@oracle-agent/oracle 0.35.20 → 0.35.22

package/dist/cli/commands/safety-intelligence.mjs

@@ -0,0 +1,4 @@
+import{createHash as se}from"node:crypto";import{getAddress as oe,wordlists as ie}from"ethers";import{address as ae}from"@solana/addresses";import{base58check as ce,bech32 as W,bech32m as de}from"@scure/base";import{sha256 as le}from"@noble/hashes/sha2.js";var V=1,tt=Object.freeze({CLEAR:"CLEAR",UNKNOWN:"UNKNOWN",REVIEW:"REVIEW",BLOCK:"BLOCK"}),fe=Object.freeze(["sanctions","phishing","scam","address-poisoning"]),ye=Object.freeze(["sanctions","phishing","scam"]),he=new Set(fe),ge=128,me=256,S=512,we=4096,Ee=8,ue=2048,q=366*24*60*60*1e3,Ce=6e4,be=ce(le),Te=["privatekey","privkey","secretkey","secret","seedphrase","seed","mnemonic","passphrase","password","keystore","keymaterial","wif","xprv","xpriv","apikey","bearer","authorization","credential"],pe=/\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b/,ke=/\bxprv[0-9A-Za-z]{50,}\b/,Ie=/^\s*(?:0x)?[0-9a-fA-F]{64}\s*$/,ve=new Set([12,15,18,21,24]),Ae=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/,Ne=/^\d+$/,Se=String(Number.MAX_SAFE_INTEGER).length,Oe=new Set(["txhash","transactionhash","recordid","hash","digest","evidenceid","sourcerecordid","blockhash","receipthash","commithash","payloadhash","sha256","sha256hex","id"]),xe=Object.freeze({CLEAR:"CLEAR",NO_MATCH:"CLEAR",NOT_LISTED:"CLEAR",ABSENT:"CLEAR",REVIEW:"REVIEW",SUSPECTED:"REVIEW",POSSIBLE_MATCH:"REVIEW",INCONCLUSIVE:"REVIEW",BLOCK:"BLOCK",MATCH:"BLOCK",LISTED:"BLOCK",MALICIOUS:"BLOCK",PHISHING:"BLOCK",SCAM:"BLOCK",UNKNOWN:"UNKNOWN",UNAVAILABLE:"UNKNOWN",ERROR:"UNKNOWN"}),M=Object.freeze({BLOCK:0,REVIEW:1,UNKNOWN:2,INFO:3});function P(e){return String(e).replace(/[^a-z0-9]/gi,"").toLowerCase()}function Re(e){let t=P(e);return Te.some(r=>t.includes(r))}function $e(e){return Oe.has(P(e))}function _e(e){let t=String(e).trim().toLowerCase().split(/\s+/).filter(Boolean);return ve.has(t.length)&&t.every(r=>ie.en.getWordIndex(r)>=0)}function p(e){let t=new WeakSet,r=0;function s(n,o,a,d=""){if(r+=1,r>we)throw new RangeError("safety-intelligence: input is too large");if(a>Ee)throw new RangeError("safety-intelligence: input is too deep");if(n==null||typeof n=="boolean")return;if(typeof n=="string"){if(n.length>ue)throw new RangeError(`safety-intelligence: string too long at ${o}`);if(pe.test(n)||ke.test(n)||_e(n))throw new TypeError(`safety-intelligence: key material refused at ${o}`);if(Ie.test(n)&&!$e(d))throw new TypeError(`safety-intelligence: key material refused at ${o}`);return}if(typeof n=="number"){if(!Number.isFinite(n))throw new TypeError(`safety-intelligence: finite number required at ${o}`);return}if(typeof n=="bigint")return;if(typeof n!="object")throw new TypeError(`safety-intelligence: JSON-like input required at ${o}`);if(ArrayBuffer.isView(n)||n instanceof ArrayBuffer)throw new TypeError(`safety-intelligence: binary key material refused at ${o}`);if(t.has(n))throw new TypeError(`safety-intelligence: cyclic input refused at ${o}`);if(t.add(n),Array.isArray(n)){if(n.length>S)throw new RangeError(`safety-intelligence: array too large at ${o}`);if(n.length===64&&n.every(c=>Number.isInteger(c)&&c>=0&&c<=255))throw new TypeError(`safety-intelligence: key material refused at ${o}`);n.forEach((c,f)=>s(c,`${o}[${f}]`,a+1,d)),t.delete(n);return}if(Object.getPrototypeOf(n)!==Object.prototype)throw new TypeError(`safety-intelligence: plain object required at ${o}`);let y=Reflect.ownKeys(n).filter(c=>typeof c=="string");if(y.length>64)throw new RangeError(`safety-intelligence: too many fields at ${o}`);for(let c of y){if(Re(c))throw new TypeError(`safety-intelligence: secret-bearing field refused at ${o}.${c}`);let f=Object.getOwnPropertyDescriptor(n,c),m=f&&"get"in f&&typeof f.get=="function"?f.get.call(n):n[c];m!==void 0&&s(m,`${o}.${c}`,a+1,c)}t.delete(n)}return s(e,"$",0),e}function w(e,t,r){for(let s of Object.keys(e||{}))if(!t.has(s))throw new TypeError(`safety-intelligence: unknown ${r} field ${s}`)}function k(e,t,r,{required:s=!1}={}){if(e==null||e===""){if(s)throw new TypeError(`safety-intelligence: ${t} required`);return null}let n=String(e).trim();if(!n&&s)throw new TypeError(`safety-intelligence: ${t} required`);if(n.length>r)throw new RangeError(`safety-intelligence: ${t} exceeds ${r} characters`);if(/[\u0000-\u001f\u007f\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff]/i.test(n))throw new TypeError(`safety-intelligence: control or invisible characters refused in ${t}`);return n||null}function O(e,t){if(e==null||e==="")throw new TypeError(`safety-intelligence: ${t} required`);let r;if(typeof e=="number"){if(!Number.isSafeInteger(e)||e<0)throw new TypeError(`safety-intelligence: ${t} must be a safe integer millisecond timestamp`);r=e}else if(typeof e=="string"){let s=e.trim();if(Ne.test(s)&&s.length<=Se){if(r=Number(s),!Number.isSafeInteger(r))throw new TypeError(`safety-intelligence: ${t} must be a safe integer millisecond timestamp`)}else if(Ae.test(s)){if(r=Date.parse(s),!Number.isFinite(r)||new Date(r).toISOString().replace(/\.000Z$/,"Z")!==s&&new Date(r).toISOString()!==s)throw new TypeError(`safety-intelligence: ${t} must be a canonical ISO timestamp`)}else throw new TypeError(`safety-intelligence: ${t} must be a canonical ISO timestamp or integer milliseconds`)}else throw new TypeError(`safety-intelligence: ${t} must be a timestamp`);if(!Number.isFinite(r))throw new TypeError(`safety-intelligence: ${t} must be a valid timestamp`);return{ms:r,iso:new Date(r).toISOString()}}function H(e,t){return e==null||e===""?null:O(e,t)}function F(e){let t=String(e||"").trim().toLowerCase();if(t==="evm"||t==="eip155")return"evm";if(t==="solana")return"solana";if(t==="bitcoin"||t==="bip122"||t==="btc")return"bitcoin";throw new TypeError("safety-intelligence: chain family must be evm, solana, or bitcoin")}function J(e){p(e);let t,r;if(Number.isInteger(e))t="evm",r=e;else if(typeof e=="string"){let o=e.trim();if(/^\d+$/.test(o))t="evm",r=Number(o);else{let a=/^(eip155|evm|solana|bitcoin|bip122|btc):([^:]+)$/i.exec(o);if(!a)throw new TypeError("safety-intelligence: chain must include a supported family");t=F(a[1]),r=a[2]}}else if(e&&typeof e=="object"&&!Array.isArray(e))w(e,new Set(["family","namespace","chainId","reference","network","key"]),"chain"),t=F(e.family??e.namespace??(e.chainId!