@oracle-agent/oracle 0.35.21 → 0.35.22

package/dist/local-signer/anvil-attestation-worker.mjs

@@ -1,2 +1,2 @@
-import Lt from"node:fs";import{JsonRpcProvider as Pt}from"ethers";import{Interface as te,keccak256 as _t}from"ethers";import{Transaction as kl}from"@scure/btc-signer";import{ed25519 as Ol}from"@noble/curves/ed25519.js";import{base58 as ri}from"@scure/base";import{Interface as fe}from"ethers";import{Interface as qe,MaxUint256 as mr,isAddress as wr,keccak256 as hr,toUtf8Bytes as gr}from"ethers";import{Interface as De,isAddress as Gt}from"ethers";import{isAddress as zt}from"ethers";var Qt=new De(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Fe,isAddress as rr}from"ethers";var ar=new Fe(["function approve(address spender,uint256 amount) returns (bool)"]),sr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Ar=new qe(["function approve(address spender,uint256 amount) returns (bool)"]);var kr=300*1e3,Ir=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as _r,NETWORK as $r,OutScript as Rr,RawTx as Lr,SigHash as Pr,TEST_NETWORK as Br,Transaction as Dr}from"@scure/btc-signer";import{createHash as Me}from"node:crypto";import{base58 as jr}from"@scure/base";import{getCompiledTransactionMessageDecoder as zr}from"@solana/transaction-messages";var se=e=>Me("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Wr=new Map([[se("route"),{name:"route",prefixBytes:0}],[se("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Zr=64*1024;var un=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),dn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var mn="0x"+"00".repeat(32);var He=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),En=Object.freeze(He.map(e=>e[0]));import{TypedDataEncoder as Yn,getAddress as Xn}from"ethers";import{TypedDataEncoder as vn,getAddress as kn,isAddress as In}from"ethers";var We=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),Ue=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as Dn,getAddress as Fn,isAddress as qn}from"ethers";var Nn=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var Ve=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),Vn=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Je=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),Jn=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var eo=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Qe=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var yo=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var et=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Eo=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),bo=new fe(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),xo=new fe(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),So=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var tt=Object.freeze([...Qe]),Ao=Object.freeze({...et});import{ed25519 as qo}from"@noble/curves/ed25519.js";import{base58 as jo}from"@scure/base";import{RawTx as zo,SigHash as Wo,Transaction as Uo}from"@scure/btc-signer";import{Transaction as Jo,keccak256 as Ko,verifyTypedData as Go}from"ethers";import{encode as Io}from"@msgpack/msgpack";import{keccak256 as To,verifyTypedData as No}from"ethers";var Co=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),_o=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{wordlists as Ei}from"ethers";import{wordlists as wi}from"ethers";var me=64*1024;var xi=32*1024;var at=["schemaVersion","buildVersion","recordType","execution","custody"],vi=[...at,"recordHash"];var ki=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var st=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Ae=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),Ci=new Set(Ae);var pt=64*1024*1024;var Di=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),Fi=Object.freeze(["read","simulate"]);var qi=1440*60;var Ki=Object.freeze(["privkey","wif","xprv","seed"]);var Gi=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),Yi=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var Y=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),ea=Object.freeze(Object.fromEntries(Y.map((e,t)=>[e,Object.freeze(t+1<Y.length?[Y[t+1]]:[])])));var mt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var ht=Object.freeze(["owner","operator","agent","viewer"]),gt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry"]),yt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),Fa=Object.freeze(["owner"]),qa=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),Ma=new Set(ht),ja=new Set(gt),Ha=new Set(Object.values(yt));var Et=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read"])}),za=Object.freeze(Object.fromEntries(Object.entries(Et).map(([e,t])=>[e,Object.freeze([...t])])));var bt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),xt=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),St=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Ja=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),Ka=new Set(bt),Ga=new Set(xt),Ya=new Set(St);var Xa=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Za=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var os=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var us=32*1024*1024;var fs=Object.freeze({N:1<<17,r:8,p:1}),ps=256*1024*1024,ms=16*1024;var hs=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{homedir as X}from"node:os";import{join as Z}from"node:path";var ve=process.env.ORACLE_PUBLIC_DESKTOP==="1",At=ve?process.env.ORACLE_CONFIG_DIR||Z(X(),".config","oracle"):Z(X(),".config","oracle"),bs=ve?At:Z(X(),".config","mad-desk");var ks="0".repeat(64),Is=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Os=Promise.resolve();import{readFileSync as Fs,readdirSync as qs,existsSync as vt}from"node:fs";import{dirname as kt,join as x}from"node:path";import{fileURLToPath as It}from"node:url";var S=kt(It(import.meta.url));function Ot(){let e=[x(S,"descriptors"),x(S,"clear-sign","descriptors"),x(S,"..","clear-sign","descriptors"),x(S,"..","..","clear-sign","descriptors"),x(S,"..","..","..","clear-sign","descriptors")];for(let t of e)if(vt(t))return t;return e[0]}var zs=Ot();var Ws=(1n<<256n)-1n;import{Wallet as Qs}from"ethers";import{base58 as tc}from"@scure/base";import{ed25519 as nc}from"@noble/curves/ed25519.js";import{NETWORK as ic,TEST_NETWORK as ac,WIF as sc,p2wpkh as cc}from"@scure/btc-signer";import{pubECDSA as uc}from"@scure/btc-signer/utils.js";var pc=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),mc=Object.freeze(["binance","bybit","okx","coinbase"]),wc=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),hc=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),gc=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),yc=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),Ec=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),bc=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),xc=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Sc=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Ac=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var Ct=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Ie=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Rc=256*1024;var l=new te(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Oe=new te(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),ee=new te(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function c(e,t){let r=String(e||"").toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(r))throw new Error(`signer: invalid ${t}`);return r}function Te(e,t){return Object.entries(e||{}).find(([r])=>r.toLowerCase()===t)?.[1]}function $t(e,t){let r=e?.anvilQuote;if(!r||typeof r!="object"||Array.isArray(r))throw new Error("signer: exact prepared Anvil quote is required");if(!e?.artifact?.anvilQuote||JSON.stringify(e.artifact.anvilQuote)!==JSON.stringify(r))throw new Error("signer: exact prepared Anvil quote artifact mismatch");return Object.freeze(t==="buy"?{totalCostRaw:BigInt(r.totalCostRaw).toString(),baseCostRaw:BigInt(r.baseCostRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString(),available:r.available===!0}:{netPayoutRaw:BigInt(r.netPayoutRaw).toString(),grossPayoutRaw:BigInt(r.grossPayoutRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString()})}function Rt(e,t,r){if(e.preconditions?.exactQuoteConfirmed!==!0)throw new Error("signer: exact prepared Anvil quote confirmation required");let a=e.artifact,p=t==="buy"?[r.totalCostRaw,e.maxPaymentTokenAmountRaw,a?.maxPaymentTokenAmountRaw,e.exactQuoteTotalCostRaw,a?.exactQuoteTotalCostRaw,e.preconditions?.confirmedTotalCostRaw]:[r.netPayoutRaw,e.minPayoutRaw,a?.minPayoutRaw,e.exactQuoteNetPayoutRaw,a?.exactQuoteNetPayoutRaw,e.preconditions?.confirmedNetPayoutRaw],n;try{n=BigInt(p[0]);for(let g of p.slice(1))if(BigInt(g)!==n)throw new Error("mismatch")}catch{throw new Error(`signer: exact Anvil ${t} settlement limit mismatch`)}let d=a?.transactions;if(!Array.isArray(d)||d.length!==1)throw new Error("signer: exact Anvil action transaction required");let h=t==="buy"?"buySpecificNFT":"sellNFT",f;try{if(f=l.decodeFunctionData(h,d[0].data),l.encodeFunctionData(h,[f[0],f[1]]).toLowerCase()!==String(d[0].data).toLowerCase())throw new Error("non-canonical")}catch{throw new Error(`signer: exact Anvil ${t} calldata required`)}if(BigInt(f[0])!==BigInt(e.tokenId)||BigInt(f[1])!==n)throw new Error(`signer: exact Anvil ${t} calldata limit mismatch`);return n}async function u(e,t,r,a,p,n=[]){let d=await e.send("eth_call",[{to:t,data:r.encodeFunctionData(a,n)},p]);return r.decodeFunctionResult(a,d)[0]}async function Ne(e,t,r,{nowMs:a=Date.now(),signerAddress:p}={}){if(t?.surface!=="evm-nft"||String(t?.provider).toLowerCase()!=="anvil-nft")return null;if(!e||typeof e.send!