@oracle-agent/oracle 0.1.0

package/public/oracle-console/app.js

@@ -0,0 +1,272 @@
+// Oracle Console. Public frontend, Slice I.
+//
+// Single action UI: connect a wallet, then preview a proposed permission set.
+// This file never installs a grant or session key and never claims on-chain
+// enforcement. It never stores, logs, or transmits a private key, session
+// secret, bearer token, or signer URL.
+//
+// Talks to two BFF routes only:
+//   POST /public/connect/assemble  -> assembleUnsignedGrant(body)
+//   POST /public/grants/active     -> listActiveGrants(body.store, body.opts)
+
+(function () {
+  "use strict";
+
+  const CONNECT_ASSEMBLE_URL = "/public/connect/assemble";
+  const GRANTS_ACTIVE_URL = "/public/grants/active";
+
+  // Demo policy for the connected agent. Read only scopes, bounded caps,
+  // one hour expiry. Nothing here is authorization.
+  const DEMO_AGENT_ADDRESS = "0x1111111111111111111111111111111111111111";
+  const DEMO_CHAIN_ID = 8453;
+  const DEMO_ACTIONS = ["read:balance", "read:positions"];
+  const DEMO_TARGETS = [];
+  const DEMO_MAX_VALUE_WEI = "0";
+  const DEMO_MAX_GAS_WEI = "0";
+  const DEMO_MAX_SLIPPAGE_BPS = 0;
+  const DEMO_TTL_SECONDS = 3600;
+
+  const connectBtn = document.getElementById("connect-btn");
+  const walletState = document.getElementById("wallet-state");
+  const revokeBtn = document.getElementById("revoke-btn");
+  const permissionPanel = document.getElementById("permission-panel");
+  const panelStatus = document.getElementById("panel-status");
+
+  const stepConnect = document.getElementById("step-connect");
+  const stepBound = document.getElementById("step-bound");
+  const stepEnforced = document.getElementById("step-enforced");
+
+  const permChain = document.getElementById("perm-chain");
+  const permActions = document.getElementById("perm-actions");
+  const permTargets = document.getElementById("perm-targets");
+  const permMaxValue = document.getElementById("perm-max-value");
+  const permExpiry = document.getElementById("perm-expiry");
+
+  // In-memory session state only. Never persisted, never logged.
+  let session = {
+    accountAddress: null,
+    grant: null,
+    grantId: null,
+  };
+
+  function setStep(stepEl, state) {
+    stepEl.setAttribute("data-state", state);
+  }
+
+  function resetSteps() {
+    setStep(stepConnect, "pending");
+    setStep(stepBound, "pending");
+    setStep(stepEnforced, "pending");
+  }
+
+  function hasInjectedWallet() {
+    return typeof window !== "undefined" && typeof window.ethereum !== "undefined";
+  }
+
+  async function postJson(url, body) {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    const data = await res.json().catch(() => null);
+    if (!res.ok) {
+      const message = (data && data.error) || `request to ${url} failed with status ${res.status}`;
+      throw new Error(message);
+    }
+    return data;
+  }
+
+  function nowUnixSeconds() {
+    return Math.floor(Date.now() / 1000);
+  }
+
+  function formatExpiry(unixSeconds) {
+    return new Date(unixSeconds * 1000).toISOString();
+  }
+
+  function renderPermissionPanel(grant) {
+    permChain.textContent = String(grant.chainId);
+    permActions.textContent = grant.actions.join(", ");
+    permTargets.textContent = grant.targets.length ? grant.targets.join(", ") : "none, read and simulate only";
+    permMaxValue.textContent = `${grant.maxValueWei} wei`;
+    permExpiry.textContent = formatExpiry(grant.expiresAt);
+    permissionPanel.hidden = false;
+    revokeBtn.disabled = false;
+    panelStatus.textContent = "";
+  }
+
+  async function requestAccount() {
+    const accounts = await window.ethereum.request({ method: "eth_requestAccounts" });
+    if (!accounts || !accounts[0]) {
+      throw new Error("no account returned by wallet");
+    }
+    return accounts[0];
+  }
+
+  async function connectFlow() {
+    if (!hasInjectedWallet()) {
+      walletState.textContent = "Connect a wallet to continue.";
+      return;
+    }
+
+    connectBtn.disabled = true;
+    resetSteps();
+    permissionPanel.hidden = true;
+
+    try {
+      walletState.textContent = "Requesting account.";
