@oracle-agent/oracle 0.28.13 → 0.28.15

package/dist/cli/commands/receipt.mjs

@@ -1,5 +1,5 @@
-var E={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},re=new Map(Object.values(E).map(t=>[t.chainId,t]));function l(t){let o=t?.transactionHash||t?.hash||t?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Interface as g,keccak256 as mo}from"ethers";import{Transaction as wo}from"@scure/btc-signer";import{ed25519 as yo}from"@noble/curves/ed25519.js";import{base58 as zr}from"@scure/base";import{Interface as k}from"ethers";import{Interface as B,MaxUint256 as Me,isAddress as qe,keccak256 as De,toUtf8Bytes as Ue}from"ethers";import{Interface as P,isAddress as Ee}from"ethers";import{isAddress as pe}from"ethers";var Ae=new P(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as _,isAddress as ke}from"ethers";var Ce=new _(["function approve(address spender,uint256 amount) returns (bool)"]),Le=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Ge=new B(["function approve(address spender,uint256 amount) returns (bool)"]);var Ke=300*1e3,Ye=(()=>{let t=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(t)&&t>0?t:1800*1e3})();import{Address as tt,NETWORK as rt,OutScript as nt,RawTx as ot,SigHash as it,TEST_NETWORK as at,Transaction as st}from"@scure/btc-signer";import{createHash as F}from"node:crypto";import{base58 as dt}from"@scure/base";import{getCompiledTransactionMessageDecoder as pt}from"@solana/transaction-messages";var x=t=>F("sha256").update(`global:${t}`).digest().subarray(0,8).toString("hex"),mt=new Map([[x("route"),{name:"route",prefixBytes:0}],[x("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var St=64*1024;var _t=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Bt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Mt="0x"+"00".repeat(32);var M=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Wt=Object.freeze(M.map(t=>t[0]));var W=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var cr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var H=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),ur=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),lr=new k(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),dr=new k(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),fr=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var J=Object.freeze([...W]),pr=Object.freeze({...H});import{ed25519 as Nr}from"@noble/curves/ed25519.js";import{base58 as Lr}from"@scure/base";import{RawTx as Pr,SigHash as _r,Transaction as Br}from"@scure/btc-signer";import{Transaction as Fr,keccak256 as Mr,verifyTypedData as qr}from"ethers";import{encode as wr}from"@msgpack/msgpack";import{keccak256 as yr,verifyTypedData as Er}from"ethers";var br=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),xr=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var on=Object.freeze({N:1<<17,r:8,p:1}),an=256*1024*1024,sn=16*1024;import{homedir as h}from"node:os";import{join as w}from"node:path";var O=process.env.ORACLE_PUBLIC_DESKTOP==="1",V=O?process.env.ORACLE_CONFIG_DIR||w(h(),".config","oracle"):w(h(),".config","oracle"),dn=O?V:w(h(),".config","mad-desk");var wn="0".repeat(64),gn=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var yn=Promise.resolve();import{Wallet as Tn}from"ethers";import{base58 as Nn}from"@scure/base";import{ed25519 as Ln}from"@noble/curves/ed25519.js";import{NETWORK as Pn,TEST_NETWORK as _n,WIF as Bn,p2wpkh as $n}from"@scure/btc-signer";import{pubECDSA as Mn}from"@scure/btc-signer/utils.js";var qo=new g(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Do=new g(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Uo=new g(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);var Yo=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import f from"node:fs";import Y from"node:os";import u from"node:path";import{fileURLToPath as X}from"node:url";var Q=u.dirname(X(import.meta.url)),ri=u.resolve(Q,"../..");function C(){return process.env.ORACLE_FAKE_HOME||Y.homedir()}function Z(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function y(){return Z()?process.env.ORACLE_CONFIG_DIR||u.join(C(),".config","oracle"):u.join(C(),".config","oracle")}function ee(){return u.join(y(),"desk.json")}function te(){return u.join(y(),"env")}function c({force:t=!1}={}){if(c._done&&!t)return c._result||null;c._done=!0;let o={},r=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=te();if(f.existsSync(n))for(let e of f.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let s=i[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),r(i[1],s)}}catch{}try{let n=ee();if(f.existsSync(n)){let e=JSON.parse(f.readFileSync(n,"utf8"));e&&typeof e=="object"&&(r("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),r("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),r("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),r("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),r("ORACLE_EXEC_URL",e.execUrl),r("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let a=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return a&&(r("ORACLE_DESK_URL",a),r("ORACLE_DATA_URL",a),r("ORACLE_API_URL",a),r("ORACLE_PUBLIC_URL",a),r("MAD_DESK_URL",a)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var yi={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(t){let o=t.argv||[],r={},a=o.indexOf("--hash"),n=o.indexOf("--json");if(a>=0)r={transactionHash:o[a+1]};else if(n>=0)try{r=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
+var b={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},ne=new Map(Object.values(b).map(t=>[t.chainId,t]));function l(t){let o=t?.transactionHash||t?.hash||t?.txid||null;return o?{happened:!0,hash:String(o),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import{Interface as E,keccak256 as ho}from"ethers";import{Transaction as go}from"@scure/btc-signer";import{ed25519 as Eo}from"@noble/curves/ed25519.js";import{base58 as zr}from"@scure/base";import{Interface as T}from"ethers";import{Interface as $,MaxUint256 as Me,isAddress as De,keccak256 as Ue,toUtf8Bytes as je}from"ethers";import{Interface as _,isAddress as xe}from"ethers";import{isAddress as me}from"ethers";var ve=new _(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as B,isAddress as Te}from"ethers";var Le=new B(["function approve(address spender,uint256 amount) returns (bool)"]),Re=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Ve=new $(["function approve(address spender,uint256 amount) returns (bool)"]);var Ye=300*1e3,Xe=(()=>{let t=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(t)&&t>0?t:1800*1e3})();import{Address as rt,NETWORK as nt,OutScript as ot,RawTx as it,SigHash as at,TEST_NETWORK as st,Transaction as ct}from"@scure/btc-signer";import{createHash as q}from"node:crypto";import{base58 as ft}from"@scure/base";import{getCompiledTransactionMessageDecoder as mt}from"@solana/transaction-messages";var S=t=>q("sha256").update(`global:${t}`).digest().subarray(0,8).toString("hex"),ht=new Map([[S("route"),{name:"route",prefixBytes:0}],[S("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var At=64*1024;var Bt=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),$t=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Mt="0x"+"00".repeat(32);var M=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Ht=Object.freeze(M.map(t=>t[0]));var H=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var cr=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var J=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),ur=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),lr=new T(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),dr=new T(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),fr=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var z=Object.freeze([...H]),pr=Object.freeze({...J});import{ed25519 as Or}from"@noble/curves/ed25519.js";import{base58 as Lr}from"@scure/base";import{RawTx as Pr,SigHash as _r,Transaction as Br}from"@scure/btc-signer";import{Transaction as Fr,keccak256 as qr,verifyTypedData as Mr}from"ethers";import{encode as wr}from"@msgpack/msgpack";import{keccak256 as yr,verifyTypedData as Er}from"ethers";var xr=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),br=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var on=Object.freeze({N:1<<17,r:8,p:1}),an=256*1024*1024,sn=16*1024;import{homedir as g}from"node:os";import{join as y}from"node:path";var O=process.env.ORACLE_PUBLIC_DESKTOP==="1",K=O?process.env.ORACLE_CONFIG_DIR||y(g(),".config","oracle"):y(g(),".config","oracle"),dn=O?K:y(g(),".config","mad-desk");var wn="0".repeat(64),gn=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var yn=Promise.resolve();import{Wallet as Nn}from"ethers";import{base58 as Cn}from"@scure/base";import{ed25519 as Rn}from"@noble/curves/ed25519.js";import{NETWORK as _n,TEST_NETWORK as Bn,WIF as $n,p2wpkh as Fn}from"@scure/btc-signer";import{pubECDSA as Mn}from"@scure/btc-signer/utils.js";var Do=new E(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Uo=new E(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),jo=new E(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);var Xo=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);import f from"node:fs";import X from"node:os";import u from"node:path";import{fileURLToPath as Q}from"node:url";var Z=u.dirname(Q(import.meta.url)),ni=u.resolve(Z,"../..");function L(){return process.env.ORACLE_FAKE_HOME||X.homedir()}function ee(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function x(){return ee()?process.env.ORACLE_CONFIG_DIR||u.join(L(),".config","oracle"):u.join(L(),".config","oracle")}function te(){return u.join(x(),"desk.json")}function re(){return u.join(x(),"env")}function c({force:t=!1}={}){if(c._done&&!t)return c._result||null;c._done=!0;let o={},r=(n,e)=>{if(e==null)return;let i=String(e).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,o[n]=i))};try{let n=re();if(f.existsSync(n))for(let e of f.readFileSync(n,"utf8").split(/\r?\n/)){let i=e.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let s=i[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),r(i[1],s)}}catch{}try{let n=te();if(f.existsSync(n)){let e=JSON.parse(f.readFileSync(n,"utf8"));e&&typeof e=="object"&&(r("ORACLE_DESK_URL",e.deskUrl||e.dataUrl||e.url),r("ORACLE_DATA_URL",e.dataUrl||e.deskUrl||e.url),r("ORACLE_API_URL",e.apiUrl||e.dataUrl||e.deskUrl),r("ORACLE_PUBLIC_URL",e.publicUrl||e.deskUrl||e.dataUrl),r("ORACLE_EXEC_URL",e.execUrl),r("MAD_DESK_URL",e.deskUrl||e.dataUrl))}}catch{}let a=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return a&&(r("ORACLE_DESK_URL",a),r("ORACLE_DATA_URL",a),r("ORACLE_API_URL",a),r("ORACLE_PUBLIC_URL",a),r("MAD_DESK_URL",a)),c._result=Object.keys(o).length?o:null,c._result}try{c()}catch{}var Ei={name:"receipt",summary:"say whether an on-chain action happened (hash or it did not)",group:"read",usage:"oracle receipt --hash <txid> | oracle receipt --json '<receipt>'",async run(t){let o=t.argv||[],r={},a=o.indexOf("--hash"),n=o.indexOf("--json");if(a>=0)r={transactionHash:o[a+1]};else if(n>=0)try{r=JSON.parse(o[n+1]||"{}")}catch(i){return process.stderr.write(`receipt: bad json: ${i.message}
