@oracle-agent/oracle 0.35.31 → 0.35.34

package/dist/cli/commands/venues.mjs

@@ -1,3 +1,3 @@
-var d=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(o){throw t=[o],o}};var T,Jt,J=d(()=>{T={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},Jt=new Map(Object.values(T).map(e=>[e.chainId,e]))});var G=d(()=>{});var mn,L=d(()=>{G();mn=64*1024});import{wordlists as Ni}from"ethers";var re=d(()=>{});var Zi,Qi,ea,pe=d(()=>{Zi=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),Qi=Object.freeze(["read","simulate"]),ea=1440*60});var la,ua,da,me=d(()=>{pe();la=Object.freeze(["privkey","wif","xprv","seed"]),ua=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),da=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"])});var ge=d(()=>{});import S from"node:fs";import _t from"node:os";import p from"node:path";import{fileURLToPath as Nt}from"node:url";function xe(){return process.env.ORACLE_FAKE_HOME||_t.homedir()}function Rt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function A(){return Rt()?process.env.ORACLE_CONFIG_DIR||p.join(xe(),".config","oracle"):p.join(xe(),".config","oracle")}function Lt(){return p.join(A(),"desk.json")}function $t(){return p.join(A(),"env")}function f({force:e=!1}={}){if(f._done&&!e)return f._result||null;f._done=!0;let r={},t=(i,n)=>{if(n==null)return;let s=String(n).trim();s&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=s,r[i]=s))};try{let i=$t();if(S.existsSync(i))for(let n of S.readFileSync(i,"utf8").split(/\r?\n/)){let s=n.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let a=s[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),t(s[1],a)}}catch{}try{let i=Lt();if(S.existsSync(i)){let n=JSON.parse(S.readFileSync(i,"utf8"));n&&typeof n=="object"&&(t("ORACLE_DESK_URL",n.deskUrl||n.dataUrl||n.url),t("ORACLE_DATA_URL",n.dataUrl||n.deskUrl||n.url),t("ORACLE_API_URL",n.apiUrl||n.dataUrl||n.deskUrl),t("ORACLE_PUBLIC_URL",n.publicUrl||n.deskUrl||n.dataUrl),t("ORACLE_EXEC_URL",n.execUrl),t("MAD_DESK_URL",n.deskUrl||n.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(t("ORACLE_DESK_URL",o),t("ORACLE_DATA_URL",o),t("ORACLE_API_URL",o),t("ORACLE_PUBLIC_URL",o),t("MAD_DESK_URL",o)),f._result=Object.keys(r).length?r:null,f._result}var Ct,Hu,Se=d(()=>{Ct=p.dirname(Nt(import.meta.url)),Hu=p.resolve(Ct,"../..");try{f()}catch{}});J();import z from"node:fs";import be from"node:path";import{homedir as Ot}from"node:os";function _(e){let r=e?.transactionHash||e?.hash||e?.txid||null;return r?{happened:!0,hash:String(r),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import l from"node:path";import kt from"node:os";import{createHash as It,randomBytes as Ml}from"node:crypto";import{Interface as H,keccak256 as zl}from"ethers";import{Transaction as Wl}from"@scure/btc-signer";import{ed25519 as Jl}from"@noble/curves/ed25519.js";import{base58 as gi}from"@scure/base";import{Interface as ee}from"ethers";import{Interface as Le,MaxUint256 as _r,isAddress as Nr,keccak256 as Cr,toUtf8Bytes as Rr}from"ethers";import{Interface as Ce,isAddress as ur}from"ethers";import{isAddress as or}from"ethers";var mr=new Ce(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Re,isAddress as gr}from"ethers";var xr=new Re(["function approve(address spender,uint256 amount) returns (bool)"]),Sr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Fr=new Le(["function approve(address spender,uint256 amount) returns (bool)"]);var jr=300*1e3,Mr=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Vr,NETWORK as Jr,OutScript as Kr,RawTx as Gr,SigHash as Yr,TEST_NETWORK as Xr,Transaction as Zr}from"@scure/btc-signer";import{createHash as $e}from"node:crypto";import{base58 as rn}from"@scure/base";import{getCompiledTransactionMessageDecoder as on}from"@solana/transaction-messages";var K=e=>$e("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),an=new Map([[K("route"),{name:"route",prefixBytes:0}],[K("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);L();var kn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),In=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var _n="0x"+"00".repeat(32);var Be=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),$n=Object.freeze(Be.map(e=>e[0]));import{TypedDataEncoder as fo,getAddress as po}from"ethers";import{TypedDataEncoder as qn,getAddress as jn,isAddress as Mn}from"ethers";var Fe=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),qe=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});L();import{TypedDataEncoder as Zn,getAddress as Qn,isAddress as eo}from"ethers";var Un=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var je=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),so=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Me=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),co=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var ho=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Je=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var Lo=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var Ke=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),$o=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Po=new ee(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Bo=new ee(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Do=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ge=Object.freeze([...Je]),Fo=Object.freeze({...Ke});import{ed25519 as ei}from"@noble/curves/ed25519.js";import{base58 as ri}from"@scure/base";import{RawTx as oi,SigHash as ii,Transaction as ai}from"@scure/btc-signer";import{Transaction as ci,keccak256 as li,verifyTypedData as ui}from"ethers";import{encode as Mo}from"@msgpack/msgpack";import{keccak256 as zo,verifyTypedData as Uo}from"ethers";var Wo=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Vo=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});re();import{wordlists as $i}from"ethers";var ne=64*1024;var Bi=32*1024;var et=["schemaVersion","buildVersion","recordType","execution","custody"],qi=[...et,"recordHash"];var ji=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var tt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),fe=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),Wi=new Set(fe);var st=64*1024*1024;me();var q=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),wa=Object.freeze(Object.fromEntries(q.map((e,r)=>[e,Object.freeze(r+1<q.length?[q[r+1]]:[])])));var ct=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var ut=Object.freeze(["owner","operator","agent","viewer"]),dt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),ft=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),Qa=Object.freeze(["owner"]),es=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),ts=new Set(ut),rs=new Set(dt),ns=new Set(Object.values(ft));var pt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),os=Object.freeze(Object.fromEntries(Object.entries(pt).map(([e,r])=>[e,Object.freeze([...r])])));var mt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),wt=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),ht=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var cs=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),ls=new Set(mt),us=new Set(wt),ds=new Set(ht);var fs=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var ps=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var Es=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var ks=32*1024*1024;var Os=Object.freeze({N:1<<17,r:8,p:1}),Ts=256*1024*1024,_s=16*1024;var Cs=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{homedir as j}from"node:os";import{join as M}from"node:path";var we=process.env.ORACLE_PUBLIC_DESKTOP==="1",gt=we?process.env.ORACLE_CONFIG_DIR||M(j(),".config","oracle"):M(j(),".config","oracle"),Ps=we?gt:M(j(),".config","mad-desk");var js="0".repeat(64),Ms=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Hs=Promise.resolve();ge();import{readFileSync as Qs,readdirSync as ec,existsSync as yt}from"node:fs";import{dirname as Et,join as h}from"node:path";import{fileURLToPath as bt}from"node:url";var g=Et(bt(import.meta.url));function xt(){let e=[h(g,"descriptors"),h(g,"clear-sign","descriptors"),h(g,"..","clear-sign","descriptors"),h(g,"..","..","clear-sign","descriptors"),h(g,"..","..","..","clear-sign","descriptors")];for(let r of e)if(yt(r))return r;return e[0]}var oc=xt();var ic=(1n<<256n)-1n;import{Wallet as mc}from"ethers";import{base58 as hc}from"@scure/base";import{ed25519 as yc}from"@noble/curves/ed25519.js";import{NETWORK as bc,TEST_NETWORK as xc,WIF as Sc,p2wpkh as Ac}from"@scure/btc-signer";import{pubECDSA as kc}from"@scure/btc-signer/utils.js";var Tc=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),_c=Object.freeze(["binance","bybit","okx","coinbase"]),Nc=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),Cc=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),Rc=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),Lc=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),$c=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),Pc=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),Bc=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Dc=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Fc=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var vt=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),ye=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Kc=256*1024;var Au=new H(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),vu=new H(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),ku=new H(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ee(e){let r=process.env.ORACLE_SIGNER_STATE_DIR||l.join(process.env.XDG_STATE_HOME||l.join(kt.homedir(),".local","state"),"oracle"),t=It("sha256").update(l.resolve(e)).digest("hex").slice(0,16);return{vault:l.join(e,"vault.json"),policy:l.join(e,"signer-policy.json"),policyKey:l.join(e,"policy-integrity-key"),policyAnchor:l.join(r,`signer-policy-${t}.high-water`),ledger:l.join(e,"signer-ledger.json"),ledgerAnchor:l.join(r,`signer-ledger-${t}.high-water`),cexOrders:l.join(e,"cex-orders.json"),cexOrdersAnchor:l.join(r,`cex-orders-${t}.high-water`),token:l.join(e,"signer-token"),lock:l.join(r,`signer-${t}.lock`),workflowLedger:l.join(e,"workflow-events.jsonl")}}function Tt(){return process.env.ORACLE_CONFIG_DIR||be.join(Ot(),".config","oracle")}function x(){let e=Ee(be.join(Tt(),"signer")),r=z.existsSync(e.vault),t=z.existsSync(e.lock),o=r?t?"disarmed":"armed-owner-confirmed":"inert-no-key";return{vaultExists:r,policyConfigured:z.existsSync(e.policy),armed:r&&!t,disarmed:t,capabilities:{swap:o,bridge:o},autonomous:!1,note:"Keys stay on this machine. Exact confirmation is required before any broadcast."