@oracle-agent/oracle 0.14.1 → 0.16.0

package/scripts/build-dist.mjs

@@ -1,119 +0,0 @@
-#!/usr/bin/env node
-// Bundle the package for publish so `src/` never ships.
-//
-// Every public entry point (package.json "exports" + "bin") becomes its own
-// bundled file under dist/. Runtime dependencies stay external — we are hiding
-// OUR source, not vendoring ethers into the tarball.
-//
-// This is obfuscation, not a security boundary. It raises the cost of lifting
-// the provider/router/scanner work from "npm pack and read it" to "reverse a
-// minified bundle". The real boundary is that the signer never ships at all.
-
-import { build } from "esbuild";
-import { cpSync, readdirSync, readFileSync, writeFileSync, rmSync, mkdirSync, existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const DIST = join(ROOT, "dist");
-const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
-
-const external = [
-  ...Object.keys(pkg.dependencies || {}),
-  ...Object.keys(pkg.peerDependencies || {}),
-];
-
-// src-relative entry -> dist-relative output, derived from the real manifest so
-// a new export can never silently ship unbundled.
-const entries = new Map();
-for (const [name, target] of Object.entries(pkg.exports || {})) {
-  if (typeof target !== "string" || !target.startsWith("./src/")) continue;
-  entries.set(target.slice(2), distPathFor(target, "exports", name));
-}
-for (const [name, target] of Object.entries(pkg.bin || {})) {
-  if (typeof target !== "string" || !target.startsWith("./bin/")) continue;
-  entries.set(target.slice(2), distPathFor(target, "bin", name));
-}
-
-const commandDir = join(ROOT, "src", "cli", "commands");
-for (const file of readdirSync(commandDir).filter((f) => f.endsWith(".mjs")).sort()) {
-  entries.set(join("src", "cli", "commands", file), join("cli", "commands", file));
-}
-
-function distPathFor(target, kind, name) {
-  const rel = target.replace(/^\.\/(src|bin)\//, "");
-  return kind === "bin" ? join("bin", rel) : rel;
-}
-
-if (existsSync(DIST)) rmSync(DIST, { recursive: true });
-mkdirSync(DIST, { recursive: true });
-
-const results = [];
-for (const [entry, outRel] of entries) {
-  const outfile = join(DIST, outRel);
-  mkdirSync(dirname(outfile), { recursive: true });
-  await build({
-    entryPoints: [join(ROOT, entry)],
-    outfile,
-    bundle: true,
-    platform: "node",
-    target: "node20",
-    format: "esm",
-    minify: true,
-    legalComments: "none",
-    external,
-    logLevel: "error",
-    // The CLI kernel loads user plugin files from disk at runtime; that import
-    // is intentionally dynamic and must stay unresolved.
-    // Bin entries already carry their own shebang in source — esbuild preserves
-    // it, so adding a banner here would emit a second one on line 2 and break
-    // the file. Only add it when the source genuinely lacks one.
-    banner:
-      outRel.startsWith("bin/") && !readFileSync(join(ROOT, entry), "utf8").startsWith("#!")
-        ? { js: "#!/usr/bin/env node" }
-        : undefined,
-  });
-  const bytes = readFileSync(outfile).byteLength;
-  results.push({ entry, outRel, bytes });
-}
-
-// Rewrite the published manifest to point at dist/ and ship no source.
-const out = structuredClone(pkg);
-out.exports = Object.fromEntries(
-  Object.entries(pkg.exports || {}).map(([k, v]) =>
-    typeof v === "string" && v.startsWith("./src/")
-      ? [k, "./dist/" + distPathFor(v, "exports", k)]
-      : [k, v],
-  ),
-);
-out.bin = Object.fromEntries(
-  Object.entries(pkg.bin || {}).map(([k, v]) =>
-    typeof v === "string" && v.startsWith("./bin/")
-      ? [k, "./dist/" + distPathFor(v, "bin", k)]
-      : [k, v],
-  ),
-);
-// Ship the bundle and the user-facing assets. Never src/, scripts/, skills/,
-// profiles/, docs/, examples/ — those are internal surface, not runtime need.
