@oracle-agent/oracle 0.25.4 → 0.27.0

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-import f from"node:fs";import U from"node:path";import I from"node:fs";import fe from"node:os";import E from"node:path";import{fileURLToPath as pe}from"node:url";var me=E.dirname(pe(import.meta.url)),hr=E.resolve(me,"../..");function j(){return process.env.ORACLE_FAKE_HOME||fe.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function T(){return he()?process.env.ORACLE_CONFIG_DIR||E.join(j(),".config","oracle"):E.join(j(),".config","oracle")}function we(){return E.join(T(),"desk.json")}function ge(){return E.join(T(),"env")}function y({force:e=!1}={}){if(y._done&&!e)return y._result||null;y._done=!0;let n={},r=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=ge();if(I.existsSync(i))for(let o of I.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let c=a[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(a[1],c)}}catch{}try{let i=we();if(I.existsSync(i)){let o=JSON.parse(I.readFileSync(i,"utf8"));o&&typeof o=="object"&&(r("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),r("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),r("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),r("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),r("ORACLE_EXEC_URL",o.execUrl),r("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let t=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return t&&(r("ORACLE_DESK_URL",t),r("ORACLE_DATA_URL",t),r("ORACLE_API_URL",t),r("ORACLE_PUBLIC_URL",t),r("MAD_DESK_URL",t)),y._result=Object.keys(n).length?n:null,y._result}try{y()}catch{}import{createCipheriv as ye,createDecipheriv as Ee,randomBytes as O,scryptSync as xe}from"node:crypto";import s from"node:fs";import m from"node:path";var W="ORACLE-LOCAL-VAULT",H=1,A=Object.freeze({N:1<<17,r:8,p:1}),be=256*1024*1024,Se=16*1024;function k(e,n,r,{max:t=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>t)throw new Error(`local-vault: invalid ${r} length`);return i}function J(e,n,r=A){let t=String(e??"");if(t.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return xe(t,n,32,{...r,maxmem:be})}function G(e,n,r={}){let t=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!t.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:W,version:H,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:r.address?String(r.address).toLowerCase():null,addresses:r.addresses||void 0,kind:r.kind||"evm",createdAt:new Date().toISOString()}},c=J(n,i);try{let d=ye("aes-256-gcm",c,o);d.setAAD(Buffer.from(JSON.stringify(a)));let u=Buffer.concat([d.update(t),d.final()]);return{...a,ciphertext:u.toString("base64"),tag:d.getAuthTag().toString("base64")}}finally{c.fill(0),t.fill(0)}}function B(e,n){if(e?.magic!==W||e?.version!==H)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!r.includes(p)))throw new Error("local-vault: unexpected vault field");let t=k(e.kdf.salt,32,"salt"),i=k(e.cipher.iv,12,"iv"),o=k(e.tag,16,"tag"),a=k(e.ciphertext,1,"ciphertext",{max:Se}),{ciphertext:c,tag:d,...u}=e,l=J(n,t);try{let p=Ee("aes-256-gcm",l,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(a),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{l.fill(0)}}function Ae(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function z(e){let n=m.dirname(e),r=s.lstatSync(n);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let t=s.lstatSync(e);if(t.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!t.isFile()||t.uid!==process.getuid?.()||t.nlink!==1)throw new Error("local-vault: unsafe destination file");if(t.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(t){if(t.code!=="ENOENT")throw t}}function w(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=s.fstatSync(n);if(Ae(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let t=s.lstatSync(e);if(t.isSymbolicLink()||t.dev!==r.dev||t.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function C(e){return JSON.parse(w(e))}function V(e,n){s.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),t;try{t=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(t,JSON.stringify(n,null,2)+`