="function")throw new Error("signer: trusted RPC cannot attest Anvil market");let n=c(t.destination,"Anvil market"),d=c(t.contract,"Anvil collection"),h=c(t.paymentToken,"Anvil payment token"),f=BigInt(t.nativeSwapFeeWei),g=Number(t.paymentTokenDecimals),y=c(p,"Anvil signer identity"),Ce=c(t.owner,"Anvil envelope owner");if(y!==Ce)throw new Error("signer: Anvil signer identity mismatch");let m=BigInt(t.tokenId);if(m<0n)throw new Error("signer: invalid Anvil tokenId");let w=String(t.nftAction||"").toLowerCase();if(w!=="buy"&&w!=="sell")throw new Error("signer: unsupported Anvil NFT action");let _=$t(t,w),$=Rt(t,w,_),A=t.anvilAttestation;if(!A||typeof A!="object"||Number(A.snapshotExpiresAtMs)<=Number(a))throw new Error("signer: fresh provider Anvil attestation required");let R=String(Te(r.anvilRuntimeCodeHashes,n)||"").toLowerCase();if(!/^0x[0-9a-f]{64}$/.test(R)||R!==String(A.runtimeCodeHash||"").toLowerCase())throw new Error("signer: Anvil runtime is not reviewed by policy");let re=Te(r.nftPaymentTokenCaps,h);if(!re||Number(re.decimals)!==g)throw new Error("signer: Anvil payment token decimals are not reviewed by policy");let ne=String(await e.send("eth_chainId",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(ne)||BigInt(ne)!==4663n)throw new Error("signer: trusted RPC Anvil chain mismatch");let v=String(await e.send("eth_blockNumber",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(v))throw new Error("signer: trusted RPC returned an invalid Anvil block number");let _e=BigInt(v),oe=await e.send("eth_getBlockByNumber",[v,!1]),L=String(oe?.hash||"").toLowerCase();if(String(oe?.number||"").toLowerCase()!==v||!/^0x[0-9a-f]{64}$/.test(L))throw new Error("signer: trusted RPC returned an invalid Anvil block attestation");let i=Object.freeze({blockHash:L,requireCanonical:!0}),P=String(await e.send("eth_getCode",[n,i])).toLowerCase();if(!/^0x[0-9a-f]+$/.test(P)||P==="0x")throw new Error("signer: Anvil market runtime is empty");let ie=_t(P).toLowerCase();if(ie!==R)throw new Error("signer: Anvil market runtime mismatch with reviewed policy");let[$e,Re,Le]=await Promise.all([u(e,n,l,"collection",i),u(e,n,l,"token",i),u(e,n,l,"robinhoodSwapFeeWei",i)]),E=c($e,"live Anvil collection"),k=c(Re,"live Anvil payment token"),ae=BigInt(Le).toString();if(E!==d)throw new Error("signer: live Anvil collection mismatch");if(k!==h)throw new Error("signer: live Anvil payment token mismatch");if(ae!==f.toString())throw new Error("signer: live Anvil native swap fee mismatch");let B=Number(await u(e,k,Oe,"decimals",i));if(!Number.isSafeInteger(B)||B!==g)throw new Error("signer: live Anvil payment token decimals mismatch");let D=c(await u(e,E,ee,"ownerOf",i,[m]),"live Anvil token owner"),F=null,I=null,O=null,T=null,o;if(w==="buy"){let[q,M,j]=await Promise.all([u(e,n,l,"inventory",i,[m]),u(e,k,Oe,"allowance",i,[y,n]),e.send("eth_call",[{to:n,data:l.encodeFunctionData("quoteSpecificBuy",[m])},i])]);F=!!q,I=BigInt(M).toString();let s=l.decodeFunctionResult("quoteSpecificBuy",j);if(o=Object.freeze({totalCostRaw:BigInt(s[0]).toString(),baseCostRaw:BigInt(s[1]).toString(),feeRaw:BigInt(s[2]).toString(),protocolFeeRaw:BigInt(s[3]).toString(),available:!!s[4]}),JSON.stringify(o)!==JSON.stringify(_))throw new Error("signer: exact Anvil buy quote changed after preparation");if(D!==n)throw new Error("signer: exact Anvil token owner is not the market");if(!F)throw new Error("signer: exact Anvil token is not in market inventory");if(BigInt(I)!==BigInt(t.preconditions?.allowanceRaw))throw new Error("signer: live Anvil ERC20 allowance changed after preparation");if(BigInt(I)<$)throw new Error("signer: live Anvil ERC20 allowance is insufficient");if(!o.available)throw new Error("signer: exact Anvil buy quote is unavailable");if(BigInt(o.totalCostRaw)!==$)throw new Error("signer: live Anvil buy quote does not equal exact payment limit");if(BigInt(o.totalCostRaw)!==BigInt(o.baseCostRaw)+BigInt(o.feeRaw)+BigInt(o.protocolFeeRaw))throw new Error("signer: exact Anvil buy quote fee arithmetic mismatch")}else{let[q,M,j]=await Promise.all([u(e,E,ee,"getApproved",i,[m]),u(e,E,ee,"isApprovedForAll",i,[y,n]),e.send("eth_call",[{to:n,data:l.encodeFunctionData("quoteSellNFT")},i])]);O=c(q,"live Anvil token approval"),T=!!M;let s=l.decodeFunctionResult("quoteSellNFT",j);if(o=Object.freeze({netPayoutRaw:BigInt(s[0]).toString(),grossPayoutRaw:BigInt(s[1]).toString(),feeRaw:BigInt(s[2]).toString(),protocolFeeRaw:BigInt(s[3]).toString()}),JSON.stringify(o)!==JSON.stringify(_))throw new Error("signer: exact Anvil sell quote changed after preparation");if(D!==y)throw new Error("signer: exact Anvil token owner does not match signer");if(O!==n&&!T)throw new Error("signer: live Anvil NFT approval is insufficient");if(O!==c(t.preconditions?.approvedAddress,"prepared Anvil token approval")||T!==!!t.preconditions?.approvedForAll)throw new Error("signer: live Anvil NFT approval changed after preparation");if(BigInt(o.netPayoutRaw)!==$)throw new Error("signer: live Anvil sell quote does not equal exact payout limit");if(BigInt(o.netPayoutRaw)+BigInt(o.feeRaw)+BigInt(o.protocolFeeRaw)!==BigInt(o.grossPayoutRaw))throw new Error("signer: exact Anvil sell quote fee arithmetic mismatch")}return Object.freeze({source:"local-signer-trusted-rpc",chainId:4663,market:n,collection:E,paymentToken:k,paymentTokenDecimals:B,nativeSwapFeeWei:ae,signerAddress:y,nftAction:w,tokenId:m.toString(),tokenOwner:D,inventoryMember:F,allowanceRaw:I,approvedAddress:O,approvedForAll:T,quote:o,blockNumber:_e.toString(),blockHash:L,runtimeCodeHash:ie,verifiedAtMs:Number(a)})}try{let e=JSON.parse(Lt.readFileSync(0,"utf8")),t=new Pt(e.rpcUrl,Number(e.chainId)),r=await Ne(t,e.envelope,e.policy,{nowMs:Number(e.nowMs),signerAddress:e.signerAddress});process.stdout.write(JSON.stringify(r))}catch(e){process.stderr.write(`Anvil attestation failed: ${String(e?.message||e)}
+import Lt from"node:fs";import{JsonRpcProvider as Pt}from"ethers";import{Interface as te,keccak256 as _t}from"ethers";import{Transaction as kl}from"@scure/btc-signer";import{ed25519 as Ol}from"@noble/curves/ed25519.js";import{base58 as ri}from"@scure/base";import{Interface as fe}from"ethers";import{Interface as qe,MaxUint256 as mr,isAddress as wr,keccak256 as hr,toUtf8Bytes as gr}from"ethers";import{Interface as De,isAddress as Gt}from"ethers";import{isAddress as zt}from"ethers";var Qt=new De(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Fe,isAddress as rr}from"ethers";var ar=new Fe(["function approve(address spender,uint256 amount) returns (bool)"]),sr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Ar=new qe(["function approve(address spender,uint256 amount) returns (bool)"]);var kr=300*1e3,Ir=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as _r,NETWORK as $r,OutScript as Rr,RawTx as Lr,SigHash as Pr,TEST_NETWORK as Br,Transaction as Dr}from"@scure/btc-signer";import{createHash as Me}from"node:crypto";import{base58 as jr}from"@scure/base";import{getCompiledTransactionMessageDecoder as zr}from"@solana/transaction-messages";var se=e=>Me("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Wr=new Map([[se("route"),{name:"route",prefixBytes:0}],[se("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var Zr=64*1024;var un=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),dn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var mn="0x"+"00".repeat(32);var He=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),En=Object.freeze(He.map(e=>e[0]));import{TypedDataEncoder as Yn,getAddress as Xn}from"ethers";import{TypedDataEncoder as vn,getAddress as kn,isAddress as In}from"ethers";var We=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),Ue=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as Dn,getAddress as Fn,isAddress as qn}from"ethers";var Nn=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var Ve=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),Vn=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Je=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),Jn=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var eo=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Qe=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var yo=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var et=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Eo=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),bo=new fe(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),xo=new fe(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),So=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var tt=Object.freeze([...Qe]),Ao=Object.freeze({...et});import{ed25519 as qo}from"@noble/curves/ed25519.js";import{base58 as jo}from"@scure/base";import{RawTx as zo,SigHash as Wo,Transaction as Uo}from"@scure/btc-signer";import{Transaction as Jo,keccak256 as Ko,verifyTypedData as Go}from"ethers";import{encode as Io}from"@msgpack/msgpack";import{keccak256 as To,verifyTypedData as No}from"ethers";var Co=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),_o=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{wordlists as Ei}from"ethers";import{wordlists as wi}from"ethers";var me=64*1024;var xi=32*1024;var at=["schemaVersion","buildVersion","recordType","execution","custody"],vi=[...at,"recordHash"];var ki=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var st=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Ae=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),Ci=new Set(Ae);var pt=64*1024*1024;var Di=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),Fi=Object.freeze(["read","simulate"]);var qi=1440*60;var Ki=Object.freeze(["privkey","wif","xprv","seed"]);var Gi=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),Yi=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var Y=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),ea=Object.freeze(Object.fromEntries(Y.map((e,t)=>[e,Object.freeze(t+1<Y.length?