@oracle-agent/oracle 0.27.0 → 0.28.0

package/dist/cli/commands/setup.mjs

@@ -1,51 +1,55 @@
-import{spawnSync as bt}from"node:child_process";import{stdin as b,stdout as Pe}from"node:process";var Q=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function he(e){return String(e||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function F(){return Q.slice()}function D(e){let t=he(e);if(!t)return null;for(let r of Q)if(r.key===t||he(r.name)===t)return r;return null}function me({profile:e="oracle",statuses:t={}}={}){let r=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${e}`,"","messaging platforms:",""];for(let o of Q){let n=t[o.key]||"unset";r.push(`  ${o.key.padEnd(16)} ${String(n).padEnd(8)}  ${o.note}`)}return r.push(""),r.push("commands:"),r.push("  oracle setup                 this menu"),r.push("  oracle setup messaging       open hermes gateway setup"),r.push("  oracle setup telegram        configure telegram bot token"),r.push("  oracle setup discord         configure discord bot token"),r.push("  oracle setup status          show configured platforms (no secrets)"),r.push("  oracle setup gateway         start/status hermes gateway"),r.push("  /setup                       same menu inside chat"),r.push(""),r.push("notes:"),r.push("  tokens stay in the hermes profile .env on this machine"),r.push("  oracle never prints bot tokens or app secrets"),r.push("  after setup: hermes -p oracle gateway restart"),r.join(`
+import{spawnSync as Pt}from"node:child_process";import{stdin as b,stdout as Te}from"node:process";var ee=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function me(e){return String(e||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function H(){return ee.slice()}function D(e){let t=me(e);if(!t)return null;for(let r of ee)if(r.key===t||me(r.name)===t)return r;return null}function we({profile:e="oracle",statuses:t={}}={}){let r=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${e}`,"","messaging platforms:",""];for(let o of ee){let n=t[o.key]||"unset";r.push(`  ${o.key.padEnd(16)} ${String(n).padEnd(8)}  ${o.note}`)}return r.push(""),r.push("commands:"),r.push("  oracle setup                 this menu"),r.push("  oracle setup messaging       open hermes gateway setup"),r.push("  oracle setup telegram        configure telegram bot token"),r.push("  oracle setup discord         configure discord bot token"),r.push("  oracle setup status          show configured platforms (no secrets)"),r.push("  oracle setup gateway         start/status hermes gateway"),r.push("  /setup                       same menu inside chat"),r.push(""),r.push("notes:"),r.push("  tokens stay in the hermes profile .env on this machine"),r.push("  oracle never prints bot tokens or app secrets"),r.push("  after setup: hermes -p oracle gateway restart"),r.join(`
 `)+`
-`}import E from"node:fs";import qe from"node:os";import ee from"node:path";import N from"node:fs";import Ne from"node:os";import A from"node:path";import{fileURLToPath as Me}from"node:url";var Ke=A.dirname(Me(import.meta.url)),Dt=A.resolve(Ke,"../..");function H(){return process.env.ORACLE_FAKE_HOME||Ne.homedir()}function Fe(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function k(){return Fe()?process.env.ORACLE_CONFIG_DIR||A.join(H(),".config","oracle"):A.join(H(),".config","oracle")}function He(){return A.join(k(),"desk.json")}function ze(){return A.join(k(),"env")}function $({force:e=!1}={}){if($._done&&!e)return $._result||null;$._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=ze();if(N.existsSync(n))for(let s of N.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=He();if(N.existsSync(n)){let s=JSON.parse(N.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),$._result=Object.keys(t).length?t:null,$._result}try{$()}catch{}function M(){return process.env.HERMES_HOME?A.resolve(process.env.HERMES_HOME):A.join(H(),".hermes")}function _(e){return N.mkdirSync(e,{recursive:!0}),e}var Be=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function z(e="oracle"){return ee.join(M(),"profiles",e,".env")}function We(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function we(e="oracle"){let t=z(e);return E.existsSync(t)?We(E.readFileSync(t,"utf8")):{}}function ge(e,t,r){if(!t||Be.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let h=new Error(`invalid env key '${t}'`);throw h.code="BAD_KEY",h}if(r==null||String(r).trim()===""){let h=new Error(`empty value for ${t}`);throw h.code="EMPTY",h}let o=z(e);_(ee.dirname(o));let n=E.existsSync(o)?E.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let h of s)h.startsWith(`${t}=`)?(i.push(c),a=!0):(h.length||i.length)&&i.push(h);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),E.writeFileSync(o,i.join(`
-`),{mode:384});try{E.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function q(e="oracle"){let t=we(e),r={};for(let o of F()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:z(e)}}function B(e="oracle"){let{statuses:t}=q(e);return me({profile:e,statuses:t})}function ye(e,t,r,o={}){let n=D(t);if(!n){let d=new Error(`unknown platform '${t}'`);throw d.code="UNKNOWN_PLATFORM",d}if(!n.required.length){let d=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw d.code="NEEDS_INTERACTIVE",d}let i=n.required.filter(d=>/(TOKEN|PASSWORD|SECRET)$/i.test(d))[0]||(n.required.length===1?n.required[0]:null);if(!i){let d=new Error(`${n.key} has no single token field; provide each of [${n.required.join(", ")}] explicitly`);throw d.code="NEEDS_EXPLICIT_KEYS",d}let a=new Set([i,...Object.keys(o||{}).filter(d=>o[d]!=null&&String(o[d]).trim())]),c=we(e),h=n.required.filter(d=>!a.has(d)&&!String(c[d]||"").trim());if(h.length){let d=new Error(`${n.key} also requires [${h.join(", ")}]; pass them explicitly (setup would otherwise be marked ready while unusable)`);throw d.code="MISSING_REQUIRED",d}ge(e,i,r);for(let[d,S]of Object.entries(o||{}))S!=null&&String(S).trim()&&ge(e,d,S);return{platform:n.key,set:n.required,profile:e,path:z(e)}}function Ve(){return ee.join(k(),"setup-state.json")}function W(e={}){_(k());let t=Ve(),r={};if(E.existsSync(t))try{r=JSON.parse(E.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:qe.hostname()};return E.writeFileSync(t,JSON.stringify(o,null,2)+`
-`,{mode:384}),o}import ke from"node:fs";import L from"node:path";var Je="0.19.0",Jt=`hermes-agent==${Je}`;var ve="0.12.1",Yt=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ve}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ve}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Ye(){return L.join(k(),"runtime")}function Ge(){return L.join(Ye(),"venv")}function Xe(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return L.join(Ge(),t,r)}function Ze(){return Xe("hermes")}function Qe(e){let t=process.platform==="win32"&&!L.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(L.delimiter))if(r)for(let o of t){let n=L.join(r,`${e}${o}`);try{if(ke.existsSync(n))return n}catch{}}return null}function Se(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=Ze();if(ke.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=Qe("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as et,randomBytes as oe,timingSafeEqual as tt}from"node:crypto";import y from"node:fs";import x from"node:path";import rt from"node:readline/promises";import{spawn as ot,spawnSync as nt}from"node:child_process";var C=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),st=12e4;function it(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function P(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(C))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function K(e){let t=P(e);return{id:t,...C[t]}}function w(e,t={}){if(!y.existsSync(e))return t;try{let r=JSON.parse(y.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function xe(e){_(e),process.platform!=="win32"&&y.chmodSync(e,448)}function O(e,t){xe(x.dirname(e));let r=`${e}.${process.pid}.${oe(4).toString("hex")}.tmp`;y.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),y.renameSync(r,e),process.platform!=="win32"&&y.chmodSync(e,384)}function at(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function te(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function I(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function ct(e={}){let t=e.file||x.join(k(),"oauth.json"),r=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),o=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||nt,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&at(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function h(m){xe(x.dirname(c));let f;for(let u=0;u<400;u+=1)try{f=y.openSync(c,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-y.statSync(c).mtimeMs>3e5&&y.unlinkSync(c)}catch{}await new Promise(p=>setTimeout(p,25))}if(f===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await m()}finally{try{y.closeSync(f)}catch{}try{y.unlinkSync(c)}catch{}}}function d(m,f="oauth"){return["application","oracle","kind",f,"provider",m]}function S(m){if(!y.existsSync(o))return null;let u=w(o,{providers:{}}).providers?.[m];if(!Array.isArray(u))return null;let l=[];for(let p of u)if(x.isAbsolute(String(p||"")))try{let g=w(p,{});if(m==="anthropic-oauth"&&g.claudeAiOauth){let R=I(g.claudeAiOauth);l.push({...R,refreshToken:"",source:"external-access-only"});continue}let v=g.credential_pool&&typeof g.credential_pool=="object"?g.credential_pool:null;if(v){let R=v[m]||v[m.replace(/-oauth$/,"")]||[],je=Array.isArray(R)?R:R?[R]:[];for(let Z of je)if(!(!Z||typeof Z!="object"))try{let De=I(Z);l.push({...De,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(p=>!p.expiresAt||p.expiresAt>n()+st)||l[0]:null}function de(m){let f=P(m);if(i){let p=s("secret-tool",["lookup",...d(f)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!p.error&&p.status===0&&String(p.stdout||"").trim())try{return I(JSON.parse(String(p.stdout).trim()))}catch{}return S(f)}let l=w(t,{providers:{}}).providers?.