safehands-pharos 1.5.0 → 2.6.0

package/dist/lib/riskEngine.js

@@ -1,11 +1,18 @@
-// ─── Risk Scoring Engine ───────────────────────────────────────────────
+// ─── Risk Scoring Engine (ADVISORY) ────────────────────────────────────
 // 5-dimension risk assessment engine for SafeHands.
 // Weights: liquidity 25%, slippage 25%, counterparty 20%,
 //          balance 15%, market conditions 15%
+//
+// This engine never gates execution. Its output is advisory: published
+// on-chain as part of the assessment record (publish_risk_score) and fed to
+// the actionPolicyEngine as evidence (riskEvidenceFromAssessment) — the
+// policy engine is the sole ALLOW/BLOCK decider on write paths
+// (docs/DECISION_CONTRACT.md).
 // ────────────────────────────────────────────────────────────────────────
 import { publicClient } from "./pharosClient.js";
-import { getDodoRoute, isNativeToken, resolveTokenAddress, resolveTokenDecimals, toWei, } from "./dodoApi.js";
-import { RISK_WEIGHTS, RISK_BLOCK_THRESHOLD, MAX_SLIPPAGE_PCT, MAX_BALANCE_USAGE_PCT, ERC20_ABI, } from "./constants.js";
+import { getDodoRoute, isNativeToken, resolveTokenAddress, resolveTokenDecimals, toWei, DodoNotConfiguredError, } from "./dodoApi.js";
+import { RISK_WEIGHTS, RISK_BLOCK_THRESHOLD, COUNTERPARTY_CRITICAL_THRESHOLD, MAX_SLIPPAGE_PCT, MAX_BALANCE_USAGE_PCT, ERC20_ABI, CHAIN_ID, } from "./constants.js";
+import { addressTrustEvidence } from "./ecosystemRegistry.js";
 import { formatEther, isAddress, parseEther } from "viem";
 // ─── Helpers ───────────────────────────────────────────────────────────
 function clamp(value, min = 0, max = 100) {
@@ -39,32 +46,37 @@ function weightedAverage(breakdown) {
 /**
  * Pre-fetches the DODO route quote once for swap actions.
  * Both scoreLiquidity and scoreSlippage use this cached result.
+ * `notConfigured` distinguishes the structural provider-not-configured state
+ * (SWAP_LIQUIDITY_NOT_CONFIGURED) from a transient fetch failure.
  */
 async function fetchSwapQuote(input) {
     if (input.action !== "swap")
-        return null;
+        return { quote: null, notConfigured: false };
     try {
-        return await getDodoRoute({
+        const quote = await getDodoRoute({
             fromToken: input.tokenIn,
             toToken: input.tokenOut,
             amountHuman: input.amount,
             walletAddress: input.walletAddress,
         });
+        return { quote, notConfigured: false };
     }
-    catch {
-        return null;
+    catch (err) {
+        return { quote: null, notConfigured: err instanceof DodoNotConfiguredError };
     }
 }
-function scoreLiquidity(input, quote) {
+function scoreLiquidity(input, quote, notConfigured) {
     const reasons = [];
     if (input.action !== "swap")
         return { score: 0, reasons };
     if (!quote) {
-        reasons.push("Failed to fetch liquidity data");
+        reasons.push(notConfigured
+            ? `Swap liquidity provider is not configured for chainId ${CHAIN_ID} (SWAP_LIQUIDITY_NOT_CONFIGURED); liquidity cannot be verified on this network.`
+            : "Failed to fetch liquidity data: route provider unavailable.");
         return { score: 70, reasons };
     }
     if (!quote.routeAvailable) {
-        reasons.push("No swap route available — liquidity may be exhausted");
+        reasons.push("No swap route available; liquidity may be exhausted");
         return { score: 100, reasons };
     }
     const impact = Math.abs(quote.priceImpact);
@@ -79,16 +91,18 @@ function scoreLiquidity(input, quote) {
     reasons.push(`Price impact acceptable: ${impact.toFixed(2)}%`);
     return { score: clamp(impact * 15), reasons };
 }
-function scoreSlippage(input, quote) {
+function scoreSlippage(input, quote, notConfigured) {
     const reasons = [];
     if (input.action !== "swap")
         return { score: 0, reasons };
     if (!quote) {
-        reasons.push("Slippage estimation failed");
+        reasons.push(notConfigured
+            ? `Slippage cannot be estimated: swap route provider not configured for chainId ${CHAIN_ID} (SWAP_LIQUIDITY_NOT_CONFIGURED).`
+            : "Slippage estimation failed: route provider unavailable.");
         return { score: 60, reasons };
     }
     if (!quote.routeAvailable) {
-        reasons.push("Cannot estimate slippage — no route");
+        reasons.push("Cannot estimate slippage: no route");
         return { score: 90, reasons };
     }
     const impact = Math.abs(quote.priceImpact);
@@ -99,12 +113,28 @@ function scoreSlippage(input, quote) {
     reasons.push(`Estimated slippage: ${impact.toFixed(2)}%`);
     return { score: clamp(impact * 16), reasons };
 }
-async function scoreCounterparty(input) {
+async function scoreCounterparty(input, quote) {
     const reasons = [];
     if (input.action === "swap") {
-        // For swaps, counterparty is the DODO protocol — trusted
-        reasons.push("Swap routed through DODO protocol (known)");
-        return { score: 5, reasons };
+        // Registry-driven counterparty trust ONLY. The former unconditional
+        // "DODO protocol (known) → 5" relaxed risk with a testnet-provenance claim
+        // that holds on no network per the ecosystem registry.