=null?"evm":"")),r=t==="evm"?e.chainId??e.reference:e.network??e.reference;else throw new TypeError("safety-intelligence: chain required");if(t==="evm"){let o=typeof r=="string"&&/^\d+$/.test(r)?Number(r):r;if(!Number.isSafeInteger(o)||o<=0)throw new TypeError("safety-intelligence: EVM chainId must be a positive safe integer");return g({family:t,namespace:"eip155",reference:String(o),chainId:o,key:`eip155:${o}`})}let s=k(r,`${t} network`,80,{required:!0}).toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(s))throw new TypeError(`safety-intelligence: invalid ${t} network`);let n=t==="bitcoin"?"bip122":"solana";return g({family:t,namespace:n,reference:s,network:s,key:`${n}:${s}`})}function Le(e){let t=String(e).toLowerCase();return["mainnet","main","bitcoin"].includes(t)?"mainnet":["testnet","testnet3","test","signet"].includes(t)?"testnet":t==="regtest"?"regtest":"unknown"}function Be(e,t){let r=k(e,"bitcoin address",100,{required:!0}),s=Le(t.reference);if(/^(bc1|tb1|bcrt1)/i.test(r)){if(r!==r.toLowerCase()&&r!==r.toUpperCase())throw new TypeError("safety-intelligence: mixed-case Bitcoin bech32 address refused");let a=r.toLowerCase(),d,y;try{d=W.decode(a,100),y="bech32"}catch{try{d=de.decode(a,100),y="bech32m"}catch{throw new TypeError("safety-intelligence: invalid Bitcoin bech32 checksum")}}let c=d.words[0],f;try{f=W.fromWords(d.words.slice(1))}catch{throw new TypeError("safety-intelligence: invalid Bitcoin witness program")}if(!Number.isInteger(c)||c<0||c>16||f.length<2||f.length>40)throw new TypeError("safety-intelligence: invalid Bitcoin witness program");if(c===0&&(y!=="bech32"||![20,32].includes(f.length)))throw new TypeError("safety-intelligence: invalid v0 Bitcoin witness address");if(c>0&&y!=="bech32m")throw new TypeError("safety-intelligence: v1+ Bitcoin witness address must use bech32m");let m=s==="mainnet"?"bc":s==="testnet"?"tb":s==="regtest"?"bcrt":null;if(m&&d.prefix!==m)throw new TypeError(`safety-intelligence: Bitcoin address does not match ${t.reference}`);return{canonical:a,display:a}}let n;try{n=be.decode(r)}catch{throw new TypeError("safety-intelligence: invalid Bitcoin base58check address")}if(n.length!==21)throw new TypeError("safety-intelligence: invalid Bitcoin address payload");let o=n[0];if(s==="mainnet"&&![0,5].includes(o))throw new TypeError("safety-intelligence: Bitcoin address does not match mainnet");if((s==="testnet"||s==="regtest")&&![111,196].includes(o))throw new TypeError(`safety-intelligence: Bitcoin address does not match ${t.reference}`);return{canonical:r,display:r}}function Ue(e,t){let r=J(t);p(e);let s=k(e,`${r.family} address`,128,{required:!0});if(r.family==="evm"){let n=s.startsWith("0X")?`0x${s.slice(2)}`:s,o;try{o=oe(n)}catch{throw new TypeError("safety-intelligence: invalid EVM address or mixed-case checksum")}return g({canonical:o.toLowerCase(),display:o})}if(r.family==="solana"){let n;try{n=String(ae(s))}catch{throw new TypeError("safety-intelligence: invalid Solana address")}return g({canonical:n,display:n})}return g(Be(s,r))}function I(e={}){if(p(e),!e||typeof e!="object"||Array.isArray(e))throw new TypeError("safety-intelligence: target object required");w(e,new Set(["chain","chainId","family","network","address","displayAddress","key"]),"target");let t=e.chain??(e.chainId!=null?{family:e.family??"evm",chainId:e.chainId}:{family:e.family,network:e.network}),r=J(t),s=Ue(e.address,r);return g({chain:r,address:s.canonical,displayAddress:s.display,key:`${r.key}:${s.canonical}`})}function T(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(T).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${T(e[t])}`).join(",")}}`}function L(e){return se("sha256").update(e).digest("hex")}function g(e){if(!e||typeof e!="object"||Object.isFrozen(e))return e;for(let t of Object.values(e))g(t);return Object.freeze(e)}function $(e){let t=String(e||"").trim().toLowerCase().replace(/_/g,"-"),s={sanction:"sanctions",sanctions:"sanctions",phishing:"phishing",scam:"scam",fraud:"scam",poisoning:"address-poisoning","address-poisoning":"address-poisoning"}[t];if(!s||!he.has(s))throw new TypeError(`safety-intelligence: unsupported evidence kind ${String(e||"<missing>")}`);return s}function Ke(e){let t=e.verdict??e.disposition??e.result??e.status;if(t==null){for(let n of["match","listed","malicious"])if(typeof e[n]=="boolean"){t=e[n]?"MATCH":"NO_MATCH";break}}let r=String(t||"").trim().toUpperCase().replace(/[ -]+/g,"_"),s=xe[r];if(!s)throw new TypeError(`safety-intelligence: unsupported evidence verdict ${String(t||"<missing>")}`);return s}function je(e,t){let r=e.target??(e.address!=null?{address:e.address,chain:e.chain,chainId:e.chainId,family:e.family,network:e.network}:null);if(!r){if(!t)throw new TypeError("safety-intelligence: evidence target required");return t}return I(r)}function De(e={},t={}){if(p({input:e,options:t}),!e||typeof e!="object"||Array.isArray(e))throw new TypeError("safety-intelligence: evidence object required");w(e,new Set(["kind","type","category","source","sourceRecordId","recordId","reference","verdict","disposition","result","status","match","listed","malicious","confidence","fetchedAt","expiresAt","expiry","ttlMs","summary","target","address","chain","chainId","family","network"]),"evidence"),w(t,new Set(["target","asOf"]),"evidence option");let r=je(e,t.target?I(t.target):null),s=$(e.kind??e.type??e.category),n=Ke(e),o=e.source&&typeof e.source=="object"?e.source.name??e.source.id:e.source,a=k(o,"evidence source",120,{required:!0}),d=Number(e.confidence);if(!Number.isFinite(d)||d<0||d>1)throw new TypeError("safety-intelligence: evidence confidence must be between 0 and 1");let y=O(e.fetchedAt,"evidence fetchedAt"),c=H(e.expiresAt??e.expiry,"evidence expiresAt");if(!c&&e.ttlMs!=null){let i=Number(e.ttlMs);if(!Number.isSafeInteger(i)||i<=0||i>q)throw new RangeError(`safety-intelligence: evidence ttlMs must be 1..${q}`);c={ms:y.ms+i,iso:new Date(y.ms+i).toISOString()}}if(!c)throw new TypeError("safety-intelligence: evidence expiresAt or ttlMs required");if(c.ms<=y.ms)throw new TypeError("safety-intelligence: evidence expiry must be after fetchedAt");if(t.asOf==null)throw new TypeError("safety-intelligence: explicit asOf required for deterministic freshness");let f=O(t.asOf,"asOf").ms,m=y.ms>f+Ce?"FUTURE":c.ms<=f?"STALE":"CURRENT",u=k(e.sourceRecordId??e.recordId??e.reference,"source record id",160),l=k(e.summary,"evidence summary",500),h={kind:s,verdict:n,source:a,...u?{sourceRecordId:u}:{},fetchedAt:y.iso,expiresAt:c.iso,confidence:d,freshness:m,target:r.key,...l?