@oracle-agent/oracle 0.10.0 → 0.12.0

package/scripts/e2e-hl-perps.mjs

@@ -1,48 +0,0 @@
-import { data as desk } from "../src/data/desk-data.mjs";
-
-const info = await desk.call("hl-perps", "assetInfo", { coin: "BTC" });
-console.log(`BTC assetId=${info.assetId} szDecimals=${info.szDecimals} maxLev=${info.maxLeverage}x mark=$${info.markPx}`);
-
-// 1. LIMIT BUY
-const lim = await desk.call("hl-perps", "prepareOrder", {
-  coin: "BTC", side: "buy", type: "limit", price: "60000.123456789", size: "0.0123456", tif: "Gtc",
-});
-console.log(`\nLIMIT BUY  px=${lim.price} sz=${lim.size} notional=$${lim.notionalUsd?.toFixed(2)} tif=${JSON.stringify(lim.action.orders[0].t)}`);
-console.log(`  signingReady=${lim.signingReady} broadcastReady=${lim.broadcastReady} requiresUserSig=${lim.requiresUserSignature}`);
-
-// 2. MARKET BUY with slippage cap
-const mkt = await desk.call("hl-perps", "prepareOrder", {
-  coin: "ETH", side: "buy", type: "market", size: "0.5", maxSlippageBps: 50,
-});
-console.log(`\nMARKET BUY ETH  aggressive px=${mkt.price} sz=${mkt.size} tif=${mkt.action.orders[0].t.limit.tif}`);
-
-// 3. slippage cap enforced
-try {
-  await desk.call("hl-perps", "prepareOrder", { coin: "ETH", side: "buy", type: "market", size: "1", maxSlippageBps: 500 });
-  console.log("  !! 500bps ACCEPTED — cap broken");
-} catch (e) { console.log(`  500bps rejected: ${e.message.slice(0, 60)}`); }
-
-// 4. LEVERAGE
-const lev = await desk.call("hl-perps", "prepareLeverage", { coin: "BTC", leverage: 25, marginMode: "isolated" });
-console.log(`\nLEVERAGE  ${lev.leverage}x ${lev.marginMode}  isCross=${lev.action.isCross}`);
-console.log(`  warning: ${lev.liquidationWarning}`);
-
-try {
-  await desk.call("hl-perps", "prepareLeverage", { coin: "BTC", leverage: 999 });
-  console.log("  !! 999x ACCEPTED — cap broken");
-} catch (e) { console.log(`  999x rejected: ${e.message.slice(0, 70)}`); }
-
-// 5. BRACKET: entry + TP + SL
-const br = await desk.call("hl-perps", "prepareBracket", {
-  coin: "BTC", side: "buy", type: "limit", price: "60000", size: "0.01",
-  takeProfitPx: "72000", stopLossPx: "57000",
-});
-console.log(`\nBRACKET  legs=${br.legs} entry=${br.entry.price} tp=${br.takeProfitPx} sl=${br.stopLossPx} grouping=${br.action.grouping}`);
-console.log(`  tp reduceOnly=${br.action.orders[1].r} trigger=${JSON.stringify(br.action.orders[1].t.trigger)}`);
-console.log(`  sl reduceOnly=${br.action.orders[2].r} trigger=${JSON.stringify(br.action.orders[2].t.trigger)}`);
-
-// 6. CANCEL
-const c = await desk.call("hl-perps", "prepareCancel", { coin: "BTC", orderId: 12345 });
-console.log(`\nCANCEL  oid=${c.orderId} action=${JSON.stringify(c.action)}`);
-
-console.log("\nNo submit function exists in hl-perps — every result is user-signed.");

package/scripts/e2e-hypercore-staking.mjs

@@ -1,128 +0,0 @@
-import { data as desk } from "../src/data/desk-data.mjs";
-import {
-  hlPrepareStakeDeposit,
-  hlPrepareStakeWithdraw,
-  hlPrepareDelegate,
-  hypeToWei,
-  weiToHype,
-} from "../src/data/providers/hl-staking.mjs";
-
-const USER = process.env.ORACLE_E2E_EVM_ADDRESS || "0x0000000000000000000000000000000000000001";
-const results = [];
-function log(lane, status, detail) {
-  results.push({ lane, status });
-  console.log(`${status === "ok" ? "OK  " : "FAIL"} ${lane} :: ${detail}`);
-}
-async function run(lane, fn) {
-  try {
-    log(lane, "ok", await fn());
-  } catch (e) {
-    log(lane, "fail", String(e?.message || e).slice(0, 150));
-  }
-}
-
-console.log("== HYPERCORE STAKING ==");
-
-let validator = null;
-await run("hl.staking.validators", async () => {
-  const v = await desk.hl.staking.validators();
-  const active = v.validators.filter((x) => x.isActive && !x.isJailed);
-  validator = active[0]?.validator || v.validators[0]?.validator;
-  return `validators=${v.count} activeUnjailed=${active.length} first=${(validator || "").slice(0, 10)}..`;
-});
-
-await run("hl.staking.health", async () => {
-  const h = await desk.hl.staking.health();
