@oracle-agent/oracle 0.35.4 → 0.35.6

package/dist/cli/commands/snipe.mjs

@@ -1,9 +1,11 @@
-var bt=/\b0x[a-fA-F0-9]{40}\b/g,gt=/\b[1-9A-HJ-NP-Za-km-z]{32,44}\b/g,wt=new Set(["0x0000000000000000000000000000000000000000","0x000000000000000000000000000000000000dead","0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"].map(e=>e.toLowerCase())),vt=new Set(["So11111111111111111111111111111111111111112","EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB","11111111111111111111111111111111"]);function yt(e){return!(vt.has(e)||/^0x/i.test(e)||!/\d/.test(e)&&e===e.toLowerCase()||!/\d/.test(e)&&e===e.toUpperCase())}function ve(e,{extras:t=[]}={}){let r=[e,...t].map(o=>String(o||"")).join(`
-`),s=[...new Set((r.match(bt)||[]).map(o=>o.toLowerCase()))].filter(o=>!wt.has(o)),n=[...new Set(r.match(gt)||[])].filter(yt);return{evm:s,solana:n,all:[...s.map(o=>({chainFamily:"evm",address:o})),...n.map(o=>({chainFamily:"solana",address:o}))]}}function ye(e){let t=String(e||"").trim();if(!t)return[];let r=[],s=n=>{if(!n||typeof n!="object")return;let o=String(n.id||n.id_str||n.tweetId||n.statusId||""),a=n.text||n.full_text||n.fullText||n.body||n.note_tweet?.text||"",c=[],i=n.entities?.urls||n.entities?.Urls||[];for(let d of i)d?.expanded_url&&c.push(d.expanded_url),d?.url&&c.push(d.url);(o||a)&&r.push({id:o,text:String(a),urls:c,raw:n})};try{let n=JSON.parse(t),o=Array.isArray(n)?n:n.data?Array.isArray(n.data)?n.data:[n.data]:n.tweets||n.statuses||n.results||[];Array.isArray(o)?o.forEach(s):s(n)}catch{for(let n of t.split(`
-`)){let o=n.trim();if(o.startsWith("{"))try{s(JSON.parse(o))}catch{}}r.length||r.push({id:"",text:t,urls:[]})}return r}import{spawnSync as Ot}from"node:child_process";import Ee from"node:fs";import Z from"node:path";var Et=(process.env.ORACLE_REDACT_SECRETS??"true").toLowerCase(),St=["1","true","yes","on"].includes(Et),At=[/sk-[A-Za-z0-9_-]{10,}/g,/sk_live_[A-Za-z0-9]{10,}/g,/sk_test_[A-Za-z0-9]{10,}/g,/ghp_[A-Za-z0-9]{10,}/g,/github_pat_[A-Za-z0-9_]{10,}/g,/gho_[A-Za-z0-9]{10,}/g,/ghs_[A-Za-z0-9]{10,}/g,/xox[baprs]-[A-Za-z0-9-]{10,}/g,/AIza[A-Za-z0-9_-]{30,}/g,/AKIA[A-Z0-9]{16}/g,/pplx-[A-Za-z0-9]{10,}/g,/hf_[A-Za-z0-9]{10,}/g,/xai-[A-Za-z0-9]{30,}/g,/gsk_[A-Za-z0-9]{10,}/g,/npm_[A-Za-z0-9]{10,}/g,/tvly-[A-Za-z0-9]{10,}/g,/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi],xt=/\b0x[a-fA-F0-9]{64}\b/g,Ct=/-----BEGIN (?:RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g,kt=/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,It=/\b([A-Z][A-Z0-9_]{0,40}(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE_?KEY|MNEMONIC|SEED|AUTH)[A-Z0-9_]{0,20})\s*=\s*(['"]?)(\S+)\2/g,_t=/^(?:export\s+)?((?:api[_-]?key|token|secret|password|private[_-]?key|mnemonic|seed[_-]?phrase|authorization))\s*[:=]\s*(['"]?)([^\s&]+)\2/gim,Nt=/("(?:api[_-]?key|apiKey|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|privateKey|secret|password|authorization|bearer|mnemonic|seedPhrase)"\s*:\s*")([^"]{6,})(")/gi,Lt=new Set(["access_token","refresh_token","id_token","token","api_key","apikey","client_secret","password","auth","jwt","session","secret","key","code","signature","x-amz-signature","private_key","authorization"]),tn=new Set([...Lt].map(e=>e.replace(/[^a-z0-9]/gi,"").toLowerCase()));function Tt(e){let t=String(e??"");return t.length<18?"[REDACTED]":`${t.slice(0,6)}\u2026${t.slice(-4)}`}function Rt(e){return`\xABredacted:${String(e??"").slice(0,4)}\u2026\xBB`}function H(e,t={}){if(e==null)return e;let r=typeof e=="string"?e:String(e);if(!r||!(t.force||St))return r;let s=t.fileRead?Rt:Tt;r=r.replace(Ct,"[REDACTED_PRIVATE_KEY]"),r=r.replace(xt,"[REDACTED_EVM_KEY]"),r=r.replace(kt,n=>s(n));for(let n of At)n.lastIndex=0,r=r.replace(n,o=>s(o));return r=r.replace(It,(n,o,a,c)=>/^(?:os\.(?:getenv|environ)|process\.env|\$ENV\{)/.test(c)?`${o}=${a||""}${c}${a||""}`:`${o}=${a||""}${s(c)}${a||""}`),r=r.replace(_t,(n,o,a,c)=>n.replace(c,s(c))),r=r.replace(Nt,(n,o,a,c)=>`${o}${s(a)}${c}`),r}var Se=45e3,qt=4e4,Ut=Object.freeze(["whoami","user","read","search","timeline","mentions","bookmarks","likes","following","followers","dms","auth"]),Pt=Object.freeze(["post","reply","quote","delete","like","unlike","repost","unrepost","bookmark","unbookmark","follow","unfollow","block","unblock","mute","unmute","dm"]),Ae=Object.freeze(["--verbose","-v","--trace","-t","--bearer-token","--consumer-key","--consumer-secret","--access-token","--token-secret","--client-id","--client-secret"]);function Bt(e=process.env){let t=String(e.ORACLE_XURL_ENABLED||"").trim().toLowerCase();return t==="1"||t==="true"||t==="yes"||t==="on"}function xe(e=process.env){let t=String(e.ORACLE_XURL_ALLOW_WRITE||"").trim().toLowerCase();return t==="1"||t==="true"||t==="yes"||t==="on"}function $t(e=process.env){let t=String(e.ORACLE_XURL_BIN||"").trim();if(t)return Z.isAbsolute(t)?Ee.existsSync(t)?{ok:!0,bin:t}:{ok:!1,error:`ORACLE_XURL_BIN not found: ${t}`}:{ok:!1,error:"ORACLE_XURL_BIN must be absolute"};let r=String(e.PATH||process.env.PATH||"");for(let s of r.split(Z.delimiter)){if(!s)continue;let n=Z.join(s,"xurl");try{if(Ee.existsSync(n))return{ok:!0,bin:n}}catch{}}return{ok:!1,error:"xurl binary not found on PATH. Install: curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash"}}function Ft(e=process.env){let t=e.HOME||process.env.HOME||"";return{PATH:e.PATH||process.env.PATH||"/usr/bin:/bin",HOME:t,USER:e.USER||process.env.USER||"",LANG:e.LANG||process.env.LANG||"C.UTF-8",LC_ALL:e.LC_ALL||process.env.LC_ALL||"C.UTF-8",XDG_CONFIG_HOME:e.XDG_CONFIG_HOME||process.env.XDG_CONFIG_HOME||"",XDG_DATA_HOME:e.XDG_DATA_HOME||process.env.XDG_DATA_HOME||"",NO_COLOR:"1"}}function Dt(e){for(let t of e){let r=String(t);if(Ae.includes(r))return r;if(Ae.some(s=>s.startsWith("--")&&r.startsWith(`${s}=`)))return r.split("=")[0]}return null}function Mt(e={},t=process.env){let r;if(Array.isArray(e.argv))r=e.argv.map(i=>String(i));else{let i=String(e.command||e.cmd||"").trim();if(!i)return{ok:!1,error:"command is required (e.g. whoami, search, read, post)"};let d=Array.isArray(e.args)?e.args.map(u=>String(u)):typeof e.query=="string"?[e.query]:typeof e.text=="string"?[e.text]:typeof e.id=="string"?[e.id]:typeof e.handle=="string"?[e.handle]:[];i==="search"&&e.limit!=null&&d.push("-n",String(Math.min(50,Math.max(1,Number(e.limit)||10)))),(i==="timeline"||i==="mentions")&&e.limit!=null&&d.push("-n",String(Math.min(50,Math.max(1,Number(e.limit)||10)))),r=[i,...d]}if(r.length===0)return{ok:!1,error:"empty argv"};if(r.length>24)return{ok:!1,error:"too many arguments"};for(let i of r)if(String(i).length>4e3)return{ok:!1,error:"argument too long"};let s=Dt(r);if(s)return{ok:!1,error:`forbidden flag: ${s}`};if(r.some(i=>String(i).includes("\0")))return{ok:!1,error:"nul byte in argv"};let n=String(r[0]||"").replace(/^\//,"");if(n.startsWith("2/")||r[0].startsWith("/2/")||r[0].startsWith("https://api.x.com/")){if(!xe(t)&&r.some(i=>/^-X$/.test(i)||/^--request$/.test(i))){let i=r.findIndex(u=>u==="-X"||u==="--request"),d=String(r[i+1]||"GET").toUpperCase();if(d!=="GET"&&d!=="HEAD")return{ok:!1,error:"raw non-GET requires ORACLE_XURL_ALLOW_WRITE=true"}}}else if(n==="auth"){if(String(r[1]||"")!=="status")return{ok:!1,error:"only `auth status` is allowed (no apps add / oauth2 from the agent)"}}else if(!Ut.includes(n))if(Pt.includes(n)){if(!xe(t))return{ok:!1,error:`write command '${n}' requires ORACLE_XURL_ALLOW_WRITE=true`}}else return n==="media"?{ok:!1,error:"media upload is disabled in the agent tool (run xurl media outside the agent)"}:{ok:!1,error:`command not allowlisted: ${n}`};let o=[...r],a=String(t.ORACLE_XURL_APP||"").trim(),c=String(t.ORACLE_XURL_USER||"").trim();if(a&&!o.includes("--app")&&o.unshift("--app",a),c&&!o.includes("--username")&&!o.includes("-u")){let i=0;o[0]==="--app"&&(i=2),i<o.length&&o.splice(i+1,0,"-u",c)}return{ok:!0,argv:o,command:n}}async function Ce(e,t={},r={}){if(e!=="xurl")return{ok:!1,error:`unknown tool: ${e}`};let s=r.env||process.env;if(!Bt(s))return{ok:!1,error:"xurl is disabled. Set ORACLE_XURL_ENABLED=true after `xurl auth status` succeeds. Writes stay off until ORACLE_XURL_ALLOW_WRITE=true."};let n=Mt(t,s);if(!n.ok)return n;let o=$t(s);if(!o.ok)return o;let c=(r.spawnFn||Ot)(o.bin,n.argv,{encoding:"utf8",timeout:r.timeoutMs||Se,maxBuffer:1024*1024,env:Ft(s)});if(c.error){let l=c.error.code==="ETIMEDOUT"?`xurl timed out after ${r.timeoutMs||Se}ms`:String(c.error.message||c.error);return{ok:!1,error:H(l,{force:!0})}}let i=H(String(c.stdout||"").slice(0,qt),{force:!0}),d=H(String(c.stderr||"").slice(0,2e3),{force:!0}),u=typeof c.status=="number"?c.status:1;return{ok:u===0,status:u,command:n.command,argv:n.argv.map(l=>/=/.test(l)&&/token|secret|key|bearer/i.test(l)?"[redacted-arg]":l),stdout:i,stderr:d||void 0}}var cn=Object.freeze([{type:"function",function:{name:"xurl",description:"Call the official xurl CLI against the X API with an allowlisted command. Reads (whoami/user/read/search/timeline/mentions/...) work when ORACLE_XURL_ENABLED=true. Writes (post/reply/like/follow/dm/...) also need ORACLE_XURL_ALLOW_WRITE=true. Never pass secrets or --verbose. Auth is whatever the operator configured in ~/.xurl.",parameters:{type:"object",properties:{command:{type:"string",description:"xurl subcommand: whoami, user, read, search, timeline, mentions, post, reply, ..."},args:{type:"array",items:{type:"string"},description:"Positional args after the command (query, id, handle, text)."},query:{type:"string",description:"Convenience for search query."},text:{type:"string",description:"Convenience for post/reply/dm text."},id:{type:"string",description:"Convenience for read/like/reply target id or URL."},handle:{type:"string",description:"Convenience for user/follow/dm handle."},limit:{type:"integer",description:"Result limit for search/timeline/mentions (1-50)."},argv:{type:"array",items:{type:"string"},description:"Raw argv alternative (still allowlisted + flag-filtered)."}},additionalProperties:!1}}}]);import{createHash as Gt}from"node:crypto";import q from"node:net";import Ht from"node:dns";var Vt=new Set(["localhost","metadata.google.internal","metadata.goog"]);function V(e){let t=String(e).toLowerCase().split("%")[0];if((t.match(/::/g)||[]).length>1)return null;let r=u=>{if(!u)return[];let l=u.split(":"),p=l.at(-1);if(p?.includes(".")){let f=p.split(".").map(Number);if(f.length!==4||f.some(h=>!Number.isInteger(h)||h<0||h>255))return null;l.splice(l.length-1,1,(f[0]<<8|f[1]).toString(16),(f[2]<<8|f[3]).toString(16))}return l.some(f=>!/^[0-9a-f]{1,4}$/.test(f))?null:l.map(f=>Number.parseInt(f,16))},[s,n]=t.split("::"),o=r(s),a=r(n);if(!o||!a)return null;let c=t.includes("::"),i=8-o.length-a.length;if(!c&&i!==0||c&&i<1)return null;let d=[...o,...Array(Math.max(0,i)).fill(0),...a];return d.length!==8?null:Uint8Array.from(d.flatMap(u=>[u>>8,u&255]))}function J(e,t,r){let s=Math.floor(r/8),n=r%8;for(let a=0;a<s;a+=1)if(e[a]!==t[a])return!1;if(!n)return!0;let o=255<<8-n;return(e[s]&o)===(t[s]&o)}function ee(e){if(q.isIPv4(e)){let t=e.split(".").map(Number);return!(t[0]===0||t[0]===10||t[0]===127||t[0]>=224||t[0]===100&&t[1]>=64&&t[1]<=127||t[0]===169&&t[1]===254||t[0]===172&&t[1]>=16&&t[1]<=31||t[0]===192&&(t[1]===0||t[1]===2||t[1]===168)||t[0]===192&&t[1]===88&&t[2]===99||t[0]===198&&(t[1]===18||t[1]===19||t[1]===51)||t[0]===203&&t[1]===0&&t[2]===113)}if(q.isIPv6(e)){let t=V(e);if(!t)return!1;let r=V("::ffff:0:0");return J(t,r,96)?ee([...t.slice(12)].join(".")):J(t,V("2000::"),3)?![["2001::",23],["2001:db8::",32],["2001:10::",28],["2001:2::",48],["2002::",16],["3fff::",20]].some(([n,o])=>J(t,V(n),o)):!1}return!1}function Wt(e){let t;try{t=new URL(String(e))}catch{return{ok:!1,error:`not a valid URL: ${String(e).slice(0,120)}`}}if(t.protocol!