+export const PRESET_NAMES = ["standard", "strict", "agent", "x402-preflight"];
+/** Bump when preset semantics change. Surfaced (never secret) in responses/metrics. */
+export const POLICY_VERSION = "p8c-2026.06";
+const NUMERIC_KEYS = [
+    "maxNativeTransferWei",
+    "maxApprovalAmount",
+    "maxX402PaymentUsdc",
+    "maxDailyAgentSpendUsdc",
+];
+export const PRESETS = {
+    // standard = the current public default (no change in behavior).
+    standard: { ...DEFAULT_BACKEND_POLICY },
+    // strict = much lower limits; always confirm/block the risky cases.
+    strict: {
+        maxNativeTransferWei: "1000000000000000000", // 1 native
+        maxApprovalAmount: "1000000000", // 1e9 raw units
+        maxX402PaymentUsdc: "0.1",
+        maxDailyAgentSpendUsdc: "10",
+        trustedRecipients: [],
+        trustedSpenders: [],
+        blockUnlimitedApproval: true,
+        requireConfirmationForUnknownContract: true,
+    },
+    // agent = the A2A/agent runtime baseline — equal-or-stricter than standard.
+    agent: {
+        ...DEFAULT_BACKEND_POLICY,
+        maxX402PaymentUsdc: "0.5",
+        maxDailyAgentSpendUsdc: "50",
+        trustedRecipients: [],
+        trustedSpenders: [],
+        blockUnlimitedApproval: true,
+        requireConfirmationForUnknownContract: true,
+    },
+    // x402-preflight = payment-intent focused tightening; still read-only.
+    "x402-preflight": {
+        ...DEFAULT_BACKEND_POLICY,
+        maxX402PaymentUsdc: "0.1",
+        blockUnlimitedApproval: true,
+        requireConfirmationForUnknownContract: true,
+    },
+};
+export function isPreset(value) {
+    return typeof value === "string" && PRESET_NAMES.includes(value);
+}
+export function presetPolicy(name) {
+    const p = PRESETS[name];
+    return { ...p, trustedRecipients: [...p.trustedRecipients], trustedSpenders: [...p.trustedSpenders] };
+}
+/**
+ * True iff `candidate` is equal-or-stricter than `baseline`: every numeric limit
+ * is ≤ baseline, the safety booleans are not weaker, and it adds no extra trusted
+ * entries. Used both at load (presets vs `standard`) and at request resolution.
+ */
+export function assertNotWeaker(candidate, baseline) {
+    for (const k of NUMERIC_KEYS) {
+        if (Number(candidate[k]) > Number(baseline[k]))
+            return false;
+    }
+    if (baseline.blockUnlimitedApproval && !candidate.blockUnlimitedApproval)
+        return false;
+    if (baseline.requireConfirmationForUnknownContract && !candidate.requireConfirmationForUnknownContract)
+        return false;
+    if (candidate.trustedRecipients.length > baseline.trustedRecipients.length)
+        return false;
+    if (candidate.trustedSpenders.length > baseline.trustedSpenders.length)
+        return false;
+    return true;
+}
+/**
+ * Resolve the effective preset NAME (tighten-only). Precedence:
+ *   serverDefault = env (SAFEHANDS_POLICY_PRESET) → endpointDefault → "standard".
+ * A request preset is honored only if it is a valid preset that is equal-or-stricter
+ * than the server default; otherwise the server default wins (a request can never
+ * loosen policy).
+ */
+export function resolvePresetName(requestPreset, endpointDefault = "standard", envPreset) {
+    const serverDefault = isPreset(envPreset) ? envPreset : endpointDefault;
+    if (isPreset(requestPreset) && assertNotWeaker(PRESETS[requestPreset], PRESETS[serverDefault])) {
+        return requestPreset;
+    }
+    return serverDefault;
+}
+/**
+ * Sanitize request-supplied policy overrides onto a server policy: TIGHTEN-ONLY.
+ * Numeric limits may only be lowered; safety booleans may only be set toward safer
+ * (true); request-supplied trusted lists are IGNORED (server-config only) so public
+ * callers can never add an approval/transfer bypass.
+ */
+export function sanitizeRequestPolicy(serverPolicy, overrides) {
+    const out = {
+        ...serverPolicy,
+        trustedRecipients: [...serverPolicy.trustedRecipients],
+        trustedSpenders: [...serverPolicy.trustedSpenders],
+    };
+    if (!overrides || typeof overrides !== "object")
+        return out;
+    const o = overrides;
+    for (const k of NUMERIC_KEYS) {
+        const raw = o[k];
+        const n = Number(raw);
+        if (Number.isFinite(n) && n >= 0 && n < Number(out[k])) {
+            out[k] = typeof raw === "string" ? raw : String(n);
+        }
+    }
+    if (o.blockUnlimitedApproval === true)
+        out.blockUnlimitedApproval = true;
+    if (o.requireConfirmationForUnknownContract === true)
+        out.requireConfirmationForUnknownContract = true;
+    return out;
+}
+//# sourceMappingURL=policyPresets.js.map

