@oracle-agent/oracle 0.11.0 → 0.12.0

package/skills/oracle-rfq-tokenized-assets/SKILL.md

@@ -1,69 +0,0 @@
----
-name: oracle-rfq-tokenized-assets
-description: RFQ/intent routing across supported chains and guarded buys for tokenized Robinhood assets when user keys/routes are configured.
----
-
-# Oracle RFQ + tokenized asset routing
-
-Use when a user asks for RFQ, solver/intent quotes, request-for-quote execution,
-or buying tokenized Robinhood-style assets/stocks on supported chains.
-
-## RFQ scope
-
-Oracle should treat RFQ as another best-execution source, not a bypass:
-
-- Query RFQ/intent venues where the chain and token pair are supported and the
-  user has configured any required API keys.
-- Compare RFQ quotes against AMM/aggregator routes on net received after gas,
-  fees, solver spread, and settlement assumptions.
-- Return `artifactKind` precisely: signed typed-data order vs unsigned tx vs
-  wallet-provider action.
-- Re-quote immediately before prepare/signing. RFQ expiry/nonce is short-lived.
-- Do not fabricate RFQ support for a chain without a configured venue.
-
-## Every-chain rule
-
-"Across all chains" means every configured chain is attempted and capability-labeled:
-
-- `RFQ_READY`: venue configured, quote live, prepare path verified.
-- `QUOTE_ONLY`: quote available, but no reviewed prepare path.
-- `UNCONFIGURED`: needs user API key or venue credentials.
-- `UNAVAILABLE`: no RFQ venue for that chain/token pair.
-- `BLOCKED`: policy, unsupported asset, compliance, or route guard rejected.
-
-Unsupported is an honest result, not a failure to hide.
-
-## Tokenized Robinhood assets
-
-Treat tokenized Robinhood assets as normal on-chain assets plus extra identity/risk
-checks:
-
-1. Resolve the exact chain and contract/mint from the official issuer/venue or a
-   user-provided contract. Never infer from ticker alone.
-2. Check asset metadata, decimals, supply, issuer/proxy/admin controls, transfer
-   restrictions, and redeemability/custody disclosures when public.
-3. Verify the venue/router can quote and prepare the asset on that chain.
-4. For buys, run the same route and slippage guard as any ERC-20/SPL swap.
-5. For sells, run sellability/reverse route first; tokenized assets may trade like
-   wrappers and can have restricted-transfer or allowlist rules.
-6. User signs; Oracle does not custody or guarantee redemption.
-
-## Output contract
-
-Return a table per chain/venue:
-
-- chain / venue / asset id
-- RFQ status and expiry
-- gross quote, estimated gas/fees, net output
-- artifact kind and signing path
-- policy blockers
-- confidence and data timestamp
-
-## Pitfalls
-
-- Calling a solver/RFQ quote "gasless" when the cost is hidden in spread.
-- Using an RFQ quote after expiry.
-- Treating a tokenized stock ticker as identity without contract provenance.
-- Ignoring transfer restrictions that make buys possible but exits blocked.
-- Routing tokenized Robinhood assets through DEMI/RH private executor by default;
-  public users must use their own wallet/key/API setup.

