safehands-pharos 1.5.0 → 2.8.0

package/dist/lib/okxDexApi.js

@@ -0,0 +1,221 @@
+// ─── OKX DEX Aggregator API Client ─────────────────────────────────────
+// Fetches swap quotes and executable calldata from the OKX DEX aggregator
+// (Classic Swap API v6).
+//
+// CHAIN SUPPORT IS EVIDENCE-GATED. OKX's own supported-chains docs list Pharos
+// with chainIndex 1672 and Trade capability, and both the aggregation router
+// and the token-approve contract are registry-verified from OKX's dev docs
+// plus on-chain bytecode checks (protocol:pacific-mainnet:okx-dex). Pacific
+// Mainnet (1672) is therefore the only chain in the default supported set;
+// quote fetches on any other chain fail closed with a structured
+// SWAP_LIQUIDITY_NOT_CONFIGURED error. Override via OKX_API_SUPPORTED_CHAIN_IDS
+// only with evidence the OKX API actually serves that chain.
+//
+// AUTH: every request is signed per OKX's REST authentication scheme:
+//   OK-ACCESS-SIGN = Base64(HMAC-SHA256(timestamp + method + requestPath, secret))
+// where requestPath INCLUDES the query string. Credentials come from env at
+// call time (OKX_API_KEY / OKX_API_SECRET / OKX_API_PASSPHRASE, optional
+// OKX_API_PROJECT_ID for the OK-ACCESS-PROJECT header) and are never logged
+// or echoed into error messages. Missing credentials fail closed BEFORE any
+// network call with OKX_API_CREDENTIALS_MISSING.
+// ────────────────────────────────────────────────────────────────────────
+import { createHmac } from "node:crypto";
+import { isAddress } from "viem";
+import { OKX_API_BASE, OKX_SWAP_ENDPOINT, OKX_DEX_APPROVE_ADDRESS, okxApiCredentials, CHAIN_ID, } from "./constants.js";
+import { fetchWithTimeoutAndRetry } from "./http.js";
+import { resolveTokenAddress, resolveTokenDecimals, resolveAutoSlippage, toWei, fromWei } from "./dodoApi.js";
+// ─── Errors ────────────────────────────────────────────────────────────
+/**
+ * Structured "provider not configured for this chain" failure. Callers must
+ * surface this as SWAP_LIQUIDITY_NOT_CONFIGURED: a permanent configuration
+ * state, not a transient provider outage.
+ */
+export class OkxNotConfiguredError extends Error {
+    code = "SWAP_LIQUIDITY_NOT_CONFIGURED";
+    constructor(chainId) {
+        super(`SWAP_LIQUIDITY_NOT_CONFIGURED: the OKX DEX aggregator API is not a verified provider for chainId ${chainId}. ` +
+            `Swap liquidity and route quotes cannot be served on this network via the okx venue. ` +
+            `Verified chains: ${okxApiSupportedChainIds().join(", ") || "none"} (override with OKX_API_SUPPORTED_CHAIN_IDS only with evidence of support).`);
+        this.name = "OkxNotConfiguredError";
+    }
+}
+/**
+ * Structured "credentials not configured" failure raised BEFORE any network
+ * call. Lists only the missing env var NAMES, never any credential value.
+ */
+export class OkxCredentialsMissingError extends Error {
+    code = "OKX_API_CREDENTIALS_MISSING";
+    missing;
+    constructor(missing) {
+        super(`OKX_API_CREDENTIALS_MISSING: the okx swap venue requires signed API access. ` +
+            `Missing environment variables: ${missing.join(", ")}. ` +
+            `Create an API key in the OKX web3 developer portal and set OKX_API_KEY, OKX_API_SECRET, and OKX_API_PASSPHRASE (plus OKX_API_PROJECT_ID if your project requires it).`);
+        this.name = "OkxCredentialsMissingError";
+        this.missing = missing;
+    }
+}
+// ─── Chain gating ──────────────────────────────────────────────────────
+/**
+ * Chains the OKX DEX aggregator API is treated as configured for. Defaults to
+ * Pacific Mainnet (1672) only: OKX's supported-chains docs list Pharos with
+ * chainIndex 1672, and no Pharos testnet is listed. Any other chain fails
+ * closed until an operator opts in via OKX_API_SUPPORTED_CHAIN_IDS with
+ * evidence the API supports it.
+ */
+export function okxApiSupportedChainIds() {
+    const raw = process.env.OKX_API_SUPPORTED_CHAIN_IDS;
+    if (raw && raw.trim()) {
+        return raw
+            .split(",")
+            .map((s) => parseInt(s.trim(), 10))
+            .filter((n) => Number.isFinite(n) && n > 0);
+    }
+    return [1672];
+}
+export function isOkxApiConfiguredForChain(chainId = CHAIN_ID) {
+    return okxApiSupportedChainIds().includes(chainId);
+}
+// ─── Request signing (pure, exported for tests) ────────────────────────
+/**
+ * Computes the OK-ACCESS-SIGN header value: Base64(HMAC-SHA256(prehash, secret))
+ * with prehash = timestamp + method + requestPath (+ body for POST). The
+ * requestPath must include the query string.
+ */
+export function signOkxRequest(params) {
+    const prehash = `${params.timestamp}${params.method}${params.requestPath}${params.body ?? ""}`;
+    return createHmac("sha256", params.secret).update(prehash).digest("base64");
+}
+/**
+ * Builds the v6 swap request path (endpoint + query string) in a fixed
+ * parameter order so the signed string is deterministic and testable.
+ */
+export function buildOkxSwapRequestPath(params) {
+    const query = new URLSearchParams();
+    query.set("chainIndex", String(params.chainId));
+    query.set("fromTokenAddress", params.fromTokenAddress);
+    query.set("toTokenAddress", params.toTokenAddress);
+    query.set("amount", params.amountWei);
+    query.set("userWalletAddress", params.userWalletAddress);
+    query.set("slippagePercent", String(params.slippagePercent));
+    query.set("swapMode", "exactIn");
+    return `${OKX_SWAP_ENDPOINT}?${query.toString()}`;
+}
+// ─── Quote fetch ───────────────────────────────────────────────────────