 `),1}let e=l(r);return o.includes("--quiet")?process.stdout.write(`${JSON.stringify(e)}
 `):e.happened?process.stdout.write(`happened  ${e.hash}
 `):process.stdout.write(`did not happen  ${e.note}
-`),e.happened?0:2}};export{yi as default};
+`),e.happened?0:2}};export{Ei as default};

package/dist/cli/commands/setup.mjs

@@ -1,10 +1,10 @@
 import{spawnSync as Lt}from"node:child_process";import{stdin as b,stdout as Ie}from"node:process";var te=Object.freeze([{key:"telegram",name:"telegram",hermes:["gateway","setup"],required:["TELEGRAM_BOT_TOKEN"],optional:["TELEGRAM_ALLOWED_USERS","TELEGRAM_PROXY"],note:"dms \xB7 groups \xB7 topics"},{key:"discord",name:"discord",hermes:["gateway","setup"],required:["DISCORD_BOT_TOKEN"],optional:["DISCORD_ALLOWED_USERS"],note:"dms \xB7 channels \xB7 threads"},{key:"slack",name:"slack",hermes:["gateway","setup"],required:["SLACK_BOT_TOKEN","SLACK_APP_TOKEN"],optional:["SLACK_ALLOWED_USERS"],note:"socket mode"},{key:"whatsapp",name:"whatsapp",hermes:["whatsapp"],required:[],optional:["WHATSAPP_ALLOWED_USERS","WHATSAPP_MODE"],note:"qr bridge"},{key:"whatsapp-cloud",name:"whatsapp cloud",hermes:["whatsapp-cloud"],required:[],optional:[],note:"business cloud api"},{key:"signal",name:"signal",hermes:["gateway","setup"],required:["SIGNAL_HTTP_URL","SIGNAL_ACCOUNT"],optional:["SIGNAL_ALLOWED_USERS"],note:"signal-cli rest bridge"},{key:"matrix",name:"matrix",hermes:["gateway","setup"],required:["MATRIX_HOMESERVER","MATRIX_ACCESS_TOKEN","MATRIX_USER_ID"],optional:["MATRIX_ALLOWED_USERS"],note:"rooms \xB7 dms"},{key:"mattermost",name:"mattermost",hermes:["gateway","setup"],required:["MATTERMOST_URL","MATTERMOST_TOKEN"],optional:["MATTERMOST_ALLOWED_USERS"],note:"channels \xB7 dms"},{key:"email",name:"email",hermes:["gateway","setup"],required:["EMAIL_ADDRESS","EMAIL_PASSWORD","EMAIL_IMAP_HOST","EMAIL_SMTP_HOST"],optional:[],note:"imap/smtp mailbox"},{key:"bluebubbles",name:"bluebubbles",hermes:["gateway","setup"],required:[],optional:[],note:"imessage via bluebubbles"},{key:"photon",name:"photon",hermes:["photon"],required:["PHOTON_PROJECT_ID","PHOTON_PROJECT_SECRET"],optional:["PHOTON_ALLOWED_USERS","PHOTON_HOME_CHANNEL"],note:"imessage via spectrum (no mac)"},{key:"homeassistant",name:"homeassistant",hermes:["gateway","setup"],required:["HASS_URL","HASS_TOKEN"],optional:[],note:"smart home"},{key:"webhook",name:"webhook",hermes:["gateway","setup"],required:[],optional:[],note:"http ingress"},{key:"api-server",name:"api server",hermes:["gateway","setup"],required:[],optional:[],note:"local http api"},{key:"dingtalk",name:"dingtalk",hermes:["gateway","setup"],required:[],optional:[],note:"dingtalk bot"},{key:"feishu",name:"feishu",hermes:["gateway","setup"],required:[],optional:[],note:"feishu / lark"},{key:"wecom",name:"wecom",hermes:["gateway","setup"],required:[],optional:[],note:"wecom"},{key:"weixin",name:"weixin",hermes:["gateway","setup"],required:[],optional:[],note:"weixin"},{key:"qqbot",name:"qqbot",hermes:["gateway","setup"],required:[],optional:[],note:"qq bot"}]);function ye(e){return String(e||"").trim().toLowerCase().replace(/^\/+/,"").replace(/\s+/g,"-")}function H(){return te.slice()}function j(e){let t=ye(e);if(!t)return null;for(let r of te)if(r.key===t||ye(r.name)===t)return r;return null}function ke({profile:e="oracle",statuses:t={}}={}){let r=["oracle setup","","one oracle. many models. every connected channel.",`profile: ${e}`,"","messaging platforms:",""];for(let o of te){let n=t[o.key]||"unset";r.push(`  ${o.key.padEnd(16)} ${String(n).padEnd(8)}  ${o.note}`)}return r.push(""),r.push("commands:"),r.push("  oracle setup                 this menu"),r.push("  oracle setup messaging       open hermes gateway setup"),r.push("  oracle setup telegram        configure telegram bot token"),r.push("  oracle setup discord         configure discord bot token"),r.push("  oracle setup status          show configured platforms (no secrets)"),r.push("  oracle setup gateway         start/status hermes gateway"),r.push("  /setup                       same menu inside chat"),r.push(""),r.push("notes:"),r.push("  tokens stay in the hermes profile .env on this machine"),r.push("  oracle never prints bot tokens or app secrets"),r.push("  after setup: hermes -p oracle gateway restart"),r.join(`
 `)+`
-`}import E from"node:fs";import Ye from"node:os";import re from"node:path";import N from"node:fs";import He from"node:os";import x from"node:path";import{fileURLToPath as ze}from"node:url";var Be=x.dirname(ze(import.meta.url)),Ht=x.resolve(Be,"../..");function z(){return process.env.ORACLE_FAKE_HOME||He.homedir()}function qe(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function S(){return qe()?process.env.ORACLE_CONFIG_DIR||x.join(z(),".config","oracle"):x.join(z(),".config","oracle")}function We(){return x.join(S(),"desk.json")}function Ve(){return x.join(S(),"env")}function L({force:e=!1}={}){if(L._done&&!e)return L._result||null;L._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=Ve();if(N.existsSync(n))for(let s of N.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=We();if(N.existsSync(n)){let s=JSON.parse(N.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),L._result=Object.keys(t).length?t:null,L._result}try{L()}catch{}function M(){return process.env.HERMES_HOME?x.resolve(process.env.HERMES_HOME):x.join(z(),".hermes")}function A(e){return N.mkdirSync(e,{recursive:!0}),e}var Je=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function B(e="oracle"){return re.join(M(),"profiles",e,".env")}function Ge(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function Se(e="oracle"){let t=B(e);return E.existsSync(t)?Ge(E.readFileSync(t,"utf8")):{}}function ve(e,t,r){if(!t||Je.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let d=new Error(`invalid env key '${t}'`);throw d.code="BAD_KEY",d}if(r==null||String(r).trim()===""){let d=new Error(`empty value for ${t}`);throw d.code="EMPTY",d}let o=B(e);A(re.dirname(o));let n=E.existsSync(o)?E.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let d of s)d.startsWith(`${t}=`)?(i.push(c),a=!0):(d.length||i.length)&&i.push(d);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),E.writeFileSync(o,i.join(`
-`),{mode:384});try{E.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function q(e="oracle"){let t=Se(e),r={};for(let o of H()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:B(e)}}function W(e="oracle"){let{statuses:t}=q(e);return ke({profile:e,statuses:t})}function Ee(e,t,r,o={}){let n=j(t);if(!n){let p=new Error(`unknown platform '${t}'`);throw p.code="UNKNOWN_PLATFORM",p}if(!n.required.length){let p=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw p.code="NEEDS_INTERACTIVE",p}let i=n.required.filter(p=>/(TOKEN|PASSWORD|SECRET)$/i.test(p))[0]||(n.required.length===1?n.required[0]:null);if(!i){let p=new Error(`${n.key} has no single token field; provide each of [${n.required.join(", ")}] explicitly`);throw p.code="NEEDS_EXPLICIT_KEYS",p}let a=new Set([i,...Object.keys(o||{}).filter(p=>o[p]!=null&&String(o[p]).trim())]),c=Se(e),d=n.required.filter(p=>!a.has(p)&&!String(c[p]||"").trim());if(d.length){let p=new Error(`${n.key} also requires [${d.join(", ")}]; pass them explicitly (setup would otherwise be marked ready while unusable)`);throw p.code="MISSING_REQUIRED",p}ve(e,i,r);for(let[p,k]of Object.entries(o||{}))k!=null&&String(k).trim()&&ve(e,p,k);return{platform:n.key,set:n.required,profile:e,path:B(e)}}function Xe(){return re.join(S(),"setup-state.json")}function V(e={}){A(S());let t=Xe(),r={};if(E.existsSync(t))try{r=JSON.parse(E.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:Ye.hostname()};return E.writeFileSync(t,JSON.stringify(o,null,2)+`
-`,{mode:384}),o}import xe from"node:fs";import I from"node:path";var Ze="0.19.0",Qt=`hermes-agent==${Ze}`;var _e="0.12.1",er=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${_e}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${_e}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Qe(){return I.join(S(),"runtime")}function et(){return I.join(Qe(),"venv")}function tt(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return I.join(et(),t,r)}function rt(){return tt("hermes")}function ot(e){let t=process.platform==="win32"&&!I.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(I.delimiter))if(r)for(let o of t){let n=I.join(r,`${e}${o}`);try{if(xe.existsSync(n))return n}catch{}}return null}function Ae(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=rt();if(xe.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=ot("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as nt,randomBytes as se,timingSafeEqual as st}from"node:crypto";import y from"node:fs";import _ from"node:path";import it from"node:readline/promises";import{spawn as at,spawnSync as ct}from"node:child_process";var C=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),ut=12e4;function lt(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function T(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(C))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function F(e){let t=T(e);return{id:t,...C[t]}}function w(e,t={}){if(!y.existsSync(e))return t;try{let r=JSON.parse(y.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${_.basename(e)}`)}}function be(e){A(e),process.platform!=="win32"&&y.chmodSync(e,448)}function O(e,t){be(_.dirname(e));let r=`${e}.