@oracle-agent/oracle 0.35.34 → 0.35.36

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-var Xe=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import $ from"node:fs";import Ze from"node:os";import x from"node:path";import{fileURLToPath as Qe}from"node:url";function le(){return process.env.ORACLE_FAKE_HOME||Ze.homedir()}function tt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function L(){return tt()?process.env.ORACLE_CONFIG_DIR||x.join(le(),".config","oracle"):x.join(le(),".config","oracle")}function rt(){return x.join(L(),"desk.json")}function nt(){return x.join(L(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=nt();if($.existsSync(i))for(let o of $.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let l=a[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),t(a[1],l)}}catch{}try{let i=rt();if($.existsSync(i)){let o=JSON.parse($.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var et,Cr,ue=Xe(()=>{et=x.dirname(Qe(import.meta.url)),Cr=x.resolve(et,"../..");try{E()}catch{}});ue();import m from"node:fs";import M from"node:path";import{createCipheriv as ot,createDecipheriv as it,randomBytes as O,scryptSync as st}from"node:crypto";import s from"node:fs";import p from"node:path";var de="ORACLE-LOCAL-VAULT",fe=1,I=Object.freeze({N:1<<17,r:8,p:1}),at=256*1024*1024,ct=16*1024;function P(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function pe(e,n,t=I){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");if(r.includes("\0"))throw new Error("local-vault: refusing zeroed passphrase material");return st(r,n,32,{...t,maxmem:at})}function me(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:de,version:fe,kdf:{name:"scrypt",...I,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},l=pe(n,i);try{let f=ot("aes-256-gcm",l,o);f.setAAD(Buffer.from(JSON.stringify(a)));let c=Buffer.concat([f.update(r),f.final()]);return{...a,ciphertext:c.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{l.fill(0),r.fill(0)}}function T(e,n){if(e?.magic!==de||e?.version!==fe)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==I.N||e.kdf.r!==I.r||e.kdf.p!==I.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!t.includes(u)))throw new Error("local-vault: unexpected vault field");let r=P(e.kdf.salt,32,"salt"),i=P(e.cipher.iv,12,"iv"),o=P(e.tag,16,"tag"),a=P(e.ciphertext,1,"ciphertext",{max:ct}),{ciphertext:l,tag:f,...c}=e,d=pe(n,r);try{let u=it("aes-256-gcm",d,i);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(o),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function lt(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function z(e){let n=p.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(lt(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function N(e){return JSON.parse(h(e))}function we(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),z(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
-`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(p.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let l=s.openSync(p.dirname(e),"r");try{s.fsyncSync(l)}finally{s.closeSync(l)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function g(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),z(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(p.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}function ut(e,n){try{s.linkSync(e,n)}catch(r){throw r?.code==="EEXIST"?new Error("export destination already exists; choose a new owner-only file"):r}s.chmodSync(n,384),s.unlinkSync(e);let t=s.openSync(p.dirname(n),"r");try{s.fsyncSync(t)}finally{s.closeSync(t)}}function he(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),z(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,String(n)),s.fsyncSync(r),s.closeSync(r),r=void 0,ut(t,e)}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}}import w from"node:path";import yr from"node:os";import{createHash as br,randomBytes as vu}from"node:crypto";import{Interface as ie,keccak256 as Iu}from"ethers";import{Transaction as Tu}from"@scure/btc-signer";import{ed25519 as _u}from"@noble/curves/ed25519.js";import{base58 as fs}from"@scure/base";import{Interface as Se}from"ethers";import{Interface as wt,MaxUint256 as hn,isAddress as gn,keccak256 as yn,toUtf8Bytes as bn}from"ethers";import{Interface as pt,isAddress as Yr}from"ethers";import{isAddress as Wr}from"ethers";var en=new pt(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as mt,isAddress as nn}from"ethers";var cn=new mt(["function approve(address spender,uint256 amount) returns (bool)"]),ln=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var kn=new wt(["function approve(address spender,uint256 amount) returns (bool)"]);var On=300*1e3,Tn=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as $n,NETWORK as Ln,OutScript as Pn,RawTx as Bn,SigHash as Dn,TEST_NETWORK as jn,Transaction as Fn}from"@scure/btc-signer";import{createHash as ht}from"node:crypto";import{base58 as zn}from"@scure/base";import{getCompiledTransactionMessageDecoder as Un}from"@solana/transaction-messages";var