[Y[t+1]]:[])])));var mt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var ht=Object.freeze(["owner","operator","agent","viewer"]),gt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),yt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),Fa=Object.freeze(["owner"]),qa=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),Ma=new Set(ht),ja=new Set(gt),Ha=new Set(Object.values(yt));var Et=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),za=Object.freeze(Object.fromEntries(Object.entries(Et).map(([e,t])=>[e,Object.freeze([...t])])));var bt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),xt=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),St=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Ja=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),Ka=new Set(bt),Ga=new Set(xt),Ya=new Set(St);var Xa=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Za=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var os=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var us=32*1024*1024;var fs=Object.freeze({N:1<<17,r:8,p:1}),ps=256*1024*1024,ms=16*1024;var hs=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{homedir as X}from"node:os";import{join as Z}from"node:path";var ve=process.env.ORACLE_PUBLIC_DESKTOP==="1",At=ve?process.env.ORACLE_CONFIG_DIR||Z(X(),".config","oracle"):Z(X(),".config","oracle"),bs=ve?At:Z(X(),".config","mad-desk");var ks="0".repeat(64),Is=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Os=Promise.resolve();import{readFileSync as Fs,readdirSync as qs,existsSync as vt}from"node:fs";import{dirname as kt,join as x}from"node:path";import{fileURLToPath as It}from"node:url";var S=kt(It(import.meta.url));function Ot(){let e=[x(S,"descriptors"),x(S,"clear-sign","descriptors"),x(S,"..","clear-sign","descriptors"),x(S,"..","..","clear-sign","descriptors"),x(S,"..","..","..","clear-sign","descriptors")];for(let t of e)if(vt(t))return t;return e[0]}var zs=Ot();var Ws=(1n<<256n)-1n;import{Wallet as Qs}from"ethers";import{base58 as tc}from"@scure/base";import{ed25519 as nc}from"@noble/curves/ed25519.js";import{NETWORK as ic,TEST_NETWORK as ac,WIF as sc,p2wpkh as cc}from"@scure/btc-signer";import{pubECDSA as uc}from"@scure/btc-signer/utils.js";var pc=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),mc=Object.freeze(["binance","bybit","okx","coinbase"]),wc=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),hc=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),gc=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),yc=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),Ec=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),bc=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),xc=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Sc=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Ac=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var Ct=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Ie=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Rc=256*1024;var l=new te(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Oe=new te(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),ee=new te(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function c(e,t){let r=String(e||"").toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(r))throw new Error(`signer: invalid ${t}`);return r}function Te(e,t){return Object.entries(e||{}).find(([r])=>r.toLowerCase()===t)?.[1]}function $t(e,t){let r=e?.anvilQuote;if(!r||typeof r!="object"||Array.isArray(r))throw new Error("signer: exact prepared Anvil quote is required");if(!e?.artifact?.anvilQuote||JSON.stringify(e.artifact.anvilQuote)!==JSON.stringify(r))throw new Error("signer: exact prepared Anvil quote artifact mismatch");return Object.freeze(t==="buy"?{totalCostRaw:BigInt(r.totalCostRaw).toString(),baseCostRaw:BigInt(r.baseCostRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString(),available:r.available===!0}:{netPayoutRaw:BigInt(r.netPayoutRaw).toString(),grossPayoutRaw:BigInt(r.grossPayoutRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString()})}function Rt(e,t,r){if(e.preconditions?.exactQuoteConfirmed!==!0)throw new Error("signer: exact prepared Anvil quote confirmation required");let a=e.artifact,p=t==="buy"?[r.totalCostRaw,e.maxPaymentTokenAmountRaw,a?.maxPaymentTokenAmountRaw,e.exactQuoteTotalCostRaw,a?.exactQuoteTotalCostRaw,e.preconditions?.confirmedTotalCostRaw]:[r.netPayoutRaw,e.minPayoutRaw,a?.minPayoutRaw,e.exactQuoteNetPayoutRaw,a?.exactQuoteNetPayoutRaw,e.preconditions?.confirmedNetPayoutRaw],n;try{n=BigInt(p[0]);for(let g of p.slice(1))if(BigInt(g)!==n)throw new Error("mismatch")}catch{throw new Error(`signer: exact Anvil ${t} settlement limit mismatch`)}let d=a?.transactions;if(!Array.isArray(d)||d.length!==1)throw new Error("signer: exact Anvil action transaction required");let h=t==="buy"?"buySpecificNFT":"sellNFT",f;try{if(f=l.decodeFunctionData(h,d[0].data),l.encodeFunctionData(h,[f[0],f[1]]).toLowerCase()!==String(d[0].data).toLowerCase())throw new Error("non-canonical")}catch{throw new Error(`signer: exact Anvil ${t} calldata required`)}if(BigInt(f[0])!==BigInt(e.tokenId)||BigInt(f[1])!==n)throw new Error(`signer: exact Anvil ${t} calldata limit mismatch`);return n}async function u(e,t,r,a,p,n=[]){let d=await e.send("eth_call",[{to:t,data:r.encodeFunctionData(a,n)},p]);return r.decodeFunctionResult(a,d)[0]}async function Ne(e,t,r,{nowMs:a=Date.now(),signerAddress:p}={}){if(t?.surface!=="evm-nft"||String(t?.provider).toLowerCase()!=="anvil-nft")return null;if(!e||typeof e.send!="function")throw new Error("signer: trusted RPC cannot attest Anvil market");let n=c(t.destination,"Anvil market"),d=c(t.contract,"Anvil collection"),h=c(t.paymentToken,"Anvil payment token"),f=BigInt(t.nativeSwapFeeWei),g=Number(t.paymentTokenDecimals),y=c(p,"Anvil signer identity"),Ce=c(t.owner,"Anvil envelope owner");if(y!==Ce)throw new Error("signer: Anvil signer identity mismatch");let m=BigInt(t.tokenId);if(m<0n)throw new Error("signer: invalid Anvil tokenId");let w=String(t.nftAction||"").toLowerCase();if(w!=="buy"&&w!=="sell")throw new Error("signer: unsupported Anvil NFT action");let _=$t(t,w),$=Rt(t,w,_),A=t.anvilAttestation;if(!A||typeof A!="object"||Number(A.snapshotExpiresAtMs)<=Number(a))throw new Error("signer: fresh provider Anvil attestation required");let R=String(Te(r.anvilRuntimeCodeHashes,n)||"").toLowerCase();if(!/^0x[0-9a-f]{64}$/.test(R)||R!==String(A.runtimeCodeHash||"").toLowerCase())throw new Error("signer: Anvil runtime is not reviewed by policy");let re=Te(r.nftPaymentTokenCaps,h);if(!re||Number(re.decimals)!==g)throw new Error("signer: Anvil payment token decimals are not reviewed by policy");let ne=String(await e.send("eth_chainId",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(ne)||BigInt(ne)!==4663n)throw new Error("signer: trusted RPC Anvil chain mismatch");let v=String(await e.send("eth_blockNumber",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(v))throw new Error("signer: trusted RPC returned an invalid Anvil block number");let _e=BigInt(v),oe=await e.send("eth_getBlockByNumber",[v,!1]),L=String(oe?.hash||"").toLowerCase();if(String(oe?.number||"").toLowerCase()!==v||!/^0x[0-9a-f]{64}$/.test(L))throw new Error("signer: trusted RPC returned an invalid Anvil block attestation");let i=Object.freeze({blockHash:L,requireCanonical:!0}),P=String(await e.send("eth_getCode",[n,i])).toLowerCase();if(!/^0x[0-9a-f]+$/.test(P)||P==="0x")throw new Error("signer: Anvil market runtime is empty");let ie=_t(P).toLowerCase();if(ie!==R)throw new Error("signer: Anvil market runtime mismatch with reviewed policy");let[$e,Re,Le]=await Promise.all([u(e,n,l,"collection",i),u(e,n,l,"token",i),u(e,n,l,"robinhoodSwapFeeWei",i)]),E=c($e,"live Anvil collection"),k=c(Re,"live Anvil payment token"),ae=BigInt(Le).toString();if(E!==d)throw new Error("signer: live Anvil collection mismatch");if(k!==h)throw new Error("signer: live Anvil payment token mismatch");if(ae!==f.toString())throw new Error("signer: live Anvil native swap fee mismatch");let B=Number(await u(e,k,Oe,"decimals",i));if(!Number.isSafeInteger(B)||B!==g)throw new Error("signer: live Anvil payment token decimals mismatch");let D=c(await u(e,E,ee,"ownerOf",i,[m]),"live Anvil token owner"),F=null,I=null,O=null,T=null,o;if(w==="buy"){let[q,M,j]=await Promise.all([u(e,n,l,"inventory",i,[m]),u(e,k,Oe,"allowance",i,[y,n]),e.send("eth_call",[{to:n,data:l.encodeFunctionData("quoteSpecificBuy",[m])},i])]);F=!!q,I=BigInt(M).toString();let s=l.decodeFunctionResult("quoteSpecificBuy",j);if(o=Object.freeze({totalCostRaw:BigInt(s[0]).toString(),baseCostRaw:BigInt(s[1]).toString(),feeRaw:BigInt(s[2]).toString(),protocolFeeRaw:BigInt(s[3]).toString(),available:!!s[4]}),JSON.stringify(o)!==JSON.stringify(_))throw new Error("signer: exact Anvil buy quote changed after preparation");if(D!==n)throw new Error("signer: exact Anvil token owner is not the market");if(!F)throw new Error("signer: exact Anvil token is not in market inventory");if(BigInt(I)!==BigInt(t.preconditions?.allowanceRaw))throw new Error("signer: live Anvil ERC20 allowance changed after preparation");if(BigInt(I)<$)throw new Error("signer: live Anvil ERC20 allowance is insufficient");if(!o.available)throw new Error("signer: exact Anvil buy quote is unavailable");if(BigInt(o.totalCostRaw)!==$)throw new Error("signer: live Anvil buy quote does not equal exact payment limit");if(BigInt(o.totalCostRaw)!