-out.files = ["dist/", "public/", "artifacts/", "README.md", "SETUP.md", "LICENSE", "SECURITY.md"];
-delete out.scripts;
-delete out.devDependencies;
-
-writeFileSync(join(DIST, "package.publish.json"), JSON.stringify(out, null, 2) + "\n");
-
-// Runtime data the bins read from disk. esbuild bundles code, not JSON assets,
-// so `oracle init` shipped without profiles/ and skills/ and crashed on ENOENT.
-// They land under dist/assets/ and src/package-manifest.mjs looks there first.
-const ASSET_DIRS = ["profiles", "skills"];
-for (const name of ASSET_DIRS) {
-  const from = join(ROOT, name);
-  if (!existsSync(from)) continue;
-  cpSync(from, join(DIST, "assets", name), { recursive: true });
-}
-
-const total = results.reduce((a, r) => a + r.bytes, 0);
-console.log(`bundled ${results.length} entry points -> dist/  (${(total / 1024).toFixed(0)} KB)`);
-for (const r of results.slice(0, 6)) {
-  console.log(`  ${r.outRel.padEnd(34)} ${(r.bytes / 1024).toFixed(0)} KB`);
-}
-if (results.length > 6) console.log(`  ... ${results.length - 6} more`);

package/scripts/build-inscription.py

@@ -1,230 +0,0 @@
-#!/usr/bin/env python3
-"""Build the Oracle inscription SVG.
-
-Text is converted to OUTLINED VECTOR PATHS so the inscription is fully
-self-contained: no font file, no external fetch, no <text> element that renders
-differently in every ordinals explorer. Design language is the Oracle splash:
-deep #0B1018 field, #7CC4FF blue, Cormorant Garamond display italic accent,
-IBM Plex Mono eyebrow, a single luminous orb.
-"""
-
-import math
-import os
-
-from fontTools.ttLib import TTFont
-from fontTools.pens.svgPathPen import SVGPathPen
-from fontTools.varLib.instancer import instantiateVariableFont
-
-import os
-from pathlib import Path
-
-REPO_ROOT = Path(__file__).resolve().parent.parent
-
-W, H = 1000, 1000
-
-BG = "#0B1018"
-BLUE = "#7CC4FF"
-BLUE2 = "#A7D8FF"
-COOL = "#9BB6D1"
-MUTE = "#5B738F"
-
-# vertical rhythm
-CX = W / 2.0
-CY = 336.0
-R_OUT = 166.0
-R_MID = 128.0
-R_IN = 92.0
-MARK_BASELINE = 690.0
-SUB_BASELINE = 786.0
-
-
-def load(path, wght):
-    f = TTFont(path)
-    if "fvar" in f:
-        f = instantiateVariableFont(f, {"wght": wght}, inplace=False, updateFontNames=False)
-    return f
-
-
-def text_paths(font, text, size, letter_spacing=0.0):
-    """Return (path_d, advance_width) with the text laid out at `size` px."""
-    upem = font["head"].unitsPerEm
-    scale = size / upem
-    cmap = font.getBestCmap()
-    gs = font.getGlyphSet()
-    hmtx = font["hmtx"]
-
-    try:
-        kern = font["kern"].kernTables[0].kernTable
-    except Exception:
-        kern = None
-
-    parts = []
-    x = 0.0
-    prev = None
-
-    for ch in text:
-        gname = cmap.get(ord(ch))
-        if gname is None:
-            x += size * 0.3
-            prev = None
-            continue
-        if prev and kern:
-            x += kern.get((prev, gname), 0) * scale
-        pen = SVGPathPen(gs)
-        gs[gname].draw(pen)
-        d = pen.getCommands()
-        if d:
-            # flip Y (font space is y-up, SVG is y-down) and place at x
-            parts.append(
-                f'<g transform="translate({x:.3f},0) scale({scale:.6f},{-scale:.6f})">'
-                f'<path d="{d}"/></g>'
-            )
-        x += hmtx[gname][0] * scale + letter_spacing
-        prev = gname
-    # trailing letter-spacing is not part of the inked width
-    if letter_spacing and text:
-        x -= letter_spacing
-    return "".join(parts), x
-
-
-def centered(font, text, size, y, fill, letter_spacing=0.0, opacity=None):
-    d, width = text_paths(font, text, size, letter_spacing)
-    if not d:
-        return ""
-    x = (W - width) / 2.0
-    op = f' opacity="{opacity}"' if opacity is not None else ""
-    return f'<g transform="translate({x:.3f},{y:.3f})" fill="{fill}"{op}>{d}</g>'
-
-
-def arc(cx, cy, r, a0, a1):
-    """SVG arc path between two angles in degrees."""
