@oracle-agent/oracle 0.25.2 → 0.25.3

package/dist/cli/commands/receipt.mjs

@@ -1,5 +1,5 @@
-var y={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},ee=new Map(Object.values(y).map(r=>[r.chainId,r]));function l(r){let o=r?.transactionHash||r?.hash||r?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Transaction as io}from"@scure/btc-signer";import{ed25519 as ao}from"@noble/curves/ed25519.js";import{base58 as Ft}from"@scure/base";import{Interface as C,MaxUint256 as $e,isAddress as Me,keccak256 as Fe,toUtf8Bytes as qe}from"ethers";import{Interface as N,isAddress as ge}from"ethers";import{isAddress as de}from"ethers";var be=new N(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as _,isAddress as ve}from"ethers";var Oe=new _(["function approve(address spender,uint256 amount) returns (bool)"]),Le=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Je=new C(["function approve(address spender,uint256 amount) returns (bool)"]);var ze=300*1e3,Ve=(()=>{let r=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(r)&&r>0?r:1800*1e3})();import{Address as Qe,NETWORK as er,OutScript as rr,RawTx as tr,SigHash as nr,TEST_NETWORK as or,Transaction as ir}from"@scure/btc-signer";import{createHash as B}from"node:crypto";import{base58 as ur}from"@scure/base";import{getCompiledTransactionMessageDecoder as dr}from"@solana/transaction-messages";var x=r=>B("sha256").update(`global:${r}`).digest().subarray(0,8).toString("hex"),fr=new Map([[x("route"),{name:"route",prefixBytes:0}],[x("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Lr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Nr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Pr="0x"+"00".repeat(32);var R=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Fr=Object.freeze(R.map(r=>r[0]));var U=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var tt=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var D=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),nt=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),ot=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var j=Object.freeze([...U]),it=Object.freeze({...D});import{ed25519 as bt}from"@noble/curves/ed25519.js";import{base58 as At}from"@scure/base";import{RawTx as It,SigHash as kt,Transaction as Tt}from"@scure/btc-signer";import{Transaction as Lt,keccak256 as Nt,verifyTypedData as _t}from"ethers";import{encode as ct}from"@msgpack/msgpack";import{keccak256 as lt,verifyTypedData as dt}from"ethers";var ft=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),pt=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var Yt=Object.freeze({N:1<<17,r:8,p:1}),Xt=256*1024*1024,Zt=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var I=process.env.ORACLE_PUBLIC_DESKTOP==="1",G=I?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),tn=I?G:w(h(),".config","mad-desk");var cn="0".repeat(64),un=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var ln=Promise.resolve();import{Wallet as En}from"ethers";import{base58 as bn}from"@scure/base";import{ed25519 as An}from"@noble/curves/ed25519.js";import{NETWORK as In,TEST_NETWORK as kn,WIF as Tn,p2wpkh as On}from"@scure/btc-signer";import{pubECDSA as Nn}from"@scure/btc-signer/utils.js";var $o=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import f from"node:fs";import V from"node:os";import u from"node:path";import{fileURLToPath as K}from"node:url";var Y=u.dirname(K(import.meta.url)),jo=u.resolve(Y,"../..");function T(){return process.env.ORACLE_FAKE_HOME||V.homedir()}function X(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return X()?process.env.ORACLE_CONFIG_DIR||u.join(T(),".config","oracle"):u.join(T(),".config","oracle")}function Z(){return u.join(g(),"desk.json")}function Q(){return u.join(g(),"env")}function c({force:r=!1}={}){if(c._done&&!r)return c._result||null;c._done=!0;let o={},t=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=Q();if(f.existsSync(n))for(let e of f.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),t(i[1],a)}}catch{}try{let n=Z();if(f.existsSync(n)){let e=JSON.parse(f.readFileSync(n,"utf8"));e&&typeof e=="object"&&(t("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),t("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),t("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),t("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),t("ORACLE_EXEC_URL",e.execUrl),t("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let s=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return s&&(t("ORACLE_DESK_URL",s),t("ORACLE_DATA_URL",s),t("ORACLE_API_URL",s),t("ORACLE_PUBLIC_URL",s),t("MAD_DESK_URL",s)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var oi={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(r){let o=r.argv||[],t={},s=o.indexOf("--hash"),n=o.indexOf("--json");if(s>=0)t={transactionHash:o[s+1]};else if(n>=0)try{t=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
