@oracle-agent/oracle 0.24.10 → 0.25.0

package/dist/cli/commands/receipt.mjs

@@ -1,5 +1,5 @@
-var E={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},V=new Map(Object.values(E).map(r=>[r.chainId,r]));function f(r){let o=r?.transactionHash||r?.hash||r?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Transaction as Kt}from"@scure/btc-signer";import{ed25519 as Xt}from"@noble/curves/ed25519.js";import{base58 as Pr}from"@scure/base";import{Interface as _,MaxUint256 as _e,isAddress as Le,keccak256 as Ne,toUtf8Bytes as ke}from"ethers";import{Interface as T,isAddress as ce}from"ethers";import{isAddress as te}from"ethers";var de=new T(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as I,isAddress as he}from"ethers";var Se=new I(["function approve(address spender,uint256 amount) returns (bool)"]),ye=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Fe=new _(["function approve(address spender,uint256 amount) returns (bool)"]);var qe=300*1e3,Ue=(()=>{let r=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(r)&&r>0?r:1800*1e3})();import{Address as Ve,NETWORK as He,OutScript as Ge,RawTx as ze,SigHash as Ke,TEST_NETWORK as Ze,Transaction as Xe}from"@scure/btc-signer";import{createHash as N}from"node:crypto";import{base58 as rr}from"@scure/base";import{getCompiledTransactionMessageDecoder as nr}from"@solana/transaction-messages";var S=r=>N("sha256").update(`global:${r}`).digest().subarray(0,8).toString("hex"),or=new Map([[S("route"),{name:"route",prefixBytes:0}],[S("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var R=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var wr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var C=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),gr=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Er=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var B=Object.freeze([...R]),Sr=Object.freeze({...C});import{ed25519 as br}from"@noble/curves/ed25519.js";import{base58 as Ar}from"@scure/base";import{RawTx as Tr,SigHash as Ir,Transaction as _r}from"@scure/btc-signer";import{Transaction as Nr}from"ethers";var Gr=Object.freeze({N:1<<17,r:8,p:1}),zr=256*1024*1024,Kr=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var x=process.env.ORACLE_PUBLIC_DESKTOP==="1",F=x?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),Qr=x?F:w(h(),".config","mad-desk");var ot="0".repeat(64),it=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var at=Promise.resolve();import{Wallet as ht}from"ethers";import{base58 as gt}from"@scure/base";import{ed25519 as St}from"@noble/curves/ed25519.js";import{NETWORK as xt,TEST_NETWORK as bt,WIF as vt,p2wpkh as At}from"@scure/btc-signer";import{pubECDSA as Tt}from"@scure/btc-signer/utils.js";var Sn=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import d from"node:fs";import q from"node:os";import u from"node:path";import{fileURLToPath as U}from"node:url";var j=u.dirname(U(import.meta.url)),On=u.resolve(j,"../..");function v(){return process.env.ORACLE_FAKE_HOME||q.homedir()}function D(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return D()?process.env.ORACLE_CONFIG_DIR||u.join(v(),".config","oracle"):u.join(v(),".config","oracle")}function W(){return u.join(g(),"desk.json")}function J(){return u.join(g(),"env")}function c({force:r=!1}={}){if(c._done&&!r)return c._result||null;c._done=!0;let o={},t=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=J();if(d.existsSync(n))for(let e of d.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let s=i[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t(i[1],s)}}catch{}try{let n=W();if(d.existsSync(n)){let e=JSON.parse(d.readFileSync(n,"utf8"));e&&typeof e=="object"&&(t("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),t("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),t("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),t("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),t("ORACLE_EXEC_URL",e.execUrl),t("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let a=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return a&&(t("ORACLE_DESK_URL",a),t("ORACLE_DATA_URL",a),t("ORACLE_API_URL",a),t("ORACLE_PUBLIC_URL",a),t("MAD_DESK_URL",a)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var jn={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(r){let o=r.argv||[],t={},a=o.indexOf("--hash"),n=o.indexOf("--json");if(a>=0)t={transactionHash:o[a+1]};else if(n>=0)try{t=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
-`),1}let e=f(t);return o.includes("--quiet")?process.stdout.write(`${JSON.stringify(e)}
