@oracle-agent/oracle 0.24.8 → 0.24.9

package/dist/local-signer/index.mjs

@@ -1 +1 @@
-import{createHash as De,randomBytes as Pe,timingSafeEqual as Ve}from"node:crypto";import{Interface as Te,MaxUint256 as $r,isAddress as Br,keccak256 as Lr,toUtf8Bytes as kr}from"ethers";import{Interface as ye,isAddress as dr}from"ethers";import{isAddress as ar}from"ethers";import{createHash as he,createHmac as ge,timingSafeEqual as be}from"node:crypto";import{readFileSync as pe}from"node:fs";import{homedir as me}from"node:os";import{join as M}from"node:path";function le(){if(process.env.ORACLE_TEST_ISOLATE_SECRETS==="1"){let t=(process.env.ORACLE_EXEC_ENV_FILE||"").trim();return t?[t]:[]}let e=(process.env.ORACLE_EXEC_ENV_FILE||process.env.MAD_EXEC_ENV_FILE||"").trim(),r=me();if(process.env.ORACLE_PUBLIC_DESKTOP==="1"){let t=(process.env.ORACLE_CONFIG_DIR||M(r,".config","oracle")).trim();return[e,M(t,"exec.env")].filter(Boolean)}return[e,M(r,".config","oracle","exec.env"),M(r,".config","mad-desk","exec.env")].filter(Boolean)}function C(e,r,t){let o=e??process.env[r]??process.env[t];if(!String(o||"").trim())for(let a of le())try{let n=pe(a,"utf8"),i=n.match(new RegExp(`^${r}=(.*)$`,"m"))||n.match(new RegExp(`^${t}=(.*)$`,"m"));if(i&&(o=i[1].trim(),o))break}catch{}if(!String(o||"").trim())throw new Error(`${r} required for attestation. Set it in the environment, or place ${r}=<value> in ~/.config/oracle/exec.env`);return o}function y(e,r,t="guard"){let o=Number(r);if(r==null||!Number.isFinite(o))throw new Error(`${t}: current time must be a finite number (got ${we(r)})`);let a=Number(e?.issuedAtMs),n=Number(e?.expiresAtMs);if(!Number.isFinite(n))throw new Error(`${t}: expiresAtMs is required and must be a finite number`);if(o>n)throw new Error(`${t} expired at ${n}, now ${o}`);if(e?.issuedAtMs!=null){if(!Number.isFinite(a))throw new Error(`${t}: issuedAtMs must be a finite number when present`);if(n<=a)throw new Error(`${t}: expiry must be after issuance`)}return{now:o,issuedAtMs:a,expiresAtMs:n}}function we(e){return e===null?"null":e===void 0?"undefined":typeof e=="number"?String(e):`${typeof e} ${JSON.stringify(String(e)).slice(0,24)}`}var ee=100;function P(e){return Array.isArray(e)?`[${e.map(P).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().map(r=>`${JSON.stringify(r)}:${P(e[r])}`).join(",")}}`:JSON.stringify(e??null)}function xe(e,{required:r=!1}={}){try{return C(e,"ORACLE_ROUTE_ATTESTATION_SECRET","MAD_ROUTE_ATTESTATION_SECRET")}catch(t){if(r)throw t;return null}}function Ee(e){let{signature:r,...t}=e;return t}function ve(e){let r=String(e||"").toLowerCase();if(!/^0x[0-9a-f]+$/.test(r)||r.length<10||r.length%2!==0)throw new Error("auto-slippage calldata must be even-length hex with a selector");return he("sha256").update(Buffer.from(r.slice(2),"hex")).digest("hex")}function Se(e,r){let t=Buffer.from(String(e??""),"utf8"),o=Buffer.from(String(r??""),"utf8");return t.length!==o.length||t.length===0?!1:be(t,o)}function Ae(e){let r=String(e||"");if(!/^0x[0-9a-fA-F]+$/.test(r)||r.length<10||r.length%2!==0)return null;let t=r.slice(0,10).toLowerCase(),o=[];for(let n=10;n+64<=r.length;n+=64)o.push(r.slice(n,n+64));let a=n=>o[n]==null?null:BigInt("0x"+o[n]);switch(t){case"0x414bf389":return a(6);case"0x04e45aaf":return a(5);case"0xc04b8d59":{let n=a(0);if(n==null)return null;let i=Number(n)/32;return!Number.isInteger(i)||i<0?null:a(i+4)}case"0xb858183f":{let n=a(0);if(n==null)return null;let i=Number(n)/32;return!Number.isInteger(i)||i<0?null:a(i+3)}case"0xa026383e":return a(6);case"0x38ed1739":case"0x5c11d795":return a(1);case"0x7ff36ab5":case"0xb6f9de95":return a(0);case"0x18cbafe5":case"0x791ac947":return a(1);default:return null}}function V(e,{nowMs:r=Date.now(),chainId:t,venue:o,secret:a,tx:n,requireSigned:i=!1}={}){if(!e||e.mode!=="auto")throw new Error("bounded auto-slippage guard required");let m=xe(a,{required:i});if(i&&!m)throw new Error("auto-slippage attestation secret required for signing or broadcast");if(m){let u=ge("sha256",m).update(P(Ee(e))).digest("hex");if(!Se(e.signature,u))throw new Error("auto-slippage guard signature mismatch \u2014 the guard was not issued by this Oracle")}else if(e.signature)throw new Error("auto-slippage guard carries a signature but no attestation secret is configured");let c=Number(e.selectedBps),s=Number(e.capBps);if(!Number.isInteger(c)||c<0||c>ee)throw new Error("auto-slippage selected tolerance exceeds hard 100 bps cap");if(!Number.isInteger(s)||s<0||s>ee||c>s)throw new Error("auto-slippage cap exceeds hard 100 bps cap");try{y({expiresAtMs:e.expiresAtMs,issuedAtMs:e.quotedAtMs},r,"auto-slippage quote")}catch(u){throw new Error(`${u.message}; re-quote before signing`)}if(t!=null&&Number(e.chainId)!==Number(t))throw new Error("auto-slippage guard chain mismatch");if(o&&String(e.venue).toLowerCase()!==String(o).toLowerCase())throw new Error("auto-slippage guard venue mismatch");let l=BigInt(e.quoteAmountOut??0),w=BigInt(e.minAmountOut??0);if(l<=0n||w<=0n)throw new Error("auto-slippage guard amounts must be positive");let E=l*BigInt(1e4-c)/10000n;if(w<E)throw new Error("auto-slippage guard is under-protected relative to its fresh quote");if(n?.data&&e.minAmountOut!=null)if(e.calldataHash!=null){if(String(e.calldataHash)!==ve(n.data))throw new Error("auto-slippage guard is not bound to this call: calldata hash mismatch")}else{let u=Ae(n.data);if(u==null){let d=String(n.data).slice(0,10);throw new Error(`auto-slippage: cannot verify the output floor encoded by selector ${d}; refusing rather than trusting unbound calldata at an allowlisted venue`)}if(u!==BigInt(e.minAmountOut))throw new Error(`auto-slippage guard is not bound to this call: guard minAmountOut ${e.minAmountOut} but calldata encodes ${u}`)}return!0}var wr=new ye(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Oe,isAddress as br}from"ethers";var Sr=new Oe(["function approve(address spender,uint256 amount) returns (bool)"]),Ar=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Pr=new Te(["function approve(address spender,uint256 amount) returns (bool)"]);var G=new Set(["0x095ea7b3","0x39509351","0x61f49ed6","0xeb5625d9","0xf9255c1f","0x87517c45","0xd505accf","0x8fcbaf0c","0x2b67b570","0x2a2d80d1"]);var te=new Set(["evm","evm-swap","evm-bridge","btc","sol"]),re=Object.freeze({swap:5,bridge:5,perps:0,nft:0}),oe=new Set(["evm-swap","evm-bridge"]),Ie=new Set(["0x0000000000000000000000000000000000000000","0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"]),j=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Ce=new Set(["0x04e45aaf","0x414bf389","0xc04b8d59","0xb858183f","0xa026383e","0x38ed1739","0x5c11d795","0x7ff36ab5","0xb6f9de95","0x18cbafe5","0x791ac947"]),_e=new Set(["0xa9059cbb","0x23b872dd","0x42842e0e","0xb88d4fde","0xf242432a","0x2eb2c2d6","0xa22cb465","0xd0e30db0","0x2e1a7d4d","0x3593564c","0x24856bc3","0xac9650d8","0x5ae401dc"]),U=(e,r,t=256)=>{if(typeof e!="string"||!e||e.length>t)throw new Error(`envelope: bounded ${r} required`);return e},p=(e,r)=>{try{let t=BigInt(e);if(t<0n)throw 0;return t}catch{throw new Error(`envelope: ${r} must be a non-negative integer`)}},$e=(e,r)=>{if(!Array.isArray(e)||e.length===0)throw new Error(`policy: ${r} allowlist is empty`);return e},b=(e,r,t)=>{if(!$e(r,t).map(o=>String(o).toLowerCase()).includes(String(e).toLowerCase()))throw new Error(`policy: ${t} not allowed`)},_=(e,r)=>{let t=String(e||"").toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw new Error(`envelope: ${r} must be a 20-byte address`);return t},O=e=>String(e||"0x").slice(0,10).toLowerCase();function W(e){return G.has(O(e))}function H(e){let r=O(e);return Ce.has(r)||_e.has(r)||Object.hasOwn(j,r)||G.has(r)}function J(e,r,t,{dynamicTail:o=!1}={}){let a=String(e||"").toLowerCase();if(!/^0x[0-9a-f]*$/.test(a)||a.length<10+r*64)throw new Error(`envelope: malformed ${t} calldata`);if(!o&&a.length!==10+r*64)throw new Error(`envelope: malformed ${t} calldata`);return{hex:a,word:n=>a.slice(10+n*64,10+(n+1)*64)}}function v(e,r){if(!/^0{24}[0-9a-f]{40}$/.test(e))throw new Error(`envelope: malformed ${r} address`);return`0x${e.slice(24)}`}function A(e,r){try{return BigInt(`0x${e}`)}catch{throw new Error(`envelope: malformed ${r} integer`)}}function Be(e){if(O(e)!=="0x095ea7b3")return null;let r=J(e,2,"approval");return{kind:"approval",spender:v(r.word(0),"approval spender"),amount:A(r.word(1),"approval amount")}}function Le(e,r){let t=r==="router02-exact-input-single"?7:8,o=J(e,t,"Uniswap v3 exactInputSingle"),a=t===7?4:5;return{kind:"action",action:"swap",inputToken:v(o.word(0),"input token"),outputToken:v(o.word(1),"output token"),recipient:v(o.word(3),"recipient"),amountIn:A(o.word(a),"amountIn"),minimumOut:A(o.word(a+1),"amountOutMinimum")}}function ke(e){let r=J(e,12,"Across depositV3",{dynamicTail:!0}),t=A(r.word(11),"message offset");if(t!==384n)throw new Error("envelope: malformed Across depositV3 message offset");let o=10+Number(t)*2;if(r.hex.length<o+64)throw new Error("envelope: malformed Across depositV3 message");let a=Number(BigInt(`0x${r.hex.slice(o,o+64)}`));if(!Number.isSafeInteger(a))throw new Error("envelope: malformed Across depositV3 message length");let n=Math.ceil(a/32)*64;if(r.hex.length!