@oracle-agent/oracle 0.24.8 → 0.24.10

package/dist/cli/commands/setup.mjs

@@ -1,51 +1,51 @@
-import{spawnSync as bt}from"node:child_process";import{stdin as O,stdout as be}from"node:process";var Q=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function he(e){return String(e||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function F(){return Q.slice()}function D(e){let t=he(e);if(!t)return null;for(let r of Q)if(r.key===t||he(r.name)===t)return r;return null}function me({profile:e="oracle",statuses:t={}}={}){let r=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${e}`,"","messaging platforms:",""];for(let o of Q){let n=t[o.key]||"unset";r.push(`  ${o.key.padEnd(16)} ${String(n).padEnd(8)}  ${o.note}`)}return r.push(""),r.push("commands:"),r.push("  oracle setup                 this menu"),r.push("  oracle setup messaging       open hermes gateway setup"),r.push("  oracle setup telegram        configure telegram bot token"),r.push("  oracle setup discord         configure discord bot token"),r.push("  oracle setup status          show configured platforms (no secrets)"),r.push("  oracle setup gateway         start/status hermes gateway"),r.push("  /setup                       same menu inside chat"),r.push(""),r.push("notes:"),r.push("  tokens stay in the hermes profile .env on this machine"),r.push("  oracle never prints bot tokens or app secrets"),r.push("  after setup: hermes -p oracle gateway restart"),r.join(`
+import{spawnSync as bt}from"node:child_process";import{stdin as b,stdout as Pe}from"node:process";var Q=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function he(e){return String(e||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function F(){return Q.slice()}function D(e){let t=he(e);if(!t)return null;for(let r of Q)if(r.key===t||he(r.name)===t)return r;return null}function me({profile:e="oracle",statuses:t={}}={}){let r=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${e}`,"","messaging platforms:",""];for(let o of Q){let n=t[o.key]||"unset";r.push(`  ${o.key.padEnd(16)} ${String(n).padEnd(8)}  ${o.note}`)}return r.push(""),r.push("commands:"),r.push("  oracle setup                 this menu"),r.push("  oracle setup messaging       open hermes gateway setup"),r.push("  oracle setup telegram        configure telegram bot token"),r.push("  oracle setup discord         configure discord bot token"),r.push("  oracle setup status          show configured platforms (no secrets)"),r.push("  oracle setup gateway         start/status hermes gateway"),r.push("  /setup                       same menu inside chat"),r.push(""),r.push("notes:"),r.push("  tokens stay in the hermes profile .env on this machine"),r.push("  oracle never prints bot tokens or app secrets"),r.push("  after setup: hermes -p oracle gateway restart"),r.join(`
 `)+`
-`}import S from"node:fs";import ze from"node:os";import ee from"node:path";import M from"node:fs";import De from"node:os";import A from"node:path";import{fileURLToPath as Me}from"node:url";var Ne=A.dirname(Me(import.meta.url)),Dt=A.resolve(Ne,"../..");function H(){return process.env.ORACLE_FAKE_HOME||De.homedir()}function Ke(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function k(){return Ke()?process.env.ORACLE_CONFIG_DIR||A.join(H(),".config","oracle"):A.join(H(),".config","oracle")}function Fe(){return A.join(k(),"desk.json")}function He(){return A.join(k(),"env")}function R({force:e=!1}={}){if(R._done&&!e)return R._result||null;R._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=He();if(M.existsSync(n))for(let s of M.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=Fe();if(M.existsSync(n)){let s=JSON.parse(M.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),R._result=Object.keys(t).length?t:null,R._result}try{R()}catch{}function N(){return process.env.HERMES_HOME?A.resolve(process.env.HERMES_HOME):A.join(H(),".hermes")}function _(e){return M.mkdirSync(e,{recursive:!0}),e}var qe=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function z(e="oracle"){return ee.join(N(),"profiles",e,".env")}function Be(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function We(e="oracle"){let t=z(e);return S.existsSync(t)?Be(S.readFileSync(t,"utf8")):{}}function ge(e,t,r){if(!t||qe.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let f=new Error(`invalid env key '${t}'`);throw f.code="BAD_KEY",f}if(r==null||String(r).trim()===""){let f=new Error(`empty value for ${t}`);throw f.code="EMPTY",f}let o=z(e);_(ee.dirname(o));let n=S.existsSync(o)?S.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let f of s)f.startsWith(`${t}=`)?(i.push(c),a=!0):(f.length||i.length)&&i.push(f);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),S.writeFileSync(o,i.join(`
-`),{mode:384});try{S.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function q(e="oracle"){let t=We(e),r={};for(let o of F()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:z(e)}}function B(e="oracle"){let{statuses:t}=q(e);return me({profile:e,statuses:t})}function ye(e,t,r,o={}){let n=D(t);if(!n){let i=new Error(`unknown platform '${t}'`);throw i.code="UNKNOWN_PLATFORM",i}if(!n.required.length){let i=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw i.code="NEEDS_INTERACTIVE",i}let s=n.required[0];ge(e,s,r);for(let[i,a]of Object.entries(o||{}))a!=null&&String(a).trim()&&ge(e,i,a);return{platform:n.key,set:n.required,profile:e,path:z(e)}}function Ve(){return ee.join(k(),"setup-state.json")}function W(e={}){_(k());let t=Ve(),r={};if(S.existsSync(t))try{r=JSON.parse(S.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:ze.hostname()};return S.writeFileSync(t,JSON.stringify(o,null,2)+`
-`,{mode:384}),o}import ve from"node:fs";import L from"node:path";var Je="0.19.0",Jt=`hermes-agent==${Je}`;var we="0.12.1",Gt=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${we}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${we}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Ge(){return L.join(k(),"runtime")}function Ye(){return L.join(Ge(),"venv")}function Xe(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return L.join(Ye(),t,r)}function Ze(){return Xe("hermes")}function Qe(e){let t=process.platform==="win32"&&!L.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(L.delimiter))if(r)for(let o of t){let n=L.join(r,`${e}${o}`);try{if(ve.existsSync(n))return n}catch{}}return null}function ke(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=Ze();if(ve.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=Qe("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as et,randomBytes as oe,timingSafeEqual as tt}from"node:crypto";import w from"node:fs";import x from"node:path";import rt from"node:readline/promises";import{spawn as ot,spawnSync as nt}from"node:child_process";var I=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),st=12e4;function it(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function b(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(I))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function K(e){let t=b(e);return{id:t,...I[t]}}function g(e,t={}){if(!w.existsSync(e))return t;try{let r=JSON.parse(w.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function xe(e){_(e),process.platform!=="win32"&&w.chmodSync(e,448)}function E(e,t){xe(x.dirname(e));let r=`${e}.${process.pid}.${oe(4).toString("hex")}.tmp`;w.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),w.renameSync(r,e),process.platform!=="win32"&&w.chmodSync(e,384)}function at(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function te(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function $(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function ct(e={}){let t=e.file||x.join(k(),"oauth.json"),r=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),o=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||nt,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&at(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function f(h){xe(x.dirname(c));let d;for(let u=0;u<400;u+=1)try{d=w.openSync(c,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-w.statSync(c).mtimeMs>3e5&&w.unlinkSync(c)}catch{}await new Promise(p=>setTimeout(p,25))}if(d===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await h()}finally{try{w.closeSync(d)}catch{}try{w.unlinkSync(c)}catch{}}}function y(h,d="oauth"){return["application","oracle","kind",d,"provider",h]}function j(h){if(!w.existsSync(o))return null;let u=g(o,{providers:{}}).providers?.[h];if(!Array.isArray(u))return null;let l=[];for(let p of u)if(x.isAbsolute(String(p||"")))try{let m=g(p,{});if(h==="anthropic-oauth"&&m.claudeAiOauth){let T=$(m.claudeAiOauth);l.push({...T,refreshToken:"",source:"external-access-only"});continue}let v=m.credential_pool&&typeof m.credential_pool=="object"?m.credential_pool:null;if(v){let T=v[h]||v[h.replace(/-oauth$/,"")]||[],Ue=Array.isArray(T)?T:T?[T]:[];for(let Z of Ue)if(!(!Z||typeof Z!="object"))try{let je=$(Z);l.push({...je,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(p=>!p.expiresAt||p.expiresAt>n()+st)||l[0]:null}function de(h){let d=b(h);if(i){let p=s("secret-tool",["lookup",...y(d)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!p.error&&p.status===0&&String(p.stdout||"").trim())try{return $(JSON.parse(String(p.stdout).trim()))}catch{}return j(d)}let l=g(t,{providers:{}}).providers?.