+var y={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},Y=new Map(Object.values(y).map(r=>[r.chainId,r]));function l(r){let o=r?.transactionHash||r?.hash||r?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Transaction as $n}from"@scure/btc-signer";import{ed25519 as Fn}from"@noble/curves/ed25519.js";import{base58 as wt}from"@scure/base";import{Interface as O,MaxUint256 as Re,isAddress as Be,keccak256 as Pe,toUtf8Bytes as Me}from"ethers";import{Interface as I,isAddress as pe}from"ethers";import{isAddress as se}from"ethers";var ge=new I(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as k,isAddress as be}from"ethers";var ve=new k(["function approve(address spender,uint256 amount) returns (bool)"]),Te=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var De=new O(["function approve(address spender,uint256 amount) returns (bool)"]);var Je=300*1e3,He=(()=>{let r=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(r)&&r>0?r:1800*1e3})();import{Address as Ye,NETWORK as Xe,OutScript as Ze,RawTx as Qe,SigHash as er,TEST_NETWORK as rr,Transaction as tr}from"@scure/btc-signer";import{createHash as N}from"node:crypto";import{base58 as ar}from"@scure/base";import{getCompiledTransactionMessageDecoder as cr}from"@solana/transaction-messages";var E=r=>N("sha256").update(`global:${r}`).digest().subarray(0,8).toString("hex"),ur=new Map([[E("route"),{name:"route",prefixBytes:0}],[E("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var dr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-stake-delegate":"delegate"}),fr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-stake-delegate":"tokenDelegate"});var mr="0x"+"00".repeat(32);var _=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),yr=Object.freeze(_.map(r=>r[0]));var M=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var Br=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var $=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Pr=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Mr=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var q=Object.freeze([...M]),$r=Object.freeze({...$});import{ed25519 as Qr}from"@noble/curves/ed25519.js";import{base58 as rt}from"@scure/base";import{RawTx as nt,SigHash as ot,Transaction as it}from"@scure/btc-signer";import{Transaction as st,keccak256 as ct,verifyTypedData as ut}from"ethers";import{encode as Ur}from"@msgpack/msgpack";import{keccak256 as Dr,verifyTypedData as Wr}from"ethers";var Jr=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Hr=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var Ot=Object.freeze({N:1<<17,r:8,p:1}),Lt=256*1024*1024,Nt=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var S=process.env.ORACLE_PUBLIC_DESKTOP==="1",D=S?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),Bt=S?D:w(h(),".config","mad-desk");var Ft="0".repeat(64),Ut=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var jt=Promise.resolve();import{Wallet as Yt}from"ethers";import{base58 as Zt}from"@scure/base";import{ed25519 as en}from"@noble/curves/ed25519.js";import{NETWORK as tn,TEST_NETWORK as nn,WIF as on,p2wpkh as an}from"@scure/btc-signer";import{pubECDSA as cn}from"@scure/btc-signer/utils.js";var mo=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import f from"node:fs";import J from"node:os";import u from"node:path";import{fileURLToPath as H}from"node:url";var G=u.dirname(H(import.meta.url)),bo=u.resolve(G,"../..");function A(){return process.env.ORACLE_FAKE_HOME||J.homedir()}function V(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return V()?process.env.ORACLE_CONFIG_DIR||u.join(A(),".config","oracle"):u.join(A(),".config","oracle")}function z(){return u.join(g(),"desk.json")}function K(){return u.join(g(),"env")}function c({force:r=!1}={}){if(c._done&&!r)return c._result||null;c._done=!0;let o={},t=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=K();if(f.existsSync(n))for(let e of f.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let s=i[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t(i[1],s)}}catch{}try{let n=z();if(f.existsSync(n)){let e=JSON.parse(f.readFileSync(n,"utf8"));e&&typeof e=="object"&&(t("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),t("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),t("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),t("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),t("ORACLE_EXEC_URL",e.execUrl),t("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let a=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return a&&(t("ORACLE_DESK_URL",a),t("ORACLE_DATA_URL",a),t("ORACLE_API_URL",a),t("ORACLE_PUBLIC_URL",a),t("MAD_DESK_URL",a)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var Mo={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(r){let o=r.argv||[],t={},a=o.indexOf("--hash"),n=o.indexOf("--json");if(a>=0)t={transactionHash:o[a+1]};else if(n>=0)try{t=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
+`),1}let e=l(t);return o.includes("--quiet")?process.stdout.write(`${JSON.stringify(e)}
 `):e.happened?process.stdout.write(`happened  ${e.hash}
 `):process.stdout.write(`did not happen  ${e.note}
-`),e.happened?0:2}};export{jn as default};
+`),e.happened?0:2}};export{Mo as default};