-    x0 = cx + math.cos(math.radians(a0)) * r
-    y0 = cy + math.sin(math.radians(a0)) * r
-    x1 = cx + math.cos(math.radians(a1)) * r
-    y1 = cy + math.sin(math.radians(a1)) * r
-    large = 1 if abs(a1 - a0) > 180 else 0
-    sweep = 1 if a1 > a0 else 0
-    return f"M{x0:.2f} {y0:.2f} A{r} {r} 0 {large} {sweep} {x1:.2f} {y1:.2f}"
-
-
-def main():
-    display_italic = load("/tmp/CormorantGaramond-Italic.ttf", 400)
-    display = load("/tmp/CormorantGaramond.ttf", 300)
-    mono = TTFont(os.environ.get("IBM_PLEX_MONO", str(Path.home() / ".local/share/fonts/protocols/IBMPlexMono-Regular.ttf")))
-
-    o = []
-    o.append(f'<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 {W} {H}" width="{W}" height="{H}">')
-
-    o.append(
-        "<defs>"
-        '<radialGradient id="halo" cx="50%" cy="34%" r="54%">'
-        f'<stop offset="0%" stop-color="{BLUE}" stop-opacity=".20"/>'
-        f'<stop offset="52%" stop-color="{BLUE}" stop-opacity=".05"/>'
-        f'<stop offset="100%" stop-color="{BLUE}" stop-opacity="0"/>'
-        "</radialGradient>"
-        '<radialGradient id="orb" cx="50%" cy="50%" r="50%">'
-        '<stop offset="0%" stop-color="#F2FAFF"/>'
-        f'<stop offset="38%" stop-color="{BLUE2}"/>'
-        f'<stop offset="100%" stop-color="{BLUE}" stop-opacity=".14"/>'
-        "</radialGradient>"
-        '<linearGradient id="rule" x1="0" y1="0" x2="1" y2="0">'
-        f'<stop offset="0%" stop-color="{BLUE}" stop-opacity="0"/>'
-        f'<stop offset="50%" stop-color="{BLUE}" stop-opacity=".6"/>'
-        f'<stop offset="100%" stop-color="{BLUE}" stop-opacity="0"/>'
-        "</linearGradient>"
-        '<linearGradient id="sweep" x1="0" y1="0" x2="1" y2="1">'
-        f'<stop offset="0%" stop-color="{BLUE}" stop-opacity="0"/>'
-        '<stop offset="100%" stop-color="#EAF6FF" stop-opacity=".95"/>'
-        "</linearGradient>"
-        "</defs>"
-    )
-
-    o.append(f'<rect width="{W}" height="{H}" fill="{BG}"/>')
-    o.append(f'<rect width="{W}" height="{H}" fill="url(#halo)"/>')
-
-    # --- orbit rings: readable at thumbnail size --------------------------
-    o.append(
-        f'<circle cx="{CX}" cy="{CY}" r="{R_OUT}" fill="none" '
-        f'stroke="{BLUE}" stroke-opacity=".24" stroke-width="1.1"/>'
-    )
-    o.append(
-        f'<circle cx="{CX}" cy="{CY}" r="{R_MID}" fill="none" '
-        f'stroke="{BLUE}" stroke-opacity=".16" stroke-width="1"/>'
-    )
-    o.append(
-        f'<circle cx="{CX}" cy="{CY}" r="{R_IN}" fill="none" '
-        f'stroke="{BLUE}" stroke-opacity=".34" stroke-width="1" stroke-dasharray="1.5 7"/>'
-    )
-
-    # the agentic sweep: one bright arc, the thing that is moving
-    o.append(
-        f'<path d="{arc(CX, CY, R_OUT, -96, 4)}" fill="none" '
-        'stroke="url(#sweep)" stroke-width="2.2" stroke-linecap="round"/>'
-    )
-
-    # 8 lane ticks on the outer ring
-    for i in range(8):
-        a = math.radians(-90 + i * 45)
-        x1 = CX + math.cos(a) * R_OUT
-        y1 = CY + math.sin(a) * R_OUT
-        x2 = CX + math.cos(a) * (R_OUT - 13)
-        y2 = CY + math.sin(a) * (R_OUT - 13)
-        o.append(
-            f'<line x1="{x1:.2f}" y1="{y1:.2f}" x2="{x2:.2f}" y2="{y2:.2f}" '
-            f'stroke="{BLUE}" stroke-opacity=".5" stroke-width="1.5"/>'
-        )
-