[d];if(l)try{return $(l)}catch{}return j(d)}function Re(h,d){let u=b(h),l=$(d);if(i){let m=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...y(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(m.error||m.status!==0)throw new Error("OS credential store rejected OAuth credential");let v=g(r,{providers:{}});return v.providers||={},v.providers[u]={expiresAt:l.expiresAt,source:l.source},E(r,v),l}let p=g(t,{providers:{}});return p.providers||={},p.providers[u]=l,E(t,p),l}function Le(h){let d=b(h);if(i){let p=s("secret-tool",["clear",...y(d)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),m=g(r,{providers:{}});return m.providers&&delete m.providers[d],E(r,m),!p.error&&p.status===0}let u=g(t,{providers:{}}),l=!!u.providers?.[d];return u.providers&&delete u.providers[d],E(t,u),l}function fe(h){let d=te(h);if(i){let u=s("secret-tool",["lookup",...y(d,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(g(t,{apiKeys:{}}).apiKeys?.[d]||"").trim()}function $e(h,d){let u=te(h),l=String(d||"").trim();if(!l)throw new Error("API key is empty");if(i){let m=s("secret-tool",["store",`--label=Oracle ${u} API key`,...y(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(m.error||m.status!==0)throw new Error("OS credential store rejected API key");let v=g(r,{providers:{},apiKeys:{}});return v.apiKeys||={},v.apiKeys[u]={configured:!0},E(r,v),!0}let p=g(t,{providers:{},apiKeys:{}});return p.apiKeys||={},p.apiKeys[u]=l,E(t,p),!0}function Ie(h){let d=te(h);if(i){let p=s("secret-tool",["clear",...y(d,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),m=g(r,{providers:{},apiKeys:{}});return m.apiKeys&&delete m.apiKeys[d],E(r,m),!p.error&&p.status===0}let u=g(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[d];return u.apiKeys&&delete u.apiKeys[d],E(t,u),l}function Ce(){let h={},d={};if(i){let u=g(r,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))h[l]={loggedIn:!!de(l),expiresAt:Number(p.expiresAt||0),source:String(p.source||"oracle"),storage:a};for(let l of Object.keys(u.apiKeys||{}))d[l]={configured:!!fe(l),storage:a}}else{let u=g(t,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))h[l]={loggedIn:!!p?.accessToken,expiresAt:Number(p?.expiresAt||0),source:String(p?.source||"oracle"),storage:a};for(let[l,p]of Object.entries(u.apiKeys||{}))d[l]={configured:!!p,storage:a}}for(let u of Object.keys(I)){if(h[u])continue;let l=j(u);l&&(h[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:a,providers:h,apiKeys:d}}return Object.freeze({file:t,storage:a,get:de,set:Re,remove:Le,getApiKey:fe,setApiKey:$e,removeApiKey:Ie,status:Ce,withLock:f})}var Se;function C(){return Se||=ct(),Se}function re(e){return Buffer.from(e).toString("base64url")}function ut(){let e=re(oe(32));return{verifier:e,challenge:re(et("sha256").update(e).digest()),state:re(oe(24))}}function lt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&tt(r,o)}function pt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return ot(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ne(e){return new URLSearchParams(e).toString()}async function P(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function dt(e){if(e)return String(await e()).trim();let t=rt.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function se(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return $({accessToken:r,refreshToken:o,expiresAt:it(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function ft(e){let t=I["anthropic-oauth"],r=e.pkce||ut(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await dt(e.inputFn),[i,a]=s.split("#",2);if(!i||!lt(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return se(await P(c,"Claude OAuth token exchange"),e)}async function ht(e){let t=I["openai-codex"],r=await P(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await P(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ne({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return se(await P(i,"Codex OAuth token exchange"),e)}function V(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function mt(e){let t=I["xai-oauth"],r=await P(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");V(r.authorization_endpoint);let o=V(r.token_endpoint),n=await P(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=V(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let f=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(f.ok){let j=await P(f,"xAI OAuth token exchange");return se(j,{...e,discovery:{authorization_endpoint:V(r.authorization_endpoint),token_endpoint:o}})}let y="";try{y=String((await f.json())?.error||"")}catch{}if(y==="slow_down")await e.sleepFn((i+1)*1e3);else if(y==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${f.status}${y?`, ${y}`:""})`)}throw new Error("xAI device authorization timed out")}async function Ae(e,t={}){let r=b(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||pt,output:t.output||(n=>process.stdout.write(`${n}
-`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?ft(o):r==="openai-codex"?ht(o):mt(o)}import Y from"node:fs";import ie from"node:path";var gt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","custom","anthropic-oauth","openai-codex","xai-oauth"]);function J(e){return String(e||"").trim()||void 0}function yt(e,{required:t=!1}={}){let r=J(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!gt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function wt(e,{required:t=!1}={}){let r=J(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function vt(e){let t=J(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function G({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=yt(e),s=wt(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:vt(r)};if(J(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var kt=new Set(["auto","standalone","hermes","remote","arch"]);function St(){return ie.join(k(),"model.json")}function U(e){return String(e||"").trim()||void 0}function xt(e={}){let t=U(e.backend)?.toLowerCase()||"auto",r=G({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=U(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=U(e.reasoningEffort),i=U(e.computeHost||e.remoteHost),a=U(e.computeUser||e.remoteUser),c=U(e.computePath||e.remotePath);if(!kt.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function _e(e){let t=xt(e),r=St();_(ie.dirname(r)),process.platform!=="win32"&&Y.chmodSync(ie.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return Y.writeFileSync(o,`${JSON.stringify(t,null,2)}
-`,{mode:384}),Y.renameSync(o,r),process.platform!=="win32"&&Y.chmodSync(r,384),t}var Ee=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},custom:{model:""}});function ae(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function At(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function _t(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`}import E from"node:fs";import qe from"node:os";import ee from"node:path";import N from"node:fs";import Ne from"node:os";import A from"node:path";import{fileURLToPath as Me}from"node:url";var Ke=A.dirname(Me(import.meta.url)),Dt=A.resolve(Ke,"../..");function H(){return process.env.ORACLE_FAKE_HOME||Ne.homedir()}function Fe(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function k(){return Fe()?process.env.ORACLE_CONFIG_DIR||A.join(H(),".config","oracle"):A.join(H(),".config","oracle")}function He(){return A.join(k(),"desk.json")}function ze(){return A.join(k(),"env")}function $({force:e=!1}={}){if($._done&&!e)return $._result||null;$._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=ze();if(N.existsSync(n))for(let s of N.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=He();if(N.existsSync(n)){let s=JSON.parse(N.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),$._result=Object.keys(t).length?t:null,$._result}try{$()}catch{}function M(){return process.env.HERMES_HOME?A.resolve(process.env.HERMES_HOME):A.join(H(),".hermes")}function _(e){return N.mkdirSync(e,{recursive:!0}),e}var Be=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function z(e="oracle"){return ee.join(M(),"profiles",e,".env")}function We(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function we(e="oracle"){let t=z(e);return E.existsSync(t)?We(E.readFileSync(t,"utf8")):{}}function ge(e,t,r){if(!t||Be.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let h=new Error(`invalid env key '${t}'`);throw h.code="BAD_KEY",h}if(r==null||String(r).trim()===""){let h=new Error(`empty value for ${t}`);throw h.code="EMPTY",h}let o=z(e);_(ee.dirname(o));let n=E.existsSync(o)?E.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let h of s)h.startsWith(`${t}=`)?(i.push(c),a=!0):(h.length||i.length)&&i.push(h);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),E.writeFileSync(o,i.join(`