package/dist/lib/policy/policyPresets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyPresets.js","sourceRoot":"","sources":["../../../src/lib/policy/policyPresets.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,+EAA+E;AAC/E,gFAAgF;AAChF,kFAAkF;AAClF,wBAAwB;AACxB,mFAAmF;AACnF,mFAAmF;AACnF,uCAAuC;AACvC,iFAAiF;AACjF,8EAA8E;AAC9E,sDAAsD;AACtD,2EAA2E;AAE3E,OAAO,EAAE,sBAAsB,EAAuB,MAAM,oCAAoC,CAAC;AAIjG,MAAM,CAAC,MAAM,YAAY,GAA4B,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAEvG,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,OAAO,GAAmD;IACrE,iEAAiE;IACjE,QAAQ,EAAE,EAAE,GAAG,sBAAsB,EAAE;IACvC,oEAAoE;IACpE,MAAM,EAAE;QACN,oBAAoB,EAAE,qBAAqB,EAAE,WAAW;QACxD,iBAAiB,EAAE,YAAY,EAAE,gBAAgB;QACjD,kBAAkB,EAAE,KAAK;QACzB,sBAAsB,EAAE,IAAI;QAC5B,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,EAAE;QACnB,sBAAsB,EAAE,IAAI;QAC5B,qCAAqC,EAAE,IAAI;KAC5C;IACD,4EAA4E;IAC5E,KAAK,EAAE;QACL,GAAG,sBAAsB;QACzB,kBAAkB,EAAE,KAAK;QACzB,sBAAsB,EAAE,IAAI;QAC5B,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,EAAE;QACnB,sBAAsB,EAAE,IAAI;QAC5B,qCAAqC,EAAE,IAAI;KAC5C;IACD,uEAAuE;IACvE,gBAAgB,EAAE;QAChB,GAAG,sBAAsB;QACzB,kBAAkB,EAAE,KAAK;QACzB,sBAAsB,EAAE,IAAI;QAC5B,qCAAqC,EAAE,IAAI;KAC5C;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;AACxG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAyB,EAAE,QAAwB;IACjF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,sBAAsB;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,QAAQ,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,qCAAqC;QAAE,OAAO,KAAK,CAAC;IACrH,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,GAAG,QAAQ,CAAC,iBAAiB,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAsB,EACtB,kBAAgC,UAAU,EAC1C,SAAkB;IAElB,MAAM,aAAa,GAAiB,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;IACtF,IAAI,QAAQ,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAA4B,EAAE,SAAkB;IACpF,MAAM,GAAG,GAAmB;QAC1B,GAAG,YAAY;QACf,iBAAiB,EAAE,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC;QACtD,eAAe,EAAE,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC;KACnD,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC5D,MAAM,CAAC,GAAG,SAAoC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,sBAAsB,KAAK,IAAI;QAAE,GAAG,CAAC,sBAAsB,GAAG,IAAI,CAAC;IACzE,IAAI,CAAC,CAAC,qCAAqC,KAAK,IAAI;QAAE,GAAG,CAAC,qCAAqC,GAAG,IAAI,CAAC;IACvG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/policy/writeExecutionGate.d.ts

@@ -0,0 +1,23 @@
+import { type ToolFailure } from "../toolResponse.js";
+import type { ActionPolicyResult } from "./actionPolicyEngine.js";
+export interface EnforceWriteDecisionOptions {
+    /** True when the caller explicitly acknowledged/confirmed this action (e.g. input.confirm === true). */
+    confirmed: boolean;
+    /** Tool name for the error envelope + telemetry. */
+    toolName: string;
+    /**
+     * Set by write tools whose policy input MUST include risk-engine evidence
+     * (execute_swap / send_payment). When true and the evaluated policy carries
+     * no `risk_*` check, the gate fails closed — a wiring mistake (assessRisk
+     * result not passed to evaluateActionPolicy) blocks loudly instead of
+     * silently losing the risk gates.
+     */
+    requireRiskEvidence?: boolean;
+}
+/**
+ * Returns a ToolFailure to short-circuit execution, or `null` to proceed.
+ * `policy.decision` is the internal 6-value decision from evaluateActionPolicy
+ * (NOT the mapped public 4-value), so all six cases are handled here.
+ */
+export declare function enforceWriteDecision(policy: ActionPolicyResult, opts: EnforceWriteDecisionOptions): ToolFailure | null;
+//# sourceMappingURL=writeExecutionGate.d.ts.map