-    # node dots on the mid ring
-    for i in range(4):
-        a = math.radians(-45 + i * 90)
-        x = CX + math.cos(a) * R_MID
-        y = CY + math.sin(a) * R_MID
-        o.append(f'<circle cx="{x:.2f}" cy="{y:.2f}" r="2.6" fill="{BLUE}" opacity=".72"/>')
-
-    # --- the orb ----------------------------------------------------------
-    o.append(f'<circle cx="{CX}" cy="{CY}" r="52" fill="url(#orb)" opacity=".20"/>')
-    o.append(f'<circle cx="{CX}" cy="{CY}" r="16" fill="url(#orb)"/>')
-    o.append(
-        f'<circle cx="{CX}" cy="{CY}" r="16" fill="none" '
-        'stroke="#F2FAFF" stroke-opacity=".55" stroke-width=".9"/>'
-    )
-
-    # --- eyebrow ----------------------------------------------------------
-    o.append(centered(mono, "ORACLE", 16, 122, BLUE, letter_spacing=7.4))
-    o.append(f'<rect x="{CX - 84}" y="143" width="168" height="1" fill="url(#rule)"/>')
-
-    # --- the mark ---------------------------------------------------------
-    o.append(centered(display_italic, "oracle", 178, MARK_BASELINE, BLUE2))
-    o.append(centered(display, "was here", 92, SUB_BASELINE, COOL, opacity=".9"))
-
-    # --- footer -----------------------------------------------------------
-    o.append(f'<rect x="{CX - 132}" y="836" width="264" height="1" fill="url(#rule)"/>')
-    o.append(centered(mono, "THE FUTURE IS AGENTIC", 14.5, 880, BLUE, letter_spacing=4.0))
-    o.append(centered(mono, "BITCOIN L1", 12, 916, MUTE, letter_spacing=3.4))
-
-    # --- corner registration marks ---------------------------------------
-    m, ln = 52, 24
-    for (x, y, dx, dy) in ((m, m, 1, 1), (W - m, m, -1, 1), (m, H - m, 1, -1), (W - m, H - m, -1, -1)):
-        o.append(
-            f'<path d="M{x} {y + dy * ln} L{x} {y} L{x + dx * ln} {y}" fill="none" '
-            f'stroke="{BLUE}" stroke-opacity=".38" stroke-width="1.3"/>'
-        )
-
-    o.append("</svg>")
-
-    svg = "".join(o)
-    path = str(REPO_ROOT / "artifacts/inscription/oracle-was-here.svg")
-    os.makedirs(os.path.dirname(path), exist_ok=True)
-    with open(path, "w") as f:
-        f.write(svg)
-
-    # sanity: the mark must not collide with the ring group
-    mark_cap_top = MARK_BASELINE - 178 * 0.74
-    ring_bottom = CY + R_OUT
-    print(f"wrote {path}")
-    print(f"bytes {len(svg.encode())}")
-    print(f"ring_bottom={ring_bottom:.1f} mark_cap_top={mark_cap_top:.1f} clearance={mark_cap_top - ring_bottom:.1f}px")
-
-
-if __name__ == "__main__":
-    main()

package/scripts/check-doc-drift.mjs

@@ -1,123 +0,0 @@
-#!/usr/bin/env node
-// Release gate: shipped prose must not contradict shipped behavior.
-//
-// Why this exists. The 2026-08-01 four-model audit found the same stale claim
-// in 20 places across both packages: docs said the unattended signer was
-// limited to `hl` and `poly` long after six bounded surfaces had shipped. The
-// worst instances were not READMEs — they were `profiles/oracle/SOUL.md` and
-// `skills/oracle-action-semantics/SKILL.md`, which are read by the MODEL. An
-// agent told that EVM daemon execution is impossible reasons incorrectly about
-// its own authority, and no test suite can see a false sentence.
-//
-// This scans every doc surface that ships in the tarball, including model-facing
-// SOUL and skill text, which is exactly where drift hides longest.