=="http:"&&t.protocol!=="https:")return{ok:!1,error:`refused protocol ${t.protocol} (only http/https)`};let r=t.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.+$/,"");if(Vt.has(r)||r.endsWith(".localhost")||r.endsWith(".internal"))return{ok:!1,error:`refused internal host ${r}`};let s=q.isIP(r);return s!==0&&!ee(r)?{ok:!1,error:`refused private address ${r}`}:{ok:!0,url:t,host:r,isLiteralIp:s!==0}}async function te(e,{lookupFn:t=Ht.promises.lookup}={}){let r=Wt(e);if(!r.ok)return r;if(r.isLiteralIp)return{ok:!0,url:r.url,addresses:[{address:r.host,family:q.isIPv6(r.host)?6:4}]};let s;try{s=await t(r.host,{all:!0,verbatim:!0})}catch{return{ok:!1,error:`refused: ${r.host} did not resolve`}}return!Array.isArray(s)||s.length===0||s.some(n=>!ee(n.address))?{ok:!1,error:`refused: ${r.host} resolves to a non-public address`}:{ok:!0,url:r.url,addresses:s}}async function re({requireUndici:e=!1,importUndici:t=()=>import("undici")}={}){let r,s;try{let l=await t();r=l.Agent,s=l.fetch}catch(l){if(e)throw new Error(`egress-guard: untrustedUrl pinning requires the undici package, which failed to load: ${l?.message||l}`);return null}if(typeof r!="function"||typeof s!="function"){if(e)throw new Error("egress-guard: untrustedUrl pinning requires undici's Agent and fetch exports, which were not found on the imported module");return null}let n=l=>String(l).toLowerCase().replace(/^\[|\]$/g,"").replace(/\.+$/,""),o=new Map,a=l=>(Array.isArray(l)?l:[l]).map(p=>typeof p=="string"?{address:p}:p).filter(p=>p&&p.address).map(p=>({address:p.address,family:p.family||(q.isIPv6(p.address)?6:4)})),c=(l,p,f)=>{o.set(n(l),a(typeof p=="string"?[{address:p,family:f}]:p))},i=l=>{let p=n(l);if(q.isIP(p))return[{address:p,family:q.isIPv6(p)?6:4}];let f=o.get(p);if(!f||!f.length)throw new Error(`refused: unpinned host ${l} during pinned fetch`);return f},d=new r({connect:{lookup(l,p,f){let h;try{h=i(l)}catch(b){return f(b)}return p?.all?f(null,h):f(null,h[0].address,h[0].family)}}}),u=zt((l,p={})=>s(l,{...p,dispatcher:d}),c);return{dispatcher:d,fetch:u,pin:c,resolve:i,async close(){try{await d.destroy()}catch{}}}}var ne=Symbol.for("oracle.egressGuard.pinCapableFetch");function zt(e,t){if(typeof e!="function")throw new Error("markPinCapableFetch: fetchImpl must be a function");if(typeof t!="function")throw new Error("markPinCapableFetch: pin must be a function");return e[ne]=Object.freeze({pin:t}),e}function oe(e){return typeof e=="function"&&typeof e[ne]?.pin=="function"}function ke(e,t,r){if(!oe(e))throw new Error("pinFetchToAddresses: fetchImpl is not pin-capable");e[ne].pin(t,r)}var jt=new Set([408,425,429,500,502,503,504]),Ie=new Set(["GET","HEAD","OPTIONS","PUT","DELETE"]),Kt=2,_e=4e3,Re=["authorization","x-api-key","x-tensor-api-key","0x-api-key","api-key","cookie","proxy-authorization"],Xt=new Set([301,302,303,307,308]),Ne=3,Yt=64*1024;function Qt(e){let t=String(e||"").toLowerCase();return Re.includes(t)||/(^|-)(api[-_]?key|key|token|secret|auth|authorization|session|cookie|signature|access)(-|$)/.test(t)}function Zt(e){let t={};for(let[r,s]of Object.entries(e||{}))Qt(r)||(t[r]=s);return t}function Jt(e,t){if(!e)throw new Error(`HTTP redirect from ${t} missing Location`);let r=new URL(String(e),String(t));if(r.protocol!=="http:"&&r.protocol!=="https:")throw new Error(`HTTP redirect from ${t} used unsupported protocol ${r.protocol}`);return r.toString()}function er(e,t){return new URL(String(e)).origin===new URL(String(t)).origin}var se=new Map;function tr(e,t,r,s={}){let n={};for(let[u,l]of Object.entries(r||{}))n[u.toLowerCase()]=l;let o=Object.keys(n).filter(u=>/(^|-)(api[-_]?key|key|token|secret|auth|authorization|session|cookie|signature|access)(-|$)/.test(u)),c=[...new Set([...Re,...o])].sort().map(u=>`${u}=${n[u]??""}`).join(`
-`),i=Gt("sha256").update(c).digest("hex").slice(0,32),d=`${s.untrustedUrl?"untrusted":"trusted"}:${s.maxResponseBytes??"unbounded"}`;return`${e} ${t} ${d} ${i}`}function rr(e,t){let r=Number(t);return Number.isFinite(r)&&r>0?Math.min(r*1e3,_e):Math.min(250*2**e,_e)+Math.floor(Math.random()*100)}var nr=e=>new Promise(t=>setTimeout(t,e));function B(e,t={}){let r=new Error(e);return r.retryable=!1,Object.assign(r,t),r}function ie(e,t,r){return B(`HTTP response from ${e} exceeded maxResponseBytes ${r} (${t})`,{oversize:!0})}function $(e){try{let t=e?.body?.cancel?.();t&&typeof t.then=="function"&&t.catch(()=>{})}catch{}}function or(e){return e?e.byteLength??e.length??0:0}async function Le(e,t,{url:r,truncate:s=!1,onOversize:n}={}){if(t==null)return await e.text();let o=Number(e.headers?.get?.("content-length"));if(Number.isFinite(o)&&o>t&&($(e),!s))throw ie(r,`content-length ${o}`,t);let a=e.body?.getReader?.();if(!a){let l=await e.text(),p=Buffer.byteLength(l,"utf8");if(p>t){if(!s)throw ie(r,`body ${p} bytes`,t);return Buffer.from(l,"utf8").subarray(0,t).toString("utf8")}return l}let c=[],i=0,d=!1;try{for(;;){let{value:l,done:p}=await a.read();if(p)break;if(l&&(c.push(Buffer.from(l)),i+=or(l),i>t)){d=!0;break}}}finally{if(d)try{await a.cancel()}catch{}try{a.releaseLock?.()}catch{}}if(d&&(typeof n=="function"&&n(),!s))throw ie(r,`streamed ${i} bytes`,t);let u=Buffer.concat(c);return(d?u.subarray(0,t):u).toString("utf8")}function Te(e){if(!e)return null;try{return JSON.parse(e)}catch{return null}}async function sr(e,{fetchImpl:t,method:r,headers:s,body:n,timeoutMs:o,lookupFn:a,realFetch:c,untrustedUrl:i=!1,maxResponseBytes:d=null,importUndici:u,validateResponse:l,signal:p}){let f=new AbortController,h=setTimeout(()=>f.abort(),o),b=p?typeof AbortSignal.any=="function"?AbortSignal.any([p,f.signal]):p:f.signal,m=null,A=t,x=a?{lookupFn:a}:{};if(i&&!c&&!oe(A))throw B(`HTTP refused ${e}: untrustedUrl requires a pin-capable fetchImpl (see markPinCapableFetch in egress-guard.mjs) or no fetchImpl override so Oracle can pin the connection itself`);let k=async(y,{status:S=null}={})=>{let E=await te(y,x);if(!E.ok)throw B(S==null?`HTTP refused ${y}: ${E.error}`:`HTTP redirect to ${y} ${E.error}`,S==null?{}:{status:S});let v=new URL(y).hostname;if(c){if(m&&(await m.close(),m=null),!m)try{m=await re({requireUndici:!0,...u?{importUndici:u}:{}})}catch(I){throw B(S==null?`HTTP refused ${y}: ${I?.message||I}`:`HTTP redirect to ${y} refused: ${I?.message||I}`,S==null?{}:{status:S})}m.pin(v,E.addresses),A=m.fetch}else ke(A,v,E.addresses);return E};try{let y=String(e),S={...s||{}};i&&await k(y);for(let E=0;E<=Ne;E+=1){let v=await A(y,{method:r,headers:S,body:n,signal:b,redirect:"manual"});if(Xt.has(v.status)){if(r!=="GET"&&r!=="HEAD"){let R=await Le(v,d??Yt,{url:y,truncate:!0}),O=new Error(`HTTP ${v.status} ${r} ${y} redirected non-idempotent request`);throw O.status=v.status,O.body=Te(R)??R.slice(0,300),O}if(E===Ne)throw $(v),new Error(`HTTP redirect loop for ${e}`);let C=v.headers?.get?.("location"),N;try{N=Jt(C,y)}catch(R){throw $(v),R}let P=!er(N,y);if($(v),P&&(S=Zt(S)),i)await k(N,{status:v.status});else if(P){let R=await te(N,x);if(!R.ok){let O=new Error(`HTTP redirect from ${y} ${R.error}`);throw O.status=v.status,O.retryable=!1,O}c&&R.addresses?.length&&(m||(m=await re(u?{importUndici:u}:{})),m&&(m.pin(new URL(N).hostname,R.addresses),A=m.fetch))}y=N;continue}if(typeof l=="function")try{await l(v,{url:y})}catch(C){throw $(v),B(C?.message||String(C))}let I=await Le(v,d,{url:y,onOversize:()=>f.abort()}),_=Te(I);if(!v.ok){let C=new Error(`HTTP ${v.status} ${r} ${y}`);throw C.status=v.status,C.retryAfter=v.headers?.get?.("retry-after")??null,C.body=_??I.slice(0,300),C}return _??I}throw new Error(`HTTP redirect loop for ${e}`)}finally{clearTimeout(h),m&&await m.close()}}async function W(e,t={}){let r=t.fetchImpl||globalThis.fetch;if(typeof r!="function")throw new Error("fetch unavailable \u2014 pass opts.fetchImpl");let s=t.timeoutMs??12e3,n=(t.method||"GET").toUpperCase(),o={Accept:"application/json",...t.headers||{}},a=t.body;a!=null&&typeof a!="string"&&(o["Content-Type"]=o["Content-Type"]||"application/json",a=JSON.stringify(a));let c=Number.isInteger(t.retries)?Math.max(t.retries,0):Kt,i=t.lookupFn,d=!t.fetchImpl,u=t.untrustedUrl===!0,l=t.importUndici,p=t.validateResponse,f=t.signal,h=Number(t.maxResponseBytes),b=Number.isFinite(h)&&h>0?Math.floor(h):null,m=async()=>{let S;for(let E=0;E<=c;E++){f?.throwIfAborted?.();try{return await sr(e,{fetchImpl:r,method:n,headers:o,body:a,timeoutMs:s,lookupFn:i,realFetch:d,untrustedUrl:u,maxResponseBytes:b,importUndici:l,validateResponse:p,signal:f})}catch(v){S=v;let I=v?.status,_=v?.name==="AbortError"||v?.name==="TimeoutError"||f?.aborted,C=new Set([408,425,429]),N=v?.retryable===!1?!1:I!=null?C.has(I)||jt.has(I)&&Ie.has(n):!_&&Ie.has(n);if(E===c||!N)throw v;let P=rr(E,v?.retryAfter);f?await new Promise((R,O)=>{let mt=setTimeout(R,P);f.addEventListener("abort",()=>{clearTimeout(mt),O(f.reason||new DOMException("Aborted","AbortError"))},{once:!0})}):await nr(P)}}throw S};if(!(t.dedupe!==!1&&!f&&n==="GET"&&a==null))return m();let x=tr(n,e,o,{untrustedUrl:u,maxResponseBytes:b}),k=se.get(x);if(k)return k;let y=m().finally(()=>se.delete(x));return se.set(x,y),y}var Oe={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},ir=new Map(Object.values(Oe).map(e=>[e.chainId,e]));function qe(e){return ir.get(Number(e))||null}function Ue(e,t=process.env){let r=qe(e);if(!r)return null;for(let s of r.rpcEnv){let n=(t[s]||"").trim();if(n)return n}return null}import{Interface as ar,getAddress as cr}from"ethers";var Pe=new ar(["function allowance(address owner,address spender) view returns (uint256)","function balanceOf(address account) view returns (uint256)"]);function Be(e,t){try{return cr(e).toLowerCase()}catch{throw new Error(`${t} must be a valid EVM address`)}}var ur={1:"https://ethereum.publicnode.com",137:"https://polygon-bor-rpc.publicnode.com",42161:"https://arbitrum-one-rpc.publicnode.com",8453:"https://base-rpc.publicnode.com",10:"https://optimism-rpc.publicnode.com",988:"https://rpc.stable.xyz",56:"https://bsc-rpc.publicnode.com",43114:"https://avalanche-c-chain-rpc.publicnode.com",999:"https://rpc.hyperliquid.xyz/evm",2741:"https://api.mainnet.abs.xyz",4663:"https://rpc.mainnet.chain.robinhood.com"};function lr(e,{rpcUrl:t,env:r=process.env}={}){if(t)return t;let s=Ue(e,r);return s||ur[Number(e)]||null}var dr=/^(?:eth_(?:call|blocknumber|chainid|get[a-z0-9]+|feehistory|gasprice|maxpriorityfeepergas|syncing|protocolversion|estimategas|createaccesslist)|net_(?:version|listening|peercount)|web3_(?:clientversion|sha3))$/;function pr(e){let t=String(e||""),r=t.toLowerCase();if(t!==t.trim()||!/^[a-zA-Z0-9_]+$/.test(t)||!dr.test(r))throw new Error(`evm-rpc: ${t} refused \u2014 @oracle-agent/oracle is prepare-only (read RPC only; no broadcast/sign)`);return r}async function L(e,t,r=[],s={}){let n=String(t||"");pr(n);let o=lr(e,s);if(!o)throw new Error(`No RPC URL for chainId ${e} (set env from chain registry rpcEnv or pass rpcUrl)`);let c=await W(o,{method:"POST",body:{jsonrpc:"2.0",id:1,method:t,params:r},fetchImpl:s.fetchImpl,timeoutMs:s.timeoutMs??12e3,signal:s.signal});if(c?.error){let i=new Error(c.error.message||JSON.stringify(c.error));throw i.code=c.error.code,i}return c.result}async function $e(e,t={}){let r=await L(e,"eth_blockNumber",[],t);return parseInt(r,16)}async function Fe(e,t,r={}){if(!t)throw new Error("rpcGetBalance requires address");let s=await L(e,"eth_getBalance",[t,"latest"],r);return{chainId:Number(e),address:t,balanceWei:BigInt(s).toString(),balanceHex:s}}async function De(e={},t={}){let r=Number(e.chainId??t.chainId??1),s=Be(e.token||e.tokenAddress,"token"),n=Be(e.account||e.owner||e.address,"account"),o=Pe.encodeFunctionData("balanceOf",[n]),a=await L(r,"eth_call",[{to:s,data:o},e.blockTag||"latest"],t),c=Pe.decodeFunctionResult("balanceOf",a),i=BigInt(c[0]);return{chainId:r,token:s,account:n,balance:i.toString(),balanceHex:`0x${i.toString(16)}`,blockTag:e.blockTag||"latest"}}var fr=new Set(["usdc","usdt","usdg","dai","usd1","usde","pyusd"]);function Me(e,t){let r=String(e||"").toLowerCase(),s=String(t?.quote||t?.quoteToken?.address||"").toLowerCase(),n=String(t?.base||t?.baseToken?.address||"").toLowerCase();return s===r?