+var y={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},re=new Map(Object.values(y).map(r=>[r.chainId,r]));function l(r){let o=r?.transactionHash||r?.hash||r?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Transaction as co}from"@scure/btc-signer";import{ed25519 as lo}from"@noble/curves/ed25519.js";import{base58 as Dt}from"@scure/base";import{Interface as U}from"ethers";import{Interface as C,MaxUint256 as Me,isAddress as Fe,keccak256 as qe,toUtf8Bytes as Ue}from"ethers";import{Interface as N,isAddress as ye}from"ethers";import{isAddress as fe}from"ethers";var Se=new N(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as _,isAddress as Ie}from"ethers";var Le=new _(["function approve(address spender,uint256 amount) returns (bool)"]),Ne=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Ge=new C(["function approve(address spender,uint256 amount) returns (bool)"]);var Ve=300*1e3,Ke=(()=>{let r=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(r)&&r>0?r:1800*1e3})();import{Address as er,NETWORK as rr,OutScript as tr,RawTx as nr,SigHash as or,TEST_NETWORK as ir,Transaction as sr}from"@scure/btc-signer";import{createHash as B}from"node:crypto";import{base58 as lr}from"@scure/base";import{getCompiledTransactionMessageDecoder as fr}from"@solana/transaction-messages";var x=r=>B("sha256").update(`global:${r}`).digest().subarray(0,8).toString("hex"),pr=new Map([[x("route"),{name:"route",prefixBytes:0}],[x("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Nr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),_r=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Br="0x"+"00".repeat(32);var R=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),qr=Object.freeze(R.map(r=>r[0]));var D=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var ot=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var j=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),it=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),st=new U(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),at=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var W=Object.freeze([...D]),ct=Object.freeze({...j});import{ed25519 as vt}from"@noble/curves/ed25519.js";import{base58 as Tt}from"@scure/base";import{RawTx as Ot,SigHash as Lt,Transaction as Nt}from"@scure/btc-signer";import{Transaction as Ct,keccak256 as Pt,verifyTypedData as Bt}from"ethers";import{encode as dt}from"@msgpack/msgpack";import{keccak256 as pt,verifyTypedData as mt}from"ethers";var ht=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),wt=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var Qt=Object.freeze({N:1<<17,r:8,p:1}),en=256*1024*1024,rn=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var I=process.env.ORACLE_PUBLIC_DESKTOP==="1",z=I?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),sn=I?z:w(h(),".config","mad-desk");var dn="0".repeat(64),fn=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var pn=Promise.resolve();import{Wallet as Sn}from"ethers";import{base58 as vn}from"@scure/base";import{ed25519 as Tn}from"@noble/curves/ed25519.js";import{NETWORK as On,TEST_NETWORK as Ln,WIF as Nn,p2wpkh as _n}from"@scure/btc-signer";import{pubECDSA as Pn}from"@scure/btc-signer/utils.js";var qo=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import f from"node:fs";import K from"node:os";import u from"node:path";import{fileURLToPath as Y}from"node:url";var X=u.dirname(Y(import.meta.url)),Jo=u.resolve(X,"../..");function k(){return process.env.ORACLE_FAKE_HOME||K.homedir()}function Z(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return Z()?process.env.ORACLE_CONFIG_DIR||u.join(k(),".config","oracle"):u.join(k(),".config","oracle")}function Q(){return u.join(g(),"desk.json")}function ee(){return u.join(g(),"env")}function c({force:r=!1}={}){if(c._done&&!r)return c._result||null;c._done=!0;let o={},t=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=ee();if(f.existsSync(n))for(let e of f.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),t(i[1],a)}}catch{}try{let n=Q();if(f.existsSync(n)){let e=JSON.parse(f.readFileSync(n,"utf8"));e&&typeof e=="object"&&(t("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),t("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),t("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),t("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),t("ORACLE_EXEC_URL",e.execUrl),t("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let s=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return s&&(t("ORACLE_DESK_URL",s),t("ORACLE_DATA_URL",s),t("ORACLE_API_URL",s),t("ORACLE_PUBLIC_URL",s),t("MAD_DESK_URL",s)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var ai={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(r){let o=r.argv||[],t={},s=o.indexOf("--hash"),n=o.indexOf("--json");if(s>=0)t={transactionHash:o[s+1]};else if(n>=0)try{t=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