+function emptyQuote(sourceStatus, usedFromToken, usedToToken, rawResponse) {
+    return {
+        amountOut: "0",
+        amountOutWei: "0",
+        priceImpact: 100,
+        gasLimit: "0",
+        value: "0",
+        calldata: "0x",
+        to: "",
+        approveAddress: "",
+        routeAvailable: false,
+        sourceStatus,
+        usedFromToken,
+        usedToToken,
+        wasSubstituted: false,
+        minReceiveAmountWei: "0",
+        rawResponse,
+    };
+}
+/**
+ * Fetches an executable swap quote from the OKX DEX aggregator. The returned
+ * `to`/`calldata` come from the aggregator and MUST still be contained by the
+ * caller against the OKX router allowlist; the approve address is the
+ * registry-verified OKX token-approve contract (OKX's approval model always
+ * targets that dedicated contract; the swap response itself does not carry a
+ * spender field).
+ */
+export async function getOkxSwapQuote(params) {
+    if (!isOkxApiConfiguredForChain(CHAIN_ID)) {
+        throw new OkxNotConfiguredError(CHAIN_ID);
+    }
+    const creds = okxApiCredentials();
+    if (!creds.ok) {
+        throw new OkxCredentialsMissingError(creds.missing);
+    }
+    if (!isAddress(params.walletAddress)) {
+        throw new Error(`INVALID_WALLET_ADDRESS: ${params.walletAddress}`);
+    }
+    const fromAddress = resolveTokenAddress(params.fromToken);
+    const toAddress = resolveTokenAddress(params.toToken);
+    const fromDecimals = resolveTokenDecimals(params.fromToken);
+    const toDecimals = resolveTokenDecimals(params.toToken);
+    const amountWei = toWei(params.amountHuman, fromDecimals);
+    const slippagePercent = params.slippage ?? resolveAutoSlippage(params.fromToken, params.toToken);
+    const requestPath = buildOkxSwapRequestPath({
+        chainId: CHAIN_ID,
+        fromTokenAddress: fromAddress,
+        toTokenAddress: toAddress,
+        amountWei,
+        userWalletAddress: params.walletAddress,
+        slippagePercent,
+    });
+    const timestamp = new Date().toISOString();
+    const headers = {
+        "Content-Type": "application/json",
+        "OK-ACCESS-KEY": creds.credentials.apiKey,
+        "OK-ACCESS-SIGN": signOkxRequest({ timestamp, method: "GET", requestPath, secret: creds.credentials.apiSecret }),
+        "OK-ACCESS-TIMESTAMP": timestamp,
+        "OK-ACCESS-PASSPHRASE": creds.credentials.passphrase,
+    };
+    if (creds.credentials.projectId) {
+        headers["OK-ACCESS-PROJECT"] = creds.credentials.projectId;
+    }
+    const response = await fetchWithTimeoutAndRetry(`${OKX_API_BASE}${requestPath}`, {
+        timeoutMs: 10_000,
+        retries: 2,
+        retryDelayMs: 300,
+        headers,
+    });
+    if (!response.ok) {
+        if (response.status === 401 || response.status === 403) {
+            throw new Error("OKX_API_AUTH_REQUIRED: the OKX DEX API rejected the configured credentials. Verify OKX_API_KEY, OKX_API_SECRET, OKX_API_PASSPHRASE (and OKX_API_PROJECT_ID if required) in the OKX web3 developer portal.");
+        }
+        if (response.status === 429) {
+            throw new Error(`OKX_API_RATE_LIMITED: ${response.status} ${response.statusText}`);
+        }
+        throw new Error(`OKX_API_UNAVAILABLE: ${response.status} ${response.statusText}`);
+    }
+    const json = (await response.json());
+    if (json.code !== "0" || !Array.isArray(json.data) || json.data.length === 0) {
+        const message = (json.msg || "").toLowerCase();
+        if (message.includes("api key") || message.includes("apikey") || message.includes("signature") || message.includes("passphrase") || message.includes("unauthorized") || message.includes("forbidden")) {
+            throw new Error("OKX_API_AUTH_REQUIRED: the OKX DEX API rejected the configured credentials. Verify OKX_API_KEY, OKX_API_SECRET, OKX_API_PASSPHRASE (and OKX_API_PROJECT_ID if required) in the OKX web3 developer portal.");
+        }
+        return emptyQuote("no_route_available", fromAddress, toAddress, json);
+    }
+    const entry = json.data[0];
+    const tx = entry.tx;
+    const routerResult = entry.routerResult;
+    // Fail closed on a malformed "success": a quote without an executable
+    // target and calldata is not tradable, whatever the response code says.
+    if (!tx || typeof tx.to !== "string" || !isAddress(tx.to) || typeof tx.data !== "string" || !/^0x[0-9a-fA-F]*$/.test(tx.data) || tx.data.length <= 2) {
+        return emptyQuote("no_route_available", fromAddress, toAddress, json);
+    }
+    const amountOutWei = String(routerResult?.toTokenAmount ?? "0");
+    // A missing/unparseable price impact must NOT default to a permissive 0:
+    // NaN makes the caller's PRICE_IMPACT_TOO_HIGH hard guard fail closed.
+    const rawImpact = routerResult?.priceImpactPercent;
+    const priceImpact = rawImpact === undefined || rawImpact === null || String(rawImpact).trim() === "" ? Number.NaN : Number(rawImpact);
+    return {
+        amountOut: fromWei(amountOutWei, toDecimals),
+        amountOutWei,
+        priceImpact,
+        gasLimit: String(tx.gas ?? "0"),
+        value: String(tx.value ?? "0"),
+        calldata: tx.data,
+        to: tx.to,
+        approveAddress: OKX_DEX_APPROVE_ADDRESS,
+        routeAvailable: true,
+        sourceStatus: "ok",
+        usedFromToken: fromAddress,
+        usedToToken: toAddress,
+        wasSubstituted: false,
+        minReceiveAmountWei: String(tx.minReceiveAmount ?? "0"),
+        rawResponse: json,
+    };
+}
+//# sourceMappingURL=okxDexApi.js.map