package/skills/oracle-smart-wallet-scanner/SKILL.md

@@ -1,49 +0,0 @@
----
-name: oracle-smart-wallet-scanner
-description: Use when finding, scoring, or monitoring smart wallets from on-chain behavior across tokens, NFTs, and venues.
----
-
-# Smart-wallet scanner
-
-Use this for on-chain wallet intelligence: early buyers, profitable exits, repeat
-edge, copy-radar, cabal detection candidates, and wallet boards.
-
-## Smart wallet definition
-
-A wallet is not smart because it bought one winner. Require repeatable evidence:
-
-- early across multiple unrelated assets
-- profitable realized exits, not just mark-to-market bags
-- enough trade count and not only one ticker
-- entry before broad social consensus
-- exits before liquidity drain or sell imbalance
-- behavior survives fees, gas, and failed trades
-
-## Scan pattern
-
-1. Start from live events: pair creates, swaps, mint transfers, order fills,
-   marketplace sales, bridge inflows.
-2. Normalize wallet, chain, token/NFT, time, size, and realized PnL.
-3. Cluster funding and common recipients separately; do not call it a bundle
-   without launch-block clustering and common-funder evidence.
-4. Score wallets by multi-asset repeatability and drawdown, not raw largest win.
-5. Track holds vs exits. A smart buyer becoming a smart seller changes the signal.
-6. Emit confidence and evidence window with every wallet label.
-
-## Output standard
-
-For each wallet surface:
-
-- address and chain
-- sample wins/losses
-- realized PnL basis and limitations
-- first-seen timing vs launch/volume
-- current holdings/exit state if known
-- confidence: high / moderate / low / unknown
-
-## Hard rules
-
-- Never expose a private operator wallet as a public smart-wallet seed.
-- Never use one-token PnL as a primary smart label.
-- Cabal candidates are seeds for deeper analysis, not proof of manipulation.
-- If sell data is unavailable, label PnL `UNKNOWN`, not profitable.

package/skills/oracle-solana/SKILL.md

@@ -1,65 +0,0 @@
----
-name: oracle-solana
-description: Use for Solana research and swap preparation — Jupiter routes, SPL accounts, simulation, blockhash expiry.
----
-
-# Solana
-
-Read and prepare through Oracle's data plane (`solana-rpc`, `jupiter`). No key
-required. Signing happens in the user's wallet; Oracle returns unsigned
-transactions.
-
-## Ops
-
-| Need | Op |
-|---|---|
-| SOL balance | `getBalance` |
-| SPL accounts | `tokenAccounts` |
-| fresh blockhash | `latestBlockhash` |
-| dry run | `simulate` |
-| route price | `jupiter.quote` |
-| unsigned swap tx | `jupiter.prepare` |
-
-## Blockhash expiry is the trap
-
-A Solana transaction carries a recent blockhash and dies in roughly 60–90 seconds.
-
-Consequences that catch people:
-
-- a transaction prepared two minutes ago is **dead** — re-prepare, don't retry
-- do not prepare, go do other tool work, then hand it over
-- if the user takes a while to approve, prepare again
-
-An expired transaction fails with a confusing error that looks like a routing bug.
-It isn't.
-
-## Simulate every time
-
-`simulateTransaction` is cheap and tells you the actual failure before the user
-signs. There is no reason to skip it. Check:
-
-- does it succeed at all
-- compute units consumed (near the limit → it will fail under load)
-- logs for the real revert reason
-
-## Account creation costs rent
-
-Swapping into a token the wallet has never held requires creating an associated
-token account, which costs SOL rent. Budget it, and say so — a wallet with exactly
-enough SOL for the swap will fail on the account creation.
-
-## Decimals are not standard
-
-Nine is common, six is common, others exist. Read the mint. Assuming decimals is how
-an amount ends up 1000x off.
-
-## Hard rules
-
-1. **Simulate before returning any transaction for signature.**
-2. **Never relay a caller-supplied RPC** — a hostile endpoint can lie about
-   simulation.
-3. **Return unsigned only.** Never a fully-signed transaction.
-4. **Solana authority is separate from EVM authority.** No EVM key satisfies a
-   Solana grant.
-5. Name the **mint address**, not just the ticker.
-6. Receipts or it didn't happen — confirmed signature or it failed.