[f];if(l)try{return I(l)}catch{}return S(f)}function $e(m,f){let u=P(m),l=I(f);if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...d(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected OAuth credential");let v=w(r,{providers:{}});return v.providers||={},v.providers[u]={expiresAt:l.expiresAt,source:l.source},O(r,v),l}let p=w(t,{providers:{}});return p.providers||={},p.providers[u]=l,O(t,p),l}function Le(m){let f=P(m);if(i){let p=s("secret-tool",["clear",...d(f)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{}});return g.providers&&delete g.providers[f],O(r,g),!p.error&&p.status===0}let u=w(t,{providers:{}}),l=!!u.providers?.[f];return u.providers&&delete u.providers[f],O(t,u),l}function fe(m){let f=te(m);if(i){let u=s("secret-tool",["lookup",...d(f,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(w(t,{apiKeys:{}}).apiKeys?.[f]||"").trim()}function Ie(m,f){let u=te(m),l=String(f||"").trim();if(!l)throw new Error("API key is empty");if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} API key`,...d(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected API key");let v=w(r,{providers:{},apiKeys:{}});return v.apiKeys||={},v.apiKeys[u]={configured:!0},O(r,v),!0}let p=w(t,{providers:{},apiKeys:{}});return p.apiKeys||={},p.apiKeys[u]=l,O(t,p),!0}function Ce(m){let f=te(m);if(i){let p=s("secret-tool",["clear",...d(f,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{},apiKeys:{}});return g.apiKeys&&delete g.apiKeys[f],O(r,g),!p.error&&p.status===0}let u=w(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[f];return u.apiKeys&&delete u.apiKeys[f],O(t,u),l}function Ue(){let m={},f={};if(i){let u=w(r,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))m[l]={loggedIn:!!de(l),expiresAt:Number(p.expiresAt||0),source:String(p.source||"oracle"),storage:a};for(let l of Object.keys(u.apiKeys||{}))f[l]={configured:!!fe(l),storage:a}}else{let u=w(t,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))m[l]={loggedIn:!!p?.accessToken,expiresAt:Number(p?.expiresAt||0),source:String(p?.source||"oracle"),storage:a};for(let[l,p]of Object.entries(u.apiKeys||{}))f[l]={configured:!!p,storage:a}}for(let u of Object.keys(C)){if(m[u])continue;let l=S(u);l&&(m[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:a,providers:m,apiKeys:f}}return Object.freeze({file:t,storage:a,get:de,set:$e,remove:Le,getApiKey:fe,setApiKey:Ie,removeApiKey:Ce,status:Ue,withLock:h})}var Ee;function U(){return Ee||=ct(),Ee}function re(e){return Buffer.from(e).toString("base64url")}function ut(){let e=re(oe(32));return{verifier:e,challenge:re(et("sha256").update(e).digest()),state:re(oe(24))}}function lt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&tt(r,o)}function pt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return ot(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ne(e){return new URLSearchParams(e).toString()}async function T(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function dt(e){if(e)return String(await e()).trim();let t=rt.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function se(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return I({accessToken:r,refreshToken:o,expiresAt:it(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function ft(e){let t=C["anthropic-oauth"],r=e.pkce||ut(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await dt(e.inputFn),[i,a]=s.split("#",2);if(!i||!lt(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return se(await T(c,"Claude OAuth token exchange"),e)}async function ht(e){let t=C["openai-codex"],r=await T(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await T(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ne({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return se(await T(i,"Codex OAuth token exchange"),e)}function V(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function mt(e){let t=C["xai-oauth"],r=await T(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");V(r.authorization_endpoint);let o=V(r.token_endpoint),n=await T(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=V(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let h=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(h.ok){let S=await T(h,"xAI OAuth token exchange");return se(S,{...e,discovery:{authorization_endpoint:V(r.authorization_endpoint),token_endpoint:o}})}let d="";try{d=String((await h.json())?.error||"")}catch{}if(d==="slow_down")await e.sleepFn((i+1)*1e3);else if(d==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${h.status}${d?`, ${d}`:""})`)}throw new Error("xAI device authorization timed out")}async function Ae(e,t={}){let r=P(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||pt,output:t.output||(n=>process.stdout.write(`${n}
-`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?ft(o):r==="openai-codex"?ht(o):mt(o)}import G from"node:fs";import ie from"node:path";var gt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","custom","anthropic-oauth","openai-codex","xai-oauth"]);function J(e){return String(e||"").trim()||void 0}function wt(e,{required:t=!1}={}){let r=J(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!gt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function yt(e,{required:t=!1}={}){let r=J(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function vt(e){let t=J(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function Y({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=wt(e),s=yt(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:vt(r)};if(J(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var kt=new Set(["auto","standalone","hermes","remote","arch"]);function St(){return ie.join(k(),"model.json")}function j(e){return String(e||"").trim()||void 0}function Et(e={}){let t=j(e.backend)?.toLowerCase()||"auto",r=Y({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=j(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=j(e.reasoningEffort),i=j(e.computeHost||e.remoteHost),a=j(e.computeUser||e.remoteUser),c=j(e.computePath||e.remotePath);if(!kt.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function _e(e){let t=Et(e),r=St();_(ie.dirname(r)),process.platform!=="win32"&&G.chmodSync(ie.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return G.writeFileSync(o,`${JSON.stringify(t,null,2)}
-`,{mode:384}),G.renameSync(o,r),process.platform!=="win32"&&G.chmodSync(r,384),t}var Oe=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},custom:{model:""}});function ae(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function xt(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function At(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
-`)},s=i=>{let a=String(i);for(let c of a){if(c==="\r"||c===`
-`){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function ce(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...Y({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function be(e,t,r={}){return _e(ce(e,t,r))}function _t(e){process.stdout.write(`storage: ${e.storage}
+`}import x from"node:fs";import Be from"node:os";import te from"node:path";import N from"node:fs";import Me from"node:os";import _ from"node:path";import{fileURLToPath as Ke}from"node:url";var Fe=_.dirname(Ke(import.meta.url)),Dt=_.resolve(Fe,"../..");function z(){return process.env.ORACLE_FAKE_HOME||Me.homedir()}function He(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function S(){return He()?process.env.ORACLE_CONFIG_DIR||_.join(z(),".config","oracle"):_.join(z(),".config","oracle")}function ze(){return _.join(S(),"desk.json")}function qe(){return _.join(S(),"env")}function $({force:e=!1}={}){if($._done&&!e)return $._result||null;$._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=qe();if(N.existsSync(n))for(let s of N.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let c=i[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(i[1],c)}}catch{}try{let n=ze();if(N.existsSync(n)){let s=JSON.parse(N.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),$._result=Object.keys(t).length?t:null,$._result}try{$()}catch{}function M(){return process.env.HERMES_HOME?_.resolve(process.env.HERMES_HOME):_.join(z(),".hermes")}function A(e){return N.mkdirSync(e,{recursive:!0}),e}var We=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function q(e="oracle"){return te.join(M(),"profiles",e,".env")}function Ve(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function ye(e="oracle"){let t=q(e);return x.existsSync(t)?Ve(x.readFileSync(t,"utf8")):{}}function ge(e,t,r){if(!t||We.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let d=new Error(`invalid env key '${t}'`);throw d.code="BAD_KEY",d}if(r==null||String(r).trim()===""){let d=new Error(`empty value for ${t}`);throw d.code="EMPTY",d}let o=q(e);A(te.dirname(o));let n=x.existsSync(o)?x.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],c=!1,a=`${t}=${String(r)}`;for(let d of s)d.startsWith(`${t}=`)?(i.push(a),c=!0):(d.length||i.length)&&i.push(d);for(c||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(a));i.length&&i[i.length-1]==="";)i.pop();i.push(""),x.writeFileSync(o,i.join(`
+`),{mode:384});try{x.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function B(e="oracle"){let t=ye(e),r={};for(let o of H()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:q(e)}}function W(e="oracle"){let{statuses:t}=B(e);return we({profile:e,statuses:t})}function ve(e,t,r,o={}){let n=D(t);if(!n){let p=new Error(`unknown platform '${t}'`);throw p.code="UNKNOWN_PLATFORM",p}if(!n.required.length){let p=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw p.code="NEEDS_INTERACTIVE",p}let i=n.required.filter(p=>/(TOKEN|PASSWORD|SECRET)$/i.test(p))[0]||(n.required.length===1?n.required[0]:null);if(!i){let p=new Error(`${n.key} has no single token field; provide each of [${n.required.join(", ")}] explicitly`);throw p.code="NEEDS_EXPLICIT_KEYS",p}let c=new Set([i,...Object.keys(o||{}).filter(p=>o[p]!=null&&String(o[p]).trim())]),a=ye(e),d=n.required.filter(p=>!c.has(p)&&!String(a[p]||"").trim());if(d.length){let p=new Error(`${n.key} also requires [${d.join(", ")}]; pass them explicitly (setup would otherwise be marked ready while unusable)`);throw p.code="MISSING_REQUIRED",p}ge(e,i,r);for(let[p,v]of Object.entries(o||{}))v!=null&&String(v).trim()&&ge(e,p,v);return{platform:n.key,set:n.required,profile:e,path:q(e)}}function Je(){return te.join(S(),"setup-state.json")}function V(e={}){A(S());let t=Je(),r={};if(x.existsSync(t))try{r=JSON.parse(x.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:Be.hostname()};return x.writeFileSync(t,JSON.stringify(o,null,2)+`