+      const accountAddress = await requestAccount();
+      session.accountAddress = accountAddress;
+      setStep(stepConnect, "done");
+      walletState.textContent = `Connected as ${accountAddress}.`;
+
+      setStep(stepBound, "active");
+      const assembled = await postJson(CONNECT_ASSEMBLE_URL, {
+        chainId: DEMO_CHAIN_ID,
+        agentAddress: DEMO_AGENT_ADDRESS,
+        accountAddress: accountAddress,
+        actions: DEMO_ACTIONS,
+        targets: DEMO_TARGETS,
+        maxValueWei: DEMO_MAX_VALUE_WEI,
+        maxGasWei: DEMO_MAX_GAS_WEI,
+        maxSlippageBps: DEMO_MAX_SLIPPAGE_BPS,
+        ttlSeconds: DEMO_TTL_SECONDS,
+        nonce: `console.${nowUnixSeconds()}`,
+        revocationKey: `revoke.console.${nowUnixSeconds()}`,
+      });
+
+      const grant = assembled.payload.grant;
+      const grantId = assembled.payload.grantId;
+      session.grant = grant;
+      session.grantId = grantId;
+      setStep(stepBound, "done");
+      walletState.textContent = "Permission set reviewed. Building local preview.";
+
+      setStep(stepEnforced, "active");
+      await refreshActiveGrants();
+      setStep(stepEnforced, "done");
+      walletState.textContent = "Permission preview ready. No session was installed.";
+    } catch (err) {
+      walletState.textContent = `Connect failed: ${err.message}`;
+    } finally {
+      connectBtn.disabled = false;
+    }
+  }
+
+  async function refreshActiveGrants() {
+    if (!session.grant || !session.accountAddress) return;
+
+    const store = [
+      {
+        grant: session.grant,
+        revoked: false,
+      },
+    ];
+
+    const result = await postJson(GRANTS_ACTIVE_URL, {
+      store: store,
+      opts: {
+        now: nowUnixSeconds(),
+        accountAddress: session.accountAddress,
+        agentAddress: DEMO_AGENT_ADDRESS,
+        chainId: DEMO_CHAIN_ID,
+      },
+    });
+
+    const active = Array.isArray(result) ? result : result.active || [];
+    const match = active.find((entry) => entry.id === session.grantId);
+
+    if (match) {
+      renderPermissionPanel(match.grant);
+    } else {
+      permissionPanel.hidden = false;
+      revokeBtn.disabled = true;
+      panelStatus.textContent = "This permission preview is no longer active.";
+    }
+  }
+
+  function clearPreviewFlow() {
+    if (!session.grant) return;
+    revokeBtn.disabled = true;
+    session.grant = null;
+    session.grantId = null;
+    permissionPanel.hidden = true;
+    resetSteps();
+    setStep(stepConnect, "done");
+    walletState.textContent = "Permission preview cleared. No on-chain revocation was required.";
+  }
+
+  connectBtn.addEventListener("click", () => {
+    connectFlow();
+  });
+
+  revokeBtn.addEventListener("click", () => {
+    clearPreviewFlow();
+  });
+
+  // ── Bitcoin multi-wallet lane (actual BTC L1) ───────────────────────────
+  const btcConnectBtn = document.getElementById("btc-connect-btn");
+  const btcWalletState = document.getElementById("btc-wallet-state");
+  const btcPanel = document.getElementById("btc-panel");
+  const btcWalletLabel = document.getElementById("btc-wallet-label");
+  const btcAddressEl = document.getElementById("btc-address");
+  const btcDetectedEl = document.getElementById("btc-detected");
+  const btcPanelStatus = document.getElementById("btc-panel-status");
+
+  let btcSession = null;
+
+  function refreshBtcDetected() {
+    const api = window.OracleBitcoinWallets;
+    if (!api) {
+      if (btcDetectedEl) btcDetectedEl.textContent = "wallet adapter missing";
+      return [];
+    }
+    const detected = api.listDetected();
+    if (btcDetectedEl) {
+      btcDetectedEl.textContent = detected.length
+        ? detected.map((d) => d.label).join(", ")
+        : "none - install Xverse / UniSat / Leather / OKX / Phantom / Magic Eden";
+    }
+    return detected;
+  }
+
+  async function btcConnectFlow() {
+    const api = window.OracleBitcoinWallets;
+    if (!api) {
+      btcWalletState.textContent = "Bitcoin wallet adapter failed to load.";
+      return;
+    }
+    btcConnectBtn.disabled = true;
+    btcWalletState.textContent = "Requesting Bitcoin wallet.";