{address:t.base||t.baseToken?.address,symbol:t.baseToken?.symbol}:n===r?{address:t.quote||t.quoteToken?.address,symbol:t.quoteToken?.symbol}:{address:t.quote||t.quoteToken?.address,symbol:t.quoteToken?.symbol}}function z(e,t=[],{stables:r=[],wrappedNative:s=null}={}){let n=String(e||"").toLowerCase(),o=new Set((r||[]).map(i=>String(i).toLowerCase())),a=String(s||"").toLowerCase(),c=(t||[]).map((i,d)=>{let u=Me(n,i),l=String(u.address||"").toLowerCase(),p=String(u.symbol||"").toLowerCase(),f=Number(i.liquidityUsd??i.liquidity?.usd),h=Number.isFinite(f)?f:0,b=String(i.dex||i.dexId||"").toLowerCase(),m=0;return o.has(l)||fr.has(p)?m=300:a&&l===a&&(m=100),b.includes("v4")?m+=20:b.includes("v3")?m+=10:(b.includes("v2")||b.includes("raydium")||b.includes("orca")||b.includes("meteora"))&&(m+=8),{pool:i,score:m*1e12+h,index:d,otherAddr:l,liquidityUsd:h}});return c.sort((i,d)=>d.score-i.score||i.index-d.index),c.map(i=>i.pool)}function He(e,t=[]){let r=Array.isArray(t)?t:[];return r.length&&Me(e,r[0]).address||null}var hr="https://api.dexscreener.com",Cn=Object.freeze({1:"ethereum",10:"optimism",56:"bsc",137:"polygon",8453:"base",42161:"arbitrum",43114:"avalanche",999:"hyperevm",4663:"robinhood"});function mr(e={}){return(e.baseUrl||process.env.DEXSCREENER_API_URL||hr).replace(/\/$/,"")}async function ae(e,t={}){if(!e)throw new Error("tokenAddress required");return W(`${mr(t)}/latest/dex/tokens/${e}`,{fetchImpl:t.fetchImpl,timeoutMs:t.timeoutMs??12e3})}var br=["EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB"];async function Ve(e,{chainSlug:t="solana",stables:r=br}={},s={}){let n=await ae(e,s),a=(n?.pairs||n?.data?.pairs||[]).filter(i=>String(i.chainId).toLowerCase()===String(t).toLowerCase()).map(i=>({pair:i.pairAddress,dex:i.dexId,dexId:i.dexId,base:i.baseToken?.address,quote:i.quoteToken?.address,baseToken:i.baseToken,quoteToken:i.quoteToken,liquidityUsd:i.liquidity?.usd??null,priceUsd:i.priceUsd??null,volume24hUsd:i.volume?.h24??null,createdAt:i.pairCreatedAt??null})),c=z(e,a,{stables:r});return{chain:t,token:e,pools:c,topPool:c[0]||null}}var G=Object.freeze(["blockNumber","nativeBalance","tokenBalance","resolveToken","resolvePools","scanBlocks","scoreRisk","quote","sellSimulation","prepareUnsignedTx"]),w=Object.freeze({LIVE:"LIVE",CACHED:"CACHED",STALE:"STALE",UNKNOWN:"UNKNOWN",UNAVAILABLE:"UNAVAILABLE"}),g=Object.freeze({PASS:"PASS",CAUTION:"CAUTION",FAIL:"FAIL",UNKNOWN:"UNKNOWN"}),gr=/^0x[0-9a-fA-F]{40}$/;function wr(e={}){let t=[],r=[];if(!e||typeof e!="object")return{ok:!1,errors:["definition must be an object"],warnings:r};if((!Number.isInteger(e.chainId)||e.chainId<=0)&&t.push("chainId must be a positive integer"),(typeof e.key!="string"||!/^[a-z][a-z0-9-]*$/.test(e.key||""))&&t.push('key must be a lowercase slug (e.g. "base")'),(typeof e.name!="string"||!e.name.trim())&&t.push("name is required"),!Array.isArray(e.rpcEnv)||e.rpcEnv.length===0)t.push("rpcEnv must list at least one environment variable name");else for(let n of e.rpcEnv)(typeof n!="string"||!/^[A-Z][A-Z0-9_]*$/.test(n))&&t.push(`rpcEnv entry "${n}" should be an UPPER_SNAKE env var name`);if(e.nativeCurrency){let n=e.nativeCurrency;(typeof n.symbol!="string"||!n.symbol)&&t.push("nativeCurrency.symbol is required when nativeCurrency is set"),Number.isInteger(n.decimals)||t.push("nativeCurrency.decimals must be an integer")}for(let[n,o]of(e.venues||[]).entries()){let a=`venues[${n}]`;if(!o||typeof o!="object"){t.push(`${a} must be an object`);continue}gr.test(o.address||"")||t.push(`${a}.address is not a valid 20-byte address`),/^0x0{40}$/.test(o.address||"")&&t.push(`${a}.address is the zero address -- placeholder left in place?`),o.kind||t.push(`${a}.kind is required (router|quoter|factory|...)`),o.verified?(o.verified.method||t.push(`${a}.verified.method is required`),o.verified.source||t.push(`${a}.verified.source is required`),o.verified.date||r.push(`${a}.verified.date missing -- add one so staleness is visible`)):t.push(`${a} must record verification: { verified: { method, source, date } }. An unverified venue stays blocked.`)}let s=e.capabilities||{};for(let n of Object.keys(s))G.includes(n)?typeof s[n]!="function"&&t.push(`capability "${n}" must be a function`):t.push(`unknown capability "${n}"`);return Object.keys(s).length===0&&r.push("scanner implements no capabilities -- it can only be registered, not used"),s.prepareUnsignedTx&&!s.quote&&r.push("prepareUnsignedTx without quote: no priced expectation to validate the built tx against"),s.prepareUnsignedTx&&!s.sellSimulation&&r.push("prepareUnsignedTx without sellSimulation: cannot prove an asset is exitable before buying"),{ok:t.length===0,errors:t,warnings:r}}function vr(e){let{ok:t,errors:r,warnings:s}=wr(e);if(!t)throw new Error(`invalid scanner for ${e?.key??"<unknown>"}:
+var Et=/\b0x[a-fA-F0-9]{40}\b/g,St=/\b[1-9A-HJ-NP-Za-km-z]{32,44}\b/g,At=new Set(["0x0000000000000000000000000000000000000000","0x000000000000000000000000000000000000dead","0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"].map(e=>e.toLowerCase())),xt=new Set(["So11111111111111111111111111111111111111112","EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB","11111111111111111111111111111111"]);function Ct(e){return!(xt.has(e)||/^0x/i.test(e)||!/\d/.test(e)&&e===e.toLowerCase()||!/\d/.test(e)&&e===e.toUpperCase())}function ve(e,{extras:t=[]}={}){let r=[e,...t].map(o=>String(o||"")).join(`
+`),s=[...new Set((r.match(Et)||[]).map(o=>o.toLowerCase()))].filter(o=>!At.has(o)),n=[...new Set(r.match(St)||[])].filter(Ct);return{evm:s,solana:n,all:[...s.map(o=>({chainFamily:"evm",address:o})),...n.map(o=>({chainFamily:"solana",address:o}))]}}function Ee(e){let t=String(e||"").trim();if(!t)return[];let r=[],s=n=>{if(!n||typeof n!="object")return;let o=String(n.id||n.id_str||n.tweetId||n.statusId||""),a=n.text||n.full_text||n.fullText||n.body||n.note_tweet?.text||"",c=[],i=n.entities?.urls||n.entities?.Urls||[];for(let d of i)d?.expanded_url&&c.push(d.expanded_url),d?.url&&c.push(d.url);(o||a)&&r.push({id:o,text:String(a),urls:c,raw:n})};try{let n=JSON.parse(t),o=Array.isArray(n)?n:n.data?Array.isArray(n.data)?n.data:[n.data]:n.tweets||n.statuses||n.results||[];Array.isArray(o)?o.forEach(s):s(n)}catch{for(let n of t.split(`
+`)){let o=n.trim();if(o.startsWith("{"))try{s(JSON.parse(o))}catch{}}r.length||r.push({id:"",text:t,urls:[]})}return r}import{spawnSync as $t}from"node:child_process";import Se from"node:fs";import J from"node:path";var kt=(process.env.ORACLE_REDACT_SECRETS??"true").toLowerCase(),It=["1","true","yes","on"].includes(kt),_t=[/sk-[A-Za-z0-9_-]{10,}/g,/sk_live_[A-Za-z0-9]{10,}/g,/sk_test_[A-Za-z0-9]{10,}/g,/ghp_[A-Za-z0-9]{10,}/g,/github_pat_[A-Za-z0-9_]{10,}/g,/gho_[A-Za-z0-9]{10,}/g,/ghs_[A-Za-z0-9]{10,}/g,/xox[baprs]-[A-Za-z0-9-]{10,}/g,/AIza[A-Za-z0-9_-]{30,}/g,/AKIA[A-Z0-9]{16}/g,/pplx-[A-Za-z0-9]{10,}/g,/hf_[A-Za-z0-9]{10,}/g,/xai-[A-Za-z0-9]{30,}/g,/gsk_[A-Za-z0-9]{10,}/g,/npm_[A-Za-z0-9]{10,}/g,/tvly-[A-Za-z0-9]{10,}/g,/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi],Nt=/\b0x[a-fA-F0-9]{64}\b/g,Lt=/-----BEGIN (?:RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g,Tt=/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,Rt=/\b([A-Z][A-Z0-9_]{0,40}(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE_?KEY|MNEMONIC|SEED|AUTH)[A-Z0-9_]{0,20})\s*=\s*(['"]?)(\S+)\2/g,Ot=/^(?:export\s+)?((?:api[_-]?key|token|secret|password|private[_-]?key|mnemonic|seed[_-]?phrase|authorization))\s*[:=]\s*(['"]?)([^\s&]+)\2/gim,qt=/("(?:api[_-]?key|apiKey|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|privateKey|secret|password|authorization|bearer|mnemonic|seedPhrase)"\s*:\s*")([^"]{6,})(")/gi,Ut=new Set(["access_token","refresh_token","id_token","token","api_key","apikey","client_secret","password","auth","jwt","session","secret","key","code","signature","x-amz-signature","private_key","authorization"]),fn=new Set([...Ut].map(e=>e.replace(/[^a-z0-9]/gi,"").toLowerCase()));function Pt(e){let t=String(e??"");return t.length<18?"[REDACTED]":`${t.slice(0,6)}\u2026${t.slice(-4)}`}function Bt(e){return`\xABredacted:${String(e??"").slice(0,4)}\u2026\xBB`}function V(e,t={}){if(e==null)return e;let r=typeof e=="string"?e:String(e);if(!r||!(t.force||It))return r;let s=t.fileRead?Bt:Pt;r=r.replace(Lt,"[REDACTED_PRIVATE_KEY]"),r=r.replace(Nt,"[REDACTED_EVM_KEY]"),r=r.replace(Tt,n=>s(n));for(let n of _t)n.lastIndex=0,r=r.replace(n,o=>s(o));return r=r.replace(Rt,(n,o,a,c)=>/^(?:os\.(?:getenv|environ)|process\.env|\$ENV\{)/.test(c)?`${o}=${a||""}${c}${a||""}`:`${o}=${a||""}${s(c)}${a||""}`),r=r.replace(Ot,(n,o,a,c)=>n.replace(c,s(c))),r=r.replace(qt,(n,o,a,c)=>`${o}${s(a)}${c}`),r}var Ae=45e3,Ft=4e4,Dt=Object.freeze(["whoami","user","read","search","timeline","mentions","bookmarks","likes","following","followers","dms","auth"]),Mt=Object.freeze(["post","reply","quote","delete","like","unlike","repost","unrepost","bookmark","unbookmark","follow","unfollow","block","unblock","mute","unmute","dm"]),xe=Object.freeze(["--verbose","-v","--trace","-t","--bearer-token","--consumer-key","--consumer-secret","--access-token","--token-secret","--client-id","--client-secret"]);function Ht(e=process.env){let t=String(e.ORACLE_XURL_ENABLED||"").trim().toLowerCase();return t==="1"||t==="true"||t==="yes"||t==="on"}function Ce(e=process.env){let t=String(e.ORACLE_XURL_ALLOW_WRITE||"").trim().toLowerCase();return t==="1"||t==="true"||t==="yes"||t==="on"}function Vt(e=process.env){let t=String(e.ORACLE_XURL_BIN||"").trim();if(t)return J.isAbsolute(t)?Se.existsSync(t)?{ok:!0,bin:t}:{ok:!1,error:`ORACLE_XURL_BIN not found: ${t}`}:{ok:!1,error:"ORACLE_XURL_BIN must be absolute"};let r=String(e.PATH||process.env.PATH||"");for(let s of r.split(J.delimiter)){if(!s)continue;let n=J.join(s,"xurl");try{if(Se.existsSync(n))return{ok:!0,bin:n}}catch{}}return{ok:!1,error:"xurl binary not found on PATH. Install: curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash"}}function Wt(e=process.env){let t=e.HOME||process.env.HOME||"";return{PATH:e.PATH||process.env.PATH||"/usr/bin:/bin",HOME:t,USER:e.USER||process.env.USER||"",LANG:e.LANG||process.env.LANG||"C.UTF-8",LC_ALL:e.LC_ALL||process.env.LC_ALL||"C.UTF-8",XDG_CONFIG_HOME:e.XDG_CONFIG_HOME||process.env.XDG_CONFIG_HOME||"",XDG_DATA_HOME:e.XDG_DATA_HOME||process.env.XDG_DATA_HOME||"",NO_COLOR:"1"}}function zt(e){for(let t of e){let r=String(t);if(xe.includes(r))return r;if(xe.some(s=>s.startsWith("--")&&r.startsWith(`${s}=`)))return r.split("=")[0]}return null}function Gt(e={},t=process.env){let r;if(Array.isArray(e.argv))r=e.argv.map(i=>String(i));else{let i=String(e.command||e.cmd||"").trim();if(!i)return{ok:!1,error:"command is required (e.g. whoami, search, read, post)"};let d=Array.isArray(e.args)?e.args.map(u=>String(u)):typeof e.query=="string"?