ge=e=>ht("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Vn=new Map([[ge("route"),{name:"route",prefixBytes:0}],[ge("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var eo=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,to=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,ro=AbortSignal.prototype.throwIfAborted,no=EventTarget.prototype.addEventListener,oo=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null;var io=64*1024,so=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024});var xo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),So=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var ko="0x"+"00".repeat(32);var yt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),_o=Object.freeze(yt.map(e=>e[0]));import{TypedDataEncoder as ai,getAddress as ci}from"ethers";import{TypedDataEncoder as Po,getAddress as Bo,isAddress as Do}from"ethers";var Et=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),xt=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as Ko,getAddress as Go,isAddress as Yo}from"ethers";var qo=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var St=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),ni=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var At=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),oi=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var di=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Nt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var Ti=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var _t=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Ni=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),_i=new Se(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Ci=new Se(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Ri=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ct=Object.freeze([...Nt]),$i=Object.freeze({..._t});import{ed25519 as Gi}from"@noble/curves/ed25519.js";import{base58 as Xi}from"@scure/base";import{RawTx as Qi,SigHash as es,Transaction as ts}from"@scure/btc-signer";import{Transaction as ns,keccak256 as os,verifyTypedData as is}from"ethers";import{encode as Bi}from"@msgpack/msgpack";import{keccak256 as ji,verifyTypedData as Fi}from"ethers";var qi=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Mi=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{wordlists as Ns}from"ethers";import{wordlists as ks}from"ethers";var ve=64*1024;var Cs=32*1024;var Bt=["schemaVersion","buildVersion","recordType","execution","custody"],Ls=[...Bt,"recordHash"];var Ps=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Dt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),$e=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),qs=new Set($e);var zt=64*1024*1024;var Js=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),Ks=Object.freeze(["read","simulate"]);var Gs=1440*60;var oa=Object.freeze(["privkey","wif","xprv","seed"]);var ia=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),sa=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var Z=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),ua=Object.freeze(Object.fromEntries(Z.map((e,n)=>[e,Object.freeze(n+1<Z.length?[Z[n+1]]:[])])));var Wt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var Vt=Object.freeze(["owner","operator","agent","viewer"]),Jt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),Kt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),Ka=Object.freeze(["owner"]),Ga=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),Ya=new Set(Vt),Xa=new Set(Jt),Za=new Set(Object.values(Kt));var Gt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),Qa=Object.freeze(Object.fromEntries(Object.entries(Gt).map(([e,n])=>[e,Object.freeze([...n])])));var Yt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),Xt=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),Zt=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var nc=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),oc=new Set(Yt),ic=new Set(Xt),sc=new Set(Zt);var ac=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var cc=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var mc=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var Ec=32*1024*1024;var Sc=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as er,randomBytes as Bc,timingSafeEqual as tr}from"node:crypto";import rr from"node:fs";import S from"node:path";import{homedir as Q}from"node:os";import{join as ee}from"node:path";var Le=process.env.ORACLE_PUBLIC_DESKTOP==="1",Qt=Le?process.env.ORACLE_CONFIG_DIR||ee(Q(),".config","oracle"):ee(Q(),".config","oracle"),Ic=Le?Qt:ee(Q(),".config","mad-desk");var Cc="0".repeat(64),Rc=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function j(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(j).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+j(e[t])).join(",")+"}"}var $c=Promise.resolve();function nr(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return rr.realpathSync(a)}catch{return S.resolve(a)}},r=t(S.dirname(S.resolve(e))),i=t(S.dirname(S.resolve(n))),o=(a,l)=>l===a||l.startsWith(a+S.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var te=(e,n)=>er("sha256",n).update(j(e)).digest("hex"),or=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&tr(t,r)};function ir(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:te(r,n)}}}function Pe(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!or(r?.integrity?.mac,te(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function sr(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let l=Pe(e,t);o=l.present&&l.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:te(a,t)}})+`