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-import d from"node:fs";import j from"node:path";import T from"node:fs";import ce from"node:os";import y from"node:path";import{fileURLToPath as ue}from"node:url";var fe=y.dirname(ue(import.meta.url)),ir=y.resolve(fe,"../..");function D(){return process.env.ORACLE_FAKE_HOME||ce.homedir()}function le(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function O(){return le()?process.env.ORACLE_CONFIG_DIR||y.join(D(),".config","oracle"):y.join(D(),".config","oracle")}function de(){return y.join(O(),"desk.json")}function pe(){return y.join(O(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},r=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=pe();if(T.existsSync(i))for(let o of T.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let i=de();if(T.existsSync(i)){let o=JSON.parse(T.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),E._result=Object.keys(n).length?n:null,E._result}try{E()}catch{}import{createCipheriv as me,createDecipheriv as he,randomBytes as k,scryptSync as we}from"node:crypto";import a from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",J=1,v=Object.freeze({N:1<<17,r:8,p:1}),ge=256*1024*1024,Ee=16*1024;function I(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function V(e,n,r=v){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return we(t,n,32,{...r,maxmem:ge})}function G(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=k(32),o=k(12),s={magic:W,version:J,kdf:{name:"scrypt",...v,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=V(n,i);try{let l=me("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([l.update(t),l.final()]);return{...s,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function B(e,n){if(e?.magic!==W||e?.version!==J)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==v.N||e.kdf.r!==v.r||e.kdf.p!==v.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=I(e.kdf.salt,32,"salt"),i=I(e.cipher.iv,12,"iv"),o=I(e.tag,16,"tag"),s=I(e.ciphertext,1,"ciphertext",{max:Ee}),{ciphertext:c,tag:l,...u}=e,f=V(n,t);try{let p=he("aes-256-gcm",f,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function ye(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function H(e){let n=m.dirname(e),r=a.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=a.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=a.fstatSync(n);if(ye(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=a.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function R(e){return JSON.parse(w(e))}function z(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),H(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${k(6).toString("hex")}.tmp`),t;try{t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(t,JSON.stringify(n,null,2)+`
-`),a.fsyncSync(t),a.closeSync(t),t=void 0;let i=a.openSync(r,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(r,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(t!==void 0)try{a.closeSync(t)}catch{}try{a.unlinkSync(r)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),H(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${k(6).toString("hex")}.tmp`);try{let t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(t,String(n)),a.fsyncSync(t)}finally{a.closeSync(t)}a.renameSync(r,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(t){try{a.unlinkSync(r)}catch{}throw t}}import h from"node:path";import Ge from"node:os";import{createHash as He,randomBytes as to}from"node:crypto";import{Transaction as oo}from"@scure/btc-signer";import{ed25519 as ao}from"@noble/curves/ed25519.js";import{base58 as Zt}from"@scure/base";import{Interface as Ae,MaxUint256 as Jr,isAddress as Vr,keccak256 as Gr,toUtf8Bytes as Hr}from"ethers";import{Interface as be,isAddress as Ar}from"ethers";import{isAddress as Er}from"ethers";var kr=new be(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ve,isAddress as _r}from"ethers";var Fr=new ve(["function approve(address spender,uint256 amount) returns (bool)"]),Mr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Qr=new Ae(["function approve(address spender,uint256 amount) returns (bool)"]);var rt=300*1e3,tt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as st,NETWORK as ct,OutScript as ut,RawTx as ft,SigHash as lt,TEST_NETWORK as dt,Transaction as pt}from"@scure/btc-signer";import{createHash as Oe}from"node:crypto";import{base58 as gt}from"@scure/base";import{getCompiledTransactionMessageDecoder as yt}from"@solana/transaction-messages";var K=e=>Oe("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),St=new Map([[K("route"),{name:"route",prefixBytes:0}],[K("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var ke=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var Bt=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var Ne=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Rt=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Ct=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Le=Object.freeze([...ke]),Ft=Object.freeze({...Ne});import{ed25519 as qt}from"@noble/curves/ed25519.js";import{base58 as Ut}from"@scure/base";import{RawTx as Dt,SigHash as Wt,Transaction as Jt}from"@scure/btc-signer";import{Transaction as Gt}from"ethers";import{createHmac as Ce,randomBytes as bn,timingSafeEqual as Fe}from"node:crypto";import Me from"node:fs";import S from"node:path";import{homedir as M}from"node:os";import{join as P}from"node:path";var Z=process.env.ORACLE_PUBLIC_DESKTOP==="1",Re=Z?process.env.ORACLE_CONFIG_DIR||P(M(),".config","oracle"):P(M(),".config","oracle"),dn=Z?Re:P(M(),".config","mad-desk");var gn="0".repeat(64),En=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+L(e[r])).join(",")+"}"}var yn=Promise.resolve();function Pe(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=s=>{try{return Me.realpathSync(s)}catch{return S.resolve(s)}},t=r(S.dirname(S.resolve(e))),i=r(S.dirname(S.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+S.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var q=(e,n)=>Ce("sha256",n).update(L(e)).digest("hex"),qe=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&Fe(r,t)};function $e(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(t,n)}}}function Y(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!qe(t?.integrity?.mac,q(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Ue(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Y(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(t)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(s,r)}})+`
