@oracle-agent/oracle 0.11.0 → 0.13.0

package/package.json

@@ -1,110 +1,27 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.11.0",
-  "description": "Oracle: standalone prepare-only multichain agent control plane with optional Hermes integration. Policy-bounded intents for a user-signed wallet; the public package never takes your key.",
-  "license": "Apache-2.0",
+  "version": "0.13.0",
+  "description": "Oracle is distributed to Locals Only holders. This package is a pointer to the gate, not the product.",
   "type": "module",
-  "publishConfig": {
-    "access": "public"
-  },
-  "homepage": "https://github.com/demi-hl/oracle",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/demi-hl/oracle.git"
-  },
-  "keywords": [
-    "ai-agent",
-    "multichain",
-    "evm",
-    "self-custody",
-    "defi",
-    "hermes",
-    "nous",
-    "mcp"
-  ],
+  "license": "SEE LICENSE IN LICENSE",
   "engines": {
     "node": ">=20.19.0"
   },
   "bin": {
-    "oracle": "./bin/oracle.mjs",
-    "oracle-data": "./bin/desk-server.mjs",
-    "oracle-public": "./bin/oracle-public-server.mjs",
-    "oracle-data-mcp": "./bin/oracle-data-mcp.mjs",
-    "oracle-init": "./bin/oracle-init.mjs",
-    "oracle-upgrade": "./bin/oracle-upgrade.mjs",
-    "oracle-scan": "./bin/oracle-scan.mjs",
-    "oracle-route": "./bin/oracle-route.mjs"
-  },
-  "exports": {
-    ".": "./src/index.mjs",
-    "./data": "./src/data/desk-data.mjs",
-    "./policy": "./src/public-control/policy-schema.mjs",
-    "./chains": "./src/chains.mjs",
-    "./scanner": "./src/scanner/index.mjs",
-    "./router": "./src/router/index.mjs",
-    "./action-semantics": "./src/action-semantics.mjs",
-    "./address-book": "./src/address-book.mjs",
-    "./nft-gas-war": "./src/nft-gas-war-guard.mjs",
-    "./prepare-envelope": "./src/prepare-envelope.mjs",
-    "./connect": "./src/onboarding/harness-configs.mjs",
-    "./receipts": "./src/action-receipts.mjs",
-    "./risk": "./src/portfolio-risk.mjs",
-    "./watch": "./src/watch-preferences.mjs",
-    "./signals": "./src/signals/index.mjs"
-  },
-  "scripts": {
-    "test": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/*.test.mjs",
-    "test:boundary": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/custody-boundary.test.mjs",
-    "e2e:solana-bitcoin": "node scripts/e2e-solana-bitcoin.mjs",
-    "e2e:hypercore-staking": "node scripts/e2e-hypercore-staking.mjs",
-    "start:data": "node bin/desk-server.mjs",
-    "start:public": "node bin/oracle-public-server.mjs",
-    "scan:public-apis": "node scripts/public-api-scan.mjs",
-    "health": "node -e \"import('./src/data/desk-data.mjs').then(m=>m.data.health().then(h=>console.log(JSON.stringify(h,null,2))))\"",
-    "init": "node bin/oracle-init.mjs",
-    "init:apply": "node bin/oracle-init.mjs --apply",
-    "scan": "node bin/oracle-scan.mjs",
-    "verify:venues": "node scripts/verify-v3-venues.mjs",
-    "route": "node bin/oracle-route.mjs",
-    "scan:secrets": "node scripts/secret-scan.mjs",
-    "test:count": "node scripts/check-test-count.mjs",
-    "test:count:update": "node scripts/check-test-count.mjs --update",
-    "test:protocol-templates": "RUN_PROTOCOL_TEMPLATE_TESTS=1 node --test test/protocol-templates.test.mjs",
-    "protocol:gate": "node scripts/protocol-template-gate.mjs",
-    "gate:docs": "node scripts/check-doc-drift.mjs",
-    "gate:release": "npm run gate:docs && node --test test/flag-polarity.test.mjs"
-  },
-  "dependencies": {
-    "@msgpack/msgpack": "^3.1.3",
-    "@noble/curves": "^2.2.0",
-    "@noble/hashes": "^2.2.0",
-    "@scure/base": "^2.2.0",
-    "ethers": "^6.16.0",
-    "viem": "^2.55.8"
+    "oracle": "bin/oracle.mjs"
   },
   "files": [
     "bin/",
-    "src/",
-    "!src/**/__pycache__/**",
-    "profiles/",
-    "skills/",
-    "skins/",
-    "plugins/",
-    "public/",
-    "artifacts/",
     "README.md",
-    "SETUP.md",
-    "LICENSE",
-    "SECURITY.md",
-    "CONTRIBUTING.md",
-    "docs/",
-    "examples/",
-    "scripts/",
-    "protocols/templates/**/src/**",
-    "protocols/templates/**/test/**",
-    "protocols/templates/**/foundry.toml",
-    "protocols/templates/**/remappings.txt",
-    "protocols/templates/**/SECURITY.md",
-    "src/protocol-templates/**"
-  ]
+    "LICENSE"
+  ],
+  "keywords": [
+    "oracle",
+    "locals-only"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/demi-hl/oracle.git"
+  },
+  "homepage": "https://oracle.demi.la"
 }