+        const router = quote?.routeAvailable && isAddress(quote.to) ? quote.to : null;
+        if (!router) {
+            reasons.push("Swap counterparty (router) could not be determined; no route data to evaluate.");
+            return { score: 55, reasons };
+        }
+        const evidence = addressTrustEvidence(router, CHAIN_ID);
+        if (evidence.verifiedCanonical) {
+            reasons.push(`Swap router ${evidence.contractLabel ?? router} is VERIFIED in the SafeHands ecosystem registry.`);
+            return { score: 5, reasons };
+        }
+        if (evidence.recognized) {
+            reasons.push(`Swap router matches ecosystem-registry entry "${evidence.contractLabel}" (${evidence.verificationStatus}); recognition only, not a safety signal.`);
+            return { score: 40, reasons };
+        }
+        reasons.push(`Swap router ${router} is not in the SafeHands ecosystem registry: unverified counterparty (the execution allowlist still constrains which router may execute at write time).`);
+        return { score: 55, reasons };
     }
     // For transfers, check the recipient address
     const to = input.toAddress;
@@ -118,19 +148,19 @@ async function scoreCounterparty(input) {
     }
     // Zero address check
     if (to === "0x0000000000000000000000000000000000000000") {
-        reasons.push("Sending to zero address — tokens will be burned");
+        reasons.push("Sending to zero address; tokens will be burned");
         return { score: 95, reasons };
     }
     // Self-send check
     if (to.toLowerCase() === input.walletAddress.toLowerCase()) {
-        reasons.push("Sending to own address — likely unintended");
+        reasons.push("Sending to own address; likely unintended");
         return { score: 50, reasons };
     }
     // Check if address has code (is a contract)
     try {
         const code = await publicClient.getCode({ address: to });
         if (code && code !== "0x") {
-            reasons.push("Recipient is a contract address — verify intent");
+            reasons.push("Recipient is a contract address; verify intent");
             return { score: 40, reasons };
         }
     }
@@ -141,7 +171,7 @@ async function scoreCounterparty(input) {
     try {
         const balance = await publicClient.getBalance({ address: to });
         if (balance === 0n) {
-            reasons.push("Recipient has zero balance — new or unused address");
+            reasons.push("Recipient has zero balance; new or unused address");
             return { score: 30, reasons };
         }
     }
@@ -155,19 +185,19 @@ async function scoreBalance(input) {
     const reasons = [];
     try {
         const walletAddr = input.walletAddress;
-        if (input.action === "transfer" || (input.action === "swap" && isNativeToken(input.tokenIn || "PHRS"))) {
-            // Check native PHRS balance
+        if (input.action === "transfer" || (input.action === "swap" && isNativeToken(input.tokenIn || "PROS"))) {
+            // Check native PROS balance
             const balance = await publicClient.getBalance({ address: walletAddr });
             const amountWei = parseEther(input.amount);
-            const gasBuffer = parseEther("0.01"); // ~0.01 PHRS for gas
+            const gasBuffer = parseEther("0.01"); // ~0.01 PROS for gas
             if (balance < amountWei + gasBuffer) {
                 const balanceHuman = formatEther(balance);
-                reasons.push(`Insufficient PHRS balance: have ${balanceHuman}, need ${input.amount} + gas`);
+                reasons.push(`Insufficient PROS balance: have ${balanceHuman}, need ${input.amount} + gas`);
                 return { score: 100, reasons };
             }
             const usagePct = Number((amountWei * 100n) / balance);
             if (usagePct > MAX_BALANCE_USAGE_PCT) {
-                reasons.push(`Using ${usagePct}% of wallet balance — high exposure`);
+                reasons.push(`Using ${usagePct}% of wallet balance; high exposure`);
                 return { score: clamp(60 + (usagePct - MAX_BALANCE_USAGE_PCT)), reasons };
             }
             reasons.push(`Balance sufficient, using ${usagePct}% of wallet`);
