@oracle-agent/oracle 0.24.9 → 0.24.10

package/dist/cli/commands/receipt.mjs

@@ -1,5 +1,5 @@
-var E={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},W=new Map(Object.values(E).map(t=>[t.chainId,t]));function f(t){let o=t?.transactionHash||t?.hash||t?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Transaction as Dt}from"@scure/btc-signer";import{ed25519 as Vt}from"@noble/curves/ed25519.js";import{base58 as Lr}from"@scure/base";import{Interface as _,MaxUint256 as Ie,isAddress as _e,keccak256 as Le,toUtf8Bytes as Ne}from"ethers";import{Interface as O,isAddress as ae}from"ethers";import{isAddress as ee}from"ethers";var fe=new O(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as I,isAddress as pe}from"ethers";var ge=new I(["function approve(address spender,uint256 amount) returns (bool)"]),Ee=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Pe=new _(["function approve(address spender,uint256 amount) returns (bool)"]);var Fe=300*1e3,Me=(()=>{let t=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(t)&&t>0?t:1800*1e3})();import{Address as We,NETWORK as Ve,OutScript as Ge,RawTx as He,SigHash as ze,TEST_NETWORK as Je,Transaction as Ke}from"@scure/btc-signer";import{getCompiledTransactionMessageDecoder as Ye}from"@solana/transaction-messages";var T=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var fr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var R=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),lr=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}});var C=Object.freeze([...T]),dr=Object.freeze({...R});import{ed25519 as hr}from"@noble/curves/ed25519.js";import{base58 as gr}from"@scure/base";import{RawTx as Sr,SigHash as xr,Transaction as yr}from"@scure/btc-signer";import{Transaction as vr}from"ethers";var Ur=Object.freeze({N:1<<17,r:8,p:1}),jr=256*1024*1024,Dr=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var x=process.env.ORACLE_PUBLIC_DESKTOP==="1",P=x?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),Hr=x?P:w(h(),".config","mad-desk");var Xr="0".repeat(64),Yr=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Qr=Promise.resolve();import{Wallet as ct}from"ethers";import{base58 as ft}from"@scure/base";import{ed25519 as dt}from"@noble/curves/ed25519.js";import{NETWORK as mt,TEST_NETWORK as ht,WIF as wt,p2wpkh as gt}from"@scure/btc-signer";import{pubECDSA as St}from"@scure/btc-signer/utils.js";var dn=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import d from"node:fs";import F from"node:os";import u from"node:path";import{fileURLToPath as M}from"node:url";var q=u.dirname(M(import.meta.url)),En=u.resolve(q,"../..");function b(){return process.env.ORACLE_FAKE_HOME||F.homedir()}function U(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return U()?process.env.ORACLE_CONFIG_DIR||u.join(b(),".config","oracle"):u.join(b(),".config","oracle")}function j(){return u.join(g(),"desk.json")}function D(){return u.join(g(),"env")}function c({force:t=!1}={}){if(c._done&&!t)return c._result||null;c._done=!0;let o={},r=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=D();if(d.existsSync(n))for(let e of d.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let s=i[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),r(i[1],s)}}catch{}try{let n=j();if(d.existsSync(n)){let e=JSON.parse(d.readFileSync(n,"utf8"));e&&typeof e=="object"&&(r("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),r("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),r("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),r("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),r("ORACLE_EXEC_URL",e.execUrl),r("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let a=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return a&&(r("ORACLE_DESK_URL",a),r("ORACLE_DATA_URL",a),r("ORACLE_API_URL",a),r("ORACLE_PUBLIC_URL",a),r("MAD_DESK_URL",a)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var Bn={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(t){let o=t.argv||[],r={},a=o.indexOf("--hash"),n=o.indexOf("--json");if(a>=0)r={transactionHash:o[a+1]};else if(n>=0)try{r=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
-`),1}let e=f(r);return o.includes("--quiet")?process.stdout.write(`${JSON.stringify(e)}