-
-import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
-const failures = [];
-
-// Claims that shipped in a real release and are now false.
-const STALE_CLAIMS = [
-  { re: /limited\s+to\s+`?hl`?\s+and\s+`?poly`?/i, why: "says the unattended signer is limited to hl+poly" },
-  { re: /only\s+`?hl`?\s+and\s+`?poly`?\s+are\s+enabled/i, why: "says only hl+poly are daemon-enabled" },
-  { re: /daemon\s+surfaces\s+remain\s+`?hl`?\s+and\s+`?poly`?/i, why: "freezes the surface list at hl+poly" },
-  { re: /policy-bounded\s+`?hl`?\s+and\s+`?poly`?\s+only/i, why: "restricts the daemon to hl+poly" },
-  { re: /agent-facing\s+daemon\s+supports\s+only\s+policy-bounded\s+Hyperliquid\s+and\s+Polymarket\s+execution/i, why: "says the agent-facing daemon supports only Hyperliquid+Polymarket" },
-  { re: /`?evm`?,?\s+`?btc`?,?\s+and\s+`?sol`?\s+fail\s+closed\s+at\s+the\s+daemon/i, why: "claims evm/btc/sol are refused at the daemon" },
-  { re: /EVM,\s*BTC,?\s*and\s+Solana\s+are\s+not\s+daemon\s+surfaces/i, why: "denies evm/btc/sol are daemon surfaces" },
-  { re: /companion\s+daemon\s+is\s+`?hl`?\s*\/\s*`?poly`?[- ]only/i, why: "describes the companion daemon as hl/poly-only" },
-  { re: /daemon\s+supports\s+only\s+policy-bounded\s+Hyperliquid\s+and\s+Polymarket/i, why: "describes the daemon as Hyperliquid/Polymarket-only" },
-  { re: /unattended\s+signer\s+remains\s+`?hl`?\s*\/\s*`?poly`?/i, why: "freezes the generic signer at hl/poly" },
-  { re: /supports\s+autonomous\s+Hyperliquid\s+and\s+Polymarket\s+execution/i, why: "describes the daemon as Hyperliquid/Polymarket-only" },
-  { re: /\(HL\s*\+\s*Poly,\s*capped\)/i, why: "documents autosign as hl/poly-only" },
-  { re: /policy-bounded\s+HL\s*\/\s*Polymarket\s+exec/i, why: "documents the signer daemon as hl/poly-only" },
-  { re: /policy-bounded\s+daemon\s+surfaces:\s*hl\s*\|\s*poly\s*$/i, why: "documents only two of six daemon surfaces" },
-  { re: /ORACLE_SIGNER_SURFACES=hl,poly\s*$/i, why: "quickstart freezes ORACLE_SIGNER_SURFACES at hl,poly" },
-  { re: /ORACLE_AUTONOMOUS_TRADING=1.*(?:or\s+run\s+the\s+signer\s+daemon|same(?:-tier)?).*oracle-signer/i, why: "frames direct exec and oracle-signer as equivalent agent paths" },
-  { re: /(?:or\s+run\s+the\s+signer\s+daemon|same(?:-tier)?).*oracle-signer.*ORACLE_AUTONOMOUS_TRADING=1/i, why: "frames direct exec and oracle-signer as equivalent agent paths" },
-  { re: /ORACLE_AUTONOMOUS=1/i, why: "names the dead autonomous env var instead of ORACLE_AUTONOMOUS_TRADING" },
-];
-
-// Version pins that go stale the moment a release ships. The audit found the
-// quickstart advertising 0.3.6/0.6.1 inside a 0.4.0 tarball, so a copy-paste
-// install handed users an older wall set.
-function checkVersionPins(rel, text) {
-  const lines = text.split("\n");
-  lines.forEach((line, i) => {
-    const pin = line.match(/@oracle-agent\/oracle@(\d+\.\d+\.\d+)/);
-    if (pin && pin[1] !== pkg.version) {
-      failures.push(
-        `${rel}:${i + 1} pins @oracle-agent/oracle@${pin[1]} but this package is ${pkg.version}\n    ${line.trim().slice(0, 120)}`,
-      );
-    }
-    const latest = line.match(/Latest:.*oracle\s+`(\d+\.\d+\.\d+)`/i);
-    if (latest && latest[1] !== pkg.version) {
-      failures.push(
-        `${rel}:${i + 1} advertises oracle ${latest[1]} as latest but this package is ${pkg.version}\n    ${line.trim().slice(0, 120)}`,
-      );
-    }
-    // The 2026-08-03 grok lane found `Source tree: **oracle \`0.5.0\`**` and a
-    // `Published npm: **oracle \`0.4.2\`**` line surviving inside a 0.10.0
-    // tarball. Both shapes sailed past the two matchers above, so a stranger
-    // reading the shipped README saw a version five releases stale. Match any
-    // prose that states an oracle version, not just the two blessed prefixes.