@@ -191,7 +221,7 @@ async function scoreBalance(input) {
             // Also check gas balance
             const ethBalance = await publicClient.getBalance({ address: walletAddr });
             if (ethBalance < parseEther("0.005")) {
-                reasons.push("Very low PHRS balance for gas fees");
+                reasons.push("Very low PROS balance for gas fees");
                 return { score: 80, reasons };
             }
             reasons.push("Token and gas balance sufficient");
@@ -201,7 +231,7 @@ async function scoreBalance(input) {
     }
     catch (err) {
         reasons.push(`Balance check failed: ${err.message}`);
-        return { score: 50, reasons };
+        return { score: 50, reasons, degraded: true };
     }
 }
 async function scoreMarketCondition(_input) {
@@ -215,7 +245,7 @@ async function scoreMarketCondition(_input) {
         const timeDiff = Number(latestBlock.timestamp - prevBlock.timestamp);
         const avgBlockTime = timeDiff / 10;
         if (avgBlockTime > 30) {
-            reasons.push(`Slow block production: ~${avgBlockTime.toFixed(1)}s/block — chain may be congested`);
+            reasons.push(`Slow block production: ~${avgBlockTime.toFixed(1)}s/block; chain may be congested`);
             return { score: 60, reasons };
         }
         if (avgBlockTime > 15) {
@@ -239,15 +269,15 @@ async function scoreMarketCondition(_input) {
 }
 // ─── Main Risk Assessment ──────────────────────────────────────────────
 export async function assessRisk(input) {
-    // Fetch DODO route once and share between liquidity + slippage scorers
-    const swapQuote = await fetchSwapQuote(input);
+    // Fetch DODO route once and share between liquidity + slippage + counterparty scorers
+    const { quote: swapQuote, notConfigured: swapProviderNotConfigured } = await fetchSwapQuote(input);
     const [counterparty, balance, market] = await Promise.all([
-        scoreCounterparty(input),
+        scoreCounterparty(input, swapQuote),
         scoreBalance(input),
         scoreMarketCondition(input),
     ]);
-    const liquidity = scoreLiquidity(input, swapQuote);
-    const slippage = scoreSlippage(input, swapQuote);
+    const liquidity = scoreLiquidity(input, swapQuote, swapProviderNotConfigured);
+    const slippage = scoreSlippage(input, swapQuote, swapProviderNotConfigured);
     const breakdown = {
         liquidityRisk: liquidity.score,
         slippageRisk: slippage.score,
@@ -257,7 +287,32 @@ export async function assessRisk(input) {
     };
     const riskScore = clamp(weightedAverage(breakdown));
     const riskLevel = computeRiskLevel(riskScore);
-    const recommendation = computeRecommendation(riskScore);
+    let recommendation = computeRecommendation(riskScore);
+    // Fail-closed on missing CRITICAL data. A swap whose route/liquidity could
+    // not be fetched, or any action whose balance check threw, must NOT be scored as
+    // safe on degraded inputs. Mark degraded and refuse to "proceed" silently.
+    const degradedReasons = [];
+    if (input.action === "swap" && swapQuote === null) {
+        degradedReasons.push(swapProviderNotConfigured
+            ? `Swap liquidity provider is not configured for chainId ${CHAIN_ID} (SWAP_LIQUIDITY_NOT_CONFIGURED); this is a permanent configuration state on this network, not a transient outage.`
+            : "Liquidity/slippage could not be assessed: swap route fetch failed.");
+    }
+    if (balance.degraded) {
+        degradedReasons.push("Wallet balance could not be verified; RPC unavailable.");
+    }
+    const degraded = degradedReasons.length > 0;
+    if (degraded && recommendation === "proceed") {
+        recommendation = "caution";
+    }
+    // Advisory escalation mirroring the policy engine's `risk_counterparty`
+    // check (the actual block mechanism). Kept so the published recommendation
+    // stays honest for critically-risky transfers (missing / invalid / zero
+    // recipient): weighted heuristics alone can never cross the block threshold
+    // for a transfer, so without this the on-chain record would say "caution"
+    // where the policy engine blocks.
