Weave Witness

Required keys.

Add these in your Lovable project under Settings → Secrets before pasting the prompt below. LOVABLE_API_KEY is provisioned automatically.

Paste into a fresh Lovable project. Make sure all five secrets above are set first. read the build strategy →

Build "Weave Witness" in ONE Lovable message. Single-page demo.

CONCEPT
Mint NFTs to certify handcrafted fabric authenticity and artisan identity.
Discipline: Fashion & Textile Design (handloom textiles).
Onchain primitive: NFT provenance mint. Why this primitive: NFTs serve as tamper-proof certificates linking artisans to their handwoven products.

5-CREDIT BUDGET (HARD LIMIT):
- ONE single-page app. No router, no Lovable Cloud, no database, no auth flows beyond Privy drop-in.
- ONE Solidity contract, <=80 lines, deployed to Tempo Moderato (chainId 42431), verified via Sourcify at contracts.tempo.xyz.
- Privy is always the auth + sponsored-tx layer (Google login, embedded wallet on Tempo Moderato).
- Pinata/IPFS only if the idea genuinely needs to store a file or metadata.
- At most ONE AI call per user action, routed through Lovable AI Gateway using LOVABLE_API_KEY from a server function (never the browser).
- Skip tests, skip CI, skip docs pages. Ship the demo, nothing else.

STACK
- React + Vite single page (the index route).
- Privy embedded wallet wraps `<App />` in src/main.tsx. CRITICAL: Privy MUST know about
  Tempo Moderato via BOTH `defaultChain` AND `supportedChains`, otherwise `sendTransaction`
  hangs forever on "logging on chain..." because Privy tries to switch to an unknown chain.
  Define the chain once with viem's `defineChain` and pass the same object to both fields:
    import { defineChain } from 'viem';
    const tempoModerato = defineChain({
      id: 42431, name: 'Tempo Moderato',
      nativeCurrency: { name: 'AlphaUSD', symbol: 'USD', decimals: 6 },  // AlphaUSD IS the gas token
      rpcUrls: { default: { http: [import.meta.env.VITE_TEMPO_RPC_URL] } },
      blockExplorers: { default: { name: 'Tempo Explorer', url: 'https://explore.testnet.tempo.xyz' } },
    });
    <PrivyProvider appId={import.meta.env.VITE_PRIVY_APP_ID}
      config={{ loginMethods:['google'],
                 embeddedWallets:{ ethereum:{ createOnLogin:'users-without-wallets' } },
                 defaultChain: tempoModerato,
                 supportedChains: [tempoModerato] }}>
- PRIVY DASHBOARD CONFIG (one-time, done at https://dashboard.privy.io for the app id above):
  1. Chains -> add Tempo Testnet (chainId 42431) as a supported + sponsored chain.
  2. Wallets -> Embedded wallets -> **Allow transactions from the client = ON**. Without
     this toggle, `sendTransaction` from the browser is refused by Privy even after the
     chain is configured.
  3. Gas policy -> "App pays" with a non-zero budget so users never touch AlphaUSD.
- All txs via Privy `useSendTransaction`. Wrap the call in a 45s `Promise.race` timeout so
  a misconfigured dashboard fails fast with a clear message instead of hanging:
    const tx = await Promise.race([
      sendTransaction({ to, data, chainId: 42431 }),
      new Promise((_, r) => setTimeout(() => r(new Error(
        "Timed out after 45s. Check that 'Allow transactions from the client' is enabled " +
        "for Tempo Testnet in the Privy dashboard, and that an 'App pays' gas policy is active."
      )), 45000)),
    ]);
- src/lib/pinata.ts uploads via `fetch('https://api.pinata.cloud/pinning/pinFileToIPFS', { method:'POST', headers:{ Authorization: `Bearer ${import.meta.env.VITE_PINATA_JWT}` }, body: fd })`.
- Hardhat in /contracts (kept outside the Vite bundle). Install
  `@nomicfoundation/hardhat-toolbox` AND `@nomicfoundation/hardhat-verify@latest`.
- hardhat.config.cjs MUST wire the Tempo network + Sourcify verifier (Tempo verifies via Sourcify, NOT Etherscan):
    require("@nomicfoundation/hardhat-toolbox");
    require("@nomicfoundation/hardhat-verify");
    module.exports = {
      solidity: { version: "0.8.24", settings: { optimizer: { enabled: true, runs: 200 } } },
      networks: { tempo: {
        url: process.env.TEMPO_RPC_URL || "https://rpc.moderato.tempo.xyz",
        accounts: [process.env.METAMASK_PRIVATE_KEY.startsWith("0x")
          ? process.env.METAMASK_PRIVATE_KEY : "0x" + process.env.METAMASK_PRIVATE_KEY],
        chainId: 42431,
      } },
      sourcify: {                                                  // Tempo verifier — no API key
        enabled: true,
        apiUrl: "https://contracts.tempo.xyz",
        browserUrl: "https://explore.testnet.tempo.xyz",
      },
      etherscan: { enabled: false },                              // silence Etherscan prompts
    };
- Deploy: `npx hardhat run scripts/deploy.cjs --network tempo`.
- Verify (run RIGHT AFTER deploy, no constructor args for these contracts):
  `npx hardhat verify --network tempo <address>`
  Sourcify returns "exact_match" and the source becomes readable at
  `https://explore.testnet.tempo.xyz/address/<address>`.
- ALT verify (no hardhat) — POST the solc metadata + sources directly to Sourcify v2:
  `POST https://contracts.tempo.xyz/v2/verify/metadata/42431/<address>`
  body: `{ "metadata": <solc metadata json>, "sources": { "<path>.sol": { "content": "..." } }, "creationTransactionHash": "0x..." }`
  Then poll `GET https://contracts.tempo.xyz/v2/verify/<verificationId>` until `status: "success"`.
  This is the fallback when hardhat verify is unavailable (edge runtime, minimal repo). Confirmed working Nov 2026 with solc 0.8.24.
- Frontend reads: reuse the same `tempoModerato` chain object with a viem public client —
    import { createPublicClient, http } from 'viem';
    export const publicClient = createPublicClient({ chain: tempoModerato, transport: http() });
- Write the deployed address to `src/data/contract.json` so the UI links to
  `https://explore.testnet.tempo.xyz/address/<address>`.