-`)}function Be(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=Pe(r,i);nr(r,e);let a=Number(o.sequence||0)+1,l=ir(t,i,{sequence:a});sr(r,a,i,l?.integrity?.mac??null),g(e,JSON.stringify(l,null,2)+`
-`)}import{readFileSync as Jc,readdirSync as Kc,existsSync as ar}from"node:fs";import{dirname as cr,join as C}from"node:path";import{fileURLToPath as lr}from"node:url";var R=cr(lr(import.meta.url));function ur(){let e=[C(R,"descriptors"),C(R,"clear-sign","descriptors"),C(R,"..","clear-sign","descriptors"),C(R,"..","..","clear-sign","descriptors"),C(R,"..","..","..","clear-sign","descriptors")];for(let n of e)if(ar(n))return n;return e[0]}var Zc=ur();var Qc=(1n<<256n)-1n;import{Wallet as re}from"ethers";import{base58 as ne}from"@scure/base";import{ed25519 as qe}from"@noble/curves/ed25519.js";import{NETWORK as Me,TEST_NETWORK as He,WIF as dr,p2wpkh as De}from"@scure/btc-signer";import{pubECDSA as fr}from"@scure/btc-signer/utils.js";var F=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},pr=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},je=e=>{let n=String(e||"").trim();try{let t=Buffer.from(ne.decode(n));return ne.encode(t)===n?t:null}catch{return null}},oe=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(qe.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},Fe=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),y=(e,n)=>{if(n==="sol")return oe(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},mr=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return y(t,n)};function b(e,n){let t=String(n||"").trim();if(e==="evm")return new re(t).privateKey;if(e==="btc")for(let o of[Me,He])try{return Buffer.from(dr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let c=F(t.slice(4));if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}if(/^base58:/i.test(t)){let c=je(t.slice(7));if(!Fe(c))throw new Error("sol: invalid explicit base58 private key");return oe(c)}if(/^0x/i.test(t)){let c=F(t);if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}let o=F(t),a=o&&(o.length===32||o.length===64)?y(o,"sol"):null,l=je(t),f=Fe(l);if(a&&f&&!a.equals(f))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(f)return oe(l);if(o)return y(o,"sol")}let r=F(t);if(r)return e==="evm"?new re(`0x${r.toString("hex")}`).privateKey:y(r,e);let i=pr(t);if(i)return y(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return mr(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return b(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let t=new re(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=y(n,"btc"),r=fr(t);return{kind:e,secret:t.toString("hex"),addresses:[De(r,Me).address,De(r,He).address]}}if(e==="sol"){let t=y(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[ne.encode(qe.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function q(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=A(o,b(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let l=(c,d=!0)=>{let u=a[c];if(!(!d&&u===void 0)){if(!Array.isArray(u)||u.length<4||u.some(k=>!Number.isInteger(k)||k<0||k>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(u)}},f=a.apiSecretEncoding;if(f!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:l("apiKeyBytes"),apiSecretBytes:l("apiSecretBytes"),apiSecretEncoding:f,passphraseBytes:l("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ze(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function We(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var ml=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),wl=Object.freeze(["binance","bybit","okx","coinbase"]),hl=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),gl=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),yl=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),bl=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),El=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),xl=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),Sl=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Al=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),vl=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var gr=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Ue=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Ll=256*1024;var sd=new ie(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),ad=new ie(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),cd=new ie(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ve(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||w.join(process.env.XDG_STATE_HOME||w.join(yr.homedir(),".local","state"),"oracle"),t=br("sha256").update(w.resolve(e)).digest("hex").slice(0,16);return{vault:w.join(e,"vault.json"),policy:w.join(e,"signer-policy.json"),policyKey:w.join(e,"policy-integrity-key"),policyAnchor:w.join(n,`signer-policy-${t}.high-water`),ledger:w.join(e,"signer-ledger.json"),ledgerAnchor:w.join(n,`signer-ledger-${t}.high-water`),cexOrders:w.join(e,"cex-orders.json"),cexOrdersAnchor:w.join(n,`cex-orders-${t}.high-water`),token:w.join(e,"signer-token"),lock:w.join(n,`signer-${t}.lock`),workflowLedger:w.join(e,"workflow-events.jsonl")}}import{randomBytes as Er}from"node:crypto";import{Wallet as Je}from"ethers";var Ge=`oracle sign init|import|import-phrase|export|policy|status|unlock|lock|doctor