}}var Bu=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_pending",description:"List pending local-signer artifacts. Read-only. Does not approve, sign, or broadcast.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_queue",description:"Queue a prepared unsigned artifact on the loopback signer. Does not broadcast.",parameters:{type:"object",properties:{artifact:{type:"object"}},required:["artifact"],additionalProperties:!1}}},{type:"function",function:{name:"signer_ack",description:"Execute one pending artifact through the armed local signer (same path as Telegram Allow). Fails if the signer is not running or disarmed. Never holds keys.",parameters:{type:"object",properties:{id:{type:"string"},digest:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"signer_deny",description:"Drop one pending local-signer artifact. Nothing signed.",parameters:{type:"object",properties:{id:{type:"string"},digest:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);Se();import ve from"node:fs";import qt from"node:path";var Pt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function v(e){return String(e||"").trim()||void 0}function Bt(e,{required:r=!1}={}){let t=v(e)?.toLowerCase();if(!t){if(r)throw new Error("model provider is required");return}if(!Pt.has(t))throw new Error(`unsupported provider: ${t}`);return t}function Dt(e,{required:r=!1}={}){let t=v(e);if(!t){if(r)throw new Error("model is required");return}if(t.includes("..")||t.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(t))throw new Error("invalid model id");return t}function Ft(e){let r=v(e);if(!r||r.length>2048)throw new Error("invalid custom base URL");let t;try{t=new URL(r)}catch{throw new Error("invalid custom base URL")}let o=t.hostname.toLowerCase().replace(/^\[|\]$/g,""),i=o==="localhost"||o==="127.0.0.1"||o==="::1";if(t.protocol!=="https:"&&!(t.protocol==="http:"&&i)||t.username||t.password||t.search||t.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return t.toString().replace(/\/+$/,"")}function Ae({provider:e,model:r,baseUrl:t}={},{requireModel:o=!1}={}){let i=Bt(e),n=Dt(r,{required:o});if(i==="custom")return{provider:i,...n?{model:n}:{},baseUrl:Ft(t)};if(v(t))throw new Error("baseUrl is only supported for the custom provider");return{...i?{provider:i}:{},...n?{model:n}:{}}}var jt=new Set(["auto","standalone","hermes","remote","arch"]);function Mt(){return qt.join(A(),"model.json")}function m(e){return String(e||"").trim()||void 0}function Ht(e={}){let r=m(e.backend)?.toLowerCase()||"auto",t=Ae({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:r==="standalone"}),o=m(e.apiKeyEnv),i=Number.parseInt(String(e.contextLength||""),10),n=m(e.reasoningEffort),s=m(e.computeHost||e.remoteHost),a=m(e.computeUser||e.remoteUser),c=m(e.computePath||e.remotePath);if(!jt.has(r))throw new Error(`unsupported backend: ${r}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(r))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(r==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:r,...t,...o?{apiKeyEnv:o}:{},...Number.isFinite(i)&&i>0?{contextLength:i}:{},...n?{reasoningEffort:n}:{},...s?{computeHost:s}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function ke(){let e=Mt();if(!ve.existsSync(e))return null;try{return Ht(JSON.parse(ve.readFileSync(e,"utf8")))}catch{return null}}var zt=new Set(["127.0.0.1","::1","localhost"]);function U({env:e=process.env,vault:r=null}={}){let t=r||x(),o=[];for(let[i,n]of Object.entries(T)){let s=(n.rpcEnv||[]).some(c=>String(e[c]||"").trim()),a="prepare";n.evm?s&&(a="live"):a="unavailable",o.push({key:i,chainId:n.chainId,name:n.name,family:"evm",status:a,execute:!!(t.vaultExists&&t.armed&&!t.disarmed),note:s?"rpc configured":"public read/prepare; set RPC for live reads"})}return o.push({key:"solana",chainId:null,name:"Solana",family:"sol",status:"prepare",execute:!1,note:"Jupiter quote/prepare; local sol signer"},{key:"bitcoin",chainId:null,name:"Bitcoin",family:"btc",status:"prepare",execute:!1,note:"Esplora read; local btc signer"},{key:"hyperliquid-l1",chainId:null,name:"Hyperliquid L1",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not an EVM signer family"},{key:"polymarket",chainId:null,name:"Polymarket",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not a signer family"}),o}function Ut({env:e=process.env,model:r=ke(),vault:t=x(),signerReachable:o=!1,quote:i=null,reviewAvailable:n=!1,receiptAvailable:s=!1}={}){let a=[],c=(u,O,Oe,Te=null)=>a.push({id:u,status:O,detail:Oe,fix:Te}),W=(()=>{let[u,O]=process.versions.node.split(".").map(Number);return u>20||u===20&&O>=19})();c("node",W?"ok":"fail",`node ${process.versions.node}`,W?null:"install node >= 20.19"),r?r.backend==="hermes"?c("model","warn","backend=hermes (opt-in attach)","oracle model --backend standalone"):c("model","ok",`${r.backend||"auto"} ${r.provider||""} ${r.model||""}`.trim()):c("model","fail","no model.json","oracle setup model"),t.vaultExists?t.disarmed?c("vault","warn","vault present, DISARMED","oracle signer (re-arm after confirm)"):c("vault",t.armed?"ok":"warn",t.armed?"present, armed":"present, not armed"):c("vault","fail","no local vault","oracle sign init");let I=e.ORACLE_SIGNER_HOST||"127.0.0.1";if(zt.has(I)?c("signer",o?"ok":"warn",o?`loopback ${I}:${e.ORACLE_SIGNER_PORT||9462}`:"loopback signer not reachable",o?null:"oracle signer"):c("signer","fail",`signer host ${I} is not loopback`,"unset ORACLE_SIGNER_HOST"),!i)c("quote","warn","quote not probed",null);else if(i.ok){let u=String(i.detail||"net quote returned");c("quote","ok",u.length>140?`${u.slice(0,140)}\u2026`:u)}else c("quote","warn",i.detail||"quote unavailable","check network / oracle data serve");c("review",n?"ok":"fail",n?"sign-time review renders decoded action, policy hits, approval deltas":"sign-time review module missing from this build",n?null:"reinstall @oracle-agent/oracle (src/control/sign-time-review.mjs)"),c("receipt",s?"ok":"fail",s?"oracle receipt verifies on-chain state (SUCCESS/FAIL/UNKNOWN, finality-pinned)":"verified-receipt observer missing from this build",s?null:"reinstall @oracle-agent/oracle (src/desk/observe-receipt.mjs)");let Ie=a.some(u=>u.status==="fail"),V=a.filter(u=>u.status==="ok").length;return{ok:!Ie,checks:a,firstRunScore:{ok:V,total:a.length,label:`${V}/${a.length} first-run hops green`},venues:U({env:e,vault:t})}}async function od(e=process.env){let r=e.ORACLE_SIGNER_HOST||"127.0.0.1",t=e.ORACLE_SIGNER_PORT||9462;try{return(await fetch(`http://${r}:${t}/status`,{signal:AbortSignal.timeout(1500)})).ok}catch{return!1}}function k(e){let r=String(e??"?").replace(/[^\w.$-]/g,"");return r.length>12?`${r.slice(0,12)}...`:r||"?"}function Wt(e,r=120){let t=String(e??"").replace(/[\u0000-\u001f\u007f-\u009f]/g," ").replace(/\s+/g," ").trim();return t?t.length>r?`${t.slice(0,r)}...`:t:"quote failed"}async function id(){try{let e=await fetch("https://api.dexscreener.com/latest/dex/search?q=WETH%20USDC",{signal:AbortSignal.timeout(4e3)});if(!e.ok)return{ok:!1,detail:`dexscreener ${e.status}`};let t=(await e.json())?.pairs?.[0];return!t?.chainId||!t?.priceUsd?{ok:!1,detail:"no pair"}:{ok:!0,detail:`${k(t.chainId)} ${k(t.baseToken?.symbol)}/${k(t.quoteToken?.symbol)} $${k(t.priceUsd)}`}}catch(e){return{ok:!1,detail:Wt(e instanceof Error?e.message:"quote failed")}}}var ad={name:"venues",summary:"label every shipped venue live / prepare / unavailable",group:"read",usage:"oracle venues [--json]",async run(e){let r=e.argv.includes("--json"),t=U();if(r)return process.stdout.write(`${JSON.stringify({venues:t},null,2)}
+var d=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(o){throw t=[o],o}};var T,Jt,J=d(()=>{T={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},Jt=new Map(Object.values(T).map(e=>[e.chainId,e]))});var G=d(()=>{});var mn,wn,hn,gn,yn,bn,En,L=d(()=>{G();mn=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,wn=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,hn=AbortSignal.prototype.throwIfAborted,gn=EventTarget.prototype.addEventListener,yn=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null,bn=64*1024,En=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024})});import{wordlists as Fi}from"ethers";var re=d(()=>{});var as,cs,ls,pe=d(()=>{as=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),cs=Object.freeze(["read","simulate"]),ls=1440*60});var ys,bs,Es,me=d(()=>{pe();ys=Object.freeze(["privkey","wif","xprv","seed"]),bs=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),Es=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"])});var ge=d(()=>{});import S from"node:fs";import _t from"node:os";import p from"node:path";import{fileURLToPath as Nt}from"node:url";function xe(){return process.env.ORACLE_FAKE_HOME||_t.homedir()}function Rt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function A(){return Rt()?process.env.ORACLE_CONFIG_DIR||p.join(xe(),".config","oracle"):p.join(xe(),".config","oracle")}function Lt(){return p.join(A(),"desk.json")}function $t(){return p.join(A(),"env")}function f({force:e=!1}={}){if(f._done&&!e)return f._result||null;f._done=!0;let r={},t=(i,n)=>{if(n==null)return;let a=String(n).