{summary:l}:{}},v=`safety-evidence:${L(T(h))}`;return g({id:v,...h})}function We(e=[],t={}){if(p({records:e,options:t}),!Array.isArray(e))throw new TypeError("safety-intelligence: evidence must be an array");let r=t.maxEvidence??ge;if(!Number.isSafeInteger(r)||r<=0||r>S)throw new RangeError("safety-intelligence: invalid maxEvidence");if(e.length>r)throw new RangeError(`safety-intelligence: evidence exceeds ${r} records`);w(t,new Set(["target","asOf","maxEvidence"]),"evidence-set option");let s={target:t.target,asOf:t.asOf},n=new Map(e.map(o=>{let a=De(o,s);return[a.id,a]}));return g([...n.values()].sort((o,a)=>o.id.localeCompare(a.id)))}function Ve(e,t,r){if(!e||typeof e!="object"||Array.isArray(e))throw new TypeError(`safety-intelligence: knownContacts[${r}] must be an object`);w(e,new Set(["id","label","address","chain","chainId","family","network"]),"contact");let s=I({address:e.address,chain:e.chain??(e.chainId!=null?{family:e.family??"evm",chainId:e.chainId}:e.family||e.network?{family:e.family,network:e.network}:t)}),n=k(e.id,"contact id",120),o=k(e.label,"contact label",120);return g({...n?{id:n}:{},...o?{label:o}:{},target:s})}function x(e,t){if(typeof e=="number"&&(!Number.isSafeInteger(e)||e<0))throw new TypeError(`safety-intelligence: ${t} must be an exact non-negative integer`);let r=typeof e=="bigint"?e.toString():String(e??"").trim();if(!/^\d+$/.test(r)||r.length>100)throw new TypeError(`safety-intelligence: ${t} must be a bounded base-unit integer`);return BigInt(r).toString()}function qe(e,t,r){if(!e||typeof e!="object"||Array.isArray(e))throw new TypeError(`safety-intelligence: observations[${r}] must be an object`);w(e,new Set(["address","counterparty","from","direction","amountBaseUnits","chain","chainId","family","network","observedAt"]),"observation");let s=e.counterparty??e.address??e.from,n=I({address:s,chain:e.chain??(e.chainId!=null?{family:e.family??"evm",chainId:e.chainId}:e.family||e.network?{family:e.family,network:e.network}:t)}),o=String(e.direction??(e.from!=null?"inbound":"unknown")).toLowerCase(),a=["inbound","received","receive"].includes(o)?"inbound":["outbound","sent","send"].includes(o)?"outbound":"unknown",d=x(e.amountBaseUnits,`observations[${r}].amountBaseUnits`),y=H(e.observedAt,`observations[${r}].observedAt`)?.iso??null;return g({target:n,direction:a,amountBaseUnits:d,...y?{observedAt:y}:{}})}function Me(e,t){let r=0;for(;r<e.length&&r<t.length&&e[r]===t[r];)r+=1;return r}function Fe(e,t){let r=0;for(;r<e.length&&r<t.length&&e[e.length-1-r]===t[t.length-1-r];)r+=1;return r}function z(e){return e.chain.family==="evm"?e.address.slice(2):e.address}function b(e){return g({code:e.code,severity:e.severity,category:e.category,basis:e.basis,message:e.message,...e.evidenceIds?.length?{evidenceIds:[...e.evidenceIds].sort()}:{},...e.relatedTargets?.length?{relatedTargets:[...e.relatedTargets].sort()}:{}})}function _(e){let t=new Map;for(let r of e){let s=T(r);t.set(s,r)}return[...t.values()].sort((r,s)=>(M[r.severity]??9)-(M[s.severity]??9)||r.category.localeCompare(s.category)||r.code.localeCompare(s.code)||T(r).localeCompare(T(s)))}function ze(e={},t={}){if(p({input:e,options:t}),!e||typeof e!="object"||Array.isArray(e))throw new TypeError("safety-intelligence: poisoning input object required");w(e,new Set(["target","address","chain","chainId","family","network","knownContacts","expectedContact","observations","dustThresholdBaseUnits","lookalikeEdgeChars"]),"poisoning input"),w(t,new Set(["maxContacts","maxObservations"]),"poisoning option");let r=I(e.target??{address:e.address,chain:e.chain,chainId:e.chainId,family:e.family,network:e.network}),s=e.knownContacts??[],n=e.observations??[];if(!Array.isArray(s))throw new TypeError("safety-intelligence: knownContacts must be an array");if(!Array.isArray(n))throw new TypeError("safety-intelligence: observations must be an array");let o=t.maxContacts??me,a=t.maxObservations??S;if(!Number.isSafeInteger(o)||o<=0||o>S)throw new RangeError("safety-intelligence: invalid maxContacts");if(!Number.isSafeInteger(a)||a<=0||a>S)throw new RangeError("safety-intelligence: invalid maxObservations");if(s.length>o)throw new RangeError(`safety-intelligence: knownContacts exceeds ${o}`);if(n.length>a)throw new RangeError(`safety-intelligence: observations exceeds ${a}`);let d=s.map((l,h)=>Ve(l,r.chain,h)).sort((l,h)=>l.target.key.localeCompare(h.target.key)||String(l.id||l.label||"").localeCompare(String(h.id||h.label||""))),y=n.map((l,h)=>qe(l,r.chain,h)).sort((l,h)=>T(l).localeCompare(T(h))),c=d.filter(l=>l.target.chain.key===r.chain.key),f=c.filter(l=>l.target.address===r.address),m=[],u=null;if(e.expectedContact!=null){if(typeof e.expectedContact=="string")u=I({chain:r.chain,address:e.expectedContact});else if(typeof e.expectedContact=="object"&&!Array.isArray(e.expectedContact))w(e.expectedContact,new Set(["address","chain","chainId","family","network"]),"expectedContact"),u=I({address:e.expectedContact.address,chain:e.expectedContact.chain??(e.expectedContact.chainId!=null?{family:e.expectedContact.family??"evm",chainId:e.expectedContact.chainId}:e.expectedContact.family||e.expectedContact.network?{family:e.expectedContact.family,network:e.expectedContact.network}:r.chain)});else throw new TypeError("safety-intelligence: expectedContact must be an address or target object");u.key!==r.key&&m.push(b({code:"EXPECTED_CONTACT_MISMATCH",severity:"REVIEW",category:"address-poisoning",basis:"contact-match",message:"Destination does not exactly match the caller-supplied expected contact.",relatedTargets:[u.key,r.key]}))}if(f.length===0){let l=Number(e.lookalikeEdgeChars??4);if(!Number.isSafeInteger(l)||l<3||l>12)throw new RangeError("safety-intelligence: lookalikeEdgeChars must be 3..12");let h=z(r);for(let v of c){let i=z(v.target),E=Me(h,i),N=Fe(h,i);E>=l&&N>=l&&h!==i&&m.push(b({code:"ADDRESS_LOOKALIKE",severity:"REVIEW",category:"address-poisoning",basis:"heuristic",message:`Destination shares at least ${l} leading and trailing characters with a different known contact.`,relatedTargets:[v.target.key,r.key]}))}if(e.dustThresholdBaseUnits!=null){let v=BigInt(x(e.dustThresholdBaseUnits,"dustThresholdBaseUnits"));y.filter(E=>E.target.key===r.key&&E.direction==="inbound"&&BigInt(E.amountBaseUnits)<=v).length>0&&m.push(b({code:"PRIOR_DUST_CONTACT",severity:"REVIEW",category:"address-poisoning",basis:"heuristic",message:"Destination appeared as an inbound counterparty at or below the caller-supplied base-unit dust threshold.",relatedTargets:[r.key]}))}}return g({target:r,exactKnownContact:f.length>0,exactContacts:f,findings:_(m),dustThresholdBaseUnits:e.dustThresholdBaseUnits==null?null:x(e.dustThresholdBaseUnits,"dustThresholdBaseUnits")})}function Pe(e){let t=e??ye;if(!Array.isArray(t)||t.length===0||t.length>32)throw new TypeError("safety-intelligence: requiredChecks must be a non-empty bounded array");let r=t.map((n,o)=>{if(typeof n=="string")return{kind:$(n),source:null};if(!n||typeof n!