package/dist/lib/policy/writeExecutionGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeExecutionGate.d.ts","sourceRoot":"","sources":["../../../src/lib/policy/writeExecutionGate.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAQ,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,MAAM,WAAW,2BAA2B;IAC1C,wGAAwG;IACxG,SAAS,EAAE,OAAO,CAAC;IACnB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,2BAA2B,GAChC,WAAW,GAAG,IAAI,CA4DpB"}

package/dist/lib/policy/writeExecutionGate.js

@@ -0,0 +1,65 @@
+// ─── SafeHands Write-Execution Gate ────────────────────────────────────
+// Enforces the FULL deterministic decision at the direct write-tool boundary.
+//
+// Historically the raw write tools (execute_swap / send_payment / approve_token /
+// x402_pay_and_fetch) only halted on `BLOCK` and silently signed on every other
+// non-ALLOW decision — so a REQUIRE_CONFIRMATION / REQUIRE_TOKEN_REVIEW action
+// (unverified recipient, unknown/flagged token) was auto-executed. That defeated
+// the core SafeHands promise ("one of four decisions before every action").
+//
+// This gate makes the raw tools honor the whole decision:
+//   • ALLOW                 → proceed.
+//   • BLOCK                 → hard stop (never confirmable).
+//   • REQUIRE_FUNDING       → hard stop (fund first; not a confirmable risk).
+//   • REQUIRE_CONFIRMATION  → proceed ONLY if the caller passed an explicit
+//     REQUIRE_TOKEN_REVIEW /   confirmation (`confirmed`); otherwise return a
+//     WARN                     non-executing CONFIRMATION_REQUIRED with the
+//                              reasons, so the confirmation is explicit + audited
+//                              instead of silent.
+// Honeypot/malicious tokens are turned into a hard BLOCK upstream (in the tool,
+// before this gate) while GoPlus token intel is available. When intel is MISSING
+// (provider outage / token not indexed / unresolvable address), the policy emits
+// the `token_security_intel_missing` check and this gate fails closed:
+// a caller confirmation cannot substitute for intel that never existed, so the
+// action stops with TOKEN_INTEL_UNAVAILABLE even with confirm=true. Only tokens
+// GoPlus actually reviewed-and-flagged remain confirmable after review.
+// ────────────────────────────────────────────────────────────────────────
+import { fail } from "../toolResponse.js";
+/**
+ * Returns a ToolFailure to short-circuit execution, or `null` to proceed.
+ * `policy.decision` is the internal 6-value decision from evaluateActionPolicy
+ * (NOT the mapped public 4-value), so all six cases are handled here.
+ */
+export function enforceWriteDecision(policy, opts) {
+    const reasons = policy.reasons.join(" ").trim();
+    const actions = policy.requiredActions.join(" ").trim();
+    if (opts.requireRiskEvidence && !policy.checks.some((c) => c.name.startsWith("risk_"))) {
+        return fail("POLICY_EVIDENCE_MISSING", `${opts.toolName} is blocked fail-closed: the policy decision was evaluated WITHOUT risk-engine evidence (no risk_* check present). This indicates a wiring defect: the assessRisk result must be passed to evaluateActionPolicy via riskEvidenceFromAssessment(). Not confirmable.`, false, opts.toolName);
+    }
+    switch (policy.decision) {
+        case "ALLOW":
+            return null;
+        case "BLOCK":
+            return fail("POLICY_BLOCKED", reasons || `${opts.toolName} was blocked by SafeHands policy.`, false, opts.toolName);
+        case "REQUIRE_FUNDING":
+            return fail("REQUIRE_FUNDING", `${opts.toolName} requires funding before execution. ${reasons} ${actions}`.replace(/\s+/g, " ").trim(), false, opts.toolName);
+        case "REQUIRE_CONFIRMATION":
+        case "REQUIRE_TOKEN_REVIEW":
+        case "WARN":
+        default:
+            // Fail-closed: when token-security intel is MISSING (not merely flagged),
+            // nothing was reviewed — a caller confirmation cannot attest to a review that
+            // never happened. Hard stop, never confirmable on the direct write path.
+            if (policy.checks.some((c) => c.name === "token_security_intel_missing" && c.status === "unknown")) {
+                return fail("TOKEN_INTEL_UNAVAILABLE", `${opts.toolName} is blocked fail-closed: token-security intelligence is unavailable for this token (provider outage or token not yet indexed), so nothing was actually reviewed. Retry when the provider is reachable, or verify the token independently. ${reasons}`
+                    .replace(/\s+/g, " ")
+                    .trim(), true, opts.toolName);
+            }
+            if (opts.confirmed)
+                return null;
+            return fail("CONFIRMATION_REQUIRED", `${opts.toolName} needs explicit confirmation before signing (decision: ${policy.decision}). ${reasons} ${actions} Re-invoke with confirm=true only after reviewing and approving this action.`
+                .replace(/\s+/g, " ")
+                .trim(), false, opts.toolName);
+    }
+}
+//# sourceMappingURL=writeExecutionGate.js.map