+    try {
+      btcSession = await api.connect();
+      btcWalletState.textContent = `BTC connected: ${btcSession.walletLabel}`;
+      btcWalletLabel.textContent = btcSession.walletLabel;
+      btcAddressEl.textContent = btcSession.address;
+      btcPanel.hidden = false;
+      btcPanelStatus.textContent =
+        "Connected. Signing stays in your wallet (signPsbt). Oracle only reads + broadcasts user-signed hex.";
+      refreshBtcDetected();
+    } catch (err) {
+      btcWalletState.textContent = `BTC connect failed: ${err.message}`;
+      btcPanelStatus.textContent = err.message;
+    } finally {
+      btcConnectBtn.disabled = false;
+    }
+  }
+
+  if (btcConnectBtn) {
+    btcConnectBtn.addEventListener("click", () => {
+      btcConnectFlow();
+    });
+    refreshBtcDetected();
+    if (!refreshBtcDetected().length) {
+      btcWalletState.textContent = "No Bitcoin wallet detected yet.";
+    }
+  }
+
+  if (!hasInjectedWallet()) {
+    walletState.textContent = "Connect an EVM wallet to continue.";
+  }
+})();

package/public/oracle-console/bitcoin-wallets.js

@@ -0,0 +1,206 @@
+// Multi-wallet Bitcoin connector for Oracle Console.
+// Injected providers only - no npm wallet SDK required in the static console.
+// Supported: Xverse, UniSat, Leather, OKX, Phantom, Magic Eden, generic.
+// Signing: PSBT stays in the wallet. Oracle never sees private keys.
+
+(function (root) {
+  "use strict";
+
+  const WALLETS = [
+    {
+      id: "unisat",
+      label: "UniSat",
+      detect: () => window.unisat,
+      async connect(provider) {
+        const accounts = await provider.requestAccounts();
+        const address = accounts && accounts[0];
+        if (!address) throw new Error("UniSat returned no address");
+        const network = (await provider.getNetwork?.()) || "livenet";
+        return { address, network, provider };
+      },
+      async signPsbt(provider, psbtHex, options = {}) {
+        return provider.signPsbt(psbtHex, options);
+      },
+      async pushPsbt(provider, psbtHex) {
+        if (typeof provider.pushPsbt === "function") return provider.pushPsbt(psbtHex);
+        throw new Error("UniSat pushPsbt unavailable - use Oracle broadcast with raw hex");
+      },
+    },
+    {
+      id: "okx",
+      label: "OKX",
+      detect: () => window.okxwallet && window.okxwallet.bitcoin,
+      async connect(provider) {
+        const result = await provider.connect();
+        const address = result?.address || result?.addresses?.[0] || (Array.isArray(result) && result[0]);
+        if (!address) throw new Error("OKX returned no address");
+        return { address, network: result?.network || "livenet", provider };
+      },
+      async signPsbt(provider, psbtHex, options = {}) {
+        return provider.signPsbt(psbtHex, options);
+      },
+      async pushPsbt(provider, psbtHex) {
+        if (typeof provider.pushPsbt === "function") return provider.pushPsbt(psbtHex);
+        throw new Error("OKX pushPsbt unavailable - use Oracle broadcast with raw hex");
+      },
+    },
+    {
+      id: "xverse",
+      label: "Xverse",
+      detect: () =>
+        window.XverseProviders?.BitcoinProvider ||
+        window.BitcoinProvider ||
+        (window.xverse && window.xverse.bitcoin),
+      async connect(provider) {
+        // Sats Connect request shape when provider.request exists
+        if (typeof provider.request === "function") {
+          const res = await provider.request("getAccounts", {
+            purposes: ["payment", "ordinals"],
+            message: "Connect to Oracle",
+          });
+          const arr = res?.result || res;
+          const payment = Array.isArray(arr) ? arr.find((a) => a.purpose === "payment") || arr[0] : null;
+          const address = payment?.address || payment;
+          if (!address) throw new Error("Xverse returned no address");
+          return { address, network: payment?.network || "Mainnet", provider };
+        }
+        if (typeof provider.connect === "function") {
+          const res = await provider.connect("Oracle");
+          const address = res?.addresses?.payment?.address || res?.paymentAddress || res?.address;