==BigInt(o.baseCostRaw)+BigInt(o.feeRaw)+BigInt(o.protocolFeeRaw))throw new Error("signer: exact Anvil buy quote fee arithmetic mismatch")}else{let[q,M,j]=await Promise.all([u(e,E,ee,"getApproved",i,[m]),u(e,E,ee,"isApprovedForAll",i,[y,n]),e.send("eth_call",[{to:n,data:l.encodeFunctionData("quoteSellNFT")},i])]);O=c(q,"live Anvil token approval"),T=!!M;let s=l.decodeFunctionResult("quoteSellNFT",j);if(o=Object.freeze({netPayoutRaw:BigInt(s[0]).toString(),grossPayoutRaw:BigInt(s[1]).toString(),feeRaw:BigInt(s[2]).toString(),protocolFeeRaw:BigInt(s[3]).toString()}),JSON.stringify(o)!==JSON.stringify(_))throw new Error("signer: exact Anvil sell quote changed after preparation");if(D!==y)throw new Error("signer: exact Anvil token owner does not match signer");if(O!==n&&!T)throw new Error("signer: live Anvil NFT approval is insufficient");if(O!==c(t.preconditions?.approvedAddress,"prepared Anvil token approval")||T!==!!t.preconditions?.approvedForAll)throw new Error("signer: live Anvil NFT approval changed after preparation");if(BigInt(o.netPayoutRaw)!==$)throw new Error("signer: live Anvil sell quote does not equal exact payout limit");if(BigInt(o.netPayoutRaw)+BigInt(o.feeRaw)+BigInt(o.protocolFeeRaw)!==BigInt(o.grossPayoutRaw))throw new Error("signer: exact Anvil sell quote fee arithmetic mismatch")}return Object.freeze({source:"local-signer-trusted-rpc",chainId:4663,market:n,collection:E,paymentToken:k,paymentTokenDecimals:B,nativeSwapFeeWei:ae,signerAddress:y,nftAction:w,tokenId:m.toString(),tokenOwner:D,inventoryMember:F,allowanceRaw:I,approvedAddress:O,approvedForAll:T,quote:o,blockNumber:_e.toString(),blockHash:L,runtimeCodeHash:ie,verifiedAtMs:Number(a)})}try{let e=JSON.parse(Lt.readFileSync(0,"utf8")),t=new Pt(e.rpcUrl,Number(e.chainId)),r=await Ne(t,e.envelope,e.policy,{nowMs:Number(e.nowMs),signerAddress:e.signerAddress});process.stdout.write(JSON.stringify(r))}catch(e){process.stderr.write(`Anvil attestation failed: ${String(e?.message||e)}
 `),process.exitCode=1}

package/dist/local-signer/runtime.mjs

@@ -5,7 +5,7 @@ import ss from"node:fs";import Q from"node:path";import Op from"node:os";import{
 `),s=[],c=new Map,d=new Set,u=new Set;for(let f=0;f<l.length;f+=1){let p=l[f];if(Buffer.byteLength(p,"utf8")>Ui)return{ok:!1,reason:"event-size-limit",line:f+1,count:s.length,workflows:c.size,events:s,paths:n};let w;try{w=JSON.parse(p)}catch{return{ok:!1,reason:"malformed-json",line:f+1,count:s.length,workflows:c.size,events:s,paths:n}}let g;try{g=Vu(w)}catch(v){return{ok:!1,reason:"event-invalid",line:f+1,detail:String(v?.message||v),count:s.length,workflows:c.size,events:s,paths:n}}if(d.has(g.id))return{ok:!1,reason:"duplicate-event-id",line:f+1,count:s.length,workflows:c.size,events:s,paths:n};let h=Cn(g),y=kn(g.tenantId,g.workflowId,g.idempotencyKey);if(u.has(y))return{ok:!1,reason:"duplicate-idempotency-key",line:f+1,count:s.length,workflows:c.size,events:s,paths:n};let E=c.get(h)??null,S=String(BigInt(E?.sequence??"0")+1n);if(g.sequence!==S)return{ok:!1,reason:"sequence-gap",line:f+1,count:s.length,workflows:c.size,events:s,paths:n};if(g.previousEventHash!==(E?.eventHash??null))return{ok:!1,reason:"previous-event-hash-mismatch",line:f+1,count:s.length,workflows:c.size,events:s,paths:n};if(E&&Date.parse(g.recordedAt)<Date.parse(E.recordedAt))return{ok:!1,reason:"recorded-at-regression",line:f+1,count:s.length,workflows:c.size,events:s,paths:n};d.add(g.id),u.add(y),c.set(h,g),s.push(g)}let m=new Map;for(let f of s){let p=Cn(f);m.has(p)||m.set(p,[]),m.get(p).push(f)}for(let[f,p]of m)try{gr(p)}catch(w){return{ok:!1,reason:"workflow-invalid",streamKey:f,detail:String(w?.message||w),count:s.length,workflows:c.size,events:s,heads:c,paths:n}}if(r){if(!Qe(n.checkpoint))return s.length===0?{ok:!0,count:0,workflows:0,events:s,heads:c,paths:n,empty:!0}:{ok:!1,reason:"checkpoint-missing",recoverable:!0,count:s.length,workflows:c.size,events:s,heads:c,paths:n};let f;try{br(n.checkpoint,"checkpoint");let g=Er(n.checkpoint,"utf8");if(!g.endsWith(`
 `))throw new L("checkpoint truncated","CHECKPOINT_INVALID");f=JSON.parse(g),Ku(f)}catch(g){return{ok:!1,reason:"checkpoint-invalid",recoverable:!1,detail:String(g?.message||g),count:s.length,workflows:c.size,events:s,heads:c,paths:n}}let p=Vi(n.ledger,s,i),w=Yu(f,p);if(!w.ok)return{...w,count:s.length,workflows:c.size,events:s,heads:c,paths:n}}return{ok:!0,count:s.length,workflows:c.size,events:s,heads:c,paths:n,raw:i,lastEventHash:s.at(-1)?.eventHash??null}}catch(o){return{ok:!1,reason:"io-error",detail:String(o?.message||o),count:0,workflows:0,events:[],paths:n}}}function Zu(e){let t={ok:e.ok,count:e.count,workflows:e.workflows,...e.reason?{reason:e.reason}:{},...e.line?{line:e.line}:{},...e.detail?{detail:e.detail}:{},...e.recoverable!==void 0?{recoverable:e.recoverable}:{},...e.lastEventHash!==void 0?{lastEventHash:e.lastEventHash}:{}};return Z(t)}function Qu(e){if(!Number.isSafeInteger(e)||e<=0)return"invalid";try{return process.kill(e,0),"active"}catch(t){return t?.code==="ESRCH"?"stale":"active"}}function Ki(e){let{lock:t}=tt(e);br(t,"lock");let r=JSON.parse(Er(t,"utf8"));if(we(r,Mi,Mi,"workflow ledger lock"),r.schemaVersion!==Rn)throw new L("lock schema mismatch","LOCK_INVALID");if(j(r.token,"workflow ledger lock.token"),!Number.isSafeInteger(r.pid)||r.pid<=0)throw new L("lock pid invalid","LOCK_INVALID");return Ce(r.createdAt,"workflow ledger lock.createdAt"),r}function Gi({path:e}={}){let{lock:t}=tt(e);if(!Qe(t))return Z({state:"unlocked",lock:null});try{let r=Ki(e);return Z({state:Qu(r.pid),lock:r})}catch(r){return Z({state:"invalid",lock:null,error:String(r?.message||r)})}}function ed(e){let t=tt(e);Wu(t.directory);let r={schemaVersion:Rn,token:ji(),pid:process.pid,createdAt:new Date().toISOString()},n;try{return n=Sr(t.lock,re.O_WRONLY|re.O_CREAT|re.O_EXCL|(re.O_NOFOLLOW||0),384),Pn(n,Buffer.from(`${JSON.stringify(r)}
 `,"utf8")),xr(n),et(n),n=void 0,_n(t.lock,384),Ar(t.directory),r}catch(o){throw n!==void 0&&et(n),o}}async function td(e,t){if(!Number.isSafeInteger(t)||t<0||t>12e4)throw new L("lockTimeoutMs out of bounds","LOCK_TIMEOUT_INVALID");let r=Date.now();for(;;)try{return ed(e)}catch(n){if(n?.code!=="EEXIST")throw n;if(Date.now()-r>=t){let o=Gi({path:e});throw new L(`ledger busy (${o.state} lock); explicit token-bound recovery is required for stale locks`,"LEDGER_BUSY",o)}await zu(10)}}function yr(e,t){let r=Ki(e);if(r.token!==t||r.pid!==process.pid)throw new L("lock fencing token no longer owned","LOCK_FENCED");return!0}function rd(e,t){let r=tt(e);yr(e,t),Hi(r.lock),Ar(r.directory)}function nd(e){return{tenantId:e.tenantId,id:e.id,workflowId:e.workflowId,idempotencyKey:e.idempotencyKey,occurredAt:e.occurredAt,recordedAt:e.recordedAt,type:e.type,external:e.external,evidence:e.evidence,data:e.data}}async function Bn(e={}){we(e,["path","event","lockTimeoutMs","maxBytes"],["path","event"],"appendWorkflowEvent options");let t=tt(e.path).ledger,r=Nn(e.event),n=e.lockTimeoutMs??Wi,o=e.maxBytes??Ln,i=await td(t,n),a=null;try{yr(t,i.token);let l=Xu({path:t,maxBytes:o});if(!l.ok)throw new L(`append refused until ledger recovery: ${l.reason}`,"LEDGER_CORRUPT",Zu(l));let s=l.events.find(E=>E.tenantId===r.tenantId&&E.workflowId===r.workflowId&&E.idempotencyKey===r.idempotencyKey);if(s){if(Ze(nd(s))!==Ze(r))throw new L("idempotency key reused with different payload","IDEMPOTENCY_CONFLICT");return Z({event:s,duplicate:!0})}if(l.events.some(E=>E.id===r.id))throw new L("event id already exists","EVENT_ID_CONFLICT");let c=Se(r.tenantId,r.workflowId),d=l.heads.get(c)??null,u=hr({...r,sequence:String(BigInt(d?.sequence??"0")+1n),previousEventHash:d?.eventHash??null}),m=l.events.filter(E=>Se(E.tenantId,E.workflowId)===c);gr([...m,u]);let f=Buffer.from(`${JSON.stringify(u)}
-`,"utf8");if(f.length>Ui)throw new L("event exceeds size limit","EVENT_SIZE_LIMIT");let p=Buffer.concat([l.raw??Buffer.alloc(0),f]);if(p.length>o)throw new L("append would exceed ledger size limit","LEDGER_SIZE_LIMIT");let w=[...l.events,u],g=Ji(t,w,p),h=Qe(t);h&&br(t,"ledger"),yr(t,i.token);let y;try{y=Uu(t),Pn(y,f),xr(y)}finally{y!==void 0&&et(y)}return _n(t,384),h||Ar(zi(t)),yr(t,i.token),Gu(t,w,p,g),Z({event:u,duplicate:!1})}catch(l){throw a=l,l}finally{try{rd(t,i.token)}catch(l){if(a===null)throw l}}}var dg=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),fg=Object.freeze(["read","simulate"]);var pg=1440*60;var Sg=Object.freeze(["privkey","wif","xprv","seed"]);var Ag=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),vg=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var Dn=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Tg=Object.freeze(Object.fromEntries(Dn.map((e,t)=>[e,Object.freeze(t+1<Dn.length?[Dn[t+1]]:[])])));var od=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});import{createHash as ud,randomBytes as dd}from"node:crypto";var id=Object.freeze(["owner","operator","agent","viewer"]),ad=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry"]),sd=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),ay=Object.freeze(["owner"]),sy=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),cy=new Set(id),ly=new Set(ad),uy=new Set(Object.values(sd));var cd=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/;var ld=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read"])}),dy=Object.freeze(Object.fromEntries(Object.entries(ld).map(([e,t])=>[e,Object.freeze([...t])]))),vr=class extends Error{constructor(t,r="invalid-context"){super(t),this.name="TenantContextError",this.code=r}};function Yi(e,t){let r=String(e??"").trim();if(!cd.test(r))throw new vr(`${t} is invalid`);return r}function Xi(e,t){let r=Yi(e,"tenantId"),n=Yi(t,"workflowId");if(r.includes(":")||n.includes(":"))throw new vr("stream key parts must not contain ':'","invalid-stream-key");return`${r}:${n}`}var na=1,oa=1,fd=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),pd=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),ia=Object.freeze(["taskId","intentId","planId","runId","eventId"]);function Zi(e,t){return Xi(e,t)}var Vt=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),md=new Set(fd),wd=new Set(pd),hd=new Set(ia),gd=/^[0-9a-f]{32}$/,Qi=/^[0-9a-f]{16}$/;var yd=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,95}$/,Ed=/^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/,bd=/^[A-Za-z][A-Za-z0-9_.