==o+64+n)throw new Error("envelope: malformed Across depositV3 trailing bytes");return{kind:"action",action:"bridge",depositor:v(r.word(0),"depositor"),recipient:v(r.word(1),"recipient"),inputToken:v(r.word(2),"input token"),outputToken:v(r.word(3),"output token"),amountIn:A(r.word(4),"inputAmount"),minimumOut:A(r.word(5),"outputAmount"),destinationChainId:A(r.word(6),"destinationChainId")}}function Me(e,r){let t=O(e),o=j[t];if(!o)throw new Error("envelope: opaque or unsupported EVM swap/bridge calldata");if(String(r).toLowerCase()!==o.provider)throw new Error("envelope: provider does not match reviewed selector");if(o.action==="swap")return{...Le(e,o.layout),selector:t,provider:o.provider};if(o.action==="bridge")return{...ke(e),selector:t,provider:o.provider};throw new Error("envelope: unsupported reviewed EVM action")}function q(e){let r=e?.artifact;if(Array.isArray(r?.transactions))return r.transactions;if(r?.transaction&&typeof r.transaction=="object")return[r.transaction];if(r?.data)return[r];throw new Error("envelope: ordered EVM transaction batch required")}function R(e,r,{nowMs:t=Date.now(),routeAttestationSecret:o}={}){let a=String(e?.surface||"");if(!oe.has(a))throw new Error("envelope: strict EVM swap/bridge surface required");let n=U(e.provider,"provider",64).toLowerCase();b(n,r.providers,"provider");let i=_(e.owner,"owner"),m=e.artifact,c=Number(m?.chainId);if(!Number.isSafeInteger(c)||c<=0)throw new Error("envelope: explicit batch chainId required");if(b(c,r.chains,"chain"),_(m?.owner,"batch owner")!==i)throw new Error("envelope: explicit batch owner mismatch");let s=q(e);if(!s.length||s.length>8)throw new Error("envelope: bounded EVM transaction batch required");let l=0n,w=0n,E=0n,u=[],d=-1;for(let g=0;g<s.length;g++){let h=s[g];if(!h||typeof h!="object"||Array.isArray(h))throw new Error("envelope: structured EVM transaction required");if(Number(h.chainId)!==c)throw new Error("envelope: every batch leg must use the same chain");if(_(h.from,"transaction owner")!==i)throw new Error("envelope: every batch leg must use the same owner");let de=O(h.data);b(de,r.selectors,"selector");let L=Be(h.data),D;if(L){if(d!==-1)throw new Error("envelope: approval must be before action");let Y=_(h.to,"approval token");if(b(Y,r.tokens,"token"),b(L.spender,r.spenders,"spender"),L.amount>p(r.maxApproval,"maxApproval"))throw new Error("policy: approval exceeds cap");D={...L,token:Y,index:g}}else{if(d!==-1)throw new Error("envelope: exactly one swap/bridge action is supported per batch");b(h.to,r.destinations,"destination"),D={...Me(h.data,n),target:_(h.to,"action target"),index:g},d=g}let Z=p(h.value??0,"value"),k=p(h.gasLimit,"gasLimit"),Q=p(h.maxFeePerGas??h.gasPrice,"feePerGas");l+=Z,w+=k,E+=k*Q,u.push({...D,value:Z,gas:k,fee:k*Q})}if(d<0)throw new Error("envelope: reviewed swap/bridge action required");if(l>p(r.maxValueWei,"maxValueWei"))throw new Error("policy: aggregate value exceeds cap");if(w>p(r.maxGasLimit,"maxGasLimit"))throw new Error("policy: aggregate gas exceeds cap");if(E>p(r.maxFeeWei,"maxFeeWei"))throw new Error("policy: aggregate fee exceeds cap");let f=u[d],B=a==="evm-swap"?"swap":"bridge";if(f.action!==B||e.action!==B)throw new Error("envelope: surface/action/calldata mismatch");if(f.recipient!==i)throw new Error("envelope: decoded recipient must equal owner");if(f.depositor&&f.depositor!==i)throw new Error("envelope: decoded bridge depositor must equal owner");if(b(f.inputToken,r.tokens,"input token"),b(f.outputToken,r.tokens,"output token"),f.amountIn<=0n||f.amountIn>p(r.maxPerTrade,"maxPerTrade"))throw new Error("policy: decoded amount exceeds per-trade cap");if(f.minimumOut<=0n)throw new Error("policy: decoded minimum output must be positive");if(V(e.autoSlippage,{nowMs:t,chainId:c,venue:n,tx:s[d],secret:o,requireSigned:!0}),Number(e.slippageBps)!==Number(e.autoSlippage.selectedBps))throw new Error("policy: slippageBps must equal the authenticated quote selectedBps");if(f.minimumOut!==p(e.autoSlippage.minAmountOut,"authenticated quote minAmountOut"))throw new Error("policy: decoded minimum output does not match authenticated quote");if(f.action==="bridge"&&p(e.toChainId,"toChainId")!==f.destinationChainId)throw new Error("envelope: decoded bridge destination chain mismatch");let N=u.filter(g=>g.kind==="approval");if(Ie.has(f.inputToken)){if(N.length)throw new Error("envelope: native-value action must not include token approval")}else{if(N.length!==1)throw new Error("envelope: exactly one approval is required before action");let g=N[0];if(g.index>=d)throw new Error("envelope: approval must be before action");if(g.token!==f.inputToken)throw new Error("envelope: approval token does not match decoded input token");if(g.spender!==f.target)throw new Error("envelope: approval spender does not match decoded action target");if(g.amount!==f.amountIn)throw new Error("envelope: approval amount must exactly match decoded action amount")}let fe=Object.freeze({quoteAmountOut:p(e.autoSlippage.quoteAmountOut,"authenticated quote amountOut"),minAmountOut:p(e.autoSlippage.minAmountOut,"authenticated quote minAmountOut"),selectedBps:Number(e.autoSlippage.selectedBps),quotedAtMs:Number(e.autoSlippage.quotedAtMs),expiresAtMs:Number(e.autoSlippage.expiresAtMs)});return{transactions:s,decoded:u,action:f,totalValue:l,totalGas:w,totalFee:E,chainId:c,owner:i,provider:n,authenticatedQuote:fe}}function ne(e,{localsWaiver:r=!1}={}){if(!(e in re))throw new Error("fee: unknown action");return r?0:re[e]}function z(e,r,{nowMs:t=Date.now(),routeAttestationSecret:o}={}){if(!e||e.version!==1)throw new Error("envelope: version 1 required");let a=U(e.surface,"surface",16);if(!te.has(a))throw new Error("envelope: unsupported public surface");let n=U(e.action,"action",32);if(b(a,r.surfaces,"surface"),b(n,r.actions,"action"),b(e.owner,r.owners,"owner"),b(e.destination,r.destinations,"destination"),!Number.isFinite(e.expiresAtMs)||e.expiresAtMs<=t||e.expiresAtMs-t>Number(r.maxTtlMs))throw new Error("policy: TTL outside bounds");if(!Number.isFinite(e.slippageBps)||e.slippageBps<0||e.slippageBps>Number(r.maxSlippageBps))throw new Error("policy: slippage exceeds cap");let i=e.artifact;if(!i||typeof i!="object"||Array.isArray(i))throw new Error("envelope: structured artifact required");if(oe.has(a))R(e,r,{nowMs:t,routeAttestationSecret:o});else if(a==="evm"){if(W(i.data))throw new Error("envelope: approval requires a strict decoded surface");if(n==="swap"||n==="bridge"||H(i.data))throw new Error("envelope: strict EVM swap/bridge surface required");b(Number(i.chainId),r.chains,"chain");let c=O(i.data);if(b(c,r.selectors,"selector"),String(i.from).toLowerCase()!==String(e.owner).toLowerCase())throw new Error("envelope: owner mismatch");if(String(i.to).toLowerCase()!==String(e.destination).toLowerCase())throw new Error("envelope: destination mismatch");if(p(i.value??0,"value")>p(r.maxValueWei,"maxValueWei"))throw new Error("policy: value exceeds cap");let s=p(i.gasLimit,"gasLimit"),l=p(i.maxFeePerGas??i.gasPrice,"feePerGas");if(s>p(r.maxGasLimit,"maxGasLimit")||s*l>p(r.maxFeeWei,"maxFeeWei"))throw new Error("policy: gas/fee exceeds cap")}else throw a==="btc"||a==="sol"?new Error("envelope: btc/sol require decoded payload; caller-authored outputs and programIds are refused"):new Error("envelope: unsupported public surface");let m=ne(n,{localsWaiver:e.fee?.waiver==="locals-only-verified"});if(Number(e.fee?.oracleFeeBps)!==m)throw new Error("fee: final artifact fee mismatch");return!0}var ae=Object.freeze([...te]),qe=Object.freeze({...j});function Re(e={}){let r={};for(let t of ae){let o=e[t];if(o){if(typeof o.sign!="function"||typeof o.broadcast!="function")throw new Error(`adapter: ${t} requires sign and broadcast functions`);r[t]=Object.freeze({sign:(a,n)=>o.sign(structuredClone(a),structuredClone(n)),broadcast:(a,n,i)=>o.broadcast(a,structuredClone(n),structuredClone(i))})}}return Object.freeze(r)}function Fe(e,r){let t=e?.surface||"evm",o=r?.[t];if(!o)throw new Error(`adapter: ${t} is not configured on this self-host`);return o}var K=e=>String(e||"").toLowerCase(),T=(e,r)=>{try{let t=BigInt(e??0);if(t<0n)throw 0;return t}catch{throw new Error(`policy: ${r} must be a non-negative integer`)}},F=(e,r,t,o=String)=>{if(!Array.isArray(r)||r.length===0)throw new Error(`policy: ${t} allowlist is empty`);if(!r.map(o).includes(o(e)))throw new Error(`policy: ${t} not allowed`)};function S(e){return De("sha256").update(JSON.stringify(e)).digest("hex")}function ie(e,r,{nowMs:t=Date.now()}={}){if(!e||!r)throw new Error("policy: artifact and policy required");if(W(e.data))throw new Error("envelope: approval requires a strict decoded surface");if(H(e.data))throw new Error("envelope: strict EVM swap/bridge surface required");if(F(Number(e.chainId),r.chains,"chain",Number),F(e.to,r.destinations,"destination",K),F(String(e.data||"0x").slice(0,10),r.selectors,"selector",n=>String(n).toLowerCase()),F(e.from,r.owners,"owner",K),T(e.value,"value")>T(r.maxValueWei,"maxValueWei"))throw new Error("policy: value exceeds cap");let o=T(e.gasLimit,"gasLimit");if(o>T(r.maxGasLimit,"maxGasLimit"))throw new Error("policy: gas exceeds cap");if(T(e.maxFeePerGas??e.gasPrice,"feePerGas")*o>T(r.maxFeeWei,"maxFeeWei"))throw new Error("policy: fee exceeds cap");if(!Number.isFinite(e.slippageBps)||e.slippageBps<0||e.slippageBps>Number(r.maxSlippageBps))throw new Error("policy: slippage attestation exceeds cap");if(!Number.isFinite(e.expiresAtMs)||e.expiresAtMs<=t)throw new Error("policy: artifact expired");return!0}var $=class{#e=new Map;constructor({now:r=Date.now}={}){this.now=r}issue({artifact:r,owner:t,ttlMs:o=6e4}){if(o<=0||o>12e4)throw new Error("confirmation: ttl out of range");let a=Pe(32).toString("hex");return this.