package/skills/oracle-solana-nft/SKILL.md

@@ -1,54 +0,0 @@
----
-name: oracle-solana-nft
-description: Research Solana NFT collections and prepare unsigned Magic Eden buy, list, and mint transactions.
----
-
-# Solana NFT lane (Magic Eden)
-
-Use when someone asks Oracle to check a Solana NFT collection's floor, find
-listings, buy an NFT, list one they hold, or mint from a launchpad drop.
-
-## Tiers
-
-| Op | Key needed | What it returns |
-|---|---|---|
-| `stats` | none | floor in SOL, listed count, 24h volume |
-| `listings` | none | mint, seller, auctionHouse, tokenATA, price |
-| `tokenListings` | none | listings for one specific mint |
-| `prepareBuy` | `MAGICEDEN_API_KEY` | unsigned base64 transaction |
-| `prepareList` | `MAGICEDEN_API_KEY` | unsigned base64 transaction |
-| `prepareMint` | `MAGICEDEN_API_KEY` | unsigned base64 transaction |
-
-Reads are keyless. Instruction builders need the user's own Magic Eden key. If
-the key is missing, say so plainly and stop; do not fake a ticket.
-
-## Flow for a buy
-
-1. `desk.solana.nftStats({ symbol })` - confirm the collection is real and get
-   the floor.
-2. `desk.solana.nftListings({ symbol, limit })` - pull live listings. The
-   cheapest listing is the first one when sorted by price.
-3. Set `maxPriceSol` from the user's stated ceiling, not from the floor. The cap
-   is checked before any network call, so a listing that moved above the ceiling
-   is rejected without touching the API.
-4. `desk.solana.nftPrepareBuy({ buyer, seller, auctionHouse, tokenMint, tokenATA, priceSol, maxPriceSol })`.
-5. Simulate the returned base64 through `desk.solana.simulate` before handing it
-   over. A prepared transaction that fails simulation is a prepared loss.
-6. Hand the user the unsigned transaction. Their wallet signs and sends.
-
-## Rules
-
-- Floor price is not a bid. Buying fills at the listing price, which can move
-  between the read and the signature.
-- Always pass `maxPriceSol`. Without it there is no ceiling on a mint or buy.
-- Collection symbols are validated as slugs. `../` and empty strings are
-  rejected, not encoded into a URL.
-- Every prepare returns `signingReady: false` and `broadcastReady: false`. Oracle
-  never signs a Solana transaction and never sends one.
-- Solana lamports are integers. `priceSol` is decimal SOL; the module converts.
-
-## Verification
-
-`npm run e2e:solana-bitcoin` hits live Magic Eden reads, a live Jupiter quote,
-a live prepared swap, and a live simulation, then asserts the prepare posture
-held.

package/skills/oracle-token-research/SKILL.md

@@ -1,67 +0,0 @@
----
-name: oracle-token-research
-description: Use when researching any token, especially low-cap or newly launched. The sell-side-first checklist that catches honeypots.
----
-
-# Token research
-
-The default assumption for a new token is **hostile**. Research exists to disprove
-that, not to confirm a story.
-
-## Sell side first
-
-Most losses here are not bad entries. They are tokens that **buy cleanly and cannot
-be sold**. So the first question is never "will it go up" — it is "can I get out."
-
-Run a **round-trip simulation** in one state-free call: wrap native → buy token →
-sell token back → require a minimum return. Treat any of these as FAIL:
-
-- quote failure in either direction
-- transfer failure
-- router revert
-- round-trip return below the no-tax reverse quote by more than a small tolerance
-
-A successful **buy** quote proves nothing about the sell.
-
-## Price against the real pool
-
-A launchpad or bonding-curve token often exposes its **own** `getReserves()`
-returning zero or virtual values. The tradeable market is a *different* pair.
-
-- `blockTimestampLast == 0` → not a live pool. Do not size against it.
-- Find the real pair via `factory.getPair(a, b)` or a live swap's decoded target
-- A pair with `kLast`, `price0CumulativeLast`, `MINIMUM_LIQUIDITY` is standard V2
-  even when the router in front of it is a custom fork
-
-Sizing against stale reserves is how a "0.4% impact" trade becomes 3%.
-
-## Identity before action
-
-Tickers collide and get squatted. A fuzzy name match is a **candidate**, never
-confirmation.
-
-Always surface the **contract address** and require explicit confirmation before
-anything that moves value. `FEFUR` vs `FEFER` is a real class of loss.
-
-## The rest of the checklist
-
-| Check | Red flag |
-|---|---|
-| holder concentration | top 5 hold most of supply |
-| liquidity depth | thin relative to your size |
-| LP status | unlocked or removable |
-| age | hours old with heavy volume |
-| router | non-canonical clone with a familiar name |
-| mint authority | still open |
-| transfer logic | fees or blocks that change post-launch |
-
-## Label your evidence
-
-Mark every finding `LIVE`, `STALE`, `UNKNOWN`, or `UNAVAILABLE` with a timestamp.
-Do not call holder-concentration analysis "bundle detection" — bundles require
-launch-block clustering and common-funder evidence, which is a different query.
-
-## Honest output
-
-`unknown` is a correct and frequent answer about a two-hour-old token. Say it.
-Never let narrative quality substitute for a passing sell simulation.