-]*$/,xd=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]),Sd=/(?:^|\s)Bearer\s+\S+|-----BEGIN [A-Z ]*PRIVATE KEY-----|\bxprv[0-9A-Za-z]{20,}\b|\bsk-[A-Za-z0-9_-]{16,}\b|[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{16,}/i,Ad=/(?:0x)?[0-9a-fA-F]{66,}/,vd=/[A-Za-z0-9+/=_-]{96,}/,B=class extends Error{constructor(t,r="invalid-telemetry"){super(t),this.name="WorkflowTelemetryError",this.code=r}};function kr(e){return!!e&&typeof e=="object"&&!Array.isArray(e)&&Object.getPrototypeOf(e)===Object.prototype}function Ir(e){if(e&&typeof e=="object"&&!Object.isFrozen(e)){Object.freeze(e);for(let t of Object.values(e))Ir(t)}return e}function Fn(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(Fn).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${Fn(e[t])}`).join(",")}}`}function aa(e){return ud("sha256").update(Fn(e)).digest("hex")}function ea(e,t,r){let n=r?r(e,t):dd(e).toString("hex");return String(n??"").trim().toLowerCase()}function sa(e={}){if(e==null)return{};if(!kr(e))throw new B("correlation must be a plain object");let t=Object.keys(e).filter(n=>!hd.has(n));if(t.length)throw new B(`unknown correlation fields: ${t.sort().join(", ")}`);let r={};for(let n of ia){if(e[n]==null)continue;let o=String(e[n]).trim();if(!Ed.test(o))throw new B(`${n} is invalid`);r[n]=o}return r}function ca(e){if(!kr(e)||e.schemaVersion!==na)throw new B("trace context version is invalid","invalid-trace");if(!gd.test(e.traceId||"")||!Qi.test(e.spanId||"")||/^0+$/.test(e.traceId)||/^0+$/.test(e.spanId))throw new B("trace or span id is invalid","invalid-trace");if(e.parentSpanId!==null&&!Qi.test(e.parentSpanId||""))throw new B("parent span id is invalid","invalid-trace");if(typeof e.sampled!="boolean")throw new B("sampled must be boolean","invalid-trace");return sa(e.correlation),e}function kd({traceId:e,spanId:t,parentSpanId:r=null,sampled:n=!1,correlation:o={}}={},{idFactory:i}={}){let a=e==null?ea(16,"trace",i):String(e).trim().toLowerCase(),l=t==null?ea(8,"span",i):String(t).trim().toLowerCase(),s=r==null?null:String(r).trim().toLowerCase(),c=Ir({schemaVersion:na,traceId:a,spanId:l,parentSpanId:s,sampled:n===!0,correlation:sa(o)});return ca(c)}var la=kd;var wy=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});function ta(e){let t=String(e).replace(/[^a-z0-9]/gi,"").toLowerCase();return xd.some(r=>t.includes(r))}function Id(e){return Sd.test(e)||Ad.test(e)||vd.test(e)?{value:"[REDACTED]",redacted:!0,truncated:!1}:e.length>Vt.maxStringLength?{value:`${e.slice(0,Vt.maxStringLength-1)}\u2026`,redacted:!1,truncated:!0}:{value:e,redacted:!1,truncated:!1}}function ua(e){if(typeof e=="string")return Id(e);if(typeof e=="boolean")return{value:e,redacted:!1,truncated:!1};if(typeof e=="number"&&Number.isFinite(e))return{value:e,redacted:!1,truncated:!1};if(Array.isArray(e)){let t=e.slice(0,Vt.maxArrayLength),r=[],n=!1,o=e.length>t.length;for(let i of t){if(!["string","boolean","number"].includes(typeof i))return null;let a=ua(i);if(!a)return null;r.push(a.value),n||=a.redacted,o||=a.truncated}return{value:r,redacted:n,truncated:o}}return null}function Od(e={}){if(!kr(e))throw new B("telemetry attributes must be a plain object");let t={},r=0,n=0,o=0,i=Object.keys(e).sort();for(let a of i){if(Object.keys(t).length>=Vt.maxAttributes){n+=1;continue}if(a.length>Vt.maxKeyLength||!bd.test(a)||ta(a)){n+=1,ta(a)&&(r+=1);continue}let l=ua(e[a]);if(!l){n+=1;continue}t[a]=l.value,l.redacted&&(r+=1),l.truncated&&(o+=1)}return Ir({attributes:t,redactedCount:r,droppedCount:n,truncatedCount:o})}function ra(e,t){if(!Number.isSafeInteger(e)||e<0)throw new B(`${t} must be a non-negative integer milliseconds value`);return e}function Td(e){if(e==null)return null;let t=String(e).trim();if(!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(t))throw new B("outcomeCode is invalid");return t}function Nd({streamKey:e,tenantId:t,workflowId:r,sourceEvent:n}){let o=e??n?.streamKey??null,i=t??n?.tenantId??null,a=r??n?.workflowId??null;if(o!=null){let l=String(o).trim();if(i!=null&&a!=null){let s=Zi(i,a);if(l!==s)throw new B("streamKey must equal tenantId:workflowId","invalid-stream-key");return s}if(!/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}:[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(l)||l.split(":").length!==2)throw new B("streamKey must be tenantId:workflowId","invalid-stream-key");return l}return i!=null&&a!=null?Zi(i,a):null}function Cd({trace:e,name:t,kind:r,diagnosticOutcome:n=null,outcome:o=null,outcomeCode:i=null,startedAt:a,endedAt:l,attributes:s,authority:c,sourceEvent:d=null,streamKey:u=null,tenantId:m=null,workflowId:f=null}){ca(e);let p=String(t??"").trim();if(!yd.test(p))throw new B("workflow telemetry name is invalid");if(!wd.has(r))throw new B("workflow telemetry kind is invalid");let w=c==="ledger_projection"?o:n;if(!md.has(w))throw new B("workflow telemetry outcome is invalid");let g=ra(a,"startedAt"),h=ra(l,"endedAt");if(h<g)throw new B("endedAt must not be before startedAt");let y=Od(s),E=Nd({streamKey:u,tenantId:m,workflowId:f,sourceEvent:d}),S={schemaVersion:oa,recordType:"oracle.workflow.telemetry",authority:c,streamKey:E,trace:{traceId:e.traceId,spanId:e.spanId,parentSpanId:e.parentSpanId,sampled:e.sampled},correlation:{...e.correlation},name:p,kind:r,...c==="ledger_projection"?{outcome:o,sourceEvent:{...d}}:{diagnosticOutcome:n},outcomeCode:Td(i),startedAt:g,endedAt:h,durationMs:h-g,attributes:{...y.attributes},attributePolicy:{redactedCount:y.redactedCount,droppedCount:y.droppedCount,truncatedCount:y.truncatedCount}};return Ir({...S,recordId:aa(S)})}function qn({trace:e,name:t,kind:r="workflow",outcome:n,outcomeCode:o=null,startedAt:i,endedAt:a,attributes:l={},tenantId:s=null,workflowId:c=null,streamKey:d=null}={}){return Cd({trace:e,name:t,kind:r,diagnosticOutcome:n,outcomeCode:o,startedAt:i,endedAt:a,attributes:l,authority:"diagnostic",tenantId:s,workflowId:c,streamKey:d})}function Mn(e){if(!kr(e)||!Object.isFrozen(e)||e.schemaVersion!==oa||e.recordType!=="oracle.workflow.telemetry")return!1;let{recordId:t,...r}=e;return typeof t=="string"&&t===aa(r)}function jn({exporter:e=null}={}){if(e!=null&&typeof e!="function"&&typeof e?.export!="function")throw new B("exporter must be a function or expose export(record)");let t=typeof e=="function"?e:e?.export?.bind(e);return Object.freeze({exporterConfigured:!!t,defaultExporter:"none",async emit(r){let n=Mn(r)?r:qn(r);if(!t)return Object.freeze({record:n,exported:!1,exporterFailed:!1});try{return await t(n),Object.freeze({record:n,exported:!0,exporterFailed:!1})}catch{return Object.freeze({record:n,exported:!1,exporterFailed:!0})}}})}var _d="ORACLE_LEDGER_DUAL_WRITE",da=/^[a-f0-9]{64}$/,$d=/^0x[a-f0-9]{64}$/,Rd=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});function At(e,t){return String(e??"").slice(0,t)}function fa(e=process.env){return String(e?.[_d]??"")==="1"}function pa({path:e,tenantId:t="local-signer",nowMs:r=Date.now,onError:n=null,telemetry:o=null,append:i=Bn}={}){if(typeof e!="string"||e.trim().length===0)throw new Error("ledger observer requires an explicit ledger path");if(typeof i!="function")throw new Error("ledger observer requires an append function");let a=typeof n=="function"?n:()=>{},l=new Map,s=Promise.resolve(),c=()=>new Date(r()).toISOString();function d(f,p,w){if(!(!o||typeof o.emit!="function"))try{let g=r(),h=qn({trace:f.trace,name:p,kind:"workflow",outcome:Rd[p]??"succeeded",startedAt:g,endedAt:g,attributes:w,tenantId:t,workflowId:f.workflowId});s=s.then(()=>o.emit(h)).catch(y=>{a(`signer telemetry emit failed: ${At(y?.message||y,200)}`)})}catch(g){a(`signer telemetry record failed: ${At(g?.message||g,200)}`)}}function u(f,p,{external:w=!1,source:g="local-signer",reference:h=null,data:y={}}={}){let E=c(),S={tenantId:t,id:`${f.workflowId}:${p}`,workflowId:f.workflowId,idempotencyKey:`${f.workflowId}:${p}`,occurredAt:E,recordedAt:E,type:p,external:w,evidence:{status:"verified",source:w?"external":g,reference:`${w?`${g}:`:""}${h??`${p}:${f.workflowId}`}`},data:y};return s=s.then(()=>i({path:e,event:S})).catch(v=>{a(`workflow ledger dual-write failed for ${p}: ${At(v?.message||v,200)}`)}),d(f,p,{digest:f.digest}),s}function m(f){let p=String(f??"").toLowerCase();return da.test(p)?l.get(p)??null:null}return Object.freeze({queued({digest:f,createdAtMs:p}={}){let w=String(f??"").toLowerCase();if(!da.test(w))return a("ledger observer: queued without a valid artifact digest"),s;let g=Number.isFinite(Number(p))?Number(p):r(),h={workflowId:`signer-${w}-${g}`,digest:w,trace:la()};return l.set(w,h),u(h,"workflow.drafted",{source:"local-signer-queue",reference:`artifact:${w}`,data:{intentSpecId:`${h.workflowId}:intent`}}),u(h,"workflow.checked",{source:"local-signer-policy",reference:`artifact:${w}`,data:{checksPassed:!0}}),u(h,"workflow.approval_requested",{source:"local-signer-queue",reference:`artifact:${w}`}),s},denied({digest:f}={}){let p=m(f);return p&&(l.delete(p.digest),u(p,"workflow.cancelled",{source:"owner-ack",reference:`deny:${p.digest}`})),s},approved({digest:f,channel:p="owner-ack"}={}){let w=m(f);return w&&u(w,"workflow.approval_granted",{external:!0,source:p,reference:`ack:${w.digest}`}),s},executed({digest:f,owner:p=null,result:w=null}={}){let g=m(f);if(!g)return s;l.delete(g.digest),u(g,"workflow.signed",{external:!0,reference:`signed:${g.digest}`,data:{artifactHash:g.digest,signer:At(p||"owner-wallet",256)}});let h=w?.hash??w?.txHash??w?.transactionHash??w?.signature??null,y=typeof h=="string"?h.trim().toLowerCase():null;return y&&$d.test(y)?u(g,"workflow.submitted",{external:!0,reference:`submitted:${g.digest}`,data:{transactionHash:y,endpoint:"local-signer-broadcast"}}):h&&u(g,"workflow.annotated",{reference:`submission:${g.digest}`,data:{note:"non-evm-submission-reference",reference:At(h,512)}}),s},failed({digest:f,reason:p=""}={}){let w=m(f);return w&&(l.delete(w.digest),u(w,"workflow.failed",{reference:`failed:${w.digest}`,data:{reason:At(p,300)}})),s},flush(){return s}})}import{appendFileSync as Ld,existsSync as Pd,mkdirSync as Bd,renameSync as Dd,statSync as Fd}from"node:fs";import{dirname as qd}from"node:path";var Md="ORACLE_TELEMETRY_JSONL",jd=32*1024*1024,ma=4096;function Hd({path:e,maxBytes:t=jd}={}){if(typeof e!="string"||e.trim().length===0)throw new B("jsonl exporter requires an explicit file path","invalid-exporter-path");let r=Number(t);if(!Number.isFinite(r)||r<ma)throw new B(`jsonl exporter maxBytes must be >= ${ma}`,"invalid-exporter-cap");let n=e;return Object.freeze({path:n,maxBytes:r,export(o){if(!Mn(o))throw new B("jsonl exporter accepts only sealed workflow telemetry records","invalid-record");let i=`${JSON.stringify(o)}