+var Xe=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import R from"node:fs";import Ze from"node:os";import x from"node:path";import{fileURLToPath as Qe}from"node:url";function ue(){return process.env.ORACLE_FAKE_HOME||Ze.homedir()}function tt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function $(){return tt()?process.env.ORACLE_CONFIG_DIR||x.join(ue(),".config","oracle"):x.join(ue(),".config","oracle")}function rt(){return x.join($(),"desk.json")}function nt(){return x.join($(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=nt();if(R.existsSync(i))for(let o of R.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let l=a[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),t(a[1],l)}}catch{}try{let i=rt();if(R.existsSync(i)){let o=JSON.parse(R.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var et,Rr,de=Xe(()=>{et=x.dirname(Qe(import.meta.url)),Rr=x.resolve(et,"../..");try{E()}catch{}});de();import m from"node:fs";import M from"node:path";import{createCipheriv as ot,createDecipheriv as it,randomBytes as O,scryptSync as st}from"node:crypto";import s from"node:fs";import p from"node:path";var fe="ORACLE-LOCAL-VAULT",pe=1,k=Object.freeze({N:1<<17,r:8,p:1}),at=256*1024*1024,ct=16*1024;function P(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function me(e,n,t=k){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");if(r.includes("\0"))throw new Error("local-vault: refusing zeroed passphrase material");return st(r,n,32,{...t,maxmem:at})}function we(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:fe,version:pe,kdf:{name:"scrypt",...k,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},l=me(n,i);try{let f=ot("aes-256-gcm",l,o);f.setAAD(Buffer.from(JSON.stringify(a)));let c=Buffer.concat([f.update(r),f.final()]);return{...a,ciphertext:c.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{l.fill(0),r.fill(0)}}function T(e,n){if(e?.magic!==fe||e?.version!==pe)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==k.N||e.kdf.r!==k.r||e.kdf.p!==k.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!t.includes(u)))throw new Error("local-vault: unexpected vault field");let r=P(e.kdf.salt,32,"salt"),i=P(e.cipher.iv,12,"iv"),o=P(e.tag,16,"tag"),a=P(e.ciphertext,1,"ciphertext",{max:ct}),{ciphertext:l,tag:f,...c}=e,d=me(n,r);try{let u=it("aes-256-gcm",d,i);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(o),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function lt(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function z(e){let n=p.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(lt(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function N(e){return JSON.parse(h(e))}function he(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),z(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
+`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(p.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let l=s.openSync(p.dirname(e),"r");try{s.fsyncSync(l)}finally{s.closeSync(l)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function g(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),z(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(p.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}function ut(e,n){try{s.linkSync(e,n)}catch(r){throw r?.code==="EEXIST"?new Error("export destination already exists; choose a new owner-only file"):r}s.chmodSync(n,384),s.unlinkSync(e);let t=s.openSync(p.dirname(n),"r");try{s.fsyncSync(t)}finally{s.closeSync(t)}}function ge(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),z(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,String(n)),s.fsyncSync(r),s.closeSync(r),r=void 0,ut(t,e)}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}}import w from"node:path";import Er from"node:os";import{createHash as xr,randomBytes as Hu}from"node:crypto";import{Interface as se,keccak256 as Wu}from"ethers";import{Transaction as Vu}from"@scure/btc-signer";import{ed25519 as Ju}from"@noble/curves/ed25519.js";import{base58 as ws}from"@scure/base";import{Interface as Ae}from"ethers";import{Interface as wt,MaxUint256 as yn,isAddress as bn,keccak256 as En,toUtf8Bytes as xn}from"ethers";import{Interface as pt,isAddress as Zr}from"ethers";import{isAddress as Vr}from"ethers";var rn=new pt(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as