package/dist/lib/okxDexApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"okxDexApi.js","sourceRoot":"","sources":["../../src/lib/okxDexApi.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,yBAAyB;AACzB,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,iEAAiE;AACjE,gFAAgF;AAChF,6DAA6D;AAC7D,EAAE;AACF,sEAAsE;AACtE,mFAAmF;AACnF,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,iDAAiD;AACjD,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA6C9G,0EAA0E;AAE1E;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,+BAAwC,CAAC;IACzD,YAAY,OAAe;QACzB,KAAK,CACH,oGAAoG,OAAO,IAAI;YAC7G,sFAAsF;YACtF,oBAAoB,uBAAuB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,6EAA6E,CAClJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,6BAAsC,CAAC;IAC9C,OAAO,CAAW;IAC3B,YAAY,OAAiB;QAC3B,KAAK,CACH,8EAA8E;YAC5E,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACxD,uKAAuK,CAC1K,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,0EAA0E;AAE1E;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACpD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACtB,OAAO,GAAG;aACP,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB,QAAQ;IACnE,OAAO,uBAAuB,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,0EAA0E;AAE1E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAM9B;IACC,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAC/F,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAOvC;IACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACvD,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACnD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACzD,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjC,OAAO,GAAG,iBAAiB,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,0EAA0E;AAE1E,SAAS,UAAU,CACjB,YAAsC,EACtC,aAAqB,EACrB,WAAmB,EACnB,WAA+B;IAE/B,OAAO;QACL,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;QACjB,WAAW,EAAE,GAAG;QAChB,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,IAAI;QACd,EAAE,EAAE,EAAE;QACN,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,KAAK;QACrB,YAAY;QACZ,aAAa;QACb,WAAW;QACX,cAAc,EAAE,KAAK;QACrB,mBAAmB,EAAE,GAAG;QACxB,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAMrC;IACC,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjG,MAAM,WAAW,GAAG,uBAAuB,CAAC;QAC1C,OAAO,EAAE,QAAQ;QACjB,gBAAgB,EAAE,WAAW;QAC7B,cAAc,EAAE,SAAS;QACzB,SAAS;QACT,iBAAiB,EAAE,MAAM,CAAC,aAAa;QACvC,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;QACzC,gBAAgB,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAChH,qBAAqB,EAAE,SAAS;QAChC,sBAAsB,EAAE,KAAK,CAAC,WAAW,CAAC,UAAU;KACrD,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,GAAG,YAAY,GAAG,WAAW,EAAE,EAAE;QAC/E,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,GAAG;QACjB,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,2MAA2M,CAAC,CAAC;QAC/N,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;IAE3D,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtM,MAAM,IAAI,KAAK,CAAC,2MAA2M,CAAC,CAAC;QAC/N,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IACpB,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAExC,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrJ,OAAO,UAAU,CAAC,oBAAoB,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,aAAa,IAAI,GAAG,CAAC,CAAC;IAChE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,SAAS,GAAG,YAAY,EAAE,kBAAkB,CAAC;IACnD,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEtI,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC;QAC5C,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC;QAC9B,QAAQ,EAAE,EAAE,CAAC,IAAI;QACjB,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,cAAc,EAAE,uBAAuB;QACvC,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,WAAW;QAC1B,WAAW,EAAE,SAAS;QACtB,cAAc,EAAE,KAAK;QACrB,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACvD,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}