+`),{mode:384});try{E.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function q(e="oracle"){let t=we(e),r={};for(let o of F()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:z(e)}}function B(e="oracle"){let{statuses:t}=q(e);return me({profile:e,statuses:t})}function ye(e,t,r,o={}){let n=D(t);if(!n){let d=new Error(`unknown platform '${t}'`);throw d.code="UNKNOWN_PLATFORM",d}if(!n.required.length){let d=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw d.code="NEEDS_INTERACTIVE",d}let i=n.required.filter(d=>/(TOKEN|PASSWORD|SECRET)$/i.test(d))[0]||(n.required.length===1?n.required[0]:null);if(!i){let d=new Error(`${n.key} has no single token field; provide each of [${n.required.join(", ")}] explicitly`);throw d.code="NEEDS_EXPLICIT_KEYS",d}let a=new Set([i,...Object.keys(o||{}).filter(d=>o[d]!=null&&String(o[d]).trim())]),c=we(e),h=n.required.filter(d=>!a.has(d)&&!String(c[d]||"").trim());if(h.length){let d=new Error(`${n.key} also requires [${h.join(", ")}]; pass them explicitly (setup would otherwise be marked ready while unusable)`);throw d.code="MISSING_REQUIRED",d}ge(e,i,r);for(let[d,S]of Object.entries(o||{}))S!=null&&String(S).trim()&&ge(e,d,S);return{platform:n.key,set:n.required,profile:e,path:z(e)}}function Ve(){return ee.join(k(),"setup-state.json")}function W(e={}){_(k());let t=Ve(),r={};if(E.existsSync(t))try{r=JSON.parse(E.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:qe.hostname()};return E.writeFileSync(t,JSON.stringify(o,null,2)+`
+`,{mode:384}),o}import ke from"node:fs";import L from"node:path";var Je="0.19.0",Jt=`hermes-agent==${Je}`;var ve="0.12.1",Yt=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ve}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ve}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Ye(){return L.join(k(),"runtime")}function Ge(){return L.join(Ye(),"venv")}function Xe(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return L.join(Ge(),t,r)}function Ze(){return Xe("hermes")}function Qe(e){let t=process.platform==="win32"&&!L.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(L.delimiter))if(r)for(let o of t){let n=L.join(r,`${e}${o}`);try{if(ke.existsSync(n))return n}catch{}}return null}function Se(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=Ze();if(ke.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=Qe("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as et,randomBytes as oe,timingSafeEqual as tt}from"node:crypto";import y from"node:fs";import x from"node:path";import rt from"node:readline/promises";import{spawn as ot,spawnSync as nt}from"node:child_process";var C=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),st=12e4;function it(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function P(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(C))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function K(e){let t=P(e);return{id:t,...C[t]}}function w(e,t={}){if(!y.existsSync(e))return t;try{let r=JSON.parse(y.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function xe(e){_(e),process.platform!=="win32"&&y.chmodSync(e,448)}function O(e,t){xe(x.dirname(e));let r=`${e}.${process.pid}.${oe(4).toString("hex")}.tmp`;y.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),y.renameSync(r,e),process.platform!=="win32"&&y.chmodSync(e,384)}function at(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function te(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function I(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function ct(e={}){let t=e.file||x.join(k(),"oauth.json"),r=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),o=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||nt,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&at(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function h(m){xe(x.dirname(c));let f;for(let u=0;u<400;u+=1)try{f=y.openSync(c,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-y.statSync(c).mtimeMs>3e5&&y.unlinkSync(c)}catch{}await new Promise(p=>setTimeout(p,25))}if(f===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await m()}finally{try{y.closeSync(f)}catch{}try{y.unlinkSync(c)}catch{}}}function d(m,f="oauth"){return["application","oracle","kind",f,"provider",m]}function S(m){if(!y.existsSync(o))return null;let u=w(o,{providers:{}}).providers?.[m];if(!Array.isArray(u))return null;let l=[];for(let p of u)if(x.isAbsolute(String(p||"")))try{let g=w(p,{});if(m==="anthropic-oauth"&&g.claudeAiOauth){let R=I(g.claudeAiOauth);l.push({...R,refreshToken:"",source:"external-access-only"});continue}let v=g.credential_pool&&typeof g.credential_pool=="object"?g.credential_pool:null;if(v){let R=v[m]||v[m.replace(/-oauth$/,"")]||[],je=Array.isArray(R)?R:R?[R]:[];for(let Z of je)if(!(!Z||typeof Z!="object"))try{let De=I(Z);l.push({...De,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(p=>!p.expiresAt||p.expiresAt>n()+st)||l[0]:null}function de(m){let f=P(m);if(i){let p=s("secret-tool",["lookup",...d(f)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!p.error&&p.status===0&&String(p.stdout||"").trim())try{return I(JSON.parse(String(p.stdout).trim()))}catch{}return S(f)}let l=w(t,{providers:{}}).providers?.[f];if(l)try{return I(l)}catch{}return S(f)}function $e(m,f){let u=P(m),l=I(f);if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...d(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected OAuth credential");let v=w(r,{providers:{}});return v.providers||={},v.providers[u]={expiresAt:l.expiresAt,source:l.source},O(r,v),l}let p=w(t,{providers:{}});return p.providers||={},p.providers[u]=l,O(t,p),l}function Le(m){let f=P(m);if(i){let p=s("secret-tool",["clear",...d(f)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{}});return g.providers&&delete g.providers[f],O(r,g),!p.error&&p.status===0}let u=w(t,{providers:{}}),l=!!u.providers?.[f];return u.providers&&delete u.providers[f],O(t,u),l}function fe(m){let f=te(m);if(i){let u=s("secret-tool",["lookup",...d(f,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(w(t,{apiKeys:{}}).apiKeys?.[f]||"").trim()}function Ie(m,f){let u=te(m),l=String(f||"").trim();if(!l)throw new Error("API key is empty");if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} API key`,...d(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected API key");let v=w(r,{providers:{},apiKeys:{}});return v.apiKeys||={},v.apiKeys[u]={configured:!0},O(r,v),!0}let p=w(t,{providers:{},apiKeys:{}});return p.apiKeys||={},p.apiKeys[u]=l,O(t,p),!0}function Ce(m){let f=te(m);if(i){let p=s("secret-tool",["clear",...d(f,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{},apiKeys:{}});return g.apiKeys&&delete g.apiKeys[f],O(r,g),!p.error&&p.status===0}let u=w(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[f];return u.apiKeys&&delete u.apiKeys[f],O(t,u),l}function Ue(){let m={},f={};if(i){let u=w(r,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))m[l]={loggedIn:!!de(l),expiresAt:Number(p.expiresAt||0),source:String(p.source||"oracle"),storage:a};for(let l of Object.keys(u.apiKeys||{}))f[l]={configured:!!fe(l),storage:a}}else{let u=w(t,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))m[l]={loggedIn:!!p?.accessToken,expiresAt:Number(p?.expiresAt||0),source:String(p?.source||"oracle"),storage:a};for(let[l,p]of Object.entries(u.apiKeys||{}))f[l]={configured:!!p,storage:a}}for(let u of Object.keys(C)){if(m[u])continue;let l=S(u);l&&(m[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:a,providers:m,apiKeys:f}}return Object.freeze({file:t,storage:a,get:de,set:$e,remove:Le,getApiKey:fe,setApiKey:Ie,removeApiKey:Ce,status:Ue,withLock:h})}var Ee;function U(){return Ee||=ct(),Ee}function re(e){return Buffer.from(e).toString("base64url")}function ut(){let e=re(oe(32));return{verifier:e,challenge:re(et("sha256").update(e).digest()),state:re(oe(24))}}function lt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&tt(r,o)}function pt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return ot(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ne(e){return new URLSearchParams(e).toString()}async function T(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function dt(e){if(e)return String(await e()).trim();let t=rt.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function se(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return I({accessToken:r,refreshToken:o,expiresAt:it(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function ft(e){let t=C["anthropic-oauth"],r=e.pkce||ut(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await dt(e.inputFn),[i,a]=s.split("#",2);if(!i||!lt(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return se(await T(c,"Claude OAuth token exchange"),e)}async function ht(e){let t=C["openai-codex"],r=await T(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await T(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ne({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return se(await T(i,"Codex OAuth token exchange"),e)}function V(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function mt(e){let t=C["xai-oauth"],r=await T(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");V(r.authorization_endpoint);let o=V(r.token_endpoint),n=await T(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=V(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let h=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(h.ok){let S=await T(h,"xAI OAuth token exchange");return se(S,{...e,discovery:{authorization_endpoint:V(r.authorization_endpoint),token_endpoint:o}})}let d="";try{d=String((await h.json())?.error||"")}catch{}if(d==="slow_down")await e.sleepFn((i+1)*1e3);else if(d==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${h.status}${d?