+    if (input.action === "transfer" && counterparty.score >= COUNTERPARTY_CRITICAL_THRESHOLD) {
+        recommendation = "block";
+    }
     const reasons = [
         ...liquidity.reasons,
         ...slippage.reasons,
@@ -275,7 +330,7 @@ export async function assessRisk(input) {
     }
     else {
         suggestion =
-            "High risk detected — execution blocked for safety. Review the reasons and adjust your transaction parameters significantly before retrying.";
+            "High risk detected: execution blocked for safety. Review the reasons and adjust your transaction parameters significantly before retrying.";
     }
     return {
         riskScore,
@@ -284,6 +339,9 @@ export async function assessRisk(input) {
         breakdown,
         reasons,
         suggestion,
+        degraded,
+        degradedReasons,
+        ...(input.action === "swap" ? { swapProviderNotConfigured } : {}),
     };
 }
 //# sourceMappingURL=riskEngine.js.map

package/dist/lib/riskEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"riskEngine.js","sourceRoot":"","sources":["../../src/lib/riskEngine.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oDAAoD;AACpD,0DAA0D;AAC1D,8CAA8C;AAC9C,2EAA2E;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,GAEN,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,oBAAoB,EAEpB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,GAEV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAiC1D,0EAA0E;AAE1E,SAAS,KAAK,CAAC,KAAa,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,KAAK,IAAI,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,SAAwB;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC;IACvB,OAAO,IAAI,CAAC,KAAK,CACf,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa;QACvC,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;QACvC,SAAS,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB;QAC/C,SAAS,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW;QACrC,SAAS,CAAC,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CACxD,CAAC;AACJ,CAAC;AAED,0EAA0E;AAE1E;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,KAAgB;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC;YACxB,SAAS,EAAE,KAAK,CAAC,OAAQ;YACzB,OAAO,EAAE,KAAK,CAAC,QAAS;YACxB,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB,EAAE,KAAuB;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB,EAAE,KAAuB;IAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,wBAAwB,gBAAgB,gBAAgB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAgB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,yDAAyD;QACzD,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,qBAAqB;IACrB,IAAI,EAAE,KAAK,4CAA4C,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAmB,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAmB,EAAE,CAAC,CAAC;QAChF,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAgB;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,aAA8B,CAAC;QAExD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC;YACvG,4BAA4B;YAC5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB;YAE3D,IAAI,OAAO,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,mCAAmC,YAAY,UAAU,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;gBAC5F,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACjC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YACtD,IAAI,QAAQ,GAAG,qBAAqB,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,SAAS,QAAQ,qCAAqC,CAAC,CAAC;gBACrE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,qBAAqB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC5E,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,aAAa,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QAED,6BAA6B;QAC7B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAExD,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC/C,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,SAAS;gBACd,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,CAAC,UAAU,CAAC;aACnB,CAAC,CAAW,CAAC;YAEd,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;gBACtD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACjC,CAAC;YAED,yBAAyB;YACzB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1E,IAAI,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;gBACnD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAChC,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAiB;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC;YAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,GAAG;SACtC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,QAAQ,GAAG,EAAE,CAAC;QAEnC,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,2BAA2B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;YACnG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,mCAAmC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAE5C,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAgB;IAC/C,uEAAuE;IACvE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAE9C,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,iBAAiB,CAAC,KAAK,CAAC;QACxB,YAAY,CAAC,KAAK,CAAC;QACnB,oBAAoB,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAkB;QAC/B,aAAa,EAAE,SAAS,CAAC,KAAK;QAC9B,YAAY,EAAE,QAAQ,CAAC,KAAK;QAC5B,gBAAgB,EAAE,YAAY,CAAC,KAAK;QACpC,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,mBAAmB,EAAE,MAAM,CAAC,KAAK;KAClC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG;QACd,GAAG,SAAS,CAAC,OAAO;QACpB,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,YAAY,CAAC,OAAO;QACvB,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,MAAM,CAAC,OAAO;KAClB,CAAC;IAEF,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,UAAU,GAAG,gEAAgE,CAAC;IAChF,CAAC;SAAM,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,UAAU;YACR,sIAAsI,CAAC;IAC3I,CAAC;SAAM,CAAC;QACN,UAAU;YACR,6IAA6I,CAAC;IAClJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS;QACT,cAAc;QACd,SAAS;QACT,OAAO;QACP,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"riskEngine.js","sourceRoot":"","sources":["../../src/lib/riskEngine.