+`,"utf8");if(f.length>Ui)throw new L("event exceeds size limit","EVENT_SIZE_LIMIT");let p=Buffer.concat([l.raw??Buffer.alloc(0),f]);if(p.length>o)throw new L("append would exceed ledger size limit","LEDGER_SIZE_LIMIT");let w=[...l.events,u],g=Ji(t,w,p),h=Qe(t);h&&br(t,"ledger"),yr(t,i.token);let y;try{y=Uu(t),Pn(y,f),xr(y)}finally{y!==void 0&&et(y)}return _n(t,384),h||Ar(zi(t)),yr(t,i.token),Gu(t,w,p,g),Z({event:u,duplicate:!1})}catch(l){throw a=l,l}finally{try{rd(t,i.token)}catch(l){if(a===null)throw l}}}var dg=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),fg=Object.freeze(["read","simulate"]);var pg=1440*60;var Sg=Object.freeze(["privkey","wif","xprv","seed"]);var Ag=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),vg=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var Dn=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Tg=Object.freeze(Object.fromEntries(Dn.map((e,t)=>[e,Object.freeze(t+1<Dn.length?[Dn[t+1]]:[])])));var od=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});import{createHash as ud,randomBytes as dd}from"node:crypto";var id=Object.freeze(["owner","operator","agent","viewer"]),ad=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),sd=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),ay=Object.freeze(["owner"]),sy=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),cy=new Set(id),ly=new Set(ad),uy=new Set(Object.values(sd));var cd=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/;var ld=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),dy=Object.freeze(Object.fromEntries(Object.entries(ld).map(([e,t])=>[e,Object.freeze([...t])]))),vr=class extends Error{constructor(t,r="invalid-context"){super(t),this.name="TenantContextError",this.code=r}};function Yi(e,t){let r=String(e??"").trim();if(!cd.test(r))throw new vr(`${t} is invalid`);return r}function Xi(e,t){let r=Yi(e,"tenantId"),n=Yi(t,"workflowId");if(r.includes(":")||n.includes(":"))throw new vr("stream key parts must not contain ':'","invalid-stream-key");return`${r}:${n}`}var na=1,oa=1,fd=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),pd=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),ia=Object.freeze(["taskId","intentId","planId","runId","eventId"]);function Zi(e,t){return Xi(e,t)}var Vt=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),md=new Set(fd),wd=new Set(pd),hd=new Set(ia),gd=/^[0-9a-f]{32}$/,Qi=/^[0-9a-f]{16}$/;var yd=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,95}$/,Ed=/^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/,bd=/^[A-Za-z][A-Za-z0-9_.-]*$/,xd=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]),Sd=/(?:^|\s)Bearer\s+\S+|-----BEGIN [A-Z ]*PRIVATE KEY-----|\bxprv[0-9A-Za-z]{20,}\b|\bsk-[A-Za-z0-9_-]{16,}\b|[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{16,}/i,Ad=/(?:0x)?[0-9a-fA-F]{66,}/,vd=/[A-Za-z0-9+/=_-]{96,}/,B=class extends Error{constructor(t,r="invalid-telemetry"){super(t),this.name="WorkflowTelemetryError",this.code=r}};function kr(e){return!!e&&typeof e=="object"&&!Array.isArray(e)&&Object.getPrototypeOf(e)===Object.prototype}function Ir(e){if(e&&typeof e=="object"&&!Object.isFrozen(e)){Object.freeze(e);for(let t of Object.values(e))Ir(t)}return e}function Fn(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(Fn).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${Fn(e[t])}`).join(",")}}`}function aa(e){return ud("sha256").update(Fn(e)).digest("hex")}function ea(e,t,r){let n=r?r(e,t):dd(e).toString("hex");return String(n??"").trim().toLowerCase()}function sa(e={}){if(e==null)return{};if(!kr(e))throw new B("correlation must be a plain object");let t=Object.keys(e).filter(n=>!hd.has(n));if(t.length)throw new B(`unknown correlation fields: ${t.sort().join(", ")}`);let r={};for(let n of ia){if(e[n]==null)continue;let o=String(e[n]).trim();if(!Ed.test(o))throw new B(`${n} is invalid`);r[n]=o}return r}function ca(e){if(!kr(e)||e.schemaVersion!==na)throw new B("trace context version is invalid","invalid-trace");if(!gd.test(e.traceId||"")||!Qi.test(e.spanId||"")||/^0+$/.test(e.traceId)||/^0+$/.test(e.spanId))throw new B("trace or span id is invalid","invalid-trace");if(e.parentSpanId!==null&&!Qi.test(e.parentSpanId||""))throw new B("parent span id is invalid","invalid-trace");if(typeof e.sampled!="boolean")throw new B("sampled must be boolean","invalid-trace");return sa(e.correlation),e}function kd({traceId:e,spanId:t,parentSpanId:r=null,sampled:n=!1,correlation:o={}}={},{idFactory:i}={}){let a=e==null?ea(16,"trace",i):String(e).trim().toLowerCase(),l=t==null?ea(8,"span",i):String(t).trim().toLowerCase(),s=r==null?null:String(r).trim().toLowerCase(),c=Ir({schemaVersion:na,traceId:a,spanId:l,parentSpanId:s,sampled:n===!0,correlation:sa(o)});return ca(c)}var la=kd;var wy=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});function ta(e){let t=String(e).replace(/[^a-z0-9]/gi,"").toLowerCase();return xd.some(r=>t.includes(r))}function Id(e){return Sd.test(e)||Ad.test(e)||vd.test(e)?{value:"[REDACTED]",redacted:!0,truncated:!1}:e.length>Vt.maxStringLength?{value:`${e.slice(0,Vt.maxStringLength-1)}\u2026`,redacted:!1,truncated:!0}:{value:e,redacted:!1,truncated:!1}}function ua(e){if(typeof e=="string")return Id(e);if(typeof e=="boolean")return{value:e,redacted:!1,truncated:!1};if(typeof e=="number"&&Number.isFinite(e))return{value:e,redacted:!1,truncated:!1};if(Array.isArray(e)){let t=e.slice(0,Vt.maxArrayLength),r=[],n=!1,o=e.length>t.length;for(let i of t){if(!["string","boolean","number"].includes(typeof i))return null;let a=ua(i);if(!a)return null;r.push(a.value),n||=a.redacted,o||=a.truncated}return{value:r,redacted:n,truncated:o}}return null}function Od(e={}){if(!kr(e))throw new B("telemetry attributes must be a plain object");let t={},r=0,n=0,o=0,i=Object.keys(e).sort();for(let a of i){if(Object.keys(t).length>=Vt.maxAttributes){n+=1;continue}if(a.length>Vt.maxKeyLength||!bd.test(a)||ta(a)){n+=1,ta(a)&&(r+=1);continue}let l=ua(e[a]);if(!l){n+=1;continue}t[a]=l.value,l.redacted&&(r+=1),l.truncated&&(o+=1)}return Ir({attributes:t,redactedCount:r,droppedCount:n,truncatedCount:o})}function ra(e,t){if(!Number.isSafeInteger(e)||e<0)throw new B(`${t} must be a non-negative integer milliseconds value`);return e}function Td(e){if(e==null)return null;let t=String(e).trim();if(!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(t))throw new B("outcomeCode is invalid");return t}function Nd({streamKey:e,tenantId:t,workflowId:r,sourceEvent:n}){let o=e??n?.streamKey??null,i=t??n?.tenantId??null,a=r??n?.workflowId??null;if(o!=null){let l=String(o).trim();if(i!=null&&a!=null){let s=Zi(i,a);if(l!==s)throw new B("streamKey must equal tenantId:workflowId","invalid-stream-key");return s}if(!/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}:[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(l)||l.split(":").length!==2)throw new B("streamKey must be tenantId:workflowId","invalid-stream-key");return l}return i!=null&&a!=null?Zi(i,a):null}function Cd({trace:e,name:t,kind:r,diagnosticOutcome:n=null,outcome:o=null,outcomeCode:i=null,startedAt:a,endedAt:l,attributes:s,authority:c,sourceEvent:d=null,streamKey:u=null,tenantId:m=null,workflowId:f=null}){ca(e);let p=String(t??"").trim();if(!yd.test(p))throw new B("workflow telemetry name is invalid");if(!wd.has(r))throw new B("workflow telemetry kind is invalid");let w=c==="ledger_projection"?o:n;if(!md.has(w))throw new B("workflow telemetry outcome is invalid");let g=ra(a,"startedAt"),h=ra(l,"endedAt");if(h<g)throw new B("endedAt must not be before startedAt");let y=Od(s),E=Nd({streamKey:u,tenantId:m,workflowId:f,sourceEvent:d}),S={schemaVersion:oa,recordType:"oracle.workflow.telemetry",authority:c,streamKey:E,trace:{traceId:e.traceId,spanId:e.spanId,parentSpanId:e.parentSpanId,sampled:e.sampled},correlation:{...e.correlation},name:p,kind:r,...c==="ledger_projection"?{outcome:o,sourceEvent:{...d}}:{diagnosticOutcome:n},outcomeCode:Td(i),startedAt:g,endedAt:h,durationMs:h-g,attributes:{...y.attributes},attributePolicy:{redactedCount:y.redactedCount,droppedCount:y.droppedCount,truncatedCount:y.truncatedCount}};return Ir({...S,recordId:aa(S)})}function qn({trace:e,name:t,kind:r="workflow",outcome:n,outcomeCode:o=null,startedAt:i,endedAt:a,attributes:l={},tenantId:s=null,workflowId:c=null,streamKey:d=null}={}){return Cd({trace:e,name:t,kind:r,diagnosticOutcome:n,outcomeCode:o,startedAt:i,endedAt:a,attributes:l,authority:"diagnostic",tenantId:s,workflowId:c,streamKey:d})}function Mn(e){if(!kr(e)||!Object.isFrozen(e)||e.schemaVersion!