+`,{mode:384}),o}import Se from"node:fs";import L from"node:path";var Ye="0.19.0",Jt=`hermes-agent==${Ye}`;var ke="0.12.1",Yt=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ke}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${ke}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Ge(){return L.join(S(),"runtime")}function Xe(){return L.join(Ge(),"venv")}function Ze(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return L.join(Xe(),t,r)}function Qe(){return Ze("hermes")}function et(e){let t=process.platform==="win32"&&!L.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(L.delimiter))if(r)for(let o of t){let n=L.join(r,`${e}${o}`);try{if(Se.existsSync(n))return n}catch{}}return null}function xe(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=Qe();if(Se.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=et("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as tt,randomBytes as ne,timingSafeEqual as rt}from"node:crypto";import y from"node:fs";import E from"node:path";import ot from"node:readline/promises";import{spawn as nt,spawnSync as st}from"node:child_process";var C=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),it=12e4;function at(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function P(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(C))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function K(e){let t=P(e);return{id:t,...C[t]}}function g(e,t={}){if(!y.existsSync(e))return t;try{let r=JSON.parse(y.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${E.basename(e)}`)}}function _e(e){A(e),process.platform!=="win32"&&y.chmodSync(e,448)}function O(e,t){_e(E.dirname(e));let r=`${e}.${process.pid}.${ne(4).toString("hex")}.tmp`;y.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),y.renameSync(r,e),process.platform!=="win32"&&y.chmodSync(e,384)}function ct(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function re(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function I(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function ut(e={}){let t=e.file||E.join(S(),"oauth.json"),r=e.metadataFile||E.join(E.dirname(t),"oauth-meta.json"),o=e.linksFile||E.join(E.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||st,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&ct(s),c=i?"linux-secret-service":"private-file",a=`${t}.lock`;async function d(m){_e(E.dirname(a));let h;for(let u=0;u<400;u+=1)try{h=y.openSync(a,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-y.statSync(a).mtimeMs>3e5&&y.unlinkSync(a)}catch{}await new Promise(f=>setTimeout(f,25))}if(h===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await m()}finally{try{y.closeSync(h)}catch{}try{y.unlinkSync(a)}catch{}}}function p(m,h="oauth"){return["application","oracle","kind",h,"provider",m]}function v(m){if(!y.existsSync(o))return null;let u=g(o,{providers:{}}).providers?.[m];if(!Array.isArray(u))return null;let l=[];for(let f of u)if(E.isAbsolute(String(f||"")))try{let w=g(f,{});if(m==="anthropic-oauth"&&w.claudeAiOauth){let R=I(w.claudeAiOauth);l.push({...R,refreshToken:"",source:"external-access-only"});continue}let k=w.credential_pool&&typeof w.credential_pool=="object"?w.credential_pool:null;if(k){let R=k[m]||k[m.replace(/-oauth$/,"")]||[],De=Array.isArray(R)?R:R?[R]:[];for(let Q of De)if(!(!Q||typeof Q!="object"))try{let Ne=I(Q);l.push({...Ne,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(f=>!f.expiresAt||f.expiresAt>n()+it)||l[0]:null}function fe(m){let h=P(m);if(i){let f=s("secret-tool",["lookup",...p(h)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!f.error&&f.status===0&&String(f.stdout||"").trim())try{return I(JSON.parse(String(f.stdout).trim()))}catch{}return v(h)}let l=g(t,{providers:{}}).providers?.[h];if(l)try{return I(l)}catch{}return v(h)}function Le(m,h){let u=P(m),l=I(h);if(i){let w=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...p(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(w.error||w.status!==0)throw new Error("OS credential store rejected OAuth credential");let k=g(r,{providers:{}});return k.providers||={},k.providers[u]={expiresAt:l.expiresAt,source:l.source},O(r,k),l}let f=g(t,{providers:{}});return f.providers||={},f.providers[u]=l,O(t,f),l}function Ie(m){let h=P(m);if(i){let f=s("secret-tool",["clear",...p(h)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),w=g(r,{providers:{}});return w.providers&&delete w.providers[h],O(r,w),!f.error&&f.status===0}let u=g(t,{providers:{}}),l=!!u.providers?.[h];return u.providers&&delete u.providers[h],O(t,u),l}function he(m){let h=re(m);if(i){let u=s("secret-tool",["lookup",...p(h,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(g(t,{apiKeys:{}}).apiKeys?.[h]||"").trim()}function Ce(m,h){let u=re(m),l=String(h||"").trim();if(!l)throw new Error("API key is empty");if(i){let w=s("secret-tool",["store",`--label=Oracle ${u} API key`,...p(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(w.error||w.status!==0)throw new Error("OS credential store rejected API key");let k=g(r,{providers:{},apiKeys:{}});return k.apiKeys||={},k.apiKeys[u]={configured:!0},O(r,k),!0}let f=g(t,{providers:{},apiKeys:{}});return f.apiKeys||={},f.apiKeys[u]=l,O(t,f),!0}function Ue(m){let h=re(m);if(i){let f=s("secret-tool",["clear",...p(h,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),w=g(r,{providers:{},apiKeys:{}});return w.apiKeys&&delete w.apiKeys[h],O(r,w),!f.error&&f.status===0}let u=g(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[h];return u.apiKeys&&delete u.apiKeys[h],O(t,u),l}function je(){let m={},h={};if(i){let u=g(r,{providers:{},apiKeys:{}});for(let[l,f]of Object.entries(u.providers||{}))m[l]={loggedIn:!!fe(l),expiresAt:Number(f.expiresAt||0),source:String(f.source||"oracle"),storage:c};for(let l of Object.keys(u.apiKeys||{}))h[l]={configured:!!he(l),storage:c}}else{let u=g(t,{providers:{},apiKeys:{}});for(let[l,f]of Object.entries(u.providers||{}))m[l]={loggedIn:!!f?.accessToken,expiresAt:Number(f?.expiresAt||0),source:String(f?.source||"oracle"),storage:c};for(let[l,f]of Object.entries(u.apiKeys||{}))h[l]={configured:!!f,storage:c}}for(let u of Object.keys(C)){if(m[u])continue;let l=v(u);l&&(m[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:c,providers:m,apiKeys:h}}return Object.freeze({file:t,storage:c,get:fe,set:Le,remove:Ie,getApiKey:he,setApiKey:Ce,removeApiKey:Ue,status:je,withLock:d})}var Ee;function U(){return Ee||=ut(),Ee}function oe(e){return Buffer.from(e).toString("base64url")}function lt(){let e=oe(ne(32));return{verifier:e,challenge:oe(tt("sha256").update(e).digest()),state:oe(ne(24))}}function pt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&rt(r,o)}function dt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return nt(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function se(e){return new URLSearchParams(e).toString()}async function T(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function ft(e){if(e)return String(await e()).trim();let t=ot.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function ie(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return I({accessToken:r,refreshToken:o,expiresAt:at(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function ht(e){let t=C["anthropic-oauth"],r=e.pkce||lt(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await ft(e.inputFn),[i,c]=s.split("#",2);if(!i||!pt(c,r.state))throw new Error("Claude OAuth state mismatch");let a=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:c,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return ie(await T(a,"Claude OAuth token exchange"),e)}async function mt(e){let t=C["openai-codex"],r=await T(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let c=0;c<Math.ceil(900/n);c+=1){await e.sleepFn(n*1e3);let a=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(a.ok){s=await T(a,"Codex device authorization");break}if(![403,404].includes(a.status))throw new Error(`Codex device authorization failed (HTTP ${a.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:se({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return ie(await T(i,"Codex OAuth token exchange"),e)}function J(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function wt(e){let t=C["xai-oauth"],r=await T(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");J(r.authorization_endpoint);let o=J(r.token_endpoint),n=await T(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:se({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=J(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),c=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let a=0;a<c;a+=1){let d=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:se({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(d.ok){let v=await T(d,"xAI OAuth token exchange");return ie(v,{...e,discovery:{authorization_endpoint:J(r.authorization_endpoint),token_endpoint:o}})}let p="";try{p=String((await d.json())?.error||"")}catch{}if(p==="slow_down")await e.sleepFn((i+1)*1e3);else if(p==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${d.status}${p?