[e.query]:typeof e.text=="string"?[e.text]:typeof e.id=="string"?[e.id]:typeof e.handle=="string"?[e.handle]:[];i==="search"&&e.limit!=null&&d.push("-n",String(Math.min(50,Math.max(1,Number(e.limit)||10)))),(i==="timeline"||i==="mentions")&&e.limit!=null&&d.push("-n",String(Math.min(50,Math.max(1,Number(e.limit)||10)))),r=[i,...d]}if(r.length===0)return{ok:!1,error:"empty argv"};if(r.length>24)return{ok:!1,error:"too many arguments"};for(let i of r)if(String(i).length>4e3)return{ok:!1,error:"argument too long"};let s=zt(r);if(s)return{ok:!1,error:`forbidden flag: ${s}`};if(r.some(i=>String(i).includes("\0")))return{ok:!1,error:"nul byte in argv"};let n=String(r[0]||"").replace(/^\//,"");if(n.startsWith("2/")||r[0].startsWith("/2/")||r[0].startsWith("https://api.x.com/")){if(!Ce(t)&&r.some(i=>/^-X$/.test(i)||/^--request$/.test(i))){let i=r.findIndex(u=>u==="-X"||u==="--request"),d=String(r[i+1]||"GET").toUpperCase();if(d!=="GET"&&d!=="HEAD")return{ok:!1,error:"raw non-GET requires ORACLE_XURL_ALLOW_WRITE=true"}}}else if(n==="auth"){if(String(r[1]||"")!=="status")return{ok:!1,error:"only `auth status` is allowed (no apps add / oauth2 from the agent)"}}else if(!Dt.includes(n))if(Mt.includes(n)){if(!Ce(t))return{ok:!1,error:`write command '${n}' requires ORACLE_XURL_ALLOW_WRITE=true`}}else return n==="media"?{ok:!1,error:"media upload is disabled in the agent tool (run xurl media outside the agent)"}:{ok:!1,error:`command not allowlisted: ${n}`};let o=[...r],a=String(t.ORACLE_XURL_APP||"").trim(),c=String(t.ORACLE_XURL_USER||"").trim();if(a&&!o.includes("--app")&&o.unshift("--app",a),c&&!o.includes("--username")&&!o.includes("-u")){let i=0;o[0]==="--app"&&(i=2),i<o.length&&o.splice(i+1,0,"-u",c)}return{ok:!0,argv:o,command:n}}async function ke(e,t={},r={}){if(e!=="xurl")return{ok:!1,error:`unknown tool: ${e}`};let s=r.env||process.env;if(!Ht(s))return{ok:!1,error:"xurl is disabled. Set ORACLE_XURL_ENABLED=true after `xurl auth status` succeeds. Writes stay off until ORACLE_XURL_ALLOW_WRITE=true."};let n=Gt(t,s);if(!n.ok)return n;let o=Vt(s);if(!o.ok)return o;let c=(r.spawnFn||$t)(o.bin,n.argv,{encoding:"utf8",timeout:r.timeoutMs||Ae,maxBuffer:1024*1024,env:Wt(s)});if(c.error){let l=c.error.code==="ETIMEDOUT"?`xurl timed out after ${r.timeoutMs||Ae}ms`:String(c.error.message||c.error);return{ok:!1,error:V(l,{force:!0})}}let i=V(String(c.stdout||"").slice(0,Ft),{force:!0}),d=V(String(c.stderr||"").slice(0,2e3),{force:!0}),u=typeof c.status=="number"?c.status:1;return{ok:u===0,status:u,command:n.command,argv:n.argv.map(l=>/=/.test(l)&&/token|secret|key|bearer/i.test(l)?"[redacted-arg]":l),stdout:i,stderr:d||void 0}}var yn=Object.freeze([{type:"function",function:{name:"xurl",description:"Call the official xurl CLI against the X API with an allowlisted command. Reads (whoami/user/read/search/timeline/mentions/...) work when ORACLE_XURL_ENABLED=true. Writes (post/reply/like/follow/dm/...) also need ORACLE_XURL_ALLOW_WRITE=true. Never pass secrets or --verbose. Auth is whatever the operator configured in ~/.xurl.",parameters:{type:"object",properties:{command:{type:"string",description:"xurl subcommand: whoami, user, read, search, timeline, mentions, post, reply, ..."},args:{type:"array",items:{type:"string"},description:"Positional args after the command (query, id, handle, text)."},query:{type:"string",description:"Convenience for search query."},text:{type:"string",description:"Convenience for post/reply/dm text."},id:{type:"string",description:"Convenience for read/like/reply target id or URL."},handle:{type:"string",description:"Convenience for user/follow/dm handle."},limit:{type:"integer",description:"Result limit for search/timeline/mentions (1-50)."},argv:{type:"array",items:{type:"string"},description:"Raw argv alternative (still allowlisted + flag-filtered)."}},additionalProperties:!1}}}]);import{createHash as _e}from"node:crypto";import q from"node:net";import jt from"node:dns";var Kt=new Set(["localhost","metadata.google.internal","metadata.goog"]);function W(e){let t=String(e).toLowerCase().split("%")[0];if((t.match(/::/g)||[]).length>1)return null;let r=u=>{if(!u)return[];let l=u.split(":"),p=l.at(-1);if(p?.includes(".")){let f=p.split(".").map(Number);if(f.length!==4||f.some(h=>!Number.isInteger(h)||h<0||h>255))return null;l.splice(l.length-1,1,(f[0]<<8|f[1]).toString(16),(f[2]<<8|f[3]).toString(16))}return l.some(f=>!/^[0-9a-f]{1,4}$/.test(f))?null:l.map(f=>Number.parseInt(f,16))},[s,n]=t.split("::"),o=r(s),a=r(n);if(!o||!a)return null;let c=t.includes("::"),i=8-o.length-a.length;if(!c&&i!==0||c&&i<1)return null;let d=[...o,...Array(Math.max(0,i)).fill(0),...a];return d.length!==8?null:Uint8Array.from(d.flatMap(u=>[u>>8,u&255]))}function ee(e,t,r){let s=Math.floor(r/8),n=r%8;for(let a=0;a<s;a+=1)if(e[a]!==t[a])return!1;if(!n)return!0;let o=255<<8-n;return(e[s]&o)===(t[s]&o)}function te(e){if(q.isIPv4(e)){let t=e.split(".").map(Number);return!(t[0]===0||t[0]===10||t[0]===127||t[0]>=224||t[0]===100&&t[1]>=64&&t[1]<=127||t[0]===169&&t[1]===254||t[0]===172&&t[1]>=16&&t[1]<=31||t[0]===192&&(t[1]===0||t[1]===2||t[1]===168)||t[0]===192&&t[1]===88&&t[2]===99||t[0]===198&&(t[1]===18||t[1]===19||t[1]===51)||t[0]===203&&t[1]===0&&t[2]===113)}if(q.isIPv6(e)){let t=W(e);if(!t)return!1;let r=W("::ffff:0:0");return ee(t,r,96)?te([...t.slice(12)].join(".")):ee(t,W("2000::"),3)?![["2001::",23],["2001:db8::",32],["2001:10::",28],["2001:2::",48],["2002::",16],["3fff::",20]].some(([n,o])=>ee(t,W(n),o)):!1}return!1}function Xt(e){let t;try{t=new URL(String(e))}catch{return{ok:!1,error:`not a valid URL: ${String(e).slice(0,120)}`}}if(t.protocol!=="http:"&&t.protocol!=="https:")return{ok:!1,error:`refused protocol ${t.protocol} (only http/https)`};let r=t.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.+$/,"");if(Kt.has(r)||r.endsWith(".localhost")||r.endsWith(".internal"))return{ok:!1,error:`refused internal host ${r}`};let s=q.isIP(r);return s!==0&&!te(r)?{ok:!1,error:`refused private address ${r}`}:{ok:!0,url:t,host:r,isLiteralIp:s!==0}}async function re(e,{lookupFn:t=jt.promises.lookup}={}){let r=Xt(e);if(!r.ok)return r;if(r.isLiteralIp)return{ok:!0,url:r.url,addresses:[{address:r.host,family:q.isIPv6(r.host)?6:4}]};let s;try{s=await t(r.host,{all:!0,verbatim:!0})}catch{return{ok:!1,error:`refused: ${r.host} did not resolve`}}return!Array.isArray(s)||s.length===0||s.some(n=>!te(n.address))?{ok:!1,error:`refused: ${r.host} resolves to a non-public address`}:{ok:!0,url:r.url,addresses:s}}async function ne({requireUndici:e=!1,importUndici:t=()=>import("undici")}={}){let r,s;try{let l=await t();r=l.Agent,s=l.fetch}catch(l){if(e)throw new Error(`egress-guard: untrustedUrl pinning requires the undici package, which failed to load: ${l?.message||l}`);return null}if(typeof r!="function"||typeof s!="function"){if(e)throw new Error("egress-guard: untrustedUrl pinning requires undici's Agent and fetch exports, which were not found on the imported module");return null}let n=l=>String(l).toLowerCase().replace(/^\[|\]$/g,"").replace(/\.+$/,""),o=new Map,a=l=>(Array.isArray(l)?l:[l]).map(p=>typeof p=="string"?{address:p}:p).filter(p=>p&&p.address).map(p=>({address:p.address,family:p.family||(q.isIPv6(p.address)?6:4)})),c=(l,p,f)=>{o.set(n(l),a(typeof p=="string"?[{address:p,family:f}]:p))},i=l=>{let p=n(l);if(q.isIP(p))return[{address:p,family:q.isIPv6(p)?6:4}];let f=o.get(p);if(!f||!f.length)throw new Error(`refused: unpinned host ${l} during pinned fetch`);return f},d=new r({connect:{lookup(l,p,f){let h;try{h=i(l)}catch(m){return f(m)}return p?.all?f(null,h):f(null,h[0].address,h[0].family)}}}),u=Yt((l,p={})=>s(l,{...p,dispatcher:d}),c);return{dispatcher:d,fetch:u,pin:c,resolve:i,async close(){try{await d.destroy()}catch{}}}}var oe=Symbol.for("oracle.egressGuard.pinCapableFetch");function Yt(e,t){if(typeof e!="function")throw new Error("markPinCapableFetch: fetchImpl must be a function");if(typeof t!="function")throw new Error("markPinCapableFetch: pin must be a function");return e[oe]=Object.freeze({pin:t}),e}function se(e){return typeof e=="function"&&typeof e[oe]?.pin=="function"}function Ie(e,t,r){if(!se(e))throw new Error("pinFetchToAddresses: fetchImpl is not pin-capable");e[oe].pin(t,r)}var Zt=new Set([408,425,429,500,502,503,504]),Ne=new Set(["GET","HEAD","OPTIONS","PUT","DELETE"]),Qt=2,Le=4e3,Ue=["authorization","x-api-key","x-tensor-api-key","0x-api-key","api-key","cookie","proxy-authorization"],Jt=new Set([301,302,303,307,308]),Te=3,er=64*1024;function tr(e){let t=String(e||"").toLowerCase();return Ue.includes(t)||/(^|-)(api[-_]?key|key|token|secret|auth|authorization|session|cookie|signature|access)(-|$)/.test(t)}function rr(e){let t={};for(let[r,s]of Object.entries(e||{}))tr(r)||(t[r]=s);return t}function nr(e,t){if(!e)throw new Error(`HTTP redirect from ${t} missing Location`);let r=new URL(String(e),String(t));if(r.protocol!=="http:"&&r.protocol!=="https:")throw new Error(`HTTP redirect from ${t} used unsupported protocol ${r.protocol}`);return r.toString()}function or(e,t){return new URL(String(e)).origin===new URL(String(t)).origin}var ie=new Map,sr=/(?:^|_)(send|submit|broadcast|sign|requestAirdrop)(?=[A-Z_]|$)/i,ir=new Set(["allMids","l2Book","outcomeMeta","spotClearinghouseState","userFills","meta","metaAndAssetCtxs","perpDexs","candleSnapshot","fundingHistory","openOrders","frontendOpenOrders","clearinghouseState","spotMeta","validatorSummaries","delegatorSummary","delegations","delegatorRewards","delegatorHistory","maxBuilderFee"]);function Re(e){let t=String(e?.method||"");return t?!sr.test(t):!1}function ar(e,t){if(e==="GET"&&t==null)return!0;if(e!=="POST"||t==null)return!1;let r=t;if(typeof t=="string")try{r=JSON.parse(t)}catch{return!1}return Array.isArray(r)?r.length>0&&r.every(Re):!r||typeof r!="object"?!1:r.jsonrpc&&r.method?Re(r):typeof r.type=="string"&&ir.has(r.type)&&r.action==null&&r.signature==null&&r.nonce==null}function cr(e,t,r,s={},n=null){let o={};for(let[p,f]of Object.entries(r||{}))o[p.toLowerCase()]=f;let a=Object.keys(o).filter(p=>/(^|-)(api[-_]?key|key|token|secret|auth|authorization|session|cookie|signature|access)(-|$)/.test(p)),i=[...new Set([...Ue,...a])].sort().map(p=>`${p}=${o[p]??""}`).join(`