+var E={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},V=new Map(Object.values(E).map(r=>[r.chainId,r]));function f(r){let o=r?.transactionHash||r?.hash||r?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Transaction as Kt}from"@scure/btc-signer";import{ed25519 as Xt}from"@noble/curves/ed25519.js";import{base58 as Pr}from"@scure/base";import{Interface as _,MaxUint256 as _e,isAddress as Le,keccak256 as Ne,toUtf8Bytes as ke}from"ethers";import{Interface as T,isAddress as ce}from"ethers";import{isAddress as te}from"ethers";var de=new T(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as I,isAddress as he}from"ethers";var Se=new I(["function approve(address spender,uint256 amount) returns (bool)"]),ye=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Fe=new _(["function approve(address spender,uint256 amount) returns (bool)"]);var qe=300*1e3,Ue=(()=>{let r=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(r)&&r>0?r:1800*1e3})();import{Address as Ve,NETWORK as He,OutScript as Ge,RawTx as ze,SigHash as Ke,TEST_NETWORK as Ze,Transaction as Xe}from"@scure/btc-signer";import{createHash as N}from"node:crypto";import{base58 as rr}from"@scure/base";import{getCompiledTransactionMessageDecoder as nr}from"@solana/transaction-messages";var S=r=>N("sha256").update(`global:${r}`).digest().subarray(0,8).toString("hex"),or=new Map([[S("route"),{name:"route",prefixBytes:0}],[S("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var R=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var wr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var C=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),gr=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Er=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var B=Object.freeze([...R]),Sr=Object.freeze({...C});import{ed25519 as br}from"@noble/curves/ed25519.js";import{base58 as Ar}from"@scure/base";import{RawTx as Tr,SigHash as Ir,Transaction as _r}from"@scure/btc-signer";import{Transaction as Nr}from"ethers";var Gr=Object.freeze({N:1<<17,r:8,p:1}),zr=256*1024*1024,Kr=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var x=process.env.ORACLE_PUBLIC_DESKTOP==="1",F=x?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),Qr=x?F:w(h(),".config","mad-desk");var ot="0".repeat(64),it=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var at=Promise.resolve();import{Wallet as ht}from"ethers";import{base58 as gt}from"@scure/base";import{ed25519 as St}from"@noble/curves/ed25519.js";import{NETWORK as xt,TEST_NETWORK as bt,WIF as vt,p2wpkh as At}from"@scure/btc-signer";import{pubECDSA as Tt}from"@scure/btc-signer/utils.js";var Sn=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import d from"node:fs";import q from"node:os";import u from"node:path";import{fileURLToPath as U}from"node:url";var j=u.dirname(U(import.meta.url)),On=u.resolve(j,"../..");function v(){return process.env.ORACLE_FAKE_HOME||q.homedir()}function D(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return D()?process.env.ORACLE_CONFIG_DIR||u.join(v(),".config","oracle"):u.join(v(),".config","oracle")}function W(){return u.join(g(),"desk.json")}function J(){return u.join(g(),"env")}function c({force:r=!1}={}){if(c._done&&!r)return c._result||null;c._done=!0;let o={},t=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=J();if(d.existsSync(n))for(let e of d.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let s=i[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t(i[1],s)}}catch{}try{let n=W();if(d.existsSync(n)){let e=JSON.parse(d.readFileSync(n,"utf8"));e&&typeof e=="object"&&(t("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),t("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),t("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),t("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),t("ORACLE_EXEC_URL",e.execUrl),t("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let a=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return a&&(t("ORACLE_DESK_URL",a),t("ORACLE_DATA_URL",a),t("ORACLE_API_URL",a),t("ORACLE_PUBLIC_URL",a),t("MAD_DESK_URL",a)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var jn={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(r){let o=r.argv||[],t={},a=o.indexOf("--hash"),n=o.indexOf("--json");if(a>=0)t={transactionHash:o[a+1]};else if(n>=0)try{t=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
+`),1}let e=f(t);return o.includes("--quiet")?process.stdout.write(`${JSON.stringify(e)}
 `):e.happened?process.stdout.write(`happened  ${e.hash}
 `):process.stdout.write(`did not happen  ${e.note}
-`),e.happened?0:2}};export{Bn as default};
+`),e.happened?0:2}};export{jn as default};

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-import d from"node:fs";import W from"node:path";import O from"node:fs";import se from"node:os";import x from"node:path";import{fileURLToPath as ce}from"node:url";var ue=x.dirname(ce(import.meta.url)),nr=x.resolve(ue,"../..");function D(){return process.env.ORACLE_FAKE_HOME||se.homedir()}function fe(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function T(){return fe()?process.env.ORACLE_CONFIG_DIR||x.join(D(),".config","oracle"):x.join(D(),".config","oracle")}function le(){return x.join(T(),"desk.json")}function de(){return x.join(T(),"env")}function S({force:e=!1}={}){if(S._done&&!e)return S._result||null;S._done=!0;let n={},r=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=de();if(O.existsSync(i))for(let o of O.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let i=le();if(O.existsSync(i)){let o=JSON.parse(O.