-`)}function Q(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=Y(t,i);Pe(t,e);let s=Number(o.sequence||0)+1,c=$e(r,i,{sequence:s});Ue(t,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
-`)}import{Wallet as $}from"ethers";import{base58 as re}from"@scure/base";import{ed25519 as je}from"@noble/curves/ed25519.js";import{NETWORK as te,TEST_NETWORK as ne,WIF as De,p2wpkh as ee}from"@scure/btc-signer";import{pubECDSA as We}from"@scure/btc-signer/utils.js";var Je=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},Ve=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},x=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function b(e,n){let r=String(n||"").trim();if(e==="evm")return new $(r).privateKey;if(e==="btc")for(let o of[te,ne])try{return Buffer.from(De(o).decode(r))}catch{}if(e==="sol")try{return x(re.decode(r),"sol")}catch{}let t=Je(r);if(t)return e==="evm"?new $(`0x${t.toString("hex")}`).privateKey:x(t,e);let i=Ve(r);if(i)return x(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return x(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return b(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let r=new $(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=x(n,"btc"),t=We(r);return{kind:e,secret:r.toString("hex"),addresses:[ee(t,te).address,ee(t,ne).address]}}if(e==="sol"){let r=x(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[re.encode(je.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function U(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=A(o,b(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function oe(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ie(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function ae(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(Ge.homedir(),".local","state"),"oracle"),r=He("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as ze}from"node:crypto";import{Wallet as Ke}from"ethers";var se=`oracle sign init|import|policy|status|lock|doctor
+import d from"node:fs";import U from"node:path";import T from"node:fs";import ce from"node:os";import E from"node:path";import{fileURLToPath as ue}from"node:url";var le=E.dirname(ue(import.meta.url)),lr=E.resolve(le,"../..");function j(){return process.env.ORACLE_FAKE_HOME||ce.homedir()}function fe(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function k(){return fe()?process.env.ORACLE_CONFIG_DIR||E.join(j(),".config","oracle"):E.join(j(),".config","oracle")}function de(){return E.join(k(),"desk.json")}function pe(){return E.join(k(),"env")}function y({force:e=!1}={}){if(y._done&&!e)return y._result||null;y._done=!0;let n={},r=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=pe();if(T.existsSync(i))for(let o of T.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let i=de();if(T.existsSync(i)){let o=JSON.parse(T.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),y._result=Object.keys(n).length?n:null,y._result}try{y()}catch{}import{createCipheriv as me,createDecipheriv as he,randomBytes as O,scryptSync as we}from"node:crypto";import a from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",J=1,A=Object.freeze({N:1<<17,r:8,p:1}),ge=256*1024*1024,ye=16*1024;function I(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function H(e,n,r=A){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return we(t,n,32,{...r,maxmem:ge})}function V(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),s={magic:W,version:J,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=H(n,i);try{let f=me("aes-256-gcm",c,o);f.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([f.update(t),f.final()]);return{...s,ciphertext:u.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function B(e,n){if(e?.magic!==W||e?.version!==J)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=I(e.kdf.salt,32,"salt"),i=I(e.cipher.iv,12,"iv"),o=I(e.tag,16,"tag"),s=I(e.ciphertext,1,"ciphertext",{max:ye}),{ciphertext:c,tag:f,...u}=e,l=H(n,t);try{let p=he("aes-256-gcm",l,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{l.fill(0)}}function Ee(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function G(e){let n=m.dirname(e),r=a.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=a.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=a.fstatSync(n);if(Ee(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=a.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function C(e){return JSON.parse(w(e))}function z(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),G(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),t;try{t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(t,JSON.stringify(n,null,2)+`