-  if (!h.ok) throw new Error("staking lane unhealthy");
-  return `ok validators=${h.validators} chain=${h.chain}`;
-});
-
-await run("hl.staking.delegatorSummary", async () => {
-  const s = await desk.hl.staking.summary(USER);
-  return `delegated=${s.delegatedWei} undelegated=${s.undelegatedWei} pendingWithdrawals=${s.nPendingWithdrawals}`;
-});
-
-await run("hl.staking.delegations", async () => {
-  const d = await desk.hl.staking.delegations(USER);
-  return `count=${d.count}`;
-});
-
-await run("hl.staking.rewards", async () => {
-  const r = await desk.hl.staking.rewards(USER);
-  return `rewards=${r.rewards.length}`;
-});
-
-await run("hl.staking.preflight", async () => {
-  const p = await desk.hl.staking.preflight(USER);
-  return `undelegated=${p.stakingBalanceUndelegated} queueDays=${p.unstakingQueueDays} lockupDays=${p.validatorLockupDays}`;
-});
-
-await run("hl.staking.units", async () => {
-  const w = hypeToWei("1.5");
-  if (w !== "150000000") throw new Error(`1.5 HYPE -> ${w}, expected 150000000`);
-  if (weiToHype("150000000") !== "1.5") throw new Error("roundtrip failed");
-  return `1.5 HYPE = ${w} wei roundtrip ok`;
-});
-
-await run("hl.staking.prepareStake", async () => {
-  const p = hlPrepareStakeDeposit({ amountHype: "2.5", maxHype: "10" });
-  if (p.action.type !== "cDeposit") throw new Error("wrong action type");
-  if (p.broadcastReady !== false || p.signingReady !== false) throw new Error("leaked readiness");
-  if (!p.requiresUserSignature) throw new Error("must require user signature");
-  return `cDeposit wei=${p.action.wei} primaryType=${p.typedData.primaryType} broadcastReady=false`;
-});
-
-await run("hl.staking.prepareStake.capBreach", async () => {
-  try {
-    hlPrepareStakeDeposit({ amountHype: "50", maxHype: "10" });
-  } catch (e) {
-    return `rejected over-cap: ${String(e.message).slice(0, 70)}`;
-  }
-  throw new Error("cap was NOT enforced");
-});
-
-await run("hl.staking.prepareDelegate", async () => {
-  if (!validator) throw new Error("no validator resolved");
-  const p = hlPrepareDelegate({ validator, amountHype: "2.5", isUndelegate: false, maxHype: "10" });
-  if (p.action.type !== "tokenDelegate" || p.action.isUndelegate !== false) throw new Error("wrong action");
-  return `tokenDelegate validator=${p.action.validator.slice(0, 10)}.. wei=${p.action.wei} isUndelegate=false`;
-});
-
-await run("hl.staking.prepareUndelegate", async () => {
-  const p = hlPrepareDelegate({ validator, amountHype: "2.5", isUndelegate: true });
-  if (p.action.isUndelegate !== true) throw new Error("undelegate flag lost");
-  return `tokenDelegate isUndelegate=true kind=${p.kind}`;
-});
-
-await run("hl.staking.prepareUnstake", async () => {
-  const p = hlPrepareStakeWithdraw({ amountHype: "2.5" });
-  if (p.action.type !== "cWithdraw") throw new Error("wrong action type");
-  if (!p.notes.join(" ").includes("7 day")) throw new Error("missing unstaking queue warning");
-  return `cWithdraw wei=${p.action.wei} queue warning present`;
-});
-
-await run("hl.staking.badAmount", async () => {
-  try {
-    hlPrepareStakeDeposit({ amountHype: "0" });
-  } catch (e) {
-    return `rejected zero amount`;
-  }
-  throw new Error("zero amount accepted");
-});
-
-await run("hl.staking.badValidator", async () => {
-  try {
-    hlPrepareDelegate({ validator: "not-an-address", amountHype: "1" });
-  } catch (e) {
-    return `rejected bad validator`;
-  }
-  throw new Error("bad validator accepted");
-});
-
-const failed = results.filter((r) => r.status === "fail");
-console.log(`\nlanes=${results.length} ok=${results.length - failed.length} failed=${failed.length}`);
-if (failed.length) {
-  console.log(`FAILED: ${failed.map((f) => f.lane).join(", ")}`);
-  process.exit(1);
-}
-console.log("HYPERCORE STAKING OK: reads live, stake/unstake/delegate prepare-only, caps enforced.");

package/scripts/e2e-solana-bitcoin.mjs

@@ -1,183 +0,0 @@
-// Oracle end-to-end LIVE lane probe: Solana + Bitcoin.