="object"||Array.isArray(n))throw new TypeError(`safety-intelligence: requiredChecks[${o}] must be a kind or object`);return w(n,new Set(["kind","source"]),"required check"),{kind:$(n.kind),source:k(n.source,"required check source",120,{required:!0})}}),s=new Map(r.map(n=>[`${n.kind}:${n.source||"*"}`,n]));return g([...s.values()].sort((n,o)=>`${n.kind}:${n.source||"*"}`.localeCompare(`${o.kind}:${o.source||"*"}`)))}function He(e,t){return e.filter(r=>r.kind===t.kind&&(!t.source||r.source===t.source))}function Je(e){return e.some(t=>t.severity==="BLOCK")?"BLOCK":e.some(t=>t.severity==="REVIEW")?"REVIEW":e.some(t=>t.severity==="UNKNOWN")?"UNKNOWN":"CLEAR"}function X(e){return p(e),`sha256:${L(T(e))}`}function B(e={},t={}){if(p({input:e,options:t}),!e||typeof e!="object"||Array.isArray(e))throw new TypeError("safety-intelligence: evaluation input object required");if(w(e,new Set(["target","address","chain","chainId","family","network","evidence","requiredChecks","knownContacts","expectedContact","observations","dustThresholdBaseUnits","lookalikeEdgeChars"]),"evaluation input"),w(t,new Set(["asOf","minClearConfidence","minBlockConfidence","maxEvidence","maxContacts","maxObservations"]),"evaluation option"),t.asOf==null)throw new TypeError("safety-intelligence: explicit asOf required for deterministic evaluation");let r=O(t.asOf,"asOf").iso,s=e.target??{address:e.address,chain:e.chain,chainId:e.chainId,family:e.family,network:e.network},n=I(s),o=Number(t.minClearConfidence??.8),a=Number(t.minBlockConfidence??.8);for(let[i,E]of[["minClearConfidence",o],["minBlockConfidence",a]])if(!Number.isFinite(E)||E<0||E>1)throw new TypeError(`safety-intelligence: ${i} must be between 0 and 1`);let d=We(e.evidence??[],{target:n,asOf:r,maxEvidence:t.maxEvidence}),y=d.filter(i=>i.target===n.key),c=Pe(e.requiredChecks),f=[];for(let i of y)i.freshness==="CURRENT"&&i.verdict==="BLOCK"?f.push(b({code:i.confidence>=a?"CURRENT_EXPLICIT_BLOCK":"LOW_CONFIDENCE_BLOCK_SIGNAL",severity:i.confidence>=a?"BLOCK":"REVIEW",category:i.kind,basis:"explicit-evidence",message:i.confidence>=a?"A current injected source returned an explicit BLOCK disposition.":"A current injected source returned BLOCK below the configured block-confidence threshold.",evidenceIds:[i.id]})):i.freshness==="CURRENT"&&i.verdict==="REVIEW"?f.push(b({code:"CURRENT_EXPLICIT_REVIEW",severity:"REVIEW",category:i.kind,basis:"explicit-evidence",message:"A current injected source returned an explicit REVIEW disposition.",evidenceIds:[i.id]})):i.freshness!=="CURRENT"&&["BLOCK","REVIEW"].includes(i.verdict)?f.push(b({code:i.freshness==="FUTURE"?"FUTURE_POSITIVE_EVIDENCE":"STALE_POSITIVE_EVIDENCE",severity:"REVIEW",category:i.kind,basis:"explicit-evidence",message:"Non-current injected adverse evidence requires human review; it is not treated as a current fact.",evidenceIds:[i.id]})):i.freshness==="CURRENT"&&i.verdict==="UNKNOWN"&&f.push(b({code:"SOURCE_UNKNOWN",severity:"UNKNOWN",category:i.kind,basis:"explicit-evidence",message:"A current injected source could not determine a disposition.",evidenceIds:[i.id]}));for(let i of c){let E=He(y,i),N=E.filter(C=>C.freshness==="CURRENT"),R=N.filter(C=>C.verdict==="CLEAR"&&C.confidence>=o),j=N.filter(C=>C.verdict==="BLOCK");if(R.length>0&&j.length>0&&f.push(b({code:"CONTRADICTORY_EVIDENCE",severity:"REVIEW",category:i.kind,basis:"explicit-evidence",message:"Current injected sources conflict for a required check.",evidenceIds:[...R,...j].map(C=>C.id)})),R.length===0){let C=N.filter(A=>A.verdict==="CLEAR"),D=E.filter(A=>A.verdict==="CLEAR"&&A.freshness!=="CURRENT"),ne=i.source?`${i.kind} from ${i.source}`:i.kind;f.push(b({code:C.length>0?"CLEAR_CONFIDENCE_TOO_LOW":D.length>0?"STALE_CLEAR_EVIDENCE":"MISSING_CURRENT_EVIDENCE",severity:"UNKNOWN",category:i.kind,basis:"coverage",message:`Required check ${ne} lacks current explicit CLEAR evidence at the configured confidence threshold.`,evidenceIds:[...C,...D].map(A=>A.id)}))}}let m=ze({target:n,knownContacts:e.knownContacts??[],expectedContact:e.expectedContact,observations:e.observations??[],dustThresholdBaseUnits:e.dustThresholdBaseUnits,lookalikeEdgeChars:e.lookalikeEdgeChars},{maxContacts:t.maxContacts,maxObservations:t.maxObservations});f.push(...m.findings);let u=_(f),l=Je(u);l==="CLEAR"&&(u=_([b({code:"REQUIRED_EVIDENCE_CURRENT_CLEAR",severity:"INFO",category:"coverage",basis:"explicit-evidence",message:"Every required injected check supplied current explicit CLEAR evidence; this is source-scoped and not a safety guarantee.",evidenceIds:y.filter(i=>i.freshness==="CURRENT"&&i.verdict==="CLEAR").map(i=>i.id)})]),l="CLEAR");let h={version:V,target:n.key,evaluatedAt:r,decision:l,gate:l==="CLEAR"?"CONTINUE":l==="BLOCK"?"BLOCK":"HOLD",requiredChecks:c,evidenceIds:y.map(i=>i.id).sort(),findings:u},v=g({...h,hash:X(h)});return g({version:V,target:n,evaluatedAt:r,status:l,evidence:d,requiredChecks:c,poisoning:m,policy:v})}function Xe(e={}){if(p(e),!e||typeof e!="object"||Array.isArray(e))throw new TypeError("safety-intelligence: transaction object required");w(e,new Set(["target","to","destination","address","chain","chainId","family","network","amountBaseUnits","valueBaseUnits"]),"transaction");let t=I(e.target??{address:e.to??e.destination??e.address,chain:e.chain,chainId:e.chainId,family:e.family,network:e.network}),r=e.amountBaseUnits??e.valueBaseUnits,s=r==null?null:x(r,"transaction amountBaseUnits"),n={target:t,amountBaseUnits:s};return g({id:`safety-transaction:${L(T(n))}`,...n})}function G(e={},t={}){if(p({input:e,options:t}),!e||typeof e!="object"||Array.isArray(e))throw new TypeError("safety-intelligence: transaction evaluation input object required");w(e,new Set(["transaction","evidence","requiredChecks","knownContacts","expectedContact","observations","dustThresholdBaseUnits","lookalikeEdgeChars"]),"transaction evaluation input");let r=Xe(e.transaction),s=B({target:r.target,evidence:e.evidence??[],requiredChecks:e.requiredChecks,knownContacts:e.knownContacts??[],expectedContact:e.expectedContact,observations:e.observations??