+`),a.fsyncSync(t),a.closeSync(t),t=void 0;let i=a.openSync(r,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(r,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(t!==void 0)try{a.closeSync(t)}catch{}try{a.unlinkSync(r)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),G(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(t,String(n)),a.fsyncSync(t)}finally{a.closeSync(t)}a.renameSync(r,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(t){try{a.unlinkSync(r)}catch{}throw t}}import h from"node:path";import Xe from"node:os";import{createHash as Ze,randomBytes as Jo}from"node:crypto";import{Transaction as Vo}from"@scure/btc-signer";import{ed25519 as zo}from"@noble/curves/ed25519.js";import{base58 as Cn}from"@scure/base";import{Interface as ve,MaxUint256 as Kr,isAddress as Yr,keccak256 as Xr,toUtf8Bytes as Zr}from"ethers";import{Interface as xe,isAddress as Lr}from"ethers";import{isAddress as Ar}from"ethers";var Cr=new xe(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Ae,isAddress as Mr}from"ethers";var Dr=new Ae(["function approve(address spender,uint256 amount) returns (bool)"]),Ur=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var ot=new ve(["function approve(address spender,uint256 amount) returns (bool)"]);var at=300*1e3,st=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as dt,NETWORK as pt,OutScript as mt,RawTx as ht,SigHash as wt,TEST_NETWORK as gt,Transaction as yt}from"@scure/btc-signer";import{createHash as ke}from"node:crypto";import{base58 as xt}from"@scure/base";import{getCompiledTransactionMessageDecoder as vt}from"@solana/transaction-messages";var K=e=>ke("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Tt=new Map([[K("route"),{name:"route",prefixBytes:0}],[K("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var It=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-stake-delegate":"delegate"}),Ot=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-stake-delegate":"tokenDelegate"});var Nt="0x"+"00".repeat(32);var Ie=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Pt=Object.freeze(Ie.map(e=>e[0]));var Be=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var Yt=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var Ce=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Xt=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Zt=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Pe=Object.freeze([...Be]),Qt=Object.freeze({...Ce});import{ed25519 as wn}from"@noble/curves/ed25519.js";import{base58 as yn}from"@scure/base";import{RawTx as bn,SigHash as Sn,Transaction as xn}from"@scure/btc-signer";import{Transaction as vn,keccak256 as Tn,verifyTypedData as kn}from"ethers";import{encode as tn}from"@msgpack/msgpack";import{keccak256 as on,verifyTypedData as an}from"ethers";var sn=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),cn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as $e,randomBytes as no,timingSafeEqual as De}from"node:crypto";import Ue from"node:fs";import b from"node:path";import{homedir as M}from"node:os";import{join as F}from"node:path";var X=process.env.ORACLE_PUBLIC_DESKTOP==="1",qe=X?process.env.ORACLE_CONFIG_DIR||F(M(),".config","oracle"):F(M(),".config","oracle"),Gn=X?qe:F(M(),".config","mad-desk");var Zn="0".repeat(64),Qn=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function N(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(N).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+N(e[r])).join(",")+"}"}var eo=Promise.resolve();function je(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=s=>{try{return Ue.realpathSync(s)}catch{return b.resolve(s)}},t=r(b.dirname(b.resolve(e))),i=r(b.dirname(b.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+b.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var q=(e,n)=>$e("sha256",n).update(N(e)).digest("hex"),We=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&De(r,t)};function Je(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(t,n)}}}function Z(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!We(t?.integrity?.mac,q(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function He(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Z(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(t)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(s,r)}})+`
+`)}function Q(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=Z(t,i);je(t,e);let s=Number(o.sequence||0)+1,c=Je(r,i,{sequence:s});He(t,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
+`)}import{Wallet as $}from"ethers";import{base58 as re}from"@scure/base";import{ed25519 as Ve}from"@noble/curves/ed25519.js";import{NETWORK as te,TEST_NETWORK as ne,WIF as Ge,p2wpkh as ee}from"@scure/btc-signer";import{pubECDSA as ze}from"@scure/btc-signer/utils.js";var Ke=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},Ye=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},S=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function x(e,n){let r=String(n||"").trim();if(e==="evm")return new $(r).privateKey;if(e==="btc")for(let o of[te,ne])try{return Buffer.from(Ge(o).decode(r))}catch{}if(e==="sol")try{return S(re.decode(r),"sol")}catch{}let t=Ke(r);if(t)return e==="evm"?new $(`0x${t.toString("hex")}`).privateKey:S(t,e);let i=Ye(r);if(i)return S(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return S(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return x(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let r=new $(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=S(n,"btc"),t=ze(r);return{kind:e,secret:r.toString("hex"),addresses:[ee(t,te).address,ee(t,ne).address]}}if(e==="sol"){let r=S(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[re.encode(Ve.