-// Read/quote/prepare/simulate only. No signing. No broadcast. No keys required.
-//
-// Run: node scripts/e2e-solana-bitcoin.mjs
-// Exit 0 = every mandatory lane answered live. Optional keyed lanes are reported, not failed.
-
-import { data as desk } from "../src/data/desk-data.mjs";
-import { jupiterQuote, jupiterPrepareSwap, SOL_MINT, USDC_MINT } from "../src/data/providers/jupiter.mjs";
-import { solanaSimulateTransaction } from "../src/data/providers/solana-rpc.mjs";
-import { magicEdenSolStats, magicEdenSolListings, magicEdenSolPrepareBuy } from "../src/data/providers/magiceden-sol.mjs";
-
-const PROBE_WALLET = process.env.ORACLE_E2E_SOL_PUBKEY || "11111111111111111111111111111111";
-const PROBE_BTC = process.env.ORACLE_E2E_BTC_ADDRESS || "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq";
-
-const results = [];
-function record(lane, status, detail) {
-  results.push({ lane, status, detail });
-  const tag = status === "ok" ? "OK  " : status === "keyed" ? "KEY " : "FAIL";
-  console.log(`${tag} ${lane} :: ${detail}`);
-}
-
-async function run(lane, fn, { optional = false } = {}) {
-  try {
-    const detail = await fn();
-    record(lane, "ok", detail);
-    return true;
-  } catch (error) {
-    const message = String(error?.message || error).slice(0, 140);
-    record(lane, optional ? "keyed" : "fail", message);
-    return optional;
-  }
-}
-
-console.log("== SOLANA ==");
-
-await run("solana.rpc.health", async () => {
-  const health = await desk.solana.health();
-  if (!health?.ok) throw new Error(`rpc unhealthy ${JSON.stringify(health).slice(0, 80)}`);
-  return `cluster ok slot lane live`;
-});
-
-await run("solana.rpc.balance", async () => {
-  const bal = await desk.solana.balance(PROBE_WALLET);
-  return `lamports=${bal?.lamports ?? bal?.value ?? "n/a"}`;
-});
-
-await run("solana.rpc.tokenAccounts", async () => {
-  const accounts = await desk.solana.tokenAccounts({ owner: PROBE_WALLET });
-  return `accounts=${accounts?.accounts?.length ?? 0}`;
-});
-
-let jupQuote = null;
-await run("solana.jupiter.quote(SOL->USDC)", async () => {
-  jupQuote = await jupiterQuote({ inputMint: SOL_MINT, outputMint: USDC_MINT, amount: "10000000", slippageBps: 50 });
-  const g = jupQuote.solanaGuard;
-  if (jupQuote.executionReady !== false) throw new Error("quote must not be executionReady");
-  if (g.slippageBps > 100) throw new Error("slippage cap breached");
-  return `out=${jupQuote.quote.outAmount} bps=${g.slippageBps} expires=${g.expiresAtMs - g.quotedAtMs}ms execReady=false`;
-});
-
-await run("solana.jupiter.slippageCap", async () => {
-  try {
-    await jupiterQuote({ inputMint: SOL_MINT, outputMint: USDC_MINT, amount: "10000000", slippageBps: 500 });
-  } catch (error) {
-    return `rejected 500bps: ${String(error.message).slice(0, 60)}`;
-  }
-  throw new Error("500 bps was NOT rejected");
-});
-
-let jupPrepared = null;
-await run("solana.jupiter.prepareSwap", async () => {
-  jupPrepared = await jupiterPrepareSwap({
-    quoteResponse: jupQuote.quote,
-    userPublicKey: PROBE_WALLET,
-  });
-  if (jupPrepared.signingReady !== false || jupPrepared.broadcastReady !== false) throw new Error("prepare leaked signing/broadcast readiness");
-  if (!jupPrepared.requiresUserSignature) throw new Error("prepare must require user signature");