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),S._result=Object.keys(n).length?n:null,S._result}try{S()}catch{}import{createCipheriv as pe,createDecipheriv as me,randomBytes as L,scryptSync as he}from"node:crypto";import a from"node:fs";import m from"node:path";var j="ORACLE-LOCAL-VAULT",V=1,v=Object.freeze({N:1<<17,r:8,p:1}),we=256*1024*1024,ge=16*1024;function I(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function G(e,n,r=v){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return he(t,n,32,{...r,maxmem:we})}function H(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=L(32),o=L(12),s={magic:j,version:V,kdf:{name:"scrypt",...v,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=G(n,i);try{let l=pe("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([l.update(t),l.final()]);return{...s,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function _(e,n){if(e?.magic!==j||e?.version!==V)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==v.N||e.kdf.r!==v.r||e.kdf.p!==v.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=I(e.kdf.salt,32,"salt"),i=I(e.cipher.iv,12,"iv"),o=I(e.tag,16,"tag"),s=I(e.ciphertext,1,"ciphertext",{max:ge}),{ciphertext:c,tag:l,...u}=e,f=G(n,t);try{let p=me("aes-256-gcm",f,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function Se(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function z(e){let n=m.dirname(e),r=a.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=a.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=a.fstatSync(n);if(Se(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=a.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function C(e){return JSON.parse(w(e))}function J(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${L(6).toString("hex")}.tmp`),t;try{t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(t,JSON.stringify(n,null,2)+`
-`),a.fsyncSync(t),a.closeSync(t),t=void 0;let i=a.openSync(r,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(r,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(t!==void 0)try{a.closeSync(t)}catch{}try{a.unlinkSync(r)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${L(6).toString("hex")}.tmp`);try{let t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(t,String(n)),a.fsyncSync(t)}finally{a.closeSync(t)}a.renameSync(r,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(t){try{a.unlinkSync(r)}catch{}throw t}}import h from"node:path";import Ve from"node:os";import{createHash as Ge,randomBytes as Kn}from"node:crypto";import{Transaction as Zn}from"@scure/btc-signer";import{ed25519 as Qn}from"@noble/curves/ed25519.js";import{base58 as Vt}from"@scure/base";import{Interface as ve,MaxUint256 as Dr,isAddress as jr,keccak256 as Vr,toUtf8Bytes as Gr}from"ethers";import{Interface as ye,isAddress as br}from"ethers";import{isAddress as wr}from"ethers";var Tr=new ye(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as be,isAddress as Nr}from"ethers";var Cr=new be(["function approve(address spender,uint256 amount) returns (bool)"]),Fr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Zr=new ve(["function approve(address spender,uint256 amount) returns (bool)"]);var Qr=300*1e3,et=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as it,NETWORK as at,OutScript as st,RawTx as ct,SigHash as ut,TEST_NETWORK as ft,Transaction as lt}from"@scure/btc-signer";import{getCompiledTransactionMessageDecoder as mt}from"@solana/transaction-messages";var Te=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var Tt=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var Ie=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),It=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}});var Le=Object.freeze([...Te]),Lt=Object.freeze({...Ie});import{ed25519 as Bt}from"@noble/curves/ed25519.js";import{base58 as Ct}from"@scure/base";import{RawTx as Rt,SigHash as $t,Transaction as Mt}from"@scure/btc-signer";import{Transaction as qt}from"ethers";import{createHmac as _e,randomBytes as hn,timingSafeEqual as Ce}from"node:crypto";import Fe from"node:fs";import E from"node:path";import{homedir as $}from"node:os";import{join as M}from"node:path";var X=process.env.ORACLE_PUBLIC_DESKTOP==="1",Be=X?process.env.ORACLE_CONFIG_DIR||M($(),".config","oracle"):M($(),".config","oracle"),on=X?Be:M($(),".config","mad-desk");var fn="0".repeat(64),ln=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function k(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(k).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+k(e[r])).join(",")+"}"}var dn=Promise.resolve();function Re(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=s=>{try{return Fe.realpathSync(s)}catch{return E.resolve(s)}},t=r(E.dirname(E.resolve(e))),i=r(E.dirname(E.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+E.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var P=(e,n)=>_e("sha256",n).update(k(e)).digest("hex"),$e=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&Ce(r,t)};function Me(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:P(t,n)}}}function Z(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!$e(t?.integrity?.mac,P(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Pe(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Z(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(t)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:P(s,r)}})+`