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,r[i]=a))};try{let i=$t();if(S.existsSync(i))for(let n of S.readFileSync(i,"utf8").split(/\r?\n/)){let a=n.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let s=a[2];(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t(a[1],s)}}catch{}try{let i=Lt();if(S.existsSync(i)){let n=JSON.parse(S.readFileSync(i,"utf8"));n&&typeof n=="object"&&(t("ORACLE_DESK_URL",n.deskUrl||n.dataUrl||n.url),t("ORACLE_DATA_URL",n.dataUrl||n.deskUrl||n.url),t("ORACLE_API_URL",n.apiUrl||n.dataUrl||n.deskUrl),t("ORACLE_PUBLIC_URL",n.publicUrl||n.deskUrl||n.dataUrl),t("ORACLE_EXEC_URL",n.execUrl),t("MAD_DESK_URL",n.deskUrl||n.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(t("ORACLE_DESK_URL",o),t("ORACLE_DATA_URL",o),t("ORACLE_API_URL",o),t("ORACLE_PUBLIC_URL",o),t("MAD_DESK_URL",o)),f._result=Object.keys(r).length?r:null,f._result}var Ct,Xu,Se=d(()=>{Ct=p.dirname(Nt(import.meta.url)),Xu=p.resolve(Ct,"../..");try{f()}catch{}});J();import z from"node:fs";import Ee from"node:path";import{homedir as Ot}from"node:os";function _(e){let r=e?.transactionHash||e?.hash||e?.txid||null;return r?{happened:!0,hash:String(r),note:null}:{happened:!1,hash:null,note:"no transaction hash \u2014 the action did not succeed"}}import l from"node:path";import kt from"node:os";import{createHash as It,randomBytes as Yl}from"node:crypto";import{Interface as H,keccak256 as Zl}from"ethers";import{Transaction as eu}from"@scure/btc-signer";import{ed25519 as ru}from"@noble/curves/ed25519.js";import{base58 as Ii}from"@scure/base";import{Interface as ee}from"ethers";import{Interface as Le,MaxUint256 as _r,isAddress as Nr,keccak256 as Cr,toUtf8Bytes as Rr}from"ethers";import{Interface as Ce,isAddress as ur}from"ethers";import{isAddress as or}from"ethers";var mr=new Ce(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Re,isAddress as gr}from"ethers";var xr=new Re(["function approve(address spender,uint256 amount) returns (bool)"]),Sr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var jr=new Le(["function approve(address spender,uint256 amount) returns (bool)"]);var qr=300*1e3,Mr=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Vr,NETWORK as Jr,OutScript as Kr,RawTx as Gr,SigHash as Yr,TEST_NETWORK as Xr,Transaction as Zr}from"@scure/btc-signer";import{createHash as $e}from"node:crypto";import{base58 as rn}from"@scure/base";import{getCompiledTransactionMessageDecoder as on}from"@solana/transaction-messages";var K=e=>$e("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),sn=new Map([[K("route"),{name:"route",prefixBytes:0}],[K("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);L();var $n=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Pn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var jn="0x"+"00".repeat(32);var Be=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),zn=Object.freeze(Be.map(e=>e[0]));import{TypedDataEncoder as xo,getAddress as So}from"ethers";import{TypedDataEncoder as Kn,getAddress as Gn,isAddress as Yn}from"ethers";var je=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),Fe=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});L();import{TypedDataEncoder as ao,getAddress as co,isAddress as lo}from"ethers";var Qn=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var qe=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),go=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Me=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),yo=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var ko=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Je=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var Ho=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var Ke=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),zo=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Uo=new ee(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Wo=new ee(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Vo=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ge=Object.freeze([...Je]),Jo=Object.freeze({...Ke});import{ed25519 as li}from"@noble/curves/ed25519.js";import{base58 as di}from"@scure/base";import{RawTx as pi,SigHash as mi,Transaction as wi}from"@scure/btc-signer";import{Transaction as gi,keccak256 as yi,verifyTypedData as bi}from"ethers";import{encode as Yo}from"@msgpack/msgpack";import{keccak256 as Zo,verifyTypedData as Qo}from"ethers";var ei=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),ti=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});re();import{wordlists as zi}from"ethers";var ne=64*1024;var Wi=32*1024;var et=["schemaVersion","buildVersion","recordType","execution","custody"],Ki=[...et,"recordHash"];var Gi=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var tt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),fe=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),es=new Set(fe);var at=64*1024*1024;me();var F=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),vs=Object.freeze(Object.fromEntries(F.map((e,r)=>[e,Object.freeze(r+1<F.length?[F[r+1]]:[])])));var ct=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var ut=Object.freeze(["owner","operator","agent","viewer"]),dt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),ft=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),ca=Object.freeze(["owner"]),la=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),ua=new Set(ut),da=new Set(dt),fa=new Set(Object.values(ft));var pt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),pa=Object.freeze(Object.fromEntries(Object.entries(pt).map(([e,r])=>[e,Object.freeze([...r])])));var mt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),wt=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),ht=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var ga=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),ya=new Set(mt),ba=new Set(wt),Ea=new Set(ht);var xa=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Sa=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var Ta=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var $a=32*1024*1024;var Ba=Object.freeze({N:1<<17,r:8,p:1}),Da=256*1024*1024,ja=16*1024;var qa=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{homedir as q}from"node:os";import{join as M}from"node:path";var we=process.env.ORACLE_PUBLIC_DESKTOP==="1",gt=we?process.env.ORACLE_CONFIG_DIR||M(q(),".config","oracle"):M(q(),".config","oracle"),Ua=we?gt:M(q(),".config","mad-desk");var Ga="0".repeat(64),Ya=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});var Xa=Promise.resolve();ge();import{readFileSync as cc,readdirSync as lc,existsSync as yt}from"node:fs";import{dirname as bt,join as h}from"node:path";import{fileURLToPath as Et}from"node:url";var g=bt(Et(import.meta.url));function xt(){let e=[h(g,"descriptors"),h(g,"clear-sign","descriptors"),h(g,"..","clear-sign","descriptors"),h(g,"..","..","clear-sign","descriptors"),h(g,"..","..","..","clear-sign","descriptors")];for(let r of e)if(yt(r))return r;return e[0]}var pc=xt();var mc=(1n<<256n)-1n;import{Wallet as Ac}from"ethers";import{base58 as kc}from"@scure/base";import{ed25519 as Oc}from"@noble/curves/ed25519.js";import{NETWORK as _c,TEST_NETWORK as Nc,WIF as Cc,p2wpkh as Rc}from"@scure/btc-signer";import{pubECDSA as $c}from"@scure/btc-signer/utils.js";var Dc=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),jc=Object.freeze(["binance","bybit","okx","coinbase"]),Fc=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),qc=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),Mc=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),Hc=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),zc=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),Uc=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),Wc=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Vc=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Jc=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var vt=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),ye=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var nl=256*1024;var Ru=new H(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Lu=new H(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),$u=new H(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function be(e){let r=process.env.ORACLE_SIGNER_STATE_DIR||l.join(process.env.XDG_STATE_HOME||l.join(kt.homedir(),".local","state"),"oracle"),t=It("sha256").update(l.resolve(e)).digest("hex").slice(0,16);return{vault:l.join(e,"vault.json"),policy:l.join(e,"signer-policy.json"),policyKey:l.join(e,"policy-integrity-key"),policyAnchor:l.join(r,`signer-policy-${t}.high-water`),ledger:l.join(e,"signer-ledger.json"),ledgerAnchor:l.join(r,`signer-ledger-${t}.high-water`),cexOrders:l.join(e,"cex-orders.json"),cexOrdersAnchor:l.join(r,`cex-orders-${t}.high-water`),token:l.join(e,"signer-token"),lock:l.join(r,`signer-${t}.lock`),workflowLedger:l.join(e,"workflow-events.jsonl")}}function Tt(){return process.env.ORACLE_CONFIG_DIR||Ee.join(Ot(),".config","oracle")}function x(){let e=be(Ee.join(Tt(),"signer")),r=z.existsSync(e.vault),t=z.existsSync(e.lock),o=r?t?"disarmed":"armed-owner-confirmed":"inert-no-key";return{vaultExists:r,policyConfigured:z.existsSync(e.policy),armed:r&&!t,disarmed:t,capabilities:{swap:o,bridge:o},autonomous:!1,note:"Keys stay on this machine. Exact confirmation is required before any broadcast."}}var Wu=Object.freeze([{type:"function",function:{name:"vault_status",description:"Read local Oracle vault/signer readiness. Never returns key material.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_status",description:"Ping the loopback signer. Fails closed if it is not running.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_pending",description:"List pending local-signer artifacts. Read-only. Does not approve, sign, or broadcast.