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function D(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",x(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=v(o,x(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function oe(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ie(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function ae(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(Xe.homedir(),".local","state"),"oracle"),r=Ze("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as Qe}from"node:crypto";import{Wallet as er}from"ethers";var se=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -11,14 +11,14 @@ import d from"node:fs";import j from"node:path";import T from"node:fs";import ce
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},Xe=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Ze(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let l of c){if(l===3){s(),t(new Error("cancelled"));return}if(l===13||l===10){s(),process.stderr.write(`
-`),r(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function Ye(e,n){let r=_(e,"--passphrase-file");return r?w(r):Ze("Vault passphrase: ",n)}function Qe(e){return e.addresses.join(", ")}async function er(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||O(),o=ae(j.join(i,"signer"));if(!t||t==="help")return r.write(se+`
+They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},rr=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function tr(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let f of c){if(f===3){s(),t(new Error("cancelled"));return}if(f===13||f===10){s(),process.stderr.write(`
+`),r(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function nr(e,n){let r=_(e,"--passphrase-file");return r?w(r):tr("Vault passphrase: ",n)}function or(e){return e.addresses.join(", ")}async function ir(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||k(),o=ae(U.join(i,"signer"));if(!t||t==="help")return r.write(se+`
 `),0;if(t==="status")return r.write(JSON.stringify({initialized:d.existsSync(o.vault),policyConfigured:d.existsSync(o.policy),armed:d.existsSync(o.vault)&&!d.existsSync(o.lock),disarmed:d.existsSync(o.lock)})+`
-`),0;if(t==="lock")return d.mkdirSync(j.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
+`),0;if(t==="lock")return d.mkdirSync(U.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),r.write(`Local signer locked.
 `),0;if(t==="doctor"){let u=[];return d.existsSync(o.vault)||u.push("vault missing"),d.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),r.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
-`),u.length?1:0}if(t==="policy"){if(!d.existsSync(o.vault)||!d.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=_(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let f;try{f=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(f[p])||f[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return Q(o.policy,o.policyKey,f,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let s=await Ye(e,n),c={};if(d.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=R(o.vault),f=B(u,s);try{c=U(f,u.meta)}finally{f.fill(0)}}if(t==="init"){let u=Ke.createRandom();c.evm=A("evm",b("evm",u.privateKey))}else{let u=Xe(e),f=_(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");c[u]=A(u,b(u,w(f)))}d.mkdirSync(j.dirname(o.vault),{recursive:!0,mode:448}),z(o.vault,G(oe(c),s,ie(c))),d.existsSync(o.policyKey)||g(o.policyKey,ze(32).toString("hex")+`
-`);let l=Object.entries(c).map(([u,f])=>`${u}:${Qe(f)}`).join(" ");return r.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
-`),0}var Lo={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:se,run:e=>er(e.argv||[])};export{Lo as default,er as run};
+`),u.length?1:0}if(t==="policy"){if(!d.existsSync(o.vault)||!d.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=_(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let l;try{l=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(l[p])||l[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return Q(o.policy,o.policyKey,l,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let s=await nr(e,n),c={};if(d.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=C(o.vault),l=B(u,s);try{c=D(l,u.meta)}finally{l.fill(0)}}if(t==="init"){let u=er.createRandom();c.evm=v("evm",x("evm",u.privateKey))}else{let u=rr(e),l=_(e,"--key-file");if(!l)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,x(u,w(l)))}d.mkdirSync(U.dirname(o.vault),{recursive:!0,mode:448}),z(o.vault,V(oe(c),s,ie(c))),d.existsSync(o.policyKey)||g(o.policyKey,Qe(32).toString("hex")+`
+`);let f=Object.entries(c).map(([u,l])=>`${u}:${or(l)}`).join(" ");return r.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
+`),0}var vi={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:se,run:e=>ir(e.argv||[])};export{vi as default,ir as run};