 `),1}let e=l(t);return o.includes("--quiet")?process.stdout.write(`${JSON.stringify(e)}
 `):e.happened?process.stdout.write(`happened  ${e.hash}
 `):process.stdout.write(`did not happen  ${e.note}
-`),e.happened?0:2}};export{oi as default};
+`),e.happened?0:2}};export{ai as default};

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-import f from"node:fs";import U from"node:path";import I from"node:fs";import fe from"node:os";import E from"node:path";import{fileURLToPath as pe}from"node:url";var me=E.dirname(pe(import.meta.url)),mr=E.resolve(me,"../..");function j(){return process.env.ORACLE_FAKE_HOME||fe.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function T(){return he()?process.env.ORACLE_CONFIG_DIR||E.join(j(),".config","oracle"):E.join(j(),".config","oracle")}function we(){return E.join(T(),"desk.json")}function ge(){return E.join(T(),"env")}function y({force:e=!1}={}){if(y._done&&!e)return y._result||null;y._done=!0;let n={},r=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=ge();if(I.existsSync(i))for(let o of I.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let c=a[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(a[1],c)}}catch{}try{let i=we();if(I.existsSync(i)){let o=JSON.parse(I.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),y._result=Object.keys(n).length?n:null,y._result}try{y()}catch{}import{createCipheriv as ye,createDecipheriv as Ee,randomBytes as O,scryptSync as xe}from"node:crypto";import s from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",H=1,A=Object.freeze({N:1<<17,r:8,p:1}),be=256*1024*1024,Se=16*1024;function k(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function J(e,n,r=A){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return xe(t,n,32,{...r,maxmem:be})}function G(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:W,version:H,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=J(n,i);try{let d=ye("aes-256-gcm",c,o);d.setAAD(Buffer.from(JSON.stringify(a)));let u=Buffer.concat([d.update(t),d.final()]);return{...a,ciphertext:u.toString("base64"),tag:d.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function C(e,n){if(e?.magic!==W||e?.version!==H)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=k(e.kdf.salt,32,"salt"),i=k(e.cipher.iv,12,"iv"),o=k(e.tag,16,"tag"),a=k(e.ciphertext,1,"ciphertext",{max:Se}),{ciphertext:c,tag:d,...u}=e,l=J(n,t);try{let p=Ee("aes-256-gcm",l,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(a),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{l.fill(0)}}function Ae(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function z(e){let n=m.dirname(e),r=s.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=s.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=s.fstatSync(n);if(Ae(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=s.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function B(e){return JSON.parse(w(e))}function V(e,n){s.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),t;try{t=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(t,JSON.stringify(n,null,2)+`
-`),s.fsyncSync(t),s.closeSync(t),t=void 0;let i=s.openSync(r,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(r,e),s.chmodSync(e,384);let c=s.openSync(m.dirname(e),"r");try{s.fsyncSync(c)}finally{s.closeSync(c)}}catch(i){if(t!==void 0)try{s.closeSync(t)}catch{}try{s.unlinkSync(r)}catch{}throw i}return e}function g(e,n){s.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let t=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(t,String(n)),s.fsyncSync(t)}finally{s.closeSync(t)}s.renameSync(r,e),s.chmodSync(e,384);let i=s.openSync(m.