`, ${d}`:""})`)}throw new Error("xAI device authorization timed out")}async function Ae(e,t={}){let r=P(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||pt,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?ft(o):r==="openai-codex"?ht(o):mt(o)}import G from"node:fs";import ie from"node:path";var gt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","custom","anthropic-oauth","openai-codex","xai-oauth"]);function J(e){return String(e||"").trim()||void 0}function wt(e,{required:t=!1}={}){let r=J(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!gt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function yt(e,{required:t=!1}={}){let r=J(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function vt(e){let t=J(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function Y({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=wt(e),s=yt(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:vt(r)};if(J(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var kt=new Set(["auto","standalone","hermes","remote","arch"]);function St(){return ie.join(k(),"model.json")}function j(e){return String(e||"").trim()||void 0}function Et(e={}){let t=j(e.backend)?.toLowerCase()||"auto",r=Y({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=j(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=j(e.reasoningEffort),i=j(e.computeHost||e.remoteHost),a=j(e.computeUser||e.remoteUser),c=j(e.computePath||e.remotePath);if(!kt.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function _e(e){let t=Et(e),r=St();_(ie.dirname(r)),process.platform!=="win32"&&G.chmodSync(ie.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return G.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`,{mode:384}),G.renameSync(o,r),process.platform!=="win32"&&G.chmodSync(r,384),t}var Oe=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},custom:{model:""}});function ae(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function xt(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function At(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
 `)},s=i=>{let a=String(i);for(let c of a){if(c==="\r"||c===`
-`){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function ce(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...G({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function Oe(e,t,r={}){return _e(ce(e,t,r))}function Et(e){process.stdout.write(`storage: ${e.storage}
+`){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function ce(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...Y({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function be(e,t,r={}){return _e(ce(e,t,r))}function _t(e){process.stdout.write(`storage: ${e.storage}
 `);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
 `);return}for(let[o,n]of t){let s=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${s}
 `)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
 `)}function Ot(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
-`)}var ue={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Ot(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=C();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
-`):Et(n),0}if(r==="login"){let n=t.find(c=>!c.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let s=K(n),i=ae(t,"--model")||s.model;ce(s.id,i);let a=await Ae(s.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let c=o.get(s.id);o.set(s.id,a);try{Oe(s.id,i)}catch(f){throw c?o.set(s.id,c):o.remove(s.id),f}}),process.stdout.write(`${s.id}: logged in, stored in ${o.storage}
-`),0}if(r==="api-key"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(Ee,n))throw new Error(`unsupported API-key provider: ${n}`);let s=ae(t,"--model")||Ee[n].model,i=ae(t,"--base-url");ce(n,s,{baseUrl:i});let a=t.includes("--stdin")?await At():await _t();return await o.withLock(async()=>{let c=o.getApiKey(n);o.setApiKey(n,a);try{Oe(n,s,{baseUrl:i})}catch(f){throw c?o.setApiKey(n,c):o.removeApiKey(n),f}}),process.stdout.write(`${n}: API key configured in ${o.storage}
-`),0}if(r==="logout"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let s=!1;try{s=o.remove(b(n))}catch{}let i=o.removeApiKey(n);if(!s&&!i)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`)}var ue={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Ot(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=U();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):_t(n),0}if(r==="login"){let n=t.find(c=>!c.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let s=K(n),i=ae(t,"--model")||s.model;ce(s.id,i);let a=await Ae(s.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let c=o.get(s.id);o.set(s.id,a);try{be(s.id,i)}catch(h){throw c?o.set(s.id,c):o.remove(s.id),h}}),process.stdout.write(`${s.id}: logged in, stored in ${o.storage}
+`),0}if(r==="api-key"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(Oe,n))throw new Error(`unsupported API-key provider: ${n}`);let s=ae(t,"--model")||Oe[n].model,i=ae(t,"--base-url");ce(n,s,{baseUrl:i});let a=t.includes("--stdin")?await xt():await At();return await o.withLock(async()=>{let c=o.getApiKey(n);o.setApiKey(n,a);try{be(n,s,{baseUrl:i})}catch(h){throw c?o.setApiKey(n,c):o.removeApiKey(n),h}}),process.stdout.write(`${n}: API key configured in ${o.storage}
+`),0}if(r==="logout"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let s=!1;try{s=o.remove(P(n))}catch{}let i=o.removeApiKey(n);if(!s&&!i)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
 `),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};var Pt=Object.freeze([{alias:"claude",label:"Anthropic OAuth"},{alias:"codex",label:"OpenAI Codex OAuth"},{alias:"grok",label:"Grok / xAI OAuth"}]),Te=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI API"},{id:"anthropic",label:"Anthropic API"},{id:"xai",label:"xAI API"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Google Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"}]);function X(e=C().status()){let t=["standalone model OAuth (choose one)",""];for(let r of Pt){let o=K(r.alias),n=e.providers?.[o.id]?.loggedIn===!0;t.push(`  ${r.label.padEnd(18)} ${n?"connected":"not connected"}`,`    oracle setup model ${r.alias}`)}t.push("","OAuth uses your provider subscription. No API key is required.","","standalone API keys","");for(let r of Te){let o=e.apiKeys?.[r.id]?.configured===!0;t.push(`  ${r.label.padEnd(18)} ${o?"configured":"not configured"}`,`    oracle setup model ${r.id}`)}return t.push("","Any other OpenAI-compatible provider:","  oracle auth api-key custom --model MODEL --base-url https://provider.example/v1","","The selected provider is saved as backend=standalone in model.json.",""),t.join(`
+`),1}}};var Pt=Object.freeze([{alias:"claude",label:"Anthropic OAuth"},{alias:"codex",label:"OpenAI Codex OAuth"},{alias:"grok",label:"Grok / xAI OAuth"}]),Re=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI API"},{id:"anthropic",label:"Anthropic API"},{id:"xai",label:"xAI API"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Google Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"}]);function X(e=U().status()){let t=["standalone model OAuth (choose one)",""];for(let r of Pt){let o=K(r.alias),n=e.providers?.[o.id]?.loggedIn===!0;t.push(`  ${r.label.padEnd(18)} ${n?"connected":"not connected"}`,`    oracle setup model ${r.alias}`)}t.push("","OAuth uses your provider subscription. No API key is required.","","standalone API keys","");for(let r of Re){let o=e.apiKeys?.[r.id]?.configured===!0;t.push(`  ${r.label.padEnd(18)} ${o?"configured":"not configured"}`,`    oracle setup model ${r.id}`)}return t.push("","Any other OpenAI-compatible provider:","  oracle auth api-key custom --model MODEL --base-url https://provider.example/v1","","The selected provider is saved as backend=standalone in model.json.",""),t.join(`
 `)}function le(){return["oracle setup, configure standalone OAuth, messaging, and the local agent surface","","  oracle setup                      menu + platform status","  oracle setup status               same, machine-friendly with --json","  oracle setup model                show Claude/Codex/Grok OAuth choices","  oracle setup model claude         connect Anthropic OAuth + select standalone","  oracle setup model codex          connect OpenAI OAuth + select standalone","  oracle setup model grok           connect xAI OAuth + select standalone","  oracle setup model deepseek       securely add a provider API key","  oracle setup model kimi           securely add a Kimi API key","  oracle setup messaging            open hermes gateway setup wizard","  oracle setup telegram             set TELEGRAM_BOT_TOKEN for profile","  oracle setup discord              set DISCORD_BOT_TOKEN for profile","  oracle setup slack                set slack tokens","  oracle setup <platform>           any supported hermes platform","  oracle setup gateway [status|restart|start|stop]","  oracle setup profile [name]       default: oracle","","chat:","  /setup","  /setup telegram","  /setup status","","model credentials stay in the OS keychain or private ~/.config/oracle storage.","messaging tokens stay local in ~/.hermes/profiles/<profile>/.env","oracle never prints secrets."].join(`
-`)}function Tt(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Rt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function pe(e,{inherit:t=!0,env:r=process.env}={}){let o=ke();if(!o.ok)return process.stderr.write(`oracle setup: Hermes not detected (opt-in only).