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oDAAoD;AACpD,0DAA0D;AAC1D,8CAA8C;AAC9C,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,wEAAwE;AACxE,+DAA+D;AAC/D,+BAA+B;AAC/B,2EAA2E;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,EACL,sBAAsB,GAEvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,+BAA+B,EAC/B,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAoD1D,0EAA0E;AAE1E,SAAS,KAAK,CAAC,KAAa,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,KAAK,IAAI,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,SAAwB;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC;IACvB,OAAO,IAAI,CAAC,KAAK,CACf,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa;QACvC,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;QACvC,SAAS,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB;QAC/C,SAAS,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW;QACrC,SAAS,CAAC,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CACxD,CAAC;AACJ,CAAC;AAED,0EAA0E;AAE1E;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,KAAgB;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,OAAQ;YACzB,OAAO,EAAE,KAAK,CAAC,QAAS;YACxB,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,YAAY,sBAAsB,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB,EAAE,KAAuB,EAAE,aAAsB;IACvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CACV,aAAa;YACX,CAAC,CAAC,yDAAyD,QAAQ,iFAAiF;YACpJ,CAAC,CAAC,6DAA6D,CAClE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB,EAAE,KAAuB,EAAE,aAAsB;IACtF,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CACV,aAAa;YACX,CAAC,CAAC,gFAAgF,QAAQ,mCAAmC;YAC7H,CAAC,CAAC,yDAAyD,CAC9D,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,wBAAwB,gBAAgB,gBAAgB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAgB,EAAE,KAAuB;IACxE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,MAAM,GAAG,KAAK,EAAE,cAAc,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;YAC/F,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,aAAa,IAAI,MAAM,mDAAmD,CAAC,CAAC;YACjH,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CACV,iDAAiD,QAAQ,CAAC,aAAa,MAAM,QAAQ,CAAC,kBAAkB,2CAA2C,CACpJ,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,IAAI,CACV,eAAe,MAAM,yJAAyJ,CAC/K,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,6CAA6C;IAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,qBAAqB;IACrB,IAAI,EAAE,KAAK,4CAA4C,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAmB,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAmB,EAAE,CAAC,CAAC;QAChF,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAClE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAgB;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,aAA8B,CAAC;QAExD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC;YACvG,4BAA4B;YAC5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB;YAE3D,IAAI,OAAO,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,mCAAmC,YAAY,UAAU,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;gBAC5F,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACjC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YACtD,IAAI,QAAQ,GAAG,qBAAqB,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,SAAS,QAAQ,oCAAoC,CAAC,CAAC;gBACpE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,qBAAqB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC5E,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,aAAa,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QAED,6BAA6B;QAC7B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAExD,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC/C,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,SAAS;gBACd,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,CAAC,UAAU,CAAC;aACnB,CAAC,CAAW,CAAC;YAEd,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;gBACtD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACjC,CAAC;YAED,yBAAyB;YACzB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1E,IAAI,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;gBACnD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAChC,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAiB;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC;YAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,GAAG;SACtC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,QAAQ,GAAG,EAAE,CAAC;QAEnC,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,2BAA2B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;YAClG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,mCAAmC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAE5C,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAgB;IAC/C,sFAAsF;IACtF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,yBAAyB,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAEnG,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;QACnC,YAAY,CAAC,KAAK,CAAC;QACnB,oBAAoB,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAE5E,MAAM,SAAS,GAAkB;QAC/B,aAAa,EAAE,SAAS,CAAC,KAAK;QAC9B,YAAY,EAAE,QAAQ,CAAC,KAAK;QAC5B,gBAAgB,EAAE,YAAY,CAAC,KAAK;QACpC,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,mBAAmB,EAAE,MAAM,CAAC,KAAK;KAClC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,eAAe,CAAC,IAAI,CAClB,yBAAyB;YACvB,CAAC,CAAC,yDAAyD,QAAQ,oHAAoH;YACvL,CAAC,CAAC,oEAAoE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,eAAe,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,IAAI,QAAQ,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7C,cAAc,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,kCAAkC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,YAAY,CAAC,KAAK,IAAI,+BAA+B,EAAE,CAAC;QACzF,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,SAAS,CAAC,OAAO;QACpB,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,YAAY,CAAC,OAAO;QACvB,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,MAAM,CAAC,OAAO;KAClB,CAAC;IAEF,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,UAAU,GAAG,gEAAgE,CAAC;IAChF,CAAC;SAAM,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,UAAU;YACR,sIAAsI,CAAC;IAC3I,CAAC;SAAM,CAAC;QACN,UAAU;YACR,4IAA4I,CAAC;IACjJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS;QACT,cAAc;QACd,SAAS;QACT,OAAO;QACP,UAAU;QACV,QAAQ;QACR,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/dist/lib/riskInclusion.d.ts

@@ -0,0 +1,72 @@
+import { type RiskRecordInput } from "./merkleBatcher.js";
+/**
+ * Normalize the DA batch JSON into typed RiskRecordInput[]. The writer may
+ * serialize expiresAt as a bigint-tagged string or a plain number, so we coerce
+ * defensively rather than trusting a single encoding.