+`),d=_e("sha256").update(i).digest("hex").slice(0,32),u=`${s.untrustedUrl?"untrusted":"trusted"}:${s.maxResponseBytes??"unbounded"}`,l=n==null?"-":_e("sha256").update(String(n)).digest("hex").slice(0,32);return`${e} ${t} ${u} ${d} ${l}`}function ur(e,t){let r=Number(t);return Number.isFinite(r)&&r>0?Math.min(r*1e3,Le):Math.min(250*2**e,Le)+Math.floor(Math.random()*100)}var lr=e=>new Promise(t=>setTimeout(t,e));function B(e,t={}){let r=new Error(e);return r.retryable=!1,Object.assign(r,t),r}function ae(e,t,r){return B(`HTTP response from ${e} exceeded maxResponseBytes ${r} (${t})`,{oversize:!0})}function $(e){try{let t=e?.body?.cancel?.();t&&typeof t.then=="function"&&t.catch(()=>{})}catch{}}function dr(e){return e?e.byteLength??e.length??0:0}async function Oe(e,t,{url:r,truncate:s=!1,onOversize:n}={}){if(t==null)return await e.text();let o=Number(e.headers?.get?.("content-length"));if(Number.isFinite(o)&&o>t&&($(e),!s))throw ae(r,`content-length ${o}`,t);let a=e.body?.getReader?.();if(!a){let l=await e.text(),p=Buffer.byteLength(l,"utf8");if(p>t){if(!s)throw ae(r,`body ${p} bytes`,t);return Buffer.from(l,"utf8").subarray(0,t).toString("utf8")}return l}let c=[],i=0,d=!1;try{for(;;){let{value:l,done:p}=await a.read();if(p)break;if(l&&(c.push(Buffer.from(l)),i+=dr(l),i>t)){d=!0;break}}}finally{if(d)try{await a.cancel()}catch{}try{a.releaseLock?.()}catch{}}if(d&&(typeof n=="function"&&n(),!s))throw ae(r,`streamed ${i} bytes`,t);let u=Buffer.concat(c);return(d?u.subarray(0,t):u).toString("utf8")}function qe(e){if(!e)return null;try{return JSON.parse(e)}catch{return null}}async function pr(e,{fetchImpl:t,method:r,headers:s,body:n,timeoutMs:o,lookupFn:a,realFetch:c,untrustedUrl:i=!1,maxResponseBytes:d=null,importUndici:u,validateResponse:l,signal:p}){let f=new AbortController,h=setTimeout(()=>f.abort(),o),m=p?typeof AbortSignal.any=="function"?AbortSignal.any([p,f.signal]):p:f.signal,b=null,A=t,x=a?{lookupFn:a}:{};if(i&&!c&&!se(A))throw B(`HTTP refused ${e}: untrustedUrl requires a pin-capable fetchImpl (see markPinCapableFetch in egress-guard.mjs) or no fetchImpl override so Oracle can pin the connection itself`);let k=async(v,{status:S=null}={})=>{let E=await re(v,x);if(!E.ok)throw B(S==null?`HTTP refused ${v}: ${E.error}`:`HTTP redirect to ${v} ${E.error}`,S==null?{}:{status:S});let y=new URL(v).hostname;if(c){if(b&&(await b.close(),b=null),!b)try{b=await ne({requireUndici:!0,...u?{importUndici:u}:{}})}catch(I){throw B(S==null?`HTTP refused ${v}: ${I?.message||I}`:`HTTP redirect to ${v} refused: ${I?.message||I}`,S==null?{}:{status:S})}b.pin(y,E.addresses),A=b.fetch}else Ie(A,y,E.addresses);return E};try{let v=String(e),S={...s||{}};i&&await k(v);for(let E=0;E<=Te;E+=1){let y=await A(v,{method:r,headers:S,body:n,signal:m,redirect:"manual"});if(Jt.has(y.status)){if(r!=="GET"&&r!=="HEAD"){let R=await Oe(y,d??er,{url:v,truncate:!0}),O=new Error(`HTTP ${y.status} ${r} ${v} redirected non-idempotent request`);throw O.status=y.status,O.body=qe(R)??R.slice(0,300),O}if(E===Te)throw $(y),new Error(`HTTP redirect loop for ${e}`);let C=y.headers?.get?.("location"),N;try{N=nr(C,v)}catch(R){throw $(y),R}let P=!or(N,v);if($(y),P&&(S=rr(S)),i)await k(N,{status:y.status});else if(P){let R=await re(N,x);if(!R.ok){let O=new Error(`HTTP redirect from ${v} ${R.error}`);throw O.status=y.status,O.retryable=!1,O}c&&R.addresses?.length&&(b||(b=await ne(u?{importUndici:u}:{})),b&&(b.pin(new URL(N).hostname,R.addresses),A=b.fetch))}v=N;continue}if(typeof l=="function")try{await l(y,{url:v})}catch(C){throw $(y),B(C?.message||String(C))}let I=await Oe(y,d,{url:v,onOversize:()=>f.abort()}),_=qe(I);if(!y.ok){let C=new Error(`HTTP ${y.status} ${r} ${v}`);throw C.status=y.status,C.retryAfter=y.headers?.get?.("retry-after")??null,C.body=_??I.slice(0,300),C}return _??I}throw new Error(`HTTP redirect loop for ${e}`)}finally{clearTimeout(h),b&&await b.close()}}async function z(e,t={}){let r=t.fetchImpl||globalThis.fetch;if(typeof r!="function")throw new Error("fetch unavailable \u2014 pass opts.fetchImpl");let s=t.timeoutMs??12e3,n=(t.method||"GET").toUpperCase(),o={Accept:"application/json",...t.headers||{}},a=t.body;a!=null&&typeof a!="string"&&(o["Content-Type"]=o["Content-Type"]||"application/json",a=JSON.stringify(a));let c=Number.isInteger(t.retries)?Math.max(t.retries,0):Qt,i=t.lookupFn,d=!t.fetchImpl,u=t.untrustedUrl===!0,l=t.importUndici,p=t.validateResponse,f=t.signal,h=Number(t.maxResponseBytes),m=Number.isFinite(h)&&h>0?Math.floor(h):null,b=async()=>{let S;for(let E=0;E<=c;E++){f?.throwIfAborted?.();try{return await pr(e,{fetchImpl:r,method:n,headers:o,body:a,timeoutMs:s,lookupFn:i,realFetch:d,untrustedUrl:u,maxResponseBytes:m,importUndici:l,validateResponse:p,signal:f})}catch(y){S=y;let I=y?.status,_=y?.name==="AbortError"||y?.name==="TimeoutError"||f?.aborted,C=new Set([408,425,429]),N=y?.retryable===!1?!1:I!=null?C.has(I)||Zt.has(I)&&Ne.has(n):!_&&Ne.has(n);if(E===c||!N)throw y;let P=ur(E,y?.retryAfter);f?await new Promise((R,O)=>{let vt=setTimeout(R,P);f.addEventListener("abort",()=>{clearTimeout(vt),O(f.reason||new DOMException("Aborted","AbortError"))},{once:!0})}):await lr(P)}}throw S};if(!(t.dedupe!==!1&&!f&&ar(n,a)))return b();let x=cr(n,e,o,{untrustedUrl:u,maxResponseBytes:m},a),k=ie.get(x);if(k)return k;let v=b().finally(()=>ie.delete(x));return ie.set(x,v),v}async function Pe(e,t,r){let s=Array.from(e),n=Math.max(1,Math.min(Number(t)||1,s.length||1)),o=new Array(s.length),a=0;return await Promise.all(Array.from({length:n},async()=>{for(;a<s.length;){let c=a++;o[c]=await r(s[c],c)}})),o}var Be={robinhood:{chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC"],evm:!0},ethereum:{chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],evm:!0},polygon:{chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],evm:!0},arbitrum:{chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],evm:!0},base:{chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],evm:!0},hyperevm:{chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],evm:!0},bsc:{chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],evm:!0},avalanche:{chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],evm:!0},optimism:{chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],evm:!0},abstract:{chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],evm:!0},stable:{chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],evm:!0}},fr=new Map(Object.values(Be).map(e=>[e.chainId,e]));function $e(e){return fr.get(Number(e))||null}function Fe(e,t=process.env){let r=$e(e);if(!r)return null;for(let s of r.rpcEnv){let n=(t[s]||"").trim();if(n)return n}return null}import{Interface as hr,getAddress as mr}from"ethers";var De=new hr(["function allowance(address owner,address spender) view returns (uint256)","function balanceOf(address account) view returns (uint256)"]);function Me(e,t){try{return mr(e).toLowerCase()}catch{throw new Error(`${t} must be a valid EVM address`)}}var br={1:"https://ethereum.publicnode.com",137:"https://polygon-bor-rpc.publicnode.com",42161:"https://arbitrum-one-rpc.publicnode.com",8453:"https://base-rpc.publicnode.com",10:"https://optimism-rpc.publicnode.com",988:"https://rpc.stable.xyz",56:"https://bsc-rpc.publicnode.com",43114:"https://avalanche-c-chain-rpc.publicnode.com",999:"https://rpc.hyperliquid.xyz/evm",2741:"https://api.mainnet.abs.xyz",4663:"https://rpc.mainnet.chain.robinhood.com"};function gr(e,{rpcUrl:t,env:r=process.env}={}){if(t)return t;let s=Fe(e,r);return s||br[Number(e)]||null}var wr=/^(?:eth_(?:call|blocknumber|chainid|get[a-z0-9]+|feehistory|gasprice|maxpriorityfeepergas|syncing|protocolversion|estimategas|createaccesslist)|net_(?:version|listening|peercount)|web3_(?:clientversion|sha3))$/;function yr(e){let t=String(e||""),r=t.toLowerCase();if(t!==t.trim()||!/^[a-zA-Z0-9_]+$/.test(t)||!wr.test(r))throw new Error(`evm-rpc: ${t} refused \u2014 @oracle-agent/oracle is prepare-only (read RPC only; no broadcast/sign)`);return r}var F=new Map,He=new Map;function vr(e){let t=new Error(e?.message||JSON.stringify(e));return t.code=e?.code,t}function Er(e){if(e?.error)throw vr(e.error);return e?.result}function Sr(e,t,r){return`${e}
+${t}
+${JSON.stringify(r??[])}`}async function Ar(e,t,r){return z(e,{method:"POST",body:t,fetchImpl:r.fetchImpl,timeoutMs:r.timeoutMs??12e3,signal:r.signal})}async function L(e,t,r=[],s={}){let n=String(t||""),o=yr(n),a=gr(e,s);if(!a)throw new Error(`No RPC URL for chainId ${e} (set env from chain registry rpcEnv or pass rpcUrl)`);if(o==="eth_chainid"&&s.cacheChainId!==!1){let u=He.get(a);if(u!=null)return u}let i=s.dedupe!==!1&&!s.signal?Sr(a,n,r):null;if(i&&F.has(i))return F.get(i);let d=(async()=>{let u=await Ar(a,{jsonrpc:"2.0",id:1,method:t,params:r},s),l=Er(u);return o==="eth_chainid"&&typeof l=="string"&&He.set(a,l),l})();return i&&(F.set(i,d),d.finally(()=>{F.get(i)===d&&F.delete(i)}).catch(()=>{})),d}async function Ve(e,t={}){let r=await L(e,"eth_blockNumber",[],t);return parseInt(r,16)}async function We(e,t,r={}){if(!t)throw new Error("rpcGetBalance requires address");let s=await L(e,"eth_getBalance",[t,"latest"],r);return{chainId:Number(e),address:t,balanceWei:BigInt(s).toString(),balanceHex:s}}async function ze(e={},t={}){let r=Number(e.chainId??t.chainId??1),s=Me(e.token||e.tokenAddress,"token"),n=Me(e.account||e.owner||e.address,"account"),o=De.encodeFunctionData("balanceOf",[n]),a=await L(r,"eth_call",[{to:s,data:o},e.blockTag||"latest"],t),c=De.decodeFunctionResult("balanceOf",a),i=BigInt(c[0]);return{chainId:r,token:s,account:n,balance:i.toString(),balanceHex:`0x${i.toString(16)}`,blockTag:e.blockTag||"latest"}}var xr=new Set(["usdc","usdt","usdg","dai","usd1","usde","pyusd"]);function Ge(e,t){let r=String(e||"").toLowerCase(),s=String(t?.quote||t?.quoteToken?.address||"").toLowerCase(),n=String(t?.base||t?.baseToken?.address||"").toLowerCase();return s===r?{address:t.base||t.baseToken?.address,symbol:t.baseToken?.symbol}:n===r?{address:t.quote||t.quoteToken?.address,symbol:t.quoteToken?.symbol}:{address:t.quote||t.quoteToken?.address,symbol:t.quoteToken?.symbol}}function G(e,t=[],{stables:r=[],wrappedNative:s=null}={}){let n=String(e||"").toLowerCase(),o=new Set((r||[]).map(i=>String(i).toLowerCase())),a=String(s||"").toLowerCase(),c=(t||[]).map((i,d)=>{let u=Ge(n,i),l=String(u.address||"").toLowerCase(),p=String(u.symbol||"").toLowerCase(),f=Number(i.liquidityUsd??i.liquidity?.usd),h=Number.isFinite(f)?f:0,m=String(i.dex||i.dexId||"").toLowerCase(),b=0;return o.has(l)||xr.has(p)?b=300:a&&l===a&&(b=100),m.includes("v4")?b+=20:m.includes("v3")?b+=10:(m.includes("v2")||m.includes("raydium")||m.includes("orca")||m.includes("meteora"))&&(b+=8),{pool:i,score:b*1e12+h,index:d,otherAddr:l,liquidityUsd:h}});return c.sort((i,d)=>d.score-i.score||i.index-d.index),c.map(i=>i.pool)}function je(e,t=[]){let r=Array.isArray(t)?t:[];return r.length&&Ge(e,r[0]).address||null}var Cr="https://api.dexscreener.com",Pn=Object.freeze({1:"ethereum",10:"optimism",56:"bsc",137:"polygon",8453:"base",42161:"arbitrum",43114:"avalanche",999:"hyperevm",4663:"robinhood"});function kr(e={}){return(e.baseUrl||process.env.DEXSCREENER_API_URL||Cr).replace(/\/$/,"")}async function ce(e,t={}){if(!e)throw new Error("tokenAddress required");return z(`${kr(t)}/latest/dex/tokens/${e}`,{fetchImpl:t.fetchImpl,timeoutMs:t.timeoutMs??12e3})}var Ir=["EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB"];async function Ke(e,{chainSlug:t="solana",stables:r=Ir}={},s={}){let n=await ce(e,s),a=(n?.pairs||n?.data?.pairs||[]).filter(i=>String(i.chainId).toLowerCase()===String(t).toLowerCase()).map(i=>({pair:i.pairAddress,dex:i.dexId,dexId:i.dexId,base:i.baseToken?.address,quote:i.quoteToken?.address,baseToken:i.baseToken,quoteToken:i.quoteToken,liquidityUsd:i.liquidity?.usd??null,priceUsd:i.priceUsd??null,volume24hUsd:i.volume?.h24??null,createdAt:i.pairCreatedAt??null})),c=G(e,a,{stables:r});return{chain:t,token:e,pools:c,topPool:c[0]||null}}var j=Object.freeze(["blockNumber","nativeBalance","tokenBalance","resolveToken","resolvePools","scanBlocks","scoreRisk","quote","sellSimulation","prepareUnsignedTx"]),w=Object.freeze({LIVE:"LIVE",CACHED:"CACHED",STALE:"STALE",UNKNOWN:"UNKNOWN",UNAVAILABLE:"UNAVAILABLE"}),g=Object.freeze({PASS:"PASS",CAUTION:"CAUTION",FAIL:"FAIL",UNKNOWN:"UNKNOWN"}),_r=/^0x[0-9a-fA-F]{40}$/;function Nr(e={}){let t=[],r=[];if(!e||typeof e!="object")return{ok:!1,errors:["definition must be an object"],warnings:r};if((!Number.isInteger(e.chainId)||e.chainId<=0)&&t.push("chainId must be a positive integer"),(typeof e.key!="string"||!/^[a-z][a-z0-9-]*$/.test(e.key||""))&&t.push('key must be a lowercase slug (e.g. "base")'),(typeof e.name!="string"||!e.name.trim())&&t.push("name is required"),!Array.isArray(e.rpcEnv)||e.rpcEnv.length===0)t.push("rpcEnv must list at least one environment variable name");else for(let n of e.rpcEnv)(typeof n!