+`)}function Tt(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Rt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function pe(e,{inherit:t=!0,env:r=process.env}={}){let o=Se();if(!o.ok)return process.stderr.write(`oracle setup: Hermes not detected (opt-in only).
 Native Oracle does not need Hermes.
 To use Hermes messaging/gateway: install Hermes, or run \`oracle bootstrap\`, then retry.
 Detect: oracle harness detect
 `),1;let n=bt(o.bin,e,{stdio:t?"inherit":"pipe",encoding:"utf8",env:r});return n.error?(process.stderr.write(`oracle setup: failed to run hermes: ${n.error.message}
-`),1):(t||(n.stdout&&process.stdout.write(n.stdout),n.stderr&&process.stderr.write(n.stderr)),typeof n.status=="number"?n.status:1)}async function Pe(e){if(!O.isTTY||typeof O.setRawMode!="function"){let t=new Error("interactive token entry requires a tty");throw t.code="NO_TTY",t}return be.write(`${e}: `),new Promise((t,r)=>{let o="",n=()=>{O.off("data",s),O.setRawMode(!1),O.pause(),be.write(`
+`),1):(t||(n.stdout&&process.stdout.write(n.stdout),n.stderr&&process.stderr.write(n.stderr)),typeof n.status=="number"?n.status:1)}async function Te(e){if(!b.isTTY||typeof b.setRawMode!="function"){let t=new Error("interactive token entry requires a tty");throw t.code="NO_TTY",t}return Pe.write(`${e}: `),new Promise((t,r)=>{let o="",n=()=>{b.off("data",s),b.setRawMode(!1),b.pause(),Pe.write(`
 `)},s=i=>{for(let a of String(i)){if(a==="\r"||a===`
-`){n(),t(o.trim());return}if(a===""){n(),r(new Error("cancelled"));return}a==="\x7F"||a==="\b"?o=o.slice(0,-1):o+=a}};O.setRawMode(!0),O.resume(),O.on("data",s)})}async function Lt(e,t,r=[]){let o=D(t);if(!o)return process.stderr.write(`oracle setup: unknown platform '${t}'
+`){n(),t(o.trim());return}if(a===""){n(),r(new Error("cancelled"));return}a==="\x7F"||a==="\b"?o=o.slice(0,-1):o+=a}};b.setRawMode(!0),b.resume(),b.on("data",s)})}async function $t(e,t,r=[]){let o=D(t);if(!o)return process.stderr.write(`oracle setup: unknown platform '${t}'
 `),process.stderr.write(`known: ${F().map(c=>c.key).join(", ")}
 `),1;if(!o.required.length)return process.stdout.write(`opening hermes setup for ${o.key} (interactive)
-`),W({lastPlatform:o.key,profile:e}),pe(["-p",e,...o.hermes||["gateway","setup"]]);let n={},s=[];for(let c=0;c<r.length;c++){let f=r[c];if(f==="--token"&&r[c+1]){n.token=r[++c];continue}if(f==="--allowed-users"&&r[c+1]){n.allowedUsers=r[++c];continue}if(f==="--app-token"&&r[c+1]){n.appToken=r[++c];continue}if(f.startsWith("-"))return process.stderr.write(`oracle setup: unknown flag ${f}
-`),1;s.push(f)}let i=n.token||s[0]||"";if(!i)try{i=await Pe(`${o.key} bot token`)}catch(c){if(c?.code==="NO_TTY")return process.stderr.write(`oracle setup ${o.key}: pass --token <value> in non-interactive mode
+`),W({lastPlatform:o.key,profile:e}),pe(["-p",e,...o.hermes||["gateway","setup"]]);let n={},s=[];for(let c=0;c<r.length;c++){let h=r[c];if(h==="--token"&&r[c+1]){n.token=r[++c];continue}if(h==="--allowed-users"&&r[c+1]){n.allowedUsers=r[++c];continue}if(h==="--app-token"&&r[c+1]){n.appToken=r[++c];continue}if(h.startsWith("-"))return process.stderr.write(`oracle setup: unknown flag ${h}
+`),1;s.push(h)}let i=n.token||s[0]||"";if(!i&&!process.stdin.isTTY&&(i=await readStdinSecret()),!i)try{i=await Te(`${o.key} bot token`)}catch(c){if(c?.code==="NO_TTY")return process.stderr.write(`oracle setup ${o.key}: pipe the token on stdin (echo "$TOKEN" | oracle setup ${o.key}) or pass --token <value>
 `),1;throw c}if(!i)return process.stderr.write(`aborted: empty token
-`),1;let a={};if(n.allowedUsers&&(o.key==="telegram"&&(a.TELEGRAM_ALLOWED_USERS=n.allowedUsers),o.key==="discord"&&(a.DISCORD_ALLOWED_USERS=n.allowedUsers),o.key==="slack"&&(a.SLACK_ALLOWED_USERS=n.allowedUsers)),n.appToken&&o.key==="slack"&&(a.SLACK_APP_TOKEN=n.appToken),o.key==="slack"&&!a.SLACK_APP_TOKEN){let c=n.appToken||s[1]||"";if(!c&&process.stdin.isTTY&&(c=await Pe("slack app token (xapp-...)")),!c)return process.stderr.write(`slack needs bot token + app token
+`),1;let a={};if(n.allowedUsers&&(o.key==="telegram"&&(a.TELEGRAM_ALLOWED_USERS=n.allowedUsers),o.key==="discord"&&(a.DISCORD_ALLOWED_USERS=n.allowedUsers),o.key==="slack"&&(a.SLACK_ALLOWED_USERS=n.allowedUsers)),n.appToken&&o.key==="slack"&&(a.SLACK_APP_TOKEN=n.appToken),o.key==="slack"&&!a.SLACK_APP_TOKEN){let c=n.appToken||s[1]||"";if(!c&&process.stdin.isTTY&&(c=await Te("slack app token (xapp-...)")),!c)return process.stderr.write(`slack needs bot token + app token
 `),1;a.SLACK_APP_TOKEN=c}try{let c=ye(e,o.key,i,a);return W({lastPlatform:o.key,profile:e,ready:!0}),process.stdout.write(`saved ${o.key} credentials for profile '${e}'
 path: ${c.path}
 next: oracle setup gateway restart
 `),0}catch(c){return process.stderr.write(`oracle setup: ${c.message}
-`),1}}var Ar={name:"setup",summary:"configure standalone OAuth and messaging platforms",group:"read",usage:le(),async run(e){let t=[...e.argv],r=t.includes("--json"),o=Tt(t),n=Rt(t).filter(a=>a!=="--json"),s=(n[0]||"menu").toLowerCase(),i=n.slice(1);if(["-h","--help","help"].includes(s))return process.stdout.write(le()+`
-`),0;if(["menu","list","ls"].includes(s))return r?process.stdout.write(JSON.stringify({...q(o),modelAuth:C().status()},null,2)+`
-`):(process.stdout.write(X()),process.stdout.write(B(o))),0;if(["status","show"].includes(s)){let a=q(o);return r?process.stdout.write(JSON.stringify({...a,modelAuth:C().status()},null,2)+`
-`):(process.stdout.write(X()),process.stdout.write(B(o)),process.stdout.write(`hermes root: ${N()}
-`)),0}if(["model","oauth"].includes(s)){let a=String(i[0]||"").trim().toLowerCase();if(!a||["list","status","show"].includes(a))return process.stdout.write(X()),0;if(Te.some(c=>c.id===a)||a==="custom")return ue.run({...e,argv:["api-key",a,...i.slice(1)]});try{return K(a),ue.run({...e,argv:["login",a,...i.slice(1)]})}catch(c){return process.stderr.write(`oracle setup model: ${c.message}
+`),1}}var xr={name:"setup",summary:"configure standalone OAuth and messaging platforms",group:"read",usage:le(),async run(e){let t=[...e.argv],r=t.includes("--json"),o=Tt(t),n=Rt(t).filter(a=>a!=="--json"),s=(n[0]||"menu").toLowerCase(),i=n.slice(1);if(["-h","--help","help"].includes(s))return process.stdout.write(le()+`
+`),0;if(["menu","list","ls"].includes(s))return r?process.stdout.write(JSON.stringify({...q(o),modelAuth:U().status()},null,2)+`
+`):(process.stdout.write(X()),process.stdout.write(B(o))),0;if(["status","show"].includes(s)){let a=q(o);return r?process.stdout.write(JSON.stringify({...a,modelAuth:U().status()},null,2)+`
+`):(process.stdout.write(X()),process.stdout.write(B(o)),process.stdout.write(`hermes root: ${M()}
+`)),0}if(["model","oauth"].includes(s)){let a=String(i[0]||"").trim().toLowerCase();if(!a||["list","status","show"].includes(a))return process.stdout.write(X()),0;if(Re.some(c=>c.id===a)||a==="custom")return ue.run({...e,argv:["api-key",a,...i.slice(1)]});try{return K(a),ue.run({...e,argv:["login",a,...i.slice(1)]})}catch(c){return process.stderr.write(`oracle setup model: ${c.message}