+          if (!address) throw new Error("Xverse returned no address");
+          return { address, network: res?.network || "Mainnet", provider };
+        }
+        throw new Error("Xverse provider has no connect/request method");
+      },
+      async signPsbt(provider, psbtBase64, options = {}) {
+        if (typeof provider.request === "function") {
+          const res = await provider.request("signPsbt", {
+            psbt: psbtBase64,
+            allowedSignHash: options.allowedSignHash,
+            signInputs: options.signInputs,
+            broadcast: false,
+          });
+          return res?.result?.psbt || res?.psbt || res;
+        }
+        if (typeof provider.signPsbt === "function") {
+          return provider.signPsbt(psbtBase64, options);
+        }
+        throw new Error("Xverse signPsbt unavailable");
+      },
+      async pushPsbt() {
+        throw new Error("Xverse: finalize in wallet or broadcast raw hex via Oracle");
+      },
+    },
+    {
+      id: "leather",
+      label: "Leather",
+      detect: () => window.LeatherProvider || window.HiroWalletProvider || window.btc,
+      async connect(provider) {
+        if (typeof provider.request === "function") {
+          const res = await provider.request("getAddresses");
+          const addrs = res?.result?.addresses || res?.addresses || [];
+          const payment = addrs.find((a) => a.type === "p2wpkh" || a.symbol === "BTC") || addrs[0];
+          const address = payment?.address;
+          if (!address) throw new Error("Leather returned no address");
+          return { address, network: payment?.network || "mainnet", provider };
+        }
+        throw new Error("Leather provider has no request method");
+      },
+      async signPsbt(provider, psbtBase64, options = {}) {
+        const res = await provider.request("signPsbt", {
+          hex: options.hex || undefined,
+          base64: psbtBase64,
+          broadcast: false,
+          ...options,
+        });
+        return res?.result?.hex || res?.result?.base64 || res?.hex || res;
+      },
+      async pushPsbt() {
+        throw new Error("Leather: broadcast raw hex via Oracle");
+      },
+    },
+    {
+      id: "phantom",
+      label: "Phantom",
+      detect: () => window.phantom && window.phantom.bitcoin,
+      async connect(provider) {
+        const res = await provider.requestAccounts();
+        const address = res?.[0]?.address || res?.[0];
+        if (!address) throw new Error("Phantom returned no BTC address");
+        return { address, network: "mainnet", provider };
+      },
+      async signPsbt(provider, psbtHex, options = {}) {
+        const res = await provider.signPSBT(Buffer.from(psbtHex, "hex"), options);
+        return res;
+      },
+      async pushPsbt() {
+        throw new Error("Phantom: broadcast raw hex via Oracle");
+      },
+    },
+    {
+      id: "magic-eden",
+      label: "Magic Eden",
+      detect: () => window.magicEden && window.magicEden.bitcoin,
+      async connect(provider) {
+        const res = await provider.connect();
+        const address = res?.address || res?.ordinals?.address || res?.payment?.address;
+        if (!address) throw new Error("Magic Eden returned no address");
+        return { address, network: "mainnet", provider };
+      },
+      async signPsbt(provider, psbt, options = {}) {
+        return provider.signPsbt(psbt, options);
+      },
+      async pushPsbt() {
+        throw new Error("Magic Eden: broadcast raw hex via Oracle");
+      },
+    },
+  ];
+
+  function listDetected() {
+    return WALLETS.filter((w) => {
+      try {
+        return !!w.detect();
+      } catch {
+        return false;
+      }
+    }).map((w) => ({ id: w.id, label: w.label }));
+  }
+
+  async function connect(preferredId) {
+    const detected = WALLETS.filter((w) => {
+      try {
+        return !!w.detect();
+      } catch {
+        return false;
+      }
+    });
+    if (!detected.length) {
+      throw new Error(
+        "No Bitcoin wallet detected. Install Xverse, UniSat, Leather, OKX, Phantom, or Magic Eden."