${process.pid}.${se(4).toString("hex")}.tmp`;y.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),y.renameSync(r,e),process.platform!=="win32"&&y.chmodSync(e,384)}function pt(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function oe(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function $(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function dt(e={}){let t=e.file||_.join(S(),"oauth.json"),r=e.metadataFile||_.join(_.dirname(t),"oauth-meta.json"),o=e.linksFile||_.join(_.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||ct,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&pt(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function d(m){be(_.dirname(c));let h;for(let u=0;u<400;u+=1)try{h=y.openSync(c,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-y.statSync(c).mtimeMs>3e5&&y.unlinkSync(c)}catch{}await new Promise(f=>setTimeout(f,25))}if(h===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await m()}finally{try{y.closeSync(h)}catch{}try{y.unlinkSync(c)}catch{}}}function p(m,h="oauth"){return["application","oracle","kind",h,"provider",m]}function k(m){if(!y.existsSync(o))return null;let u=w(o,{providers:{}}).providers?.[m];if(!Array.isArray(u))return null;let l=[];for(let f of u)if(_.isAbsolute(String(f||"")))try{let g=w(f,{});if(m==="anthropic-oauth"&&g.claudeAiOauth){let P=$(g.claudeAiOauth);l.push({...P,refreshToken:"",source:"external-access-only"});continue}let v=g.credential_pool&&typeof g.credential_pool=="object"?g.credential_pool:null;if(v){let P=v[m]||v[m.replace(/-oauth$/,"")]||[],Fe=Array.isArray(P)?P:P?[P]:[];for(let ee of Fe)if(!(!ee||typeof ee!="object"))try{let Ke=$(ee);l.push({...Ke,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(f=>!f.expiresAt||f.expiresAt>n()+ut)||l[0]:null}function ge(m){let h=T(m);if(i){let f=s("secret-tool",["lookup",...p(h)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!f.error&&f.status===0&&String(f.stdout||"").trim())try{return $(JSON.parse(String(f.stdout).trim()))}catch{}return k(h)}let l=w(t,{providers:{}}).providers?.[h];if(l)try{return $(l)}catch{}return k(h)}function De(m,h){let u=T(m),l=$(h);if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...p(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected OAuth credential");let v=w(r,{providers:{}});return v.providers||={},v.providers[u]={expiresAt:l.expiresAt,source:l.source},O(r,v),l}let f=w(t,{providers:{}});return f.providers||={},f.providers[u]=l,O(t,f),l}function Ue(m){let h=T(m);if(i){let f=s("secret-tool",["clear",...p(h)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{}});return g.providers&&delete g.providers[h],O(r,g),!f.error&&f.status===0}let u=w(t,{providers:{}}),l=!!u.providers?.[h];return u.providers&&delete u.providers[h],O(t,u),l}function we(m){let h=oe(m);if(i){let u=s("secret-tool",["lookup",...p(h,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(w(t,{apiKeys:{}}).apiKeys?.[h]||"").trim()}function je(m,h){let u=oe(m),l=String(h||"").trim();if(!l)throw new Error("API key is empty");if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} API key`,...p(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected API key");let v=w(r,{providers:{},apiKeys:{}});return v.apiKeys||={},v.apiKeys[u]={configured:!0},O(r,v),!0}let f=w(t,{providers:{},apiKeys:{}});return f.apiKeys||={},f.apiKeys[u]=l,O(t,f),!0}function Ne(m){let h=oe(m);if(i){let f=s("secret-tool",["clear",...p(h,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{},apiKeys:{}});return g.apiKeys&&delete g.apiKeys[h],O(r,g),!f.error&&f.status===0}let u=w(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[h];return u.apiKeys&&delete u.apiKeys[h],O(t,u),l}function Me(){let m={},h={};if(i){let u=w(r,{providers:{},apiKeys:{}});for(let[l,f]of Object.entries(u.providers||{}))m[l]={loggedIn:!!ge(l),expiresAt:Number(f.expiresAt||0),source:String(f.source||"oracle"),storage:a};for(let l of Object.keys(u.apiKeys||{}))h[l]={configured:!!we(l),storage:a}}else{let u=w(t,{providers:{},apiKeys:{}});for(let[l,f]of Object.entries(u.providers||{}))m[l]={loggedIn:!!f?.accessToken,expiresAt:Number(f?.expiresAt||0),source:String(f?.source||"oracle"),storage:a};for(let[l,f]of Object.entries(u.apiKeys||{}))h[l]={configured:!!f,storage:a}}for(let u of Object.keys(C)){if(m[u])continue;let l=k(u);l&&(m[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:a,providers:m,apiKeys:h}}return Object.freeze({file:t,storage:a,get:ge,set:De,remove:Ue,getApiKey:we,setApiKey:je,removeApiKey:Ne,status:Me,withLock:d})}var Oe;function D(){return Oe||=dt(),Oe}function ne(e){return Buffer.from(e).toString("base64url")}function ft(){let e=ne(se(32));return{verifier:e,challenge:ne(nt("sha256").update(e).digest()),state:ne(se(24))}}function ht(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&st(r,o)}function mt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return at(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ie(e){return new URLSearchParams(e).toString()}async function R(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function gt(e){if(e)return String(await e()).trim();let t=it.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function ae(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return $({accessToken:r,refreshToken:o,expiresAt:lt(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function wt(e){let t=C["anthropic-oauth"],r=e.pkce||ft(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await gt(e.inputFn),[i,a]=s.split("#",2);if(!i||!ht(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return ae(await R(c,"Claude OAuth token exchange"),e)}async function yt(e){let t=C["openai-codex"],r=await R(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await R(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ie({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return ae(await R(i,"Codex OAuth token exchange"),e)}function Y(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function kt(e){let t=C["xai-oauth"],r=await R(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");Y(r.authorization_endpoint);let o=Y(r.token_endpoint),n=await R(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ie({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=Y(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let d=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ie({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(d.ok){let k=await R(d,"xAI OAuth token exchange");return ae(k,{...e,discovery:{authorization_endpoint:Y(r.authorization_endpoint),token_endpoint:o}})}let p="";try{p=String((await d.json())?.error||"")}catch{}if(p==="slow_down")await e.sleepFn((i+1)*1e3);else if(p==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${d.status}${p?`, ${p}`:""})`)}throw new Error("xAI device authorization timed out")}async function Te(e,t={}){let r=T(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||mt,output:t.output||(n=>process.stdout.write(`${n}
-`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?wt(o):r==="openai-codex"?yt(o):kt(o)}import X from"node:fs";import ce from"node:path";var vt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","custom","anthropic-oauth","openai-codex","xai-oauth"]);function J(e){return String(e||"").trim()||void 0}function St(e,{required:t=!1}={}){let r=J(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!vt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function Et(e,{required:t=!1}={}){let r=J(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function _t(e){let t=J(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function G({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=St(e),s=Et(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:_t(r)};if(J(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var xt=new Set(["auto","standalone","hermes","remote","arch"]);function At(){return ce.join(S(),"model.json")}function U(e){return String(e||"").trim()||void 0}function Ot(e={}){let t=U(e.backend)?.toLowerCase()||"auto",r=G({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=U(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=U(e.reasoningEffort),i=U(e.computeHost||e.remoteHost),a=U(e.computeUser||e.remoteUser),c=U(e.computePath||e.remotePath);if(!xt.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function Re(e){let t=Ot(e),r=At();A(ce.dirname(r)),process.platform!=="win32"&&X.chmodSync(ce.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return X.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`}import E from"node:fs";import Ye from"node:os";import re from"node:path";import N from"node:fs";import He from"node:os";import _ from"node:path";import{fileURLToPath as ze}from"node:url";var Be=_.dirname(ze(import.meta.url)),Ht=_.resolve(Be,"../..");function z(){return process.env.ORACLE_FAKE_HOME||He.homedir()}function qe(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function S(){return qe()?process.env.ORACLE_CONFIG_DIR||_.join(z(),".config","oracle"):_.join(z(),".config","oracle")}function We(){return _.join(S(),"desk.json")}function Ve(){return _.join(S(),"env")}function L({force:e=!1}={}){if(L._done&&!e)return L._result||null;L._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=Ve();if(N.existsSync(n))for(let s of N.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=We();if(N.existsSync(n)){let s=JSON.parse(N.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),L._result=Object.keys(t).length?t:null,L._result}try{L()}catch{}function M(){return process.env.HERMES_HOME?_.resolve(process.env.HERMES_HOME):_.join(z(),".hermes")}function x(e){return N.mkdirSync(e,{recursive:!0}),e}var Je=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function B(e="oracle"){return re.join(M(),"profiles",e,".env")}function Ge(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function Se(e="oracle"){let t=B(e);return E.existsSync(t)?Ge(E.readFileSync(t,"utf8")):{}}function ve(e,t,r){if(!t||Je.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let d=new Error(`invalid env key '${t}'`);throw d.code="BAD_KEY",d}if(r==null||String(r).trim()===""){let d=new Error(`empty value for ${t}`);throw d.code="EMPTY",d}let o=B(e);x(re.dirname(o));let n=E.existsSync(o)?E.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let d of s)d.startsWith(`${t}=`)?(i.push(c),a=!0):(d.length||i.length)&&i.push(d);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),E.writeFileSync(o,i.join(`