="string"||!/^[A-Z][A-Z0-9_]*$/.test(n))&&t.push(`rpcEnv entry "${n}" should be an UPPER_SNAKE env var name`);if(e.nativeCurrency){let n=e.nativeCurrency;(typeof n.symbol!="string"||!n.symbol)&&t.push("nativeCurrency.symbol is required when nativeCurrency is set"),Number.isInteger(n.decimals)||t.push("nativeCurrency.decimals must be an integer")}for(let[n,o]of(e.venues||[]).entries()){let a=`venues[${n}]`;if(!o||typeof o!="object"){t.push(`${a} must be an object`);continue}_r.test(o.address||"")||t.push(`${a}.address is not a valid 20-byte address`),/^0x0{40}$/.test(o.address||"")&&t.push(`${a}.address is the zero address -- placeholder left in place?`),o.kind||t.push(`${a}.kind is required (router|quoter|factory|...)`),o.verified?(o.verified.method||t.push(`${a}.verified.method is required`),o.verified.source||t.push(`${a}.verified.source is required`),o.verified.date||r.push(`${a}.verified.date missing -- add one so staleness is visible`)):t.push(`${a} must record verification: { verified: { method, source, date } }. An unverified venue stays blocked.`)}let s=e.capabilities||{};for(let n of Object.keys(s))j.includes(n)?typeof s[n]!="function"&&t.push(`capability "${n}" must be a function`):t.push(`unknown capability "${n}"`);return Object.keys(s).length===0&&r.push("scanner implements no capabilities -- it can only be registered, not used"),s.prepareUnsignedTx&&!s.quote&&r.push("prepareUnsignedTx without quote: no priced expectation to validate the built tx against"),s.prepareUnsignedTx&&!s.sellSimulation&&r.push("prepareUnsignedTx without sellSimulation: cannot prove an asset is exitable before buying"),{ok:t.length===0,errors:t,warnings:r}}function Lr(e){let{ok:t,errors:r,warnings:s}=Nr(e);if(!t)throw new Error(`invalid scanner for ${e?.key??"<unknown>"}:
   - ${r.join(`
-  - `)}`);let n=e.capabilities||{},o=G.filter(c=>typeof n[c]=="function"),a={key:e.key,chainId:e.chainId,name:e.name,rpcEnv:[...e.rpcEnv],nativeCurrency:e.nativeCurrency?{...e.nativeCurrency}:null,wrappedNative:e.wrappedNative||null,explorer:e.explorer||null,venues:(e.venues||[]).map(c=>({...c})),warnings:s,capabilities(){return{chainId:e.chainId,key:e.key,supported:[...o],unsupported:G.filter(c=>!o.includes(c))}},supports(c){return o.includes(c)}};for(let c of G)o.includes(c)?a[c]=async(...i)=>n[c](...i,{scanner:a}):a[c]=async()=>{throw new Error(`${e.key} (chain ${e.chainId}) does not implement "${c}". Supported: ${o.join(", ")||"none"}. An unimplemented capability is absent, not assumed -- implement it or treat this chain as fail-closed for that operation.`)};return Object.freeze(a)}var We=new Map;function ze(e){let t=vr(e);return We.set(t.chainId,t),t}function Ge(e){return We.get(Number(e))||null}var ue={getAmountsOut:"d06ca61f",swapExactTokensForTokens:"38ed1739",swapExactETHForTokens:"7ff36ab5"},T=e=>BigInt(e).toString(16).padStart(64,"0"),F=e=>e.slice(2).toLowerCase().padStart(64,"0");function yr(e,t){return`0x${ue.getAmountsOut}`+T(e)+T(64)+T(t.length)+t.map(F).join("")}function Er(e){if(!e||e==="0x")return null;let t=e.slice(2);if(t.length<128)return null;let r=Number(BigInt(`0x${t.slice(64,128)}`));if(!Number.isFinite(r)||r<1||r>16)return null;let s=[];for(let n=0;n<r;n++){let o=128+n*64;if(t.length<o+64)return null;s.push(BigInt(`0x${t.slice(o,o+64)}`))}return s}function ce(e,t="router"){return(e?.venues||[]).find(s=>s.kind===t)?.address??null}var le=100;function Sr(e,t){let r=Number(t);if(!Number.isFinite(r)||r<0)throw new Error("slippageBps must be a non-negative number");if(r>le)throw new Error(`slippageBps ${r} exceeds the ${le} bps ceiling. Block and requote or split the order -- do not widen the guard to force a fill.`);return BigInt(e)*BigInt(1e4-Math.floor(r))/10000n}function je(e){let{chainId:t,wrappedNative:r}=e;async function s(n,o,a,c){let i=await L(t,"eth_call",[{to:n,data:yr(o,a)},"latest"],c);return Er(i?.result??i)}return{async quote({tokenIn:n,tokenOut:o,amountIn:a,path:c},i={}){let d=ce(i.scanner);if(!d)return{chainId:t,evidence:w.UNAVAILABLE,reason:"no verified router configured for this chain; quoting stays fail-closed rather than guessing a venue address"};let u=c||[n,o];if(u.some(p=>!/^0x[0-9a-fA-F]{40}$/.test(p||"")))throw new Error("quote requires valid 20-byte addresses");let l=await s(d,a,u,i);return l?{chainId:t,router:d,path:u,amountIn:String(a),amountOut:l[l.length-1].toString(),hops:u.length-1,evidence:w.LIVE,note:"exact-input quote at current reserves; not a guaranteed fill"}:{chainId:t,router:d,path:u,evidence:w.UNKNOWN,reason:"router returned no amounts -- no pool for this path, or the call reverted"}},async sellSimulation({token:n,amountIn:o,base:a},c={}){let i=ce(c.scanner),d=a||r;if(d&&String(n).toLowerCase()===String(d).toLowerCase())return{chainId:t,token:n,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:"token is the base asset for this chain, so there is nothing to round-trip against. Sellability must be judged against a different quote asset."};if(!i||!d)return{chainId:t,token:n,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:i?"no wrappedNative configured for this chain, so no base asset to round-trip against":"no verified router configured for this chain"};let u=await s(i,o,[d,n],c);if(!u)return{chainId:t,token:n,verdict:g.FAIL,evidence:w.LIVE,leg:"buy",reason:"buy leg returned no amounts -- no route in"};let l=u[u.length-1];if(l===0n)return{chainId:t,token:n,verdict:g.FAIL,evidence:w.LIVE,leg:"buy",reason:"buy leg quotes zero output"};let p=await s(i,l,[n,d],c);if(!p)return{chainId:t,token:n,verdict:g.FAIL,evidence:w.LIVE,leg:"sell",bought:l.toString(),reason:"SELL LEG FAILED while the buy leg quoted fine. This is the honeypot signature: do not trade."};let f=p[p.length-1],h=Number(f*10000n/BigInt(o)),b=g.PASS,m="round trip completes with expected fee/impact loss";return h<5e3?(b=g.FAIL,m=`round trip returns only ${(h/100).toFixed(2)}% -- punitive tax or no real liquidity`):h<9e3&&(b=g.CAUTION,m=`round trip returns ${(h/100).toFixed(2)}% -- transfer tax or thin liquidity at this size`),{chainId:t,token:n,base:d,router:i,verdict:b,reason:m,amountIn:String(o),bought:l.toString(),returned:f.toString(),retentionBps:h,evidence:w.LIVE,note:"Quote-level round trip. It does not prove transfer hooks absent at execution time."}},async prepareUnsignedTx({tokenIn:n,tokenOut:o,amountIn:a,recipient:c,slippageBps:i=50,deadlineSeconds:d=900,path:u},l={}){let p=l.scanner,f=ce(p);if(!f)throw new Error(`chain ${t} has no verified router; preparing a swap stays fail-closed. Add a venue with recorded provenance first (see docs/adding-a-chain.md).`);if(!/^0x[0-9a-fA-F]{40}$/.test(c||""))throw new Error("prepareUnsignedTx requires a valid recipient address");let h=u||[n,o],b=await this.quote({tokenIn:n,tokenOut:o,amountIn:a,path:h},l);if(b.evidence!==w.LIVE)throw new Error(`cannot prepare without a live quote (${b.evidence}: ${b.reason??"no reason given"})`);let m=Sr(b.amountOut,i);if(m<=0n)throw new Error("computed minOut is zero -- refusing to prepare");let A=BigInt(Math.floor(Date.now()/1e3)+Number(d)),x=r&&h[0].toLowerCase()===r.toLowerCase()&&l.useNative,k=x?`0x${ue.swapExactETHForTokens}`+T(m)+T(128)+F(c)+T(A)+T(h.length)+h.map(F).join(""):`0x${ue.swapExactTokensForTokens}`+T(a)+T(m)+T(160)+F(c)+T(A)+T(h.length)+h.map(F).join("");return{unsigned:!0,signedBy:"user-wallet",chainId:t,tx:{to:f,data:k,value:x?`0x${BigInt(a).toString(16)}`:"0x0"},guard:{quotedOut:b.amountOut,minOut:m.toString(),slippageBps:i,maxSlippageBps:le,deadline:A.toString()},requires:x?[]:[{step:"approve",token:h[0],spender:f,amount:String(a)}],note:"UNSIGNED. Re-verify the guard against a fresh quote immediately before signing -- a quote-time minimum is not a minimum at broadcast time."}}}}var Ar=[100,500,3e3,1e4],Ke={quoteExactInputSingle:"c6a5026a",exactInputSingle:"04e45aaf"},U=e=>BigInt(e).toString(16).padStart(64,"0"),D=e=>e.slice(2).toLowerCase().padStart(64,"0"),Xe=/^0x[0-9a-fA-F]{40}$/,pe=100;function xr(e,t){let r=Number(t);if(!Number.isFinite(r)||r<0)throw new Error("slippageBps must be a non-negative number");if(r>pe)throw new Error(`slippageBps ${r} exceeds the ${pe} bps ceiling. Block and requote or split the order -- do not widen the guard to force a fill.`);return BigInt(e)*BigInt(1e4-Math.floor(r))/10000n}function de(e,t){return(e?.venues||[]).find(r=>r.kind===t)?.address??null}function Ye(e){let{chainId:t,wrappedNative:r}=e;async function s({quoter:o,tokenIn:a,tokenOut:c,amountIn:i,fee:d},u){let l=`0x${Ke.quoteExactInputSingle}`+D(a)+D(c)+U(i)+U(d)+U(0),p=await L(t,"eth_call",[{to:o,data:l},"latest"],u).catch(()=>null),f=p?.result??p;if(!f||f==="0x"||f.length<66)return null;let h=BigInt(`0x${f.slice(2,66)}`);return h>0n?h:null}async function n({quoter:o,tokenIn:a,tokenOut:c,amountIn:i},d){let u=[],l=null;for(let p of Ar){let f=await s({quoter:o,tokenIn:a,tokenOut:c,amountIn:i,fee:p},d);u.push({fee:p,amountOut:f?f.toString():null}),f&&(!l||f>l.amountOut)&&(l={fee:p,amountOut:f})}return{best:l,tried:u}}return{async quote({tokenIn:o,tokenOut:a,amountIn:c},i={}){let d=de(i.scanner,"quoter");if(!d)return{chainId:t,evidence:w.UNAVAILABLE,reason:"no verified quoter configured for this chain; quoting stays fail-closed rather than guessing a venue address"};for(let p of[o,a])if(!Xe.test(p||""))throw new Error("quote requires valid 20-byte addresses");let{best:u,tried:l}=await n({quoter:d,tokenIn:o,tokenOut:a,amountIn:c},i);return u?{chainId:t,venue:"uniswap-v3",quoter:d,tokenIn:o,tokenOut:a,amountIn:String(c),amountOut:u.amountOut.toString(),fee:u.fee,useNative:!!r&&String(o).toLowerCase()===String(r).toLowerCase(),triedFeeTiers:l,evidence:w.LIVE,note:"exact-input single-hop quote at current tick; not a guaranteed fill"}:{chainId:t,quoter:d,tokenIn:o,tokenOut:a,triedFeeTiers:l,evidence:w.UNKNOWN,reason:"no fee tier returned a quote -- no V3 pool for this pair, or no liquidity"}},async sellSimulation({token:o,amountIn:a,base:c},i={}){let d=de(i.scanner,"quoter"),u=(e.stableQuoteAssets||[]).map(S=>String(S).toLowerCase()),l=null;!c&&typeof e.resolveQuoteAsset=="function"&&(l=await e.resolveQuoteAsset(o,i).catch(()=>null));let p=String(o).toLowerCase(),f=String(r||"").toLowerCase();if(f&&p===f)return{chainId:t,token:o,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:"token is the base asset for this chain, so there is nothing to round-trip against. Sellability must be judged against a different quote asset."};let h=c||l||(u[0]&&p!==u[0]?u[0]:null)||r;if(h&&p===String(h).toLowerCase())return{chainId:t,token:o,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:"token is the base asset for this chain, so there is nothing to round-trip against. Sellability must be judged against a different quote asset."};if(!d||!h)return{chainId:t,token:o,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:d?"no wrappedNative configured, so there is no base asset to round-trip against":"no verified quoter configured for this chain"};let b=await n({quoter:d,tokenIn:h,tokenOut:o,amountIn:a},i);if(!b.best){let S=u.find(E=>E&&E!==String(h).toLowerCase()&&E!==String(o).toLowerCase());if(S){let E=await n({quoter:d,tokenIn:S,tokenOut:o,amountIn:a},i);if(E.best){let v=await n({quoter:d,tokenIn:o,tokenOut:S,amountIn:E.best.amountOut},i);if(v.best){let I=v.best.amountOut,_=Number(I*10000n/BigInt(a)),C=g.PASS,N="round trip vs dollar book completes with expected fee/impact loss";return _<5e3?