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"signer_queue",description:"Queue a prepared unsigned artifact on the loopback signer. Does not broadcast.",parameters:{type:"object",properties:{artifact:{type:"object"}},required:["artifact"],additionalProperties:!1}}},{type:"function",function:{name:"signer_ack",description:"Execute one pending artifact through the armed local signer (same path as Telegram Allow). Fails if the signer is not running or disarmed. Never holds keys.",parameters:{type:"object",properties:{id:{type:"string"},digest:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"signer_deny",description:"Drop one pending local-signer artifact. Nothing signed.",parameters:{type:"object",properties:{id:{type:"string"},digest:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"signer_execute",description:"Broadcast one already-confirmed local artifact. Requires a one-use confirmationNonce from the local signer TTY confirm. Cannot mint confirmation itself.",parameters:{type:"object",properties:{artifact:{type:"object"},confirmationNonce:{type:"string",minLength:32,maxLength:128}},required:["artifact","confirmationNonce"],additionalProperties:!1}}},{type:"function",function:{name:"signer_disarm",description:"Global kill switch. Stops the local signer from broadcasting.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"receipt_report",description:"Receipt or it did not happen. Requires transactionHash/hash/txid.",parameters:{type:"object",properties:{receipt:{type:"object"},transactionHash:{type:"string"},hash:{type:"string"},txid:{type:"string"}},additionalProperties:!1}}},{type:"function",function:{name:"watch_create",description:"Create an alert-only watch. Never execute.",parameters:{type:"object",properties:{chain:{type:"string"},token:{type:"string"},condition:{type:"string"},note:{type:"string"}},required:["chain","token","condition"],additionalProperties:!1}}},{type:"function",function:{name:"watch_list",description:"List local alert-only watches.",parameters:{type:"object",properties:{},additionalProperties:!1}}},{type:"function",function:{name:"portfolio_snapshot",description:"How to read the one portfolio snapshot. knownUsd is incomplete if a provider is missing.",parameters:{type:"object",properties:{},additionalProperties:!1}}}]);Se();import ve from"node:fs";import Ft from"node:path";var Pt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function v(e){return String(e||"").trim()||void 0}function Bt(e,{required:r=!1}={}){let t=v(e)?.toLowerCase();if(!t){if(r)throw new Error("model provider is required");return}if(!Pt.has(t))throw new Error(`unsupported provider: ${t}`);return t}function Dt(e,{required:r=!1}={}){let t=v(e);if(!t){if(r)throw new Error("model is required");return}if(t.includes("..")||t.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(t))throw new Error("invalid model id");return t}function jt(e){let r=v(e);if(!r||r.length>2048)throw new Error("invalid custom base URL");let t;try{t=new URL(r)}catch{throw new Error("invalid custom base URL")}let o=t.hostname.toLowerCase().replace(/^\[|\]$/g,""),i=o==="localhost"||o==="127.0.0.1"||o==="::1";if(t.protocol!=="https:"&&!(t.protocol==="http:"&&i)||t.username||t.password||t.search||t.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return t.toString().replace(/\/+$/,"")}function Ae({provider:e,model:r,baseUrl:t}={},{requireModel:o=!1}={}){let i=Bt(e),n=Dt(r,{required:o});if(i==="custom")return{provider:i,...n?{model:n}:{},baseUrl:jt(t)};if(v(t))throw new Error("baseUrl is only supported for the custom provider");return{...i?{provider:i}:{},...n?{model:n}:{}}}var qt=new Set(["auto","standalone","hermes","remote","arch"]);function Mt(){return Ft.join(A(),"model.json")}function m(e){return String(e||"").trim()||void 0}function Ht(e={}){let r=m(e.backend)?.toLowerCase()||"auto",t=Ae({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:r==="standalone"}),o=m(e.apiKeyEnv),i=Number.parseInt(String(e.contextLength||""),10),n=m(e.reasoningEffort),a=m(e.computeHost||e.remoteHost),s=m(e.computeUser||e.remoteUser),c=m(e.computePath||e.remotePath);if(!qt.has(r))throw new Error(`unsupported backend: ${r}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(r))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(r==="remote"&&!a)throw new Error("remote backend requires computeHost");return{backend:r,...t,...o?{apiKeyEnv:o}:{},...Number.isFinite(i)&&i>0?{contextLength:i}:{},...n?{reasoningEffort:n}:{},...a?{computeHost:a}:{},...s?{computeUser:s}:{},...c?{computePath:c}:{}}}function ke(){let e=Mt();if(!ve.existsSync(e))return null;try{return Ht(JSON.parse(ve.readFileSync(e,"utf8")))}catch{return null}}var zt=new Set(["127.0.0.1","::1","localhost"]);function U({env:e=process.env,vault:r=null}={}){let t=r||x(),o=[];for(let[i,n]of Object.entries(T)){let a=(n.rpcEnv||[]).some(c=>String(e[c]||"").trim()),s="prepare";n.evm?a&&(s="live"):s="unavailable",o.push({key:i,chainId:n.chainId,name:n.name,family:"evm",status:s,execute:!!(t.vaultExists&&t.armed&&!t.disarmed),note:a?"rpc configured":"public read/prepare; set RPC for live reads"})}return o.push({key:"solana",chainId:null,name:"Solana",family:"sol",status:"prepare",execute:!1,note:"Jupiter quote/prepare; local sol signer"},{key:"bitcoin",chainId:null,name:"Bitcoin",family:"btc",status:"prepare",execute:!1,note:"Esplora read; local btc signer"},{key:"hyperliquid-l1",chainId:null,name:"Hyperliquid L1",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not an EVM signer family"},{key:"polymarket",chainId:null,name:"Polymarket",family:"data",status:"live",execute:!1,note:"data/prepare only \u2014 not a signer family"}),o}function Ut({env:e=process.env,model:r=ke(),vault:t=x(),signerReachable:o=!1,quote:i=null,reviewAvailable:n=!1,receiptAvailable:a=!1}={}){let s=[],c=(u,O,Oe,Te=null)=>s.push({id:u,status:O,detail:Oe,fix:Te}),W=(()=>{let[u,O]=process.versions.node.split(".").map(Number);return u>20||u===20&&O>=19})();c("node",W?"ok":"fail",`node ${process.versions.node}`,W?null:"install node >= 20.19"),r?r.backend==="hermes"?c("model","warn","backend=hermes (opt-in attach)","oracle model --backend standalone"):c("model","ok",`${r.backend||"auto"} ${r.provider||""} ${r.model||""}`.trim()):c("model","fail","no model.json","oracle setup model"),t.vaultExists?t.disarmed?c("vault","warn","vault present, DISARMED","oracle signer (re-arm after confirm)"):c("vault",t.armed?"ok":"warn",t.armed?"present, armed":"present, not armed"):c("vault","fail","no local vault","oracle sign init");let I=e.ORACLE_SIGNER_HOST||"127.0.0.1";if(zt.has(I)?c("signer",o?"ok":"warn",o?`loopback ${I}:${e.ORACLE_SIGNER_PORT||9462}`:"loopback signer not reachable",o?null:"oracle signer"):c("signer","fail",`signer host ${I} is not loopback`,"unset ORACLE_SIGNER_HOST"),!i)c("quote","warn","quote not probed",null);else if(i.ok){let u=String(i.detail||"net quote returned");c("quote","ok",u.length>140?`${u.slice(0,140)}\u2026`:u)}else c("quote","warn",i.detail||"quote unavailable","check network / oracle data serve");c("review",n?"ok":"fail",n?"sign-time review renders decoded action, policy hits, approval deltas":"sign-time review module missing from this build",n?null:"reinstall @oracle-agent/oracle (src/control/sign-time-review.mjs)"),c("receipt",a?"ok":"fail",a?"oracle receipt verifies on-chain state (SUCCESS/FAIL/UNKNOWN, finality-pinned)":"verified-receipt observer missing from this build",a?null:"reinstall @oracle-agent/oracle (src/desk/observe-receipt.mjs)");let Ie=s.some(u=>u.status==="fail"),V=s.filter(u=>u.status==="ok").length;return{ok:!Ie,checks:s,firstRunScore:{ok:V,total:s.length,label:`${V}/${s.length} first-run hops green`},venues:U({env:e,vault:t})}}async function pd(e=process.env){let r=e.ORACLE_SIGNER_HOST||"127.0.0.1",t=e.ORACLE_SIGNER_PORT||9462;try{return(await fetch(`http://${r}:${t}/status`,{signal:AbortSignal.timeout(1500)})).ok}catch{return!1}}function k(e){let r=String(e??"?").replace(/[^\w.$-]/g,"");return r.length>12?`${r.slice(0,12)}...`:r||"?"}function Wt(e,r=120){let t=String(e??"").replace(/[\u0000-\u001f\u007f-\u009f]/g," ").replace(/\s+/g," ").trim();return t?t.length>r?`${t.slice(0,r)}...`:t:"quote failed"}async function md(){try{let e=await fetch("https://api.dexscreener.com/latest/dex/search?q=WETH%20USDC",{signal:AbortSignal.timeout(4e3)});if(!e.ok)return{ok:!1,detail:`dexscreener ${e.status}`};let t=(await e.json())?.pairs?.[0];return!t?.chainId||!t?.priceUsd?{ok:!1,detail:"no pair"}:{ok:!0,detail:`${k(t.chainId)} ${k(t.baseToken?.symbol)}/${k(t.quoteToken?.symbol)} $${k(t.priceUsd)}`}}catch(e){return{ok:!1,detail:Wt(e instanceof Error?e.message:"quote failed")}}}var wd={name:"venues",summary:"label every shipped venue live / prepare / unavailable",group:"read",usage:"oracle venues [--json]",async run(e){let r=e.argv.includes("--json"),t=U();if(r)return process.stdout.write(`${JSON.stringify({venues:t},null,2)}
 `),0;for(let o of t)process.stdout.write(`${o.status.padEnd(12)} ${o.key.padEnd(16)} ${o.name}  exec=${o.execute?"local":"no"}
-`);return 0}};export{_ as classifyReceipt,ad as default,Wt as detailText,Ut as firstHourReport,id as probeQuote,od as probeSigner,k as symbol,x as vaultStatus};
+`);return 0}};export{_ as classifyReceipt,wd as default,Wt as detailText,Ut as firstHourReport,md as probeQuote,pd as probeSigner,k as symbol,x as vaultStatus};

package/dist/context-graph.mjs

@@ -1,3 +1,3 @@