==oa||e.recordType!=="oracle.workflow.telemetry")return!1;let{recordId:t,...r}=e;return typeof t=="string"&&t===aa(r)}function jn({exporter:e=null}={}){if(e!=null&&typeof e!="function"&&typeof e?.export!="function")throw new B("exporter must be a function or expose export(record)");let t=typeof e=="function"?e:e?.export?.bind(e);return Object.freeze({exporterConfigured:!!t,defaultExporter:"none",async emit(r){let n=Mn(r)?r:qn(r);if(!t)return Object.freeze({record:n,exported:!1,exporterFailed:!1});try{return await t(n),Object.freeze({record:n,exported:!0,exporterFailed:!1})}catch{return Object.freeze({record:n,exported:!1,exporterFailed:!0})}}})}var _d="ORACLE_LEDGER_DUAL_WRITE",da=/^[a-f0-9]{64}$/,$d=/^0x[a-f0-9]{64}$/,Rd=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});function At(e,t){return String(e??"").slice(0,t)}function fa(e=process.env){return String(e?.[_d]??"")==="1"}function pa({path:e,tenantId:t="local-signer",nowMs:r=Date.now,onError:n=null,telemetry:o=null,append:i=Bn}={}){if(typeof e!="string"||e.trim().length===0)throw new Error("ledger observer requires an explicit ledger path");if(typeof i!="function")throw new Error("ledger observer requires an append function");let a=typeof n=="function"?n:()=>{},l=new Map,s=Promise.resolve(),c=()=>new Date(r()).toISOString();function d(f,p,w){if(!(!o||typeof o.emit!="function"))try{let g=r(),h=qn({trace:f.trace,name:p,kind:"workflow",outcome:Rd[p]??"succeeded",startedAt:g,endedAt:g,attributes:w,tenantId:t,workflowId:f.workflowId});s=s.then(()=>o.emit(h)).catch(y=>{a(`signer telemetry emit failed: ${At(y?.message||y,200)}`)})}catch(g){a(`signer telemetry record failed: ${At(g?.message||g,200)}`)}}function u(f,p,{external:w=!1,source:g="local-signer",reference:h=null,data:y={}}={}){let E=c(),S={tenantId:t,id:`${f.workflowId}:${p}`,workflowId:f.workflowId,idempotencyKey:`${f.workflowId}:${p}`,occurredAt:E,recordedAt:E,type:p,external:w,evidence:{status:"verified",source:w?"external":g,reference:`${w?`${g}:`:""}${h??`${p}:${f.workflowId}`}`},data:y};return s=s.then(()=>i({path:e,event:S})).catch(v=>{a(`workflow ledger dual-write failed for ${p}: ${At(v?.message||v,200)}`)}),d(f,p,{digest:f.digest}),s}function m(f){let p=String(f??"").toLowerCase();return da.test(p)?l.get(p)??null:null}return Object.freeze({queued({digest:f,createdAtMs:p}={}){let w=String(f??"").toLowerCase();if(!da.test(w))return a("ledger observer: queued without a valid artifact digest"),s;let g=Number.isFinite(Number(p))?Number(p):r(),h={workflowId:`signer-${w}-${g}`,digest:w,trace:la()};return l.set(w,h),u(h,"workflow.drafted",{source:"local-signer-queue",reference:`artifact:${w}`,data:{intentSpecId:`${h.workflowId}:intent`}}),u(h,"workflow.checked",{source:"local-signer-policy",reference:`artifact:${w}`,data:{checksPassed:!0}}),u(h,"workflow.approval_requested",{source:"local-signer-queue",reference:`artifact:${w}`}),s},denied({digest:f}={}){let p=m(f);return p&&(l.delete(p.digest),u(p,"workflow.cancelled",{source:"owner-ack",reference:`deny:${p.digest}`})),s},approved({digest:f,channel:p="owner-ack"}={}){let w=m(f);return w&&u(w,"workflow.approval_granted",{external:!0,source:p,reference:`ack:${w.digest}`}),s},executed({digest:f,owner:p=null,result:w=null}={}){let g=m(f);if(!g)return s;l.delete(g.digest),u(g,"workflow.signed",{external:!0,reference:`signed:${g.digest}`,data:{artifactHash:g.digest,signer:At(p||"owner-wallet",256)}});let h=w?.hash??w?.txHash??w?.transactionHash??w?.signature??null,y=typeof h=="string"?h.trim().toLowerCase():null;return y&&$d.test(y)?u(g,"workflow.submitted",{external:!0,reference:`submitted:${g.digest}`,data:{transactionHash:y,endpoint:"local-signer-broadcast"}}):h&&u(g,"workflow.annotated",{reference:`submission:${g.digest}`,data:{note:"non-evm-submission-reference",reference:At(h,512)}}),s},failed({digest:f,reason:p=""}={}){let w=m(f);return w&&(l.delete(w.digest),u(w,"workflow.failed",{reference:`failed:${w.digest}`,data:{reason:At(p,300)}})),s},flush(){return s}})}import{appendFileSync as Ld,existsSync as Pd,mkdirSync as Bd,renameSync as Dd,statSync as Fd}from"node:fs";import{dirname as qd}from"node:path";var Md="ORACLE_TELEMETRY_JSONL",jd=32*1024*1024,ma=4096;function Hd({path:e,maxBytes:t=jd}={}){if(typeof e!="string"||e.trim().length===0)throw new B("jsonl exporter requires an explicit file path","invalid-exporter-path");let r=Number(t);if(!Number.isFinite(r)||r<ma)throw new B(`jsonl exporter maxBytes must be >= ${ma}`,"invalid-exporter-cap");let n=e;return Object.freeze({path:n,maxBytes:r,export(o){if(!Mn(o))throw new B("jsonl exporter accepts only sealed workflow telemetry records","invalid-record");let i=`${JSON.stringify(o)}
 `;Bd(qd(n),{recursive:!0,mode:448}),Pd(n)&&Fd(n).size+Buffer.byteLength(i)>r&&Dd(n,`${n}.1`),Ld(n,i,{mode:384})}})}function wa(e=process.env,{maxBytes:t}={}){let r=String(e?.[Md]??"").trim();return r?jn({exporter:Hd({path:r,...t===void 0?{}:{maxBytes:t}})}):jn({})}import{createCipheriv as ky,createDecipheriv as zd,randomBytes as Wd,scryptSync as Ud}from"node:crypto";import P from"node:fs";import vt from"node:path";var Vd="ORACLE-LOCAL-VAULT",Jd=1,Tr=Object.freeze({N:1<<17,r:8,p:1}),Kd=256*1024*1024,Gd=16*1024;function Or(e,t,r,{max:n=t}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${r} encoding`);let o=Buffer.from(e,"base64");if(o.toString("base64")!==e||o.length<t||o.length>n)throw new Error(`local-vault: invalid ${r} length`);return o}function Yd(e,t,r=Tr){let n=String(e??"");if(n.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Ud(n,t,32,{...r,maxmem:Kd})}function ha(e,t){if(e?.magic!==Vd||e?.version!==Jd)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==Tr.N||e.kdf.r!==Tr.r||e.kdf.p!==Tr.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let r=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!r.includes(u)))throw new Error("local-vault: unexpected vault field");let n=Or(e.kdf.salt,32,"salt"),o=Or(e.cipher.iv,12,"iv"),i=Or(e.tag,16,"tag"),a=Or(e.ciphertext,1,"ciphertext",{max:Gd}),{ciphertext:l,tag:s,...c}=e,d=Yd(t,n);try{let u=zd("aes-256-gcm",d,o);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(i),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function Xd(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function Zd(e){let t=vt.dirname(e),r=P.lstatSync(t);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(r.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((r.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let n=P.lstatSync(e);if(n.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!n.isFile()||n.uid!==process.getuid?.()||n.nlink!==1)throw new Error("local-vault: unsafe destination file");if(n.dev!==r.dev)throw new Error("local-vault: destination device mismatch")}catch(n){if(n.code!=="ENOENT")throw n}}function _(e){let t;try{t=P.openSync(e,P.constants.O_RDONLY|P.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=P.fstatSync(t);if(Xd(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let n=P.lstatSync(e);if(n.isSymbolicLink()||n.dev!==r.dev||n.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return P.readFileSync(t,"utf8").replace(/[\r\n]+$/,"")}finally{P.closeSync(t)}}function ga(e){return JSON.parse(_(e))}function he(e,t){P.mkdirSync(vt.dirname(e),{recursive:!0,mode:448}),Zd(e);let r=vt.join(vt.dirname(e),`.${vt.basename(e)}.${process.pid}.${Wd(6).toString("hex")}.tmp`);try{let n=P.openSync(r,P.constants.O_CREAT|P.constants.O_EXCL|P.constants.O_WRONLY|P.constants.O_NOFOLLOW,384);try{P.writeFileSync(n,String(t)),P.fsyncSync(n)}finally{P.closeSync(n)}P.renameSync(r,e),P.chmodSync(e,384);let o=P.openSync(vt.dirname(e),"r");try{P.fsyncSync(o)}finally{P.closeSync(o)}}catch(n){try{P.unlinkSync(r)}catch{}throw n}}var ya=/^0x[0-9a-fA-F]+$/,Qd=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});function ef(e){let t=process.env[`ORACLE_PRIVATE_RELAY_${Number(e)}`];if(!t)return null;let r=t.split(",").map(n=>n.trim()).filter(Boolean);return r.length?r:null}function tf(e,{requirePrivate:t=!1}={}){let r=Number(e);if(!Number.isInteger(r))throw new Error("resolvePrivateRelay: chainId must be an integer");let n=Qd[r]||{name:`chain-${r}`,mode:"public-only",endpoints:[]},o=ef(r),i=o||n.endpoints,a=o&&n.mode==="public-only"?"mempool-private":n.mode,l=i.length>0&&a!=="public-only";if(t&&!l)throw new Error(`private relay: no keyless private endpoint for chain ${r} (${n.name}); set ORACLE_PRIVATE_RELAY_${r} to force one, or allow public fallback`);return{chainId:r,name:n.name,mode:a,endpoints:[...i],source:o?"env":"builtin",hasPrivate:l}}async function Ea(e,{chainId:t,requirePrivate:r=!1,allowPublicFallback:n=!0,fetchImpl:o,timeoutMs:i=8e3}={}){if(typeof e!