-`)}function Y(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=Z(t,i);Re(t,e);let s=Number(o.sequence||0)+1,c=Me(r,i,{sequence:s});Pe(t,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
-`)}import{Wallet as q}from"ethers";import{base58 as ee}from"@scure/base";import{ed25519 as qe}from"@noble/curves/ed25519.js";import{NETWORK as re,TEST_NETWORK as te,WIF as Ue,p2wpkh as Q}from"@scure/btc-signer";import{pubECDSA as We}from"@scure/btc-signer/utils.js";var De=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},je=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},y=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function b(e,n){let r=String(n||"").trim();if(e==="evm")return new q(r).privateKey;if(e==="btc")for(let o of[re,te])try{return Buffer.from(Ue(o).decode(r))}catch{}if(e==="sol")try{return y(ee.decode(r),"sol")}catch{}let t=De(r);if(t)return e==="evm"?new q(`0x${t.toString("hex")}`).privateKey:y(t,e);let i=je(r);if(i)return y(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return y(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return b(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let r=new q(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=y(n,"btc"),t=We(r);return{kind:e,secret:r.toString("hex"),addresses:[Q(t,re).address,Q(t,te).address]}}if(e==="sol"){let r=y(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[ee.encode(qe.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function U(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=A(o,b(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ne(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function oe(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function ie(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(Ve.homedir(),".local","state"),"oracle"),r=Ge("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as He}from"node:crypto";import{Wallet as ze}from"ethers";var ae=`oracle sign init|import|policy|status|lock|doctor
+import d from"node:fs";import j from"node:path";import T from"node:fs";import ce from"node:os";import y from"node:path";import{fileURLToPath as ue}from"node:url";var fe=y.dirname(ue(import.meta.url)),ir=y.resolve(fe,"../..");function D(){return process.env.ORACLE_FAKE_HOME||ce.homedir()}function le(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function O(){return le()?process.env.ORACLE_CONFIG_DIR||y.join(D(),".config","oracle"):y.join(D(),".config","oracle")}function de(){return y.join(O(),"desk.json")}function pe(){return y.join(O(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},r=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=pe();if(T.existsSync(i))for(let o of T.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let i=de();if(T.existsSync(i)){let o=JSON.parse(T.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),E._result=Object.keys(n).length?n:null,E._result}try{E()}catch{}import{createCipheriv as me,createDecipheriv as he,randomBytes as k,scryptSync as we}from"node:crypto";import a from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",J=1,v=Object.freeze({N:1<<17,r:8,p:1}),ge=256*1024*1024,Ee=16*1024;function I(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function V(e,n,r=v){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return we(t,n,32,{...r,maxmem:ge})}function G(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=k(32),o=k(12),s={magic:W,version:J,kdf:{name:"scrypt",...v,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=V(n,i);try{let l=me("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([l.update(t),l.final()]);return{...s,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function B(e,n){if(e?.magic!==W||e?.version!==J)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==v.N||e.kdf.r!==v.r||e.kdf.p!==v.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=I(e.kdf.salt,32,"salt"),i=I(e.cipher.iv,12,"iv"),o=I(e.tag,16,"tag"),s=I(e.ciphertext,1,"ciphertext",{max:Ee}),{ciphertext:c,tag:l,...u}=e,f=V(n,t);try{let p=he("aes-256-gcm",f,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function ye(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function H(e){let n=m.dirname(e),r=a.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=a.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=a.fstatSync(n);if(ye(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=a.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function R(e){return JSON.parse(w(e))}function z(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),H(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${k(6).toString("hex")}.tmp`),t;try{t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(t,JSON.stringify(n,null,2)+`