-import{createHash as ve}from"node:crypto";var ke=1,Re=1,xe=1;var Ce=Object.freeze(["owner","operator","agent","viewer"]),De=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),ce=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),je=Object.freeze(["owner"]),I=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),ze=new Set(Ce),q=new Set(De),$e=new Set(Object.values(ce)),He=new Set(["user","service","local-owner"]),Le=new Set(["verified-session","service-credential","desktop-session","owner-arm-token","local-owner"]),J=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/,de="tob1",Pe=new WeakSet,Me=new WeakMap,le=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),bt=Object.freeze(Object.fromEntries(Object.entries(le).map(([e,t])=>[e,Object.freeze([...t])]))),A=class extends Error{constructor(t,n="invalid-context"){super(t),this.name="TenantContextError",this.code=n}};function ie(e){return!!e&&typeof e=="object"&&!Array.isArray(e)&&Object.getPrototypeOf(e)===Object.prototype}function G(e){if(e&&typeof e=="object"&&!Object.isFrozen(e)){Object.freeze(e);for(let t of Object.values(e))G(t)}return e}function Z(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(Z).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${Z(e[t])}`).join(",")}}`}function fe(e){return ve("sha256").update(Z(e)).digest("hex")}function Ye(e,t){return e.length===t.length&&e.every((n,r)=>n===t[r])}function Ve(e){if(!ie(e)||e.schemaVersion!==ke||!J.test(e.tenantId||"")||typeof e.localCompatibility!="boolean")return!1;let t=e.actor;if(!ie(t)||t.schemaVersion!==Re||!J.test(t.actorId||"")||!He.has(t.actorType)||!Le.has(t.authSource)||!Array.isArray(t.roles)||t.roles.length===0)return!1;let n=[...new Set(t.roles)].sort();return n.every(r=>ze.has(r))&&Ye(n,t.roles)}function X(e,t){j(e);let n=String(t??"").trim();if(!/^[a-z0-9][a-z0-9._-]{0,95}$/.test(n))return!1;let r=Me.get(e)||[];return r.includes("*")||r.includes(n)}function P(e,t){if(!X(e,t))throw new A("context domain access denied","domain-access-denied");return t}function H(e){return Pe.has(e)&&Ve(e)}function j(e){if(!H(e))throw new A("a resolved tenant context is required","unresolved-context");return e}function L(e){return Buffer.from(e,"utf8").toString("base64url")}function F(e,t){if(!e||!/^[A-Za-z0-9_-]+$/.test(e))throw new A(`${t} binding is invalid`,"invalid-object-binding");let n=Buffer.from(e,"base64url").toString("utf8");if(!n||L(n)!==e)throw new A(`${t} binding is non-canonical`,"invalid-object-binding");return n}function ue(e){let t=String(e??"").trim();if(!t||t.length>256||/[\u0000-\u001f\u007f]/.test(t))throw new A("objectId is invalid","invalid-object-id");return t}function B(e,t,n){j(e);let r=String(t??"").trim();if(!q.has(r))throw new A("resource is unknown","unknown-resource");let o=ue(n);return`${de}.${L(e.tenantId)}.${L(r)}.${L(o)}`}function Ue(e){let t=String(e??""),n=t.split(".");if(n.length!==4||n[0]!==de)throw new A("tenant-bound object id required","unbound-object");let r=F(n[1],"tenant"),o=F(n[2],"resource"),c=F(n[3],"object");if(!J.test(r)||!q.has(o))throw new A("tenant-bound object id is invalid","invalid-object-binding");return ue(c),G({schemaVersion:1,tenantId:r,resource:o,objectId:c,boundId:t})}function Fe(e){if(typeof e!="string"||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(e))return null;let t=Date.parse(e);return Number.isFinite(t)&&new Date(t).toISOString()===e?e:null}function ae(e){let t={...e,decisionId:fe(e)};return G(t)}function Je({context:e,resource:t,action:n,objectId:r=null,decidedAt:o}={}){let c=Fe(o),m={schemaVersion:xe,recordType:"tenant.access-decision",decidedAt:c,tenantId:H(e)?e.tenantId:null,actor:H(e)?{actorId:e.actor.actorId,actorType:e.actor.actorType,authSource:e.actor.authSource,roles:[...e.actor.roles]}:null,request:{resource:typeof t=="string"?t:null,action:typeof n=="string"?n:null,objectRefHash:r==null?null:fe(String(r))}},f=S=>ae({...m,allowed:!1,outcome:"deny",reason:S});if(e==null)return f(I.DENY_MISSING_CONTEXT);if(!H(e))return f(I.DENY_INVALID_CONTEXT);if(!c)return f(I.DENY_INVALID_REQUEST);if(!q.has(t))return f(I.DENY_UNKNOWN_RESOURCE);if(!$e.has(n))return f(I.DENY_UNKNOWN_ACTION);if(r!=null){let S;try{S=Ue(r)}catch{return f(I.DENY_UNBOUND_OBJECT)}if(S.tenantId!==e.tenantId)return f(I.DENY_TENANT_MISMATCH);if(S.resource!==t)return f(I.DENY_RESOURCE_MISMATCH)}if(n===ce.approve&&!e.actor.roles.some(k=>je.includes(k)))return f(I.DENY_ROLE_PERMISSION);let _=`${t}:${n}`,N=e.actor.roles.some(S=>le[S]?.includes(_));return ae({...m,allowed:N,outcome:N?"allow":"deny",reason:N?I.ALLOW_ROLE_PERMISSION:I.DENY_ROLE_PERMISSION})}function pe(e){let t=Je(e);if(!t.allowed){let n=new A(`tenant access denied: ${t.reason}`,"access-denied");throw n.decision=t,n}return t}import{createHash as Ze,randomUUID as qe}from"node:crypto";import{chmodSync as Ge,closeSync as Y,constants as z,existsSync as W,fsyncSync as K,lstatSync as he,mkdirSync as me,openSync as Q,readFileSync as Xe,renameSync as Be,unlinkSync as ee,writeFileSync as ye}from"node:fs";import{dirname as we,resolve as ge}from"node:path";function te(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(te).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${te(e[t])}`).join(",")}}`}function E(e){return Ze("sha256").update(te(e)).digest("hex")}function O(e){if(e&&typeof e=="object"&&!Object.isFrozen(e)){Object.freeze(e);for(let t of Object.values(e))O(t)}return e}function We(e,t,n){let r=ge(e),o=we(r);if(me(o,{recursive:!0,mode:448}),W(r)){let m=he(r);if(!m.isFile()||m.isSymbolicLink())throw n("state path must be a regular non-symlink file","unsafe-file")}let c=`${r}.${qe()}.tmp`;try{ye(c,`${JSON.stringify(t)}
-`,{encoding:"utf8",mode:384,flag:"wx"});let m=Q(c,z.O_RDONLY);try{K(m)}finally{Y(m)}Be(c,r),Ge(r,384);let f;try{f=Q(o,z.O_RDONLY),K(f)}finally{f!==void 0&&Y(f)}}catch(m){try{W(c)&&ee(c)}catch{}throw m}}function Ke(e,t,n){if(!e||typeof e!="object"||Array.isArray(e))throw n("state must be an object","integrity-failed");if(e.schemaVersion!==t||!Array.isArray(e.events))throw n("state schema is invalid","integrity-failed");let r=null;for(let m=0;m<e.events.length;m+=1){let f=e.events[m];if(!f||typeof f!="object"||Array.isArray(f))throw n("event is invalid","integrity-failed");if(f.record&&typeof f.record.recordHash=="string"){let{recordHash:S,...k}=f.record;if(E(k)!==S)throw n("record hash integrity failed; state may be tampered","integrity-failed")}let{eventHash:_,...N}=f;if(f.sequence!==m+1||f.previousEventHash!==r||E(N)!==_)throw n("event hash chain integrity failed; state may be tampered","integrity-failed");r=_}let{stateHash:o,...c}=e;if(E(c)!==o)throw n("state hash integrity failed; state may be tampered","integrity-failed");return e}function M(e,t,n){if(!W(e)){let c={schemaVersion:t,events:[]};return{...c,stateHash:E(c)}}let r=he(e);if(!r.isFile()||r.isSymbolicLink())throw n("state path must be a regular non-symlink file","unsafe-file");if((r.mode&511)!==384)throw n("state file permissions must be 0600","unsafe-permissions");let o;try{o=JSON.parse(Xe(e,"utf8"))}catch{throw n("state JSON is malformed","integrity-failed")}return Ke(o,t,n)}function Qe(e,t,n){let r=`${e}.lock`,o;try{o=Q(r,z.O_CREAT|z.O_EXCL|z.O_WRONLY,384),ye(o,`${JSON.stringify({pid:process.pid,createdAt:new Date().toISOString()})}
-`,"utf8"),K(o)}catch(c){if(o!==void 0){Y(o);try{ee(r)}catch{}}throw c?.code==="EEXIST"?t("state is locked by another writer","state-locked"):c}try{return n()}finally{try{Y(o)}finally{ee(r)}}}function Se({path:e,schemaVersion:t,fail:n}){if(typeof e!="string"||e.length<1||e.length>4096)throw n("bounded state path required","invalid-path");if(typeof n!="function")throw new TypeError("fail factory required");let r=ge(e);me(we(r),{recursive:!0,mode:448});let o=M(r,t,n);function c(){let f={schemaVersion:t,events:o.events};o={...f,stateHash:E(f)},We(r,o,n)}function m({tenantId:f,recordType:_,recordId:N,operation:S,occurredAt:k,record:R,expectedRecordHash:U=null}){return Qe(r,n,()=>{if(o=M(r,t,n),(([...o.events].reverse().find(u=>u.record?.boundId===R?.boundId)??null)?.record?.recordHash??null)!==U)throw n("record changed concurrently; retry from current state","state-conflict");if(R&&typeof R.recordHash=="string"){let{recordHash:u,...d}=R;if(E(d)!==u)throw n("record hash is inconsistent","integrity-failed")}let l={sequence:o.events.length+1,previousEventHash:o.events.at(-1)?.eventHash??null,tenantId:f,recordType:_,recordId:N,operation:S,occurredAt:k,record:R},a=O({...l,eventHash:E(l)});return o={...o,events:[...o.events,a]},c(),a})}return Object.freeze({append:m,events:()=>(o=M(r,t,n),o.events.map(f=>structuredClone(f))),verify:()=>{try{return o=M(r,t,n),{ok:!0,count:o.events.length,stateHash:o.stateHash}}catch(f){return{ok:!1,reason:f?.code||"integrity-failed"}}},path:r})}var et=Object.freeze([/(?:^|\s)Bearer\s+\S+/i,/-----BEGIN [A-Z ]*PRIVATE KEY-----/i,/\b(?:sk-|xprv|gh[pousr]_|github_pat_|AKIA|ASIA)[A-Za-z0-9_/-]{12,}\b/i,/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/,/\b(?:0x)?[0-9a-f]{64}\b/i,/(?<![1-9A-HJ-NP-Za-km-z])[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}(?![1-9A-HJ-NP-Za-km-z])/,/(?<![1-9A-HJ-NP-Za-km-z])[1-9A-HJ-NP-Za-km-z]{64,88}(?![1-9A-HJ-NP-Za-km-z])/]),tt=new Set(["apikey","key","token","accesstoken","secret","password","passwd","auth","authorization","bearer","signertoken","credential","credentials","clientsecret","privatekey","xapikey","accesskey","refreshtoken"]),nt=Object.freeze(["apikey","accesskey","privatekey","clientsecret","accesstoken","refreshtoken","signertoken","credential","password","passwd","authorization","bearer","secret","token"]);function rt(e){return String(e??"").replace(/[^a-z0-9]/gi,"").toLowerCase()}function ot(e){let t;try{t=new URL(e)}catch{return!1}if(t.username||t.password)return!0;for(let n of t.searchParams.keys()){let r=rt(n);if(tt.has(r)||nt.some(o=>r.includes(o)))return!0}return!1}function Ie(e){try{let t=decodeURIComponent(e);return t===e?null:t}catch{return null}}var st=/[a-z][a-z0-9+.-]{1,15}(?::\/\/|%3a%2f%2f)\S+/gi;function it(e){return e.replace(/[),.;:!?'"\]}]+$/,"")}function at(e){let t=e.match(st)||[];for(let n of t){let r=it(n),o=Ie(r),c=o?Ie(o):null;for(let m of[r,o,c])if(m&&ot(m))return!0}return!1}function C(e){return typeof e!