feat: read-file + concat value resolvers and safe-exec-transaction std template

[Agusx1211]

Summary

Adds two value resolvers and one std template, closing gaps hit while building a "Shape 1" Safe relay in 0xsequence/live-contracts — a catapult job that broadcasts a fully-signed Gnosis Safe execTransaction on-chain, rather than emitting calldata for a human to paste into the Safe UI.

1. read-file value resolver — reads a file's raw contents as a value (utf8 | hex | json), resolved relative to the job/template directory. The intended home for large, opaque, per-execution operational blobs (e.g. packed multisig signatures) that don't belong in constants and aren't typed build artifacts. Gitignorable.

2. concat value resolver — explicit string join for URL/path templating. Preferred over implicit whole-string interpolation: today a {{ref}} is only resolved when it is the entire value (value.match(/^{{(.*)}}$/)), so embedding a reference inside a longer URL was sent literally and 404'd us.

3. safe-exec-transaction std template — assembles execTransaction(...) via abi-encode and broadcasts it via send-transaction. Takes a single resolved signatures argument; the caller chooses the source with read-file (offline/air-gapped) or json-request + read-json against a concat-built Safe Transaction Service URL (hosted flow). No post-execution skip condition — the desired state is the inner call's effect, which the caller gates with job-level skip_if.

Rejected: a generic "blob registry"

We considered a free-form "blob of data" store (a free-form build-info) and rejected it: build-info earns its keep by being typed/validated and referenced semantically via Contract(name); a free-form analog is just "constants, but a second bag" with no added safety. The blob problem is better served by the smallest primitive that lets a blob live in its own file — read-file.

Security (read-file)

• No absolute paths — rejected outright.
• Confined to the project root — resolved against the job dir, then checked with path.relative(projectRoot, resolved); anything starting with .. or absolute (escaping the root) is refused, so ../../secrets can't climb out.
• No secret auto-discovery — only the exact named file is read; no scanning/globbing of .env/keystores. The deployer key continues to arrive via env/CLI, never through this path.

Design note

Full write-up of the options, the rejection rationale, the API, security, and the before/after live-contracts YAML: notes/read-file-and-concat-value-resolvers.md.

Test & build status

• New tests: 218/218 pass — read-file (11) + concat (6) in resolver.spec.ts, and safe-exec-transaction.spec.ts (2, parses the shipped YAML and asserts the broadcast tx carries execTransaction calldata matching an independent ethers encoding).
• Build clean (pnpm build); lint 0 errors (only pre-existing repo-wide no-explicit-any warnings).
• Full suite: 700 pass. The ~4 engine.spec.ts failures (send-signed-transaction, test-nicks-method) are pre-existing and environmental — they fail identically on clean master; those tests broadcast/mine and the local node is a Polygon fork, not a clean instant-mining anvil. Unrelated to this change.

Final YAML shapes

# read-file
signatures:
  type: "read-file"
  arguments: { path: "signatures.hex", encoding: "hex" }

# concat
url:
  type: "concat"
  arguments:
    values: [ "{{txServiceUrl}}", "/v1/multisig-transactions/", "{{safeTxHash}}", "/" ]

# safe-exec-transaction (offline signatures)
- name: "relay"
  template: "safe-exec-transaction"
  arguments:
    safe: "{{safe_address}}"
    to: "{{target}}"
    data: "{{inner_calldata}}"
    operation: "0"
    signatures: { type: "read-file", arguments: { path: "signatures.hex", encoding: "hex" } }

🤖 Generated with Claude Code