[],dustThresholdBaseUnits:e.dustThresholdBaseUnits,lookalikeEdgeChars:e.lookalikeEdgeChars},t),{hash:n,...o}=s.policy,a={...o,transactionId:r.id},d=g({...a,hash:X(a)});return g({...s,transaction:r,policy:d})}import Y from"node:fs";var Z=1024*1024;function Q(e=[],t={}){let r=[],s={};for(let n=0;n<e.length;n+=1){let o=e[n];if(!o.startsWith("--")){r.push(o);continue}let a=o.indexOf("="),d=o.slice(2,a===-1?void 0:a),y=t[d];if(!y)throw new TypeError(`unknown option --${d}`);if(Object.hasOwn(s,d))throw new TypeError(`duplicate option --${d}`);if(y==="boolean"){if(a!==-1)throw new TypeError(`option --${d} does not take a value`);s[d]=!0;continue}let c=a===-1?e[++n]:o.slice(a+1);if(c==null||c===""||c.startsWith("--"))throw new TypeError(`option --${d} requires a value`);s[d]=c}return{positionals:r,options:s}}function ee(e,t="input"){if(!e)throw new TypeError(`${t} JSON path or - is required`);let r=e==="-"?Y.readFileSync(0):Y.readFileSync(e);if(r.length>Z)throw new RangeError(`${t} exceeds ${Z} bytes`);let s;try{s=JSON.parse(r.toString("utf8"))}catch(n){throw new TypeError(`${t} must be valid JSON: ${n.message}`)}if(!s||typeof s!="object"||Array.isArray(s)||Object.getPrototypeOf(s)!==Object.prototype)throw new TypeError(`${t} must be a JSON object`);return s}function U(e,t){if(e==null)return;let r=Number(e);if(!Number.isFinite(r)||r<0||r>1)throw new TypeError(`${t} must be between 0 and 1`);return r}function te(e,t=process.stdout){t.write(`${JSON.stringify(e,null,2)}
+`)}function re(e,t=process.stderr){return t.write(`oracle: ${e instanceof Error?e.message:String(e)}
+`),2}var K="oracle safety-intelligence <address|transaction> <input.json|-> --as-of <timestamp> [--min-clear-confidence <0..1>] [--min-block-confidence <0..1>]",at={name:"safety-intelligence",summary:"evaluate supplied address or transaction safety evidence",group:"read",usage:K,async run(e){let t=e.argv??[];if(t.length===0||t.includes("--help")||t.includes("-h"))return process.stdout.write(`${K}
+`),0;try{let{positionals:r,options:s}=Q(t,{"as-of":"value","min-clear-confidence":"value","min-block-confidence":"value"});if(r.length!==2||!["address","transaction"].includes(r[0])||!s["as-of"])throw new TypeError(K);let n=ee(r[1]),o={asOf:s["as-of"],minClearConfidence:U(s["min-clear-confidence"],"min clear confidence"),minBlockConfidence:U(s["min-block-confidence"],"min block confidence")},a=r[0]==="transaction"?G(n,o):B(n,o);return te(a),0}catch(r){return re(r)}}};export{at as default};

package/dist/cli/commands/sign.mjs

@@ -1,5 +1,5 @@
 var ze=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import T from"node:fs";import We from"node:os";import b from"node:path";import{fileURLToPath as Ue}from"node:url";function oe(){return process.env.ORACLE_FAKE_HOME||We.homedir()}function Je(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function N(){return Je()?process.env.ORACLE_CONFIG_DIR||b.join(oe(),".config","oracle"):b.join(oe(),".config","oracle")}function Ke(){return b.join(N(),"desk.json")}function Ge(){return b.join(N(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let s=String(o).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,n[i]=s))};try{let i=Ge();if(T.existsSync(i))for(let o of T.readFileSync(i,"utf8").split(/\r?\n/)){let s=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),t(s[1],c)}}catch{}try{let i=Ke();if(T.existsSync(i)){let o=JSON.parse(T.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var Ve,Ar,ie=ze(()=>{Ve=b.dirname(Ue(import.meta.url)),Ar=b.resolve(Ve,"../..");try{E()}catch{}});ie();import m from"node:fs";import ne from"node:path";import{createCipheriv as Ye,createDecipheriv as Xe,randomBytes as _,scryptSync as Ze}from"node:crypto";import a from"node:fs";import w from"node:path";var se="ORACLE-LOCAL-VAULT",ae=1,A=Object.freeze({N:1<<17,r:8,p:1}),Qe=256*1024*1024,et=16*1024;function C(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function ce(e,n,t=A){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Ze(r,n,32,{...t,maxmem:Qe})}function le(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=_(32),o=_(12),s={magic:se,version:ae,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},c=ce(n,i);try{let u=Ye("aes-256-gcm",c,o);u.setAAD(Buffer.from(JSON.stringify(s)));let l=Buffer.concat([u.update(r),u.final()]);return{...s,ciphertext:l.toString("base64"),tag:u.getAuthTag().toString("base64")}}finally{c.fill(0),r.fill(0)}}function F(e,n){if(e?.magic!==se||e?.version!==ae)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(d=>!["address","addresses","kind","createdAt"].includes(d))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(d=>!t.includes(d)))throw new Error("local-vault: unexpected vault field");let r=C(e.kdf.salt,32,"salt"),i=C(e.cipher.iv,12,"iv"),o=C(e.tag,16,"tag"),s=C(e.ciphertext,1,"ciphertext",{max:et}),{ciphertext:c,tag:u,...l}=e,f=ce(n,r);try{let d=Xe("aes-256-gcm",f,i);return d.setAAD(Buffer.from(JSON.stringify(l))),d.setAuthTag(o),Buffer.concat([d.update(s),d.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function tt(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function ue(e){let n=w.dirname(e),t=a.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=a.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=a.openSync(e,a.constants.O_RDONLY|a.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=a.fstatSync(n);if(tt(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=a.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return a.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{a.closeSync(n)}}function q(e){return JSON.parse(h(e))}function de(e,n){a.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),ue(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${_(6).toString("hex")}.tmp`),r;try{r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384),a.writeFileSync(r,JSON.stringify(n,null,2)+`