package/dist/lib/policy/writeExecutionGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeExecutionGate.js","sourceRoot":"","sources":["../../../src/lib/policy/writeExecutionGate.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8EAA8E;AAC9E,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,EAAE;AACF,0DAA0D;AAC1D,uCAAuC;AACvC,6DAA6D;AAC7D,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,kFAAkF;AAClF,kDAAkD;AAClD,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,uEAAuE;AACvE,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;AACxE,2EAA2E;AAE3E,OAAO,EAAE,IAAI,EAAoB,MAAM,oBAAoB,CAAC;AAkB5D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA0B,EAC1B,IAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAExD,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CACT,yBAAyB,EACzB,GAAG,IAAI,CAAC,QAAQ,oQAAoQ,EACpR,KAAK,EACL,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QAEd,KAAK,OAAO;YACV,OAAO,IAAI,CACT,gBAAgB,EAChB,OAAO,IAAI,GAAG,IAAI,CAAC,QAAQ,mCAAmC,EAC9D,KAAK,EACL,IAAI,CAAC,QAAQ,CACd,CAAC;QAEJ,KAAK,iBAAiB;YACpB,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,IAAI,CAAC,QAAQ,uCAAuC,OAAO,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EACvG,KAAK,EACL,IAAI,CAAC,QAAQ,CACd,CAAC;QAEJ,KAAK,sBAAsB,CAAC;QAC5B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ;YACE,0EAA0E;YAC1E,8EAA8E;YAC9E,yEAAyE;YACzE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,8BAA8B,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBACnG,OAAO,IAAI,CACT,yBAAyB,EACzB,GAAG,IAAI,CAAC,QAAQ,6OAA6O,OAAO,EAAE;qBACnQ,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;qBACpB,IAAI,EAAE,EACT,IAAI,EACJ,IAAI,CAAC,QAAQ,CACd,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,IAAI,CACT,uBAAuB,EACvB,GAAG,IAAI,CAAC,QAAQ,0DAA0D,MAAM,CAAC,QAAQ,MAAM,OAAO,IAAI,OAAO,8EAA8E;iBAC5L,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE,EACT,KAAK,EACL,IAAI,CAAC,QAAQ,CACd,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/lib/preparedTxStore.d.ts

@@ -0,0 +1,21 @@
+export interface PreparedTransactionRecord {
+    id: string;
+    hash: string;
+    from: string;
+    to: string;
+    dataHash: string;
+    value: string;
+    chainId: number;
+    decision: string;
+    policyVersion: string | null;
+    policyPreset: string | null;
+    expiresAt: number;
+    usedAt: number | null;
+    createdAt?: number;
+    updatedAt?: number;
+}
+export declare function generatePreparedTransactionHash(from: string, to: string, data: string, value: string, chainId: number, decision: string): string;
+export declare function savePreparedTx(from: string, to: string, data: string, value: string, chainId: number, decision: string, policyVersion: string | null, policyPreset: string | null): PreparedTransactionRecord;
+export declare function getPreparedTx(id: string): PreparedTransactionRecord | null;
+export declare function markPreparedTxUsed(id: string): void;
+//# sourceMappingURL=preparedTxStore.d.ts.map