#e.set(a,{digest:S(r),owner:K(t),expiresAtMs:this.now()+o}),a}consume(r,t){let o=this.#e.get(String(r));if(!o)throw new Error("confirmation: used or unknown nonce");if(o.expiresAtMs<=this.now())throw this.#e.delete(String(r)),new Error("confirmation: expired nonce");let a=Buffer.from(o.digest,"hex"),n=Buffer.from(S(t),"hex");if(!Ve(a,n))throw new Error("confirmation: artifact mismatch");return this.#e.delete(String(r)),o}clear(){this.#e.clear()}};function Ge(e={},r={}){let t={};for(let o of new Set([...Object.keys(e||{}),...Object.keys(r||{})]))t[o]=(BigInt(r?.[o]??0)-BigInt(e?.[o]??0)).toString();return t}function Ue(e){let r=e?.status,t=r===1||r==="0x1"?"success":r===0||r==="0x0"?"failed":"pending",o=e?.verifiedBefore??e?.before,a=e?.verifiedAfter??e?.after;return{transactionHash:e?.hash||e?.transactionHash||null,status:t,balanceDeltaVerified:!!(e?.verifiedBefore&&e?.verifiedAfter),delta:Ge(o,a)}}function se(e){return e?.surface==="evm-swap"||e?.surface==="evm-bridge"}function I(e,r,t=Date.now(),{routeAttestationSecret:o}={}){let a=e?.version===1&&e?.surface?e:null;return a?(z(a,r,{nowMs:t,routeAttestationSecret:o}),se(a)?R(a,r,{nowMs:t,routeAttestationSecret:o}):null):(ie(e,r,{nowMs:t}),null)}async function X(e,r,t){if(!t.isArmed())throw new Error("signer: disarmed");let o=e?.version===1&&e?.surface?e:null,a=()=>typeof t.nowMs=="function"?t.nowMs():t.nowMs??Date.now(),n=typeof t.readPolicy=="function"?t.readPolicy():t.policy,i=n?.confirmationMode||"exact-human";if(t.autonomous===!0){if(t.env?.ORACLE_AUTONOMOUS_TRADING!=="1")throw new Error("signer: autonomous execution requires ORACLE_AUTONOMOUS_TRADING=1");if(typeof t.verifyTriggerAttestation!="function"||await t.verifyTriggerAttestation(o?.triggerAttestation,e)!==!0)throw new Error("signer: autonomous trigger attestation required")}else{if(i==="auto-within-rails")throw new Error("signer: auto-within-rails requires autonomous trading with authenticated trigger attestation");if(i!=="exact-human")throw new Error("signer: unsupported confirmation mode");if(!t.confirmations||typeof t.confirmations.consume!="function")throw new Error("signer: exact confirmation store required");t.confirmations.consume(r,e)}let m=S(e),c=I(e,n,a(),{routeAttestationSecret:t.routeAttestationSecret});typeof t.reserveLedger=="function"&&t.reserveLedger(o||e,n,c);let s=o&&se(o)?q(o):[o?o.artifact:e],l=[],w=[];for(let d=0;d<s.length;d++){if(!t.isArmed())throw new Error("signer: disarmed before signing");if(S(e)!==m)throw new Error("signer: artifact mutated before signing");d>0&&(n=typeof t.readPolicy=="function"?t.readPolicy():t.policy,c=I(e,n,a(),{routeAttestationSecret:t.routeAttestationSecret}));let f=await t.sign(s[d],o);if(l.push(f),!t.isArmed())throw new Error("signer: disarmed before broadcast");if(S(e)!==m)throw new Error("signer: artifact mutated before broadcast");n=typeof t.readPolicy=="function"?t.readPolicy():t.policy,c=I(e,n,a(),{routeAttestationSecret:t.routeAttestationSecret});let B=await t.broadcast(f,s[d],o),N=Ue(B);if(w.push(N),N.status!=="success")break}let E=w.length===s.length&&w.every(d=>d.status==="success")?"success":w.some(d=>d.status==="failed")?"failed":"pending",u={prepared:e,signed:s.length===1?l[0]:l,receipt:w[0]||null,receipts:w,status:E};return o?.surface==="evm-bridge"&&(u.originStatus=E,u.destinationStatus="unverified",u.destinationSuccess=!1,u.note="Origin-chain receipts do not prove destination-chain settlement."),u}import je from"node:http";import{timingSafeEqual as We}from"node:crypto";var ce=new Set(["127.0.0.1","::1","localhost"]),He=(e,r)=>{let t=Buffer.from(String(e)),o=Buffer.from(String(r));return t.length===o.length&&We(t,o)},x=(e,r,t)=>{let o=JSON.stringify(t);e.writeHead(r,{"content-type":"application/json","cache-control":"no-store","content-length":Buffer.byteLength(o)}),e.end(o)},ue=e=>new Promise((r,t)=>{let o=0,a=[],n=!1;e.on("data",i=>{o+=i.length,o>64*1024&&!n?(n=!0,t(new Error("request refused")),e.resume()):n||a.push(i)}),e.on("end",()=>{if(!n)try{r(JSON.parse(Buffer.concat(a).toString()||"{}"))}catch{t(new Error("request refused"))}}),e.on("error",t)});function Je(e={}){let r=e.host||"127.0.0.1";if(!ce.has(r))throw new Error("signer: loopback bind required");if(String(e.token||"").length<32)throw new Error("signer: strong auth token required");let t=e.confirmations||new $,o=e.origin||`http://${r}`;return je.createServer(async(n,i)=>{try{let m=String(n.headers.authorization||"").replace(/^Bearer /i,"");if(!He(m,e.token))return x(i,401,{error:"unauthorized"});let c=String(n.headers.host||"").replace(/^\[|\](?=:|$)/g,"").split(":")[0];if(!ce.has(c))return x(i,403,{error:"host refused"});if(n.headers.origin&&n.headers.origin!==o)return x(i,403,{error:"origin refused"});if(n.method==="GET"&&n.url==="/status")return x(i,200,{ok:!0,armed:e.isArmed?.()===!0,sessionExpiresAtMs:e.sessionExpiresAtMs||null});if(n.method==="POST"&&n.url==="/disarm")return e.disarm?.(),t.clear(),x(i,200,{ok:!0,armed:!1});if(!["GET","POST"].includes(n.method))return x(i,405,{error:"request refused"});if(n.method==="POST"&&String(n.headers["content-type"]||"").split(";",1)[0].trim().toLowerCase()!=="application/json")return x(i,415,{error:"request refused"});if(n.method==="POST"&&n.url==="/confirm"){let s=await ue(n),l=S(s.artifact);if(e.autonomous!==!0){if(typeof e.confirmArtifact!="function")return x(i,403,{error:"local human confirmation unavailable"});let w=typeof e.readPolicy=="function"?e.readPolicy():e.policy,E=typeof e.nowMs=="function"?e.nowMs():e.nowMs??Date.now(),u=I(s.artifact,w,E);if(await e.confirmArtifact(s.artifact,l,u)!==!0)return x(i,400,{error:"exact human confirmation refused"})}return x(i,200,{confirmationNonce:t.issue({artifact:s.artifact,owner:s.artifact?.from,ttlMs:s.ttlMs})})}if(n.method==="POST"&&n.url==="/execute"){let s=await ue(n),l=await X(s.artifact,s.confirmationNonce,{...e,confirmations:t});return x(i,200,l)}return x(i,404,{error:"not found"})}catch(m){return e.onError?.(String(m?.message||m)),x(i,400,{error:"request refused"})}})}export{$ as ConfirmationStore,ae as PUBLIC_SIGNER_SURFACES,qe as REVIEWED_EVM_SELECTORS,S as artifactDigest,ie as assertExactPolicy,Je as createSignerServer,Re as createSurfaceAdapters,q as evmTransactions,X as executeConfirmedArtifact,I as inspectArtifactForConfirmation,R as inspectEvmBatch,ne as publicFeeBps,Fe as surfaceAdapterFor,z as validateSurfaceEnvelope};
+import{createHash as Xr,randomBytes as Zr,timingSafeEqual as Qr}from"node:crypto";import{base58 as _e}from"@scure/base";import{Interface as er,MaxUint256 as rr,isAddress as tr,keccak256 as Xt,toUtf8Bytes as Zt}from"ethers";import{Interface as Qe,isAddress as Lt}from"ethers";import{isAddress as Tt}from"ethers";import{createHash as De,createHmac as je,timingSafeEqual as Ge}from"node:crypto";import{readFileSync as Pe}from"node:fs";import{homedir as We}from"node:os";import{join as U}from"node:path";function Ve(){if(process.env.ORACLE_TEST_ISOLATE_SECRETS==="1"){let t=(process.env.ORACLE_EXEC_ENV_FILE||"").trim();return t?[t]:[]}let e=(process.env.ORACLE_EXEC_ENV_FILE||process.env.MAD_EXEC_ENV_FILE||"").trim(),r=We();if(process.env.ORACLE_PUBLIC_DESKTOP==="1"){let t=(process.env.ORACLE_CONFIG_DIR||U(r,".config","oracle")).trim();return[e,U(t,"exec.env")].filter(Boolean)}return[e,U(r,".config","oracle","exec.env"),U(r,".config","mad-desk","exec.env")].filter(Boolean)}function _(e,r,t){let n=e??process.env[r]??process.env[t];if(!String(n||"").trim())for(let i of Ve())try{let o=Pe(i,"utf8"),a=o.match(new RegExp(`^${r}=(.*)$`,"m"))||o.match(new RegExp(`^${t}=(.*)$`,"m"));if(a&&(n=a[1].trim(),n))break}catch{}if(!String(n||"").trim())throw new Error(`${r} required for attestation. Set it in the environment, or place ${r}=<value> in ~/.config/oracle/exec.env`);return n}function L(e,r,t="guard"){let n=Number(r);if(r==null||!Number.isFinite(n))throw new Error(`${t}: current time must be a finite number (got ${Ue(r)})`);let i=Number(e?.issuedAtMs),o=Number(e?.expiresAtMs);if(!Number.isFinite(o))throw new Error(`${t}: expiresAtMs is required and must be a finite number`);if(n>o)throw new Error(`${t} expired at ${o}, now ${n}`);if(e?.issuedAtMs!=null){if(!Number.isFinite(i))throw new Error(`${t}: issuedAtMs must be a finite number when present`);if(o<=i)throw new Error(`${t}: expiry must be after issuance`)}return{now:n,issuedAtMs:i,expiresAtMs:o}}function Ue(e){return e===null?"null":e===void 0?"undefined":typeof e=="number"?String(e):`${typeof e} ${JSON.stringify(String(e)).slice(0,24)}`}var se=100;function Q(e){return Array.isArray(e)?`[${e.map(Q).