+ */
+export declare function normalizeRiskRecords(raw: unknown): RiskRecordInput[];
+export interface InclusionProof {
+    record: RiskRecordInput;
+    leaf: `0x${string}`;
+    proof: `0x${string}`[];
+    /** Root recomputed from the full batch — must equal the on-chain root for a valid claim. */
+    computedRoot: `0x${string}`;
+    /** merkletreejs verification of proof→leaf against the recomputed root. */
+    verifiedLocal: boolean;
+}
+/**
+ * Pure inclusion proof: find the record matching `match` in `records`, rebuild
+ * the tree, and produce the Merkle proof for its leaf. No network, no chain —
+ * fully unit-testable. Returns null when no record matches.
+ */
+export declare function proveInclusion(records: RiskRecordInput[], match: {
+    target: string;
+    actionHash?: string;
+}): InclusionProof | null;
+export interface RiskInclusionResult {
+    /** SAFEHANDS_REGISTRY_ADDRESS is set to a valid address. */
+    configured: boolean;
+    /** A non-zero Merkle root has been committed on-chain. */
+    committed: boolean;
+    onchainMerkleRoot: string | null;
+    dataURI: string | null;
+    /** A record for the target was located in the batch. */
+    found: boolean;
+    /** The recomputed batch root equals the committed on-chain root (DA is authentic & current). */
+    rootMatches: boolean;
+    /** Merkle proof verified locally (merkletreejs) against the recomputed root. */
+    verifiedLocal: boolean;
+    /** Contract verifyRiskRecord view returned true (trustless, composable). null = not attempted. */
+    verifiedOnchain: boolean | null;
+    /** Record's expiresAt has passed (on-chain verifyRiskRecord would revert with Expired). */
+    expired: boolean;
+    proof: string[] | null;
+    record: {
+        target: string;
+        actionHash: string;
+        score: number;
+        level: number;
+        recommendation: number;
+        policyVersionHash: string;
+        evidenceHash: string;
+        expiresAt: string;
+    } | null;
+    source: "onchain-view" | "local-only" | "unconfigured" | "not-committed" | "not-found" | "root-mismatch" | "error";
+    error?: string;
+}
+/**
+ * End-to-end keyless inclusion check for a target's risk record against the
+ * currently committed on-chain Merkle root. Fail-closed and neutral on every
+ * missing precondition (unconfigured, uncommitted, unreachable DA, not found).
+ * When `verifyOnchain` is true (default) it additionally calls the contract's
+ * verifyRiskRecord view so the "yes, this verdict is in the on-chain root" claim
+ * is proven trustlessly rather than only in-process.
+ */
+export declare function verifyRiskInclusion(match: {
+    target: string;
+    actionHash?: string;
+}, opts?: {
+    verifyOnchain?: boolean;
+    registryAddress?: string;
+}): Promise<RiskInclusionResult>;
+//# sourceMappingURL=riskInclusion.d.ts.map

package/dist/lib/riskInclusion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskInclusion.d.ts","sourceRoot":"","sources":["../../src/lib/riskInclusion.ts"],"names":[],"mappings":"AAaA,OAAO,EAAoC,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAuB5F;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE,CAcpE;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,CAAC;IACvB,4FAA4F;IAC5F,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,EAAE,EAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,cAAc,GAAG,IAAI,CAiBvB;AAED,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;IACpB,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,KAAK,EAAE,OAAO,CAAC;IACf,gGAAgG;IAChG,WAAW,EAAE,OAAO,CAAC;IACrB,gFAAgF;IAChF,aAAa,EAAE,OAAO,CAAC;IACvB,kGAAkG;IAClG,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IACT,MAAM,EAAE,cAAc,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,GAAG,WAAW,GAAG,eAAe,GAAG,OAAO,CAAC;IACnH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAoCD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9C,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,OAAO,CAAC,mBAAmB,CAAC,CAgJ9B"}

package/dist/lib/riskInclusion.js

@@ -0,0 +1,252 @@
+// ─── L1 Merkle inclusion read-path ─────────────────────────────────────
+// The keyless consumer that closes the L1 on-chain-memory loop. commitRiskRoot
+// publishes a Merkle root (on-chain) + a data-availability pointer to the batch
+// JSON (off-chain). This module reads that root, fetches the batch, and proves a
+// single risk record is included — both locally and, for trustlessness, through
+// the contract's own verifyRiskRecord view. No private key is ever touched: this
+// is a pure read/verify path, safe for the zero-custody public profile.