mt,isAddress as sn}from"ethers";var un=new mt(["function approve(address spender,uint256 amount) returns (bool)"]),dn=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var On=new wt(["function approve(address spender,uint256 amount) returns (bool)"]);var Nn=300*1e3,Cn=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Pn,NETWORK as Bn,OutScript as Dn,RawTx as Fn,SigHash as jn,TEST_NETWORK as qn,Transaction as Mn}from"@scure/btc-signer";import{createHash as ht}from"node:crypto";import{base58 as Un}from"@scure/base";import{getCompiledTransactionMessageDecoder as Kn}from"@solana/transaction-messages";var ye=e=>ht("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Jn=new Map([[ye("route"),{name:"route",prefixBytes:0}],[ye("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var ro=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,no=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,oo=AbortSignal.prototype.throwIfAborted,io=EventTarget.prototype.addEventListener,so=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null;var ao=64*1024,co=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024});var bo=Object.freeze({tradexyz:"xyz",ventuals:"vntl",hypernova:"hyna",paradex:"para"});var vo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Io=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var To="0x"+"00".repeat(32);var yt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Ro=Object.freeze(yt.map(e=>e[0]));import{TypedDataEncoder as ui,getAddress as di}from"ethers";import{TypedDataEncoder as Fo,getAddress as jo,isAddress as qo}from"ethers";var Et=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),xt=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as Xo,getAddress as Zo,isAddress as Qo}from"ethers";var zo=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var St=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),si=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var At=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),ai=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var mi=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Nt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var _i=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var Ct=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Li=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Ri=new Ae(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),$i=new Ae(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Pi=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var _t=Object.freeze([...Nt]),Bi=Object.freeze({...Ct});import{ed25519 as Zi}from"@noble/curves/ed25519.js";import{base58 as es}from"@scure/base";import{RawTx as rs,SigHash as ns,Transaction as os}from"@scure/btc-signer";import{Transaction as ss,keccak256 as as,verifyTypedData as cs}from"ethers";import{encode as ji}from"@msgpack/msgpack";import{keccak256 as Mi,verifyTypedData as Hi}from"ethers";var zi=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Wi=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{closeSync as _s,constants as Pt,fchmodSync as Ls,fsyncSync as Rs,lstatSync as $s,mkdirSync as Ps,openSync as Bs,readFileSync as Ds,renameSync as Fs,rmSync as js,writeFileSync as qs}from"node:fs";import{wordlists as Ts}from"ethers";var zs=Pt.O_NOFOLLOW??0;import{wordlists as Vs}from"ethers";var ve=64*1024;var Js=32*1024;var Ft=["schemaVersion","buildVersion","recordType","execution","custody"],Xs=[...Ft,"recordHash"];var Zs=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var jt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Re=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),na=new Set(Re);var Ut=64*1024*1024;var ua=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),da=Object.freeze(["read","simulate"]);var fa=1440*60;var xa=Object.freeze(["privkey","wif","xprv","seed"]);var Sa=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),Aa=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var Q=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Oa=Object.freeze(Object.fromEntries(Q.map((e,n)=>[e,Object.freeze(n+1<Q.length?[Q[n+1]]:[])])));var Vt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var Jt=Object.freeze(["owner","operator","agent","viewer"]),Gt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),Yt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),dc=Object.freeze(["owner"]),fc=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),pc=new Set(Jt),mc=new Set(Gt),wc=new Set(Object.values(Yt));var Xt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),hc=Object.freeze(Object.fromEntries(Object.entries(Xt).map(([e,n])=>[e,Object.freeze([...n])])));var Zt=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),Qt=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),er=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Ec=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),xc=new Set(Zt),Sc=new Set(Qt),Ac=new Set(er);var vc=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Ic=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var _c=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var Dc=32*1024*1024;var jc=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as rr,randomBytes as Qc,timingSafeEqual as nr}from"node:crypto";import or from"node:fs";import S from"node:path";import{homedir as ee}from"node:os";import{join as te}from"node:path";var $e=process.env.ORACLE_PUBLIC_DESKTOP==="1",tr=$e?process.env.ORACLE_CONFIG_DIR||te(ee(),".config","oracle"):te(ee(),".config","oracle"),zc=$e?tr:te(ee(),".config","mad-desk");var Jc="0".repeat(64),Gc=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function F(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(F).