+`),{mode:384});try{E.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function q(e="oracle"){let t=Se(e),r={};for(let o of H()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:B(e)}}function W(e="oracle"){let{statuses:t}=q(e);return ke({profile:e,statuses:t})}function Ee(e,t,r,o={}){let n=j(t);if(!n){let p=new Error(`unknown platform '${t}'`);throw p.code="UNKNOWN_PLATFORM",p}if(!n.required.length){let p=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw p.code="NEEDS_INTERACTIVE",p}let i=n.required.filter(p=>/(TOKEN|PASSWORD|SECRET)$/i.test(p))[0]||(n.required.length===1?n.required[0]:null);if(!i){let p=new Error(`${n.key} has no single token field; provide each of [${n.required.join(", ")}] explicitly`);throw p.code="NEEDS_EXPLICIT_KEYS",p}let a=new Set([i,...Object.keys(o||{}).filter(p=>o[p]!=null&&String(o[p]).trim())]),c=Se(e),d=n.required.filter(p=>!a.has(p)&&!String(c[p]||"").trim());if(d.length){let p=new Error(`${n.key} also requires [${d.join(", ")}]; pass them explicitly (setup would otherwise be marked ready while unusable)`);throw p.code="MISSING_REQUIRED",p}ve(e,i,r);for(let[p,k]of Object.entries(o||{}))k!=null&&String(k).trim()&&ve(e,p,k);return{platform:n.key,set:n.required,profile:e,path:B(e)}}function Xe(){return re.join(S(),"setup-state.json")}function V(e={}){x(S());let t=Xe(),r={};if(E.existsSync(t))try{r=JSON.parse(E.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:Ye.hostname()};return E.writeFileSync(t,JSON.stringify(o,null,2)+`
+`,{mode:384}),o}import _e from"node:fs";import I from"node:path";var Ze="0.19.0",Qt=`hermes-agent==${Ze}`;var Ae="0.12.1",er=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${Ae}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${Ae}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Qe(){return I.join(S(),"runtime")}function et(){return I.join(Qe(),"venv")}function tt(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return I.join(et(),t,r)}function rt(){return tt("hermes")}function ot(e){let t=process.platform==="win32"&&!I.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(I.delimiter))if(r)for(let o of t){let n=I.join(r,`${e}${o}`);try{if(_e.existsSync(n))return n}catch{}}return null}function xe(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=rt();if(_e.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=ot("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as nt,randomBytes as se,timingSafeEqual as st}from"node:crypto";import y from"node:fs";import A from"node:path";import it from"node:readline/promises";import{spawn as at,spawnSync as ct}from"node:child_process";var C=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),ut=12e4;function lt(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function T(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(C))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function F(e){let t=T(e);return{id:t,...C[t]}}function w(e,t={}){if(!y.existsSync(e))return t;try{let r=JSON.parse(y.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${A.basename(e)}`)}}function be(e){x(e),process.platform!=="win32"&&y.chmodSync(e,448)}function O(e,t){be(A.dirname(e));let r=`${e}.${process.pid}.${se(4).toString("hex")}.tmp`;y.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),y.renameSync(r,e),process.platform!=="win32"&&y.chmodSync(e,384)}function pt(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function oe(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function $(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function dt(e={}){let t=e.file||A.join(S(),"oauth.json"),r=e.metadataFile||A.join(A.dirname(t),"oauth-meta.json"),o=e.linksFile||A.join(A.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||ct,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&pt(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function d(m){be(A.dirname(c));let h;for(let u=0;u<400;u+=1)try{h=y.openSync(c,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-y.statSync(c).mtimeMs>3e5&&y.unlinkSync(c)}catch{}await new Promise(f=>setTimeout(f,25))}if(h===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await m()}finally{try{y.closeSync(h)}catch{}try{y.unlinkSync(c)}catch{}}}function p(m,h="oauth"){return["application","oracle","kind",h,"provider",m]}function k(m){if(!y.existsSync(o))return null;let u=w(o,{providers:{}}).providers?.[m];if(!Array.isArray(u))return null;let l=[];for(let f of u)if(A.isAbsolute(String(f||"")))try{let g=w(f,{});if(m==="anthropic-oauth"&&g.claudeAiOauth){let P=$(g.claudeAiOauth);l.push({...P,refreshToken:"",source:"external-access-only"});continue}let v=g.credential_pool&&typeof g.credential_pool=="object"?g.credential_pool:null;if(v){let P=v[m]||v[m.replace(/-oauth$/,"")]||[],Fe=Array.isArray(P)?P:P?[P]:[];for(let ee of Fe)if(!(!ee||typeof ee!="object"))try{let Ke=$(ee);l.push({...Ke,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(f=>!f.expiresAt||f.expiresAt>n()+ut)||l[0]:null}function ge(m){let h=T(m);if(i){let f=s("secret-tool",["lookup",...p(h)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!f.error&&f.status===0&&String(f.stdout||"").trim())try{return $(JSON.parse(String(f.stdout).trim()))}catch{}return k(h)}let l=w(t,{providers:{}}).providers?.[h];if(l)try{return $(l)}catch{}return k(h)}function De(m,h){let u=T(m),l=$(h);if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...p(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected OAuth credential");let v=w(r,{providers:{}});return v.providers||={},v.providers[u]={expiresAt:l.expiresAt,source:l.source},O(r,v),l}let f=w(t,{providers:{}});return f.providers||={},f.providers[u]=l,O(t,f),l}function Ue(m){let h=T(m);if(i){let f=s("secret-tool",["clear",...p(h)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{}});return g.providers&&delete g.providers[h],O(r,g),!f.error&&f.status===0}let u=w(t,{providers:{}}),l=!!u.providers?.[h];return u.providers&&delete u.providers[h],O(t,u),l}function we(m){let h=oe(m);if(i){let u=s("secret-tool",["lookup",...p(h,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(w(t,{apiKeys:{}}).apiKeys?.[h]||"").trim()}function je(m,h){let u=oe(m),l=String(h||"").trim();if(!l)throw new Error("API key is empty");if(i){let g=s("secret-tool",["store",`--label=Oracle ${u} API key`,...p(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(g.error||g.status!==0)throw new Error("OS credential store rejected API key");let v=w(r,{providers:{},apiKeys:{}});return v.apiKeys||={},v.apiKeys[u]={configured:!0},O(r,v),!0}let f=w(t,{providers:{},apiKeys:{}});return f.apiKeys||={},f.apiKeys[u]=l,O(t,f),!0}function Ne(m){let h=oe(m);if(i){let f=s("secret-tool",["clear",...p(h,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),g=w(r,{providers:{},apiKeys:{}});return g.apiKeys&&delete g.apiKeys[h],O(r,g),!f.error&&f.status===0}let u=w(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[h];return u.apiKeys&&delete u.apiKeys[h],O(t,u),l}function Me(){let m={},h={};if(i){let u=w(r,{providers:{},apiKeys:{}});for(let[l,f]of Object.entries(u.providers||{}))m[l]={loggedIn:!!ge(l),expiresAt:Number(f.expiresAt||0),source:String(f.source||"oracle"),storage:a};for(let l of Object.keys(u.apiKeys||{}))h[l]={configured:!!we(l),storage:a}}else{let u=w(t,{providers:{},apiKeys:{}});for(let[l,f]of Object.entries(u.providers||{}))m[l]={loggedIn:!!f?.accessToken,expiresAt:Number(f?.expiresAt||0),source:String(f?.source||"oracle"),storage:a};for(let[l,f]of Object.entries(u.apiKeys||{}))h[l]={configured:!!f,storage:a}}for(let u of Object.keys(C)){if(m[u])continue;let l=k(u);l&&(m[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:a,providers:m,apiKeys:h}}return Object.freeze({file:t,storage:a,get:ge,set:De,remove:Ue,getApiKey:we,setApiKey:je,removeApiKey:Ne,status:Me,withLock:d})}var Oe;function D(){return Oe||=dt(),Oe}function ne(e){return Buffer.from(e).toString("base64url")}function ft(){let e=ne(se(32));return{verifier:e,challenge:ne(nt("sha256").update(e).digest()),state:ne(se(24))}}function ht(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&st(r,o)}function mt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return at(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ie(e){return new URLSearchParams(e).toString()}async function R(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function gt(e){if(e)return String(await e()).trim();let t=it.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function ae(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return $({accessToken:r,refreshToken:o,expiresAt:lt(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function wt(e){let t=C["anthropic-oauth"],r=e.pkce||ft(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await gt(e.inputFn),[i,a]=s.split("#",2);if(!i||!ht(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return ae(await R(c,"Claude OAuth token exchange"),e)}async function yt(e){let t=C["openai-codex"],r=await R(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await R(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ie({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return ae(await R(i,"Codex OAuth token exchange"),e)}function Y(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function kt(e){let t=C["xai-oauth"],r=await R(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");Y(r.authorization_endpoint);let o=Y(r.token_endpoint),n=await R(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ie({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=Y(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let d=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ie({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(d.ok){let k=await R(d,"xAI OAuth token exchange");return ae(k,{...e,discovery:{authorization_endpoint:Y(r.authorization_endpoint),token_endpoint:o}})}let p="";try{p=String((await d.json())?.error||"")}catch{}if(p==="slow_down")await e.sleepFn((i+1)*1e3);else if(p==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${d.status}${p?