AI (only if this idea uses AI)
- Put AI calls behind a server function. Read process.env.LOVABLE_API_KEY inside the handler.
- Use the AI SDK with @ai-sdk/openai-compatible pointed at https://ai.gateway.lovable.dev/v1,
  header `Lovable-API-Key: ${LOVABLE_API_KEY}`. Default model: google/gemini-3-flash-preview.
- Never expose LOVABLE_API_KEY to the browser.

CONTRACT (contracts/WeaveWitness.sol):
```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
/// @title WeaveWitness
/// @notice ERC-721 provenance for: Mint NFTs to certify handcrafted fabric authenticity and artisan identity.
/// @notice Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14
contract WeaveWitness is ERC721 {
    uint256 public nextId;
    mapping(uint256 => string) public cidOf;
    constructor() ERC721("WeaveWitness", "WEAVEW") {}
    /// @notice Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14
    function mint(string calldata cid) external returns (uint256 id) {
        id = ++nextId; cidOf[id] = cid; _safeMint(msg.sender, id);
    }
    function tokenURI(uint256 id) public view override returns (string memory) {
        return string(abi.encodePacked("ipfs://", cidOf[id]));
    }
}
```

USER FLOW
1. Land on page -> 'Sign in with Google' (Privy) -> embedded wallet auto-provisioned on Tempo Moderato.
2. After the user creates a handloom textiles artefact, pin the file to IPFS via Pinata, then call `mint(cid)` on the deployed contract through Privy's sponsored transaction. Show tokenId, IPFS preview (`https://gateway.pinata.cloud/ipfs/<cid>`), and the Tempo Explorer mint-tx link.
3. Footer renders: "Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14"

REQUIRED SECRETS (Lovable -> Project Settings -> Secrets):
- LOVABLE_API_KEY        Auto-provisioned by Lovable. Powers the Lovable AI Gateway (chat, image, embeddings). Never expose to the browser; call from a server function.
- METAMASK_PRIVATE_KEY   Tempo Moderato deployer key exported from MetaMask. Fund it with test AlphaUSD at https://tempofaucet.lovable.app/ (paste the address, it drips ~$5 of AlphaUSD on Moderato — AlphaUSD IS the gas token, there is no separate ETH).
- TEMPO_RPC_URL          Tempo Moderato HTTPS endpoint. Use https://rpc.moderato.tempo.xyz (chainId 42431). Also expose it to the client as VITE_TEMPO_RPC_URL.
- PRIVY_APP_ID           Google sign-in + sponsored tx. Docs: https://docs.privy.io/llms-full.txt
- PINATA_JWT             IPFS uploads (only if app pins media). Docs: https://docs.pinata.cloud/llms-full.txt

CREDIT (must appear in UI footer AND as NatSpec on every deployed contract):
Built during the Creative AI & Quantum Hackathon organised by StreetKode Fam during Indian Krump Festival 14

Market sizing.

Indicative figures for hackathon pitches — refine with your own research before raising.