-`),s.fsyncSync(t),s.closeSync(t),t=void 0;let i=s.openSync(r,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(r,e),s.chmodSync(e,384);let c=s.openSync(m.dirname(e),"r");try{s.fsyncSync(c)}finally{s.closeSync(c)}}catch(i){if(t!==void 0)try{s.closeSync(t)}catch{}try{s.unlinkSync(r)}catch{}throw i}return e}function g(e,n){s.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),z(e);let r=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let t=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(t,String(n)),s.fsyncSync(t)}finally{s.closeSync(t)}s.renameSync(r,e),s.chmodSync(e,384);let i=s.openSync(m.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(t){try{s.unlinkSync(r)}catch{}throw t}}import h from"node:path";import tr from"node:os";import{createHash as nr,randomBytes as hi}from"node:crypto";import{Transaction as gi}from"@scure/btc-signer";import{ed25519 as Ei}from"@noble/curves/ed25519.js";import{base58 as oo}from"@scure/base";import{Interface as Re}from"ethers";import{Interface as Oe,MaxUint256 as Qr,isAddress as et,keccak256 as rt,toUtf8Bytes as tt}from"ethers";import{Interface as Te,isAddress as Pr}from"ethers";import{isAddress as Or}from"ethers";var Fr=new Te(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ke,isAddress as Ur}from"ethers";var Jr=new ke(["function approve(address spender,uint256 amount) returns (bool)"]),Gr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var ct=new Oe(["function approve(address spender,uint256 amount) returns (bool)"]);var lt=300*1e3,dt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as wt,NETWORK as gt,OutScript as yt,RawTx as Et,SigHash as xt,TEST_NETWORK as bt,Transaction as St}from"@scure/btc-signer";import{createHash as Ne}from"node:crypto";import{base58 as Tt}from"@scure/base";import{getCompiledTransactionMessageDecoder as Ot}from"@solana/transaction-messages";var Y=e=>Ne("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Lt=new Map([[Y("route"),{name:"route",prefixBytes:0}],[Y("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Gt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),zt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Yt="0x"+"00".repeat(32);var _e=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),rn=Object.freeze(_e.map(e=>e[0]));var Me=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var bn=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var Fe=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Sn=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),An=new Re(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),vn=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var qe=Object.freeze([...Me]),In=Object.freeze({...Fe});import{ed25519 as Un}from"@noble/curves/ed25519.js";import{base58 as Wn}from"@scure/base";import{RawTx as Jn,SigHash as Gn,Transaction as zn}from"@scure/btc-signer";import{Transaction as Kn,keccak256 as Yn,verifyTypedData as Xn}from"ethers";import{encode as On}from"@msgpack/msgpack";import{keccak256 as Nn,verifyTypedData as _n}from"ethers";var Bn=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Cn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as He,randomBytes as Lo,timingSafeEqual as Je}from"node:crypto";import Ge from"node:fs";import x from"node:path";import{homedir as R}from"node:os";import{join as M}from"node:path";var re=process.env.ORACLE_PUBLIC_DESKTOP==="1",We=re?process.env.ORACLE_CONFIG_DIR||M(R(),".config","oracle"):M(R(),".config","oracle"),Eo=re?We:M(R(),".config","mad-desk");var vo="0".repeat(64),Io=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function N(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(N).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+N(e[r])).join(",")+"}"}var To=Promise.resolve();function ze(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let r=a=>{try{return Ge.realpathSync(a)}catch{return x.resolve(a)}},t=r(x.dirname(x.resolve(e))),i=r(x.dirname(x.resolve(n))),o=(a,c)=>c===a||c.startsWith(a+x.sep);if(o(t,i)||o(i,t))throw new Error("ledger: separate freshness anchor required")}var F=(e,n)=>He("sha256",n).update(N(e)).digest("hex"),Ve=(e,n)=>{let r=Buffer.from(String(e)),t=Buffer.from(String(n));return r.length===t.length&&Je(r,t)};function Ke(e,n,{sequence:r}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let t=r===void 0?e:{...e,policySequence:Number(r)};return{policy:t,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:F(t,n)}}}function te(e,n){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=w(e)}catch{return{sequence:0,present:!1}}let t;try{t=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Ve(t?.integrity?.mac,F(t?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(t?.marker?.policySequence||0),policyMac:t?.marker?.policyMac??null,present:!0,ledgerInitialized:t?.marker?.ledgerInitialized===!0}}function Ye(e,n,r,t=null,{ledgerInitialized:i}={}){if(t==null||!String(t))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=te(e,r);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(t)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:F(a,r)}})+`