+// ────────────────────────────────────────────────────────────────────────
+import { isAddress, keccak256 } from "viem";
+import { MerkleTree } from "merkletreejs";
+import { publicClient } from "./pharosClient.js";
+import { fetchWithTimeoutAndRetry } from "./http.js";
+import { buildMerkleTree, computeRiskLeaf } from "./merkleBatcher.js";
+import { SAFEHANDS_REGISTRY_ADDRESS, SAFEHANDS_REGISTRY_ABI } from "./constants.js";
+const ZERO_ROOT = "0x0000000000000000000000000000000000000000000000000000000000000000";
+function registryAddress() {
+    return SAFEHANDS_REGISTRY_ADDRESS && isAddress(SAFEHANDS_REGISTRY_ADDRESS)
+        ? SAFEHANDS_REGISTRY_ADDRESS
+        : null;
+}
+/** Coerce expiresAt from any serialized form ("123n" suffixed, numeric string, number, bigint). */
+function toBigInt(value) {
+    if (typeof value === "bigint")
+        return value;
+    if (typeof value === "number")
+        return BigInt(Math.trunc(value));
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        const digits = /n$/.test(trimmed) ? trimmed.slice(0, -1) : trimmed;
+        if (/^\d+$/.test(digits))
+            return BigInt(digits);
+    }
+    return 0n;
+}
+/**
+ * Normalize the DA batch JSON into typed RiskRecordInput[]. The writer may
+ * serialize expiresAt as a bigint-tagged string or a plain number, so we coerce
+ * defensively rather than trusting a single encoding.
+ */
+export function normalizeRiskRecords(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .filter((r) => r && typeof r === "object")
+        .map((r) => ({
+        target: String(r.target ?? ""),
+        actionHash: String(r.actionHash ?? ""),
+        score: Number(r.score ?? 0),
+        level: Number(r.level ?? 0),
+        recommendation: Number(r.recommendation ?? 0),
+        policyVersionHash: String(r.policyVersionHash ?? ""),
+        evidenceHash: String(r.evidenceHash ?? ""),
+        expiresAt: toBigInt(r.expiresAt),
+    }));
+}
+/**
+ * Pure inclusion proof: find the record matching `match` in `records`, rebuild
+ * the tree, and produce the Merkle proof for its leaf. No network, no chain —
+ * fully unit-testable. Returns null when no record matches.
+ */
+export function proveInclusion(records, match) {
+    const target = match.target.toLowerCase();
+    const actionHash = match.actionHash?.toLowerCase();
+    const record = records.find((r) => r.target.toLowerCase() === target &&
+        (actionHash === undefined || r.actionHash.toLowerCase() === actionHash));
+    if (!record)
+        return null;
+    const tree = buildMerkleTree(records);
+    const leaf = computeRiskLeaf(record);
+    const proof = tree.getHexProof(leaf);
+    const computedRoot = tree.getHexRoot();
+    const verifiedLocal = MerkleTree.verify(proof, leaf, computedRoot, keccak256, { sortPairs: true });
+    return { record, leaf, proof, computedRoot, verifiedLocal };
+}
+function neutral(partial) {
+    return {
+        configured: false,
+        committed: false,
+        onchainMerkleRoot: null,
+        dataURI: null,
+        found: false,
+        rootMatches: false,
+        verifiedLocal: false,
+        verifiedOnchain: null,
+        expired: false,
+        proof: null,
+        record: null,
+        source: "unconfigured",
+        ...partial,
+    };
+}
+async function fetchBatch(dataURI) {
+    if (!/^https?:\/\//i.test(dataURI)) {
+        throw new Error(`Unsupported data-availability URI scheme: ${dataURI}. Only http(s) batch pointers are resolvable by this read-path.`);
+    }
+    // dataURI is operator-controlled (read from chain), so fetch through the
+    // SSRF-guarded layer (DNS-pinned lookup, blocked internal ranges, redirect
+    // re-validation) — a malicious/compromised operator must not be able to point
+    // this read-path at internal endpoints. The Merkle-root comparison downstream
+    // already detects content tampering; this guards the request itself.
+    const res = await fetchWithTimeoutAndRetry(dataURI, { timeoutMs: 10_000, retries: 0 });
+    if (!res.ok)
+        throw new Error(`DA fetch failed: HTTP ${res.status} for ${dataURI}`);
+    return res.json();
+}
+/**
+ * End-to-end keyless inclusion check for a target's risk record against the
+ * currently committed on-chain Merkle root. Fail-closed and neutral on every
+ * missing precondition (unconfigured, uncommitted, unreachable DA, not found).
+ * When `verifyOnchain` is true (default) it additionally calls the contract's
+ * verifyRiskRecord view so the "yes, this verdict is in the on-chain root" claim
+ * is proven trustlessly rather than only in-process.
+ */
+export async function verifyRiskInclusion(match, opts = {}) {
+    // An explicit registryAddress override (incl. "") lets callers/tests exercise the
+    // fail-closed branch deterministically without touching env or the network.