`, ${p}`:""})`)}throw new Error("xAI device authorization timed out")}async function Te(e,t={}){let r=T(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||mt,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?wt(o):r==="openai-codex"?yt(o):kt(o)}import X from"node:fs";import ce from"node:path";var vt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","custom","anthropic-oauth","openai-codex","xai-oauth"]);function J(e){return String(e||"").trim()||void 0}function St(e,{required:t=!1}={}){let r=J(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!vt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function Et(e,{required:t=!1}={}){let r=J(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function At(e){let t=J(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function G({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=St(e),s=Et(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:At(r)};if(J(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var _t=new Set(["auto","standalone","hermes","remote","arch"]);function xt(){return ce.join(S(),"model.json")}function U(e){return String(e||"").trim()||void 0}function Ot(e={}){let t=U(e.backend)?.toLowerCase()||"auto",r=G({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=U(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=U(e.reasoningEffort),i=U(e.computeHost||e.remoteHost),a=U(e.computeUser||e.remoteUser),c=U(e.computePath||e.remotePath);if(!_t.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function Re(e){let t=Ot(e),r=xt();x(ce.dirname(r)),process.platform!=="win32"&&X.chmodSync(ce.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return X.writeFileSync(o,`${JSON.stringify(t,null,2)}
 `,{mode:384}),X.renameSync(o,r),process.platform!=="win32"&&X.chmodSync(r,384),t}var Pe=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},custom:{model:""}});function ue(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function bt(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function Tt(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
 `)},s=i=>{let a=String(i);for(let c of a){if(c==="\r"||c===`
 `){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function le(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...G({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function Le(e,t,r={}){return Re(le(e,t,r))}function Rt(e){process.stdout.write(`storage: ${e.storage}
@@ -17,7 +17,7 @@ import{spawnSync as Lt}from"node:child_process";import{stdin as b,stdout as Ie}f
 `),0}if(r==="api-key"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(Pe,n))throw new Error(`unsupported API-key provider: ${n}`);let s=ue(t,"--model")||Pe[n].model,i=ue(t,"--base-url");le(n,s,{baseUrl:i});let a=t.includes("--stdin")?await bt():await Tt();return await o.withLock(async()=>{let c=o.getApiKey(n);o.setApiKey(n,a);try{Le(n,s,{baseUrl:i})}catch(d){throw c?o.setApiKey(n,c):o.removeApiKey(n),d}}),process.stdout.write(`${n}: API key configured in ${o.storage}
 `),0}if(r==="logout"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let s=!1;try{s=o.remove(T(n))}catch{}let i=o.removeApiKey(n);if(!s&&!i)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
 `),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};var kr=Object.freeze([["#EAF7FF","    \u2588\u2588\u2588\u2593\u2593\u2593"],["#D8F2FF","  \u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2593\u2592"],["#B8F0FF"," \u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2593\u2593\u2592\u2592"],["#ACDEEF","\u2593\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2591"],["#A5D9EB","\u2593\u2593\u2593\u2593\u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2592\u2591\u2591"],["#9FCBDD"," \u2592\u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2592\u2592\u2591\u2591"],["#91C2D7","  \u2592\u2592\u2592\u2592\u2592\u2592\u2591\u2591\u2591\u2591"],["#60717F","    \u2591\u2591\u2591\u2591\u2591\u2591"]]);var vr=Object.freeze(["   \u2588\u2588\u2588\u2593\u2593"," \u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592","\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592\u2592"," \u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2591","  \u2592\u2592\u2592\u2591\u2591\u2591"]);var Q=Object.freeze([["   \u2588\u2588\u2588\u2593\u2593"," \u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592","\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592\u2592"," \u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2591","  \u2592\u2592\u2592\u2591\u2591\u2591"],["   \u2593\u2588\u2588\u2588\u2593"," \u2592\u2593\u2593\u2588\u2588\u2588\u2588\u2588","\u2592\u2592\u2593\u2593\u2588\u2588\u2588\u2588\u2588\u2588"," \u2591\u2592\u2592\u2593\u2593\u2593\u2593\u2593","  \u2591\u2591\u2592\u2592\u2592\u2592"],["   \u2593\u2593\u2588\u2588\u2588"," \u2592\u2593\u2593\u2593\u2588\u2588\u2588\u2588","\u2592\u2592\u2593\u2593\u2593\u2588\u2588\u2588\u2588\u2588"," \u2591\u2592\u2592\u2592\u2593\u2593\u2593\u2593","  \u2591\u2591\u2591\u2592\u2592\u2592"],["   \u2591\u2592\u2592\u2593\u2593"," \u2591\u2592\u2592\u2593\u2593\u2593\u2593\u2593","\u2591\u2591\u2592\u2592\u2593\u2593\u2588\u2588\u2588\u2588"," \u2593\u2593\u2593\u2588\u2588\u2588\u2588\u2588\u2588","  \u2588\u2588\u2588\u2588\u2588\u2593"]]),Sr=Object.freeze([["#EAF7FF","                                       \u2588\u2588\u2588\u2588"],["#D8F2FF","                                      \u2591\u2591\u2588\u2588\u2588"],["#B8F0FF","  \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588"],["#ACDEEF"," \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588"],["#A5D9EB","\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2591\u2591   \u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2591\u2591  \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#9FCBDD","\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588      \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2591"],["#91C2D7","\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588    \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588"],["#60717F"," \u2591\u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591      \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591\u2591"]]);var pe=Object.freeze([{alias:"claude",label:"Claude",hint:"Anthropic subscription"},{alias:"codex",label:"Codex",hint:"OpenAI subscription"},{alias:"grok",label:"Grok",hint:"xAI subscription"}]),fe=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI"},{id:"anthropic",label:"Anthropic"},{id:"xai",label:"xAI"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"},{id:"nous",label:"Nous"}]),he=Object.freeze([...pe.map((e,t)=>({n:t+1,id:e.alias,label:e.label,kind:"oauth",hint:e.hint})),...fe.map((e,t)=>({n:pe.length+t+1,id:e.id,label:e.label,kind:"api-key",hint:"API key"})),{n:pe.length+fe.length+1,id:"custom",label:"Custom",kind:"api-key",hint:"OpenAI-compatible"}]);function It(e){let t=String(e||"").trim().toLowerCase();if(!t||t==="skip")return{skip:!0};let r=he.find(o=>String(o.n)===t||o.id===t);return r||{unknown:!0,choice:t}}function Ce(e="sign in",t=0){let r=Q[t]||Q[0];return["",`${r[0]}      oracle`,`${r[1]}     ${e}`,r[2],r[3],r[4],""].join(`
+`),1}}};var kr=Object.freeze([["#EAF7FF","     \u2584\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2584"],["#D8F2FF","  \u2584\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2584"],["#B8F0FF"," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#ACDEEF","\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#A5D9EB","\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#9FCBDD","\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#91C2D7","\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#7FA9BE"," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#60717F","  \u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580"],["#4A5A66","     \u2580\u2580\u2580\u2588\u2588\u2588\u2588\u2580\u2580\u2580"]]);var vr=Object.freeze(["   \u2588\u2588\u2588\u2593\u2593"," \u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592","\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592\u2592"," \u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2591","  \u2592\u2592\u2592\u2591\u2591\u2591"]);var Q=Object.freeze([["   \u2588\u2588\u2588\u2593\u2593"," \u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592","\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2593\u2592\u2592"," \u2593\u2593\u2593\u2593\u2592\u2592\u2592\u2591","  \u2592\u2592\u2592\u2591\u2591\u2591"],["   \u2593\u2588\u2588\u2588\u2593"," \u2592\u2593\u2593\u2588\u2588\u2588\u2588\u2588","\u2592\u2592\u2593\u2593\u2588\u2588\u2588\u2588\u2588\u2588"," \u2591\u2592\u2592\u2593\u2593\u2593\u2593\u2593","  \u2591\u2591\u2592\u2592\u2592\u2592"],["   \u2593\u2593\u2588\u2588\u2588"," \u2592\u2593\u2593\u2593\u2588\u2588\u2588\u2588","\u2592\u2592\u2593\u2593\u2593\u2588\u2588\u2588\u2588\u2588"," \u2591\u2592\u2592\u2592\u2593\u2593\u2593\u2593","  \u2591\u2591\u2591\u2592\u2592\u2592"],["   \u2591\u2592\u2592\u2593\u2593"," \u2591\u2592\u2592\u2593\u2593\u2593\u2593\u2593","\u2591\u2591\u2592\u2592\u2593\u2593\u2588\u2588\u2588\u2588"," \u2593\u2593\u2593\u2588\u2588\u2588\u2588\u2588\u2588","  \u2588\u2588\u2588\u2588\u2588\u2593"]]),Sr=Object.freeze([["#EAF7FF","                                       \u2588\u2588\u2588\u2588"],["#D8F2FF","                                      \u2591\u2591\u2588\u2588\u2588"],["#B8F0FF","  \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588"],["#ACDEEF"," \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588"],["#A5D9EB","\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2591\u2591   \u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2591\u2591  \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588"],["#9FCBDD","\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588      \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588\u2588\u2588 \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2591"],["#91C2D7","\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588    \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588"],["#60717F"," \u2591\u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591      \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591  \u2591\u2591\u2591\u2591\u2591\u2591"]]);var pe=Object.freeze([{alias:"claude",label:"Claude",hint:"Anthropic subscription"},{alias:"codex",label:"Codex",hint:"OpenAI subscription"},{alias:"grok",label:"Grok",hint:"xAI subscription"}]),fe=Object.freeze([{id:"openrouter",label:"OpenRouter"},{id:"openai",label:"OpenAI"},{id:"anthropic",label:"Anthropic"},{id:"xai",label:"xAI"},{id:"deepseek",label:"DeepSeek"},{id:"gemini",label:"Gemini"},{id:"kimi",label:"Kimi"},{id:"mistral",label:"Mistral"},{id:"nous",label:"Nous"}]),he=Object.freeze([...pe.map((e,t)=>({n:t+1,id:e.alias,label:e.label,kind:"oauth",hint:e.hint})),...fe.map((e,t)=>({n:pe.length+t+1,id:e.id,label:e.label,kind:"api-key",hint:"API key"})),{n:pe.length+fe.length+1,id:"custom",label:"Custom",kind:"api-key",hint:"OpenAI-compatible"}]);function It(e){let t=String(e||"").trim().toLowerCase();if(!t||t==="skip")return{skip:!0};let r=he.find(o=>String(o.n)===t||o.id===t);return r||{unknown:!0,choice:t}}function Ce(e="sign in",t=0){let r=Q[t]||Q[0];return["",`${r[0]}      oracle`,`${r[1]}     ${e}`,r[2],r[3],r[4],""].join(`