-  return `tx=${jupPrepared.swapTransaction.length}b64 requiresUserSig=true signingReady=false broadcastReady=false`;
-});
-
-await run("solana.rpc.simulate(preparedSwap)", async () => {
-  const sim = await solanaSimulateTransaction({ transaction: jupPrepared.swapTransaction, sigVerify: false });
-  const err = sim?.err ?? sim?.value?.err ?? sim?.raw?.value?.err ?? null;
-  const units = sim?.unitsConsumed ?? sim?.value?.unitsConsumed ?? sim?.raw?.value?.unitsConsumed ?? null;
-  return `err=${JSON.stringify(err)} unitsConsumed=${units}`;
-});
-
-await run("solana.nft.magiceden.stats", async () => {
-  const stats = await magicEdenSolStats({ symbol: "mad_lads" });
-  if (!(stats.floorPriceSol > 0)) throw new Error("no floor");
-  return `floor=${stats.floorPriceSol} SOL listed=${stats.listedCount}`;
-});
-
-let meListing = null;
-await run("solana.nft.magiceden.listings", async () => {
-  const out = await magicEdenSolListings({ symbol: "mad_lads", limit: 1 });
-  meListing = out.listings[0];
-  if (!meListing?.tokenMint) throw new Error("no listing");
-  return `mint=${meListing.tokenMint.slice(0, 8)}.. price=${meListing.priceSol} SOL seller=${meListing.seller.slice(0, 6)}..`;
-});
-
-await run(
-  "solana.nft.magiceden.prepareBuy",
-  async () => {
-    const prep = await magicEdenSolPrepareBuy({
-      buyer: PROBE_WALLET,
-      seller: meListing.seller,
-      auctionHouse: meListing.auctionHouse,
-      tokenMint: meListing.tokenMint,
-      tokenATA: meListing.tokenATA,
-      priceSol: meListing.priceSol,
-    });
-    if (prep.broadcastReady !== false) throw new Error("prepare leaked broadcast readiness");
-    return `tx prepared bytes=${String(prep.transaction || "").length} requiresUserSig=${prep.requiresUserSignature}`;
-  },
-  { optional: true }
-);
-
-console.log("== BITCOIN ==");
-
-await run("bitcoin.esplora.health", async () => {
-  const h = await desk.bitcoin.health();
-  if (!h?.ok) throw new Error("esplora unhealthy");
-  return `ok tip lane live`;
-});
-
-await run("bitcoin.esplora.tipHeight", async () => {
-  const t = await desk.bitcoin.tipHeight();
-  const height = t?.height ?? t?.tipHeight ?? t;
-  if (!Number(height)) throw new Error("no tip height");
-  return `tip=${height}`;
-});
-
-await run("bitcoin.esplora.fees", async () => {
-  const f = await desk.bitcoin.fees();
-  const fast = f?.fastestFee ?? f?.fees?.fastestFee ?? f?.["1"] ?? null;
-  return `fastest=${JSON.stringify(fast)}`;
-});
-
-await run("bitcoin.esplora.address", async () => {
-  const a = await desk.bitcoin.address(PROBE_BTC);
-  const funded = a?.chainStats?.fundedTxoSum ?? a?.balanceSats ?? a?.raw?.chain_stats?.funded_txo_sum ?? null;
-  return `fundedSats=${funded}`;
-});
-
-await run("bitcoin.esplora.utxos", async () => {
-  const u = await desk.bitcoin.utxos(PROBE_BTC);
-  const n = u?.utxos?.length ?? u?.length ?? 0;
-  return `utxos=${n}`;
-});
-
-await run("bitcoin.meta.health", async () => {
-  const h = await desk.bitcoin.metaHealth();
-  return `ok=${h?.ok} tier=${h?.tier ?? h?.mode ?? "keyless"}`;
-});
-
-await run(
-  "bitcoin.meta.inscriptionInfo",
-  async () => {
-    const info = await desk.bitcoin.inscriptions(PROBE_BTC);
-    return `inscriptions=${info?.inscriptions?.length ?? "unknown"}`;
-  },
-  { optional: true }
-);
-
-await run(
-  "bitcoin.satflow.health",