+      );
+    }
+    const wallet = (preferredId && detected.find((w) => w.id === preferredId)) || detected[0];
+    const provider = wallet.detect();
+    const session = await wallet.connect(provider);
+    return {
+      walletId: wallet.id,
+      walletLabel: wallet.label,
+      address: session.address,
+      network: session.network,
+      provider: session.provider,
+      wallet,
+    };
+  }
+
+  async function signPsbt(session, psbt, options = {}) {
+    if (!session?.wallet || !session?.provider) throw new Error("Bitcoin wallet not connected");
+    return session.wallet.signPsbt(session.provider, psbt, options);
+  }
+
+  root.OracleBitcoinWallets = {
+    listDetected,
+    connect,
+    signPsbt,
+    supported: WALLETS.map((w) => ({ id: w.id, label: w.label })),
+  };
+})(typeof window !== "undefined" ? window : globalThis);

package/public/oracle-console/index.html

@@ -0,0 +1,91 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Oracle Console</title>
+<link rel="stylesheet" href="styles.css" />
+</head>
+<body>
+  <main class="page">
+    <header class="hero">
+      <p class="hero-line">Preview agent permissions before you install a real wallet-enforced session.</p>
+      <p class="hero-sub">
+        Full crypto pack: multichain reads, quotes, simulation, and unsigned
+        transaction prep across 11 EVM chains plus Solana and Bitcoin L1 lanes.
+        Protocol builder included &mdash; design and prepare a deploy, sign it yourself.
+      </p>
+      <p class="hero-posture">
+        Every lane starts <strong>DISARMED</strong>. This console previews policy only and does not authorize an agent.
+      </p>
+    </header>
+
+    <section class="cta-row">
+      <button id="connect-btn" class="cta" type="button">Preview agent permissions</button>
+      <button id="btc-connect-btn" class="cta cta-secondary" type="button">Connect Bitcoin wallet</button>
+      <p id="wallet-state" class="wallet-state" aria-live="polite"></p>
+      <p id="btc-wallet-state" class="wallet-state" aria-live="polite"></p>
+    </section>
+
+    <section id="btc-panel" class="permission-panel btc-panel" hidden>
+      <h2 class="panel-title">Bitcoin lane</h2>
+      <p class="panel-note">Actual BTC L1 + ordinals/runes via Satflow. Sign in wallet (Xverse / UniSat / Leather / OKX / Phantom). Magic Eden BTC marketplace is dead. Oracle never holds keys.</p>
+      <dl class="panel-grid">
+        <dt>Wallet</dt>
+        <dd id="btc-wallet-label">.</dd>
+        <dt>Address</dt>
+        <dd id="btc-address">.</dd>
+        <dt>Detected</dt>
+        <dd id="btc-detected">.</dd>
+      </dl>
+      <p id="btc-panel-status" class="panel-status" aria-live="polite"></p>
+    </section>
+
+    <section class="sequence" aria-label="connection sequence">
+      <div class="seq-step" id="step-connect" data-state="pending">
+        <span class="seq-index">1</span>
+        <span class="seq-label">Connect</span>
+      </div>
+      <div class="seq-arrow">-&gt;</div>
+      <div class="seq-step" id="step-bound" data-state="pending">
+        <span class="seq-index">2</span>
+        <span class="seq-label">Review</span>
+      </div>
+      <div class="seq-arrow">-&gt;</div>
+      <div class="seq-step" id="step-enforced" data-state="pending">
+        <span class="seq-index">3</span>
+        <span class="seq-label">Preview</span>
+      </div>
+    </section>
+
+    <section id="permission-panel" class="permission-panel" hidden>
+      <h2 class="panel-title">What this agent can do</h2>
+      <dl class="panel-grid">
+        <dt>Chain</dt>
+        <dd id="perm-chain">.</dd>
+
+        <dt>Actions</dt>
+        <dd id="perm-actions">.</dd>
+
+        <dt>Targets</dt>
+        <dd id="perm-targets">.</dd>
+
+        <dt>Max value</dt>
+        <dd id="perm-max-value">.</dd>
+
+        <dt>Expiry</dt>
+        <dd id="perm-expiry">.</dd>
+      </dl>
+      <button id="revoke-btn" class="revoke" type="button">Clear preview</button>
+      <p id="panel-status" class="panel-status" aria-live="polite"></p>
+    </section>
+
+    <footer class="custody-line">
+      <p>You keep custody. A preview is not an installed grant, session key, or revocation.</p>
+    </footer>
+  </main>
+
+  <script src="bitcoin-wallets.js"></script>
+  <script src="app.js"></script>
+</body>
+</html>