`, ${p}`:""})`)}throw new Error("xAI device authorization timed out")}async function Ae(e,t={}){let r=P(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||dt,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?ht(o):r==="openai-codex"?mt(o):wt(o)}import X from"node:fs";import ae from"node:path";var gt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","custom","anthropic-oauth","openai-codex","xai-oauth"]);function Y(e){return String(e||"").trim()||void 0}function yt(e,{required:t=!1}={}){let r=Y(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!gt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function vt(e,{required:t=!1}={}){let r=Y(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function kt(e){let t=Y(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function G({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=yt(e),s=vt(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:kt(r)};if(Y(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var St=new Set(["auto","standalone","hermes","remote","arch"]);function xt(){return ae.join(S(),"model.json")}function j(e){return String(e||"").trim()||void 0}function Et(e={}){let t=j(e.backend)?.toLowerCase()||"auto",r=G({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=j(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=j(e.reasoningEffort),i=j(e.computeHost||e.remoteHost),c=j(e.computeUser||e.remoteUser),a=j(e.computePath||e.remotePath);if(!St.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...c?{computeUser:c}:{},...a?{computePath:a}:{}}}function Oe(e){let t=Et(e),r=xt();A(ae.dirname(r)),process.platform!=="win32"&&X.chmodSync(ae.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return X.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`,{mode:384}),X.renameSync(o,r),process.platform!=="win32"&&X.chmodSync(r,384),t}var be=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},custom:{model:""}});function ce(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function _t(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function At(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`)},s=i=>{let c=String(i);for(let a of c){if(a==="\r"||a===`
+`){n(),t(o.trim());return}if(a===""){n(),r(new Error("cancelled"));return}a==="\x7F"||a==="\b"?o=o.slice(0,-1):o+=a}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function ue(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...G({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function Pe(e,t,r={}){return Oe(ue(e,t,r))}function Ot(e){process.stdout.write(`storage: ${e.storage}
 `);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
 `);return}for(let[o,n]of t){let s=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${s}
 `)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
-`)}function Ot(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
-`)}var ue={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Ot(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=U();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
-`):_t(n),0}if(r==="login"){let n=t.find(c=>!c.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let s=K(n),i=ae(t,"--model")||s.model;ce(s.id,i);let a=await Ae(s.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let c=o.get(s.id);o.set(s.id,a);try{be(s.id,i)}catch(h){throw c?o.set(s.id,c):o.remove(s.id),h}}),process.stdout.write(`${s.id}: logged in, stored in ${o.storage}
-`),0}if(r==="api-key"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(Oe,n))throw new Error(`unsupported API-key provider: ${n}`);let s=ae(t,"--model")||Oe[n].model,i=ae(t,"--base-url");ce(n,s,{baseUrl:i});let a=t.includes("--stdin")?await xt():await At();return await o.withLock(async()=>{let c=o.getApiKey(n);o.setApiKey(n,a);try{be(n,s,{baseUrl:i})}catch(h){throw c?o.setApiKey(n,c):o.removeApiKey(n),h}}),process.stdout.write(`${n}: API key configured in ${o.storage}
-`),0}if(r==="logout"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let s=!1;try{s=o.remove(P(n))}catch{}let i=o.removeApiKey(n);if(!s&&!i)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`)}function bt(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
+`)}var Z={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:bt(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=U();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):Ot(n),0}if(r==="login"){let n=t.find(a=>!a.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let s=K(n),i=ce(t,"--model")||s.model;ue(s.id,i);let c=await Ae(s.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let a=o.get(s.id);o.set(s.id,c);try{Pe(s.id,i)}catch(d){throw a?o.set(s.id,a):o.remove(s.id),d}}),process.stdout.write(`${s.id}: logged in, stored in ${o.storage}
+`),0}if(r==="api-key"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(be,n))throw new Error(`unsupported API-key provider: ${n}`);let s=ce(t,"--model")||be[n].model,i=ce(t,"--base-url");ue(n,s,{baseUrl:i});let c=t.includes("--stdin")?await _t():await At();return await o.withLock(async()=>{let a=o.getApiKey(n);o.setApiKey(n,c);try{Pe(n,s,{baseUrl:i})}catch(d){throw a?o.setApiKey(n,a):o.removeApiKey(n),d}}),process.stdout.write(`${n}: API key configured in ${o.storage}
+`),0}if(r==="logout"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let s=!1;try{s=o.remove(P(n))}catch{}let i=o.removeApiKey(n);if(!s&&!i)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
 `),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};var Pt=Object.freeze([{alias:"claude",label:"Anthropic OAuth"},{alias:"codex",label:"OpenAI Codex OAuth"},{alias:"grok",label:"Grok / xAI OAuth"}]),Re=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI API"},{id:"anthropic",label:"Anthropic API"},{id:"xai",label:"xAI API"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Google Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"}]);function X(e=U().status()){let t=["standalone model OAuth (choose one)",""];for(let r of Pt){let o=K(r.alias),n=e.providers?.[o.id]?.loggedIn===!0;t.push(`  ${r.label.padEnd(18)} ${n?"connected":"not connected"}`,`    oracle setup model ${r.alias}`)}t.push("","OAuth uses your provider subscription. No API key is required.","","standalone API keys","");for(let r of Re){let o=e.apiKeys?.[r.id]?.configured===!0;t.push(`  ${r.label.padEnd(18)} ${o?"configured":"not configured"}`,`    oracle setup model ${r.id}`)}return t.push("","Any other OpenAI-compatible provider:","  oracle auth api-key custom --model MODEL --base-url https://provider.example/v1","","The selected provider is saved as backend=standalone in model.json.",""),t.join(`
+`),1}}};var $e=Object.freeze([{alias:"claude",label:"Anthropic OAuth"},{alias:"codex",label:"OpenAI Codex OAuth"},{alias:"grok",label:"Grok / xAI OAuth"}]),de=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI API"},{id:"anthropic",label:"Anthropic API"},{id:"xai",label:"xAI API"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Google Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"},{id:"nous",label:"Nous"}]);async function Er({stdin:e=process.stdin,stdout:t=process.stdout,readLine:r,runAuth:o=n=>Z.run({argv:n})}={}){if(t.write(`${F()}
+`),t.write(`choose oauth: claude | codex | grok   (enter skips)
+`),e.isTTY!==!0||t.isTTY!==!0)return{skipped:!0,reason:"non-tty"};t.write("> ");let n=r?await r():await new Promise(a=>{let d="",p=v=>{d+=String(v),(d.includes(`
+`)||d.includes("\r"))&&(e.off("data",p),a(d.trim()))};e.on("data",p)}),s=String(n||"").trim().toLowerCase();if(!s||s==="skip")return{skipped:!0,reason:"skipped"};let i=$e.find(a=>a.alias===s);if(i){let a=await o(["login",i.alias]);return{skipped:!1,choice:i.alias,code:a}}if(de.find(a=>a.id===s)||s==="custom"){let a=await o(["api-key",s]);return{skipped:!1,choice:s,code:a}}return t.write(`unknown choice '${s}'
+`),{skipped:!0,reason:"unknown"}}function F(e=U().status()){let t=["standalone model OAuth (choose one)",""];for(let r of $e){let o=K(r.alias),n=e.providers?.[o.id]?.loggedIn===!0;t.push(`  ${r.label.padEnd(18)} ${n?"connected":"not connected"}`,`    oracle setup model ${r.alias}`)}t.push("","OAuth uses your provider subscription. No API key is required.","","standalone API keys","");for(let r of de){let o=e.apiKeys?.[r.id]?.configured===!0;t.push(`  ${r.label.padEnd(18)} ${o?"configured":"not configured"}`,`    oracle setup model ${r.id}`)}return t.push("","Any other OpenAI-compatible provider:","  oracle auth api-key custom --model MODEL --base-url https://provider.example/v1","","The selected provider is saved as backend=standalone in model.json.",""),t.join(`
 `)}function le(){return["oracle setup, configure standalone OAuth, messaging, and the local agent surface","","  oracle setup                      menu + platform status","  oracle setup status               same, machine-friendly with --json","  oracle setup model                show Claude/Codex/Grok OAuth choices","  oracle setup model claude         connect Anthropic OAuth + select standalone","  oracle setup model codex          connect OpenAI OAuth + select standalone","  oracle setup model grok           connect xAI OAuth + select standalone","  oracle setup model deepseek       securely add a provider API key","  oracle setup model kimi           securely add a Kimi API key","  oracle setup messaging            open hermes gateway setup wizard","  oracle setup telegram             set TELEGRAM_BOT_TOKEN for profile","  oracle setup discord              set DISCORD_BOT_TOKEN for profile","  oracle setup slack                set slack tokens","  oracle setup <platform>           any supported hermes platform","  oracle setup gateway [status|restart|start|stop]","  oracle setup profile [name]       default: oracle","","chat:","  /setup","  /setup telegram","  /setup status","","model credentials stay in the OS keychain or private ~/.config/oracle storage.","messaging tokens stay local in ~/.hermes/profiles/<profile>/.env","oracle never prints secrets."].join(`
-`)}function Tt(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Rt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function pe(e,{inherit:t=!0,env:r=process.env}={}){let o=Se();if(!o.ok)return process.stderr.write(`oracle setup: Hermes not detected (opt-in only).
+`)}function Tt(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Rt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function pe(e,{inherit:t=!0,env:r=process.env}={}){let o=xe();if(!o.ok)return process.stderr.write(`oracle setup: Hermes not detected (opt-in only).
 Native Oracle does not need Hermes.
 To use Hermes messaging/gateway: install Hermes, or run \`oracle bootstrap\`, then retry.