-  async () => {
-    const h = await desk.bitcoin.satflowHealth();
-    if (!h?.ok) throw new Error(`satflow ${JSON.stringify(h).slice(0, 90)}`);
-    return `ok`;
-  },
-  { optional: true }
-);
-
-const failed = results.filter((r) => r.status === "fail");
-const keyed = results.filter((r) => r.status === "keyed");
-console.log(`\nlanes=${results.length} ok=${results.length - failed.length - keyed.length} keyed=${keyed.length} failed=${failed.length}`);
-if (failed.length) {
-  console.log(`FAILED: ${failed.map((f) => f.lane).join(", ")}`);
-  process.exit(1);
-}
-console.log("E2E OK: every mandatory Solana + Bitcoin lane answered live, prepare-only posture held.");

package/scripts/protocol-template-gate.mjs

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-import { listProtocolTemplates, runProtocolTemplateGate } from "../src/protocol-templates/gate.mjs";
-
-const id = process.argv[2];
-if (!id || id === "list") {
-  console.log(JSON.stringify(listProtocolTemplates(), null, 2));
-  process.exit(0);
-}
-try {
-  const r = runProtocolTemplateGate(id, { allowSkipStatic: process.env.REQUIRE_SLITHER !== "1" });
-  console.log(JSON.stringify(r, null, 2));
-} catch (e) {
-  console.error(String(e.message || e));
-  process.exit(1);
-}

package/scripts/public-api-scan.mjs

@@ -1,23 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs/promises";
-import path from "node:path";
-import { scanPublicApis } from "../src/data/public-api-scan.mjs";
-
-const args = process.argv.slice(2);
-const value = (flag) => {
-  const i = args.indexOf(flag);
-  return i >= 0 ? args[i + 1] : null;
-};
-const outPath = value("--out");
-const timeoutMs = Number(value("--timeout-ms") || 12_000);
-const providers = value("--providers")?.split(",").map((x) => x.trim()).filter(Boolean);
-
-const report = await scanPublicApis({ providers, timeoutMs });
-const json = `${JSON.stringify(report, null, 2)}\n`;
-if (outPath) {
-  const target = path.resolve(outPath);
-  await fs.mkdir(path.dirname(target), { recursive: true });
-  await fs.writeFile(target, json, "utf8");
-  console.error(`wrote ${target}`);
-}
-process.stdout.write(json);

package/scripts/secret-scan.mjs

@@ -1,181 +0,0 @@
-#!/usr/bin/env node
-// Pre-publication secret scan. Fails CLOSED: any hit is an error.
-//
-// Checks the working tree AND every blob in git history, because a secret
-// removed in a later commit is still public the moment the repo is.
-
-import { execFileSync } from "node:child_process";
-
-const ROOT = process.cwd();
-
-// Live values that must never appear. Sourced from the environment at scan
-// time so the scanner itself contains no secrets.
-function liveSecrets() {
-  const out = [];
-  const push = (label, value) => {
-    const v = String(value || "").trim();
-    if (v.length >= 8) out.push({ label, value: v });
-  };
-  for (const k of Object.keys(process.env)) {
-    if (/(_KEY|_SECRET|_TOKEN|_PASSPHRASE|_WIF|PRIVATE_KEY)$/i.test(k)) {
-      push(`env:${k}`, process.env[k]);
-    }
-  }
-  return out;
-}
-
-// A representative slice of the BIP39 English wordlist. Full coverage is not
-// required: a real mnemonic is 12 or 24 words drawn ENTIRELY from the list, so
-// any genuine phrase will hit these common entries, while English prose will
-// not have every one of its words in the list.