package/dist/lib/persistentJsonStore.d.ts

@@ -0,0 +1,5 @@
+export declare function safeHandsStateDir(): string;
+export declare function stateFile(name: string, envName?: string): string;
+export declare function readJsonFile<T>(filePath: string, fallback: T): T;
+export declare function writeJsonFileAtomic<T>(filePath: string, value: T): void;
+//# sourceMappingURL=persistentJsonStore.d.ts.map

package/dist/lib/persistentJsonStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistentJsonStore.d.ts","sourceRoot":"","sources":["../../src/lib/persistentJsonStore.ts"],"names":[],"mappings":"AAUA,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhE;AAOD,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAShE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAKvE"}

package/dist/lib/persistentJsonStore.js

@@ -0,0 +1,39 @@
+// ─── Small persistent JSON store ───────────────────────────────────────
+// Single-process durable storage for the Single-Instance Production Architecture.
+// It writes atomically
+// to a local file/volume and is intentionally dependency-free. For multi-node
+// deployments, replace this adapter with Postgres/Redis.
+// ────────────────────────────────────────────────────────────────────────
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+export function safeHandsStateDir() {
+    return process.env.SAFEHANDS_STATE_DIR || process.env.STATE_DIR || ".safehands";
+}
+export function stateFile(name, envName) {
+    return (envName ? process.env[envName] : undefined) || join(safeHandsStateDir(), name);
+}
+function ensureParent(filePath) {
+    const dir = dirname(filePath);
+    if (dir && dir !== "." && !existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+export function readJsonFile(filePath, fallback) {
+    try {
+        if (!existsSync(filePath))
+            return fallback;
+        const raw = readFileSync(filePath, "utf-8");
+        if (!raw.trim())
+            return fallback;
+        return JSON.parse(raw);
+    }
+    catch {
+        return fallback;
+    }
+}
+export function writeJsonFileAtomic(filePath, value) {
+    ensureParent(filePath);
+    const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(value, null, 2), "utf-8");
+    renameSync(tmpPath, filePath);
+}
+//# sourceMappingURL=persistentJsonStore.js.map

package/dist/lib/persistentJsonStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistentJsonStore.js","sourceRoot":"","sources":["../../src/lib/persistentJsonStore.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,kFAAkF;AAClF,uBAAuB;AACvB,8EAA8E;AAC9E,yDAAyD;AACzD,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,YAAY,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAgB;IACtD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,YAAY,CAAI,QAAgB,EAAE,QAAW;IAC3D,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,QAAgB,EAAE,KAAQ;IAC/D,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC/D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChC,CAAC"}