="string"||e.length===0?!1:et.some(t=>t.test(e))?!0:at(e)}var Ae="oracle.context-graph/1",ct="oracle.context-graph-state/1",dt=Object.freeze(["onchain","api","document","user","system","derived"]),lt=/^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/,ft=/^[a-z0-9][a-z0-9._-]{0,95}$/,ut=/^[a-z][a-z0-9._-]{0,63}$/,pt=/^[0-9a-f]{64}$/,ht=new Set(dt),mt=32,yt=16,wt=512,gt=366*24*60*60*1e3,St=300*1e3,It=["authorization","apikey","accesskey","cookie","credential","password","passphrase","secret","token","privatekey","seed","mnemonic","keystore","signature"],ne=class extends Error{constructor(t,n="invalid-context-graph"){super(`context-graph: ${t}`),this.name="ContextGraphError",this.code=n}};function p(e,t){return new ne(e,t)}function V(e,t){if(typeof e!="string")throw p(`${t} must be an ISO timestamp`,"invalid-time");let n=Date.parse(e);if(!Number.isFinite(n)||new Date(n).toISOString()!==e)throw p(`${t} must be an ISO timestamp`,"invalid-time");return e}function b(e,t){let n=String(e??"").trim();if(C(n))throw p(`${t} contains secret-shaped material`,"secret-material");if(!lt.test(n))throw p(`${t} is invalid`,"invalid-id");return n}function T(e){let t=String(e??"").trim();if(C(t))throw p("domain contains secret-shaped material","secret-material");if(!ft.test(t))throw p("domain is invalid","invalid-domain");return t}function be(e){let t=String(e??"").trim();if(C(t))throw p("relation contains secret-shaped material","secret-material");if(!ut.test(t))throw p("relation is invalid","invalid-relation");return t}function Ee(e,t){if(typeof e=="string"){if(e.length>wt)throw p(`${t} string is too long`,"attribute-too-large");if(C(e))throw p(`${t} contains secret-shaped material`,"secret-material");return e}if(typeof e=="boolean"||e===null||typeof e=="number"&&Number.isFinite(e))return e;throw p(`${t} must be a scalar or scalar array`,"invalid-attribute")}function Ne(e={}){if(!e||typeof e!="object"||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype)throw p("attributes must be a plain object","invalid-attributes");let t=Object.keys(e).sort();if(t.length>mt)throw p("attributes exceed the field limit","attribute-limit");let n={};for(let r of t){if(!/^[A-Za-z][A-Za-z0-9_.-]{0,47}$/.test(r))throw p(`attribute key ${r} is invalid`,"invalid-attribute-key");let o=r.replace(/[^a-z0-9]/gi,"").toLowerCase();if(It.some(c=>o.includes(c)))throw p(`attribute key ${r} is forbidden because it may contain a secret`,"secret-material");if(Array.isArray(e[r])){if(e[r].length>yt)throw p(`${r} array is too long`,"attribute-limit");n[r]=e[r].map((c,m)=>Ee(c,`${r}[${m}]`))}else n[r]=Ee(e[r],r)}return n}function Oe(e,t,n){if(!e||typeof e!="object"||Array.isArray(e))throw p("provenance is required","missing-provenance");let r=String(e.sourceType??"").trim();if(!ht.has(r))throw p("provenance sourceType is invalid","invalid-provenance");let o=String(e.source??"").trim();if(!o||o.length>512||/[\u0000-\u001f\u007f]/.test(o)||C(o))throw p("provenance source is invalid","invalid-provenance");let c=String(e.evidenceHash??"").trim().toLowerCase();if(!pt.test(c))throw p("provenance evidenceHash must be sha256","invalid-provenance");let m=V(e.observedAt,"provenance.observedAt");if(Date.parse(m)>Date.parse(t)+St)throw p("provenance observedAt is too far in the future","future-observation");return{sourceType:r,source:o,observedAt:m,evidenceHash:c,verification:"unverified",assertedBy:b(n.actor.actorId,"assertedBy")}}function _e(e,t){if(e&&Date.parse(t.observedAt)<Date.parse(e.provenance.observedAt))throw p("provenance observedAt is out of order relative to the existing record","out-of-order-provenance")}function Te(e,t,n){if(!e||typeof e!="object"||Array.isArray(e))throw p("freshness policy is required","missing-freshness");let r=Number(e.maxAgeMs);if(!Number.isSafeInteger(r)||r<1||r>gt)throw p("freshness.maxAgeMs is invalid","invalid-freshness");let o=Date.parse(t)+r;if(!Number.isSafeInteger(o))throw p("freshness expiry is invalid","invalid-freshness");let c=new Date(o).toISOString();return{maxAgeMs:r,expiresAt:c,status:Date.parse(n)<o?"fresh":"stale"}}function D(e){return{...e,freshness:{maxAgeMs:e.freshness.maxAgeMs,expiresAt:e.freshness.expiresAt}}}function v(e,t){if(!e)return null;let n=Date.parse(t)<Date.parse(e.freshness.expiresAt)?"fresh":"stale";return O(structuredClone({...e,freshness:{...e.freshness,status:n}}))}function Ct(e,{at:t=new Date().toISOString()}={}){let n=V(t,"at");if(!e?.freshness?.expiresAt)throw p("record freshness is missing","invalid-freshness");let r=V(e.freshness.expiresAt,"freshness.expiresAt");return O({status:Date.parse(n)<Date.parse(r)?"fresh":"stale",checkedAt:n,expiresAt:r})}function $(e){let t=new Map;for(let n of e)t.set(`${n.tenantId}\0${n.recordType}\0${n.record.domain}\0${n.recordId}`,n.record);return t}function Dt({path:e,now:t=()=>new Date().toISOString()}={}){let n=Se({path:e,schemaVersion:ct,fail:p});function r(){return V(t(),"now")}function o(s,l,a=null,u=r()){return a!=null&&P(s,a),pe({context:s,resource:"context",action:l,decidedAt:u})}function c(s,l,a,u){return $(n.events()).get(`${s.tenantId}\0${l}\0${a}\0${u}`)??null}function m({context:s,input:l}={}){j(s);let a=r(),u=T(l?.domain);P(s,u);let d=b(l?.nodeId,"nodeId"),y=c(s,"node",u,d);o(s,y?"update":"create",u,a);let h=Oe(l?.provenance,a,s);_e(y,h);let g=Te(l?.freshness,h.observedAt,a),w={schemaVersion:Ae,recordType:"node",tenantId:s.tenantId,boundId:B(s,"context",`node:${u}:${d}`),domain:u,nodeId:d,kind:b(l?.kind,"kind"),attributes:Ne(l?.attributes),provenance:h,freshness:g,recordedAt:a,revision:y?y.revision+1:1},i={...w,recordHash:E(D(w))};return n.append({tenantId:s.tenantId,recordType:"node",recordId:d,operation:y?"update":"create",occurredAt:a,record:D(i),expectedRecordHash:y?.recordHash??null}),v(D(i),a)}function f({context:s,input:l}={}){j(s);let a=r(),u=T(l?.domain);P(s,u);let d=b(l?.edgeId,"edgeId"),y=b(l?.fromNodeId,"fromNodeId"),h=b(l?.toNodeId,"toNodeId");if(!c(s,"node",u,y)||!c(s,"node",u,h))throw p("edge references a missing node in its domain","missing-node");let g=c(s,"edge",u,d);o(s,g?"update":"create",u,a);let w=be(l?.relation),i=Oe(l?.provenance,a,s);_e(g,i);let x=Te(l?.freshness,i.observedAt,a),oe={schemaVersion:Ae,recordType:"edge",tenantId:s.tenantId,boundId:B(s,"context",`edge:${u}:${d}`),domain:u,edgeId:d,fromNodeId:y,toNodeId:h,relation:w,attributes:Ne(l?.attributes),provenance:i,freshness:x,recordedAt:a,revision:g?g.revision+1:1},se={...oe,recordHash:E(D(oe))};return n.append({tenantId:s.tenantId,recordType:"edge",recordId:d,operation:g?"update":"create",occurredAt:a,record:D(se),expectedRecordHash:g?.recordHash??null}),v(D(se),a)}function _({context:s,domain:l,nodeId:a,includeStale:u=!1}={}){let d=r(),y=T(l);o(s,"read",y,d);let h=v(c(s,"node",y,b(a,"nodeId")),d);return h&&(u||h.freshness.status==="fresh")?h:null}function N({context:s,domain:l,edgeId:a,includeStale:u=!1}={}){let d=r(),y=T(l);o(s,"read",y,d);let h=v(c(s,"edge",y,b(a,"edgeId")),d);return h&&(u||h.freshness.status==="fresh")?h:null}function S({context:s,domain:l,kinds:a=null,includeStale:u=!1,limit:d=100}={}){let y=r(),h=T(l);if(o(s,"read",h,y),!Number.isSafeInteger(d)||d<1||d>500)throw p("query limit is invalid","invalid-limit");let g=a==null?null:new Set(a.map(i=>b(i,"kind"))),w=[...$(n.events()).values()].filter(i=>i.tenantId===s.tenantId&&i.recordType==="node"&&i.domain===h).filter(i=>!g||g.has(i.kind)).map(i=>v(i,y)).filter(i=>u||i.freshness.status==="fresh").sort((i,x)=>i.nodeId.localeCompare(x.nodeId)).slice(0,d);return O({domain:h,count:w.length,records:w})}function k({context:s,domain:l,relations:a=null,includeStale:u=!1,limit:d=100}={}){let y=r(),h=T(l);if(o(s,"read",h,y),!Number.isSafeInteger(d)||d<1||d>500)throw p("query limit is invalid","invalid-limit");let g=a==null?null:new Set(a.map(i=>be(i))),w=[...$(n.events()).values()].filter(i=>i.tenantId===s.tenantId&&i.recordType==="edge"&&i.domain===h).filter(i=>!g||g.has(i.relation)).map(i=>v(i,y)).filter(i=>u||i.freshness.status==="fresh").sort((i,x)=>i.edgeId.localeCompare(x.edgeId)).slice(0,d);return O({domain:h,count:w.length,records:w})}function R({context:s,domain:l,nodeId:a,includeStale:u=!1,limit:d=100}={}){let y=r(),h=T(l);o(s,"read",h,y);let g=b(a,"nodeId");if(!Number.isSafeInteger(d)||d<1||d>500)throw p("query limit is invalid","invalid-limit");let w=[...$(n.events()).values()].filter(i=>i.tenantId===s.tenantId&&i.recordType==="edge"&&i.domain===h).filter(i=>i.fromNodeId===g||i.toNodeId===g).map(i=>v(i,y)).filter(i=>u||i.freshness.status==="fresh").sort((i,x)=>i.edgeId.localeCompare(x.edgeId)).slice(0,d);return O({domain:h,nodeId:g,count:w.length,records:w})}function U({context:s}={}){let l=r();return o(s,"read",null,l),[...new Set([...$(n.events()).values()].filter(a=>a.tenantId===s.tenantId&&X(s,a.domain)).map(a=>a.domain))].sort()}function re({context:s,domain:l,recordId:a,recordType:u="node",limit:d=100}={}){let y=r(),h=T(l);o(s,"read",h,y);let g=b(a,"recordId");if(!["node","edge"].includes(u))throw p("recordType must be node or edge","invalid-record-type");if(!Number.isSafeInteger(d)||d<1||d>500)throw p("history limit is invalid","invalid-limit");return n.events().filter(w=>w.tenantId===s.tenantId&&w.recordType===u&&w.record.domain===h&&w.recordId===g).slice(-d).map(w=>O({operation:w.operation,occurredAt:w.occurredAt,eventHash:w.eventHash,record:v(w.record,y)}))}return Object.freeze({putNode:m,putEdge:f,getNode:_,getEdge:N,query:S,queryEdges:k,neighbors:R,listDomains:U,history:re,verify:n.verify})}export{Ae as CONTEXT_GRAPH_SCHEMA_VERSION,dt as CONTEXT_GRAPH_SOURCE_TYPES,ct as CONTEXT_GRAPH_STATE_VERSION,ne as ContextGraphError,Ct as assessContextFreshness,Dt as createContextGraph};