 Detect: oracle harness detect
-`),1;let n=bt(o.bin,e,{stdio:t?"inherit":"pipe",encoding:"utf8",env:r});return n.error?(process.stderr.write(`oracle setup: failed to run hermes: ${n.error.message}
-`),1):(t||(n.stdout&&process.stdout.write(n.stdout),n.stderr&&process.stderr.write(n.stderr)),typeof n.status=="number"?n.status:1)}async function Te(e){if(!b.isTTY||typeof b.setRawMode!="function"){let t=new Error("interactive token entry requires a tty");throw t.code="NO_TTY",t}return Pe.write(`${e}: `),new Promise((t,r)=>{let o="",n=()=>{b.off("data",s),b.setRawMode(!1),b.pause(),Pe.write(`
-`)},s=i=>{for(let a of String(i)){if(a==="\r"||a===`
-`){n(),t(o.trim());return}if(a===""){n(),r(new Error("cancelled"));return}a==="\x7F"||a==="\b"?o=o.slice(0,-1):o+=a}};b.setRawMode(!0),b.resume(),b.on("data",s)})}async function $t(e,t,r=[]){let o=D(t);if(!o)return process.stderr.write(`oracle setup: unknown platform '${t}'
-`),process.stderr.write(`known: ${F().map(c=>c.key).join(", ")}
+`),1;let n=Pt(o.bin,e,{stdio:t?"inherit":"pipe",encoding:"utf8",env:r});return n.error?(process.stderr.write(`oracle setup: failed to run hermes: ${n.error.message}
+`),1):(t||(n.stdout&&process.stdout.write(n.stdout),n.stderr&&process.stderr.write(n.stderr)),typeof n.status=="number"?n.status:1)}async function Re(e){if(!b.isTTY||typeof b.setRawMode!="function"){let t=new Error("interactive token entry requires a tty");throw t.code="NO_TTY",t}return Te.write(`${e}: `),new Promise((t,r)=>{let o="",n=()=>{b.off("data",s),b.setRawMode(!1),b.pause(),Te.write(`
+`)},s=i=>{for(let c of String(i)){if(c==="\r"||c===`
+`){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};b.setRawMode(!0),b.resume(),b.on("data",s)})}async function $t(e,t,r=[]){let o=D(t);if(!o)return process.stderr.write(`oracle setup: unknown platform '${t}'
+`),process.stderr.write(`known: ${H().map(a=>a.key).join(", ")}
 `),1;if(!o.required.length)return process.stdout.write(`opening hermes setup for ${o.key} (interactive)
-`),W({lastPlatform:o.key,profile:e}),pe(["-p",e,...o.hermes||["gateway","setup"]]);let n={},s=[];for(let c=0;c<r.length;c++){let h=r[c];if(h==="--token"&&r[c+1]){n.token=r[++c];continue}if(h==="--allowed-users"&&r[c+1]){n.allowedUsers=r[++c];continue}if(h==="--app-token"&&r[c+1]){n.appToken=r[++c];continue}if(h.startsWith("-"))return process.stderr.write(`oracle setup: unknown flag ${h}
-`),1;s.push(h)}let i=n.token||s[0]||"";if(!i&&!process.stdin.isTTY&&(i=await readStdinSecret()),!i)try{i=await Te(`${o.key} bot token`)}catch(c){if(c?.code==="NO_TTY")return process.stderr.write(`oracle setup ${o.key}: pipe the token on stdin (echo "$TOKEN" | oracle setup ${o.key}) or pass --token <value>
-`),1;throw c}if(!i)return process.stderr.write(`aborted: empty token
-`),1;let a={};if(n.allowedUsers&&(o.key==="telegram"&&(a.TELEGRAM_ALLOWED_USERS=n.allowedUsers),o.key==="discord"&&(a.DISCORD_ALLOWED_USERS=n.allowedUsers),o.key==="slack"&&(a.SLACK_ALLOWED_USERS=n.allowedUsers)),n.appToken&&o.key==="slack"&&(a.SLACK_APP_TOKEN=n.appToken),o.key==="slack"&&!a.SLACK_APP_TOKEN){let c=n.appToken||s[1]||"";if(!c&&process.stdin.isTTY&&(c=await Te("slack app token (xapp-...)")),!c)return process.stderr.write(`slack needs bot token + app token
-`),1;a.SLACK_APP_TOKEN=c}try{let c=ye(e,o.key,i,a);return W({lastPlatform:o.key,profile:e,ready:!0}),process.stdout.write(`saved ${o.key} credentials for profile '${e}'
-path: ${c.path}
+`),V({lastPlatform:o.key,profile:e}),pe(["-p",e,...o.hermes||["gateway","setup"]]);let n={},s=[];for(let a=0;a<r.length;a++){let d=r[a];if(d==="--token"&&r[a+1]){n.token=r[++a];continue}if(d==="--allowed-users"&&r[a+1]){n.allowedUsers=r[++a];continue}if(d==="--app-token"&&r[a+1]){n.appToken=r[++a];continue}if(d.startsWith("-"))return process.stderr.write(`oracle setup: unknown flag ${d}
+`),1;s.push(d)}let i=n.token||s[0]||"";if(!i&&!process.stdin.isTTY&&(i=await readStdinSecret()),!i)try{i=await Re(`${o.key} bot token`)}catch(a){if(a?.code==="NO_TTY")return process.stderr.write(`oracle setup ${o.key}: pipe the token on stdin (echo "$TOKEN" | oracle setup ${o.key}) or pass --token <value>
+`),1;throw a}if(!i)return process.stderr.write(`aborted: empty token
+`),1;let c={};if(n.allowedUsers&&(o.key==="telegram"&&(c.TELEGRAM_ALLOWED_USERS=n.allowedUsers),o.key==="discord"&&(c.DISCORD_ALLOWED_USERS=n.allowedUsers),o.key==="slack"&&(c.SLACK_ALLOWED_USERS=n.allowedUsers)),n.appToken&&o.key==="slack"&&(c.SLACK_APP_TOKEN=n.appToken),o.key==="slack"&&!c.SLACK_APP_TOKEN){let a=n.appToken||s[1]||"";if(!a&&process.stdin.isTTY&&(a=await Re("slack app token (xapp-...)")),!a)return process.stderr.write(`slack needs bot token + app token
+`),1;c.SLACK_APP_TOKEN=a}try{let a=ve(e,o.key,i,c);return V({lastPlatform:o.key,profile:e,ready:!0}),process.stdout.write(`saved ${o.key} credentials for profile '${e}'
+path: ${a.path}
 next: oracle setup gateway restart
-`),0}catch(c){return process.stderr.write(`oracle setup: ${c.message}
-`),1}}var xr={name:"setup",summary:"configure standalone OAuth and messaging platforms",group:"read",usage:le(),async run(e){let t=[...e.argv],r=t.includes("--json"),o=Tt(t),n=Rt(t).filter(a=>a!=="--json"),s=(n[0]||"menu").toLowerCase(),i=n.slice(1);if(["-h","--help","help"].includes(s))return process.stdout.write(le()+`
-`),0;if(["menu","list","ls"].includes(s))return r?process.stdout.write(JSON.stringify({...q(o),modelAuth:U().status()},null,2)+`
-`):(process.stdout.write(X()),process.stdout.write(B(o))),0;if(["status","show"].includes(s)){let a=q(o);return r?process.stdout.write(JSON.stringify({...a,modelAuth:U().status()},null,2)+`
-`):(process.stdout.write(X()),process.stdout.write(B(o)),process.stdout.write(`hermes root: ${M()}
-`)),0}if(["model","oauth"].includes(s)){let a=String(i[0]||"").trim().toLowerCase();if(!a||["list","status","show"].includes(a))return process.stdout.write(X()),0;if(Re.some(c=>c.id===a)||a==="custom")return ue.run({...e,argv:["api-key",a,...i.slice(1)]});try{return K(a),ue.run({...e,argv:["login",a,...i.slice(1)]})}catch(c){return process.stderr.write(`oracle setup model: ${c.message}
-`),process.stderr.write(X()),1}}if(["messaging","gateway-setup","platforms"].includes(s))return W({lastAction:"messaging",profile:o}),process.stdout.write(`opening hermes gateway setup wizard...
-`),pe(["-p",o,"gateway","setup"]);if(s==="gateway"){let a=(i[0]||"status").toLowerCase();return["status","start","stop","restart","run","install"].includes(a)?pe(["-p",o,"gateway",a]):(process.stderr.write(`usage: oracle setup gateway [status|start|stop|restart|run|install]
-`),1)}if(s==="profile"){let a=i[0]||o;return process.stdout.write(`profile: ${a}
-hermes: ${M()}/profiles/${a}
-`),process.stdout.write(B(a)),0}return D(s)?$t(o,s,i):(process.stderr.write(`oracle setup: unknown verb '${s}'
+`),0}catch(a){return process.stderr.write(`oracle setup: ${a.message}
+`),1}}var _r={name:"setup",summary:"configure standalone OAuth and messaging platforms",group:"read",usage:le(),async run(e){let t=[...e.argv],r=t.includes("--json"),o=Tt(t),n=Rt(t).filter(c=>c!=="--json"),s=(n[0]||"menu").toLowerCase(),i=n.slice(1);if(["-h","--help","help"].includes(s))return process.stdout.write(le()+`
+`),0;if(["menu","list","ls"].includes(s))return r?process.stdout.write(JSON.stringify({...B(o),modelAuth:U().status()},null,2)+`
+`):(process.stdout.write(F()),process.stdout.write(W(o))),0;if(["status","show"].includes(s)){let c=B(o);return r?process.stdout.write(JSON.stringify({...c,modelAuth:U().status()},null,2)+`
+`):(process.stdout.write(F()),process.stdout.write(W(o)),process.stdout.write(`hermes root: ${M()}
+`)),0}if(["model","oauth"].includes(s)){let c=String(i[0]||"").trim().toLowerCase();if(!c||["list","status","show"].includes(c))return process.stdout.write(F()),0;if(de.some(a=>a.id===c)||c==="custom")return Z.run({...e,argv:["api-key",c,...i.slice(1)]});try{return K(c),Z.run({...e,argv:["login",c,...i.slice(1)]})}catch(a){return process.stderr.write(`oracle setup model: ${a.message}
+`),process.stderr.write(F()),1}}if(["messaging","gateway-setup","platforms"].includes(s))return V({lastAction:"messaging",profile:o}),process.stdout.write(`opening hermes gateway setup wizard...