 `),process.stderr.write(X()),1}}if(["messaging","gateway-setup","platforms"].includes(s))return W({lastAction:"messaging",profile:o}),process.stdout.write(`opening hermes gateway setup wizard...
 `),pe(["-p",o,"gateway","setup"]);if(s==="gateway"){let a=(i[0]||"status").toLowerCase();return["status","start","stop","restart","run","install"].includes(a)?pe(["-p",o,"gateway",a]):(process.stderr.write(`usage: oracle setup gateway [status|start|stop|restart|run|install]
 `),1)}if(s==="profile"){let a=i[0]||o;return process.stdout.write(`profile: ${a}
-hermes: ${N()}/profiles/${a}
-`),process.stdout.write(B(a)),0}return D(s)?Lt(o,s,i):(process.stderr.write(`oracle setup: unknown verb '${s}'
+hermes: ${M()}/profiles/${a}
+`),process.stdout.write(B(a)),0}return D(s)?$t(o,s,i):(process.stderr.write(`oracle setup: unknown verb '${s}'
 ${le()}
-`),1)}};export{Ar as default,X as renderModelSetup};
+`),1)}};export{xr as default,X as renderModelSetup};

package/dist/cli/commands/sign.mjs

@@ -1,23 +1,24 @@
-import d from"node:fs";import T from"node:path";import b from"node:fs";import j from"node:os";import w from"node:path";import{fileURLToPath as q}from"node:url";var F=w.dirname(q(import.meta.url)),xe=w.resolve(F,"../..");function k(){return process.env.ORACLE_FAKE_HOME||j.homedir()}function U(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function E(){return U()?process.env.ORACLE_CONFIG_DIR||w.join(k(),".config","oracle"):w.join(k(),".config","oracle")}function V(){return w.join(E(),"desk.json")}function G(){return w.join(E(),"env")}function h({force:e=!1}={}){if(h._done&&!e)return h._result||null;h._done=!0;let i={},r=(a,n)=>{if(n==null)return;let s=String(n).trim();s&&(process.env[a]!=null&&String(process.env[a]).trim()!==""||(process.env[a]=s,i[a]=s))};try{let a=G();if(b.existsSync(a))for(let n of b.readFileSync(a,"utf8").split(/\r?\n/)){let s=n.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let a=V();if(b.existsSync(a)){let n=JSON.parse(b.readFileSync(a,"utf8"));n&&typeof n=="object"&&(r("ORACLE_DESK_URL",n.deskUrl||n.dataUrl||n.url),r("ORACLE_DATA_URL",n.dataUrl||n.deskUrl||n.url),r("ORACLE_API_URL",n.apiUrl||n.dataUrl||n.deskUrl),r("ORACLE_PUBLIC_URL",n.publicUrl||n.deskUrl||n.dataUrl),r("ORACLE_EXEC_URL",n.execUrl),r("MAD_DESK_URL",n.deskUrl||n.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),h._result=Object.keys(i).length?i:null,h._result}try{h()}catch{}import{createCipheriv as H,createDecipheriv as Se,randomBytes as S,scryptSync as W}from"node:crypto";import o from"node:fs";import l from"node:path";var J="ORACLE-LOCAL-VAULT",z=1,I=Object.freeze({N:1<<17,r:8,p:1}),K=256*1024*1024,Ae=16*1024;function X(e,i,r=I){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return W(t,i,32,{...r,maxmem:K})}function L(e,i,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let a=S(32),n=S(12),s={magic:J,version:z,kdf:{name:"scrypt",...I,salt:a.toString("base64")},cipher:{name:"aes-256-gcm",iv:n.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=X(i,a);try{let u=H("aes-256-gcm",c,n);u.setAAD(Buffer.from(JSON.stringify(s)));let f=Buffer.concat([u.update(t),u.final()]);return{...s,ciphertext:f.toString("base64"),tag:u.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function Y(e){let i=o.lstatSync(e);if(i.isSymbolicLink())throw new Error("local-vault: refusing symlink");if(!i.isFile())throw new Error("local-vault: secret source must be a regular file");if(i.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(i.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((i.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function $(e){let i=l.dirname(e),r=o.lstatSync(i);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");try{let t=o.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function p(e){let i=o.lstatSync(e);Y(e);let r=o.openSync(e,o.constants.O_RDONLY|o.constants.O_NOFOLLOW);try{let t=o.fstatSync(r);if(i.dev!==t.dev||i.ino!==t.ino||t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");return o.readFileSync(r,"utf8").replace(/[\r\n]+$/,"")}finally{o.closeSync(r)}}function R(e,i){o.mkdirSync(l.dirname(e),{recursive:!0,mode:448}),$(e);let r=l.join(l.dirname(e),`.${l.basename(e)}.${process.pid}.${S(6).toString("hex")}.tmp`),t;try{t=o.openSync(r,o.constants.O_CREAT|o.constants.O_EXCL|o.constants.O_WRONLY|o.constants.O_NOFOLLOW,384),o.writeFileSync(t,JSON.stringify(i,null,2)+`
-`),o.fsyncSync(t),o.closeSync(t),t=void 0;let a=o.openSync(r,o.constants.O_RDONLY|o.constants.O_NOFOLLOW),n;try{n=o.fstatSync(a)}finally{o.closeSync(a)}let s=o.lstatSync(l.dirname(e));if(n.nlink!==1||n.dev!==s.dev||n.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");o.renameSync(r,e),o.chmodSync(e,384);let c=o.openSync(l.dirname(e),"r");try{o.fsyncSync(c)}finally{o.closeSync(c)}}catch(a){if(t!==void 0)try{o.closeSync(t)}catch{}try{o.unlinkSync(r)}catch{}throw a}return e}function g(e,i){o.mkdirSync(l.dirname(e),{recursive:!0,mode:448}),$(e);let r=l.join(l.dirname(e),`.${l.basename(e)}.${process.pid}.${S(6).toString("hex")}.tmp`);try{let t=o.openSync(r,o.constants.O_CREAT|o.constants.O_EXCL|o.constants.O_WRONLY|o.constants.O_NOFOLLOW,384);try{o.writeFileSync(t,String(i)),o.fsyncSync(t)}finally{o.closeSync(t)}o.renameSync(r,e),o.chmodSync(e,384);let a=o.openSync(l.dirname(e),"r");try{o.fsyncSync(a)}finally{o.closeSync(a)}}catch(t){try{o.unlinkSync(r)}catch{}throw t}}import m from"node:path";import{Interface as te,MaxUint256 as ir,isAddress as ar,keccak256 as sr,toUtf8Bytes as cr}from"ethers";import{Interface as ee,isAddress as je}from"ethers";import{isAddress as $e}from"ethers";var Ve=new ee(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as re,isAddress as We}from"ethers";var Xe=new re(["function approve(address spender,uint256 amount) returns (bool)"]),Ye=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var mr=new te(["function approve(address spender,uint256 amount) returns (bool)"]);var ne=new Set(["evm","evm-swap","evm-bridge","btc","sol"]),br=Object.freeze({swap:5,bridge:5,perps:0,nft:0});var oe=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}});var Er=Object.freeze([...ne]),Sr=Object.freeze({...oe});import{createHash as Jr,createHmac as se,timingSafeEqual as zr,verify as Kr}from"node:crypto";import{homedir as _}from"node:os";import{join as N}from"node:path";var B=process.env.ORACLE_PUBLIC_DESKTOP==="1",ae=B?process.env.ORACLE_CONFIG_DIR||N(_(),".config","oracle"):N(_(),".config","oracle"),Dr=B?ae:N(_(),".config","mad-desk");var Ur="0".repeat(64),Vr=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function y(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(y).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+y(e[r])).join(",")+"}"}var Gr=Promise.resolve();var ce=(e,i)=>se("sha256",i).update(y(e)).digest("hex");function ue(e,i){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");return{policy:e,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:ce(e,i)}}}function M(e,i,r){let t=p(i);g(e,JSON.stringify(ue(r,t),null,2)+`