 `)}async function $t(e){if(e.isTTY!==!0||process.env.NODE_TEST_CONTEXT||process.env.ORACLE_INSTALL_PLAIN==="1")return;let t=r=>new Promise(o=>setTimeout(o,r));for(let r=0;r<Q.length;r+=1)r>0&&e.write("\x1B[7A"),e.write(`${Ce("sign in",r)}
 `),await t(90)}async function $r({stdin:e=process.stdin,stdout:t=process.stdout,readLine:r,runAuth:o=n=>Z.run({argv:n})}={}){if(await $t(t),t.write(`${K()}
 `),t.write(`number or name  \xB7  enter skips
@@ -25,7 +25,7 @@ import{spawnSync as Lt}from"node:child_process";import{stdin as b,stdout as Ie}f
 `)||d.includes("\r"))&&(e.off("data",p),c(d.trim()))};e.on("data",p)}),s=It(n);if(s.skip)return{skipped:!0,reason:"skipped"};if(s.unknown)return t.write(`unknown choice '${s.choice}'
 `),{skipped:!0,reason:"unknown"};let i=s.kind==="oauth"?["login",s.id]:["api-key",s.id],a=await o(i);return{skipped:!1,choice:s.id,code:a}}function K(e=D().status()){let t=[Ce("sign in"),"sign in with a subscription",""];for(let r of he.filter(o=>o.kind==="oauth")){let o=F(r.id),n=e.providers?.[o.id]?.loggedIn===!0;t.push(`  ${String(r.n).padStart(2)}  ${r.label.padEnd(12)} ${n?"connected":"OAuth"}`)}t.push("","or use an API key","");for(let r of he.filter(o=>o.kind==="api-key")){let o=r.id==="custom"?!1:e.apiKeys?.[r.id]?.configured===!0;t.push(`  ${String(r.n).padStart(2)}  ${r.label.padEnd(12)} ${o?"configured":"not configured"}`)}return t.push("","Your key stays on this machine. Nothing is uploaded by Oracle.",""),t.join(`
 `)}function de(){return["oracle setup, configure standalone OAuth, messaging, and the local agent surface","","  oracle setup                      menu + platform status","  oracle setup status               same, machine-friendly with --json","  oracle setup model                show Claude, Codex, Grok, OpenRouter, DeepSeek, Nous, ...","  oracle setup model claude         connect Anthropic OAuth + select standalone","  oracle setup model codex          connect OpenAI OAuth + select standalone","  oracle setup model grok           connect xAI OAuth + select standalone","  oracle setup model deepseek       securely add a provider API key","  oracle setup model kimi           securely add a Kimi API key","  oracle setup messaging            open hermes gateway setup wizard","  oracle setup telegram             set TELEGRAM_BOT_TOKEN for profile","  oracle setup discord              set DISCORD_BOT_TOKEN for profile","  oracle setup slack                set slack tokens","  oracle setup <platform>           any supported hermes platform","  oracle setup gateway [status|restart|start|stop]","  oracle setup profile [name]       default: oracle","","chat:","  /setup","  /setup telegram","  /setup status","","model credentials stay in the OS keychain or private ~/.config/oracle storage.","messaging tokens stay local in ~/.hermes/profiles/<profile>/.env","oracle never prints secrets."].join(`
-`)}function Ct(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Dt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function me(e,{inherit:t=!0,env:r=process.env}={}){let o=Ae();if(!o.ok)return process.stderr.write(`oracle setup: Hermes not detected (opt-in only).
+`)}function Ct(e){let t=e.indexOf("--profile");if(t>=0&&e[t+1])return e[t+1];let r=e.indexOf("-p");return r>=0&&e[r+1]?e[r+1]:process.env.ORACLE_PROFILE||"oracle"}function Dt(e){let t=[];for(let r=0;r<e.length;r++){if(e[r]==="--profile"||e[r]==="-p"){r+=1;continue}t.push(e[r])}return t}function me(e,{inherit:t=!0,env:r=process.env}={}){let o=xe();if(!o.ok)return process.stderr.write(`oracle setup: Hermes not detected (opt-in only).
 Native Oracle does not need Hermes.
 To use Hermes messaging/gateway: install Hermes, or run \`oracle bootstrap\`, then retry.
 Detect: oracle harness detect

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-import f from"node:fs";import j from"node:path";import k from"node:fs";import he from"node:os";import E from"node:path";import{fileURLToPath as we}from"node:url";var ge=E.dirname(we(import.meta.url)),wt=E.resolve(ge,"../..");function W(){return process.env.ORACLE_FAKE_HOME||he.homedir()}function ye(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function I(){return ye()?process.env.ORACLE_CONFIG_DIR||E.join(W(),".config","oracle"):E.join(W(),".config","oracle")}function Ee(){return E.join(I(),"desk.json")}function be(){return E.join(I(),"env")}function y({force:e=!1}={}){if(y._done&&!e)return y._result||null;y._done=!0;let n={},t=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=be();if(k.existsSync(i))for(let o of k.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),t(s[1],c)}}catch{}try{let i=Ee();if(k.existsSync(i)){let o=JSON.parse(k.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),y._result=Object.keys(n).length?n:null,y._result}try{y()}catch{}import{createCipheriv as xe,createDecipheriv as Se,randomBytes as N,scryptSync as Ae}from"node:crypto";import a from"node:fs";import m from"node:path";var H="ORACLE-LOCAL-VAULT",J=1,A=Object.freeze({N:1<<17,r:8,p:1}),ve=256*1024*1024,ke=16*1024;function T(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function z(e,n,t=A){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Ae(r,n,32,{...t,maxmem:ve})}function V(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=N(32),o=N(12),s={magic:H,version:J,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},c=z(n,i);try{let d=xe("aes-256-gcm",c,o);d.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([d.update(r),d.final()]);return{...s,ciphertext:u.toString("base64"),tag:d.getAuthTag().toString("base64")}}finally{c.fill(0),r.fill(0)}}function R(e,n){if(e?.magic!==H||e?.version!==J)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!t.includes(p)))throw new Error("local-vault: unexpected vault field");let r=T(e.kdf.salt,32,"salt"),i=T(e.cipher.iv,12,"iv"),o=T(e.tag,16,"tag"),s=T(e.ciphertext,1,"ciphertext",{max:ke}),{ciphertext:c,tag:d,...u}=e,l=z(n,r);try{let p=Se("aes-256-gcm",l,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{l.fill(0)}}function Ie(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function G(e){let n=m.dirname(e),t=a.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=a.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=a.fstatSync(n);if(Ie(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=a.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function B(e){return JSON.parse(w(e))}function K(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),G(e);let t=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${N(6).toString("hex")}.tmp`),r;try{r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(r,JSON.stringify(n,null,2)+`
-`),a.fsyncSync(r),a.closeSync(r),r=void 0;let i=a.openSync(t,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(t,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(r!==void 0)try{a.closeSync(r)}catch{}try{a.unlinkSync(t)}catch{}throw i}return e}function g(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),G(e);let t=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${N(6).toString("hex")}.tmp`);try{let r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(r,String(n)),a.fsyncSync(r)}finally{a.closeSync(r)}a.renameSync(t,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(r){try{a.unlinkSync(t)}catch{}throw r}}import h from"node:path";import nt from"node:os";import{createHash as ot,randomBytes as bi}from"node:crypto";import{Interface as U,keccak256 as Si}from"ethers";import{Transaction as vi}from"@scure/btc-signer";import{ed25519 as Ii}from"@noble/curves/ed25519.js";import{base58 as uo}from"@scure/base";import{Interface as re}from"ethers";import{Interface as Ce,MaxUint256 as er,isAddress as tr,keccak256 as rr,toUtf8Bytes as nr}from"ethers";import{Interface as Oe,isAddress as _t}from"ethers";import{isAddress as Ot}from"ethers";var Mt=new Oe(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Le,isAddress as jt}from"ethers";var zt=new Le(["function approve(address spender,uint256 amount) returns (bool)"]),Vt=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var ur=new Ce(["function approve(address spender,uint256 amount) returns (bool)"]);var dr=300*1e3,fr=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as gr,NETWORK as yr,OutScript as Er,RawTx as br,SigHash as xr,TEST_NETWORK as Sr,Transaction as Ar}from"@scure/btc-signer";import{createHash as Be}from"node:crypto";import{base58 as Tr}from"@scure/base";import{getCompiledTransactionMessageDecoder as Or}from"@solana/transaction-messages";var X=e=>Be("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Lr=new Map([[X("route"),{name:"route",prefixBytes:0}],[X("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var qr=64*1024;var Yr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Xr=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var en="0x"+"00".repeat(32);var Pe=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),an=Object.freeze(Pe.map(e=>e[0]));var Me=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var kn=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var De=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),In=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Tn=new re(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Nn=new re(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),On=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ue=Object.freeze([...Me]),Ln=Object.freeze({...De});import{ed25519 as zn}from"@noble/curves/ed25519.js";import{base58 as Gn}from"@scure/base";import{RawTx as Yn,SigHash as Xn,Transaction as Qn}from"@scure/btc-signer";import{Transaction as eo,keccak256 as to,verifyTypedData as ro}from"ethers";import{encode as Bn}from"@msgpack/msgpack";import{keccak256 as _n,verifyTypedData as Fn}from"ethers";var $n=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),qn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as Je,randomBytes as Po,timingSafeEqual as ze}from"node:crypto";import Ve from"node:fs";import b from"node:path";import{homedir as F}from"node:os";import{join as $}from"node:path";var oe=process.env.ORACLE_PUBLIC_DESKTOP==="1",He=oe?process.env.ORACLE_CONFIG_DIR||$(F(),".config","oracle"):$(F(),".config","oracle"),vo=oe?He:$(F(),".config","mad-desk");var Oo="0".repeat(64),Lo=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var Co=Promise.resolve();function Ge(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=s=>{try{return Ve.realpathSync(s)}catch{return b.resolve(s)}},r=t(b.dirname(b.resolve(e))),i=t(b.dirname(b.