+`),pe(["-p",o,"gateway","setup"]);if(s==="gateway"){let c=(i[0]||"status").toLowerCase();return["status","start","stop","restart","run","install"].includes(c)?pe(["-p",o,"gateway",c]):(process.stderr.write(`usage: oracle setup gateway [status|start|stop|restart|run|install]
+`),1)}if(s==="profile"){let c=i[0]||o;return process.stdout.write(`profile: ${c}
+hermes: ${M()}/profiles/${c}
+`),process.stdout.write(W(c)),0}return D(s)?$t(o,s,i):(process.stderr.write(`oracle setup: unknown verb '${s}'
 ${le()}
-`),1)}};export{xr as default,X as renderModelSetup};
+`),1)}};export{_r as default,F as renderModelSetup,Er as runFirstRunModelSetup};

package/dist/cli/commands/venues.mjs

@@ -1,3 +1,3 @@
-var b={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},Pe=new Map(Object.values(b).map(e=>[e.chainId,e]));import T from"node:fs";import D from"node:path";import{homedir as me}from"node:os";function x(e){let r=e?.transactionHash||e?.hash||e?.txid||null;return r?{happened:!0,hash:String(r),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import c from"node:path";import fe from"node:os";import{createHash as pe,randomBytes as Go}from"node:crypto";import{Interface as k,keccak256 as Ko}from"ethers";import{Transaction as Xo}from"@scure/btc-signer";import{ed25519 as Zo}from"@noble/curves/ed25519.js";import{base58 as vn}from"@scure/base";import{Interface as B}from"ethers";import{Interface as X,MaxUint256 as ht,isAddress as wt,keccak256 as gt,toUtf8Bytes as yt}from"ethers";import{Interface as K,isAddress as Ye}from"ethers";import{isAddress as He}from"ethers";var et=new K(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Y,isAddress as nt}from"ethers";var st=new Y(["function approve(address spender,uint256 amount) returns (bool)"]),ct=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var vt=new X(["function approve(address spender,uint256 amount) returns (bool)"]);var kt=300*1e3,Tt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Rt,NETWORK as Pt,OutScript as _t,RawTx as Bt,SigHash as $t,TEST_NETWORK as Ft,Transaction as Mt}from"@scure/btc-signer";import{createHash as Z}from"node:crypto";import{base58 as jt}from"@scure/base";import{getCompiledTransactionMessageDecoder as Ht}from"@solana/transaction-messages";var C=e=>Z("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Jt=new Map([[C("route"),{name:"route",prefixBytes:0}],[C("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Zt=64*1024;var dr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),fr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var hr="0x"+"00".repeat(32);var ee=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),br=Object.freeze(ee.map(e=>e[0]));var ie=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var qr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var ae=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Dr=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Ur=new B(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),jr=new B(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Wr=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var se=Object.freeze([...ie]),Hr=Object.freeze({...ae});import{ed25519 as sn}from"@noble/curves/ed25519.js";import{base58 as un}from"@scure/base";import{RawTx as dn,SigHash as fn,Transaction as pn}from"@scure/btc-signer";import{Transaction as hn,keccak256 as wn,verifyTypedData as gn}from"ethers";import{encode as Gr}from"@msgpack/msgpack";import{keccak256 as Kr,verifyTypedData as Yr}from"ethers";var Xr=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Qr=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var $n=Object.freeze({N:1<<17,r:8,p:1}),Fn=256*1024*1024,Mn=16*1024;import{homedir as v}from"node:os";import{join as I}from"node:path";var F=process.env.ORACLE_PUBLIC_DESKTOP==="1",le=F?process.env.ORACLE_CONFIG_DIR||I(v(),".config","oracle"):I(v(),".config","oracle"),jn=F?le:I(v(),".config","mad-desk");var Gn="0".repeat(64),Vn=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Kn=Promise.resolve();import{Wallet as oo}from"ethers";import{base58 as ao}from"@scure/base";import{ed25519 as co}from"@noble/curves/ed25519.js";import{NETWORK as lo,TEST_NETWORK as fo,WIF as po,p2wpkh as mo}from"@scure/btc-signer";import{pubECDSA as wo}from"@scure/btc-signer/utils.js";var bi=new k(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),xi=new k(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Si=new k(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function q(e){let r=process.env.ORACLE_SIGNER_STATE_DIR||c.join(process.env.XDG_STATE_HOME||c.join(fe.homedir(),".local","state"),"oracle"),t=pe("sha256").update(c.resolve(e)).digest("hex").slice(0,16);return{vault:c.join(e,"vault.json"),policy:c.join(e,"signer-policy.json"),policyKey:c.join(e,"policy-integrity-key"),policyAnchor:c.join(r,`signer-policy-${t}.high-water`),ledger:c.join(e,"signer-ledger.json"),ledgerAnchor:c.join(r,`signer-ledger-${t}.high-water`),token:c.join(e,"signer-token"),lock:c.join(r,`signer-${t}.lock`)}}function he(){return process.env.ORACLE_CONFIG_DIR||D.join(me(),".config","oracle")}function h(){let e=q(D.join(he(),"signer")),r=T.existsSync(e.vault),t=T.existsSync(e.lock),o=r?t?"disarmed":"armed-owner-confirmed":"inert-no-key";return{vaultExists:r,policyConfigured:T.existsSync(e.policy),armed:r&&!t,disarmed:t,capabilities:{swap:o,bridge:o},autonomous:!1,note:"Keys stay on this machine. Exact confirmation is required before any broadcast."}}var Pi=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import W from"node:fs";import ke from"node:path";import w from"node:fs";import we from"node:os";import f from"node:path";import{fileURLToPath as ge}from"node:url";var ye=f.dirname(ge(import.meta.url)),qi=f.resolve(ye,"../..");function U(){return process.env.ORACLE_FAKE_HOME||we.homedir()}function Ee(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return Ee()?process.env.ORACLE_CONFIG_DIR||f.join(U(),".config","oracle"):f.join(U(),".config","oracle")}function be(){return f.join(g(),"desk.json")}function xe(){return f.join(g(),"env")}function d({force:e=!1}={}){if(d._done&&!e)return d._result||null;d._done=!0;let r={},t=(i,n)=>{if(n==null)return;let a=String(n).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,r[i]=a))};try{let i=xe();if(w.existsSync(i))for(let n of w.readFileSync(i,"utf8").split(/\r?\n/)){let a=n.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let s=a[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t(a[1],s)}}catch{}try{let i=be();if(w.existsSync(i)){let n=JSON.parse(w.readFileSync(i,"utf8"));n&&typeof n=="object"&&(t("ORACLE_DESK_URL",n.deskUrl||n.dataUrl||n.url),t("ORACLE_DATA_URL",n.dataUrl||n.deskUrl||n.url),t("ORACLE_API_URL",n.apiUrl||n.dataUrl||n.deskUrl),t("ORACLE_PUBLIC_URL",n.publicUrl||n.deskUrl||n.dataUrl),t("ORACLE_EXEC_URL",n.execUrl),t("MAD_DESK_URL",n.deskUrl||n.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(t("ORACLE_DESK_URL",o),t("ORACLE_DATA_URL",o),t("ORACLE_API_URL",o),t("ORACLE_PUBLIC_URL",o),t("MAD_DESK_URL",o)),d._result=Object.keys(r).length?r:null,d._result}try{d()}catch{}var Se=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","custom","anthropic-oauth","openai-codex","xai-oauth"]);function y(e){return String(e||"").trim()||void 0}function Ae(e,{required:r=!1}={}){let t=y(e)?.toLowerCase();if(!t){if(r)throw new Error("model provider is required");return}if(!Se.has(t))throw new Error(`unsupported provider: ${t}`);return t}function ve(e,{required:r=!1}={}){let t=y(e);if(!t){if(r)throw new Error("model is required");return}if(t.includes("..")||t.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(t))throw new Error("invalid model id");return t}function Ie(e){let r=y(e);if(!r||r.length>2048)throw new Error("invalid custom base URL");let t;try{t=new URL(r)}catch{throw new Error("invalid custom base URL")}let o=t.hostname.toLowerCase().replace(/^\[|\]$/g,""),i=o==="localhost"||o==="127.0.0.1"||o==="::1";if(t.protocol!=="https:"&&!(t.protocol==="http:"&&i)||t.username||t.password||t.search||t.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return t.toString().replace(/\/+$/,"")}function j({provider:e,model:r,baseUrl:t}={},{requireModel:o=!1}={}){let i=Ae(e),n=ve(r,{required:o});if(i==="custom")return{provider:i,...n?{model:n}:{},baseUrl:Ie(t)};if(y(t))throw new Error("baseUrl is only supported for the custom provider");return{...i?{provider:i}:{},...n?{model:n}:{}}}var Te=new Set(["auto","standalone","hermes","remote","arch"]);function Oe(){return ke.join(g(),"model.json")}function p(e){return String(e||"").trim()||void 0}function Ne(e={}){let r=p(e.backend)?.toLowerCase()||"auto",t=j({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:r==="standalone"}),o=p(e.apiKeyEnv),i=Number.parseInt(String(e.contextLength||""),10),n=p(e.reasoningEffort),a=p(e.computeHost||e.remoteHost),s=p(e.computeUser||e.remoteUser),u=p(e.computePath||e.remotePath);if(!Te.has(r))throw new Error(`unsupported backend: ${r}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(r))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(r==="remote"&&!a)throw new Error("remote backend requires computeHost");return{backend:r,...t,...o?