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().map(r=>`${JSON.stringify(r)}:${Q(e[r])}`).join(",")}}`:JSON.stringify(e??null)}function He(e,{required:r=!1}={}){try{return _(e,"ORACLE_ROUTE_ATTESTATION_SECRET","MAD_ROUTE_ATTESTATION_SECRET")}catch(t){if(r)throw t;return null}}function ze(e){let{signature:r,...t}=e;return t}function Je(e){let r=String(e||"").toLowerCase();if(!/^0x[0-9a-f]+$/.test(r)||r.length<10||r.length%2!==0)throw new Error("auto-slippage calldata must be even-length hex with a selector");return De("sha256").update(Buffer.from(r.slice(2),"hex")).digest("hex")}function Ke(e,r){let t=Buffer.from(String(e??""),"utf8"),n=Buffer.from(String(r??""),"utf8");return t.length!==n.length||t.length===0?!1:Ge(t,n)}function Xe(e){let r=String(e||"");if(!/^0x[0-9a-fA-F]+$/.test(r)||r.length<10||r.length%2!==0)return null;let t=r.slice(0,10).toLowerCase(),n=[];for(let o=10;o+64<=r.length;o+=64)n.push(r.slice(o,o+64));let i=o=>n[o]==null?null:BigInt("0x"+n[o]);switch(t){case"0x414bf389":return i(6);case"0x04e45aaf":return i(5);case"0xc04b8d59":{let o=i(0);if(o==null)return null;let a=Number(o)/32;return!Number.isInteger(a)||a<0?null:i(a+4)}case"0xb858183f":{let o=i(0);if(o==null)return null;let a=Number(o)/32;return!Number.isInteger(a)||a<0?null:i(a+3)}case"0xa026383e":return i(6);case"0x38ed1739":case"0x5c11d795":return i(1);case"0x7ff36ab5":case"0xb6f9de95":return i(0);case"0x18cbafe5":case"0x791ac947":return i(1);default:return null}}function Y(e,{nowMs:r=Date.now(),chainId:t,venue:n,secret:i,tx:o,requireSigned:a=!1}={}){if(!e||e.mode!=="auto")throw new Error("bounded auto-slippage guard required");let u=He(i,{required:a});if(a&&!u)throw new Error("auto-slippage attestation secret required for signing or broadcast");if(u){let d=je("sha256",u).update(Q(ze(e))).digest("hex");if(!Ke(e.signature,d))throw new Error("auto-slippage guard signature mismatch \u2014 the guard was not issued by this Oracle")}else if(e.signature)throw new Error("auto-slippage guard carries a signature but no attestation secret is configured");let f=Number(e.selectedBps),s=Number(e.capBps);if(!Number.isInteger(f)||f<0||f>se)throw new Error("auto-slippage selected tolerance exceeds hard 100 bps cap");if(!Number.isInteger(s)||s<0||s>se||f>s)throw new Error("auto-slippage cap exceeds hard 100 bps cap");try{L({expiresAtMs:e.expiresAtMs,issuedAtMs:e.quotedAtMs},r,"auto-slippage quote")}catch(d){throw new Error(`${d.message}; re-quote before signing`)}if(t!=null&&Number(e.chainId)!==Number(t))throw new Error("auto-slippage guard chain mismatch");if(n&&String(e.venue).toLowerCase()!==String(n).toLowerCase())throw new Error("auto-slippage guard venue mismatch");let m=BigInt(e.quoteAmountOut??0),l=BigInt(e.minAmountOut??0);if(m<=0n||l<=0n)throw new Error("auto-slippage guard amounts must be positive");let p=m*BigInt(1e4-f),c=p/10000n;if(p%10000n!==0n&&(c+=1n),l<c)throw new Error("auto-slippage guard is under-protected relative to its fresh quote");if(o?.data&&e.minAmountOut!=null){let d=Xe(o.data);if(e.calldataHash!=null){if(String(e.calldataHash)!==Je(o.data))throw new Error("auto-slippage guard is not bound to this call: calldata hash mismatch");if(d!=null&&d!==BigInt(e.minAmountOut))throw new Error(`auto-slippage guard is hash-bound but the calldata encodes ${d}, not the guard floor ${e.minAmountOut}`)}else{if(d==null){let h=String(o.data).slice(0,10);throw new Error(`auto-slippage: cannot verify the output floor encoded by selector ${h}; refusing rather than trusting unbound calldata at an allowlisted venue`)}if(d!==BigInt(e.minAmountOut))throw new Error(`auto-slippage guard is not bound to this call: guard minAmountOut ${e.minAmountOut} but calldata encodes ${d}`)}}return!0}var $t=new Qe(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Ye,isAddress as kt}from"ethers";var Ut=new Ye(["function approve(address spender,uint256 amount) returns (bool)"]),Dt=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});function ce(e,r="amount"){if(typeof e=="bigint")return e;if(typeof e=="number"){if(!Number.isInteger(e))throw new Error(`${r} must be an integer`);if(!Number.isSafeInteger(e))throw new Error(`${r} exceeds safe integer precision \u2014 pass it as a decimal string or BigInt so the exact value is preserved`);return BigInt(e)}let t=String(e??"").trim();if(t==="")throw new Error(`${r} is required`);if(!/^-?\d+$/.test(t)&&!/^0x[0-9a-fA-F]+$/.test(t))throw new Error(`${r} must be an integer in decimal or 0x-hex form, got ${JSON.stringify(t)}`);try{return BigInt(t)}catch{throw new Error(`${r} must be an integer, got ${JSON.stringify(t)}`)}}var nn=new er(["function approve(address spender,uint256 amount) returns (bool)"]);function ue(e,r){let t=String(e||"").trim();if(!tr(t))throw new Error(`${r} must be an address`);return t.toLowerCase()}function nr(e,r="approval amount",{allowZero:t=!1}={}){let n=ce(e,r);if(t?n<0n:n<=0n)throw new Error(`${r} must be positive`);if(n>=rr)throw new Error("unlimited approvals are refused; use an exact bounded amount");return n.toString()}var fe=new Set(["0x095ea7b3","0x39509351","0x61f49ed6","0xeb5625d9","0xf9255c1f","0x87517c45","0xd505accf","0x8fcbaf0c","0x2b67b570","0x2a2d80d1"]),or=new Set(["0x39509351","0xf9255c1f"]);function B(e){let r=String(e||"").toLowerCase();return r.length<10?!1:fe.has(r.slice(0,10))}function de(e){if(!B(e))throw new Error("approval calldata required");let r=String(e||"").toLowerCase(),t=r.slice(0,10),n=r.slice(10).match(/.{1,64}/g)||[],i=s=>n[s]?"0x"+n[s].slice(24):null,o=s=>n[s]?BigInt("0x"+n[s]):null,a=null,u=null,f=null;switch(t){case"0x095ea7b3":case"0x39509351":a=i(0),u=o(1);break;case"0x61f49ed6":case"0xeb5625d9":case"0xf9255c1f":f=i(0),a=i(1),u=o(2);break;case"0xd505accf":a=i(1),u=o(2);break;case"0x8fcbaf0c":{a=i(1),u=o(4)===0n?0n:(1n<<256n)-1n;break}case"0x87517c45":f=i(0),a=i(1),u=o(2);break;default:throw new Error(`approval selector ${t} is recognised but not decodable; refusing to bound it`)}if(a==null||u==null)throw new Error("invalid approve calldata");return{spender:ue(a,"approval spender"),token:f==null?null:ue(f,"approval token"),amount:nr(u,"approval amount",{allowZero:!0}),selector:t,additive:or.has(t)}}import{createHash as ir,createHmac as ar,timingSafeEqual as sr}from"node:crypto";var cr=2,ee=300*1e3,pe=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();function ur(e){let r=e==null||e===""?ee:Number(e);return!Number.isFinite(r)||r<0?ee:Math.min(r,pe)}function re(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(re).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${re(e[t])}`).join(",")}}`}function le(e){let r=String(e?.ORACLE_STAMP_HMAC_SECRET||"").trim();return r.length>=16?r:""}function me(e=process.env){return le(process.env)||le(e)}function fr(e=process.env){return String(process.env.ORACLE_STAMP_REQUIRE_MAC||"").trim()==="1"||String(e?.ORACLE_STAMP_REQUIRE_MAC||"").trim()==="1"}function dr(e){let{oraclePrepared:r,prepareHash:t,prepareMac:n,note:i,...o}=e||{};return o}function lr(e){let r=dr(e);return ir("sha256").update(re(r)).digest("hex")}function pr(e,r=me()){return r?ar("sha256",r).update(String(e)).digest("hex"):""}function mr(e,r){try{let t=Buffer.from(String(e),"hex"),n=Buffer.from(String(r),"hex");return t.length===0||t.length!==n.length?!1:sr(t,n)}catch{return!1}}function we(e,{maxAgeMs:r=ee,nowMs:t=Date.now(),providers:n=null,kinds:i=null,label:o="operator",env:a=process.env}={}){if(!e||typeof e!="object")throw new Error(`${o}: prepared envelope object required`);if(e.oraclePrepared!==!0)throw new Error(`${o}: prepared integrity envelope missing \u2014 use an @oracle-agent/oracle prepare result`);if(Number(e.prepareVersion)!==cr)throw new Error(`${o}: unsupported prepareVersion ${e.prepareVersion}`);let u=lr(e);if(String(e.prepareHash||"")!==u)throw new Error(`${o}: prepareHash mismatch \u2014 payload was altered after prepare`);let f=me(a),s=String(e.prepareMac||"");if(fr(a)||s||f){if(!f)throw new Error(`${o}: prepareMac present or ORACLE_STAMP_REQUIRE_MAC=1 but ORACLE_STAMP_HMAC_SECRET missing in signer`);let h=pr(u,f);if(!s||!mr(s,h))throw new Error(`${o}: prepareMac mismatch \u2014 stamp not from trusted preparer`)}let m=Number(e.preparedAt),l=Number(e.expiresAt),p=ur(r),c=t-m,d=l-m;if(!Number.isFinite(c)||!Number.isFinite(l)||!Number.isFinite(d)||c<0||d<=0||d>pe||c>p||t>l)throw new Error(`${o}: prepare envelope expired or clock-skewed (ageMs=${c}, max=${p})`);if(n&&!new Set(n).has(e.provider))throw new Error(`${o}: provider ${e.provider} not allowed here`);if(i&&!new Set(i).has(e.kind))throw new Error(`${o}: kind ${e.kind} not allowed here`);return!0}var D=e=>String(e||"").toLowerCase(),wr=new Set(["chainId","from","to","data","value","gasLimit","gasPrice","maxFeePerGas","maxPriorityFeePerGas","l1FeeWei","operatorFeeWei","nonce","type","accessList","slippageBps","expiresAtMs"]),hr=new Set([10n,8453n,84532n,42161n,421614n,11155420n,7777777n]);function y(e){try{return hr.has(BigInt(e))}catch{return!1}}var S=(e,r)=>{if(e==null||e==="")throw new Error(`policy: ${r} required`);try{let t=BigInt(e);if(t<0n)throw 0;return t}catch{throw new Error(`policy: ${r} must be a non-negative integer`)}},he=(e,r)=>{let t=Number(e);if(!Number.isFinite(t))throw new Error(`policy: ${r} must be finite`);return t},M=(e,r,t,n=String)=>{if(!Array.isArray(r)||r.length===0)throw new Error(`policy: ${t} allowlist is empty`);if(!r.map(n).includes(n(e)))throw new Error(`policy: ${t} not allowed`)};function j(e,r,{nowMs:t=Date.now(),networkFees:n,requireNetworkFees:i=!1}={}){if(!e||!r)throw new Error("policy: artifact and policy required");if(Object.keys(e).some(c=>!wr.has(c)))throw new Error("policy: unexpected EVM artifact field");if(e.gasPrice!