package/dist/lib/pharos/attestationPublisher.d.ts

@@ -0,0 +1,50 @@
+export declare const ACTION_PAYMENT: `0x${string}`;
+export declare const ACTION_SWAP: `0x${string}`;
+export declare const ACTION_BRIDGE: `0x${string}`;
+export declare const ACTION_APPROVAL: `0x${string}`;
+export declare const ACTION_CONTRACT_CALL: `0x${string}`;
+export declare const ACTION_UNKNOWN: `0x${string}`;
+type AttestationStatus = "required" | "skipped" | "published" | "confirmed" | "pending_retry" | "failed";
+export interface PendingAttestation {
+    txHash: string;
+    preparedTransactionHash: string;
+    chainId: number;
+    actionType: `0x${string}`;
+    policyHash: `0x${string}`;
+    metadataHash: `0x${string}`;
+    /** The agent/signer the verified action is attributed to (drives reputationOf). */
+    agent: `0x${string}`;
+    status: AttestationStatus;
+    attempts: number;
+    nextAttemptAt: number;
+    createdAt: number;
+    updatedAt: number;
+    attestationTxHash?: string;
+    lastError?: string;
+}
+export declare function getAttestationRecord(txHash: string): PendingAttestation | null;
+export declare function checkAttestationConfig(): void;
+export declare function classifyAction(parsedTx: any): `0x${string}`;
+export declare function publishAttestation(txHash: string, parsedTx: any, record: any): Promise<AttestationStatus>;
+export interface AgentReputation {
+    agent: string;
+    /** True when the on-chain SafeHandsAttestation address is configured. */
+    configured: boolean;
+    /** Count of SafeHands-verified safe broadcasts attributed to this address. */
+    verifiedCount: number;
+    /** Unix seconds of the most recent attestation (0 = no track record yet). */
+    lastAttestationAt: number;
+    source: "onchain" | "unconfigured";
+}
+/**
+ * Read an address's on-chain SafeHands reputation (verified-safe broadcast count +
+ * recency). Read-only, keyless, composable — any agent can consult this as a trust
+ * signal. A zero count means "no track record yet" → treat as NEUTRAL, never as a
+ * negative (the ledger only records verified-safe actions). Degrades gracefully to a
+ * neutral zero when the contract is unconfigured or the RPC read fails.
+ */
+export declare function getAgentReputation(agent: string): Promise<AgentReputation>;
+export declare function retryPendingAttestations(): Promise<number>;
+export declare function startAttestationRetryLoop(): void;
+export {};
+//# sourceMappingURL=attestationPublisher.d.ts.map

package/dist/lib/pharos/attestationPublisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestationPublisher.d.ts","sourceRoot":"","sources":["../../../src/lib/pharos/attestationPublisher.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,cAAc,eAAoC,CAAC;AAChE,eAAO,MAAM,WAAW,eAAiC,CAAC;AAC1D,eAAO,MAAM,aAAa,eAAmC,CAAC;AAC9D,eAAO,MAAM,eAAe,eAAqC,CAAC;AAClE,eAAO,MAAM,oBAAoB,eAA0C,CAAC;AAC5E,eAAO,MAAM,cAAc,eAAoC,CAAC;AAQhE,KAAK,iBAAiB,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,eAAe,GAAG,QAAQ,CAAC;AAEzG,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,mFAAmF;IACnF,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAwBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAG9E;AAED,wBAAgB,sBAAsB,SAQrC;AAWD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,KAAK,MAAM,EAAE,CAS3D;AAwHD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB/G;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,SAAS,GAAG,cAAc,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA4BhF;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAYhE;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAYhD"}