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+F(e[t])).join(",")+"}"}var Yc=Promise.resolve();function ir(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return or.realpathSync(a)}catch{return S.resolve(a)}},r=t(S.dirname(S.resolve(e))),i=t(S.dirname(S.resolve(n))),o=(a,l)=>l===a||l.startsWith(a+S.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var re=(e,n)=>rr("sha256",n).update(F(e)).digest("hex"),sr=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&nr(t,r)};function ar(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:re(r,n)}}}function Pe(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!sr(r?.integrity?.mac,re(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function cr(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let l=Pe(e,t);o=l.present&&l.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:re(a,t)}})+`
+`)}function Be(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=Pe(r,i);ir(r,e);let a=Number(o.sequence||0)+1,l=ar(t,i,{sequence:a});cr(r,a,i,l?.integrity?.mac??null),g(e,JSON.stringify(l,null,2)+`
+`)}import{readFileSync as ul,readdirSync as dl,existsSync as lr}from"node:fs";import{dirname as ur,join as _}from"node:path";import{fileURLToPath as dr}from"node:url";var L=ur(dr(import.meta.url));function fr(){let e=[_(L,"descriptors"),_(L,"clear-sign","descriptors"),_(L,"..","clear-sign","descriptors"),_(L,"..","..","clear-sign","descriptors"),_(L,"..","..","..","clear-sign","descriptors")];for(let n of e)if(lr(n))return n;return e[0]}var wl=fr();var hl=(1n<<256n)-1n;import{Wallet as ne}from"ethers";import{base58 as oe}from"@scure/base";import{ed25519 as qe}from"@noble/curves/ed25519.js";import{NETWORK as Me,TEST_NETWORK as He,WIF as pr,p2wpkh as De}from"@scure/btc-signer";import{pubECDSA as mr}from"@scure/btc-signer/utils.js";var j=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},wr=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},Fe=e=>{let n=String(e||"").trim();try{let t=Buffer.from(oe.decode(n));return oe.encode(t)===n?t:null}catch{return null}},ie=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(qe.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},je=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),y=(e,n)=>{if(n==="sol")return ie(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},hr=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return y(t,n)};function b(e,n){let t=String(n||"").trim();if(e==="evm")return new ne(t).privateKey;if(e==="btc")for(let o of[Me,He])try{return Buffer.from(pr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let c=j(t.slice(4));if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}if(/^base58:/i.test(t)){let c=Fe(t.slice(7));if(!je(c))throw new Error("sol: invalid explicit base58 private key");return ie(c)}if(/^0x/i.test(t)){let c=j(t);if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}let o=j(t),a=o&&(o.length===32||o.length===64)?y(o,"sol"):null,l=Fe(t),f=je(l);if(a&&f&&!a.equals(f))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(f)return ie(l);if(o)return y(o,"sol")}let r=j(t);if(r)return e==="evm"?new ne(`0x${r.toString("hex")}`).privateKey:y(r,e);let i=wr(t);if(i)return y(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return hr(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return b(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let t=new ne(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=y(n,"btc"),r=mr(t);return{kind:e,secret:t.toString("hex"),addresses:[De(r,Me).address,De(r,He).address]}}if(e==="sol"){let t=y(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[oe.encode(qe.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function q(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=A(o,b(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let l=(c,d=!0)=>{let u=a[c];if(!(!d&&u===void 0)){if(!Array.isArray(u)||u.length<4||u.some(I=>!Number.isInteger(I)||I<0||I>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(u)}},f=a.apiSecretEncoding;if(f!