+`),a.fsyncSync(t),a.closeSync(t),t=void 0;let i=a.openSync(r,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(r,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(t!==void 0)try{a.closeSync(t)}catch{}try{a.unlinkSync(r)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),H(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${k(6).toString("hex")}.tmp`);try{let t=a.openSync(r,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(t,String(n)),a.fsyncSync(t)}finally{a.closeSync(t)}a.renameSync(r,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(t){try{a.unlinkSync(r)}catch{}throw t}}import h from"node:path";import Ge from"node:os";import{createHash as He,randomBytes as to}from"node:crypto";import{Transaction as oo}from"@scure/btc-signer";import{ed25519 as ao}from"@noble/curves/ed25519.js";import{base58 as Zt}from"@scure/base";import{Interface as Ae,MaxUint256 as Jr,isAddress as Vr,keccak256 as Gr,toUtf8Bytes as Hr}from"ethers";import{Interface as be,isAddress as Ar}from"ethers";import{isAddress as Er}from"ethers";var kr=new be(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ve,isAddress as _r}from"ethers";var Fr=new ve(["function approve(address spender,uint256 amount) returns (bool)"]),Mr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Qr=new Ae(["function approve(address spender,uint256 amount) returns (bool)"]);var rt=300*1e3,tt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as st,NETWORK as ct,OutScript as ut,RawTx as ft,SigHash as lt,TEST_NETWORK as dt,Transaction as pt}from"@scure/btc-signer";import{createHash as Oe}from"node:crypto";import{base58 as gt}from"@scure/base";import{getCompiledTransactionMessageDecoder as yt}from"@solana/transaction-messages";var K=e=>Oe("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),St=new Map([[K("route"),{name:"route",prefixBytes:0}],[K("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var ke=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol"]);var Bt=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0});var Ne=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Rt=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),Ct=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Le=Object.freeze([...ke]),Ft=Object.freeze({...Ne});import{ed25519 as qt}from"@noble/curves/ed25519.js";import{base58 as Ut}from"@scure/base";import{RawTx as Dt,SigHash as Wt,Transaction as Jt}from"@scure/btc-signer";import{Transaction as Gt}from"ethers";import{createHmac as Ce,randomBytes as bn,timingSafeEqual as Fe}from"node:crypto";import Me from"node:fs";import S from"node:path";import{homedir as M}from"node:os";import{join as P}from"node:path";var Z=process.env.ORACLE_PUBLIC_DESKTOP==="1",Re=Z?process.env.ORACLE_CONFIG_DIR||P(M(),".config","oracle"):P(M(),".config","oracle"),dn=Z?Re:P(M(),".config","mad-desk");var gn="0".repeat(64),En=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+L(e[r])).join(",")+"}"}var yn=Promise.resolve();function Pe(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=s=>{try{return Me.realpathSync(s)}catch{return S.resolve(s)}},t=r(S.dirname(S.resolve(e))),i=r(S.dirname(S.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+S.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var q=(e,n)=>Ce("sha256",n).update(L(e)).digest("hex"),qe=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&Fe(r,t)};function $e(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(t,n)}}}function Y(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!qe(t?.integrity?.mac,q(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Ue(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Y(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(t)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(s,r)}})+`
+`)}function Q(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=Y(t,i);Pe(t,e);let s=Number(o.sequence||0)+1,c=$e(r,i,{sequence:s});Ue(t,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
+`)}import{Wallet as $}from"ethers";import{base58 as re}from"@scure/base";import{ed25519 as je}from"@noble/curves/ed25519.js";import{NETWORK as te,TEST_NETWORK as ne,WIF as De,p2wpkh as ee}from"@scure/btc-signer";import{pubECDSA as We}from"@scure/btc-signer/utils.js";var Je=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},Ve=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},x=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function b(e,n){let r=String(n||"").trim();if(e==="evm")return new $(r).privateKey;if(e==="btc")for(let o of[te,ne])try{return Buffer.from(De(o).decode(r))}catch{}if(e==="sol")try{return x(re.decode(r),"sol")}catch{}let t=Je(r);if(t)return e==="evm"?new $(`0x${t.toString("hex")}`).privateKey:x(t,e);let i=Ve(r);if(i)return x(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return x(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return b(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let r=new $(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=x(n,"btc"),t=We(r);return{kind:e,secret:r.toString("hex"),addresses:[ee(t,te).address,ee(t,ne).address]}}if(e==="sol"){let r=x(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[re.encode(je.