package/dist/lib/preparedTxStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preparedTxStore.d.ts","sourceRoot":"","sources":["../../src/lib/preparedTxStore.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAgDD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,MAAM,CAGR;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,GAC1B,yBAAyB,CA2B3B;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAM1E;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CASnD"}

package/dist/lib/preparedTxStore.js

@@ -0,0 +1,90 @@
+import { keccak256, stringToHex } from "viem";
+import { randomUUID } from "crypto";
+import { readJsonFile, stateFile, writeJsonFileAtomic } from "./persistentJsonStore.js";
+const STORE_PATH = stateFile("prepared_transactions.json", "SAFEHANDS_PREPARED_TX_STORE_PATH");
+const EXPIRATION_MS = Number(process.env.SAFEHANDS_PREPARED_TX_TTL_MS || 60 * 60 * 1000);
+let state = loadState();
+function loadState() {
+    const loaded = readJsonFile(STORE_PATH, { records: {} });
+    cleanupExpired(loaded, Date.now(), false);
+    return loaded;
+}
+function persist() {
+    writeJsonFileAtomic(STORE_PATH, state);
+}
+function cleanupExpired(target = state, now = Date.now(), shouldPersist = true) {
+    let changed = false;
+    for (const [id, record] of Object.entries(target.records)) {
+        if (record.expiresAt < now) {
+            delete target.records[id];
+            changed = true;
+        }
+    }
+    if (changed && shouldPersist)
+        persist();
+}
+// Bound the store so an anonymous flood of /wallet/prepare writes cannot grow
+// it without limit between TTL sweeps. Evicts oldest-created first. (Public-scale
+// deployments should back this with Redis/Postgres rather than a JSON file.)
+const MAX_PREPARED_TX_RECORDS = Number(process.env.SAFEHANDS_PREPARED_TX_MAX || 5000);
+function enforceStoreCap() {
+    const ids = Object.keys(state.records);
+    if (ids.length <= MAX_PREPARED_TX_RECORDS)
+        return;
+    const excess = ids.length - MAX_PREPARED_TX_RECORDS;
+    const oldest = ids
+        .map((id) => ({ id, createdAt: state.records[id].createdAt ?? 0 }))
+        .sort((a, b) => a.createdAt - b.createdAt)
+        .slice(0, excess);
+    for (const { id } of oldest)
+        delete state.records[id];
+}
+export function generatePreparedTransactionHash(from, to, data, value, chainId, decision) {
+    const payload = `${from.toLowerCase()}:${to.toLowerCase()}:${data.toLowerCase()}:${value}:${chainId}:${decision}`;
+    return keccak256(stringToHex(payload));
+}
+export function savePreparedTx(from, to, data, value, chainId, decision, policyVersion, policyPreset) {
+    cleanupExpired();
+    const id = randomUUID();
+    const hash = generatePreparedTransactionHash(from, to, data, value, chainId, decision);
+    const now = Date.now();
+    const record = {
+        id,
+        hash,
+        from: from.toLowerCase(),
+        to: to.toLowerCase(),
+        dataHash: keccak256(data),
+        value,
+        chainId,
+        decision,
+        policyVersion,
+        policyPreset,
+        expiresAt: now + EXPIRATION_MS,
+        usedAt: null,
+        createdAt: now,
+        updatedAt: now,
+    };
+    state.records[id] = record;
+    enforceStoreCap();
+    persist();
+    return record;
+}
+export function getPreparedTx(id) {
+    // Reload on read so a restarted process or another single-node lifecycle write
+    // is visible without requiring a full application restart.
+    state = loadState();
+    const record = state.records[id];
+    return record ?? null;
+}
+export function markPreparedTxUsed(id) {
+    state = loadState();
+    const record = state.records[id];
+    if (record && !record.usedAt) {
+        const now = Date.now();
+        record.usedAt = now;
+        record.updatedAt = now;
+        persist();
+    }
+}
+setInterval(() => cleanupExpired(), 5 * 60 * 1000).unref();
+//# sourceMappingURL=preparedTxStore.js.map