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(t){try{s.unlinkSync(r)}catch{}throw t}}import h from"node:path";import rr from"node:os";import{createHash as tr,randomBytes as fi}from"node:crypto";import{Transaction as mi}from"@scure/btc-signer";import{ed25519 as wi}from"@noble/curves/ed25519.js";import{base58 as ro}from"@scure/base";import{Interface as Oe,MaxUint256 as Zr,isAddress as Qr,keccak256 as et,toUtf8Bytes as rt}from"ethers";import{Interface as Te,isAddress as Br}from"ethers";import{isAddress as kr}from"ethers";var Mr=new Te(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ke,isAddress as Dr}from"ethers";var Hr=new ke(["function approve(address spender,uint256 amount) returns (bool)"]),Jr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var at=new Oe(["function approve(address spender,uint256 amount) returns (bool)"]);var ut=300*1e3,lt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as ht,NETWORK as wt,OutScript as gt,RawTx as yt,SigHash as Et,TEST_NETWORK as xt,Transaction as bt}from"@scure/btc-signer";import{createHash as Ne}from"node:crypto";import{base58 as It}from"@scure/base";import{getCompiledTransactionMessageDecoder as kt}from"@solana/transaction-messages";var Y=e=>Ne("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Ot=new Map([[Y("route"),{name:"route",prefixBytes:0}],[Y("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Jt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Gt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Kt="0x"+"00".repeat(32);var _e=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),en=Object.freeze(_e.map(e=>e[0]));var Re=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var En=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var Me=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),xn=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"}}),bn=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Fe=Object.freeze([...Re]),Sn=Object.freeze({...Me});import{ed25519 as Fn}from"@noble/curves/ed25519.js";import{base58 as Dn}from"@scure/base";import{RawTx as jn,SigHash as Wn,Transaction as Hn}from"@scure/btc-signer";import{Transaction as Gn,keccak256 as zn,verifyTypedData as Vn}from"ethers";import{encode as In}from"@msgpack/msgpack";import{keccak256 as kn,verifyTypedData as On}from"ethers";var Ln=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Nn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as We,randomBytes as To,timingSafeEqual as He}from"node:crypto";import Je from"node:fs";import x from"node:path";import{homedir as R}from"node:os";import{join as M}from"node:path";var re=process.env.ORACLE_PUBLIC_DESKTOP==="1",je=re?process.env.ORACLE_CONFIG_DIR||M(R(),".config","oracle"):M(R(),".config","oracle"),wo=re?je:M(R(),".config","mad-desk");var bo="0".repeat(64),So=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function N(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(N).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+N(e[r])).join(",")+"}"}var Ao=Promise.resolve();function Ge(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=a=>{try{return Je.realpathSync(a)}catch{return x.resolve(a)}},t=r(x.dirname(x.resolve(e))),i=r(x.dirname(x.resolve(n))),o=(a,c)=>c===a||c.startsWith(a+x.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var F=(e,n)=>We("sha256",n).update(N(e)).digest("hex"),ze=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&He(r,t)};function Ve(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:F(t,n)}}}function te(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!ze(t?.integrity?.mac,F(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Ke(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=te(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(t)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:F(a,r)}})+`
-`)}function ne(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=te(t,i);Ge(t,e);let a=Number(o.sequence||0)+1,c=Ve(r,i,{sequence:a});Ke(t,a,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
-`)}import{Wallet as q}from"ethers";import{base58 as ie}from"@scure/base";import{ed25519 as Ye}from"@noble/curves/ed25519.js";import{NETWORK as se,TEST_NETWORK as ae,WIF as Xe,p2wpkh as oe}from"@scure/btc-signer";import{pubECDSA as Ze}from"@scure/btc-signer/utils.js";var Qe=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},er=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},b=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function S(e,n){let r=String(n||"").trim();if(e==="evm")return new q(r).privateKey;if(e==="btc")for(let o of[se,ae])try{return Buffer.from(Xe(o).decode(r))}catch{}if(e==="sol")try{return b(ie.decode(r),"sol")}catch{}let t=Qe(r);if(t)return e==="evm"?new q(`0x${t.toString("hex")}`).privateKey:b(t,e);let i=er(r);if(i)return b(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return b(Uint8Array.from(o),e);let a=o.privateKey??o.secretKey??o.key;if(a)return S(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let r=new q(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=b(n,"btc"),t=Ze(r);return{kind:e,secret:r.toString("hex"),addresses:[oe(t,se).address,oe(t,ae).address]}}if(e==="sol"){let r=b(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[ie.encode(Ye.