-`)}function ne(e,n,r,{sequenceAnchorFile:t}={}){let i=w(n);if(!t)throw new Error("policy: sequence anchor required");let o=te(t,i);ze(t,e);let a=Number(o.sequence||0)+1,c=Ke(r,i,{sequence:a});Ye(t,a,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
-`)}import{Wallet as q}from"ethers";import{base58 as ie}from"@scure/base";import{ed25519 as Xe}from"@noble/curves/ed25519.js";import{NETWORK as se,TEST_NETWORK as ae,WIF as Ze,p2wpkh as oe}from"@scure/btc-signer";import{pubECDSA as Qe}from"@scure/btc-signer/utils.js";var er=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},rr=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let r=Buffer.from(n,"base64");return r.toString("base64")===n?r:null},b=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function S(e,n){let r=String(n||"").trim();if(e==="evm")return new q(r).privateKey;if(e==="btc")for(let o of[se,ae])try{return Buffer.from(Ze(o).decode(r))}catch{}if(e==="sol")try{return b(ie.decode(r),"sol")}catch{}let t=er(r);if(t)return e==="evm"?new q(`0x${t.toString("hex")}`).privateKey:b(t,e);let i=rr(r);if(i)return b(i,e);if(r.startsWith("[")||r.startsWith("{")){let o=JSON.parse(r);if(Array.isArray(o))return b(Uint8Array.from(o),e);let a=o.privateKey??o.secretKey??o.key;if(a)return S(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let r=new q(String(n));return{kind:e,secret:r.privateKey,addresses:[r.address.toLowerCase()]}}if(e==="btc"){let r=b(n,"btc"),t=Qe(r);return{kind:e,secret:r.toString("hex"),addresses:[oe(t,se).address,oe(t,ae).address]}}if(e==="sol"){let r=b(n,"sol");return{kind:e,secret:r.toString("hex"),addresses:[ie.encode(Xe.getPublicKey(r))]}}throw new Error(`unsupported signer kind ${e}`)}function D(e,n={}){let r=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",r))};let t=JSON.parse(r),i={};for(let o of["evm","btc","sol"])t[o]&&(i[o]=v(o,S(o,t[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ce(e){let n={};for(let r of["evm","btc","sol"])e[r]&&(n[r]=(e[r].kind==="evm",e[r].secret));return Buffer.from(JSON.stringify(n))}function ue(e){let n={};for(let[r,t]of Object.entries(e))n[r]=t.addresses;return{kind:"multichain",address:null,addresses:n}}function le(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(tr.homedir(),".local","state"),"oracle"),r=nr("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${r}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${r}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${r}.lock`)}}import{randomBytes as or}from"node:crypto";import{Wallet as ir}from"ethers";var de=`oracle sign init|import|policy|status|lock|doctor
+import f from"node:fs";import j from"node:path";import k from"node:fs";import he from"node:os";import E from"node:path";import{fileURLToPath as we}from"node:url";var ge=E.dirname(we(import.meta.url)),wt=E.resolve(ge,"../..");function W(){return process.env.ORACLE_FAKE_HOME||he.homedir()}function ye(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function I(){return ye()?process.env.ORACLE_CONFIG_DIR||E.join(W(),".config","oracle"):E.join(W(),".config","oracle")}function Ee(){return E.join(I(),"desk.json")}function be(){return E.join(I(),"env")}function y({force:e=!1}={}){if(y._done&&!e)return y._result||null;y._done=!0;let n={},t=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=be();if(k.existsSync(i))for(let o of k.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),t(s[1],c)}}catch{}try{let i=Ee();if(k.existsSync(i)){let o=JSON.parse(k.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),y._result=Object.keys(n).length?n:null,y._result}try{y()}catch{}import{createCipheriv as xe,createDecipheriv as Se,randomBytes as N,scryptSync as Ae}from"node:crypto";import a from"node:fs";import m from"node:path";var H="ORACLE-LOCAL-VAULT",J=1,A=Object.freeze({N:1<<17,r:8,p:1}),ve=256*1024*1024,ke=16*1024;function T(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function z(e,n,t=A){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Ae(r,n,32,{...t,maxmem:ve})}function V(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=N(32),o=N(12),s={magic:H,version:J,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},c=z(n,i);try{let d=xe("aes-256-gcm",c,o);d.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([d.update(r),d.final()]);return{...s,ciphertext:u.toString("base64"),tag:d.getAuthTag().toString("base64")}}finally{c.fill(0),r.fill(0)}}function R(e,n){if(e?.magic!==H||e?.version!