-const BIP39_SAMPLE = new Set(
-  ("abandon ability able about above absent absorb abstract absurd abuse access accident account accuse achieve acid " +
-   "across act action actor actress actual adapt add addict address adjust admit adult advance advice aerobic affair " +
-   "afford afraid again age agent agree ahead aim air airport aisle alarm album alcohol alert alien all alley allow " +
-   "almost alone alpha already also alter always amateur amazing among amount amused analyst anchor ancient anger " +
-   "angle angry animal ankle announce annual another answer antenna antique anxiety any apart apology appear apple " +
-   "approve april arch arctic area arena argue arm armed armor army around arrange arrest arrive arrow art artefact " +
-   "artist artwork ask aspect assault asset assist assume asthma athlete atom attack attend attitude attract auction " +
-   "audit august aunt author auto autumn average avocado avoid awake aware away awesome awful awkward axis baby " +
-   "bachelor bacon badge bag balance balcony ball bamboo banana banner bar barely bargain barrel base basic basket " +
-   "battle beach bean beauty because become beef before begin behave behind believe below belt bench benefit best " +
-   "betray better between beyond bicycle bid bike bind biology bird birth bitter black blade blame blanket blast " +
-   "bleak bless blind blood blossom blouse blue blur blush board boat body boil bomb bone bonus book boost border " +
-   "boring borrow boss bottom bounce box boy bracket brain brand brass brave bread breeze brick bridge brief bright " +
-   "bring brisk broccoli broken bronze broom brother brown brush bubble buddy budget buffalo build bulb bulk bullet " +
-   "bundle bunker burden burger burst bus business busy butter buyer buzz cabbage cabin cable cactus cage cake call " +
-   "calm camera camp can canal cancel candy cannon canoe canvas canyon capable capital captain car carbon card cargo " +
-   "carpet carry cart case cash casino castle casual cat catalog catch category cattle caught cause caution cave " +
-   "ceiling celery cement census century cereal certain chair chalk champion change chaos chapter charge chase chat " +
-   "cheap check cheese chef cherry chest chicken chief child chimney choice choose chronic chuckle chunk churn cigar " +
-   "cinnamon circle citizen city civil claim clap clarify claw clay clean clerk clever click client cliff climb " +
-   "clinic clip clock clog close cloth cloud clown club clump cluster clutch coach coast coconut code coffee coil " +
-   "coin collect color column combine come comfort comic common company concert conduct confirm congress connect " +
-   "consider control convince cook cool copper copy coral core corn correct cost cotton couch country couple course " +
-   "cousin cover coyote crack cradle craft cram crane crash crater crawl crazy cream credit creek crew cricket crime " +
-   "crisp critic crop cross crouch crowd crucial cruel cruise crumble crunch crush cry crystal cube culture cup " +
-   "cupboard curious current curtain curve cushion custom cute cycle zoo zone zero youth young you yellow year " +
-   "wrong write wrist wrap worth world work word wood wonder woman wolf wire winter wing wine window wind wild wife " +
-   "why whisper white where when wheat what wet west welcome weird weekend week wedding web wealth wear weapon " +
-   "weasel wear wave water watch waste wash warrior warm want walnut wall walk wait wagon void voice vote volume " +
-   "vocal vivid virus violin virtual vintage view video vicious vibrant vessel very verify version verb vendor " +
-   "vehicle vegetable vault various vast vase vanish valve valley valid vacuum vacant").split(/\s+/)
-);
-
-const PATTERNS = [
-  { name: "private key (hex 64)", re: /\b(?:0x)?[0-9a-fA-F]{64}\b/, refine: (m, line) =>
-      /priv|secret|wif|seed|mnemonic|signer|wallet/i.test(line) && !/hash|digest|sha256|txid|commit|blob|sha1|0x0{40,}/i.test(line) },
-  { name: "BTC WIF", re: /\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b/ },
-  { name: "BIP39 seed phrase", re: /\b(?:[a-z]{3,8} ){11,23}[a-z]{3,8}\b/, refine: (m) => {
-      // Ordinary English prose trivially matches "12-24 short lowercase words".
-      // A scanner that cries wolf on comments is a scanner people switch off,
-      // so require the words to actually be in the BIP39 wordlist.