{apiKeyEnv:o}:{},...Number.isFinite(i)&&i>0?{contextLength:i}:{},...n?{reasoningEffort:n}:{},...a?{computeHost:a}:{},...s?{computeUser:s}:{},...u?{computePath:u}:{}}}function H(){let e=Oe();if(!W.existsSync(e))return null;try{return Ne(JSON.parse(W.readFileSync(e,"utf8")))}catch{return null}}var Ce=new Set(["127.0.0.1","::1","localhost"]);function O({env:e=process.env,vault:r=null}={}){let t=r||h(),o=[];for(let[i,n]of Object.entries(b)){let a=(n.rpcEnv||[]).some(u=>String(e[u]||"").trim()),s="prepare";n.evm?a&&(s="live"):s="unavailable",o.push({key:i,chainId:n.chainId,name:n.name,family:"evm",status:s,execute:!!(t.vaultExists&&t.armed&&!t.disarmed),note:a?"rpc configured":"public read/prepare; set RPC for live reads"})}return o.push({key:"solana",chainId:null,name:"Solana",family:"sol",status:"prepare",execute:!1,note:"Jupiter quote/prepare; local sol signer"},{key:"bitcoin",chainId:null,name:"Bitcoin",family:"btc",status:"prepare",execute:!1,note:"Esplora read; local btc signer"},{key:"hyperliquid-l1",chainId:null,name:"Hyperliquid L1",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not an EVM signer family"},{key:"polymarket",chainId:null,name:"Polymarket",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not a signer family"}),o}function Le({env:e=process.env,model:r=H(),vault:t=h(),signerReachable:o=!1,quote:i=null}={}){let n=[],a=(l,E,J,z=null)=>n.push({id:l,status:E,detail:J,fix:z}),s=(()=>{let[l,E]=process.versions.node.split(".").map(Number);return l>20||l===20&&E>=19})();a("node",s?"ok":"fail",`node ${process.versions.node}`,s?null:"install node >= 20.19"),r?r.backend==="hermes"?a("model","warn","backend=hermes (opt-in attach)","oracle model --backend standalone"):a("model","ok",`${r.backend||"auto"} ${r.provider||""} ${r.model||""}`.trim()):a("model","fail","no model.json","oracle setup model"),t.vaultExists?t.disarmed?a("vault","warn","vault present, DISARMED","oracle signer (re-arm after confirm)"):a("vault",t.armed?"ok":"warn",t.armed?"present, armed":"present, not armed"):a("vault","fail","no local vault","oracle sign init");let u=e.ORACLE_SIGNER_HOST||"127.0.0.1";return Ce.has(u)?a("signer",o?"ok":"warn",o?`loopback ${u}:${e.ORACLE_SIGNER_PORT||9462}`:"loopback signer not reachable",o?null:"oracle signer"):a("signer","fail",`signer host ${u} is not loopback`,"unset ORACLE_SIGNER_HOST"),i?i.ok?a("quote","ok",i.detail||"net quote returned"):a("quote","warn",i.detail||"quote unavailable","check network / oracle data serve"):a("quote","warn","quote not probed",null),{ok:!n.some(l=>l.status==="fail"),checks:n,venues:O({env:e,vault:t})}}async function ta(e=process.env){let r=e.ORACLE_SIGNER_HOST||"127.0.0.1",t=e.ORACLE_SIGNER_PORT||9462;try{return(await fetch(`http://${r}:${t}/status`,{signal:AbortSignal.timeout(1500)})).ok}catch{return!1}}async function ra(){try{let e=await fetch("https://api.dexscreener.com/latest/dex/search?q=WETH%20USDC",{signal:AbortSignal.timeout(4e3)});if(!e.ok)return{ok:!1,detail:`dexscreener ${e.status}`};let t=(await e.json())?.pairs?.[0];return!t?.chainId||!t?.priceUsd?{ok:!1,detail:"no pair"}:{ok:!0,detail:`${t.chainId} ${t.baseToken?.symbol}/${t.quoteToken?.symbol} $${t.priceUsd}`}}catch(e){return{ok:!1,detail:e instanceof Error?e.message:"quote failed"}}}var na={name:"venues",summary:"label every shipped venue live / prepare / unavailable",group:"read",usage:"oracle venues [--json]",async run(e){let r=e.argv.includes("--json"),t=O();if(r)return process.stdout.write(`${JSON.stringify({venues:t},null,2)}
+var b={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},Pe=new Map(Object.values(b).map(e=>[e.chainId,e]));import T from"node:fs";import D from"node:path";import{homedir as me}from"node:os";function x(e){let r=e?.transactionHash||e?.hash||e?.txid||null;return r?{happened:!0,hash:String(r),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import c from"node:path";import fe from"node:os";import{createHash as pe,randomBytes as Go}from"node:crypto";import{Interface as k,keccak256 as Ko}from"ethers";import{Transaction as Xo}from"@scure/btc-signer";import{ed25519 as Zo}from"@noble/curves/ed25519.js";import{base58 as vn}from"@scure/base";import{Interface as B}from"ethers";import{Interface as X,MaxUint256 as ht,isAddress as wt,keccak256 as gt,toUtf8Bytes as yt}from"ethers";import{Interface as K,isAddress as Ye}from"ethers";import{isAddress as He}from"ethers";var et=new K(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Y,isAddress as nt}from"ethers";var st=new Y(["function approve(address spender,uint256 amount) returns (bool)"]),ct=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var vt=new X(["function approve(address spender,uint256 amount) returns (bool)"]);var kt=300*1e3,Tt=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Rt,NETWORK as Pt,OutScript as _t,RawTx as Bt,SigHash as $t,TEST_NETWORK as Ft,Transaction as Mt}from"@scure/btc-signer";import{createHash as Z}from"node:crypto";import{base58 as jt}from"@scure/base";import{getCompiledTransactionMessageDecoder as Ht}from"@solana/transaction-messages";var C=e=>Z("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Jt=new Map([[C("route"),{name:"route",prefixBytes:0}],[C("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Zt=64*1024;var dr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),fr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var hr="0x"+"00".repeat(32);var ee=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),br=Object.freeze(ee.map(e=>e[0]));var ie=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var qr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var ae=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Dr=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Ur=new B(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),jr=new B(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Wr=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var se=Object.freeze([...ie]),Hr=Object.freeze({...ae});import{ed25519 as sn}from"@noble/curves/ed25519.js";import{base58 as un}from"@scure/base";import{RawTx as dn,SigHash as fn,Transaction as pn}from"@scure/btc-signer";import{Transaction as hn,keccak256 as wn,verifyTypedData as gn}from"ethers";import{encode as Gr}from"@msgpack/msgpack";import{keccak256 as Kr,verifyTypedData as Yr}from"ethers";var Xr=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Qr=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var $n=Object.freeze({N:1<<17,r:8,p:1}),Fn=256*1024*1024,Mn=16*1024;import{homedir as v}from"node:os";import{join as I}from"node:path";var F=process.env.ORACLE_PUBLIC_DESKTOP==="1",le=F?process.env.ORACLE_CONFIG_DIR||I(v(),".config","oracle"):I(v(),".config","oracle"),jn=F?le:I(v(),".config","mad-desk");var Gn="0".repeat(64),Vn=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Kn=Promise.resolve();import{Wallet as oo}from"ethers";import{base58 as ao}from"@scure/base";import{ed25519 as co}from"@noble/curves/ed25519.js";import{NETWORK as lo,TEST_NETWORK as fo,WIF as po,p2wpkh as mo}from"@scure/btc-signer";import{pubECDSA as wo}from"@scure/btc-signer/utils.js";var bi=new k(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),xi=new k(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Si=new k(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function q(e){let r=process.env.ORACLE_SIGNER_STATE_DIR||c.join(process.env.XDG_STATE_HOME||c.join(fe.homedir(),".local","state"),"oracle"),t=pe("sha256").update(c.resolve(e)).digest("hex").slice(0,16);return{vault:c.join(e,"vault.json"),policy:c.join(e,"signer-policy.json"),policyKey:c.join(e,"policy-integrity-key"),policyAnchor:c.join(r,`signer-policy-${t}.high-water`),ledger:c.join(e,"signer-ledger.json"),ledgerAnchor:c.join(r,`signer-ledger-${t}.high-water`),token:c.join(e,"signer-token"),lock:c.join(r,`signer-${t}.lock`)}}function he(){return process.env.ORACLE_CONFIG_DIR||D.join(me(),".config","oracle")}function h(){let e=q(D.join(he(),"signer")),r=T.existsSync(e.vault),t=T.existsSync(e.lock),o=r?t?"disarmed":"armed-owner-confirmed":"inert-no-key";return{vaultExists:r,policyConfigured:T.existsSync(e.policy),armed:r&&!t,disarmed:t,capabilities:{swap:o,bridge:o},autonomous:!1,note:"Keys stay on this machine. Exact confirmation is required before any broadcast."}}var Pi=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import W from"node:fs";import ke from"node:path";import w from"node:fs";import we from"node:os";import f from"node:path";import{fileURLToPath as ge}from"node:url";var ye=f.dirname(ge(import.meta.url)),qi=f.resolve(ye,"../..");function U(){return process.env.ORACLE_FAKE_HOME||we.homedir()}function Ee(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function g(){return Ee()?process.env.ORACLE_CONFIG_DIR||f.join(U(),".config","oracle"):f.join(U(),".config","oracle")}function be(){return f.join(g(),"desk.json")}function xe(){return f.join(g(),"env")}function d({force:e=!1}={}){if(d._done&&!e)return d._result||null;d._done=!0;let r={},t=(i,n)=>{if(n==null)return;let a=String(n).