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+b.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var q=(e,n)=>Je("sha256",n).update(L(e)).digest("hex"),Ke=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&ze(t,r)};function Ye(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(r,n)}}}function ie(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=w(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Ke(r?.integrity?.mac,q(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function Xe(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=ie(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(r)};o&&(s.ledgerInitialized=!0),g(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:q(s,t)}})+`
-`)}function ae(e,n,t,{sequenceAnchorFile:r}={}){let i=w(n);if(!r)throw new Error("policy: sequence anchor required");let o=ie(r,i);Ge(r,e);let s=Number(o.sequence||0)+1,c=Ye(t,i,{sequence:s});Xe(r,s,i,c?.integrity?.mac??null),g(e,JSON.stringify(c,null,2)+`
-`)}import{Wallet as M}from"ethers";import{base58 as ce}from"@scure/base";import{ed25519 as Qe}from"@noble/curves/ed25519.js";import{NETWORK as ue,TEST_NETWORK as le,WIF as Ze,p2wpkh as se}from"@scure/btc-signer";import{pubECDSA as et}from"@scure/btc-signer/utils.js";var tt=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},rt=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},x=(e,n)=>{if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)};function S(e,n){let t=String(n||"").trim();if(e==="evm")return new M(t).privateKey;if(e==="btc")for(let o of[ue,le])try{return Buffer.from(Ze(o).decode(t))}catch{}if(e==="sol")try{return x(ce.decode(t),"sol")}catch{}let r=tt(t);if(r)return e==="evm"?new M(`0x${r.toString("hex")}`).privateKey:x(r,e);let i=rt(t);if(i)return x(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return x(Uint8Array.from(o),e);let s=o.privateKey??o.secretKey??o.key;if(s)return S(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let t=new M(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=x(n,"btc"),r=et(t);return{kind:e,secret:t.toString("hex"),addresses:[se(r,ue).address,se(r,le).address]}}if(e==="sol"){let t=x(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[ce.encode(Qe.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function D(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=v(o,S(o,r[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function de(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=(e[t].kind==="evm",e[t].secret));return Buffer.from(JSON.stringify(n))}function fe(e){let n={};for(let[t,r]of Object.entries(e))n[t]=r.addresses;return{kind:"multichain",address:null,addresses:n}}var Vi=new U(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Gi=new U(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Ki=new U(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function pe(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(nt.homedir(),".local","state"),"oracle"),t=ot("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${t}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${t}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${t}.lock`)}}import{randomBytes as it}from"node:crypto";import{Wallet as at}from"ethers";var me=`oracle sign init|import|policy|status|lock|doctor
+import f from"node:fs";import V from"node:path";import k from"node:fs";import be from"node:os";import x from"node:path";import{fileURLToPath as Se}from"node:url";var Ae=x.dirname(Se(import.meta.url)),bt=x.resolve(Ae,"../..");function G(){return process.env.ORACLE_FAKE_HOME||be.homedir()}function ve(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function I(){return ve()?process.env.ORACLE_CONFIG_DIR||x.join(G(),".config","oracle"):x.join(G(),".config","oracle")}function ke(){return x.join(I(),"desk.json")}function Ie(){return x.join(I(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=Ie();if(k.existsSync(i))for(let o of k.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),t(s[1],c)}}catch{}try{let i=ke();if(k.existsSync(i)){let o=JSON.parse(k.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}try{E()}catch{}import{createCipheriv as Te,createDecipheriv as Ne,randomBytes as N,scryptSync as Oe}from"node:crypto";import a from"node:fs";import m from"node:path";var K="ORACLE-LOCAL-VAULT",Y=1,A=Object.freeze({N:1<<17,r:8,p:1}),Le=256*1024*1024,Ce=16*1024;function T(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function X(e,n,t=A){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Oe(r,n,32,{...t,maxmem:Le})}function Q(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=N(32),o=N(12),s={magic:K,version:Y,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},c=X(n,i);try{let l=Te("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(s)));let u=Buffer.concat([l.update(r),l.final()]);return{...s,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),r.fill(0)}}function P(e,n){if(e?.magic!==K||e?.version!==Y)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(p=>!["address","addresses","kind","createdAt"].includes(p))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(p=>!t.includes(p)))throw new Error("local-vault: unexpected vault field");let r=T(e.kdf.salt,32,"salt"),i=T(e.cipher.iv,12,"iv"),o=T(e.tag,16,"tag"),s=T(e.ciphertext,1,"ciphertext",{max:Ce}),{ciphertext:c,tag:l,...u}=e,d=X(n,r);try{let p=Ne("aes-256-gcm",d,i);return p.setAAD(Buffer.from(JSON.stringify(u))),p.setAuthTag(o),Buffer.concat([p.update(s),p.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function Be(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function Z(e){let n=m.dirname(e),t=a.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=a.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function w(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=a.fstatSync(n);if(Be(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=a.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function R(e){return JSON.parse(w(e))}function ee(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),Z(e);let t=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${N(6).toString("hex")}.tmp`),r;try{r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(r,JSON.stringify(n,null,2)+`
+`),a.fsyncSync(r),a.closeSync(r),r=void 0;let i=a.openSync(t,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(m.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(t,e),a.chmodSync(e,384);let c=a.openSync(m.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(r!==void 0)try{a.closeSync(r)}catch{}try{a.unlinkSync(t)}catch{}throw i}return e}function y(e,n){a.mkdirSync(m.dirname(e),{recursive:!0,mode:448}),Z(e);let t=m.join(m.dirname(e),`.${m.basename(e)}.${process.pid}.${N(6).toString("hex")}.tmp`);try{let r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(r,String(n)),a.fsyncSync(r)}finally{a.closeSync(r)}a.renameSync(t,e),a.chmodSync(e,384);let i=a.openSync(m.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(r){try{a.unlinkSync(t)}catch{}throw r}}import h from"node:path";import ct from"node:os";import{createHash as ut,randomBytes as ki}from"node:crypto";import{Interface as z,keccak256 as Ti}from"ethers";import{Transaction as Oi}from"@scure/btc-signer";import{ed25519 as Ci}from"@noble/curves/ed25519.js";import{base58 as mo}from"@scure/base";import{Interface as ae}from"ethers";import{Interface as Fe,MaxUint256 as ir,isAddress as ar,keccak256 as sr,toUtf8Bytes as cr}from"ethers";import{Interface as _e,isAddress as Dt}from"ethers";import{isAddress as Rt}from"ethers";var Ht=new _e(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as $e,isAddress as Vt}from"ethers";var Xt=new $e(["function approve(address spender,uint256 amount) returns (bool)"]),Qt=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var mr=new Fe(["function approve(address spender,uint256 amount) returns (bool)"]);var wr=300*1e3,gr=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Sr,NETWORK as Ar,OutScript as vr,RawTx as kr,SigHash as Ir,TEST_NETWORK as Tr,Transaction as Nr}from"@scure/btc-signer";import{createHash as Me}from"node:crypto";import{base58 as Br}from"@scure/base";import{getCompiledTransactionMessageDecoder as Rr}from"@solana/transaction-messages";var te=e=>Me("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),_r=new Map([[te("route"),{name:"route",prefixBytes:0}],[te("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Wr=64*1024;var tn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),rn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var an="0x"+"00".repeat(32);var De=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),dn=Object.freeze(De.map(e=>e[0]));var Je=new Set(["evm","evm-swap","evm-bridge","evm-nft","btc","sol","hl","poly","lighter"]);var On=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0,delegate:0});var ze=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Ln=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Cn=new ae(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Bn=new ae(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Pn=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ve=Object.freeze([...Je]),Rn=Object.freeze({...ze});import{ed25519 as Yn}from"@noble/curves/ed25519.js";import{base58 as Qn}from"@scure/base";import{RawTx as eo,SigHash as to,Transaction as ro}from"@scure/btc-signer";import{Transaction as oo,keccak256 as io,verifyTypedData as ao}from"ethers";import{encode as Fn}from"@msgpack/msgpack";import{keccak256 as Mn,verifyTypedData as Dn}from"ethers";var Un=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),jn=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{createHmac as Xe,randomBytes as qo,timingSafeEqual as Qe}from"node:crypto";import Ze from"node:fs";import b from"node:path";import{homedir as M}from"node:os";import{join as D}from"node:path";var ce=process.env.ORACLE_PUBLIC_DESKTOP==="1",Ye=ce?process.env.ORACLE_CONFIG_DIR||D(M(),".config","oracle"):D(M(),".config","oracle"),No=ce?Ye:D(M(),".config","mad-desk");var Po="0".repeat(64),Ro=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var _o=Promise.resolve();function et(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=s=>{try{return Ze.realpathSync(s)}catch{return b.resolve(s)}},r=t(b.dirname(b.resolve(e))),i=t(b.dirname(b.