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:l("apiKeyBytes"),apiSecretBytes:l("apiSecretBytes"),apiSecretEncoding:f,passphraseBytes:l("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function ze(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function We(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var _l=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),Ll=Object.freeze(["binance","bybit","okx","coinbase"]),Rl=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),$l=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),Pl=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),Bl=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),Dl=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),Fl=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),jl=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),ql=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Ml=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var br=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Ue=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Xl=256*1024;var Id=new se(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),kd=new se(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Od=new se(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ve(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||w.join(process.env.XDG_STATE_HOME||w.join(Er.homedir(),".local","state"),"oracle"),t=xr("sha256").update(w.resolve(e)).digest("hex").slice(0,16);return{vault:w.join(e,"vault.json"),policy:w.join(e,"signer-policy.json"),policyKey:w.join(e,"policy-integrity-key"),policyAnchor:w.join(n,`signer-policy-${t}.high-water`),ledger:w.join(e,"signer-ledger.json"),ledgerAnchor:w.join(n,`signer-ledger-${t}.high-water`),executionOutbox:w.join(e,"signer-execution-outbox.json"),cexOrders:w.join(e,"cex-orders.json"),cexOrdersAnchor:w.join(n,`cex-orders-${t}.high-water`),token:w.join(e,"signer-token"),lock:w.join(n,`signer-${t}.lock`),workflowLedger:w.join(e,"workflow-events.jsonl")}}import{randomBytes as Sr}from"node:crypto";import{Wallet as Ke}from"ethers";var Ge=`oracle sign init|import|import-phrase|export|policy|status|unlock|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -15,18 +15,18 @@ var Xe=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,v=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},Ke=e=>{let n=String(v(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function xr(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=l=>{for(let f of l){if(f===3){a(),r(new Error("cancelled"));return}if(f===13||f===10){a(),process.stderr.write(`
-`),t(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function se(e,n){let t=v(e,"--passphrase-file");return t?h(t):xr("Vault passphrase: ",n)}function Sr(e){return e.addresses.join(", ")}function Ar(e,n){m.mkdirSync(M.dirname(e.vault),{recursive:!0,mode:448}),g(e.lock,`locked
-`),we(e.vault,n),m.existsSync(e.policyKey)||g(e.policyKey,Er(32).toString("hex")+`
-`)}async function vr(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||L(),o=Ve(M.join(i,"signer"));if(!r||r==="help")return t.write(Ge+`
+They are never accepted as argument values or inherited environment variables.`,v=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},Je=e=>{let n=String(v(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Ar(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=l=>{for(let f of l){if(f===3){a(),r(new Error("cancelled"));return}if(f===13||f===10){a(),process.stderr.write(`
+`),t(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function ae(e,n){let t=v(e,"--passphrase-file");return t?h(t):Ar("Vault passphrase: ",n)}function vr(e){return e.addresses.join(", ")}function Ir(e,n){m.mkdirSync(M.dirname(e.vault),{recursive:!0,mode:448}),g(e.lock,`locked
+`),he(e.vault,n),m.existsSync(e.policyKey)||g(e.policyKey,Sr(32).toString("hex")+`
+`)}async function kr(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||$(),o=Ve(M.join(i,"signer"));if(!r||r==="help")return t.write(Ge+`
 `),0;if(r==="status")return t.write(JSON.stringify({initialized:m.existsSync(o.vault),policyConfigured:m.existsSync(o.policy),armed:m.existsSync(o.vault)&&!m.existsSync(o.lock),disarmed:m.existsSync(o.lock)})+`
 `),0;if(r==="lock")return m.mkdirSync(M.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),t.write(`Local signer locked.
-`),0;if(r==="unlock"){if(!e.includes("--acknowledge-local-signing"))throw new Error("unlock requires --acknowledge-local-signing");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=await se(e,n);T(N(o.vault),c).fill(0);try{m.unlinkSync(o.lock)}catch(u){if(u.code!=="ENOENT")throw u}return t.write(`Local signer unlocked. Transaction signing still requires exact policy and owner confirmation.
+`),0;if(r==="unlock"){if(!e.includes("--acknowledge-local-signing"))throw new Error("unlock requires --acknowledge-local-signing");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=await ae(e,n);T(N(o.vault),c).fill(0);try{m.unlinkSync(o.lock)}catch(u){if(u.code!=="ENOENT")throw u}return t.write(`Local signer unlocked. Transaction signing still requires exact policy and owner confirmation.
 `),0}if(r==="doctor"){let c=[];return m.existsSync(o.vault)||c.push("vault missing"),m.existsSync(o.policy)||c.push("policy missing (empty allowlists fail closed)"),t.write(c.length?`Signer not ready: ${c.join("; ")}
 `:`Signer files ready; explicitly unlock locally before a bounded signing session.