package/dist/lib/preparedTxStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preparedTxStore.js","sourceRoot":"","sources":["../../src/lib/preparedTxStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAuBxF,MAAM,UAAU,GAAG,SAAS,CAAC,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;AAC/F,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEzF,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;AAExB,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,YAAY,CAAkB,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO;IACd,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,SAA0B,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,GAAG,IAAI;IAC7F,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,aAAa;QAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC,CAAC;AAEtF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,IAAI,uBAAuB;QAAE,OAAO;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,uBAAuB,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG;SACf,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;SACzC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAAY,EACZ,EAAU,EACV,IAAY,EACZ,KAAa,EACb,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;IAClH,OAAO,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAAU,EACV,IAAY,EACZ,KAAa,EACb,OAAe,EACf,QAAgB,EAChB,aAA4B,EAC5B,YAA2B;IAE3B,cAAc,EAAE,CAAC;IACjB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,MAAM,GAA8B;QACxC,EAAE;QACF,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;QACxB,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;QACpB,QAAQ,EAAE,SAAS,CAAC,IAAqB,CAAC;QAC1C,KAAK;QACL,OAAO;QACP,QAAQ;QACR,aAAa;QACb,YAAY;QACZ,SAAS,EAAE,GAAG,GAAG,aAAa;QAC9B,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;IAC3B,eAAe,EAAE,CAAC;IAClB,OAAO,EAAE,CAAC;IACV,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,+EAA+E;IAC/E,2DAA2D;IAC3D,KAAK,GAAG,SAAS,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,KAAK,GAAG,SAAS,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;QACpB,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,WAAW,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC"}

package/dist/lib/price/chainlinkPushProvider.d.ts

@@ -0,0 +1,34 @@
+import type { ContractReader, PriceFeedConfig, PriceProvider, ProviderQuote } from "./types.js";
+export declare const CHAINLINK_PUSH_FEED_ABI: readonly [{
+    readonly name: "latestAnswer";
+    readonly type: "function";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly type: "int256";
+    }];
+}, {
+    readonly name: "latestTimestamp";
+    readonly type: "function";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly type: "uint256";
+    }];
+}, {
+    readonly name: "getFeedId";
+    readonly type: "function";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly type: "bytes32";
+    }];
+}];
+export declare class ChainlinkPushProvider implements PriceProvider {
+    readonly kind: "chainlink-push";
+    readonly label = "Chainlink Push Engine feed on Pharos";
+    private readonly reader;
+    constructor(reader?: ContractReader);
+    fetchQuote(feed: PriceFeedConfig): Promise<ProviderQuote>;
+}
+//# sourceMappingURL=chainlinkPushProvider.d.ts.map

package/dist/lib/price/chainlinkPushProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chainlinkPushProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/price/chainlinkPushProvider.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhG,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;EAMlC,CAAC;AAEH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAC1C,QAAQ,CAAC,KAAK,0CAA0C;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,CAAC,EAAE,cAAc;IAI7B,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;CAchE"}

package/dist/lib/price/chainlinkPushProvider.js

@@ -0,0 +1,36 @@
+// ─── Chainlink Push Engine Provider ────────────────────────────────────
+// Reads latestAnswer/latestTimestamp live from Chainlink Push Engine feed
+// contracts on Pharos via viem eth_call.
+// ────────────────────────────────────────────────────────────────────────
+import { parseAbi } from "viem";
+import { publicClient } from "../pharosClient.js";
+export const CHAINLINK_PUSH_FEED_ABI = parseAbi([
+    "function latestAnswer() view returns (int256)",
+    "function latestTimestamp() view returns (uint256)",
+    // Declared for verification tooling only — never called per price request;
+    // feed identity is static registry config.
+    "function getFeedId() view returns (bytes32)",
+]);
+export class ChainlinkPushProvider {
+    kind = "chainlink-push";
+    label = "Chainlink Push Engine feed on Pharos";
+    reader;
+    constructor(reader) {
+        this.reader = reader ?? publicClient;
+    }
+    async fetchQuote(feed) {
+        // Sequential on purpose: the public Pharos RPC rate-limits parallel eth_call bursts.
+        const answer = (await this.reader.readContract({
+            address: feed.feedAddress,
+            abi: CHAINLINK_PUSH_FEED_ABI,
+            functionName: "latestAnswer",
+        }));
+        const updatedAt = (await this.reader.readContract({
+            address: feed.feedAddress,
+            abi: CHAINLINK_PUSH_FEED_ABI,
+            functionName: "latestTimestamp",
+        }));
+        return { answer, updatedAtUnix: Number(updatedAt) };
+    }
+}
+//# sourceMappingURL=chainlinkPushProvider.js.map

package/dist/lib/price/chainlinkPushProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chainlinkPushProvider.js","sourceRoot":"","sources":["../../../src/lib/price/chainlinkPushProvider.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,yCAAyC;AACzC,2EAA2E;AAE3E,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC9C,+CAA+C;IAC/C,mDAAmD;IACnD,2EAA2E;IAC3E,2CAA2C;IAC3C,6CAA6C;CAC9C,CAAC,CAAC;AAEH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IACjC,KAAK,GAAG,sCAAsC,CAAC;IACvC,MAAM,CAAiB;IAExC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAK,YAA0C,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAqB;QACpC,qFAAqF;QACrF,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,cAAc;SAC7B,CAAC,CAAW,CAAC;QACd,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAChD,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,iBAAiB;SAChC,CAAC,CAAW,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/lib/price/feedRegistry.d.ts