-`),a.fsyncSync(r),a.closeSync(r),r=void 0;let i=a.openSync(t,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(w.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(t,e),a.chmodSync(e,384);let c=a.openSync(w.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(r!==void 0)try{a.closeSync(r)}catch{}try{a.unlinkSync(t)}catch{}throw i}return e}function y(e,n){a.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),ue(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${_(6).toString("hex")}.tmp`);try{let r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(r,String(n)),a.fsyncSync(r)}finally{a.closeSync(r)}a.renameSync(t,e),a.chmodSync(e,384);let i=a.openSync(w.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(r){try{a.unlinkSync(t)}catch{}throw r}}import p from"node:path";import lr from"node:os";import{createHash as ur,randomBytes as au}from"node:crypto";import{Interface as re,keccak256 as lu}from"ethers";import{Transaction as du}from"@scure/btc-signer";import{ed25519 as pu}from"@noble/curves/ed25519.js";import{base58 as Gi}from"@scure/base";import{Interface as ge}from"ethers";import{Interface as st,MaxUint256 as cn,isAddress as ln,keccak256 as un,toUtf8Bytes as dn}from"ethers";import{Interface as ot,isAddress as Hr}from"ethers";import{isAddress as Br}from"ethers";var Vr=new ot(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as it,isAddress as Gr}from"ethers";var Qr=new it(["function approve(address spender,uint256 amount) returns (bool)"]),en=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var gn=new st(["function approve(address spender,uint256 amount) returns (bool)"]);var En=300*1e3,bn=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as kn,NETWORK as In,OutScript as On,RawTx as Tn,SigHash as Nn,TEST_NETWORK as Cn,Transaction as _n}from"@scure/btc-signer";import{createHash as at}from"node:crypto";import{base58 as Pn}from"@scure/base";import{getCompiledTransactionMessageDecoder as Dn}from"@solana/transaction-messages";var fe=e=>at("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Fn=new Map([[fe("route"),{name:"route",prefixBytes:0}],[fe("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Vn=64*1024;var no=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),oo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var ao="0x"+"00".repeat(32);var lt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),po=Object.freeze(lt.map(e=>e[0]));import{TypedDataEncoder as Wo,getAddress as Uo}from"ethers";import{TypedDataEncoder as yo,getAddress as Eo,isAddress as bo}from"ethers";var dt=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),ft=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as _o,getAddress as Ro,isAddress as $o}from"ethers";var Ao=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var pt=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),Mo=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var mt=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),jo=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var Ko=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var bt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var di=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var xt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),fi=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),pi=new ge(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),mi=new ge(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),wi=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var St=Object.freeze([...bt]),hi=Object.freeze({...xt});import{ed25519 as Ri}from"@noble/curves/ed25519.js";import{base58 as Li}from"@scure/base";import{RawTx as Bi,SigHash as Di,Transaction as Fi}from"@scure/btc-signer";import{Transaction as Mi,keccak256 as ji,verifyTypedData as Hi}from"ethers";import{encode as Ei}from"@msgpack/msgpack";import{keccak256 as xi,verifyTypedData as Si}from"ethers";var Ai=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),vi=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{wordlists as fs}from"ethers";import{wordlists as cs}from"ethers";var Ee=64*1024;var ms=32*1024;var Ot=["schemaVersion","buildVersion","recordType","execution","custody"],gs=[...Ot,"recordHash"];var ys=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Tt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Te=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),As=new Set(Te);var Lt=64*1024*1024;var Cs=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),_s=Object.freeze(["read","simulate"]);var Rs=1440*60;var js=Object.freeze(["privkey","wif","xprv","seed"]);var Hs=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),zs=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var K=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Js=Object.freeze(Object.fromEntries(K.map((e,n)=>[e,Object.freeze(n+1<K.length?[K[n+1]]:[])])));var Pt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var Dt=Object.freeze(["owner","operator","agent","viewer"]),Ft=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry"]),qt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),_a=Object.freeze(["owner"]),Ra=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),$a=new Set(Dt),La=new Set(Ft),Pa=new Set(Object.values(qt));var Mt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read"])}),Ba=Object.freeze(Object.fromEntries(Object.entries(Mt).map(([e,n])=>[e,Object.freeze([...n])])));var jt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),Ht=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),zt=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Ma=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),ja=new Set(jt),Ha=new Set(Ht),za=new Set(zt);var Wa=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Ua=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var Xa=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var nc=32*1024*1024;var ic=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as Ut,randomBytes as Ec,timingSafeEqual as Vt}from"node:crypto";import Jt from"node:fs";import x from"node:path";import{homedir as G}from"node:os";import{join as Y}from"node:path";var Ne=process.env.ORACLE_PUBLIC_DESKTOP==="1",Wt=Ne?process.env.ORACLE_CONFIG_DIR||Y(G(),".config","oracle"):Y(G(),".config","oracle"),lc=Ne?Wt:Y(G(),".config","mad-desk");var mc="0".repeat(64),wc=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var hc=Promise.resolve();function Kt(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=s=>{try{return Jt.realpathSync(s)}catch{return x.resolve(s)}},r=t(x.dirname(x.resolve(e))),i=t(x.dirname(x.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+x.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var X=(e,n)=>Ut("sha256",n).update(L(e)).digest("hex"),Gt=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&Vt(t,r)};function Yt(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:X(r,n)}}}function Ce(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Gt(r?.integrity?.mac,X(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function Xt(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Ce(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(r)};o&&(s.ledgerInitialized=!0),y(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:X(s,t)}})+`