=null&&(e.maxFeePerGas!=null||e.maxPriorityFeePerGas!=null))throw new Error("policy: ambiguous EVM fee fields");if(e.type!=null&&![0,1,2].includes(Number(e.type)))throw new Error("policy: unsupported EVM transaction type");let o=(c,d)=>{try{return BigInt(c)===BigInt(d)}catch{return String(c)===String(d)}};if(!Array.isArray(r.chains)||r.chains.length===0)throw new Error("policy: chain allowlist is empty");if(!r.chains.some(c=>o(c,e.chainId)))throw new Error("policy: chain not allowed");if(M(e.to,r.destinations,"destination",D),M(String(e.data||"0x").slice(0,10),r.selectors,"selector",c=>String(c).toLowerCase()),M(e.from,r.owners,"owner",D),B(e.data)){let c;try{c=de(e.data)}catch(h){throw new Error(`policy: malformed approval calldata: ${h?.message||h}`)}M(c.spender,r.spenders,"spender",D),M(c.token||e.to,r.erc20Tokens,"ERC-20 token",D);let d=S(r.maxApproval,"maxApproval");if(BigInt(c.amount)>d)throw new Error("policy: approval exceeds cap");if(c.additive)throw new Error("policy: additive approval cannot be bounded; use approve() with an absolute amount")}if(S(e.value,"value")>S(r.maxValueWei,"maxValueWei"))throw new Error("policy: value exceeds cap");let a=S(e.gasLimit,"gasLimit");if(a>S(r.maxGasLimit,"maxGasLimit"))throw new Error("policy: gas exceeds cap");let u=e.maxFeePerGas??e.gasPrice,f=S(u,"feePerGas")*a,s=0n;try{if(y(e.chainId)&&(e.l1FeeWei===void 0||e.operatorFeeWei===void 0))throw new Error("missing")}catch{throw new Error("policy: rollup EVM artifacts require l1FeeWei and operatorFeeWei")}if(e.l1FeeWei!==void 0&&(s+=S(e.l1FeeWei,"l1FeeWei")),e.operatorFeeWei!==void 0&&(s+=S(e.operatorFeeWei,"operatorFeeWei")),y(e.chainId)&&(i||n!=null)){if(!n||n.l1FeeWei===void 0||n.operatorFeeWei===void 0)throw new Error("policy: rollup fee estimate required");let c=S(n.l1FeeWei,"estimated l1FeeWei")+S(n.operatorFeeWei,"estimated operatorFeeWei");if(s<c)throw new Error("policy: rollup fee attestation understates estimate")}if(f+s>S(r.maxFeeWei,"maxFeeWei"))throw new Error("policy: fee exceeds cap");let l=he(r.maxSlippageBps,"maxSlippageBps");if(!Number.isFinite(e.slippageBps)||e.slippageBps<0||e.slippageBps>l)throw new Error("policy: slippage attestation exceeds cap");if(!Number.isFinite(e.expiresAtMs)||e.expiresAtMs<=t)throw new Error("policy: artifact expired");let p=he(r.maxTtlMs??12e4,"maxTtlMs");if(p<=0||e.expiresAtMs-t>p)throw new Error("policy: artifact TTL exceeds cap");return!0}import{createHash as ge}from"node:crypto";import{Address as gr,NETWORK as xr,OutScript as xe,RawTx as br,SigHash as be,TEST_NETWORK as Er,Transaction as Sr}from"@scure/btc-signer";var Ee=(e,r)=>{if(e==null||e==="")throw new Error(`policy: ${r} required`);try{let t=BigInt(e);if(t<0n)throw 0;return t}catch{throw new Error(`policy: ${r} must be a non-negative integer`)}},vr=(e,r)=>{if(typeof e!="string"||e.length===0||e.length>131072||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`envelope: invalid ${r}`);let t=Buffer.from(e,"base64");if(t.toString("base64")!==e)throw new Error(`envelope: invalid ${r}`);return t},Ar=e=>Array.isArray(e)||e instanceof Uint8Array?e.length>0:e!=null,yr=e=>/^(bc1|tb1|bcrt1)/i.test(String(e)),F=e=>yr(e)?String(e).toLowerCase():String(e),te=(e,r)=>Array.isArray(r)&&r.some(t=>F(t)===F(e)),Tr=(e,r)=>Buffer.from(e||[]).equals(Buffer.from(r||[]));function Nr(e){let r=Buffer.from(br.encode(e)),t=ge("sha256").update(r).digest();return Buffer.from(ge("sha256").update(t).digest()).reverse().toString("hex")}function Ir(e){if(!e.nonWitnessUtxo)throw new Error("envelope: PSBT input nonWitnessUtxo required");if(Nr(e.nonWitnessUtxo)!==Buffer.from(e.txid||[]).toString("hex"))throw new Error("envelope: Bitcoin prevout txid mismatch");let r=e.nonWitnessUtxo.outputs?.[e.index];if(!r)throw new Error("envelope: Bitcoin prevout output missing");if(!e.witnessUtxo)throw new Error("envelope: PSBT input witness UTXO required");if(BigInt(e.witnessUtxo.amount)!==BigInt(r.amount)||!Tr(e.witnessUtxo.script,r.script))throw new Error("envelope: Bitcoin witness UTXO mismatch");return r}function Br(e,r){if(e.action!=="transfer")throw new Error("envelope: BTC decoder requires transfer action");let t=e?.artifact;if(Object.keys(t).some(l=>!["network","psbt"].includes(l)))throw new Error("envelope: unexpected BTC artifact field");if(!te(t.network,r.chains))throw new Error("policy: chain not allowed");let n=["bitcoin","mainnet"].includes(String(t.network).toLowerCase())?xr:["testnet","signet","regtest"].includes(String(t.network).toLowerCase())?Er:null;if(!n)throw new Error("envelope: unsupported Bitcoin network");let i;try{i=Sr.fromPSBT(vr(t.psbt,"PSBT"))}catch(l){throw new Error(`envelope: invalid PSBT: ${l?.message||l}`)}if(i.inputsLength===0||i.outputsLength===0)throw new Error("envelope: PSBT inputs and outputs required");let o=gr(n);for(let l=0;l<i.inputsLength;l++){let p=i.getInput(l);for(let h of["partialSig","tapKeySig","tapScriptSig","finalScriptSig","finalScriptWitness"])if(Ar(p[h]))throw new Error("envelope: signed or finalized PSBT refused");if(p.sighashType!==void 0&&p.sighashType!==be.DEFAULT&&p.sighashType!==be.ALL)throw new Error("envelope: Bitcoin sighash must bind all inputs and outputs");let c=Ir(p),d;try{let h=xe.decode(c.script);if(!["wpkh"].includes(h.type))throw new Error("unsupported input");d=o.encode(h)}catch{throw new Error("envelope: unsupported Bitcoin input script")}if(!te(d,r.owners)||F(d)!==F(e.owner))throw new Error("envelope: Bitcoin input owner mismatch")}let a=new Set([e.owner,...r.changeAddresses||[]].map(l=>F(l))),u=0n,f=!1,s=[];for(let l=0;l<i.outputsLength;l++){let p=i.getOutput(l),c;try{c=o.encode(xe.decode(p.script))}catch{throw new Error("envelope: unsupported Bitcoin output script")}let d=F(c);if(s.push(`${c}:${p.amount}`),d===F(e.destination)){f=!0,u+=p.amount;continue}if(te(c,r.destinations)){u+=p.amount;continue}if(!a.has(d))throw new Error("policy: Bitcoin output destination not allowed")}if(!f)throw new Error("envelope: Bitcoin destination mismatch");let m;try{m=i.fee}catch{throw new Error("envelope: PSBT fee cannot be decoded")}if(m<0n||m>Ee(r.maxFeeSats,"maxFeeSats"))throw new Error("policy: Bitcoin fee exceeds cap");if(u>Ee(r.maxValueSats,"maxValueSats"))throw new Error("policy: Bitcoin value exceeds cap");return Object.freeze({unit:"sats",value:u.toString(),notional:(u+m).toString(),fee:m.toString(),outputs:Object.freeze(s)})}function Se(e,r){let{unit:t,value:n,notional:i,fee:o}=Br(e,r);return Object.freeze({unit:t,value:n,notional:i,fee:o})}import{getCompiledTransactionMessageDecoder as Fr}from"@solana/transaction-messages";var Or="11111111111111111111111111111111",Lr=5000n,$=(e,r)=>{if(e==null||e==="")throw new Error(`policy: ${r} required`);try{let t=BigInt(e);if(t<0n)throw 0;return t}catch{throw new Error(`policy: ${r} must be a non-negative integer`)}},Cr=(e,r)=>{if(typeof e!="string"||e.length===0||e.length>131072||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`envelope: invalid ${r}`);let t=Buffer.from(e,"base64");if(t.toString("base64")!==e)throw new Error(`envelope: invalid ${r}`);return t},G=(e,r)=>Array.isArray(r)&&r.some(t=>String(t)===String(e));function _r(e,r){if(e.action!=="transfer")throw new Error("envelope: Solana decoder requires transfer action");let t=e?.artifact;if(Object.keys(t).some(d=>!["cluster","messageBase64","exactFeeLamports"].includes(d)))throw new Error("envelope: unexpected Solana artifact field");if(!G(t.cluster,r.chains))throw new Error("policy: chain not allowed");let n;try{n=Fr().decode(Cr(t.messageBase64,"Solana message"))}catch(d){throw new Error(`envelope: invalid Solana message: ${d?.message||d}`)}if(n.version!=="legacy"&&Array.isArray(n.addressTableLookups)&&n.addressTableLookups.length)throw new Error("envelope: unresolved Solana address tables refused");if(n.header.numSignerAccounts!==1||n.staticAccounts[0]!==e.owner||!G(e.owner,r.owners))throw new Error("envelope: Solana owner mismatch");let i=0n,o=!1,a=[];if(!Array.isArray(n.instructions)||n.instructions.length===0)throw new Error("envelope: Solana instructions required");for(let d of n.instructions){let h=n.staticAccounts[d.programAddressIndex];if(!h||!G(h,r.programs))throw new Error("policy: Solana program not allowed");if(h!==Or)throw new Error("envelope: unsupported Solana program decoder");a.push(h);let w=d.accountIndices||[];if(w.length!==2||n.staticAccounts[w[0]]!==e.owner)throw new Error("envelope: Solana transfer owner mismatch");let E=n.staticAccounts[w[1]];if(E!==e.destination||!G(E,r.destinations))throw new Error("envelope: Solana destination mismatch");let A=Buffer.from(d.data||[]);if(A.length!==12||A.readUInt32LE(0)!