-`)}function D(e){return{vault:m.join(e,"vault.json"),policy:m.join(e,"signer-policy.json"),policyKey:m.join(e,"policy-integrity-key"),triggerAuthorityPublicKey:m.join(e,"trigger-attestation-authority.pub"),ledger:m.join(e,"signer-ledger.json"),token:m.join(e,"signer-token"),lock:m.join(e,"signer.lock")}}import{randomBytes as fe}from"node:crypto";var P=`oracle sign init|import|policy|status|lock|doctor
+import d from"node:fs";import j from"node:path";import T from"node:fs";import ce from"node:os";import y from"node:path";import{fileURLToPath as ue}from"node:url";var fe=y.dirname(ue(import.meta.url)),ir=y.resolve(fe,"../..");function D(){return process.env.ORACLE_FAKE_HOME||ce.homedir()}function le(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function O(){return le()?process.env.ORACLE_CONFIG_DIR||y.join(D(),".config","oracle"):y.join(D(),".config","oracle")}function de(){return y.join(O(),"desk.json")}function pe(){return y.join(O(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},r=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=pe();if(T.existsSync(i))for(let o of T.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let i=de();if(T.existsSync(i)){let o=JSON.parse(T.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),E._result=Object.keys(n).length?n:null,E._result}try{E()}catch{}import{createCipheriv as me,createDecipheriv as he,randomBytes as k,scryptSync as we}from"node:crypto";import a from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",J=1,v=Object.freeze({N:1<<17,r:8,p:1}),ge=256*1024*1024,Ee=16*1024;function I(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function V(e,n,r=v){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return we(t,n,32,{...r,maxmem:ge})}function G(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=k(32),o=k(12),s={magic:W,version:J,kdf:{name:"scrypt",...v,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=V(n,i);try{let l=me("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([l.update(t),l.final()]);return{...s,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function B(e,n){if(e?.magic!==W||e?.version!==J)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==v.N||e.kdf.r!==v.r||e.kdf.p!==v.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=I(e.kdf.salt,32,"salt"),i=I(e.cipher.iv,12,"iv"),o=I(e.tag,16,"tag"),s=I(e.ciphertext,1,"ciphertext",{max:Ee}),{ciphertext:c,tag:l,...u}=e,f=V(n,t);try{let p=he("aes-256-gcm",f,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function ye(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function H(e){let n=m.dirname(e),r=a.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=a.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=a.fstatSync(n);if(ye(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=a.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function R(e){return JSON.parse(w(e))}function z(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),H(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${k(6).toString("hex")}.tmp`),t;try{t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(t,JSON.stringify(n,null,2)+`
+`),a.fsyncSync(t),a.closeSync(t),t=void 0;let i=a.openSync(r,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(r,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(t!==void 0)try{a.closeSync(t)}catch{}try{a.unlinkSync(r)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),H(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${k(6).toString("hex")}.tmp`);try{let t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(t,String(n)),a.fsyncSync(t)}finally{a.closeSync(t)}a.renameSync(r,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(t){try{a.unlinkSync(r)}catch{}throw t}}import h from"node:path";import Ge from"node:os";import{createHash as He,randomBytes as to}from"node:crypto";import{Transaction as oo}from"@scure/btc-signer";import{ed25519 as ao}from"@noble/curves/ed25519.js";import{base58 as Zt}from"@scure/base";import{Interface as Ae,MaxUint256 as Jr,isAddress as Vr,keccak256 as Gr,toUtf8Bytes as Hr}from"ethers";import{Interface as be,isAddress as Ar}from"ethers";import{isAddress as Er}from"ethers";var kr=new be(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ve,isAddress as _r}from"ethers";var Fr=new ve(["function approve(address spender,uint256 amount) returns (bool)"]),Mr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Qr=new Ae(["function approve(address spender,uint256 amount) returns (bool)"]);var rt=300*1e3,tt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as st,NETWORK as ct,OutScript as ut,RawTx as ft,SigHash as lt,TEST_NETWORK as dt,Transaction as pt}from"@scure/btc-signer";import{createHash as Oe}from"node:crypto";import{base58 as gt}from"@scure/base";import{getCompiledTransactionMessageDecoder as yt}from"@solana/transaction-messages";var K=e=>Oe("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),St=new Map([[K("route"),{name:"route",prefixBytes:0}],[K("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var ke=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var Bt=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var Ne=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Rt=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Ct=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Le=Object.freeze([...ke]),Ft=Object.freeze({...Ne});import{ed25519 as qt}from"@noble/curves/ed25519.js";import{base58 as Ut}from"@scure/base";import{RawTx as Dt,SigHash as Wt,Transaction as Jt}from"@scure/btc-signer";import{Transaction as Gt}from"ethers";import{createHmac as Ce,randomBytes as bn,timingSafeEqual as Fe}from"node:crypto";import Me from"node:fs";import S from"node:path";import{homedir as M}from"node:os";import{join as P}from"node:path";var Z=process.env.ORACLE_PUBLIC_DESKTOP==="1",Re=Z?process.env.ORACLE_CONFIG_DIR||P(M(),".config","oracle"):P(M(),".config","oracle"),dn=Z?Re:P(M(),".config","mad-desk");var gn="0".repeat(64),En=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+L(e[r])).join(",")+"}"}var yn=Promise.resolve();function Pe(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=s=>{try{return Me.realpathSync(s)}catch{return S.resolve(s)}},t=r(S.dirname(S.resolve(e))),i=r(S.dirname(S.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+S.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var q=(e,n)=>Ce("sha256",n).update(L(e)).digest("hex"),qe=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&Fe(r,t)};function $e(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(t,n)}}}function Y(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!qe(t?.integrity?.mac,q(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Ue(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Y(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(t)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(s,r)}})+`
+`)}function Q(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=Y(t,i);Pe(t,e);let s=Number(o.sequence||0)+1,c=$e(r,i,{sequence:s});Ue(t,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