+`),a.fsyncSync(r),a.closeSync(r),r=void 0;let i=a.openSync(t,a.constants.O_RDONLY|a.constants.O_NOFOLLOW),o;try{o=a.fstatSync(i)}finally{a.closeSync(i)}let s=a.lstatSync(w.dirname(e));if(o.nlink!==1||o.dev!==s.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");a.renameSync(t,e),a.chmodSync(e,384);let c=a.openSync(w.dirname(e),"r");try{a.fsyncSync(c)}finally{a.closeSync(c)}}catch(i){if(r!==void 0)try{a.closeSync(r)}catch{}try{a.unlinkSync(t)}catch{}throw i}return e}function y(e,n){a.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),ue(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${_(6).toString("hex")}.tmp`);try{let r=a.openSync(t,a.constants.O_CREAT|a.constants.O_EXCL|a.constants.O_WRONLY|a.constants.O_NOFOLLOW,384);try{a.writeFileSync(r,String(n)),a.fsyncSync(r)}finally{a.closeSync(r)}a.renameSync(t,e),a.chmodSync(e,384);let i=a.openSync(w.dirname(e),"r");try{a.fsyncSync(i)}finally{a.closeSync(i)}}catch(r){try{a.unlinkSync(t)}catch{}throw r}}import p from"node:path";import lr from"node:os";import{createHash as ur,randomBytes as au}from"node:crypto";import{Interface as re,keccak256 as lu}from"ethers";import{Transaction as du}from"@scure/btc-signer";import{ed25519 as pu}from"@noble/curves/ed25519.js";import{base58 as Gi}from"@scure/base";import{Interface as ge}from"ethers";import{Interface as st,MaxUint256 as cn,isAddress as ln,keccak256 as un,toUtf8Bytes as dn}from"ethers";import{Interface as ot,isAddress as Hr}from"ethers";import{isAddress as Br}from"ethers";var Vr=new ot(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as it,isAddress as Gr}from"ethers";var Qr=new it(["function approve(address spender,uint256 amount) returns (bool)"]),en=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var gn=new st(["function approve(address spender,uint256 amount) returns (bool)"]);var En=300*1e3,bn=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as kn,NETWORK as In,OutScript as On,RawTx as Tn,SigHash as Nn,TEST_NETWORK as Cn,Transaction as _n}from"@scure/btc-signer";import{createHash as at}from"node:crypto";import{base58 as Pn}from"@scure/base";import{getCompiledTransactionMessageDecoder as Dn}from"@solana/transaction-messages";var fe=e=>at("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Fn=new Map([[fe("route"),{name:"route",prefixBytes:0}],[fe("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Vn=64*1024;var no=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),oo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var ao="0x"+"00".repeat(32);var lt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),po=Object.freeze(lt.map(e=>e[0]));import{TypedDataEncoder as Wo,getAddress as Uo}from"ethers";import{TypedDataEncoder as yo,getAddress as Eo,isAddress as bo}from"ethers";var dt=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),ft=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as _o,getAddress as Ro,isAddress as $o}from"ethers";var Ao=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var pt=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),Mo=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var mt=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),jo=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var Ko=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var bt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var di=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var xt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),fi=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),pi=new ge(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),mi=new ge(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),wi=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var St=Object.freeze([...bt]),hi=Object.freeze({...xt});import{ed25519 as Ri}from"@noble/curves/ed25519.js";import{base58 as Li}from"@scure/base";import{RawTx as Bi,SigHash as Di,Transaction as Fi}from"@scure/btc-signer";import{Transaction as Mi,keccak256 as ji,verifyTypedData as Hi}from"ethers";import{encode as Ei}from"@msgpack/msgpack";import{keccak256 as xi,verifyTypedData as Si}from"ethers";var Ai=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),vi=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{wordlists as fs}from"ethers";import{wordlists as cs}from"ethers";var Ee=64*1024;var ms=32*1024;var Ot=["schemaVersion","buildVersion","recordType","execution","custody"],gs=[...Ot,"recordHash"];var ys=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Tt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Te=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),As=new Set(Te);var Lt=64*1024*1024;var Cs=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),_s=Object.freeze(["read","simulate"]);var Rs=1440*60;var js=Object.freeze(["privkey","wif","xprv","seed"]);var Hs=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),zs=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var K=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Js=Object.freeze(Object.fromEntries(K.map((e,n)=>[e,Object.freeze(n+1<K.length?[K[n+1]]:[])])));var Pt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var Dt=Object.freeze(["owner","operator","agent","viewer"]),Ft=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),qt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),_a=Object.freeze(["owner"]),Ra=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),$a=new Set(Dt),La=new Set(Ft),Pa=new Set(Object.values(qt));var Mt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),Ba=Object.freeze(Object.fromEntries(Object.entries(Mt).map(([e,n])=>[e,Object.freeze([...n])])));var jt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),Ht=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),zt=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Ma=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),ja=new Set(jt),Ha=new Set(Ht),za=new Set(zt);var Wa=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Ua=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var Xa=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var nc=32*1024*1024;var ic=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as Ut,randomBytes as Ec,timingSafeEqual as Vt}from"node:crypto";import Jt from"node:fs";import x from"node:path";import{homedir as G}from"node:os";import{join as Y}from"node:path";var Ne=process.env.ORACLE_PUBLIC_DESKTOP==="1",Wt=Ne?process.env.ORACLE_CONFIG_DIR||Y(G(),".config","oracle"):Y(G(),".config","oracle"),lc=Ne?Wt:Y(G(),".config","mad-desk");var mc="0".repeat(64),wc=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var hc=Promise.resolve();function Kt(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=s=>{try{return Jt.realpathSync(s)}catch{return x.resolve(s)}},r=t(x.dirname(x.resolve(e))),i=t(x.dirname(x.resolve(n))),o=(s,c)=>c===s||c.startsWith(s+x.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var X=(e,n)=>Ut("sha256",n).update(L(e)).digest("hex"),Gt=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&Vt(t,r)};function Yt(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:X(r,n)}}}function Ce(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Gt(r?.integrity?.mac,X(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function Xt(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=Ce(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let s={policySequence:Number(n),policyMac:String(r)};o&&(s.ledgerInitialized=!0),y(e,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:X(s,t)}})+`