==2)throw new Error("envelope: unsupported Solana system instruction");i+=A.readBigUInt64LE(4),o=!0}if(!o)throw new Error("envelope: Solana destination mismatch");if(i>$(r.maxValueLamports,"maxValueLamports"))throw new Error("policy: Solana value exceeds cap");let u=$(r.lamportsPerSignature,"lamportsPerSignature");if(u<Lr)throw new Error("policy: Solana per-signature fee is below the network minimum");let f=r.maxLamportsPerSignature===void 0?u:$(r.maxLamportsPerSignature,"maxLamportsPerSignature");if(u>f)throw new Error("policy: Solana per-signature fee exceeds cap");let s=e?.artifact?.exactFeeLamports,m=BigInt(n.header.numSignerAccounts),l=m*u,p=m*f;if(s!==void 0){let d=$(s,"exactFeeLamports");if(d<l)throw new Error("policy: Solana exact fee below the base signature fee");if(d>p)throw new Error("policy: Solana exact fee exceeds the per-signature bound")}let c=p;if(c>$(r.maxFeeLamports,"maxFeeLamports"))throw new Error("policy: Solana fee exceeds cap");return Object.freeze({unit:"lamports",value:i.toString(),notional:(i+c).toString(),fee:c.toString(),programs:Object.freeze(a)})}function ve(e,r){let{unit:t,value:n,notional:i,fee:o}=_r(e,r);return Object.freeze({unit:t,value:n,notional:i,fee:o})}var ye=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var oe=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0}),Mr=new Set(["0x0000000000000000000000000000000000000000","0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"]),Te=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),$r=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}});var H=(e,r,t=256)=>{if(typeof e!="string"||!e||e.length>t)throw new Error(`envelope: bounded ${r} required`);return e},g=(e,r)=>{try{let t=BigInt(e);if(t<0n)throw 0;return t}catch{throw new Error(`envelope: ${r} must be a non-negative integer`)}},Ae=(e,r)=>{let t=Number(e);if(!Number.isFinite(t))throw new Error(`policy: ${r} must be finite`);return t},qr=(e,r)=>{if(!Array.isArray(e)||e.length===0)throw new Error(`policy: ${r} allowlist is empty`);return e},x=(e,r,t)=>{if(!qr(r,t).map(n=>String(n).toLowerCase()).includes(String(e).toLowerCase()))throw new Error(`policy: ${t} not allowed`)},ne=(e,r,t)=>{Array.isArray(r)&&r.length&&x(e,r,t)},N=(e,r)=>{let t=String(e||"").toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw new Error(`envelope: ${r} must be a 20-byte address`);return t},R=e=>String(e||"0x").slice(0,10).toLowerCase(),Ne=e=>g(e.gasLimit,"gasLimit")*g(e.maxFeePerGas??e.gasPrice,"feePerGas")+g(e.l1FeeWei??0,"l1FeeWei")+g(e.operatorFeeWei??0,"operatorFeeWei");function z(e,r,t,{dynamicTail:n=!1}={}){let i=String(e||"").toLowerCase();if(!/^0x[0-9a-f]*$/.test(i)||i.length<10+r*64)throw new Error(`envelope: malformed ${t} calldata`);if(!n&&i.length!==10+r*64)throw new Error(`envelope: malformed ${t} calldata`);return{hex:i,word:o=>i.slice(10+o*64,10+(o+1)*64)}}function v(e,r){if(!/^0{24}[0-9a-f]{40}$/.test(e))throw new Error(`envelope: malformed ${r} address`);return`0x${e.slice(24)}`}function T(e,r){try{return BigInt(`0x${e}`)}catch{throw new Error(`envelope: malformed ${r} integer`)}}function Rr(e){if(R(e)!=="0x095ea7b3")return null;let r=z(e,2,"approval");return{kind:"approval",spender:v(r.word(0),"approval spender"),amount:T(r.word(1),"approval amount")}}function kr(e,r){let t=r==="router02-exact-input-single"?7:8,n=z(e,t,"Uniswap v3 exactInputSingle"),i=t===7?4:5;return{kind:"action",action:"swap",inputToken:v(n.word(0),"input token"),outputToken:v(n.word(1),"output token"),recipient:v(n.word(3),"recipient"),amountIn:T(n.word(i),"amountIn"),minimumOut:T(n.word(i+1),"amountOutMinimum")}}function Pr(e){let r=z(e,12,"Across depositV3",{dynamicTail:!0}),t=T(r.word(11),"message offset");if(t!==384n)throw new Error("envelope: malformed Across depositV3 message offset");let n=10+Number(t)*2;if(r.hex.length<n+64)throw new Error("envelope: malformed Across depositV3 message");let i=Number(BigInt(`0x${r.hex.slice(n,n+64)}`));if(!Number.isSafeInteger(i))throw new Error("envelope: malformed Across depositV3 message length");let o=Math.ceil(i/32)*64;if(r.hex.length!==n+64+o)throw new Error("envelope: malformed Across depositV3 trailing bytes");return{kind:"action",action:"bridge",depositor:v(r.word(0),"depositor"),recipient:v(r.word(1),"recipient"),inputToken:v(r.word(2),"input token"),outputToken:v(r.word(3),"output token"),amountIn:T(r.word(4),"inputAmount"),minimumOut:T(r.word(5),"outputAmount"),destinationChainId:T(r.word(6),"destinationChainId")}}function Wr(e,r){let t=R(e),n=Te[t];if(!n)throw new Error("envelope: opaque or unsupported EVM swap/bridge calldata");if(String(r).toLowerCase()!==n.provider)throw new Error("envelope: provider does not match reviewed selector");if(n.action==="swap")return{...kr(e,n.layout),selector:t,provider:n.provider};if(n.action==="bridge")return{...Pr(e),selector:t,provider:n.provider};throw new Error("envelope: unsupported reviewed EVM action")}function Vr(e){let r=z(e,4,"SeaDrop mintPublic");return{kind:"mint",action:"mint",contract:v(r.word(0),"mint NFT contract"),feeRecipient:v(r.word(1),"mint fee recipient"),recipient:v(r.word(2),"mint recipient"),quantity:T(r.word(3),"mint quantity")}}function Ur(e,r){let t=R(e),n=$r[t];if(!n)throw new Error("envelope: opaque or unsupported NFT mint calldata");if(String(r).toLowerCase()!==n.provider)throw new Error("envelope: provider does not match reviewed NFT selector");if(n.layout==="seadrop-mint-public")return{...Vr(e),selector:t,provider:n.provider};throw new Error("envelope: unsupported reviewed NFT action")}function q(e){let r=e?.artifact;if(Array.isArray(r?.transactions))return r.transactions;if(r?.transaction&&typeof r.transaction=="object")return[r.transaction];if(r?.data)return[r];throw new Error("envelope: ordered EVM transaction batch required")}function Ie(e,r,t,{nowMs:n=Date.now(),networkFees:i,requireNetworkFees:o=!1}={}){let a=N(e.owner,"owner"),u=e.artifact,f=Number(u?.chainId??q(e)[0]?.chainId);if(!Number.isSafeInteger(f)||f<=0)throw new Error("envelope: explicit batch chainId required");if(x(f,r.chains,"chain"),u?.owner!==void 0&&N(u.owner,"batch owner")!==a)throw new Error("envelope: explicit batch owner mismatch");let s=q(e);if(!s.length||s.length>8)throw new Error("envelope: bounded EVM transaction batch required");let m=0n,l=0n,p=0n;for(let c of s){if(!c||typeof c!="object"||Array.isArray(c))throw new Error("envelope: structured EVM transaction required");if(Number(c.chainId)!==f)throw new Error("envelope: every batch leg must use the same chain");if(N(c.from,"transaction owner")!==a)throw new Error("envelope: every batch leg must use the same owner");if(x(R(c.data),r.selectors,"selector"),m+=g(c.value??0,"value"),l+=g(c.gasLimit,"gasLimit"),p+=Ne(c),y(f)&&(c.l1FeeWei===void 0||c.operatorFeeWei===void 0))throw new Error("policy: rollup EVM artifacts require l1FeeWei and operatorFeeWei")}if(m>g(r.maxValueWei,"maxValueWei"))throw new Error("policy: aggregate value exceeds cap");if(l>g(r.maxGasLimit,"maxGasLimit"))throw new Error("policy: aggregate gas exceeds cap");if(p>g(r.maxFeeWei,"maxFeeWei"))throw new Error("policy: aggregate fee exceeds cap");return{transactions:s,chainId:f,owner:a,totalValue:m,totalGas:l,totalFee:p}}function Be(e,r,{nowMs:t=Date.now(),routeAttestationSecret:n}={}){let i=String(e?.surface||"");if(i!=="evm-swap"&&i!=="evm-bridge")throw new Error("envelope: strict EVM swap/bridge surface required");let o=H(e.provider,"provider",64).toLowerCase();x(o,r.providers,"provider");let a=Ie(e,r,i,{nowMs:t}),u=[],f=-1;for(let c=0;c<a.transactions.length;c++){let d=a.transactions[c],h=Rr(d.data),w;if(h){if(f!==-1)throw new Error("envelope: approval must be before action");if(g(d.value??0,"value")!==0n)throw new Error("envelope: approval cannot transfer native value");let O=N(d.to,"approval token");if(x(O,r.tokens,"token"),x(h.spender,r.spenders,"spender"),h.amount>g(r.maxApproval,"maxApproval"))throw new Error("policy: approval exceeds cap");w={...h,token:O,index:c}}else{if(f!==-1)throw new Error("envelope: exactly one swap/bridge action is supported per batch");x(d.to,r.destinations,"destination"),w={...Wr(d.data,o),target:N(d.to,"action target"),index:c},f=c}let E=g(d.value??0,"value"),A=g(d.gasLimit,"gasLimit");u.push({...w,value:E,gas:A,fee:Ne(d)})}if(f<0)throw new Error("envelope: reviewed swap/bridge action required");let s=u[f],m=i==="evm-swap"?"swap":"bridge";if(s.action!==m||e.action!==m)throw new Error("envelope: surface/action/calldata mismatch");if(N(e.destination,"destination")!==s.target)throw new Error("envelope: destination must equal decoded action target");if(s.recipient!==a.owner)throw new Error("envelope: decoded recipient must equal owner");if(s.depositor&&s.depositor!==a.owner)throw new Error("envelope: decoded bridge depositor must equal owner");if(x(s.inputToken,r.tokens,"input token"),x(s.outputToken,r.tokens,"output token"),s.amountIn<=0n||s.amountIn>g(r.maxPerTrade,"maxPerTrade"))throw new Error("policy: decoded amount exceeds per-trade cap");if(s.minimumOut<=0n)throw new Error("policy: decoded minimum output must be positive");if(Y(e.autoSlippage,{nowMs:t,chainId:a.chainId,venue:o,tx:a.transactions[f],secret:n,requireSigned:!0}),Number(e.slippageBps)!==Number(e.autoSlippage.selectedBps))throw new Error("policy: slippageBps must equal the authenticated quote selectedBps");if(s.minimumOut!==g(e.autoSlippage.minAmountOut,"authenticated quote minAmountOut"))throw new Error("policy: decoded minimum output does not match authenticated quote");if(s.action==="bridge"&&g(e.toChainId,"toChainId")!