@@ -0,0 +1,26 @@
+import type { PriceFeedConfig } from "./types.js";
+/**
+ * Pacific Mainnet (1672) Chainlink Push Engine feeds — derived from the
+ * canonical ecosystem registry (src/data/ecosystemRegistry.data.ts) so the
+ * price resolver and the Anvita hosted-skill assets share one feed set.
+ */
+export declare const PACIFIC_MAINNET_PRICE_FEEDS: Record<string, PriceFeedConfig>;
+/** No published Push Engine feed addresses for Atlantic testnet — fail closed. */
+export declare const ATLANTIC_TESTNET_PRICE_FEEDS: Record<string, PriceFeedConfig>;
+/**
+ * Wrapped/native aliases → canonical feed key. WBTC is NOT aliased to BTC:
+ * a dedicated WBTC/USD feed exists on Pacific Mainnet.
+ */
+export declare const PRICE_FEED_ALIASES: Record<string, string>;
+export declare function activePriceFeeds(): Record<string, PriceFeedConfig>;
+export interface FeedLookup {
+    requested: string;
+    canonical: string;
+    aliased: boolean;
+    feed: PriceFeedConfig;
+}
+/** Case-insensitive symbol → feed lookup with alias mapping; null if not configured for the active network. */
+export declare function resolveFeedSymbol(symbol: string): FeedLookup | null;
+/** Symbols the active network can price (canonical feeds + configured aliases). */
+export declare function pricedSymbolsForActiveNetwork(): string[];
+//# sourceMappingURL=feedRegistry.d.ts.map

package/dist/lib/price/feedRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedRegistry.d.ts","sourceRoot":"","sources":["../../../src/lib/price/feedRegistry.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAiBlD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAOpE,CAAC;AAEL,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAM,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMrD,CAAC;AAEF,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAElE;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED,+GAA+G;AAC/G,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAMnE;AAED,mFAAmF;AACnF,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAMxD"}

package/dist/lib/price/feedRegistry.js

@@ -0,0 +1,67 @@
+// ─── Price Feed Registry ───────────────────────────────────────────────
+// Network-keyed oracle feed configuration. Feed addresses/decimals/heartbeats
+// are static config; prices are ALWAYS read live from the feed contracts.
+// ────────────────────────────────────────────────────────────────────────
+import { getActiveNetwork } from "../networks.js";
+import { ECOSYSTEM_REGISTRY_ITEMS } from "../../data/ecosystemRegistry.data.js";
+const CHAINLINK_PUSH_DOCS = "Chainlink Push Engine Feeds on Pharos Pacific Mainnet (docs.pharos.xyz)";
+function pushFeed(base, feedAddress) {
+    return {
+        pair: `${base}/USD`,
+        base,
+        quote: "USD",
+        feedAddress,
+        decimals: 18,
+        heartbeatSeconds: 3600,
+        provider: "chainlink-push",
+        docsSource: CHAINLINK_PUSH_DOCS,
+    };
+}
+/**
+ * Pacific Mainnet (1672) Chainlink Push Engine feeds — derived from the
+ * canonical ecosystem registry (src/data/ecosystemRegistry.data.ts) so the
+ * price resolver and the Anvita hosted-skill assets share one feed set.
+ */
+export const PACIFIC_MAINNET_PRICE_FEEDS = (() => {
+    const item = ECOSYSTEM_REGISTRY_ITEMS.find((i) => i.id === "oracle:pacific-mainnet:chainlink-push-feeds");
+    const feeds = {};
+    for (const c of item?.contracts ?? []) {
+        if (c.symbol)
+            feeds[c.symbol] = pushFeed(c.symbol, c.address);
+    }
+    return feeds;
+})();
+/** No published Push Engine feed addresses for Atlantic testnet — fail closed. */
+export const ATLANTIC_TESTNET_PRICE_FEEDS = {};
+/**
+ * Wrapped/native aliases → canonical feed key. WBTC is NOT aliased to BTC:
+ * a dedicated WBTC/USD feed exists on Pacific Mainnet.
+ */
+export const PRICE_FEED_ALIASES = {
+    WPROS: "PROS",
+    WETH: "ETH",
+    // Pharos is the network/ecosystem; PROS is the token. Priced via the PROS/USD
+    // feed. Matches supported-assets.json + the Anvita engine.
+    PHAROS: "PROS",
+};
+export function activePriceFeeds() {
+    return getActiveNetwork().isMainnet ? PACIFIC_MAINNET_PRICE_FEEDS : ATLANTIC_TESTNET_PRICE_FEEDS;
+}
+/** Case-insensitive symbol → feed lookup with alias mapping; null if not configured for the active network. */
+export function resolveFeedSymbol(symbol) {
+    const requested = symbol.trim().toUpperCase();
+    const canonical = PRICE_FEED_ALIASES[requested] ?? requested;
+    const feed = activePriceFeeds()[canonical];
+    if (!feed)
+        return null;
+    return { requested, canonical, aliased: canonical !== requested, feed };
+}
+/** Symbols the active network can price (canonical feeds + configured aliases). */
+export function pricedSymbolsForActiveNetwork() {
+    const canonical = Object.keys(activePriceFeeds());
+    const aliases = Object.entries(PRICE_FEED_ALIASES)
+        .filter(([, target]) => canonical.includes(target))
+        .map(([alias]) => alias);
+    return [...canonical, ...aliases].sort();
+}
+//# sourceMappingURL=feedRegistry.js.map