package/CONTRIBUTING.md

@@ -1,98 +0,0 @@
-# Contributing to Oracle
-
-Thanks for looking. Oracle is a control plane for money movement, so the review
-bar is about safety and honesty more than style.
-
-## Before you start
-
-Run the suite:
-
-```bash
-npm install
-npm test
-```
-
-391 tests, all green. If they aren't green on a clean checkout, that's a bug —
-please report it.
-
-## The one rule that matters
-
-**The public plane may never reach a private key or a house signer.**
-
-Oracle ships the data plane, the policy plane, and the control plane. It does not
-ship the executor. A PR that imports signer or keystore code into public modules
-will fail `test/custody-boundary.test.mjs`, and the fix is not to edit the
-forbidden list.
-
-If your feature seems to need a key, restructure it: build an unsigned
-transaction or a typed-data intent and hand it back to the caller to sign.
-
-## What we want
-
-- **Real bugs, fixed at the class level.** Reproduce it, point at the line, fix
-  every sibling call path — not just the one that was reported.
-- **New chains and providers.** This is the most useful contribution. See below.
-- **Honest capability tiers.** If a provider can only quote, mark it
-  `quote-only`. Do not mark it `prepare` because a prepare function exists but
-  was never validated against a live route.
-- **Tests that assert invariants**, not snapshots. `assert` that a minimum output
-  is enforced; don't freeze today's provider list into an equality check.
-- **Guards recomputed before signing.** A quote-time check that isn't re-verified
-  at broadcast is decoration.
-
-## What gets rejected
-
-- A signer, private key, or house-custody path in the public tree.
-- A destination allowlist that defaults to permissive, or an empty allowlist read
-  as "allow all."
-- Slippage widened past the 100 bps cap to make a trade go through. Block,
-  requote, or split instead.
-- A claim of execution support with no live prepare/simulate evidence.
-- Secrets in code, tests, fixtures, or docs — including a real wallet address as
-  a default `from` for quotes. Use `src/data/quote-placeholder.mjs`.
-- "It worked when I ran it" with no test.
-
-## Adding a provider
-
-1. Create `src/data/providers/<name>.mjs`.
-2. Export a `health()` plus the ops you actually implement.
-3. Register it in `src/data/catalog.mjs` with truthful `chainIds`, `auth`, `ops`,
-   and `execution` tier.
-4. Add a test with a mocked transport. Do not require a live network for CI.
-5. If it needs a key, the health check must report
-   `{ ok: false, configured: false }` rather than throwing.
-
-## Adding a chain
-
-1. Add an entry to `CHAINS` in `src/chains.mjs` with its `rpcEnv` names.
-2. Verify every router/venue address on-chain (`eth_getCode` must return real
-   bytecode) before adding it to `src/venues.mjs`.
-3. Comment each venue addition with how you verified it and when.
-4. An unverified chain stays fail-closed. That is a safe state, not a gap.
-
-Never allowlist a router you found only in a blog post or a model's answer. The
-destination allowlist is the highest-leverage control in the system.
-
-## Commits and PRs
-
-Conventional prefixes: `fix:`, `feat:`, `refactor:`, `docs:`, `test:`, `chore:`.
-
-In the PR body, state:
-
-- what broke or what's new
-- how you verified it (paste the real command output)
-- whether anything touches the custody boundary
-
-Small, reviewable PRs get merged. A 3000-line PR mixing a refactor with a policy
-change will sit.
-
-## Style
-
-- ES modules, Node 20+, no build step.
-- No new runtime dependency without a reason in the PR description.
-- Comments explain *why*, not *what*. If a line encodes a hard-won fact — a
-  provider's unit quirk, a revert cause — say so, and say how it was learned.
-
-## License
-
-Contributions are accepted under [Apache-2.0](LICENSE).