package/skins/oracle.yaml

@@ -1,56 +0,0 @@
-name: oracle
-description: filled lowercase oracle in the classic boxed layout
-colors:
-  banner_border: "#455867"
-  banner_title: "#B8F0FF"
-  banner_accent: "#91C2D7"
-  banner_dim: "#60717F"
-  banner_text: "#EAF2F8"
-  ui_accent: "#B8F0FF"
-  ui_label: "#A5D9EB"
-  ui_ok: "#7EE7B5"
-  ui_error: "#FF7B7B"
-  ui_warn: "#F0C674"
-  prompt: "#B8F0FF"
-  input_rule: "#455867"
-  response_border: "#91C2D7"
-  status_bar_bg: "#11161B"
-  status_bar_text: "#91A2B1"
-  status_bar_strong: "#EAF2F8"
-  status_bar_dim: "#60717F"
-  status_bar_good: "#7EE7B5"
-  status_bar_warn: "#F0C674"
-  status_bar_bad: "#FF9B71"
-  status_bar_critical: "#FF7B7B"
-  session_label: "#B8F0FF"
-  session_border: "#455867"
-  voice_status_bg: "#11161B"
-  selection_bg: "#23313B"
-  completion_menu_bg: "#11161B"
-  completion_menu_current_bg: "#23313B"
-  completion_menu_meta_bg: "#11161B"
-  completion_menu_meta_current_bg: "#23313B"
-spinner:
-  waiting_faces: ["·", "··", "···"]
-  thinking_faces: ["◇", "◈", "◆", "◈"]
-  thinking_verbs: ["thinking", "reading", "checking", "routing"]
-  wings: [["", ""]]
-branding:
-  agent_name: "oracle"
-  welcome: ""
-  goodbye: "exit"
-  response_label: " oracle "
-  prompt_symbol: "›"
-  help_header: "oracle"
-tool_prefix: "│"
-banner_logo: |
-  [bold #B8F0FF]                                       ████[/]
-  [bold #B8F0FF]                                      ░░███[/]
-  [bold #ACDEEF]  ██████  ████████   ██████    ██████  ░███   ██████[/]
-  [bold #A5D9EB] ███░░███░░███░░███ ░░░░░███  ███░░███ ░███  ███░░███[/]
-  [bold #9FCBDD]░███ ░███ ░███ ░░░   ███████ ░███ ░░░  ░███ ░███████[/]
-  [bold #9FCBDD]░███ ░███ ░███      ███░░███ ░███  ███ ░███ ░███░░░[/]
-  [bold #ACDEEF]░░██████  █████    ░░████████░░██████  █████░░██████[/]
-  [bold #B8F0FF] ░░░░░░  ░░░░░      ░░░░░░░░  ░░░░░░  ░░░░░  ░░░░░░[/]
-banner_hero: |
-  [bold #EAF2F8]THE FUTURE IS AGENTIC[/]