-    const stated = line.match(/oracle\s+`(\d+\.\d+\.\d+)`/i);
-    if (stated && stated[1] !== pkg.version) {
-      failures.push(
-        `${rel}:${i + 1} states oracle ${stated[1]} but this package is ${pkg.version}\n    ${line.trim().slice(0, 120)}`,
-      );
-    }
-  });
-}
-
-// Every markdown surface that ships to a user or a model.
-function docFiles() {
-  const out = [];
-  for (const rel of ["README.md", "SETUP.md", "SECURITY.md"]) {
-    if (existsSync(path.join(root, rel))) out.push(rel);
-  }
-  for (const dir of ["docs", "profiles", "skills"]) {
-    const abs = path.join(root, dir);
-    if (!existsSync(abs)) continue;
-    const walk = (d) => {
-      for (const entry of readdirSync(d)) {
-        const full = path.join(d, entry);
-        if (statSync(full).isDirectory()) walk(full);
-        else if (entry.endsWith(".md")) out.push(path.relative(root, full));
-      }
-    };
-    walk(abs);
-  }
-  return out;
-}
-
-const files = docFiles();
-for (const rel of files) {
-  const text = readFileSync(path.join(root, rel), "utf8");
-  text.split("\n").forEach((line, i) => {
-    for (const claim of STALE_CLAIMS) {
-      if (claim.re.test(line)) {
-        failures.push(`${rel}:${i + 1} ${claim.why}\n    ${line.trim().slice(0, 140)}`);
-      }
-    }
-  });
-  checkVersionPins(rel, text);
-}
-
-console.log(`package version: ${pkg.version}`);
-console.log(`doc surfaces scanned: ${files.length} (README/SETUP/SECURITY + docs/ + profiles/ + skills/)`);
-console.log("");
-
-if (failures.length) {
-  console.error(`FAIL — ${failures.length} doc/code drift finding(s):\n`);
-  for (const f of failures) console.error(`  ${f}\n`);
-  console.error("Shipped prose contradicts shipped behavior. Model-facing SOUL/skill text counts:");
-  console.error("an agent that reads a false capability claim reasons wrongly about its own authority.");
-  process.exit(1);
-}
-
-console.log("PASS — no stale capability claims or version pins in shipped docs");

package/scripts/check-test-count.mjs

@@ -1,105 +0,0 @@
-#!/usr/bin/env node
-// Test-count drift gate.
-//
-// Two agents push to this branch. Each one runs the suite in its own tree and
-// reports a number. Those numbers drift: round 7 landed a commit message
-// claiming "707 tests, 0 failing" when the tree at that commit actually ran
-// 729. Nobody lied — the claim was just written against a stale checkout, and
-// git history keeps it forever.
-//
-// So the count is committed alongside the code. Add or remove a test and the
-// build fails until the baseline is updated in the SAME commit, which puts the
-// delta in the diff where review can see it. A stale claim becomes a red build
-// instead of a permanent wrong number in the log.
-//
-//   node scripts/check-test-count.mjs            verify against the baseline
-//   node scripts/check-test-count.mjs --update   rewrite it (intentional change)
-
-import { spawnSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join, resolve } from "node:path";
-
-const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const BASELINE = join(ROOT, "test-baseline.json");
-const UPDATE = process.argv.includes("--update");
-
-// Run the suite exactly the way `npm test` does, so the gate can never pass
-// against a different set of files or env than the suite CI actually runs.