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function D(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=v(o,S(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ce(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ue(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function le(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(rr.homedir(),".local","state"),"oracle"),r=tr("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as nr}from"node:crypto";import{Wallet as or}from"ethers";var de=`oracle sign init|import|policy|status|lock|doctor
+import f from"node:fs";import U from"node:path";import I from"node:fs";import fe from"node:os";import E from"node:path";import{fileURLToPath as pe}from"node:url";var me=E.dirname(pe(import.meta.url)),hr=E.resolve(me,"../..");function j(){return process.env.ORACLE_FAKE_HOME||fe.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function T(){return he()?process.env.ORACLE_CONFIG_DIR||E.join(j(),".config","oracle"):E.join(j(),".config","oracle")}function we(){return E.join(T(),"desk.json")}function ge(){return E.join(T(),"env")}function y({force:e=!1}={}){if(y._done&&!e)return y._result||null;y._done=!0;let n={},r=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=ge();if(I.existsSync(i))for(let o of I.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let c=a[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(a[1],c)}}catch{}try{let i=we();if(I.existsSync(i)){let o=JSON.parse(I.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),y._result=Object.keys(n).length?n:null,y._result}try{y()}catch{}import{createCipheriv as ye,createDecipheriv as Ee,randomBytes as O,scryptSync as xe}from"node:crypto";import s from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",H=1,A=Object.freeze({N:1<<17,r:8,p:1}),be=256*1024*1024,Se=16*1024;function k(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function J(e,n,r=A){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return xe(t,n,32,{...r,maxmem:be})}function G(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:W,version:H,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=J(n,i);try{let d=ye("aes-256-gcm",c,o);d.setAAD(Buffer.from(JSON.stringify(a)));let u=Buffer.concat([d.update(t),d.final()]);return{...a,ciphertext:u.toString("base64"),tag:d.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function B(e,n){if(e?.magic!==W||e?.version!==H)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=k(e.kdf.salt,32,"salt"),i=k(e.cipher.iv,12,"iv"),o=k(e.tag,16,"tag"),a=k(e.ciphertext,1,"ciphertext",{max:Se}),{ciphertext:c,tag:d,...u}=e,l=J(n,t);try{let p=Ee("aes-256-gcm",l,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(a),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{l.fill(0)}}function Ae(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function z(e){let n=m.dirname(e),r=s.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=s.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=s.fstatSync(n);if(Ae(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=s.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function C(e){return JSON.parse(w(e))}function V(e,n){s.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),t;try{t=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(t,JSON.stringify(n,null,2)+`
+`),s.fsyncSync(t),s.closeSync(t),t=void 0;let i=s.openSync(r,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(r,e),s.chmodSync(e,384);let c=s.openSync(m.dirname(e),"r");try{s.fsyncSync(c)}finally{s.closeSync(c)}}catch(i){if(t!==void 0)try{s.closeSync(t)}catch{}try{s.unlinkSync(r)}catch{}throw i}return e}function g(e,n){s.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let t=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(t,String(n)),s.fsyncSync(t)}finally{s.closeSync(t)}s.renameSync(r,e),s.chmodSync(e,384);let i=s.openSync(m.