+`)}import{Wallet as $}from"ethers";import{base58 as re}from"@scure/base";import{ed25519 as je}from"@noble/curves/ed25519.js";import{NETWORK as te,TEST_NETWORK as ne,WIF as De,p2wpkh as ee}from"@scure/btc-signer";import{pubECDSA as We}from"@scure/btc-signer/utils.js";var Je=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},Ve=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},x=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function b(e,n){let r=String(n||"").trim();if(e==="evm")return new $(r).privateKey;if(e==="btc")for(let o of[te,ne])try{return Buffer.from(De(o).decode(r))}catch{}if(e==="sol")try{return x(re.decode(r),"sol")}catch{}let t=Je(r);if(t)return e==="evm"?new $(`0x${t.toString("hex")}`).privateKey:x(t,e);let i=Ve(r);if(i)return x(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return x(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return b(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let r=new $(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=x(n,"btc"),t=We(r);return{kind:e,secret:r.toString("hex"),addresses:[ee(t,te).address,ee(t,ne).address]}}if(e==="sol"){let r=x(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[re.encode(je.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function U(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=A(o,b(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function oe(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ie(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function ae(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(Ge.homedir(),".local","state"),"oracle"),r=He("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as ze}from"node:crypto";import{Wallet as Ke}from"ethers";var se=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
-  oracle sign import --key-file <0600 file> [--passphrase-file <0600 file>]
+  oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
   oracle sign policy --policy-file <0600 JSON file>
   oracle sign status
   oracle sign lock
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,C=(e,i)=>{let r=e.indexOf(i);return r>=0?e[r+1]:null};async function de(e,i={}){if(i.readHidden)return i.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let a="",n=c=>{for(let u of c){if(u===3){s(),t(new Error("cancelled"));return}if(u===13||u===10){s(),process.stderr.write(`
-`),r(a);return}u===127?a=a.slice(0,-1):a+=String.fromCharCode(u)}},s=()=>{process.stdin.off("data",n),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",n)})}async function le(e,i){let r=C(e,"--passphrase-file");return r?p(r):de("Vault passphrase: ",i)}async function pe(e=[],i={}){let r=i.out||process.stdout,t=e[0],a=i.configDir||E(),n=D(T.join(a,"signer"));if(!t||t==="help")return r.write(P+`
-`),0;if(t==="status")return r.write(JSON.stringify({initialized:d.existsSync(n.vault),policyConfigured:d.existsSync(n.policy),armed:d.existsSync(n.vault)&&!d.existsSync(n.lock),disarmed:d.existsSync(n.lock)})+`
-`),0;if(t==="lock")return d.mkdirSync(T.dirname(n.lock),{recursive:!0,mode:448}),g(n.lock,`locked
+They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},Xe=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Ze(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let l of c){if(l===3){s(),t(new Error("cancelled"));return}if(l===13||l===10){s(),process.stderr.write(`
+`),r(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function Ye(e,n){let r=_(e,"--passphrase-file");return r?w(r):Ze("Vault passphrase: ",n)}function Qe(e){return e.addresses.join(", ")}async function er(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||O(),o=ae(j.join(i,"signer"));if(!t||t==="help")return r.write(se+`
+`),0;if(t==="status")return r.write(JSON.stringify({initialized:d.existsSync(o.vault),policyConfigured:d.existsSync(o.policy),armed:d.existsSync(o.vault)&&!d.existsSync(o.lock),disarmed:d.existsSync(o.lock)})+`
+`),0;if(t==="lock")return d.mkdirSync(j.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),r.write(`Local signer locked.
-`),0;if(t==="doctor"){let f=[];return d.existsSync(n.vault)||f.push("vault missing"),d.existsSync(n.policy)||f.push("policy missing (empty allowlists fail closed)"),r.write(f.length?`Signer not ready: ${f.join("; ")}
+`),0;if(t==="doctor"){let u=[];return d.existsSync(o.vault)||u.push("vault missing"),d.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),r.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
-`),f.length?1:0}if(t==="policy"){if(!d.existsSync(n.vault)||!d.existsSync(n.policyKey))throw new Error("initialize the local signer before sealing policy");let f=C(e,"--policy-file");if(!f)throw new Error("policy requires --policy-file <0600 JSON file>");let x;try{x=JSON.parse(p(f))}catch{throw new Error("policy file must contain valid JSON")}for(let A of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(x[A])||x[A].length===0)throw new Error(`policy: ${A} allowlist is empty`);return M(n.policy,n.policyKey,x),r.write(`Signer policy sealed with local integrity protection.
-`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let s=await le(e,i),{Wallet:c}=await import("ethers"),u;if(t==="import"){let f=C(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");u=new c(p(f))}else u=c.createRandom();d.mkdirSync(T.dirname(n.vault),{recursive:!0,mode:448}),R(n.vault,L(Buffer.from(u.privateKey),s,{address:u.address,kind:"evm"})),d.existsSync(n.policyKey)||g(n.policyKey,fe(32).toString("hex")+`
-`);try{d.unlinkSync(n.lock)}catch(f){if(f.code!=="ENOENT")throw f}return r.write(`Encrypted local vault initialized for ${u.address}. User-initiated swaps and bridges are armed; non-empty sealed policy rails, exact confirmation, and per-action bounds are still required, and disarm always wins.
-`),0}var yt={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:P,run:e=>pe(e.argv||[])};export{yt as default,pe as run};
+`),u.length?1:0}if(t==="policy"){if(!d.existsSync(o.vault)||!d.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=_(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let f;try{f=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(f[p])||f[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return Q(o.policy,o.policyKey,f,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let s=await Ye(e,n),c={};if(d.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=R(o.vault),f=B(u,s);try{c=U(f,u.meta)}finally{f.fill(0)}}if(t==="init"){let u=Ke.createRandom();c.evm=A("evm",b("evm",u.privateKey))}else{let u=Xe(e),f=_(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");c[u]=A(u,b(u,w(f)))}d.mkdirSync(j.dirname(o.vault),{recursive:!0,mode:448}),z(o.vault,G(oe(c),s,ie(c))),d.existsSync(o.policyKey)||g(o.policyKey,ze(32).toString("hex")+`
+`);let l=Object.entries(c).map(([u,f])=>`${u}:${Qe(f)}`).join(" ");return r.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
+`),0}var Lo={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:se,run:e=>er(e.argv||[])};export{Lo as default,er as run};