==s.destinationChainId)throw new Error("envelope: decoded bridge destination chain mismatch");let l=u.filter(c=>c.kind==="approval");if(!Mr.has(s.inputToken))throw new Error("envelope: strict local signer swap/bridge requires native input token; use wallet signing for token-unit rails");if(l.length)throw new Error("envelope: native-value action must not include token approval");if(s.value!==s.amountIn)throw new Error("envelope: native value must exactly match decoded amountIn");let p=Object.freeze({quoteAmountOut:g(e.autoSlippage.quoteAmountOut,"authenticated quote amountOut"),minAmountOut:g(e.autoSlippage.minAmountOut,"authenticated quote minAmountOut"),selectedBps:Number(e.autoSlippage.selectedBps),quotedAtMs:Number(e.autoSlippage.quotedAtMs),expiresAtMs:Number(e.autoSlippage.expiresAtMs)});return{...a,decoded:u,action:s,provider:o,authenticatedQuote:p}}function Fe(e,r,{nowMs:t=Date.now()}={}){if(e?.surface!=="evm-nft")throw new Error("envelope: evm-nft surface required");if(!["mint","nft"].includes(e.action))throw new Error("envelope: evm-nft requires mint action");let n=H(e.provider||e.artifact?.provider||"opensea-nft","provider",64).toLowerCase();ne(n,r.providers,"provider");let i=e.artifact?.oraclePrepared===!0?e.artifact:e.prepared;i?.oraclePrepared===!0&&we(i,{nowMs:t,providers:Array.isArray(r.providers)&&r.providers.length?r.providers:null,kinds:["nft-mint"],label:"local-signer"});let o=Ie(e,r,"evm-nft",{nowMs:t});if(o.transactions.length!==1)throw new Error("envelope: mint supports exactly one transaction");let a=o.transactions[0],u=R(a.data);x(u,r.selectors,"selector"),x(a.to,r.destinations,"destination");let f=Ur(a.data,n),s=N(e.contract??e.artifact?.contract,"NFT contract");if(ne(s,r.nftContracts,"NFT contract"),f.contract!==s)throw new Error("envelope: mint calldata NFT contract mismatch");if(f.recipient!==o.owner)throw new Error("envelope: mint calldata recipient mismatch");ne(f.feeRecipient,r.nftFeeRecipients,"mint fee recipient");let m=g(e.quantity??e.artifact?.quantity,"quantity");if(m<=0n||m>g(r.maxMintQuantity??1,"maxMintQuantity"))throw new Error("policy: mint quantity exceeds cap");if(f.quantity!==m)throw new Error("envelope: mint calldata quantity mismatch");let l=g(e.totalWei??e.artifact?.totalWei,"totalWei");if(o.totalValue!==l)throw new Error("envelope: mint value does not match declared totalWei");if((e.priceWei!==void 0||e.artifact?.priceWei!==void 0)&&g(e.priceWei??e.artifact.priceWei,"priceWei")*m!==l)throw new Error("envelope: mint price does not match declared totalWei");if(l>g(r.maxMintTotalWei??r.maxValueWei,"maxMintTotalWei"))throw new Error("policy: mint total exceeds cap");return{...o,provider:n,decoded:[{...f,target:N(a.to,"mint target"),value:o.totalValue,gas:o.totalGas,fee:o.totalFee}]}}function Oe(e,{localsWaiver:r=!1}={}){if(!(e in oe))throw new Error("fee: unknown action");return r?0:oe[e]}function k(e,r,{nowMs:t=Date.now(),verifyFeeWaiver:n,routeAttestationSecret:i,networkFees:o,requireNetworkFees:a=!1}={}){if(!e||e.version!==1)throw new Error("envelope: version 1 required");let u=H(e.surface,"surface",16);if(!ye.has(u))throw new Error("envelope: unsupported public surface");let f=H(e.action,"action",32);x(u,r.surfaces,"surface"),x(f,r.actions,"action"),x(e.owner,r.owners,"owner"),x(e.destination,r.destinations,"destination");let s=Ae(r.maxTtlMs,"maxTtlMs"),m=Ae(r.maxSlippageBps,"maxSlippageBps");if(!Number.isFinite(e.expiresAtMs)||e.expiresAtMs<=t||e.expiresAtMs-t>s)throw new Error("policy: TTL outside bounds");if(!Number.isFinite(e.slippageBps)||e.slippageBps<0||e.slippageBps>m)throw new Error("policy: slippage exceeds cap");let l=e.artifact;if(!l||typeof l!="object"||Array.isArray(l))throw new Error("envelope: structured artifact required");if(u==="evm-swap"||u==="evm-bridge")Be(e,r,{nowMs:t,routeAttestationSecret:i});else if(u==="evm-nft")Fe(e,r,{nowMs:t});else if(u==="evm"){if(!["transfer","approve"].includes(f))throw new Error("envelope: generic evm requires transfer or approve; use strict evm-nft for mint action");if(f==="swap"||f==="bridge")throw new Error("envelope: surface/action mismatch; use strict decoded surface");if(String(l.to).toLowerCase()!==String(e.destination).toLowerCase())throw new Error("envelope: destination mismatch");if(String(l.from).toLowerCase()!==String(e.owner).toLowerCase())throw new Error("envelope: artifact from mismatch with owner");j({...l,slippageBps:e.slippageBps,expiresAtMs:e.expiresAtMs},r,{nowMs:t,networkFees:o,requireNetworkFees:a});let d=String(l.data||"0x").toLowerCase(),h=g(l.value,"EVM value");if(d==="0x"){if(h===0n)throw new Error("envelope: native EVM transfer value required")}else if(B(d)){if(h!==0n)throw new Error("envelope: EVM approval cannot transfer native value")}else throw new Error("envelope: unsupported generic EVM calldata")}else u==="btc"?Se(e,r):u==="sol"&&ve(e,r);let p=Number(e.fee?.oracleFeeBps)===0&&oe[f]!==0;if(e.fee?.waiver||p&&!e.fee?.waiverAttestation)throw new Error("fee: verified waiver attestation required");if(p&&(typeof n!="function"||n(e.fee.waiverAttestation,e)!==!0))throw new Error("fee: waiver attestation invalid");let c=Oe(f,{localsWaiver:p});if(Number(e.fee?.oracleFeeBps)!==c)throw new Error("fee: final artifact fee mismatch");return!0}var J=Object.freeze([...ye]),Dr=Object.freeze({...Te});function jr(e={}){let r={};for(let t of J){let n=e[t];if(n){if(typeof n.simulate!="function"||typeof n.sign!="function"||typeof n.broadcast!="function")throw new Error(`adapter: ${t} requires simulate, sign, and broadcast functions`);r[t]=Object.freeze({simulate:(i,o)=>n.simulate(structuredClone(i),structuredClone(o)),sign:(i,o)=>n.sign(structuredClone(i),structuredClone(o)),broadcast:(i,o,a)=>n.broadcast(i,structuredClone(o),structuredClone(a))})}}return Object.freeze(r)}function Gr(e,r){let t=e?.surface||"evm",n=r?.[t];if(!n)throw new Error(`adapter: ${t} is not configured on this self-host`);return n}import{ed25519 as An}from"@noble/curves/ed25519.js";import{base58 as Hr}from"@scure/base";import{RawTx as Nn,SigHash as In,Transaction as zr}from"@scure/btc-signer";import{Transaction as Jr}from"ethers";var Le=e=>{if(typeof e!="string"||e.length===0||e.length>262144||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))return null;let r=Buffer.from(e,"base64");return r.toString("base64")===e?r:null};function Kr(e){let r=0,t=0,n=0;for(;n<e.length&&n<3;){let i=e[n++];if(r|=(i&127)<<t,(i&128)===0)return{value:r,offset:n};t+=7}return null}function Ce(e,r){try{if(String(e).startsWith("evm"))return Jr.from(r).hash;if(e==="btc"){let t=Le(r);if(!t)return null;let n=zr.fromPSBT(t);return n.finalize(),n.extract(),n.id}if(e==="sol"){let t=Le(r);if(!t)return null;let n=Kr(t);if(!n||n.value!==1)return null;let i=t.subarray(n.offset,n.offset+64);return i.length===64?Hr.encode(i):null}}catch{}return null}var Yr=e=>String(e||"").toLowerCase();function I(e){return Xr("sha256").update(JSON.stringify(e)).digest("hex")}function X(e,r,t={}){return j(e,r,t)}async function et(e,r={}){if(!y(e?.chainId))return{l1FeeWei:"0",operatorFeeWei:"0"};if(typeof r.estimateNetworkFees!="function")throw new Error("policy: rollup fee estimate required");let t=await r.estimateNetworkFees(e);if(!t||t.l1FeeWei===void 0||t.operatorFeeWei===void 0)throw new Error("policy: rollup fee estimate required");return{l1FeeWei:String(t.l1FeeWei),operatorFeeWei:String(t.operatorFeeWei)}}function Me(e,r,t=!1){if(!y(e?.chainId))return!0;if(e.l1FeeWei===void 0||e.operatorFeeWei===void 0)throw new Error("policy: rollup EVM artifacts require l1FeeWei and operatorFeeWei");if(t||r!=null){if(!r||r.l1FeeWei===void 0||r.operatorFeeWei===void 0)throw new Error("policy: rollup fee estimate required");let n=BigInt(e.l1FeeWei)+BigInt(e.operatorFeeWei),i=BigInt(r.l1FeeWei)+BigInt(r.operatorFeeWei);if(n<i)throw new Error("policy: rollup fee attestation understates estimate")}return!0}function rt(e,r={}){return renderConfirmationArtifact(e,I(e),r)}var P=class{#e=new Map;constructor({now:r=Date.now}={}){this.now=r}issue({artifact:r,owner:t,ttlMs:n=6e4}){if(!Number.isFinite(n)||!Number.isInteger(n)||n<=0||n>12e4)throw new Error("confirmation: ttl out of range");let i=Zr(32).toString("hex");return this.#e.set(i,{digest:I(r),owner:Yr(t),expiresAtMs:this.now()+n}),i}consume(r,t){let n=this.#e.get(String(r));if(!n)throw new Error("confirmation: used or unknown nonce");if(n.expiresAtMs<=this.now())throw this.#e.delete(String(r)),new Error("confirmation: expired nonce");let i=Buffer.from(n.digest,"hex"),o=Buffer.from(I(t),"hex");if(!Qr(i,o))throw new Error("confirmation: artifact mismatch");return this.#e.delete(String(r)),n}clear(){this.#e.clear()}};function tt(e){let r=String(e?.data||"0x").toLowerCase(),t=BigInt(e?.value??0);if(r==="0x"){if(t<=0n)throw new Error("signer: native EVM transfer value required");return!0}if(B(r)){if(t!==0n)throw new Error("signer: EVM approval cannot transfer native value");return!0}throw new Error("signer: unsupported EVM calldata; use a versioned envelope")}function nt(e={},r={}){let t={};for(let n of new Set([...Object.keys(e||{}),...Object.keys(r||{})]))t[n]=(BigInt(r?.[n]??0)-BigInt(e?.