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(t){try{s.unlinkSync(r)}catch{}throw t}}import h from"node:path";import tr from"node:os";import{createHash as nr,randomBytes as hi}from"node:crypto";import{Transaction as gi}from"@scure/btc-signer";import{ed25519 as Ei}from"@noble/curves/ed25519.js";import{base58 as oo}from"@scure/base";import{Interface as Re}from"ethers";import{Interface as Oe,MaxUint256 as Qr,isAddress as et,keccak256 as rt,toUtf8Bytes as tt}from"ethers";import{Interface as Te,isAddress as Pr}from"ethers";import{isAddress as Or}from"ethers";var Fr=new Te(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ke,isAddress as Ur}from"ethers";var Jr=new ke(["function approve(address spender,uint256 amount) returns (bool)"]),Gr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var ct=new Oe(["function approve(address spender,uint256 amount) returns (bool)"]);var lt=300*1e3,dt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as wt,NETWORK as gt,OutScript as yt,RawTx as Et,SigHash as xt,TEST_NETWORK as bt,Transaction as St}from"@scure/btc-signer";import{createHash as Ne}from"node:crypto";import{base58 as Tt}from"@scure/base";import{getCompiledTransactionMessageDecoder as Ot}from"@solana/transaction-messages";var Y=e=>Ne("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Lt=new Map([[Y("route"),{name:"route",prefixBytes:0}],[Y("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Gt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),zt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Yt="0x"+"00".repeat(32);var _e=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),rn=Object.freeze(_e.map(e=>e[0]));var Me=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var bn=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var Fe=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Sn=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),An=new Re(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),vn=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var qe=Object.freeze([...Me]),In=Object.freeze({...Fe});import{ed25519 as Un}from"@noble/curves/ed25519.js";import{base58 as Wn}from"@scure/base";import{RawTx as Jn,SigHash as Gn,Transaction as zn}from"@scure/btc-signer";import{Transaction as Kn,keccak256 as Yn,verifyTypedData as Xn}from"ethers";import{encode as On}from"@msgpack/msgpack";import{keccak256 as Nn,verifyTypedData as _n}from"ethers";var Bn=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Cn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as He,randomBytes as Lo,timingSafeEqual as Je}from"node:crypto";import Ge from"node:fs";import x from"node:path";import{homedir as R}from"node:os";import{join as M}from"node:path";var re=process.env.ORACLE_PUBLIC_DESKTOP==="1",We=re?process.env.ORACLE_CONFIG_DIR||M(R(),".config","oracle"):M(R(),".config","oracle"),Eo=re?We:M(R(),".config","mad-desk");var vo="0".repeat(64),Io=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function N(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(N).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+N(e[r])).join(",")+"}"}var To=Promise.resolve();function ze(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=a=>{try{return Ge.realpathSync(a)}catch{return x.resolve(a)}},t=r(x.dirname(x.resolve(e))),i=r(x.dirname(x.resolve(n))),o=(a,c)=>c===a||c.startsWith(a+x.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var F=(e,n)=>He("sha256",n).update(N(e)).digest("hex"),Ve=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&Je(r,t)};function Ke(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:F(t,n)}}}function te(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Ve(t?.integrity?.mac,F(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Ye(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=te(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(t)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:F(a,r)}})+`
+`)}function ne(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=te(t,i);ze(t,e);let a=Number(o.sequence||0)+1,c=Ke(r,i,{sequence:a});Ye(t,a,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
+`)}import{Wallet as q}from"ethers";import{base58 as ie}from"@scure/base";import{ed25519 as Xe}from"@noble/curves/ed25519.js";import{NETWORK as se,TEST_NETWORK as ae,WIF as Ze,p2wpkh as oe}from"@scure/btc-signer";import{pubECDSA as Qe}from"@scure/btc-signer/utils.js";var er=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},rr=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},b=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function S(e,n){let r=String(n||"").trim();if(e==="evm")return new q(r).privateKey;if(e==="btc")for(let o of[se,ae])try{return Buffer.from(Ze(o).decode(r))}catch{}if(e==="sol")try{return b(ie.decode(r),"sol")}catch{}let t=er(r);if(t)return e==="evm"?new q(`0x${t.toString("hex")}`).privateKey:b(t,e);let i=rr(r);if(i)return b(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return b(Uint8Array.from(o),e);let a=o.privateKey??o.secretKey??o.key;if(a)return S(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let r=new q(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=b(n,"btc"),t=Qe(r);return{kind:e,secret:r.toString("hex"),addresses:[oe(t,se).address,oe(t,ae).address]}}if(e==="sol"){let r=b(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[ie.encode(Xe.