package/dist/lib/pharos/attestationPublisher.js

@@ -0,0 +1,262 @@
+import { createPublicClient, createWalletClient, http, keccak256, stringToHex, parseAbi, zeroAddress } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { pharosNetwork } from "../pharosClient.js";
+import { auditLog } from "../auditLog.js";
+import { readJsonFile, stateFile, writeJsonFileAtomic } from "../persistentJsonStore.js";
+/**
+ * Resolve the SafeHandsAttestation contract address (SAFEHANDS_ATTESTATION_ADDRESS
+ * only). The legacy SAFEHANDS_RISK_REGISTRY_ADDRESS var aliases the REGISTRY
+ * contract, not this ledger — accepting it here pointed attestation calls at the
+ * wrong contract (ABI-mismatch reverts), so the fallback was removed.
+ */
+function attestationContractAddress() {
+    return process.env.SAFEHANDS_ATTESTATION_ADDRESS;
+}
+// Action Types matching the contract
+export const ACTION_PAYMENT = keccak256(stringToHex("PAYMENT"));
+export const ACTION_SWAP = keccak256(stringToHex("SWAP"));
+export const ACTION_BRIDGE = keccak256(stringToHex("BRIDGE"));
+export const ACTION_APPROVAL = keccak256(stringToHex("APPROVAL"));
+export const ACTION_CONTRACT_CALL = keccak256(stringToHex("CONTRACT_CALL"));
+export const ACTION_UNKNOWN = keccak256(stringToHex("UNKNOWN"));
+const attestationAbi = parseAbi([
+    "function attest(bytes32 preparedTransactionHash, bytes32 txHash, uint256 chainId, bytes32 actionType, bytes32 policyHash, bytes32 metadataHash, address agent) external",
+    "function reputationOf(address agent) view returns (uint256 verifiedCount, uint64 lastAt)",
+    "function attestationCountByAgent(address agent) view returns (uint256)"
+]);
+const STORE_PATH = stateFile("attestations.json", "SAFEHANDS_ATTESTATION_STORE_PATH");
+const RETRY_ENABLED = process.env.SAFEHANDS_ATTESTATION_RETRY_ENABLED !== "false";
+const MAX_ATTEMPTS = Number(process.env.SAFEHANDS_ATTESTATION_MAX_ATTEMPTS || 5);
+const RETRY_DELAY_MS = Number(process.env.SAFEHANDS_ATTESTATION_RETRY_DELAY_MS || 60_000);
+const RETRY_INTERVAL_MS = Number(process.env.SAFEHANDS_ATTESTATION_RETRY_INTERVAL_MS || 60_000);
+let state = readJsonFile(STORE_PATH, { records: {} });
+let retryLoopStarted = false;
+function persist() {
+    writeJsonFileAtomic(STORE_PATH, state);
+}
+function upsert(record) {
+    state.records[record.txHash.toLowerCase()] = record;
+    persist();
+}
+export function getAttestationRecord(txHash) {
+    state = readJsonFile(STORE_PATH, { records: {} });
+    return state.records[txHash.toLowerCase()] ?? null;
+}
+export function checkAttestationConfig() {
+    const required = process.env.SAFEHANDS_ATTESTATION_REQUIRED === "true";
+    const address = attestationContractAddress();
+    const pk = process.env.SAFEHANDS_ATTESTER_PRIVATE_KEY;
+    if (required && (!address || !pk)) {
+        throw new Error("Attestation required but SAFEHANDS_ATTESTATION_ADDRESS or SAFEHANDS_ATTESTER_PRIVATE_KEY is missing. Aborting broadcast.");
+    }
+}
+/**
+ * True only when this process holds both an attestation contract address and an
+ * attester signing key. The zero-custody public profile has neither, so there is
+ * nothing for the retry loop to publish — arming the timer would just spin.
+ */
+function isAttesterConfigured() {
+    return Boolean(attestationContractAddress() && process.env.SAFEHANDS_ATTESTER_PRIVATE_KEY);
+}
+export function classifyAction(parsedTx) {
+    if (!parsedTx.data || parsedTx.data === "0x") {
+        return ACTION_PAYMENT;
+    }
+    const selector = parsedTx.data.slice(0, 10);
+    if (selector === "0x095ea7b3") { // approve(address,uint256)
+        return ACTION_APPROVAL;
+    }
+    return ACTION_CONTRACT_CALL;
+}
+function makePending(txHash, parsedTx, record) {
+    const actionType = classifyAction(parsedTx);
+    const policyHash = record.policyVersion ? keccak256(stringToHex(record.policyVersion)) : keccak256(stringToHex("none"));
+    const metadataHash = record.evidenceHash ? record.evidenceHash : keccak256(stringToHex("none"));
+    const agent = record.from || zeroAddress;
+    const now = Date.now();
+    return {
+        txHash,
+        preparedTransactionHash: record.hash,
+        chainId: record.chainId,
+        actionType,
+        policyHash,
+        metadataHash,
+        agent,
+        status: "pending_retry",
+        attempts: 0,
+        nextAttemptAt: now,
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+async function attemptPublish(record) {
+    const required = process.env.SAFEHANDS_ATTESTATION_REQUIRED === "true";
+    const address = attestationContractAddress();
+    const pk = process.env.SAFEHANDS_ATTESTER_PRIVATE_KEY;
+    if (!address || !pk) {
+        record.status = required ? "failed" : "skipped";
+        record.updatedAt = Date.now();
+        record.lastError = required ? "Attestation required but signer/address missing" : undefined;
+        upsert(record);
+        return record.status;
+    }
+    try {
+        record.status = "pending_retry";
+        record.attempts += 1;
+        record.updatedAt = Date.now();
+        upsert(record);
+        const formattedPk = pk.startsWith("0x") ? pk : `0x${pk}`;
+        const account = privateKeyToAccount(formattedPk);
+        const rpc = process.env.PHAROS_RPC_URL || "https://rpc.pharos.xyz";
+        const publicClient = createPublicClient({
+            chain: pharosNetwork,
+            transport: http(rpc)
+        });
+        const walletClient = createWalletClient({
+            account,
+            chain: pharosNetwork,
+            transport: http(rpc)
+        });
+        const { request } = await publicClient.simulateContract({
+            address,
+            abi: attestationAbi,
+            functionName: "attest",
+            args: [