-      const words = m[0].trim().split(/\s+/);
-      if (words.length !== 12 && words.length !== 24) return false;
-      return words.every((w) => BIP39_SAMPLE.has(w));
-    } },
-  { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/ },
-  { name: "OpenAI key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/ },
-  { name: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
-  { name: "GitHub token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
-  { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
-  { name: "Telegram bot token", re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/ },
-  { name: "PEM private key", re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/ },
-  { name: "Solana keypair array", re: /\[\s*(?:\d{1,3}\s*,\s*){63}\d{1,3}\s*\]/ },
-];
-
-// Paths whose matches are known-safe test fixtures.
-const ALLOWED_PATHS = [
-  /^scripts\/secret-scan\.mjs$/,
-  /^package-lock\.json$/,
-];
-
-// Literal strings that are documented, synthetic, or public by nature.
-const ALLOWED_VALUES = [
-  "0x0123456789012345678901234567890123456789012345678901234567890123", // HL SDK public test vector
-  "L1aW4aubDFB7yfras2S1mN3bqg9nwySY8nkoLmJebSLD5BWv3ENZ",
-  "/-----BEGIN[A-Z ]*PRIVATE KEY-----/",
-  '{ value: "-----BEGIN EC PRIVATE KEY-----" }',
-  "0x0000000000000000000000000000000000000000",
-];
-
-function sh(cmd, args) {
-  return execFileSync(cmd, args, { cwd: ROOT, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
-}
-
-function scanText(text, origin, findings) {
-  const lines = text.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line.length > 4000) continue;
-    for (const p of PATTERNS) {
-      const m = p.re.exec(line);
-      if (!m) continue;
-      if (ALLOWED_VALUES.some((v) => line.includes(v))) continue;
-      if (p.refine && !p.refine(m, line)) continue;
-      findings.push({ origin, line: i + 1, kind: p.name, sample: line.trim().slice(0, 100) });
-    }
-    for (const s of LIVE) {
-      if (line.includes(s.value)) {
-        findings.push({ origin, line: i + 1, kind: `LIVE SECRET ${s.label}`, sample: "[REDACTED — real credential]" });
-      }
-    }
-  }
-}
-
-const LIVE = liveSecrets();
-const findings = [];
-
-// --- 1. working tree (tracked files only) ---
-const tracked = sh("git", ["ls-files"]).split("\n").filter(Boolean);
-for (const rel of tracked) {
-  if (ALLOWED_PATHS.some((r) => r.test(rel))) continue;
-  let content;
-  try {
-    content = sh("git", ["show", `:${rel}`]);
-  } catch {
-    continue; // binary or unreadable
-  }
-  if (content.includes("\u0000")) continue;
-  scanText(content, rel, findings);
-}
-
-// --- 2. every blob in history ---
-const revs = sh("git", ["rev-list", "--all"]).split("\n").filter(Boolean);
-const seen = new Set();
-let historyBlobs = 0;
-for (const rev of revs) {
-  const entries = sh("git", ["ls-tree", "-r", rev]).split("\n").filter(Boolean);
-  for (const entry of entries) {
-    const [meta, path] = entry.split("\t");
-    const sha = meta.split(/\s+/)[2];
-    if (!sha || seen.has(sha)) continue;
-    seen.add(sha);
-    if (ALLOWED_PATHS.some((r) => r.test(path))) continue;
-    let content;
-    try {
-      content = sh("git", ["cat-file", "-p", sha]);
-    } catch {
-      continue;
-    }
-    if (content.includes("\u0000")) continue;
-    historyBlobs++;
-    scanText(content, `history:${rev.slice(0, 8)}:${path}`, findings);
-  }
-}
-
-// --- 3. author identity leakage ---
-const authors = new Set(sh("git", ["log", "--all", "--format=%an <%ae>|%cn <%ce>"]).split(/[\n|]/).filter(Boolean));
-
-console.log(`scanned ${tracked.length} tracked files, ${historyBlobs} historical blobs, ${revs.length} commits`);
-console.log(`live env secrets checked: ${LIVE.length}`);
-console.log(`git identities: ${[...authors].join(", ") || "(none)"}`);
-
-if (findings.length) {
-  console.error(`\nFAIL — ${findings.length} finding(s):`);
-  for (const f of findings.slice(0, 40)) {
-    console.error(`  ${f.origin}:${f.line}  [${f.kind}]  ${f.sample}`);
-  }
-  process.exit(1);
-}
-console.log("\nPASS — no secrets found in tree or history");