==J)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!t.includes(p)))throw new Error("local-vault: unexpected vault field");let r=T(e.kdf.salt,32,"salt"),i=T(e.cipher.iv,12,"iv"),o=T(e.tag,16,"tag"),s=T(e.ciphertext,1,"ciphertext",{max:ke}),{ciphertext:c,tag:d,...u}=e,l=z(n,r);try{let p=Se("aes-256-gcm",l,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{l.fill(0)}}function Ie(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function G(e){let n=m.dirname(e),t=a.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=a.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=a.fstatSync(n);if(Ie(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=a.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function B(e){return JSON.parse(w(e))}function K(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),G(e);let t=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${N(6).toString("hex")}.tmp`),r;try{r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(r,JSON.stringify(n,null,2)+`
+`),a.fsyncSync(r),a.closeSync(r),r=void 0;let i=a.openSync(t,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(t,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(r!==void 0)try{a.closeSync(r)}catch{}try{a.unlinkSync(t)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),G(e);let t=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${N(6).toString("hex")}.tmp`);try{let r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(r,String(n)),a.fsyncSync(r)}finally{a.closeSync(r)}a.renameSync(t,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(r){try{a.unlinkSync(t)}catch{}throw r}}import h from"node:path";import nt from"node:os";import{createHash as ot,randomBytes as bi}from"node:crypto";import{Interface as U,keccak256 as Si}from"ethers";import{Transaction as vi}from"@scure/btc-signer";import{ed25519 as Ii}from"@noble/curves/ed25519.js";import{base58 as uo}from"@scure/base";import{Interface as re}from"ethers";import{Interface as Ce,MaxUint256 as er,isAddress as tr,keccak256 as rr,toUtf8Bytes as nr}from"ethers";import{Interface as Oe,isAddress as _t}from"ethers";import{isAddress as Ot}from"ethers";var Mt=new Oe(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Le,isAddress as jt}from"ethers";var zt=new Le(["function approve(address spender,uint256 amount) returns (bool)"]),Vt=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var ur=new Ce(["function approve(address spender,uint256 amount) returns (bool)"]);var dr=300*1e3,fr=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as gr,NETWORK as yr,OutScript as Er,RawTx as br,SigHash as xr,TEST_NETWORK as Sr,Transaction as Ar}from"@scure/btc-signer";import{createHash as Be}from"node:crypto";import{base58 as Tr}from"@scure/base";import{getCompiledTransactionMessageDecoder as Or}from"@solana/transaction-messages";var X=e=>Be("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Lr=new Map([[X("route"),{name:"route",prefixBytes:0}],[X("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var qr=64*1024;var Yr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Xr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var en="0x"+"00".repeat(32);var Pe=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),an=Object.freeze(Pe.map(e=>e[0]));var Me=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var kn=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var De=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),In=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Tn=new re(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Nn=new re(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),On=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ue=Object.freeze([...Me]),Ln=Object.freeze({...De});import{ed25519 as zn}from"@noble/curves/ed25519.js";import{base58 as Gn}from"@scure/base";import{RawTx as Yn,SigHash as Xn,Transaction as Qn}from"@scure/btc-signer";import{Transaction as eo,keccak256 as to,verifyTypedData as ro}from"ethers";import{encode as Bn}from"@msgpack/msgpack";import{keccak256 as _n,verifyTypedData as Fn}from"ethers";var $n=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),qn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as Je,randomBytes as Po,timingSafeEqual as ze}from"node:crypto";import Ve from"node:fs";import b from"node:path";import{homedir as F}from"node:os";import{join as $}from"node:path";var oe=process.env.ORACLE_PUBLIC_DESKTOP==="1",He=oe?process.env.ORACLE_CONFIG_DIR||$(F(),".config","oracle"):$(F(),".config","oracle"),vo=oe?He:$(F(),".config","mad-desk");var Oo="0".repeat(64),Lo=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var Co=Promise.resolve();function Ge(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=s=>{try{return Ve.realpathSync(s)}catch{return b.resolve(s)}},r=t(b.dirname(b.resolve(e))),i=t(b.dirname(b.