package/src/action-receipts.mjs

@@ -1,265 +0,0 @@
-// Deterministic, public-only receipts for prepared and executed actions.
-//
-// This module deliberately has no authority and no I/O: it does not authorize,
-// sign, broadcast, or fetch. It only records facts supplied by its caller.
-
-import { createHash } from "node:crypto";
-import { wordlists } from "ethers";
-
-export const ACTION_RECEIPT_VERSION = 1;
-
-// Key-name matching was exact-ish and only covered five words, so every wallet
-// export alias (secretKey, seedPhrase, wif, keyMaterial, privKey, xprv, seed,
-// keystore) sailed through. There was also NO value-shape rule, so a raw key or
-// a BIP-39 phrase pasted into a benign field like `memo` was recorded verbatim.
-//
-// Both concerns were already solved in src/address-book.mjs; this module simply
-// did not use the hardened list. Found by the opus lane of the 2026-08-03
-// four-model review, and verified to PERSIST: unknown top-level props are
-// dropped by the schema whitelist, but a secret nested inside a RETAINED field
-// (intent, route, decodedAction) survives into the frozen receipt.
-const SECRET_KEYS = new Set([
-  "privatekey",
-  "privkey",
-  "secretkey",
-  "seedphrase",
-  "seed",
-  "mnemonic",
-  "passphrase",
-  "password",
-  "keystore",
-  "keymaterial",
-  "wif",
-  "xprv",
-  "xpriv",
-  "bearer",
-  "authorization",
-  "signature",
-  "apikey",
-  "credential",
-]);
-
-// Unambiguous key shapes: WIF, extended private key, BIP-39 word run. These are
-// refused wherever they appear.
-//
-// A bare 64-hex string is deliberately NOT in this list. A raw EVM private key
-// and a bytes32 tx hash are byte-identical, and receipts legitimately carry
-// txHash / orderHash / salt / merkleRoot / nonce. Blanket-refusing 64-hex would
-// break real receipts — an over-tight filter is its own bug. It is instead
-// gated on the field name below.
-const KEY_SHAPED_VALUE = [
-  /\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b/,
-  /\bxprv[0-9A-Za-z]{50,}\b/,
-];
-
-const BIP39_WORD_COUNTS = new Set([12, 15, 18, 21, 24]);
-
-function isBip39EnglishPhrase(value) {
-  const words = String(value).trim().toLowerCase().split(/\s+/).filter(Boolean);
-  return BIP39_WORD_COUNTS.has(words.length) && words.every((word) => wordlists.en.getWordIndex(word) >= 0);
-}
-
-const BARE_32_BYTE_HEX = /^\s*(?:0x)?[0-9a-fA-F]{64}\s*$/;
-
-// Field names whose whole value is EXPECTED to be a 32-byte digest.
-//
-// The trailing `(?:e?s)?` matters: `publicValue` scans array leaves using the
-// PARENT key, so a batched route's `orderHashes` / `proofs` / `commitments`
-// arrives here in its plural form (English pluralizes `hash` as `hashes`).
-// Without it a digest LIST is refused while the exact same digest in singular
-// form is accepted — an over-tight filter that breaks real receipts and blocks
-// no secret (key-SHAPED values are refused by KEY_SHAPED_VALUE / BIP-39
-// regardless of field name).
-const DIGEST_FIELD = /(hash|digest|root|salt|nonce|proof|commitment|sig|id)(?:e?s)?$/i;
-const PROTOCOL_HEX_FIELDS = new Set([
-  "calldata",
-  "data",
-  "publickey",
-  "pubkey",
-  "message",
-  "payload",
-  "input",
-  "extradata",
-]);
-
-function allows32ByteHex(key) {
-  const normalized = normalizedKey(key);
-  return PROTOCOL_HEX_FIELDS.has(normalized) || DIGEST_FIELD.test(normalized);
-}
-
-export class ActionReceiptSecretError extends Error {
-  constructor(path) {
-    super(`action receipt refused: secret-bearing field at ${path}`);
-    this.name = "ActionReceiptSecretError";
-    this.code = "ACTION_RECEIPT_SECRET";
-  }
-}
-
-function normalizedKey(key) {