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function D(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=v(o,S(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ce(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ue(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function le(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(tr.homedir(),".local","state"),"oracle"),r=nr("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as or}from"node:crypto";import{Wallet as ir}from"ethers";var de=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -11,14 +11,14 @@ import f from"node:fs";import U from"node:path";import I from"node:fs";import fe
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},ir=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function sr(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let d of c){if(d===3){a(),t(new Error("cancelled"));return}if(d===13||d===10){a(),process.stderr.write(`
-`),r(i);return}d===127?i=i.slice(0,-1):i+=String.fromCharCode(d)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function ar(e,n){let r=_(e,"--passphrase-file");return r?w(r):sr("Vault passphrase: ",n)}function cr(e){return e.addresses.join(", ")}async function ur(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||T(),o=le(U.join(i,"signer"));if(!t||t==="help")return r.write(de+`
+They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},sr=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function ar(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let d of c){if(d===3){a(),t(new Error("cancelled"));return}if(d===13||d===10){a(),process.stderr.write(`
+`),r(i);return}d===127?i=i.slice(0,-1):i+=String.fromCharCode(d)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function cr(e,n){let r=_(e,"--passphrase-file");return r?w(r):ar("Vault passphrase: ",n)}function ur(e){return e.addresses.join(", ")}async function lr(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||T(),o=le(U.join(i,"signer"));if(!t||t==="help")return r.write(de+`
 `),0;if(t==="status")return r.write(JSON.stringify({initialized:f.existsSync(o.vault),policyConfigured:f.existsSync(o.policy),armed:f.existsSync(o.vault)&&!f.existsSync(o.lock),disarmed:f.existsSync(o.lock)})+`
 `),0;if(t==="lock")return f.mkdirSync(U.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),r.write(`Local signer locked.
 `),0;if(t==="doctor"){let u=[];return f.existsSync(o.vault)||u.push("vault missing"),f.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),r.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
 `),u.length?1:0}if(t==="policy"){if(!f.existsSync(o.vault)||!f.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=_(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let l;try{l=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(l[p])||l[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return ne(o.policy,o.policyKey,l,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let a=await ar(e,n),c={};if(f.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=B(o.vault),l=C(u,a);try{c=D(l,u.meta)}finally{l.fill(0)}}if(t==="init"){let u=or.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=ir(e),l=_(e,"--key-file");if(!l)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,w(l)))}f.mkdirSync(U.dirname(o.vault),{recursive:!0,mode:448}),V(o.vault,G(ce(c),a,ue(c))),f.existsSync(o.policyKey)||g(o.policyKey,nr(32).toString("hex")+`
-`);let d=Object.entries(c).map(([u,l])=>`${u}:${cr(l)}`).join(" ");return r.write(`Encrypted local vault initialized for ${d}. Configure sealed policy rails before starting a signer session.
-`),0}var Gi={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:de,run:e=>ur(e.argv||[])};export{Gi as default,ur as run};
+`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let a=await cr(e,n),c={};if(f.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=C(o.vault),l=B(u,a);try{c=D(l,u.meta)}finally{l.fill(0)}}if(t==="init"){let u=ir.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=sr(e),l=_(e,"--key-file");if(!l)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,w(l)))}f.mkdirSync(U.dirname(o.vault),{recursive:!0,mode:448}),V(o.vault,G(ce(c),a,ue(c))),f.existsSync(o.policyKey)||g(o.policyKey,or(32).toString("hex")+`
+`);let d=Object.entries(c).map(([u,l])=>`${u}:${ur(l)}`).join(" ");return r.write(`Encrypted local vault initialized for ${d}. Configure sealed policy rails before starting a signer session.
+`),0}var Ki={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:de,run:e=>lr(e.argv||[])};export{Ki as default,lr as run};