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,r[i]=a))};try{let i=xe();if(w.existsSync(i))for(let n of w.readFileSync(i,"utf8").split(/\r?\n/)){let a=n.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let s=a[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t(a[1],s)}}catch{}try{let i=be();if(w.existsSync(i)){let n=JSON.parse(w.readFileSync(i,"utf8"));n&&typeof n=="object"&&(t("ORACLE_DESK_URL",n.deskUrl||n.dataUrl||n.url),t("ORACLE_DATA_URL",n.dataUrl||n.deskUrl||n.url),t("ORACLE_API_URL",n.apiUrl||n.dataUrl||n.deskUrl),t("ORACLE_PUBLIC_URL",n.publicUrl||n.deskUrl||n.dataUrl),t("ORACLE_EXEC_URL",n.execUrl),t("MAD_DESK_URL",n.deskUrl||n.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(t("ORACLE_DESK_URL",o),t("ORACLE_DATA_URL",o),t("ORACLE_API_URL",o),t("ORACLE_PUBLIC_URL",o),t("MAD_DESK_URL",o)),d._result=Object.keys(r).length?r:null,d._result}try{d()}catch{}var Se=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","custom","anthropic-oauth","openai-codex","xai-oauth"]);function y(e){return String(e||"").trim()||void 0}function Ae(e,{required:r=!1}={}){let t=y(e)?.toLowerCase();if(!t){if(r)throw new Error("model provider is required");return}if(!Se.has(t))throw new Error(`unsupported provider: ${t}`);return t}function ve(e,{required:r=!1}={}){let t=y(e);if(!t){if(r)throw new Error("model is required");return}if(t.includes("..")||t.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(t))throw new Error("invalid model id");return t}function Ie(e){let r=y(e);if(!r||r.length>2048)throw new Error("invalid custom base URL");let t;try{t=new URL(r)}catch{throw new Error("invalid custom base URL")}let o=t.hostname.toLowerCase().replace(/^\[|\]$/g,""),i=o==="localhost"||o==="127.0.0.1"||o==="::1";if(t.protocol!=="https:"&&!(t.protocol==="http:"&&i)||t.username||t.password||t.search||t.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return t.toString().replace(/\/+$/,"")}function j({provider:e,model:r,baseUrl:t}={},{requireModel:o=!1}={}){let i=Ae(e),n=ve(r,{required:o});if(i==="custom")return{provider:i,...n?{model:n}:{},baseUrl:Ie(t)};if(y(t))throw new Error("baseUrl is only supported for the custom provider");return{...i?{provider:i}:{},...n?{model:n}:{}}}var Te=new Set(["auto","standalone","hermes","remote","arch"]);function Oe(){return ke.join(g(),"model.json")}function p(e){return String(e||"").trim()||void 0}function Ne(e={}){let r=p(e.backend)?.toLowerCase()||"auto",t=j({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:r==="standalone"}),o=p(e.apiKeyEnv),i=Number.parseInt(String(e.contextLength||""),10),n=p(e.reasoningEffort),a=p(e.computeHost||e.remoteHost),s=p(e.computeUser||e.remoteUser),u=p(e.computePath||e.remotePath);if(!Te.has(r))throw new Error(`unsupported backend: ${r}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(r))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(r==="remote"&&!a)throw new Error("remote backend requires computeHost");return{backend:r,...t,...o?{apiKeyEnv:o}:{},...Number.isFinite(i)&&i>0?{contextLength:i}:{},...n?{reasoningEffort:n}:{},...a?{computeHost:a}:{},...s?{computeUser:s}:{},...u?{computePath:u}:{}}}function H(){let e=Oe();if(!W.existsSync(e))return null;try{return Ne(JSON.parse(W.readFileSync(e,"utf8")))}catch{return null}}var Ce=new Set(["127.0.0.1","::1","localhost"]);function O({env:e=process.env,vault:r=null}={}){let t=r||h(),o=[];for(let[i,n]of Object.entries(b)){let a=(n.rpcEnv||[]).some(u=>String(e[u]||"").trim()),s="prepare";n.evm?a&&(s="live"):s="unavailable",o.push({key:i,chainId:n.chainId,name:n.name,family:"evm",status:s,execute:!!(t.vaultExists&&t.armed&&!t.disarmed),note:a?"rpc configured":"public read/prepare; set RPC for live reads"})}return o.push({key:"solana",chainId:null,name:"Solana",family:"sol",status:"prepare",execute:!1,note:"Jupiter quote/prepare; local sol signer"},{key:"bitcoin",chainId:null,name:"Bitcoin",family:"btc",status:"prepare",execute:!1,note:"Esplora read; local btc signer"},{key:"hyperliquid-l1",chainId:null,name:"Hyperliquid L1",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not an EVM signer family"},{key:"polymarket",chainId:null,name:"Polymarket",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not a signer family"}),o}function Le({env:e=process.env,model:r=H(),vault:t=h(),signerReachable:o=!1,quote:i=null}={}){let n=[],a=(l,E,J,z=null)=>n.push({id:l,status:E,detail:J,fix:z}),s=(()=>{let[l,E]=process.versions.node.split(".").map(Number);return l>20||l===20&&E>=19})();a("node",s?"ok":"fail",`node ${process.versions.node}`,s?null:"install node >= 20.19"),r?r.backend==="hermes"?a("model","warn","backend=hermes (opt-in attach)","oracle model --backend standalone"):a("model","ok",`${r.backend||"auto"} ${r.provider||""} ${r.model||""}`.trim()):a("model","fail","no model.json","oracle setup model"),t.vaultExists?t.disarmed?a("vault","warn","vault present, DISARMED","oracle signer (re-arm after confirm)"):a("vault",t.armed?"ok":"warn",t.armed?"present, armed":"present, not armed"):a("vault","fail","no local vault","oracle sign init");let u=e.ORACLE_SIGNER_HOST||"127.0.0.1";return Ce.has(u)?a("signer",o?"ok":"warn",o?`loopback ${u}:${e.ORACLE_SIGNER_PORT||9462}`:"loopback signer not reachable",o?null:"oracle signer"):a("signer","fail",`signer host ${u} is not loopback`,"unset ORACLE_SIGNER_HOST"),i?i.ok?a("quote","ok",i.detail||"net quote returned"):a("quote","warn",i.detail||"quote unavailable","check network / oracle data serve"):a("quote","warn","quote not probed",null),{ok:!n.some(l=>l.status==="fail"),checks:n,venues:O({env:e,vault:t})}}async function ta(e=process.env){let r=e.ORACLE_SIGNER_HOST||"127.0.0.1",t=e.ORACLE_SIGNER_PORT||9462;try{return(await fetch(`http://${r}:${t}/status`,{signal:AbortSignal.timeout(1500)})).ok}catch{return!1}}async function ra(){try{let e=await fetch("https://api.dexscreener.com/latest/dex/search?q=WETH%20USDC",{signal:AbortSignal.timeout(4e3)});if(!e.ok)return{ok:!1,detail:`dexscreener ${e.status}`};let t=(await e.json())?.pairs?.[0];return!t?.chainId||!t?.priceUsd?{ok:!1,detail:"no pair"}:{ok:!0,detail:`${t.chainId} ${t.baseToken?.symbol}/${t.quoteToken?.symbol} $${t.priceUsd}`}}catch(e){return{ok:!1,detail:e instanceof Error?e.message:"quote failed"}}}var na={name:"venues",summary:"label every shipped venue live / prepare / unavailable",group:"read",usage:"oracle venues [--json]",async run(e){let r=e.argv.includes("--json"),t=O();if(r)return process.stdout.write(`${JSON.stringify({venues:t},null,2)}
 `),0;for(let o of t)process.stdout.write(`${o.status.padEnd(12)} ${o.key.padEnd(16)} ${o.name}  exec=${o.execute?"local":"no"}
 `);return 0}};export{x as classifyReceipt,na as default,Le as firstHourReport,ra as probeQuote,ta as probeSigner,h as vaultStatus};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Oracle: standalone multichain agent control plane with an optional encrypted, loopback-only self-hosted signer.",
   "license": "BUSL-1.1",
   "type": "module",

package/public/install.sh

@@ -33,6 +33,25 @@ err()  { printf 'oracle-install: ERROR: %s\n' "$*" >&2; }
 die()  { err "$*"; exit 1; }
 have() { command -v "$1" >/dev/null 2>&1; }
 
+# Mirror packages/oracle/src/tui/brand.mjs SPLASH_ORB. Hardcoded because
+# this script runs before the package exists on disk.
+want_globe() {
+  [ -t 1 ] && [ "${TERM:-}" != "dumb" ] && [ -z "${NO_COLOR:-}" ] && [ "${ORACLE_INSTALL_PLAIN:-0}" != 1 ]
+}
+
+print_globe() {
+  want_globe || return 0
+  cat <<'EOF'
+
+   ███▓▓      oracle
+  █████▓▓▒     installing
+ ██████▓▓▒▒
+  ▓▓▓▓▒▒▒░
+   ▒▒▒░░░
+
+EOF
+}
+
 usage() {
   cat <<'EOF'
 Oracle install (curl)
@@ -278,6 +297,7 @@ EOF
 }
 
 main() {
+  print_globe
   need_cmds
   log "os=$OS arch=$ARCH"
   log "prefix=$PREFIX home=$SHARE_DIR"

package/public/oracle-splash/install.sh

@@ -33,6 +33,25 @@ err()  { printf 'oracle-install: ERROR: %s\n' "$*" >&2; }
 die()  { err "$*"; exit 1; }
 have() { command -v "$1" >/dev/null 2>&1; }
 
+# Mirror packages/oracle/src/tui/brand.mjs SPLASH_ORB. Hardcoded because
+# this script runs before the package exists on disk.
+want_globe() {
+  [ -t 1 ] && [ "${TERM:-}" != "dumb" ] && [ -z "${NO_COLOR:-}" ] && [ "${ORACLE_INSTALL_PLAIN:-0}" != 1 ]
+}
+
+print_globe() {
+  want_globe || return 0
+  cat <<'EOF'
+
+   ███▓▓      oracle
+  █████▓▓▒     installing
+ ██████▓▓▒▒
+  ▓▓▓▓▒▒▒░
+   ▒▒▒░░░
+
+EOF
+}
+
 usage() {
   cat <<'EOF'
 Oracle install (curl)
@@ -278,6 +297,7 @@ EOF
 }
 
 main() {
+  print_globe
   need_cmds
   log "os=$OS arch=$ARCH"
   log "prefix=$PREFIX home=$SHARE_DIR"