-const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
-const testCmd = pkg.scripts?.test;
-if (!testCmd) {
-  console.error("check-test-count: package.json has no test script");
-  process.exit(1);
-}
-
-const run = spawnSync("sh", ["-c", testCmd], {
-  cwd: ROOT,
-  encoding: "utf8",
-  maxBuffer: 64 * 1024 * 1024,
-});
-
-const output = `${run.stdout || ""}${run.stderr || ""}`;
-
-// node --test emits two different summary formats. Interactive (TTY) gives the
-// spec reporter's "ℹ tests 729". Non-interactive — which is every CI run —
-// gives TAP: "# tests 729". Parsing only the first shape passed locally and
-// failed in CI, which is the same stale-measurement class this gate exists to
-// catch, so match both anchored to line start. A test NAME containing
-// "tests 999" lives on an "ok N - ..." line and cannot reach either pattern.
-function summaryValue(label) {
-  const m = output.match(new RegExp(`^\\s*(?:ℹ|i|#)\\s+${label}\\s+(\\d+)\\s*$`, "m"));
-  return m ? Number(m[1]) : null;
-}
-
-const actual = {
-  tests: summaryValue("tests"),
-  pass: summaryValue("pass"),
-  fail: summaryValue("fail"),
-  skipped: summaryValue("skipped"),
-};
-
-if (actual.tests == null || actual.pass == null || actual.fail == null) {
-  console.error("check-test-count: could not parse the node --test summary.");
-  console.error(output.slice(-2000));
-  process.exit(1);
-}
-
-// A red suite is the suite step's job to report, but never let a failing run
-// silently rewrite the baseline.
-if (actual.fail > 0) {
-  console.error(`check-test-count: suite is RED (${actual.fail} failing) — refusing to gate or update.`);
-  console.error(output.slice(-4000));
-  process.exit(1);
-}
-
-if (UPDATE) {
-  writeFileSync(BASELINE, `${JSON.stringify(actual, null, 2)}\n`);
-  console.log(`check-test-count: baseline updated -> ${JSON.stringify(actual)}`);
-  console.log("Commit test-baseline.json in the same commit as the test change.");
-  process.exit(0);
-}
-
-if (!existsSync(BASELINE)) {
-  console.error(`check-test-count: ${BASELINE} is missing. Create it with --update.`);
-  process.exit(1);
-}
-
-const expected = JSON.parse(readFileSync(BASELINE, "utf8"));
-const drifted = ["tests", "pass", "fail", "skipped"].filter(
-  (k) => Number(expected[k]) !== Number(actual[k]),
-);
-
-if (drifted.length) {
-  console.error("check-test-count: TEST COUNT DRIFT");
-  console.error(`  expected  ${JSON.stringify(expected)}`);
-  console.error(`  actual    ${JSON.stringify(actual)}`);
-  console.error(`  differs   ${drifted.join(", ")}`);
-  console.error("");
-  console.error("If this change is intentional, run:");
-  console.error("  npm run test:count:update");
-  console.error("and commit test-baseline.json alongside the test change.");
-  process.exit(1);
-}
-
-console.log(`check-test-count: PASS — ${JSON.stringify(actual)} matches the committed baseline`);

package/scripts/e2e-hl-markets.mjs

@@ -1,21 +0,0 @@
-import { data as desk } from "../src/data/desk-data.mjs";
-
-const board = await desk.call("hl-markets", "markets", {});
-console.log(`markets: ${board.count} live perps`);
-console.log(`total OI:  $${(board.totals.openInterestUsd / 1e9).toFixed(2)}B`);
-console.log(`24h vol:   $${(board.totals.dayNtlVolumeUsd / 1e9).toFixed(2)}B`);
-
-const btc = board.markets.find((m) => m.coin === "BTC");
-console.log(`\nBTC  mark=$${btc.markPx}  24h=${btc.change24hPct?.toFixed(2)}%  OI=$${(btc.openInterestUsd / 1e6).toFixed(1)}M  fundingAPR=${btc.fundingRateAprPct?.toFixed(2)}%  maxLev=${btc.maxLeverage}x`);
-
-const lb = await desk.call("hl-markets", "leaderboards", { limit: 3 });