[n]??0)).toString();return t}function K(e,r){let t=String(r||"");if(String(e).startsWith("evm"))return/^0x[0-9a-fA-F]{64}$/.test(t);if(e==="btc")return/^[0-9a-fA-F]{64}$/.test(t);if(e==="sol")try{let n=_e.decode(t);return n.length===64&&_e.encode(n)===t}catch{return!1}return!1}function $e(e,r,t){return!K(e,r)||!K(e,t)?!1:e==="sol"?String(r)===String(t):String(r).toLowerCase()===String(t).toLowerCase()}function ot(e){let r=e?.confirmationMode;if(r!=="exact-human"&&r!=="auto-within-rails")throw new Error("signer: confirmationMode must be exact-human or auto-within-rails");return r}async function ie({artifact:e,envelope:r,nonce:t,deps:n,policy:i,confirmation:o,consumeNonce:a,nowMs:u}){let f=ot(i);if(n.autonomous===!0){if(n.env?.ORACLE_AUTONOMOUS_TRADING!=="1")throw new Error("signer: autonomous execution requires ORACLE_AUTONOMOUS_TRADING=1");if(f!=="auto-within-rails")throw new Error("signer: autonomous execution requires auto-within-rails policy");if(typeof n.verifyTriggerAttestation!="function"||await n.verifyTriggerAttestation(r?.triggerAttestation,e,u())!==!0)throw new Error("signer: autonomous trigger attestation required");return o}if(f!=="exact-human")throw new Error("signer: non-autonomous execution requires exact-human exact confirmation policy");if(!n.confirmations)throw new Error("signer: exact-human confirmation store required");if(a)return n.confirmations.consume(t,e);if(!o||!Number.isFinite(o.expiresAtMs)||o.expiresAtMs<=u())throw new Error("confirmation: expired nonce");return o}function it(e){return e==="evm-swap"||e==="evm-bridge"||e==="evm-nft"}function at(e,r){return e&&it(e.surface)?q(e):[r]}function st(e,r){let t=e?.hash??null,n=e?.transactionHash??null;if(t!=null&&n!=null&&!$e(r,t,n))throw new Error("signer: receipt reports conflicting transaction hashes");return t||n||null}function ct(e,r){let t=e?.verifiedBefore??e?.before,n=e?.verifiedAfter??e?.after;return{transactionHash:r,status:e?.status,balanceDeltaVerified:!!(e?.verifiedBefore&&e?.verifiedAfter),delta:nt(t,n)}}async function ae(e,r,t){if(!t.isArmed())throw new Error("signer: disarmed");let n=e?.version===1&&e?.surface?e:null,i=n?n.artifact:(()=>{let{tradeId:w,...E}=e||{};return E})(),o=at(n,i),a=typeof t.readPolicy=="function"?t.readPolicy():t.policy,u=()=>typeof t.nowMs=="function"?t.nowMs():t.nowMs??Date.now(),f=await ie({artifact:e,envelope:n,nonce:r,deps:t,policy:a,confirmation:null,consumeNonce:!0,nowMs:u}),s=I(e),m=(w={})=>{n?k(n,a,w):(X(i,a,{nowMs:w.nowMs,networkFees:w.networkFees,requireNetworkFees:w.requireNetworkFees}),tt(i))},l=async w=>{let E=n&&!String(n.surface||"").startsWith("evm")?void 0:await et(w,t);return{nowMs:u(),verifyFeeWaiver:t.verifyFeeWaiver,routeAttestationSecret:t.routeAttestationSecret,networkFees:E,requireNetworkFees:y(w?.chainId)}};m({nowMs:u(),verifyFeeWaiver:t.verifyFeeWaiver,routeAttestationSecret:t.routeAttestationSecret});for(let w of["reserveLedger","validateReservation","commitLedger","releaseLedger","settleFailedLedger"])if(typeof t[w]!="function")throw new Error(`signer: ${w} is required`);let p=t.reserveLedger(n||e,a);if(!p)throw new Error("signer: ledger reservation required");let c=!1,d=[];try{for(let w of o){if(typeof t.simulate!="function"||await t.simulate(w,n)!==!0)throw new Error("signer: strict affirmative simulation required");let E=await l(w);if(Me(w,E.networkFees,E.requireNetworkFees),!t.isArmed())throw new Error("signer: disarmed before signing");a=typeof t.readPolicy=="function"?t.readPolicy():t.policy,f=await ie({artifact:e,envelope:n,nonce:r,deps:t,policy:a,confirmation:f,consumeNonce:!1,nowMs:u}),m(E),t.validateReservation(p,a,n&&typeof t.decodeEconomics=="function"?t.decodeEconomics(n,a):void 0),c=!0;let A=await t.sign(w,n);if(typeof t.verifySigned!="function"||await t.verifySigned(A,w,n)!==!0)throw new Error("signer: signed bytes do not match confirmed artifact");if(!t.isArmed())throw new Error("signer: disarmed before broadcast");if(I(e)!==s)throw new Error("signer: artifact mutated after signing");a=typeof t.readPolicy=="function"?t.readPolicy():t.policy,f=await ie({artifact:e,envelope:n,nonce:r,deps:t,policy:a,confirmation:f,consumeNonce:!1,nowMs:u});let O=await l(w);Me(w,O.networkFees,O.requireNetworkFees),m(O),t.validateReservation(p,a,n&&typeof t.decodeEconomics=="function"?t.decodeEconomics(n,a):void 0);let Z=await t.broadcast(A,w,n),W=Z?.status,C=n?.surface||"evm",V=st(Z,C),ke=Ce(C,A);if(!$e(C,V,ke))throw new Error("signer: receipt transaction hash does not match signed bytes");if(W===0||W==="0x0")throw K(C,V)?(t.settleFailedLedger(p),new Error("signer: broadcast did not return a successful receipt")):new Error("signer: failed broadcast requires a valid transaction hash");if(W!==1&&W!=="0x1")throw new Error("signer: broadcast did not return a successful receipt");if(!K(C,V))throw new Error("signer: successful broadcast requires a valid transaction hash");d.push(ct(Z,V))}}catch(w){throw c||t.releaseLedger(p),w}if(t.commitLedger(p),d.length===1){let w={receipt:d[0]};return n?.surface==="evm-bridge"&&(w.originStatus="success",w.destinationStatus="unverified",w.destinationSuccess=!1,w.note="Origin-chain receipts do not prove destination-chain settlement."),w}let h={receipts:d,status:"success"};return n?.surface==="evm-bridge"&&(h.originStatus="success",h.destinationStatus="unverified",h.destinationSuccess=!1,h.note="Origin-chain receipts do not prove destination-chain settlement."),h}import ut from"node:http";import{timingSafeEqual as ft}from"node:crypto";var qe=new Set(["127.0.0.1","::1","localhost"]),dt=(e,r)=>{let t=Buffer.from(String(e)),n=Buffer.from(String(r));return t.length===n.length&&ft(t,n)},b=(e,r,t)=>{let n=JSON.stringify(t);e.writeHead(r,{"content-type":"application/json","cache-control":"no-store","content-length":Buffer.byteLength(n)}),e.end(n)};function lt(e){let r=String(e||"");if(r.startsWith("[")){let t=r.indexOf("]");if(t>1)return r.slice(1,t)}return r.split(":")[0]}var Re=e=>new Promise((r,t)=>{let n=0,i=[],o=!1;e.on("data",a=>{n+=a.length,n>64*1024&&!o?(o=!0,t(new Error("request refused")),e.resume()):o||i.push(a)}),e.on("end",()=>{if(!o)try{r(JSON.parse(Buffer.concat(i).toString()||"{}"))}catch{t(new Error("request refused"))}}),e.on("error",t)});function pt(e={}){let r=e.host||"127.0.0.1";if(!qe.has(r))throw new Error("signer: loopback bind required");if(String(e.token||"").length<32)throw new Error("signer: strong auth token required");for(let o of["reserveLedger","validateReservation","commitLedger","releaseLedger","settleFailedLedger"])if(typeof e[o]!="function")throw new Error(`signer: ${o} is required`);if(typeof e.disarm!="function")throw new Error("signer: disarm callback is required");let t=e.confirmations||new P,n=e.origin||`http://${r}`;return ut.createServer(async(o,a)=>{try{let u=String(o.headers.authorization||"").replace(/^Bearer /i,"");if(!dt(u,e.token))return b(a,401,{error:"unauthorized"});let f=lt(o.headers.host);if(!qe.has(f))return b(a,403,{error:"host refused"});if(o.headers.origin&&o.headers.origin!==n)return b(a,403,{error:"origin refused"});if(o.method==="GET"&&o.url==="/status"){let s=typeof e.readPolicy=="function"?e.readPolicy():e.policy,m=new Set(J),l=Array.isArray(s?.surfaces)?s.surfaces.filter(p=>typeof p=="string"&&m.has(p)):[];return b(a,200,{ok:!0,service:"oracle-signer",armed:e.isArmed?.()===!0,surfaces:l,sessionExpiresAtMs:e.sessionExpiresAtMs||null})}if(o.method==="POST"&&o.url==="/disarm")return e.disarm(),t.clear(),b(a,200,{ok:!0,armed:!1});if(!["GET","POST"].includes(o.method))return b(a,405,{error:"request refused"});if(o.method==="POST"&&String(o.headers["content-type"]||"").split(";",1)[0].trim().toLowerCase()!=="application/json")return b(a,415,{error:"request refused"});if(o.method==="POST"&&o.url==="/confirm"){if(e.autonomous===!0)return b(a,403,{error:"autonomous signer does not issue human confirmation nonces"});let s=await Re(o),m=I(s.artifact),l=typeof e.readPolicy=="function"?e.readPolicy():e.policy;if(l?.confirmationMode!=="exact-human")return b(a,403,{error:"exact-human policy required"});let p=typeof e.nowMs=="function"?e.nowMs():Date.now();if(s.artifact?.version===1&&s.artifact?.surface)k(s.artifact,l,{nowMs:p,verifyFeeWaiver:e.verifyFeeWaiver});else{let{tradeId:c,...d}=s.artifact||{};X(d,l,{nowMs:p})}return typeof e.confirmArtifact!="function"?b(a,403,{error:"local human confirmation unavailable"}):await e.confirmArtifact(s.artifact,m,l)!==!0?b(a,400,{error:"exact human confirmation refused"}):b(a,200,{confirmationNonce:t.issue({artifact:s.artifact,owner:s.artifact?.owner??s.artifact?.from,ttlMs:s.ttlMs})})}if(o.method==="POST"&&o.url==="/execute"){let s=await Re(o),m=await ae(s.artifact,s.confirmationNonce,{...e,confirmations:t});return b(a,200,m)}return b(a,404,{error:"not found"})}catch(u){return e.onError?.(String(u?.message||u)),b(a,400,{error:"request refused"})}})}export{P as ConfirmationStore,J as PUBLIC_SIGNER_SURFACES,Dr as REVIEWED_EVM_SELECTORS,I as artifactDigest,X as assertExactPolicy,pt as createSignerServer,jr as createSurfaceAdapters,q as evmTransactions,ae as executeConfirmedArtifact,rt as inspectArtifactForConfirmation,Be as inspectEvmBatch,Fe as inspectEvmNft,Oe as publicFeeBps,Gr as surfaceAdapterFor,k as validateSurfaceEnvelope};