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+b.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var q=(e,n)=>Je("sha256",n).update(L(e)).digest("hex"),Ke=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&ze(t,r)};function Ye(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(r,n)}}}function ie(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=w(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Ke(r?.integrity?.mac,q(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function Xe(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=ie(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(r)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(s,t)}})+`
+`)}function ae(e,n,t,{sequenceAnchorFile:r}={}){let i=w(n);if(!r)throw new Error("policy: sequence anchor required");let o=ie(r,i);Ge(r,e);let s=Number(o.sequence||0)+1,c=Ye(t,i,{sequence:s});Xe(r,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
+`)}import{Wallet as M}from"ethers";import{base58 as ce}from"@scure/base";import{ed25519 as Qe}from"@noble/curves/ed25519.js";import{NETWORK as ue,TEST_NETWORK as le,WIF as Ze,p2wpkh as se}from"@scure/btc-signer";import{pubECDSA as et}from"@scure/btc-signer/utils.js";var tt=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},rt=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},x=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function S(e,n){let t=String(n||"").trim();if(e==="evm")return new M(t).privateKey;if(e==="btc")for(let o of[ue,le])try{return Buffer.from(Ze(o).decode(t))}catch{}if(e==="sol")try{return x(ce.decode(t),"sol")}catch{}let r=tt(t);if(r)return e==="evm"?new M(`0x${r.toString("hex")}`).privateKey:x(r,e);let i=rt(t);if(i)return x(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return x(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return S(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let t=new M(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=x(n,"btc"),r=et(t);return{kind:e,secret:t.toString("hex"),addresses:[se(r,ue).address,se(r,le).address]}}if(e==="sol"){let t=x(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[ce.encode(Qe.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function D(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=v(o,S(o,r[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function de(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=(e[t].kind==="evm",e[t].secret));return Buffer.from(JSON.stringify(n))}function fe(e){let n={};for(let[t,r]of Object.entries(e))n[t]=r.addresses;return{kind:"multichain",address:null,addresses:n}}var Vi=new U(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Gi=new U(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Ki=new U(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function pe(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(nt.homedir(),".local","state"),"oracle"),t=ot("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${t}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${t}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${t}.lock`)}}import{randomBytes as it}from"node:crypto";import{Wallet as at}from"ethers";var me=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -11,14 +11,14 @@ import f from"node:fs";import U from"node:path";import I from"node:fs";import fe
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,_=(e,n)=>{let r=e.indexOf(n);return r>=0?e[r+1]:null},sr=e=>{let n=String(_(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function ar(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((r,t)=>{let i="",o=c=>{for(let d of c){if(d===3){a(),t(new Error("cancelled"));return}if(d===13||d===10){a(),process.stderr.write(`
-`),r(i);return}d===127?i=i.slice(0,-1):i+=String.fromCharCode(d)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function cr(e,n){let r=_(e,"--passphrase-file");return r?w(r):ar("Vault passphrase: ",n)}function ur(e){return e.addresses.join(", ")}async function lr(e=[],n={}){let r=n.out||process.stdout,t=e[0],i=n.configDir||T(),o=le(U.join(i,"signer"));if(!t||t==="help")return r.write(de+`
-`),0;if(t==="status")return r.write(JSON.stringify({initialized:f.existsSync(o.vault),policyConfigured:f.existsSync(o.policy),armed:f.existsSync(o.vault)&&!f.existsSync(o.lock),disarmed:f.existsSync(o.lock)})+`
-`),0;if(t==="lock")return f.mkdirSync(U.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
-`),r.write(`Local signer locked.