package/SECURITY.md

@@ -1,89 +0,0 @@
-# Security Policy
-
-## Reporting a vulnerability
-
-**Do not open a public issue for a live exploit.**
-
-Email **security@demi.la** with:
-
-- what the issue is
-- how to reproduce it
-- the impact you believe it has
-- whether funds are at risk right now
-
-You'll get an acknowledgement within 72 hours. If funds are actively at risk,
-say so in the subject line and we'll treat it as urgent.
-
-Please give us a reasonable window to ship a fix before public disclosure. We
-will credit you unless you'd rather stay anonymous.
-
-## Scope
-
-In scope:
-
-- custody-boundary escapes (public code reaching a signer or key material)
-- destination-allowlist bypasses
-- slippage/minimum-output guard bypasses
-- grant forgery, replay, or scope escalation
-- route/vault/order attestation forgery
-- secret leakage through an API response or log
-
-Out of scope:
-
-- third-party provider outages and their rate limits
-- economic risk inherent to a protocol you chose to trade
-- issues that require the operator's own machine to already be compromised
-- deployment hardening for an operator's separate private execution service
-
-## Threat model
-
-Oracle assumes the language model can be wrong or adversarially steered. The
-model is treated as an untrusted proposer.
-
-Consequences of that assumption, which are the invariants worth attacking:
-
-1. **The public package never holds a key.** Signing happens in the user's
-   wallet. Source-only operator modules are excluded from public entrypoints and
-   the npm artifact.
-2. **Model output is not authorization.** A grant is authorization, and a grant
-   is signed by the owner, scoped, and expiring.
-3. **Destinations are allowlisted per chain and fail closed.** An empty allowlist
-   refuses everything. It never means "allow anything."
-4. **Model-authored metadata is not trusted for routing.** Dynamic execution
-   targets require an attestation minted inside the trusted boundary.
-5. **Guards are recomputed at sign and broadcast time**, not just at quote time,
-   because a stale minimum is not a minimum.
-
-If you find a path where model-authored text becomes an authorized on-chain
-action without an owner signature and a policy check, that is the bug we most
-want to hear about.
-
-## Enforcement in CI
-
-`test/custody-boundary.test.mjs` walks the public import graph, and
-`test/public-release-hardening.test.mjs` inspects the packed npm artifact. The
-build fails if either public surface reaches wallet key material or a house
-signer. The secret scanner also checks current files and Git history. CI runs
-the boundary suite on every push and pull request.
-
-A security claim that isn't enforced by a test is just a comment.
-
-## Residual operator notes
-
-These are not public-package custody holes. They are operator constraints that
-still apply after the public boundary hardening:
-
-1. **Owner-local signer modules live in the public companion**
-   [`@oracle-agent/operator`](https://github.com/demi-hl/oracle-operator)
-   (`hl-exec`, `key-vault`, `oracle-vault`). Keys stay on the operator's
-   machine. They must not be restored into this prepare-only package or its
-   npm artifact. CI fails if a pack of *this* repo includes those paths.
-2. **Prepare helpers that validate executable routes require an attestation
-   secret** (`requireSigned`) so they cannot be used as a softer pre-broadcast
-   gate than `enforceTxPolicy`.
-3. **Daily spend ledger locks are pid + TTL based.** A live owner holds the
-   lock; a dead pid or expired lock is reclaimed. Override TTL with
-   `ORACLE_LEDGER_LOCK_TTL_MS` only if you know you need a longer window.
-4. **GitHub process controls** (branch protection, CodeQL, secret scanning,
-   Dependabot) are enabled on this public repo and are independent of the
-   package boundary tests.