 `)}function _e(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=Ce(r,i);Kt(r,e);let s=Number(o.sequence||0)+1,c=Yt(t,i,{sequence:s});Xt(r,s,i,c?.integrity?.mac??null),y(e,JSON.stringify(c,null,2)+`
 `)}import{readFileSync as Cc,readdirSync as _c,existsSync as Zt}from"node:fs";import{dirname as Qt,join as k}from"node:path";import{fileURLToPath as er}from"node:url";var I=Qt(er(import.meta.url));function tr(){let e=[k(I,"descriptors"),k(I,"clear-sign","descriptors"),k(I,"..","clear-sign","descriptors"),k(I,"..","..","clear-sign","descriptors"),k(I,"..","..","..","clear-sign","descriptors")];for(let n of e)if(Zt(n))return n;return e[0]}var Pc=tr();var Bc=(1n<<256n)-1n;import{Wallet as Z}from"ethers";import{base58 as Q}from"@scure/base";import{ed25519 as Pe}from"@noble/curves/ed25519.js";import{NETWORK as Be,TEST_NETWORK as De,WIF as rr,p2wpkh as Re}from"@scure/btc-signer";import{pubECDSA as nr}from"@scure/btc-signer/utils.js";var P=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},or=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},$e=e=>{let n=String(e||"").trim();try{let t=Buffer.from(Q.decode(n));return Q.encode(t)===n?t:null}catch{return null}},ee=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(Pe.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},Le=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),g=(e,n)=>{if(n==="sol")return ee(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},ir=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return g(t,n)};function S(e,n){let t=String(n||"").trim();if(e==="evm")return new Z(t).privateKey;if(e==="btc")for(let o of[Be,De])try{return Buffer.from(rr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let l=P(t.slice(4));if(!l)throw new Error("sol: invalid explicit hex private key");return g(l,"sol")}if(/^base58:/i.test(t)){let l=$e(t.slice(7));if(!Le(l))throw new Error("sol: invalid explicit base58 private key");return ee(l)}if(/^0x/i.test(t)){let l=P(t);if(!l)throw new Error("sol: invalid explicit hex private key");return g(l,"sol")}let o=P(t),s=o&&(o.length===32||o.length===64)?g(o,"sol"):null,c=$e(t),u=Le(c);if(s&&u&&!s.equals(u))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(u)return ee(c);if(o)return g(o,"sol")}let r=P(t);if(r)return e==="evm"?new Z(`0x${r.toString("hex")}`).privateKey:g(r,e);let i=or(t);if(i)return g(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return ir(o,e);let s=o.privateKey??o.secretKey??o.key;if(s)return S(e,Array.isArray(s)?JSON.stringify(s):String(s))}throw new Error(`${e}: unsupported private key format`)}function O(e,n){if(e==="evm"){let t=new Z(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=g(n,"btc"),r=nr(t);return{kind:e,secret:t.toString("hex"),addresses:[Re(r,Be).address,Re(r,De).address]}}if(e==="sol"){let t=g(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[Q.encode(Pe.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function te(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:O(n.kind||"evm",S(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=O(o,S(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,s]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!s||typeof s!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(s.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(s.accountId||""))throw new Error("local-vault: cex credential binding invalid");let c=(l,f=!0)=>{let d=s[l];if(!(!f&&d===void 0)){if(!Array.isArray(d)||d.length<4||d.some(D=>!Number.isInteger(D)||D<0||D>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(d)}},u=s.apiSecretEncoding;if(u!==(s.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:s.venue,accountId:s.accountId,apiKeyBytes:c("apiKeyBytes"),apiSecretBytes:c("apiSecretBytes"),apiSecretEncoding:u,passphraseBytes:c("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function Fe(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function qe(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var Xc=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),Zc=Object.freeze(["binance","bybit","okx","coinbase"]),Qc=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),el=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),tl=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),rl=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),nl=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),ol=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),il=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),sl=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),al=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var cr=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Me=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var gl=256*1024;var zu=new re(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Wu=new re(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Uu=new re(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function je(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||p.join(process.env.XDG_STATE_HOME||p.join(lr.homedir(),".local","state"),"oracle"),t=ur("sha256").update(p.resolve(e)).digest("hex").slice(0,16);return{vault:p.join(e,"vault.json"),policy:p.join(e,"signer-policy.json"),policyKey:p.join(e,"policy-integrity-key"),policyAnchor:p.join(n,`signer-policy-${t}.high-water`),ledger:p.join(e,"signer-ledger.json"),ledgerAnchor:p.join(n,`signer-ledger-${t}.high-water`),cexOrders:p.join(e,"cex-orders.json"),cexOrdersAnchor:p.join(n,`cex-orders-${t}.high-water`),token:p.join(e,"signer-token"),lock:p.join(n,`signer-${t}.lock`),workflowLedger:p.join(e,"workflow-events.jsonl")}}import{randomBytes as dr}from"node:crypto";import{Wallet as fr}from"ethers";var He=`oracle sign init|import|policy|status|lock|doctor