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function U(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=A(o,b(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function oe(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ie(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function ae(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(Ge.homedir(),".local","state"),"oracle"),r=He("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as ze}from"node:crypto";import{Wallet as Ke}from"ethers";var se=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -11,14 +11,14 @@ import d from"node:fs";import W from"node:path";import O from"node:fs";import se
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,B=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},Je=e=>{let n=String(B(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Ke(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let l of c){if(l===3){s(),t(new Error("cancelled"));return}if(l===13||l===10){s(),process.stderr.write(`
-`),r(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function Xe(e,n){let r=B(e,"--passphrase-file");return r?w(r):Ke("Vault passphrase: ",n)}function Ze(e){return e.addresses.join(", ")}async function Ye(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||T(),o=ie(W.join(i,"signer"));if(!t||t==="help")return r.write(ae+`
+They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},Xe=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Ze(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let l of c){if(l===3){s(),t(new Error("cancelled"));return}if(l===13||l===10){s(),process.stderr.write(`
+`),r(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function Ye(e,n){let r=_(e,"--passphrase-file");return r?w(r):Ze("Vault passphrase: ",n)}function Qe(e){return e.addresses.join(", ")}async function er(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||O(),o=ae(j.join(i,"signer"));if(!t||t==="help")return r.write(se+`
 `),0;if(t==="status")return r.write(JSON.stringify({initialized:d.existsSync(o.vault),policyConfigured:d.existsSync(o.policy),armed:d.existsSync(o.vault)&&!d.existsSync(o.lock),disarmed:d.existsSync(o.lock)})+`
-`),0;if(t==="lock")return d.mkdirSync(W.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
+`),0;if(t==="lock")return d.mkdirSync(j.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),r.write(`Local signer locked.
 `),0;if(t==="doctor"){let u=[];return d.existsSync(o.vault)||u.push("vault missing"),d.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),r.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
-`),u.length?1:0}if(t==="policy"){if(!d.existsSync(o.vault)||!d.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=B(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let f;try{f=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(f[p])||f[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return Y(o.policy,o.policyKey,f,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let s=await Xe(e,n),c={};if(d.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=C(o.vault),f=_(u,s);try{c=U(f,u.meta)}finally{f.fill(0)}}if(t==="init"){let u=ze.createRandom();c.evm=A("evm",b("evm",u.privateKey))}else{let u=Je(e),f=B(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");c[u]=A(u,b(u,w(f)))}d.mkdirSync(W.dirname(o.vault),{recursive:!0,mode:448}),J(o.vault,H(ne(c),s,oe(c))),d.existsSync(o.policyKey)||g(o.policyKey,He(32).toString("hex")+`
-`);let l=Object.entries(c).map(([u,f])=>`${u}:${Ze(f)}`).join(" ");return r.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
-`),0}var vo={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:ae,run:e=>Ye(e.argv||[])};export{vo as default,Ye as run};
+`),u.length?1:0}if(t==="policy"){if(!d.existsSync(o.vault)||!d.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=_(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let f;try{f=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(f[p])||f[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return Q(o.policy,o.policyKey,f,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let s=await Ye(e,n),c={};if(d.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=R(o.vault),f=B(u,s);try{c=U(f,u.meta)}finally{f.fill(0)}}if(t==="init"){let u=Ke.createRandom();c.evm=A("evm",b("evm",u.privateKey))}else{let u=Xe(e),f=_(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");c[u]=A(u,b(u,w(f)))}d.mkdirSync(j.dirname(o.vault),{recursive:!0,mode:448}),z(o.vault,G(oe(c),s,ie(c))),d.existsSync(o.policyKey)||g(o.policyKey,ze(32).toString("hex")+`
+`);let l=Object.entries(c).map(([u,f])=>`${u}:${Qe(f)}`).join(" ");return r.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
+`),0}var Lo={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:se,run:e=>er(e.argv||[])};export{Lo as default,er as run};