-  return String(key).replace(/[^a-z0-9]/gi, "").toLowerCase();
-}
-
-function isSecretKey(key) {
-  const normalized = normalizedKey(key);
-  return [...SECRET_KEYS].some((secret) => normalized.includes(secret));
-}
-
-/**
- * Refuse a key-material-shaped VALUE, so a secret pasted into a benign field
- * name (memo, note, label) cannot be recorded verbatim.
- *
- * Bare 64-hex is only refused when the field name is NOT digest-shaped: a raw
- * EVM private key and a bytes32 hash are byte-identical, and receipts carry
- * txHash / orderHash / salt / nonce legitimately.
- */
-function assertNoSecretValue(key, value, path) {
-  if (typeof value !== "string") return;
-  if (KEY_SHAPED_VALUE.some((re) => re.test(value)) || isBip39EnglishPhrase(value)) {
-    throw new ActionReceiptSecretError(path);
-  }
-  if (BARE_32_BYTE_HEX.test(value) && !allows32ByteHex(key)) {
-    throw new ActionReceiptSecretError(path);
-  }
-}
-
-function publicValue(value, path = "$", key = "") {
-  if (value == null || typeof value === "boolean") return value;
-  if (typeof value === "string") {
-    assertNoSecretValue(key, value, path);
-    return value;
-  }
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new TypeError(`action receipt: non-finite number at ${path}`);
-    return value;
-  }
-  if (typeof value === "bigint") return value.toString();
-  if (Array.isArray(value)) return value.map((item, index) => publicValue(item, `${path}[${index}]`, key));
-  if (typeof value !== "object" || Object.getPrototypeOf(value) !== Object.prototype) {
-    throw new TypeError(`action receipt: JSON-like value required at ${path}`);
-  }
-
-  const out = {};
-  for (const childKey of Object.keys(value).sort()) {
-    const childPath = `${path}.${childKey}`;
-    if (isSecretKey(childKey)) throw new ActionReceiptSecretError(childPath);
-    if (value[childKey] !== undefined) out[childKey] = publicValue(value[childKey], childPath, childKey);
-  }
-  return out;
-}
-
-/** Recursively reject secret-bearing fields and return a detached public copy. */
-export function assertNoReceiptSecrets(value) {
-  return publicValue(value);
-}
-
-function canonicalPublicJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonicalPublicJson).join(",")}]`;
-  return `{${Object.keys(value).map((key) => `${JSON.stringify(key)}:${canonicalPublicJson(value[key])}`).join(",")}}`;
-}
-
-/** Canonical JSON with recursively sorted object keys. */
-export function canonicalReceiptJson(value) {
-  return canonicalPublicJson(publicValue(value));
-}
-
-/** Hash exactly the public receipt fields, excluding the self-referential id. */
-export function computeReceiptId(receipt) {
-  if (!receipt || typeof receipt !== "object" || Array.isArray(receipt)) {
-    throw new TypeError("action receipt: object required");
-  }
-  const { receiptId: _ignored, summary: _derived, ...publicFields } = receipt;
-  return createHash("sha256").update(canonicalReceiptJson(publicFields)).digest("hex");
-}
-
-function supplied(input, ...keys) {
-  for (const key of keys) if (input[key] !== undefined) return input[key];
-  return undefined;
-}
-
-function required(input, keys, label) {
-  const value = supplied(input, ...keys);
-  if (value === undefined || value === null) throw new TypeError(`action receipt: ${label} required`);
-  return value;
-}
-
-function balanceFields(input) {
-  const balances = supplied(input, "balances", "balanceChanges");
-  const before = supplied(input, "beforeBalances", "balancesBefore", "before");
-  const after = supplied(input, "afterBalances", "balancesAfter", "after");
-  if (balances !== undefined) return { balances };