+import{createHash as Te}from"node:crypto";var ve=1,ke=1,Re=1;var je=Object.freeze(["owner","operator","agent","viewer"]),Ce=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),ce=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),ze=Object.freeze(["owner"]),S=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),De=new Set(je),Z=new Set(Ce),$e=new Set(Object.values(ce)),He=new Set(["user","service","local-owner"]),Pe=new Set(["verified-session","service-credential","desktop-session","owner-arm-token","local-owner"]),F=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/,de="tob1",Le=new WeakSet,Me=new WeakMap,fe=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),At=Object.freeze(Object.fromEntries(Object.entries(fe).map(([e,t])=>[e,Object.freeze([...t])]))),I=class extends Error{constructor(t,n="invalid-context"){super(t),this.name="TenantContextError",this.code=n}};function ie(e){return!!e&&typeof e=="object"&&!Array.isArray(e)&&Object.getPrototypeOf(e)===Object.prototype}function q(e){if(e&&typeof e=="object"&&!Object.isFrozen(e)){Object.freeze(e);for(let t of Object.values(e))q(t)}return e}function J(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(J).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${J(e[t])}`).join(",")}}`}function le(e){return Te("sha256").update(J(e)).digest("hex")}function Ue(e,t){return e.length===t.length&&e.every((n,r)=>n===t[r])}function Ye(e){if(!ie(e)||e.schemaVersion!==ve||!F.test(e.tenantId||"")||typeof e.localCompatibility!="boolean")return!1;let t=e.actor;if(!ie(t)||t.schemaVersion!==ke||!F.test(t.actorId||"")||!He.has(t.actorType)||!Pe.has(t.authSource)||!Array.isArray(t.roles)||t.roles.length===0)return!1;let n=[...new Set(t.roles)].sort();return n.every(r=>De.has(r))&&Ue(n,t.roles)}function G(e,t){z(e);let n=String(t??"").trim();if(!/^[a-z0-9][a-z0-9._-]{0,95}$/.test(n))return!1;let r=Me.get(e)||[];return r.includes("*")||r.includes(n)}function L(e,t){if(!G(e,t))throw new I("context domain access denied","domain-access-denied");return t}function H(e){return Le.has(e)&&Ye(e)}function z(e){if(!H(e))throw new I("a resolved tenant context is required","unresolved-context");return e}function P(e){return Buffer.from(e,"utf8").toString("base64url")}function B(e,t){if(!e||!/^[A-Za-z0-9_-]+$/.test(e))throw new I(`${t} binding is invalid`,"invalid-object-binding");let n=Buffer.from(e,"base64url").toString("utf8");if(!n||P(n)!==e)throw new I(`${t} binding is non-canonical`,"invalid-object-binding");return n}function ue(e){let t=String(e??"").trim();if(!t||t.length>256||/[\u0000-\u001f\u007f]/.test(t))throw new I("objectId is invalid","invalid-object-id");return t}function X(e,t,n){z(e);let r=String(t??"").trim();if(!Z.has(r))throw new I("resource is unknown","unknown-resource");let o=ue(n);return`${de}.${P(e.tenantId)}.${P(r)}.${P(o)}`}function Ve(e){let t=String(e??""),n=t.split(".");if(n.length!==4||n[0]!==de)throw new I("tenant-bound object id required","unbound-object");let r=B(n[1],"tenant"),o=B(n[2],"resource"),c=B(n[3],"object");if(!F.test(r)||!Z.has(o))throw new I("tenant-bound object id is invalid","invalid-object-binding");return ue(c),q({schemaVersion:1,tenantId:r,resource:o,objectId:c,boundId:t})}function Be(e){if(typeof e!="string"||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(e))return null;let t=Date.parse(e);return Number.isFinite(t)&&new Date(t).toISOString()===e?e:null}function ae(e){let t={...e,decisionId:le(e)};return q(t)}function Fe({context:e,resource:t,action:n,objectId:r=null,decidedAt:o}={}){let c=Be(o),m={schemaVersion:Re,recordType:"tenant.access-decision",decidedAt:c,tenantId:H(e)?e.tenantId:null,actor:H(e)?{actorId:e.actor.actorId,actorType:e.actor.actorType,authSource:e.actor.authSource,roles:[...e.actor.roles]}:null,request:{resource:typeof t=="string"?t:null,action:typeof n=="string"?n:null,objectRefHash:r==null?null:le(String(r))}},l=b=>ae({...m,allowed:!1,outcome:"deny",reason:b});if(e==null)return l(S.DENY_MISSING_CONTEXT);if(!H(e))return l(S.DENY_INVALID_CONTEXT);if(!c)return l(S.DENY_INVALID_REQUEST);if(!Z.has(t))return l(S.DENY_UNKNOWN_RESOURCE);if(!$e.has(n))return l(S.DENY_UNKNOWN_ACTION);if(r!=null){let b;try{b=Ve(r)}catch{return l(S.DENY_UNBOUND_OBJECT)}if(b.tenantId!==e.tenantId)return l(S.DENY_TENANT_MISMATCH);if(b.resource!==t)return l(S.DENY_RESOURCE_MISMATCH)}if(n===ce.approve&&!e.actor.roles.some(v=>ze.includes(v)))return l(S.DENY_ROLE_PERMISSION);let N=`${t}:${n}`,O=e.actor.roles.some(b=>fe[b]?.includes(N));return ae({...m,allowed:O,outcome:O?"allow":"deny",reason:O?S.ALLOW_ROLE_PERMISSION:S.DENY_ROLE_PERMISSION})}function pe(e){let t=Fe(e);if(!t.allowed){let n=new I(`tenant access denied: ${t.reason}`,"access-denied");throw n.decision=t,n}return t}import{createHash as Je,randomUUID as Ze}from"node:crypto";import{chmodSync as qe,closeSync as U,constants as D,existsSync as K,fsyncSync as W,lstatSync as he,mkdirSync as me,openSync as Q,readFileSync as Ge,renameSync as Xe,unlinkSync as ee,writeFileSync as ye}from"node:fs";import{dirname as we,resolve as ge}from"node:path";function te(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(te).join(",")}]`:`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${te(e[t])}`).join(",")}}`}function E(e){return Je("sha256").update(te(e)).digest("hex")}function _(e){if(e&&typeof e=="object"&&!Object.isFrozen(e)){Object.freeze(e);for(let t of Object.values(e))_(t)}return e}function Ke(e,t,n){let r=ge(e),o=we(r);if(me(o,{recursive:!0,mode:448}),K(r)){let m=he(r);if(!m.isFile()||m.isSymbolicLink())throw n("state path must be a regular non-symlink file","unsafe-file")}let c=`${r}.${Ze()}.tmp`;try{ye(c,`${JSON.stringify(t)}
+`,{encoding:"utf8",mode:384,flag:"wx"});let m=Q(c,D.O_RDONLY);try{W(m)}finally{U(m)}Xe(c,r),qe(r,384);let l;try{l=Q(o,D.O_RDONLY),W(l)}finally{l!==void 0&&U(l)}}catch(m){try{K(c)&&ee(c)}catch{}throw m}}function We(e,t,n){if(!e||typeof e!="object"||Array.isArray(e))throw n("state must be an object","integrity-failed");if(e.schemaVersion!==t||!Array.isArray(e.events))throw n("state schema is invalid","integrity-failed");let r=null;for(let m=0;m<e.events.length;m+=1){let l=e.events[m];if(!l||typeof l!="object"||Array.isArray(l))throw n("event is invalid","integrity-failed");if(l.record&&typeof l.record.recordHash=="string"){let{recordHash:b,...v}=l.record;if(E(v)!==b)throw n("record hash integrity failed; state may be tampered","integrity-failed")}let{eventHash:N,...O}=l;if(l.sequence!==m+1||l.previousEventHash!==r||E(O)!==N)throw n("event hash chain integrity failed; state may be tampered","integrity-failed");r=N}let{stateHash:o,...c}=e;if(E(c)!==o)throw n("state hash integrity failed; state may be tampered","integrity-failed");return e}function M(e,t,n){if(!K(e)){let c={schemaVersion:t,events:[]};return{...c,stateHash:E(c)}}let r=he(e);if(!r.isFile()||r.isSymbolicLink())throw n("state path must be a regular non-symlink file","unsafe-file");if((r.mode&511)!==384)throw n("state file permissions must be 0600","unsafe-permissions");let o;try{o=JSON.parse(Ge(e,"utf8"))}catch{throw n("state JSON is malformed","integrity-failed")}return We(o,t,n)}function Qe(e,t,n){let r=`${e}.lock`,o;try{o=Q(r,D.O_CREAT|D.O_EXCL|D.O_WRONLY,384),ye(o,`${JSON.stringify({pid:process.pid,createdAt:new Date().toISOString()})}
+`,"utf8"),W(o)}catch(c){if(o!==void 0){U(o);try{ee(r)}catch{}}throw c?.code==="EEXIST"?t("state is locked by another writer","state-locked"):c}try{return n()}finally{try{U(o)}finally{ee(r)}}}function be({path:e,schemaVersion:t,fail:n}){if(typeof e!="string"||e.length<1||e.length>4096)throw n("bounded state path required","invalid-path");if(typeof n!="function")throw new TypeError("fail factory required");let r=ge(e);me(we(r),{recursive:!0,mode:448});let o=M(r,t,n);function c(){let l={schemaVersion:t,events:o.events};o={...l,stateHash:E(l)},Ke(r,o,n)}function m({tenantId:l,recordType:N,recordId:O,operation:b,occurredAt:v,record:k,expectedRecordHash:V=null}){return Qe(r,n,()=>{if(o=M(r,t,n),(([...o.events].reverse().find(u=>u.record?.boundId===k?.boundId)??null)?.record?.recordHash??null)!==V)throw n("record changed concurrently; retry from current state","state-conflict");if(k&&typeof k.recordHash=="string"){let{recordHash:u,...d}=k;if(E(d)!==u)throw n("record hash is inconsistent","integrity-failed")}let f={sequence:o.events.length+1,previousEventHash:o.events.at(-1)?.eventHash??null,tenantId:l,recordType:N,recordId:O,operation:b,occurredAt:v,record:k},a=_({...f,eventHash:E(f)});return o={...o,events:[...o.events,a]},c(),a})}return Object.freeze({append:m,events:()=>(o=M(r,t,n),o.events.map(l=>structuredClone(l))),verify:()=>{try{return o=M(r,t,n),{ok:!0,count:o.events.length,stateHash:o.stateHash}}catch(l){return{ok:!1,reason:l?.code||"integrity-failed"}}},path:r})}var et=Object.freeze([/(?:^|\s)Bearer\s+\S+/i,/-----BEGIN [A-Z ]*PRIVATE KEY-----/i,/\b(?:sk-|xprv|gh[pousr]_|github_pat_|AKIA|ASIA)[A-Za-z0-9_/-]{12,}\b/i,/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/,/\b(?:0x)?[0-9a-f]{64}\b/i,/(?<![1-9A-HJ-NP-Za-km-z])[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}(?![1-9A-HJ-NP-Za-km-z])/,/(?<![1-9A-HJ-NP-Za-km-z])[1-9A-HJ-NP-Za-km-z]{64,88}(?![1-9A-HJ-NP-Za-km-z])/]),tt=new Set(["apikey","key","token","accesstoken","secret","password","passwd","auth","authorization","bearer","signertoken","credential","credentials","clientsecret","privatekey","xapikey","accesskey","refreshtoken"]),nt=Object.freeze(["apikey","accesskey","privatekey","clientsecret","accesstoken","refreshtoken","signertoken","credential","password","passwd","authorization","bearer","secret","token"]);function rt(e){return String(e??"").replace(/[^a-z0-9]/gi,"").toLowerCase()}function ot(e){let t;try{t=new URL(e)}catch{return!1}if(t.username||t.password)return!0;for(let n of t.searchParams.keys()){let r=rt(n);if(tt.has(r)||nt.some(o=>r.includes(o)))return!0}return!1}function Se(e){try{let t=decodeURIComponent(e);return t===e?null:t}catch{return null}}var st=/[a-z][a-z0-9+.-]{1,15}(?::\/\/|%3a%2f%2f)\S+/gi;function it(e){return e.replace(/[),.;:!?'"\]}]+$/,"")}function at(e){let t=e.match(st)||[];for(let n of t){let r=it(n),o=Se(r),c=o?Se(o):null;for(let m of[r,o,c])if(m&&ot(m))return!0}return!1}var Tt=Object.freeze([Object.freeze([120,112,114,118]),Object.freeze([115,107,45]),Object.freeze([103,104,112,95]),Object.freeze([103,104,111,95]),Object.freeze([103,104,117,95]),Object.freeze([103,104,115,95]),Object.freeze([103,104,114,95]),Object.freeze([103,105,116,104,117,98,95,112,97,116,95]),Object.freeze([97,107,105,97]),Object.freeze([97,115,105,97])]);function j(e){return typeof e!