-`),0;if(t==="doctor"){let u=[];return f.existsSync(o.vault)||u.push("vault missing"),f.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),r.write(u.length?`Signer not ready: ${u.join("; ")}
+They are never accepted as argument values or inherited environment variables.`,C=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},st=e=>{let n=String(C(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function ct(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=c=>{for(let d of c){if(d===3){s(),r(new Error("cancelled"));return}if(d===13||d===10){s(),process.stderr.write(`
+`),t(i);return}d===127?i=i.slice(0,-1):i+=String.fromCharCode(d)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function ut(e,n){let t=C(e,"--passphrase-file");return t?w(t):ct("Vault passphrase: ",n)}function lt(e){return e.addresses.join(", ")}async function dt(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||I(),o=pe(j.join(i,"signer"));if(!r||r==="help")return t.write(me+`
+`),0;if(r==="status")return t.write(JSON.stringify({initialized:f.existsSync(o.vault),policyConfigured:f.existsSync(o.policy),armed:f.existsSync(o.vault)&&!f.existsSync(o.lock),disarmed:f.existsSync(o.lock)})+`
+`),0;if(r==="lock")return f.mkdirSync(j.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
+`),t.write(`Local signer locked.
+`),0;if(r==="doctor"){let u=[];return f.existsSync(o.vault)||u.push("vault missing"),f.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),t.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
-`),u.length?1:0}if(t==="policy"){if(!f.existsSync(o.vault)||!f.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=_(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let l;try{l=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(l[p])||l[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return ne(o.policy,o.policyKey,l,{sequenceAnchorFile:o.policyAnchor}),r.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(t!=="init"&&t!=="import")throw new Error(`unknown subcommand '${t}'`);let a=await cr(e,n),c={};if(f.existsSync(o.vault)){if(t==="init")throw new Error("local signer vault already exists");let u=C(o.vault),l=B(u,a);try{c=D(l,u.meta)}finally{l.fill(0)}}if(t==="init"){let u=ir.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=sr(e),l=_(e,"--key-file");if(!l)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,w(l)))}f.mkdirSync(U.dirname(o.vault),{recursive:!0,mode:448}),V(o.vault,G(ce(c),a,ue(c))),f.existsSync(o.policyKey)||g(o.policyKey,or(32).toString("hex")+`
-`);let d=Object.entries(c).map(([u,l])=>`${u}:${ur(l)}`).join(" ");return r.write(`Encrypted local vault initialized for ${d}. Configure sealed policy rails before starting a signer session.
-`),0}var Ki={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:de,run:e=>lr(e.argv||[])};export{Ki as default,lr as run};
+`),u.length?1:0}if(r==="policy"){if(!f.existsSync(o.vault)||!f.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=C(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let l;try{l=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(l[p])||l[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return ae(o.policy,o.policyKey,l,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(r!=="init"&&r!=="import")throw new Error(`unknown subcommand '${r}'`);let s=await ut(e,n),c={};if(f.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let u=B(o.vault),l=R(u,s);try{c=D(l,u.meta)}finally{l.fill(0)}}if(r==="init"){let u=at.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=st(e),l=C(e,"--key-file");if(!l)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,w(l)))}f.mkdirSync(j.dirname(o.vault),{recursive:!0,mode:448}),K(o.vault,V(de(c),s,fe(c))),f.existsSync(o.policyKey)||g(o.policyKey,it(32).toString("hex")+`
+`);let d=Object.entries(c).map(([u,l])=>`${u}:${lt(l)}`).join(" ");return t.write(`Encrypted local vault initialized for ${d}. Configure sealed policy rails before starting a signer session.
+`),0}var aa={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:me,run:e=>dt(e.argv||[])};export{aa as default,dt as run};