-  if (before === undefined && after === undefined) return {};
-  return { balances: { ...(before === undefined ? {} : { before }), ...(after === undefined ? {} : { after }) } };
-}
-
-/**
- * Normalize caller-supplied prepare/execute facts into the versioned schema.
- * Unknown input fields are intentionally omitted from the receipt.
- */
-export function normalizeActionReceipt(input = {}) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new TypeError("action receipt: input object required");
-  }
-  // Scan the complete input before selecting fields so a secret cannot be
-  // hidden in an otherwise unknown property and accidentally appear later.
-  publicValue(input);
-
-  const txHash = supplied(input, "txHash", "transactionHash");
-  const phase = supplied(input, "phase", "stage", "resultType") ?? (txHash == null ? "prepare" : "execute");
-  if (phase !== "prepare" && phase !== "execute") {
-    throw new TypeError('action receipt: phase must be "prepare" or "execute"');
-  }
-
-  const fields = {
-    receiptVersion: ACTION_RECEIPT_VERSION,
-    phase,
-    intent: required(input, ["intent"], "intent"),
-    route: required(input, ["route"], "route"),
-    decodedAction: required(input, ["decodedAction", "action"], "decodedAction"),
-    policyChecks: required(input, ["policyChecks", "checks"], "policyChecks"),
-    allowlistHits: required(input, ["allowlistHits", "allowlistMatches"], "allowlistHits"),
-    prepareHash: required(input, ["prepareHash"], "prepareHash"),
-    ...(txHash == null ? {} : { txHash }),
-    ...balanceFields(input),
-  };
-  const receipt = publicValue(fields);
-  return Object.freeze({ ...receipt, receiptId: computeReceiptId(receipt) });
-}
-
-export const createActionReceipt = normalizeActionReceipt;
-
-function label(value, preferred = []) {
-  if (typeof value === "string" || typeof value === "number") return String(value);
-  for (const key of preferred) if (value?.[key] != null) return String(value[key]);
-  return "recorded";
-}
-
-function checkResult(check) {
-  if (typeof check === "boolean") return check;
-  if (check && typeof check === "object") {
-    if (typeof check.ok === "boolean") return check.ok;
-    if (typeof check.allowed === "boolean") return check.allowed;
-    if (typeof check.passed === "boolean") return check.passed;
-  }
-  return null;
-}
-
-/** Produce a compact human-readable statement without changing the receipt. */
-export function summarizeActionReceipt(receipt) {
-  if (!receipt || typeof receipt !== "object") throw new TypeError("action receipt: object required");
-  const action = label(receipt.decodedAction, ["type", "action", "method", "name"]);
-  const route = label(receipt.route, ["name", "provider", "venue", "id"]);
-  const checks = Array.isArray(receipt.policyChecks)
-    ? receipt.policyChecks
-    : Object.values(receipt.policyChecks || {});
-  const passed = checks.filter((check) => checkResult(check) === true).length;
-  const failed = checks.filter((check) => checkResult(check) === false).length;
-  const hits = Array.isArray(receipt.allowlistHits)
-    ? receipt.allowlistHits.length
-    : Object.keys(receipt.allowlistHits || {}).length;
-  const tx = receipt.txHash == null ? "no transaction hash" : `tx ${receipt.txHash}`;
-  const balances = receipt.balances == null ? "balances not provided" : "before/after balances recorded";
-  return `${receipt.phase} ${action} via ${route}; policy ${passed} passed, ${failed} failed; ${hits} allowlist hit${hits === 1 ? "" : "s"}; ${tx}; ${balances}; receipt ${receipt.receiptId}`;
-}
-
-export const formatActionReceipt = summarizeActionReceipt;