+                record.preparedTransactionHash,
+                record.txHash,
+                BigInt(record.chainId),
+                record.actionType,
+                record.policyHash,
+                record.metadataHash,
+                record.agent
+            ],
+            account
+        });
+        const attestationTxHash = await walletClient.writeContract(request);
+        record.attestationTxHash = attestationTxHash;
+        record.status = "published";
+        record.updatedAt = Date.now();
+        upsert(record);
+        const receipt = await publicClient.waitForTransactionReceipt({ hash: attestationTxHash });
+        record.status = receipt.status === "success" ? "confirmed" : "failed";
+        record.updatedAt = Date.now();
+        if (receipt.status !== "success")
+            record.lastError = "Attestation transaction reverted";
+        upsert(record);
+        auditLog({
+            ts: new Date().toISOString(),
+            tool: "publish_attestation",
+            success: record.status === "confirmed",
+            errorCode: record.status === "confirmed" ? undefined : "ATTESTATION_TX_REVERTED",
+            txHash: record.txHash,
+            attestationTxHash,
+            attempts: record.attempts,
+            status: record.status,
+        });
+        return record.status;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        record.status = record.attempts >= MAX_ATTEMPTS ? "failed" : "pending_retry";
+        record.nextAttemptAt = Date.now() + RETRY_DELAY_MS * Math.max(1, record.attempts);
+        record.updatedAt = Date.now();
+        record.lastError = message;
+        upsert(record);
+        auditLog({
+            ts: new Date().toISOString(),
+            tool: "publish_attestation",
+            success: false,
+            errorCode: "ATTESTATION_PUBLISH_FAILED",
+            txHash: record.txHash,
+            attempts: record.attempts,
+            nextAttemptAt: record.nextAttemptAt,
+            message,
+        });
+        console.error("Attestation publish failed:", message);
+        return record.status;
+    }
+}
+export async function publishAttestation(txHash, parsedTx, record) {
+    const required = process.env.SAFEHANDS_ATTESTATION_REQUIRED === "true";
+    const address = attestationContractAddress();
+    const pk = process.env.SAFEHANDS_ATTESTER_PRIVATE_KEY;
+    if (!address || !pk) {
+        const status = required ? "failed" : "skipped";
+        if (required) {
+            const pending = makePending(txHash, parsedTx, record);
+            pending.status = "failed";
+            pending.lastError = "Attestation required but signer/address missing";
+            pending.updatedAt = Date.now();
+            upsert(pending);
+        }
+        return status;
+    }
+    const pending = makePending(txHash, parsedTx, record);
+    upsert(pending);
+    return attemptPublish(pending);
+}
+/**
+ * Read an address's on-chain SafeHands reputation (verified-safe broadcast count +
+ * recency). Read-only, keyless, composable — any agent can consult this as a trust
+ * signal. A zero count means "no track record yet" → treat as NEUTRAL, never as a
+ * negative (the ledger only records verified-safe actions). Degrades gracefully to a
+ * neutral zero when the contract is unconfigured or the RPC read fails.
+ */
+export async function getAgentReputation(agent) {
+    const address = attestationContractAddress();
+    const neutral = { agent, verifiedCount: 0, lastAttestationAt: 0 };
+    if (!/^0x[0-9a-fA-F]{40}$/.test(agent)) {
+        return { ...neutral, configured: Boolean(address), source: "unconfigured" };
+    }
+    if (!address) {
+        return { ...neutral, configured: false, source: "unconfigured" };
+    }
+    try {
+        const rpc = process.env.PHAROS_RPC_URL || "https://rpc.pharos.xyz";
+        const publicClient = createPublicClient({ chain: pharosNetwork, transport: http(rpc) });
+        const [verifiedCount, lastAt] = (await publicClient.readContract({
+            address,
+            abi: attestationAbi,
+            functionName: "reputationOf",
+            args: [agent],
+        }));
+        return {
+            agent,
+            configured: true,
+            verifiedCount: Number(verifiedCount),
+            lastAttestationAt: Number(lastAt),
+            source: "onchain",
+        };
+    }
+    catch {
+        return { ...neutral, configured: true, source: "onchain" };
+    }
+}
+export async function retryPendingAttestations() {
+    state = readJsonFile(STORE_PATH, { records: {} });
+    const now = Date.now();
+    const records = Object.values(state.records).filter((record) => record.status === "pending_retry" && record.attempts < MAX_ATTEMPTS && record.nextAttemptAt <= now);
+    let attempted = 0;
+    for (const record of records) {
+        attempted += 1;
+        await attemptPublish(record);
+    }
+    return attempted;
+}
+export function startAttestationRetryLoop() {
+    if (!RETRY_ENABLED || retryLoopStarted)
+        return;
+    // Zero-custody profile has no attester key/address: don't arm an unusable timer.
+    // If attestation is explicitly required, keep the loop so a late/misconfig gets
+    // surfaced via retryPendingAttestations → attemptPublish marking records failed.
+    if (!isAttesterConfigured() && process.env.SAFEHANDS_ATTESTATION_REQUIRED !== "true")
+        return;
+    retryLoopStarted = true;
+    setInterval(() => {
+        retryPendingAttestations().catch((err) => {
+            console.error("Attestation retry loop failed:", err instanceof Error ? err.message : String(err));
+        });
+    }, RETRY_INTERVAL_MS).unref();
+}
+startAttestationRetryLoop();
+//# sourceMappingURL=attestationPublisher.js.map