 `),c.length?1:0}if(r==="policy"){if(!m.existsSync(o.vault)||!m.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let c=v(e,"--policy-file");if(!c)throw new Error("policy requires --policy-file <0600 JSON file>");let d;try{d=JSON.parse(h(c))}catch{throw new Error("policy file must contain valid JSON")}for(let u of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(d[u])||d[u].length===0)throw new Error(`policy: ${u} allowlist is empty`);return Be(o.policy,o.policyKey,d,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(r==="export"){if(!e.includes("--acknowledge-raw-key-export"))throw new Error("export requires --acknowledge-raw-key-export");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=Ke(e),d=v(e,"--output-file");if(!d)throw new Error("export requires --output-file <0600 file>");let u=M.resolve(d),k=await se(e,n),ae=N(o.vault),ce=T(ae,k);try{let H=q(ce,ae.meta)[c];if(!H)throw new Error(`local signer has no ${c} key`);let Ye=c==="evm"?H.secret:`0x${H.secret.replace(/^0x/,"")}`;he(u,`${Ye}
+`),0}if(r==="export"){if(!e.includes("--acknowledge-raw-key-export"))throw new Error("export requires --acknowledge-raw-key-export");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=Je(e),d=v(e,"--output-file");if(!d)throw new Error("export requires --output-file <0600 file>");let u=M.resolve(d),I=await ae(e,n),ce=N(o.vault),le=T(ce,I);try{let H=q(le,ce.meta)[c];if(!H)throw new Error(`local signer has no ${c} key`);let Ye=c==="evm"?H.secret:`0x${H.secret.replace(/^0x/,"")}`;ge(u,`${Ye}
 `),t.write(`Private key exported to owner-only file ${u}. Protect it as wallet custody.
-`)}finally{ce.fill(0)}return 0}if(r!=="init"&&r!=="import"&&r!=="import-phrase")throw new Error(`unknown subcommand '${r}'`);let a=await se(e,n),l={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let c=N(o.vault),d=T(c,a);try{l=q(d,c.meta)}finally{d.fill(0)}}if(r==="init"){let c=Je.createRandom();l.evm=A("evm",b("evm",c.privateKey))}else if(r==="import"){let c=Ke(e),d=v(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");l[c]=A(c,b(c,h(d)))}else{let c=v(e,"--phrase-file");if(!c)throw new Error("import-phrase requires --phrase-file <0600 file>");if(l.evm&&!e.includes("--replace-evm"))throw new Error("local signer already holds an evm key; pass --replace-evm to overwrite it");let d=Je.fromPhrase(h(c).trim().replace(/\s+/g," "));l.evm=A("evm",b("evm",d.privateKey))}Ar(o,me(ze(l),a,We(l)));let f=Object.entries(l).map(([c,d])=>`${c}:${Sr(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
-`),0}var bd={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:Ge,run:e=>vr(e.argv||[])};export{bd as default,Ar as publishLockedVault,vr as run};
+`)}finally{le.fill(0)}return 0}if(r!=="init"&&r!=="import"&&r!=="import-phrase")throw new Error(`unknown subcommand '${r}'`);let a=await ae(e,n),l={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let c=N(o.vault),d=T(c,a);try{l=q(d,c.meta)}finally{d.fill(0)}}if(r==="init"){let c=Ke.createRandom();l.evm=A("evm",b("evm",c.privateKey))}else if(r==="import"){let c=Je(e),d=v(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");l[c]=A(c,b(c,h(d)))}else{let c=v(e,"--phrase-file");if(!c)throw new Error("import-phrase requires --phrase-file <0600 file>");if(l.evm&&!e.includes("--replace-evm"))throw new Error("local signer already holds an evm key; pass --replace-evm to overwrite it");let d=Ke.fromPhrase(h(c).trim().replace(/\s+/g," "));l.evm=A("evm",b("evm",d.privateKey))}Ir(o,we(ze(l),a,We(l)));let f=Object.entries(l).map(([c,d])=>`${c}:${vr(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
+`),0}var Fd={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:Ge,run:e=>kr(e.argv||[])};export{Fd as default,Ir as publishLockedVault,kr as run};