(C=g.FAIL,N=`round trip vs dollar book returns only ${(_/100).toFixed(2)}% -- punitive tax or no real liquidity`):_<9e3&&(C=g.CAUTION,N=`round trip vs dollar book returns ${(_/100).toFixed(2)}% -- transfer tax or thin liquidity at this size`),{chainId:t,venue:"uniswap-v3",token:o,base:S,quoteAsset:S,verdict:C,reason:N,amountIn:String(a),bought:E.best.amountOut.toString(),returned:I.toString(),retentionBps:_,buyFee:E.best.fee,sellFee:v.best.fee,evidence:w.LIVE,note:"Quoted against the dollar book, not wrapped native. A missing WETH pool is not a honeypot."}}}}return{chainId:t,token:o,verdict:g.FAIL,evidence:w.LIVE,leg:"buy",reason:"no V3 pool priced the buy leg on any fee tier against wrapped native or the dollar book"}}let m=await n({quoter:d,tokenIn:o,tokenOut:h,amountIn:b.best.amountOut},i);if(!m.best){let S=u.find(E=>E&&E!==String(h).toLowerCase()&&E!==String(o).toLowerCase());if(S){let E=await n({quoter:d,tokenIn:S,tokenOut:o,amountIn:a},i),v=E.best?await n({quoter:d,tokenIn:o,tokenOut:S,amountIn:E.best.amountOut},i):{best:null};if(E.best&&v.best){let I=v.best.amountOut,_=Number(I*10000n/BigInt(a)),C=g.PASS,N="round trip vs dollar book completes; missing WETH sell pool is not a honeypot";return _<5e3?(C=g.FAIL,N=`dollar-book round trip returns only ${(_/100).toFixed(2)}%`):_<9e3&&(C=g.CAUTION,N=`dollar-book round trip returns ${(_/100).toFixed(2)}%`),{chainId:t,venue:"uniswap-v3",token:o,base:S,quoteAsset:S,verdict:C,reason:N,amountIn:String(a),bought:E.best.amountOut.toString(),returned:I.toString(),retentionBps:_,buyFee:E.best.fee,sellFee:v.best.fee,evidence:w.LIVE,note:"Sell vs wrapped native failed; dollar book succeeded. Not labelled honeypot."}}}return{chainId:t,token:o,verdict:g.FAIL,evidence:w.LIVE,leg:"sell",bought:b.best.amountOut.toString(),reason:"SELL LEG FAILED against wrapped native and the dollar book. This is the honeypot signature: do not trade."}}let A=m.best.amountOut,x=Number(A*10000n/BigInt(a)),k=g.PASS,y="round trip completes with expected fee/impact loss";return x<5e3?(k=g.FAIL,y=`round trip returns only ${(x/100).toFixed(2)}% -- punitive tax or no real liquidity`):x<9e3&&(k=g.CAUTION,y=`round trip returns ${(x/100).toFixed(2)}% -- transfer tax or thin liquidity at this size`),{chainId:t,venue:"uniswap-v3",token:o,base:h,verdict:k,reason:y,amountIn:String(a),bought:b.best.amountOut.toString(),returned:A.toString(),retentionBps:x,buyFee:b.best.fee,sellFee:m.best.fee,evidence:w.LIVE,note:"Quote-level round trip. It does not prove transfer hooks absent at execution time."}},async prepareUnsignedTx({tokenIn:o,tokenOut:a,amountIn:c,recipient:i,slippageBps:d=50,fee:u},l={}){let p=de(l.scanner,"router");if(!p)throw new Error(`chain ${t} has no verified V3 router; preparing a swap stays fail-closed. Add a venue with recorded provenance first (see docs/adding-a-chain.md).`);if(!Xe.test(i||""))throw new Error("prepareUnsignedTx requires a valid recipient address");let f=await this.quote({tokenIn:o,tokenOut:a,amountIn:c},l);if(f.evidence!==w.LIVE)throw new Error(`cannot prepare without a live quote (${f.evidence}: ${f.reason??"no reason given"})`);let h=u??f.fee,b=xr(f.amountOut,d);if(b<=0n)throw new Error("computed minOut is zero -- refusing to prepare");let m=!!(l.useNative||f.useNative)&&r&&String(o).toLowerCase()===String(r).toLowerCase(),A=`0x${Ke.exactInputSingle}`+D(o)+D(a)+U(h)+D(i)+U(c)+U(b)+U(0);return{unsigned:!0,signedBy:"user-wallet",chainId:t,venue:"uniswap-v3",tx:{to:p,data:A,value:m?String(c):"0x0"},guard:{quotedOut:f.amountOut,minOut:b.toString(),slippageBps:d,maxSlippageBps:pe,fee:h},requires:m?[]:[{step:"approve",token:o,spender:p,amount:String(c)}],note:"UNSIGNED. Re-verify the guard against a fresh quote immediately before signing -- a quote-time minimum is not a minimum at broadcast time."}}}}var j={decimals:"0x313ce567",symbol:"0x95d89b41",name:"0x06fdde03",totalSupply:"0x18160ddd",owner:"0x8da5cb5b"};function Qe(e){if(!e||e==="0x")return null;try{return BigInt(e)}catch{return null}}function Ze(e){if(!e||e==="0x")return null;let t=e.slice(2);if(t.length>=128){let s=Number(BigInt(`0x${t.slice(64,128)}`));if(s>0&&s<=256&&t.length>=128+s*2){let n=t.slice(128,128+s*2),o=Buffer.from(n,"hex").toString("utf8").replace(/\0+$/,"");if(o)return o}}return Buffer.from(t.slice(0,64),"hex").toString("utf8").replace(/\0+$/,"")||null}function Cr(e){let{chainId:t}=e;async function r(s,n,o){return L(t,"eth_call",[{to:s,data:n},"latest"],o)}return{async blockNumber(s={}){let n=await $e(t,s);return{chainId:t,blockNumber:n?.blockNumber??n,evidence:w.LIVE}},async nativeBalance(s,n={}){let o=await Fe(t,s,n);return{chainId:t,address:s,wei:o?.wei??o?.balance??null,symbol:e.nativeCurrency?.symbol??null,decimals:e.nativeCurrency?.decimals??18,evidence:w.LIVE}},async tokenBalance({token:s,owner:n},o={}){let a=await De({chainId:t,token:s,owner:n},o);return{chainId:t,token:s,owner:n,raw:a?.balance??a,evidence:w.LIVE}},async resolveToken(s,n={}){if(!/^0x[0-9a-fA-F]{40}$/.test(s||""))return{chainId:t,token:s,evidence:w.UNKNOWN,error:"resolveToken needs a 20-byte address; symbol lookup is a market-data concern"};let[o,a,c,i]=await Promise.all([r(s,j.decimals,n).catch(()=>null),r(s,j.symbol,n).catch(()=>null),r(s,j.name,n).catch(()=>null),r(s,j.totalSupply,n).catch(()=>null)]),d=Qe(o?.result??o),u=d!==null||a?.result||c?.result;return{chainId:t,address:s,decimals:d===null?null:Number(d),symbol:Ze(a?.result??a),name:Ze(c?.result??c),totalSupply:(Qe(i?.result??i)??null)?.toString()??null,evidence:u?w.LIVE:w.UNKNOWN,warning:u?void 0:"no ERC-20 metadata returned -- may not be a token contract"}},async resolvePools(s,n={}){let o=e.dexscreenerSlug;if(!o)return{chainId:t,token:s,pools:[],evidence:w.UNAVAILABLE,reason:"no dexscreenerSlug configured for this chain; pool discovery is unavailable rather than guessed"};let a=await ae(s,n).catch(()=>null),i=(a?.pairs||a?.data?.pairs||[]).filter(u=>String(u.chainId).toLowerCase()===String(o).toLowerCase()).map(u=>({pair:u.pairAddress,dex:u.dexId,base:u.baseToken?.address,quote:u.quoteToken?.address,liquidityUsd:u.liquidity?.usd??null,priceUsd:u.priceUsd??null,volume24hUsd:u.volume?.h24??null,createdAt:u.pairCreatedAt??null})).sort((u,l)=>(l.liquidityUsd??0)-(u.liquidityUsd??0)),d=z(s,i,{stables:e.stableQuoteAssets||[],wrappedNative:e.wrappedNative});return{chainId:t,token:s,pools:d,topPool:d[0]||null,quoteAsset:He(s,d),evidence:d.length?w.LIVE:w.UNKNOWN}},async scanBlocks({fromBlock:s,toBlock:n,address:o,topics:a,chunkSize:c=2e3}={},i={}){if(!Number.isInteger(s)||!Number.isInteger(n))throw new Error("scanBlocks requires integer fromBlock and toBlock");if(n<s)throw new Error("toBlock must be >= fromBlock");let d=[],u=[];for(let l=s;l<=n;l+=c){let p=Math.min(l+c-1,n);u.push([l,p])}for(let[l,p]of u){let f={fromBlock:`0x${l.toString(16)}`,toBlock:`0x${p.toString(16)}`};o&&(f.address=o),a&&(f.topics=a);let h=await L(t,"eth_getLogs",[f],i).catch(b=>({error:String(b?.message||b)}));if(h?.error)return{chainId:t,fromBlock:s,toBlock:n,logs:d,complete:!1,failedAt:[l,p],error:h.error,evidence:w.UNKNOWN};for(let b of h?.result??h??[])d.push(b)}return{chainId:t,fromBlock:s,toBlock:n,logs:d,complete:!0,chunks:u.length,evidence:w.LIVE}},async scoreRisk(s,n={}){let o=[],a=g.PASS,c=u=>{let l={[g.PASS]:0,[g.CAUTION]:1,[g.UNKNOWN]:2,[g.FAIL]:3};l[u]>l[a]&&(a=u)},i=await this.resolveToken(s,n);i.evidence!==w.LIVE?(o.push({check:"erc20-metadata",result:g.UNKNOWN,detail:i.warning}),c(g.UNKNOWN)):o.push({check:"erc20-metadata",result:g.PASS,detail:`${i.symbol} / ${i.decimals}d`});let d=await this.resolvePools(s,n);if(d.evidence===w.UNAVAILABLE)o.push({check:"liquidity",result:g.UNKNOWN,detail:d.reason}),c(g.UNKNOWN);else if(!d.pools.length)o.push({check:"liquidity",result:g.FAIL,detail:"no pool with liquidity found"}),c(g.FAIL);else{let u=d.pools[0],l=u.liquidityUsd??0;l<5e3?(o.push({check:"liquidity",result:g.CAUTION,detail:`top pool only $${l}`}),c(g.CAUTION)):o.push({check:"liquidity",result:g.PASS,detail:`$${l} on ${u.dex}`}),u.createdAt&&Date.now()-u.createdAt<24*3600*1e3&&(o.push({check:"age",result:g.CAUTION,detail:"pool under 24h old"}),c(g.CAUTION))}if(typeof this.sellSimulation=="function"){let u=await this.sellSimulation({token:s,amountIn:(10n**16n).toString()},n).catch(l=>({verdict:g.UNKNOWN,reason:String(l?.message||l)}));o.push({check:"sellability",result:u.verdict,detail:u.retentionBps!=null?`round trip returns ${(u.retentionBps/100).toFixed(2)}% -- ${u.reason}`:u.reason}),c(u.verdict)}else o.push({check:"sellability",result:g.UNKNOWN,detail:"no verified router on this chain, so a round-trip sell simulation cannot run. Treat as unproven -- a buy path is not an exit path."}),c(g.UNKNOWN);return{chainId:t,token:s,verdict:a,checks:o,note:"Structural checks only. UNKNOWN is not PASS. A token is not tradeable until a sell simulation succeeds."}}}}function Je(e){let r={...Cr(e)},s=new Set((e.venues||[]).map(o=>o.kind));e.venueKind==="uniswap-v3"&&s.has("quoter")&&s.has("router")?Object.assign(r,Ye({chainId:e.chainId,wrappedNative:e.wrappedNative,stableQuoteAssets:e.stableQuoteAssets||[],resolveQuoteAsset:async(o,a)=>(await r.resolvePools(o,a)).quoteAsset||null})):e.venueKind==="uniswap-v2"&&s.has("router")&&Object.assign(r,je({chainId:e.chainId,wrappedNative:e.wrappedNative}));let n={};for(let[o,a]of Object.entries(r))n[o]=a.bind(r);return{key:e.key,chainId:e.chainId,name:e.name,rpcEnv:e.rpcEnv,nativeCurrency:e.nativeCurrency,explorer:e.explorer,venues:e.venues||[],capabilities:n}}var kr=Object.freeze([{key:"ethereum",chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://etherscan.io",dexscreenerSlug:"ethereum",venueKind:"uniswap-v3",wrappedNative:"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",stableQuoteAssets:["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48","0xdAC17F958D2ee523a2206206994597C13D831ec7"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDC fee 500 quoted 1908.71 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:1}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:1}}]},{key:"optimism",chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://optimistic.etherscan.io",dexscreenerSlug:"optimism",venueKind:"uniswap-v3",wrappedNative:"0x4200000000000000000000000000000000000006",stableQuoteAssets:["0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85","0x94b008aA00579c1307B0EF2c499aD98a8ce58e58"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDC fee 500 quoted 1905.23 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:10}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:10}}]},{key:"bsc",chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],nativeCurrency:{symbol:"BNB",decimals:18},explorer:"https://bscscan.com",dexscreenerSlug:"bsc",venueKind:"uniswap-v3",wrappedNative:"0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c",stableQuoteAssets:["0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d","0x55d398326f99059fF775485246999027B3197955"],venues:[{kind:"quoter",address:"0x78D78E420Da98ad378D7799bE8f4AF69033EB077",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WBNB->USDC fee 500 quoted 413.86 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:56}},{kind:"router",address:"0xB971eF87ede563556b2ED4b1C0b0019111Dd85d2",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:56}}]},{key:"polygon",chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],nativeCurrency:{symbol:"POL",decimals:18},explorer:"https://polygonscan.com",dexscreenerSlug:"polygon",venueKind:"uniswap-v3",wrappedNative:"0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270",stableQuoteAssets:["0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359","0xc2132D05D31c914a87C6611C10748AEb04B58e8F"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WMATIC->USDC fee 500 quoted 0.0720 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:137}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:137}}]},{key:"stable",chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],nativeCurrency:{symbol:"USDT0",decimals:18},venueKind:"uniswap-v3",wrappedNative:"0x5d442b349590a6048Eb2dC0eC346cAA5F47A9ab5",venues:[{kind:"quoter",address:"0xb070179E7032CdA868b53e6C1742F80c9e940d1A",label:"Uniswap V3 QuoterV2 (canonical)",verified:{method:"Stable is on the OFFICIAL Uniswap v3 Deployments List (governance-recognised 2026-05-12, UAC process completed 2026-04, deployed by Protofire), so this is a canonical deployment rather than a fork. eth_getCode returned 8273 bytes, the same size as the canonical quoter on the seven already-verified chains. Functional probe on a live pool (TOAST -> USDT0, fee 10000): 100 in -> 0.000003, 1000 -> 0.000031, 10000 -> 0.000319 USDT0. Output scales monotonically with input, which is a working quoter answering, not a revert. Two of three sampled pools carry non-zero liquidity. NOTE: the pools discovered so far are thin, so real routing size is limited -- the venue is proved, deep liquidity is not.