="string"||e.length===0?!1:et.some(t=>t.test(e))?!0:at(e)}var Ie="oracle.context-graph/1",ct="oracle.context-graph-state/1",dt=Object.freeze(["onchain","api","document","user","system","derived"]),ft=/^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/,lt=/^[a-z0-9][a-z0-9._-]{0,95}$/,ut=/^[a-z][a-z0-9._-]{0,63}$/,pt=/^[0-9a-f]{64}$/,ht=new Set(dt),mt=32,yt=16,wt=512,gt=366*24*60*60*1e3,bt=300*1e3,St=["authorization","apikey","accesskey","cookie","credential","password","passphrase","secret","token","privatekey","seed","mnemonic","keystore","signature"],ne=class extends Error{constructor(t,n="invalid-context-graph"){super(`context-graph: ${t}`),this.name="ContextGraphError",this.code=n}};function p(e,t){return new ne(e,t)}function Y(e,t){if(typeof e!="string")throw p(`${t} must be an ISO timestamp`,"invalid-time");let n=Date.parse(e);if(!Number.isFinite(n)||new Date(n).toISOString()!==e)throw p(`${t} must be an ISO timestamp`,"invalid-time");return e}function A(e,t){let n=String(e??"").trim();if(j(n))throw p(`${t} contains secret-shaped material`,"secret-material");if(!ft.test(n))throw p(`${t} is invalid`,"invalid-id");return n}function x(e){let t=String(e??"").trim();if(j(t))throw p("domain contains secret-shaped material","secret-material");if(!lt.test(t))throw p("domain is invalid","invalid-domain");return t}function Ae(e){let t=String(e??"").trim();if(j(t))throw p("relation contains secret-shaped material","secret-material");if(!ut.test(t))throw p("relation is invalid","invalid-relation");return t}function Ee(e,t){if(typeof e=="string"){if(e.length>wt)throw p(`${t} string is too long`,"attribute-too-large");if(j(e))throw p(`${t} contains secret-shaped material`,"secret-material");return e}if(typeof e=="boolean"||e===null||typeof e=="number"&&Number.isFinite(e))return e;throw p(`${t} must be a scalar or scalar array`,"invalid-attribute")}function Oe(e={}){if(!e||typeof e!="object"||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype)throw p("attributes must be a plain object","invalid-attributes");let t=Object.keys(e).sort();if(t.length>mt)throw p("attributes exceed the field limit","attribute-limit");let n={};for(let r of t){if(!/^[A-Za-z][A-Za-z0-9_.-]{0,47}$/.test(r))throw p(`attribute key ${r} is invalid`,"invalid-attribute-key");let o=r.replace(/[^a-z0-9]/gi,"").toLowerCase();if(St.some(c=>o.includes(c)))throw p(`attribute key ${r} is forbidden because it may contain a secret`,"secret-material");if(Array.isArray(e[r])){if(e[r].length>yt)throw p(`${r} array is too long`,"attribute-limit");n[r]=e[r].map((c,m)=>Ee(c,`${r}[${m}]`))}else n[r]=Ee(e[r],r)}return n}function _e(e,t,n){if(!e||typeof e!="object"||Array.isArray(e))throw p("provenance is required","missing-provenance");let r=String(e.sourceType??"").trim();if(!ht.has(r))throw p("provenance sourceType is invalid","invalid-provenance");let o=String(e.source??"").trim();if(!o||o.length>512||/[\u0000-\u001f\u007f]/.test(o)||j(o))throw p("provenance source is invalid","invalid-provenance");let c=String(e.evidenceHash??"").trim().toLowerCase();if(!pt.test(c))throw p("provenance evidenceHash must be sha256","invalid-provenance");let m=Y(e.observedAt,"provenance.observedAt");if(Date.parse(m)>Date.parse(t)+bt)throw p("provenance observedAt is too far in the future","future-observation");return{sourceType:r,source:o,observedAt:m,evidenceHash:c,verification:"unverified",assertedBy:A(n.actor.actorId,"assertedBy")}}function Ne(e,t){if(e&&Date.parse(t.observedAt)<Date.parse(e.provenance.observedAt))throw p("provenance observedAt is out of order relative to the existing record","out-of-order-provenance")}function xe(e,t,n){if(!e||typeof e!="object"||Array.isArray(e))throw p("freshness policy is required","missing-freshness");let r=Number(e.maxAgeMs);if(!Number.isSafeInteger(r)||r<1||r>gt)throw p("freshness.maxAgeMs is invalid","invalid-freshness");let o=Date.parse(t)+r;if(!Number.isSafeInteger(o))throw p("freshness expiry is invalid","invalid-freshness");let c=new Date(o).toISOString();return{maxAgeMs:r,expiresAt:c,status:Date.parse(n)<o?"fresh":"stale"}}function C(e){return{...e,freshness:{maxAgeMs:e.freshness.maxAgeMs,expiresAt:e.freshness.expiresAt}}}function T(e,t){if(!e)return null;let n=Date.parse(t)<Date.parse(e.freshness.expiresAt)?"fresh":"stale";return _(structuredClone({...e,freshness:{...e.freshness,status:n}}))}function Ct(e,{at:t=new Date().toISOString()}={}){let n=Y(t,"at");if(!e?.freshness?.expiresAt)throw p("record freshness is missing","invalid-freshness");let r=Y(e.freshness.expiresAt,"freshness.expiresAt");return _({status:Date.parse(n)<Date.parse(r)?"fresh":"stale",checkedAt:n,expiresAt:r})}function $(e){let t=new Map;for(let n of e)t.set(`${n.tenantId}\0${n.recordType}\0${n.record.domain}\0${n.recordId}`,n.record);return t}function zt({path:e,now:t=()=>new Date().toISOString()}={}){let n=be({path:e,schemaVersion:ct,fail:p});function r(){return Y(t(),"now")}function o(s,f,a=null,u=r()){return a!=null&&L(s,a),pe({context:s,resource:"context",action:f,decidedAt:u})}function c(s,f,a,u){return $(n.events()).get(`${s.tenantId}\0${f}\0${a}\0${u}`)??null}function m({context:s,input:f}={}){z(s);let a=r(),u=x(f?.domain);L(s,u);let d=A(f?.nodeId,"nodeId"),y=c(s,"node",u,d);o(s,y?"update":"create",u,a);let h=_e(f?.provenance,a,s);Ne(y,h);let g=xe(f?.freshness,h.observedAt,a),w={schemaVersion:Ie,recordType:"node",tenantId:s.tenantId,boundId:X(s,"context",`node:${u}:${d}`),domain:u,nodeId:d,kind:A(f?.kind,"kind"),attributes:Oe(f?.attributes),provenance:h,freshness:g,recordedAt:a,revision:y?y.revision+1:1},i={...w,recordHash:E(C(w))};return n.append({tenantId:s.tenantId,recordType:"node",recordId:d,operation:y?"update":"create",occurredAt:a,record:C(i),expectedRecordHash:y?.recordHash??null}),T(C(i),a)}function l({context:s,input:f}={}){z(s);let a=r(),u=x(f?.domain);L(s,u);let d=A(f?.edgeId,"edgeId"),y=A(f?.fromNodeId,"fromNodeId"),h=A(f?.toNodeId,"toNodeId");if(!c(s,"node",u,y)||!c(s,"node",u,h))throw p("edge references a missing node in its domain","missing-node");let g=c(s,"edge",u,d);o(s,g?"update":"create",u,a);let w=Ae(f?.relation),i=_e(f?.provenance,a,s);Ne(g,i);let R=xe(f?.freshness,i.observedAt,a),oe={schemaVersion:Ie,recordType:"edge",tenantId:s.tenantId,boundId:X(s,"context",`edge:${u}:${d}`),domain:u,edgeId:d,fromNodeId:y,toNodeId:h,relation:w,attributes:Oe(f?.attributes),provenance:i,freshness:R,recordedAt:a,revision:g?g.revision+1:1},se={...oe,recordHash:E(C(oe))};return n.append({tenantId:s.tenantId,recordType:"edge",recordId:d,operation:g?"update":"create",occurredAt:a,record:C(se),expectedRecordHash:g?.recordHash??null}),T(C(se),a)}function N({context:s,domain:f,nodeId:a,includeStale:u=!1}={}){let d=r(),y=x(f);o(s,"read",y,d);let h=T(c(s,"node",y,A(a,"nodeId")),d);return h&&(u||h.freshness.status==="fresh")?h:null}function O({context:s,domain:f,edgeId:a,includeStale:u=!1}={}){let d=r(),y=x(f);o(s,"read",y,d);let h=T(c(s,"edge",y,A(a,"edgeId")),d);return h&&(u||h.freshness.status==="fresh")?h:null}function b({context:s,domain:f,kinds:a=null,includeStale:u=!1,limit:d=100}={}){let y=r(),h=x(f);if(o(s,"read",h,y),!Number.isSafeInteger(d)||d<1||d>500)throw p("query limit is invalid","invalid-limit");let g=a==null?null:new Set(a.map(i=>A(i,"kind"))),w=[...$(n.events()).values()].filter(i=>i.tenantId===s.tenantId&&i.recordType==="node"&&i.domain===h).filter(i=>!g||g.has(i.kind)).map(i=>T(i,y)).filter(i=>u||i.freshness.status==="fresh").sort((i,R)=>i.nodeId.localeCompare(R.nodeId)).slice(0,d);return _({domain:h,count:w.length,records:w})}function v({context:s,domain:f,relations:a=null,includeStale:u=!1,limit:d=100}={}){let y=r(),h=x(f);if(o(s,"read",h,y),!Number.isSafeInteger(d)||d<1||d>500)throw p("query limit is invalid","invalid-limit");let g=a==null?null:new Set(a.map(i=>Ae(i))),w=[...$(n.events()).values()].filter(i=>i.tenantId===s.tenantId&&i.recordType==="edge"&&i.domain===h).filter(i=>!g||g.has(i.relation)).map(i=>T(i,y)).filter(i=>u||i.freshness.status==="fresh").sort((i,R)=>i.edgeId.localeCompare(R.edgeId)).slice(0,d);return _({domain:h,count:w.length,records:w})}function k({context:s,domain:f,nodeId:a,includeStale:u=!1,limit:d=100}={}){let y=r(),h=x(f);o(s,"read",h,y);let g=A(a,"nodeId");if(!Number.isSafeInteger(d)||d<1||d>500)throw p("query limit is invalid","invalid-limit");let w=[...$(n.events()).values()].filter(i=>i.tenantId===s.tenantId&&i.recordType==="edge"&&i.domain===h).filter(i=>i.fromNodeId===g||i.toNodeId===g).map(i=>T(i,y)).filter(i=>u||i.freshness.status==="fresh").sort((i,R)=>i.edgeId.localeCompare(R.edgeId)).slice(0,d);return _({domain:h,nodeId:g,count:w.length,records:w})}function V({context:s}={}){let f=r();return o(s,"read",null,f),[...new Set([...$(n.events()).values()].filter(a=>a.tenantId===s.tenantId&&G(s,a.domain)).map(a=>a.domain))].sort()}function re({context:s,domain:f,recordId:a,recordType:u="node",limit:d=100}={}){let y=r(),h=x(f);o(s,"read",h,y);let g=A(a,"recordId");if(!["node","edge"].includes(u))throw p("recordType must be node or edge","invalid-record-type");if(!Number.isSafeInteger(d)||d<1||d>500)throw p("history limit is invalid","invalid-limit");return n.events().filter(w=>w.tenantId===s.tenantId&&w.recordType===u&&w.record.domain===h&&w.recordId===g).slice(-d).map(w=>_({operation:w.operation,occurredAt:w.occurredAt,eventHash:w.eventHash,record:T(w.record,y)}))}return Object.freeze({putNode:m,putEdge:l,getNode:N,getEdge:O,query:b,queryEdges:v,neighbors:k,listDomains:V,history:re,verify:n.verify})}export{Ie as CONTEXT_GRAPH_SCHEMA_VERSION,dt as CONTEXT_GRAPH_SOURCE_TYPES,ct as CONTEXT_GRAPH_STATE_VERSION,ne as ContextGraphError,Ct as assessContextFreshness,zt as createContextGraph};