+    const address = opts.registryAddress !== undefined
+        ? (opts.registryAddress && isAddress(opts.registryAddress) ? opts.registryAddress : null)
+        : registryAddress();
+    if (!address) {
+        return neutral({ source: "unconfigured", error: "SAFEHANDS_REGISTRY_ADDRESS not configured." });
+    }
+    let onchainMerkleRoot;
+    let dataURI;
+    try {
+        [onchainMerkleRoot, dataURI] = (await Promise.all([
+            publicClient.readContract({ address, abi: SAFEHANDS_REGISTRY_ABI, functionName: "currentMerkleRoot", args: [] }),
+            publicClient.readContract({ address, abi: SAFEHANDS_REGISTRY_ABI, functionName: "currentDataURI", args: [] }),
+        ]));
+    }
+    catch (err) {
+        return neutral({ configured: true, source: "error", error: `Registry read failed: ${err.message}` });
+    }
+    if (!onchainMerkleRoot || onchainMerkleRoot === ZERO_ROOT) {
+        return neutral({ configured: true, onchainMerkleRoot, dataURI, source: "not-committed" });
+    }
+    let records;
+    try {
+        records = normalizeRiskRecords(await fetchBatch(dataURI));
+    }
+    catch (err) {
+        return neutral({
+            configured: true,
+            committed: true,
+            onchainMerkleRoot,
+            dataURI,
+            source: "error",
+            error: err.message,
+        });
+    }
+    const proven = proveInclusion(records, match);
+    if (!proven) {
+        return neutral({
+            configured: true,
+            committed: true,
+            onchainMerkleRoot,
+            dataURI,
+            source: "not-found",
+        });
+    }
+    const rootMatches = proven.computedRoot.toLowerCase() === onchainMerkleRoot.toLowerCase();
+    const now = BigInt(Math.floor(Date.now() / 1000));
+    const expired = proven.record.expiresAt !== 0n && proven.record.expiresAt < now;
+    const record = {
+        target: proven.record.target,
+        actionHash: proven.record.actionHash,
+        score: proven.record.score,
+        level: proven.record.level,
+        recommendation: proven.record.recommendation,
+        policyVersionHash: proven.record.policyVersionHash,
+        evidenceHash: proven.record.evidenceHash,
+        expiresAt: proven.record.expiresAt === 0n ? "never" : proven.record.expiresAt.toString(),
+    };
+    // If the batch we fetched does not hash to the committed root, the DA content is
+    // stale or tampered — the proof is meaningless. Fail loudly rather than half-pass.
+    if (!rootMatches) {
+        return {
+            ...neutral({}),
+            configured: true,
+            committed: true,
+            onchainMerkleRoot,
+            dataURI,
+            found: true,
+            rootMatches: false,
+            verifiedLocal: proven.verifiedLocal,
+            verifiedOnchain: null,
+            expired,
+            proof: proven.proof,
+            record,
+            source: "root-mismatch",
+            error: "Recomputed batch root does not match the on-chain committed root (stale or tampered data availability).",
+        };
+    }
+    let verifiedOnchain = null;
+    const shouldVerifyOnchain = opts.verifyOnchain !== false;
+    if (shouldVerifyOnchain) {
+        try {
+            verifiedOnchain = (await publicClient.readContract({
+                address,
+                abi: SAFEHANDS_REGISTRY_ABI,
+                functionName: "verifyRiskRecord",
+                args: [
+                    proven.record.target,
+                    proven.record.actionHash,
+                    proven.record.score,
+                    proven.record.level,
+                    proven.record.recommendation,
+                    proven.record.policyVersionHash,
+                    proven.record.evidenceHash,
+                    proven.record.expiresAt,
+                    proven.proof,
+                ],
+            }));
+        }
+        catch (err) {
+            // Expired() revert is a legitimate on-chain answer, not an infra failure.
+            verifiedOnchain = false;
+            if (!expired) {
+                return {
+                    configured: true,
+                    committed: true,
+                    onchainMerkleRoot,
+                    dataURI,
+                    found: true,
+                    rootMatches: true,
+                    verifiedLocal: proven.verifiedLocal,
+                    verifiedOnchain: false,
+                    expired,
+                    proof: proven.proof,
+                    record,
+                    source: "error",
+                    error: `On-chain verifyRiskRecord failed: ${err.message}`,
+                };
+            }
+        }
+    }
+    return {
+        configured: true,
+        committed: true,
+        onchainMerkleRoot,
+        dataURI,
+        found: true,
+        rootMatches: true,
+        verifiedLocal: proven.verifiedLocal,
+        verifiedOnchain,
+        expired,
+        proof: proven.proof,
+        record,
+        source: shouldVerifyOnchain ? "onchain-view" : "local-only",
+    };
+}
+//# sourceMappingURL=riskInclusion.js.map