-console.log(`\ntop gainers:  ${lb.gainers.map((m) => `${m.coin} ${m.change24hPct.toFixed(1)}%`).join(", ")}`);
-console.log(`top losers:   ${lb.losers.map((m) => `${m.coin} ${m.change24hPct.toFixed(1)}%`).join(", ")}`);
-console.log(`by volume:    ${lb.byVolume.map((m) => `${m.coin} $${(m.dayNtlVolumeUsd / 1e6).toFixed(0)}M`).join(", ")}`);
-console.log(`funding high: ${lb.fundingHighest.map((m) => `${m.coin} ${m.fundingRateAprPct.toFixed(1)}%`).join(", ")}`);
-
-const hype = await desk.call("hl-markets", "coin", { coin: "HYPE", interval: "1h" });
-console.log(`\nHYPE mark=$${hype.market.markPx}  spread=${hype.book.spreadBps?.toFixed(2)}bps  candles=${hype.candles.count}`);
-
-const spot = await desk.call("hl-markets", "spot", {});
-console.log(`spot: ${spot.tokenCount} tokens / ${spot.pairCount} pairs`);

package/scripts/e2e-hl-perps.mjs

@@ -1,48 +0,0 @@
-import { data as desk } from "../src/data/desk-data.mjs";
-
-const info = await desk.call("hl-perps", "assetInfo", { coin: "BTC" });
-console.log(`BTC assetId=${info.assetId} szDecimals=${info.szDecimals} maxLev=${info.maxLeverage}x mark=$${info.markPx}`);
-
-// 1. LIMIT BUY
-const lim = await desk.call("hl-perps", "prepareOrder", {
-  coin: "BTC", side: "buy", type: "limit", price: "60000.123456789", size: "0.0123456", tif: "Gtc",
-});
-console.log(`\nLIMIT BUY  px=${lim.price} sz=${lim.size} notional=$${lim.notionalUsd?.toFixed(2)} tif=${JSON.stringify(lim.action.orders[0].t)}`);
-console.log(`  signingReady=${lim.signingReady} broadcastReady=${lim.broadcastReady} requiresUserSig=${lim.requiresUserSignature}`);
-
-// 2. MARKET BUY with slippage cap
-const mkt = await desk.call("hl-perps", "prepareOrder", {
-  coin: "ETH", side: "buy", type: "market", size: "0.5", maxSlippageBps: 50,
-});
-console.log(`\nMARKET BUY ETH  aggressive px=${mkt.price} sz=${mkt.size} tif=${mkt.action.orders[0].t.limit.tif}`);
-
-// 3. slippage cap enforced
-try {
-  await desk.call("hl-perps", "prepareOrder", { coin: "ETH", side: "buy", type: "market", size: "1", maxSlippageBps: 500 });
-  console.log("  !! 500bps ACCEPTED — cap broken");
-} catch (e) { console.log(`  500bps rejected: ${e.message.slice(0, 60)}`); }
-
-// 4. LEVERAGE
-const lev = await desk.call("hl-perps", "prepareLeverage", { coin: "BTC", leverage: 25, marginMode: "isolated" });
-console.log(`\nLEVERAGE  ${lev.leverage}x ${lev.marginMode}  isCross=${lev.action.isCross}`);
-console.log(`  warning: ${lev.liquidationWarning}`);
-
-try {
-  await desk.call("hl-perps", "prepareLeverage", { coin: "BTC", leverage: 999 });
-  console.log("  !! 999x ACCEPTED — cap broken");
-} catch (e) { console.log(`  999x rejected: ${e.message.slice(0, 70)}`); }
-
-// 5. BRACKET: entry + TP + SL
-const br = await desk.call("hl-perps", "prepareBracket", {
-  coin: "BTC", side: "buy", type: "limit", price: "60000", size: "0.01",
-  takeProfitPx: "72000", stopLossPx: "57000",
-});
-console.log(`\nBRACKET  legs=${br.legs} entry=${br.entry.price} tp=${br.takeProfitPx} sl=${br.stopLossPx} grouping=${br.action.grouping}`);
-console.log(`  tp reduceOnly=${br.action.orders[1].r} trigger=${JSON.stringify(br.action.orders[1].t.trigger)}`);
-console.log(`  sl reduceOnly=${br.action.orders[2].r} trigger=${JSON.stringify(br.action.orders[2].t.trigger)}`);
-
-// 6. CANCEL
-const c = await desk.call("hl-perps", "prepareCancel", { coin: "BTC", orderId: 12345 });
-console.log(`\nCANCEL  oid=${c.orderId} action=${JSON.stringify(c.action)}`);
-
-console.log("\nNo submit function exists in hl-perps — every result is user-signed.");