package/dist/lib/price/feedRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedRegistry.js","sourceRoot":"","sources":["../../../src/lib/price/feedRegistry.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAGhF,MAAM,mBAAmB,GAAG,yEAAyE,CAAC;AAEtG,SAAS,QAAQ,CAAC,IAAY,EAAE,WAA0B;IACxD,OAAO;QACL,IAAI,EAAE,GAAG,IAAI,MAAM;QACnB,IAAI;QACJ,KAAK,EAAE,KAAK;QACZ,WAAW;QACX,QAAQ,EAAE,EAAE;QACZ,gBAAgB,EAAE,IAAI;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,mBAAmB;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAoC,CAAC,GAAG,EAAE;IAChF,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,6CAA6C,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAoC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM;YAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAoC,EAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,KAAK;IACX,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,4BAA4B,CAAC;AACnG,CAAC;AASD,+GAA+G;AAC/G,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IAC7D,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,6BAA6B;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/lib/price/priceResolver.d.ts

@@ -0,0 +1,35 @@
+import type { PriceFeedProviderKind, PriceProvider, PriceResolverResult } from "./types.js";
+export declare const PRICE_CACHE_TTL_MS = 45000;
+export declare const DEGRADED_CACHE_MAX_AGE_MS = 300000;
+export interface ResolvePriceOptions {
+    cacheTtlMs?: number;
+    /** Set false to disable rpc_degraded_cache serves and strictly fail on RPC errors. */
+    allowDegradedCache?: boolean;
+}
+export declare class PriceResolver {
+    private readonly providers;
+    private readonly now;
+    private readonly cache;
+    private readonly inflight;
+    constructor(providers: Partial<Record<PriceFeedProviderKind, PriceProvider>>, now?: () => number);
+    clearCache(): void;
+    resolvePriceUsd(symbol: string, opts?: ResolvePriceOptions): Promise<PriceResolverResult>;
+    /**
+     * Serve a cached resolution if it is within maxAgeMs AND the original oracle
+     * timestamp is still within the feed heartbeat. Returns null otherwise.
+     */
+    private serveFromCache;
+    private fetchLive;
+    private invalid;
+}
+/**
+ * Process-wide singleton wired to the live publicClient. Only implemented
+ * providers are registered — the Supra pull provider is a stub
+ * (src/lib/price/supraProvider.ts) and is deliberately NOT registered; a feed
+ * configured for "supra-pull" fails closed with a structured
+ * PRICE_SOURCE_UNAVAILABLE ("no provider registered") instead of advertising an
+ * unimplemented source.
+ */
+export declare const priceResolver: PriceResolver;
+export declare function resolvePriceUsd(symbol: string, opts?: ResolvePriceOptions): Promise<PriceResolverResult>;
+//# sourceMappingURL=priceResolver.d.ts.map