package/dist/lib/pharos/attestationPublisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestationPublisher.js","sourceRoot":"","sources":["../../../src/lib/pharos/attestationPublisher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACnH,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEzF;;;;;GAKG;AACH,SAAS,0BAA0B;IACjC,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;AACnD,CAAC;AAED,qCAAqC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AAEhE,MAAM,cAAc,GAAG,QAAQ,CAAC;IAC9B,yKAAyK;IACzK,0FAA0F;IAC1F,wEAAwE;CACzE,CAAC,CAAC;AA0BH,MAAM,UAAU,GAAG,SAAS,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,KAAK,OAAO,CAAC;AAClF,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,CAAC,CAAC;AACjF,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,MAAM,CAAC,CAAC;AAC1F,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,MAAM,CAAC,CAAC;AAEhG,IAAI,KAAK,GAAG,YAAY,CAAmB,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACxE,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,SAAS,OAAO;IACd,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,MAAM,CAAC,MAA0B;IACxC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,KAAK,GAAG,YAAY,CAAmB,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAEtD,IAAI,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0HAA0H,CAAC,CAAC;IAC9I,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB;IAC3B,OAAO,OAAO,CAAC,0BAA0B,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAa;IAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC,CAAC,2BAA2B;QAC1D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAAa,EAAE,MAAW;IAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACxH,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAE,MAAM,CAAC,YAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACnH,MAAM,KAAK,GAAI,MAAM,CAAC,IAAsB,IAAI,WAAW,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO;QACL,MAAM;QACN,uBAAuB,EAAE,MAAM,CAAC,IAAI;QACpC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU;QACV,UAAU;QACV,YAAY;QACZ,KAAK;QACL,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAA0B;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,0BAA0B,EAA+B,CAAC;IAC1E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAEtD,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAChD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,CAAC;QACf,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC;QAChC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC;QAEf,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAA4B,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,wBAAwB,CAAC;QAEnE,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,OAAO;YACP,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;QAEH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;YACtD,OAAO;YACP,GAAG,EAAE,cAAc;YACnB,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE;gBACJ,MAAM,CAAC,uBAAwC;gBAC/C,MAAM,CAAC,MAAuB;gBAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACtB,MAAM,CAAC,UAAU;gBACjB,MAAM,CAAC,UAAU;gBACjB,MAAM,CAAC,YAAY;gBACnB,MAAM,CAAC,KAAK;aACb;YACD,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC7C,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;QAC5B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC;QAEf,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,kCAAkC,CAAC;QACxF,MAAM,CAAC,MAAM,CAAC,CAAC;QAEf,QAAQ,CAAC;YACP,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW;YACtC,SAAS,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB;YAChF,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,iBAAiB;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7E,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClF,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC;QACf,QAAQ,CAAC;YACP,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,4BAA4B;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO;SACR,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,QAAa,EAAE,MAAW;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAEtD,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC1B,OAAO,CAAC,SAAS,GAAG,iDAAiD,CAAC;YACtE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,OAAO,CAAC,CAAC;IAChB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,OAAO,GAAG,0BAA0B,EAA+B,CAAC;IAC1E,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;YAC/D,OAAO;YACP,GAAG,EAAE,cAAc;YACnB,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,CAAC,KAAsB,CAAC;SAC/B,CAAC,CAA8B,CAAC;QACjC,OAAO;YACL,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;YACpC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC;YACjC,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,KAAK,GAAG,YAAY,CAAmB,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7D,MAAM,CAAC,MAAM,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,GAAG,YAAY,IAAI,MAAM,CAAC,aAAa,IAAI,GAAG,CACnG,CAAC;IACF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,SAAS,IAAI,CAAC,CAAC;QACf,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,IAAI,CAAC,aAAa,IAAI,gBAAgB;QAAE,OAAO;IAC/C,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,IAAI,CAAC,oBAAoB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM;QAAE,OAAO;IAC7F,gBAAgB,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,GAAG,EAAE;QACf,wBAAwB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,iBAAiB,CAAC,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,yBAAyB,EAAE,CAAC"}