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+b.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var U=(e,n)=>Xe("sha256",n).update(L(e)).digest("hex"),tt=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&Qe(t,r)};function rt(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:U(r,n)}}}function ue(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=w(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!tt(r?.integrity?.mac,U(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function nt(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=ue(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(r)};o&&(s.ledgerInitialized=!0),y(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:U(s,t)}})+`
+`)}function le(e,n,t,{sequenceAnchorFile:r}={}){let i=w(n);if(!r)throw new Error("policy: sequence anchor required");let o=ue(r,i);et(r,e);let s=Number(o.sequence||0)+1,c=rt(t,i,{sequence:s});nt(r,s,i,c?.integrity?.mac??null),y(e,JSON.stringify(c,null,2)+`
+`)}import{Wallet as j}from"ethers";import{base58 as W}from"@scure/base";import{ed25519 as me}from"@noble/curves/ed25519.js";import{NETWORK as he,TEST_NETWORK as we,WIF as ot,p2wpkh as de}from"@scure/btc-signer";import{pubECDSA as it}from"@scure/btc-signer/utils.js";var C=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},at=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},fe=e=>{let n=String(e||"").trim();try{let t=Buffer.from(W.decode(n));return W.encode(t)===n?t:null}catch{return null}},H=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(me.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},pe=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),g=(e,n)=>{if(n==="sol")return H(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},st=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return g(t,n)};function S(e,n){let t=String(n||"").trim();if(e==="evm")return new j(t).privateKey;if(e==="btc")for(let o of[he,we])try{return Buffer.from(ot(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let u=C(t.slice(4));if(!u)throw new Error("sol: invalid explicit hex private key");return g(u,"sol")}if(/^base58:/i.test(t)){let u=fe(t.slice(7));if(!pe(u))throw new Error("sol: invalid explicit base58 private key");return H(u)}if(/^0x/i.test(t)){let u=C(t);if(!u)throw new Error("sol: invalid explicit hex private key");return g(u,"sol")}let o=C(t),s=o&&(o.length===32||o.length===64)?g(o,"sol"):null,c=fe(t),l=pe(c);if(s&&l&&!s.equals(l))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(l)return H(c);if(o)return g(o,"sol")}let r=C(t);if(r)return e==="evm"?new j(`0x${r.toString("hex")}`).privateKey:g(r,e);let i=at(t);if(i)return g(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return st(o,e);let s=o.privateKey??o.secretKey??o.key;if(s)return S(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let t=new j(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=g(n,"btc"),r=it(t);return{kind:e,secret:t.toString("hex"),addresses:[de(r,he).address,de(r,we).address]}}if(e==="sol"){let t=g(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[W.encode(me.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function J(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=v(o,S(o,r[o])));if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ge(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return Buffer.from(JSON.stringify(n))}function ye(e){let n={};for(let[t,r]of Object.entries(e))n[t]=r.addresses;return{kind:"multichain",address:null,addresses:n}}var Qi=new z(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Zi=new z(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),ea=new z(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ee(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||h.join(process.env.XDG_STATE_HOME||h.join(ct.homedir(),".local","state"),"oracle"),t=ut("sha256").update(h.resolve(e)).digest("hex").slice(0,16);return{vault:h.join(e,"vault.json"),policy:h.join(e,"signer-policy.json"),policyKey:h.join(e,"policy-integrity-key"),policyAnchor:h.join(n,`signer-policy-${t}.high-water`),ledger:h.join(e,"signer-ledger.json"),ledgerAnchor:h.join(n,`signer-ledger-${t}.high-water`),token:h.join(e,"signer-token"),lock:h.join(n,`signer-${t}.lock`)}}import{randomBytes as lt}from"node:crypto";import{Wallet as dt}from"ethers";var xe=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -11,14 +11,14 @@ import f from"node:fs";import j from"node:path";import k from"node:fs";import he
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,C=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},st=e=>{let n=String(C(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function ct(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=c=>{for(let d of c){if(d===3){s(),r(new Error("cancelled"));return}if(d===13||d===10){s(),process.stderr.write(`
-`),t(i);return}d===127?i=i.slice(0,-1):i+=String.fromCharCode(d)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function ut(e,n){let t=C(e,"--passphrase-file");return t?w(t):ct("Vault passphrase: ",n)}function lt(e){return e.addresses.join(", ")}async function dt(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||I(),o=pe(j.join(i,"signer"));if(!r||r==="help")return t.write(me+`
+They are never accepted as argument values or inherited environment variables.`,B=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},ft=e=>{let n=String(B(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function pt(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=c=>{for(let l of c){if(l===3){s(),r(new Error("cancelled"));return}if(l===13||l===10){s(),process.stderr.write(`
+`),t(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},s=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function mt(e,n){let t=B(e,"--passphrase-file");return t?w(t):pt("Vault passphrase: ",n)}function ht(e){return e.addresses.join(", ")}async function wt(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||I(),o=Ee(V.join(i,"signer"));if(!r||r==="help")return t.write(xe+`
 `),0;if(r==="status")return t.write(JSON.stringify({initialized:f.existsSync(o.vault),policyConfigured:f.existsSync(o.policy),armed:f.existsSync(o.vault)&&!f.existsSync(o.lock),disarmed:f.existsSync(o.lock)})+`
-`),0;if(r==="lock")return f.mkdirSync(j.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
+`),0;if(r==="lock")return f.mkdirSync(V.dirname(o.lock),{recursive:!0,mode:448}),y(o.lock,`locked
 `),t.write(`Local signer locked.
 `),0;if(r==="doctor"){let u=[];return f.existsSync(o.vault)||u.push("vault missing"),f.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),t.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
-`),u.length?1:0}if(r==="policy"){if(!f.existsSync(o.vault)||!f.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=C(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let l;try{l=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(l[p])||l[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return ae(o.policy,o.policyKey,l,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(r!=="init"&&r!=="import")throw new Error(`unknown subcommand '${r}'`);let s=await ut(e,n),c={};if(f.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let u=B(o.vault),l=R(u,s);try{c=D(l,u.meta)}finally{l.fill(0)}}if(r==="init"){let u=at.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=st(e),l=C(e,"--key-file");if(!l)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,w(l)))}f.mkdirSync(j.dirname(o.vault),{recursive:!0,mode:448}),K(o.vault,V(de(c),s,fe(c))),f.existsSync(o.policyKey)||g(o.policyKey,it(32).toString("hex")+`
-`);let d=Object.entries(c).map(([u,l])=>`${u}:${lt(l)}`).join(" ");return t.write(`Encrypted local vault initialized for ${d}. Configure sealed policy rails before starting a signer session.
-`),0}var aa={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:me,run:e=>dt(e.argv||[])};export{aa as default,dt as run};
+`),u.length?1:0}if(r==="policy"){if(!f.existsSync(o.vault)||!f.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=B(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let d;try{d=JSON.parse(w(u))}catch{throw new Error("policy file must contain valid JSON")}for(let p of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(d[p])||d[p].length===0)throw new Error(`policy: ${p} allowlist is empty`);return le(o.policy,o.policyKey,d,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(r!=="init"&&r!=="import")throw new Error(`unknown subcommand '${r}'`);let s=await mt(e,n),c={};if(f.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let u=R(o.vault),d=P(u,s);try{c=J(d,u.meta)}finally{d.fill(0)}}if(r==="init"){let u=dt.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=ft(e),d=B(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,w(d)))}f.mkdirSync(V.dirname(o.vault),{recursive:!0,mode:448}),ee(o.vault,Q(ge(c),s,ye(c))),f.existsSync(o.policyKey)||y(o.policyKey,lt(32).toString("hex")+`
+`);let l=Object.entries(c).map(([u,d])=>`${u}:${ht(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
+`),0}var da={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:xe,run:e=>wt(e.argv||[])};export{da as default,wt as run};