="string"||!ya.test(e))throw new Error("submitPrivate: signedRawTx must be a 0x-hex string");let a=tf(t,{requirePrivate:r}),l=o||globalThis.fetch;if(!l)throw new Error("submitPrivate: no fetch implementation available");let s=[];for(let c of a.endpoints){let d=new AbortController,u=setTimeout(()=>d.abort(),i);try{let m=await l(c,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_sendRawTransaction",params:[e]}),signal:d.signal}),f=await m.text(),p=null;try{p=JSON.parse(f)}catch{}if(p&&p.result&&ya.test(p.result))return{hash:p.result,endpoint:c,mode:a.mode,chainId:a.chainId,fellBack:!1};s.push({endpoint:c,error:p&&p.error&&p.error.message||`http ${m.status}`})}catch(m){s.push({endpoint:c,error:String(m&&m.message||m).slice(0,160)})}finally{clearTimeout(u)}}if(n&&!r)return{fellBack:!0,mode:a.mode,chainId:a.chainId,attempts:s};throw new Error(`submitPrivate: all private endpoints failed for chain ${a.chainId} (${s.map(c=>`${c.endpoint}:${c.error}`).join("; ")||"none configured"})`)}import{createHmac as nf,randomBytes as of,timingSafeEqual as af}from"node:crypto";import G from"node:fs";import rt from"node:path";import{homedir as Hn}from"node:os";import{join as zn}from"node:path";var ba=process.env.ORACLE_PUBLIC_DESKTOP==="1",rf=ba?process.env.ORACLE_CONFIG_DIR||zn(Hn(),".config","oracle"):zn(Hn(),".config","oracle"),$y=ba?rf:zn(Hn(),".config","mad-desk");var Dy="0".repeat(64),Fy=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function Nr(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(Nr).join(",")+"]":"{"+Object.keys(e).sort().map(r=>JSON.stringify(r)+":"+Nr(e[r])).join(",")+"}"}var qy=Promise.resolve();function nt(e,t){if(!e)throw new Error("ledger: separate freshness anchor required");let r=a=>{try{return G.realpathSync(a)}catch{return rt.resolve(a)}},n=r(rt.dirname(rt.resolve(e))),o=r(rt.dirname(rt.resolve(t))),i=(a,l)=>l===a||l.startsWith(a+rt.sep);if(i(n,o)||i(o,n))throw new Error("ledger: separate freshness anchor required")}var sf=864e5,ne=(e,t)=>nf("sha256",t).update(Nr(e)).digest("hex"),Ae=(e,t)=>{let r=Buffer.from(String(e)),n=Buffer.from(String(t));return r.length===n.length&&af(r,n)},cf=e=>{if(!e||typeof e!="object"||Array.isArray(e)||!("triggerAttestation"in e))return e;let{triggerAttestation:t,...r}=e;return r};function lf(e,t){if(e?.integrity?.algorithm!=="hmac-sha256-canonical-json-v1"||!Ae(e.integrity.mac,ne(e.policy,t)))throw new Error("policy: integrity verification failed");return structuredClone(e.policy)}function _r(e,t){if(!e)throw new Error("policy: sequence anchor required");let r;try{r=_(e)}catch{return{sequence:0,present:!1}}let n;try{n=JSON.parse(r)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!Ae(n?.integrity?.mac,ne(n?.marker,t)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(n?.marker?.policySequence||0),policyMac:n?.marker?.policyMac??null,present:!0,ledgerInitialized:n?.marker?.ledgerInitialized===!0}}function uf(e,t,r,n=null,{ledgerInitialized:o}={}){if(n==null||!String(n))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let i=o===!0;if(o===void 0)try{let l=_r(e,r);i=l.present&&l.ledgerInitialized===!0}catch{i=!1}let a={policySequence:Number(t),policyMac:String(n)};i&&(a.ledgerInitialized=!0),he(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:ne(a,r)}})+`
 `)}function df(e,t){let r=_r(e,t);if(!r.present)throw new Error("policy: sequence anchor required");if(r.ledgerInitialized)return!0;if(r.policyMac==null)throw new Error("policy: sequence anchor does not bind this sealed policy");return uf(e,r.sequence,t,r.policyMac,{ledgerInitialized:!0}),!0}function $r(e,t,{sequenceAnchorFile:r}={}){if(!r)throw new Error("policy: sequence anchor required");let n=_(t),o;try{o=JSON.parse(_(e))}catch(s){throw new Error(`policy: cannot read sealed policy: ${s?.message||s}`)}let i=lf(o,n);nt(r,e);let a=_r(r,n),l=Number(i.policySequence||0);if(!a.present)throw new Error("policy: sequence anchor is missing for an existing policy");if(l!==a.sequence)throw new Error("policy: rolled back to a superseded policy");if(a.policyMac==null)throw new Error("policy: sequence anchor does not bind this sealed policy");if(!Ae(a.policyMac,o?.integrity?.mac))throw new Error("policy: anchor does not match this sealed policy");return i}function kt(e,t,r,n,o){let i=`${e}.continuity`,a;try{let l=JSON.parse(_(e));if(l?.integrity?.algorithm!=="hmac-sha256-canonical-json-v1"||!Ae(l?.integrity?.mac,ne(l.ledger,t)))throw new Error("integrity verification failed");if(a=l.ledger,!Number.isFinite(a?.windowStartMs)||!Array.isArray(a?.entries)||a.sequence!==void 0&&(!Number.isSafeInteger(a.sequence)||a.sequence<0))throw new Error("invalid ledger")}catch(l){if(l?.code==="ENOENT"){if(G.existsSync(i)||G.existsSync(n))throw new Error("ledger: missing after initialization");if(o){let s=_r(o,t);if(s.present&&s.ledgerInitialized)throw new Error("ledger: missing after initialization")}return{windowStartMs:r,entries:[],sequence:0}}throw new Error(`ledger: corrupt or unreadable: ${l?.message||l}`)}try{let l=JSON.parse(_(i));if(l?.integrity?.algorithm!=="hmac-sha256-canonical-json-v1"||!Ae(l?.integrity?.mac,ne(l.marker,t)))throw new Error("continuity verification failed");if(l.marker?.version===2&&(l.marker.sequence!==a.sequence||!Ae(l.marker.ledgerMac,ne(a,t))))throw new Error("continuity rollback detected");if(l.marker?.version!==2&&a.sequence!==void 0)throw new Error("continuity rollback detected");if(G.existsSync(n)&&(l.marker?.version!==2||a.sequence===void 0))throw new Error("legacy ledger rollback detected after checkpoint initialization");if(l.marker?.version===2){let s=JSON.parse(_(n));if(s?.integrity?.algorithm!=="hmac-sha256-canonical-json-v1"||!Ae(s?.integrity?.mac,ne(s.marker,t))||s.marker?.version!==1||s.marker.sequence!==a.sequence||!Ae(s.marker.ledgerMac,ne(a,t)))throw new Error("checkpoint rollback detected")}}catch(l){throw new Error(`ledger: corrupt or unreadable: ${l?.message||l}`)}if(r-a.windowStartMs>=sf){let l=new Date(r).toISOString().slice(0,10),s=d=>String(d||"").startsWith("cex:")&&String(d).endsWith(`:${l}`),c=a.entries.map(d=>{if(d.state==="reserved"||d.state==="consumed")return d;if(Array.isArray(d.units)){let u=d.units.map(f=>s(f.unit)?f:{...f,value:"0",notional:"0"}),m=u.some(f=>BigInt(f.value??0)>0n||BigInt(f.notional??0)>0n);return{...d,state:m?d.state:"consumed",units:u}}return s(d.unit)?d:{...d,state:"consumed",value:"0",notional:"0"}});return{windowStartMs:r,entries:c,sequence:a.sequence??0}}return{...a,sequence:a.sequence??0}}function ff(e){return Array.isArray(e.units)?e.units:[{unit:e.unit||"wei",value:e.value,notional:e.notional,fee:e.fee}]}function je(e,t,r){return e.reduce((n,o)=>{let i=ff(o).find(a=>a.unit===r);return i?n+BigInt(i[t]??0):n},0n)}function Wn(e){if(!Array.isArray(e)||e.length===0)throw new Error("ledger: units array required");let t=new Set,r=e.map(n=>{let o=String(n?.unit||"");if(!o)throw new Error("ledger: unit required");if(t.has(o))throw new Error("ledger: duplicate unit in units array");t.add(o);let i=BigInt(n.value??0),a=BigInt(n.notional??0);if(i<0n||a<0n)throw new Error("ledger: unit value/notional must be non-negative");let l=n.fee===void 0?0n:BigInt(n.fee);if(l<0n)throw new Error("ledger: unit fee must be non-negative");return{unit:o,value:i.toString(),notional:a.toString(),fee:l.toString()}});return r.sort((n,o)=>n.unit<o.unit?-1:n.unit>o.unit?1:0),r}function pf(e,t){let r=e[t];if(r==null||r==="")throw new Error(`ledger: ${t} required`);return ee(r,`ledger: ${t}`)}function Cr(e,t){if(String(t).startsWith("cex:")){let[,n,o,i,a,l]=String(t).split(":");if(!/^[A-Za-z0-9._-]{1,64}$/.test(n||"")||!/^[A-Za-z0-9._-]{1,64}$/.test(o||"")||!/^[a-z0-9._-]{1,32}$/.test(i||"")||!/^[A-Z0-9._-]{1,24}$/.test(a||"")||!/^\d{4}-\d{2}-\d{2}$/.test(l||""))throw new Error("ledger: invalid CEX accounting unit");let s=e.cexAccounts?.[n];if(!s||String(s.accountId)!==o||!Array.isArray(s.venues)||!s.venues.includes(i))throw new Error("ledger: CEX account/venue policy required");if(!s.symbolQuotes||!Object.values(s.symbolQuotes).includes(a))throw new Error("ledger: CEX quote policy required");let c=ee(s.dailyGrossQuoteCap,"ledger: dailyGrossQuoteCap"),d=ee(s.perOrderQuoteCap,"ledger: perOrderQuoteCap");return[c,c,d]}if(String(t).startsWith("erc20:")){let n=String(t).slice(6).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw new Error("ledger: invalid ERC20 accounting unit");let o=Object.entries(e.tokenCaps||e.nftPaymentTokenCaps||{}).find(([a])=>String(a).toLowerCase()===n)?.[1];if(!o)throw new Error("ledger: ERC-20 token caps required");let i=["maxDailyValueRaw","maxDailyNotionalRaw","maxPerTradeRaw"];for(let a of i)if(o[a]===void 0||o[a]===null||o[a]==="")throw new Error(`ledger: ${a} required`);return i.map(a=>BigInt(o[a]))}let r=t==="wei"?["maxDailyValueWei","maxDailyNotional","maxPerTrade"]:t==="sats"?["maxDailyValueSats","maxDailyNotionalSats","maxPerTradeSats"]:t==="lamports"?["maxDailyValueLamports","maxDailyNotionalLamports","maxPerTradeLamports"]:t==="usdc"?["maxDailyValueUsdc","maxDailyNotionalUsdc","maxPerTradeUsdc"]:null;if(!r)throw new Error("ledger: unsupported accounting unit");if(t==="usdc"){let n=r.filter(s=>e[s]!==void 0&&e[s]!==null&&e[s]!=="");if(n.length===r.length)return r.map(s=>pf(e,s));if(n.length>0){let s=r.filter(c=>!n.includes(c));throw new Error(`ledger: ${s[0]} required`)}let o=e.maxDailyNotionalUsd??e.maxNotionalUsd??e.maxNotionalUsdc,i=e.maxPerTradeUsd??e.maxNotionalUsd??e.maxNotionalUsdc;if(o==null||o==="")throw new Error("ledger: maxDailyValueUsdc required");if(i==null||i==="")throw new Error("ledger: maxPerTradeUsdc required");let a=q(o,6,"ledger: maxDailyNotionalUsdc"),l=q(i,6,"ledger: maxPerTradeUsdc");return[a,a,l]}for(let n of r)if(e[n]===void 0||e[n]===null||e[n]==="")throw new Error(`ledger: ${n} required`);return r.map(n=>BigInt(e[n]))}function It(e,t){let r=`${e}.lock`,n=of(16).toString("hex"),o;try{o=G.openSync(r,G.constants.O_CREAT|G.constants.O_EXCL|G.constants.O_WRONLY|(G.constants.O_NOFOLLOW||0),384),G.writeFileSync(o,n),G.fsyncSync(o)}catch(i){throw o!==void 0&&G.closeSync(o),i?.code==="EEXIST"?new Error("ledger: busy"):i}try{return t()}finally{G.closeSync(o);try{_(r)===n&&G.unlinkSync(r)}catch{}}}function He(e,t,r,n,o){let i=`${e}.continuity`,a={...t,sequence:(t.sequence??0)+1},l=ne(a,r);he(e,JSON.stringify({ledger:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:l}})+`
 `);let s={version:2,sequence:a.sequence,ledgerMac:l};he(i,JSON.stringify({marker:s,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:ne(s,r)}})+`