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:988}},{kind:"router",address:"0x32eaf9B5d5F2CD7361c5012890C943D7de84C22a",label:"Uniswap SwapRouter02 (canonical)",verified:{method:"eth_getCode returned 24497 bytes. Cross-checked on-chain rather than trusted from docs: router.factory() returns 0x88f0a512ef09175d456bc9547f914f48c013e4aa, the same v3 core factory that created the pools quoted above, and router.WETH9() returns the wrappedNative recorded on this chain entry. Address published in the Stable docs DEX reference and the Uniswap deployments list.",source:"docs.stable.xyz/en/reference/dexes + on-chain factory()/WETH9() round-trip",date:"2026-08-05",chainId:988}}]},{key:"hyperevm",chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],nativeCurrency:{symbol:"HYPE",decimals:18},dexscreenerSlug:"hyperevm",venueKind:"uniswap-v3",wrappedNative:"0x5555555555555555555555555555555555555555",venues:[{kind:"quoter",address:"0x03A918028f22D9E1473B7959C927AD7425A45C7C",label:"HyperSwap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle(1 WHYPE -> USDT0) returned live output on all four fee tiers (100: 57.3385, 500: 57.4187, 3000: 57.3237, 10000: 56.1963 USDT0). Decimals read on-chain: WHYPE 18, USDT0 6. Best tier checked against an INDEPENDENT control the same minute -- Hyperliquid allMids put HYPE at 57.3205, so the pool is 0.171% from the perp mid, which is the right shape for fee plus impact rather than a wrong contract or a decimals bug.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:999}},{kind:"router",address:"0x4E2960a8cd19B467b82d26D83fAcb0fAE26b094D",label:"HyperSwap V3 SwapRouter",verified:{method:"eth_getCode returned 12070 bytes, and it is the router paired with the quoter proved above -- the same pair already shipped in UNI_V3_VENUES[999].hyperswap, which is the map the quote/prepare path actually routes through.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:999}}]},{key:"abstract",chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},venueKind:"uniswap-v3",wrappedNative:"0x3439153EB7AF838Ad19d56E1571FBD09333C2809",venues:[{kind:"quoter",address:"0x728BD3eC25D5EDBafebB84F3d67367Cd9EBC7693",label:"Uniswap V3 QuoterV2 (Abstract deployment)",verified:{method:"Abstract is a ZK-stack chain, so CREATE2 addresses differ and the canonical Uniswap addresses are NOT valid here -- probing them returns codesize 0, which is what previously made this chain look like it had no V3 at all. Found the real deployment from live traffic instead: scanned recent Swap(...) logs, took the busiest pool, read pool.factory() = 0xa1160e73b63f322ae88cc2d8e700833e71d0b2a1, then enumerated that factory's deployer (0xf3d63166F0Ca56C3c1A3508FcE03Ff0Cf3Fb691e) and probed each of its 56 contracts with a real quoteExactInputSingle call. Exactly one answered: 1 WETH -> 1846.475731 USDC.e at fee 500. Independent sanity check: the pool's own slot0() spot price is 1873.11 USDC.e per WETH, so the quoter sits ~1.4% below spot, the right shape for fee plus price impact on this size.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:2741}},{kind:"router",address:"0x7712FA47387542819d4E35A23f8116C90C18767C",label:"Uniswap SwapRouter02 (Abstract deployment)",verified:{method:"eth_getCode returned 167392 bytes and the runtime contains the exactInputSingle selector. router.factory() matches the factory proved above and router.WETH9() matches the wrappedNative on this entry. Chosen over its byte-identical twin (0xfD6257F4...) because this is the address real users actually route through: it appeared as tx.to on live swaps against the WETH/USDC.e pool.",source:"on-chain factory()/WETH9() round-trip + live swap tx.to sampling",date:"2026-08-05",chainId:2741}}]},{key:"robinhood",chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC","ROBINHOOD_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},dexscreenerSlug:"robinhood",venueKind:"uniswap-v3",wrappedNative:"0x0bd7d308f8e1639fab988df18a8011f41eacad73",stableQuoteAssets:["0x5fc5360d0400a0fd4f2af552add042d716f1d168"],venues:[{kind:"quoter",address:"0x33e885ed0ec9bf04ecfb19341582aadcb4c8a9e7",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDG fee 100 quoted 1866.58 USDG, and USDG->CASHCAT fee 10000 quoted a live amount). A contract that correctly prices known pairs IS a working V3 quoter",source:"live eth_call against rpc.mainnet.chain.robinhood.com",date:"2026-07-31",chainId:4663}},{kind:"router",address:"0xcaf681a66d020601342297493863e78c959e5cb2",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode (24497 bytes) on this chain and the paired quoter at the same deployment passed a live functional quote",source:"live eth_getCode against rpc.mainnet.chain.robinhood.com",date:"2026-07-31",chainId:4663}},{kind:"factory",address:"0x1f7d7550b1b028f7571e69a784071f0205fd2efa",label:"Uniswap V3 Factory",verified:{method:"eth_getCode returned real bytecode (24535 bytes) and a PoolCreated log scan over this factory returned 76 pools in ~9000 recent blocks",source:"live eth_getLogs against rpc.mainnet.chain.robinhood.com",date:"2026-07-31",chainId:4663}}]},{key:"base",chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://basescan.org",dexscreenerSlug:"base",venueKind:"uniswap-v3",wrappedNative:"0x4200000000000000000000000000000000000006",stableQuoteAssets:["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"],venues:[{kind:"quoter",address:"0x3d4e44Eb1374240CE5F1B871ab261CD16335B76a",label:"Uniswap V3 QuoterV2 (Base)",verified:{method:"functional probe: quoteExactInputSingle returned WETH->USDC at fee 500 = 1908.44 USDC, a live sane price. The canonical mainnet quoter address also has bytecode on Base but does NOT price this pair, which is exactly the false positive a codesize-only check accepts",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:8453}},{kind:"router",address:"0x2626664c2603336E57B271c5C0b26F421741e481",label:"Uniswap V3 SwapRouter02 (Base)",verified:{method:"eth_getCode returned real bytecode and the paired Base quoter passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:8453}},{kind:"router-v2",address:"0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24",label:"Uniswap V2 Router02 (Base)",verified:{method:"eth_getCode returned 17891 bytes; live getAmountsOut on WETH->USDC round-tripped to 98.75% (2x0.30% fee + impact)",source:"https://docs.uniswap.org/contracts/v2/reference/smart-contracts/v2-deployments",date:"2026-07-30",chainId:8453}}]},{key:"arbitrum",chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://arbiscan.io",dexscreenerSlug:"arbitrum",venueKind:"uniswap-v3",wrappedNative:"0x82aF49447D8a07e3bd95BD0d56f35241523fBab1",stableQuoteAssets:["0xaf88d065e77c8cC2239327C5EDb3A432268e5831","0xFd086bC7CD5C481DCC9C85ebE478A1C0b69FCbb9"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDC fee 500 quoted 1908.72 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:42161}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:42161}}]},{key:"avalanche",chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],nativeCurrency:{symbol:"AVAX",decimals:18},explorer:"https://snowtrace.io",dexscreenerSlug:"avalanche",venueKind:"uniswap-v3",wrappedNative:"0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7",stableQuoteAssets:["0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E"],venues:[{kind:"quoter",address:"0xbe0F5544EC67e9B3b2D979aaA43f18Fd87E6257F",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WAVAX->USDC fee 500 quoted 6.48 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:43114}},{kind:"router",address:"0xbb00FF08d01D300023C629E8fFfFcb65A5a578cE",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:43114}}]}]);function et(){return kr.map(e=>ze(Je(e)))}import{createHash as Lr,createHmac as nt,timingSafeEqual as Tr}from"node:crypto";import{readFileSync as Ir}from"node:fs";import{homedir as _r}from"node:os";import{join as K}from"node:path";function Nr(){if(process.env.ORACLE_TEST_ISOLATE_SECRETS==="1"){let r=(process.env.ORACLE_EXEC_ENV_FILE||"").trim();return r?[r]:[]}let e=(process.env.ORACLE_EXEC_ENV_FILE||process.env.MAD_EXEC_ENV_FILE||"").trim(),t=_r();if(process.env.ORACLE_PUBLIC_DESKTOP==="1"){let r=(process.env.ORACLE_CONFIG_DIR||K(t,".config","oracle")).trim();return[e,K(r,"exec.env")].filter(Boolean)}return[e,K(t,".config","oracle","exec.env"),K(t,".config","mad-desk","exec.env")].filter(Boolean)}function tt(e,t,r){let s=e??process.env[t]??process.env[r];if(!String(s||"").trim())for(let n of Nr())try{let o=Ir(n,"utf8"),a=o.match(new RegExp(`^${t}=(.*)$`,"m"))||o.match(new RegExp(`^${r}=(.*)$`,"m"));if(a&&(s=a[1].trim(),s))break}catch{}if(!String(s||"").trim())throw new Error(`${t} required for attestation. Set it in the environment, or place ${t}=<value> in ~/.config/oracle/exec.env`);return s}var X=100,rt=2e4;function Y(e){return Array.isArray(e)?`[${e.map(Y).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${Y(e[t])}`).join(",")}}`:JSON.stringify(e??null)}function ot(e,{required:t=!1}={}){try{return tt(e,"ORACLE_ROUTE_ATTESTATION_SECRET","MAD_ROUTE_ATTESTATION_SECRET")}catch(r){if(t)throw r;return null}}function he(e){let{signature:t,...r}=e;return r}function st(e,{secret:t}={}){let r=ot(t);return r?{...e,signature:nt("sha256",r).update(Y(he(e))).digest("hex")}:e}function Rr(e){let t=String(e||"").toLowerCase();if(!/^0x[0-9a-f]+$/.test(t)||t.length<10||t.length%2!==0)throw new Error("auto-slippage calldata must be even-length hex with a selector");return Lr("sha256").update(Buffer.from(t.slice(2),"hex")).digest("hex")}function it(e,{chainId:t,venue:r,data:s,secret:n}={}){if(!e||e.mode!=="auto")throw new Error("bounded auto-slippage guard required");if(Number(e.chainId)!==Number(t))throw new Error("auto-slippage guard chain mismatch");if(String(e.venue).toLowerCase()!==String(r||"").toLowerCase())throw new Error("auto-slippage guard venue mismatch");let o=ot(n);if(o){let f=nt("sha256",o).update(Y(he(e))).digest("hex");if(!Or(e.signature,f))throw new Error("auto-slippage guard signature mismatch \u2014 refusing to bind a guard this Oracle did not issue")}let a=Number(e.selectedBps),c=Number(e.capBps);if(!Number.isInteger(a)||a<0||a>X||!Number.isInteger(c)||c<0||c>X||a>c)throw new Error("auto-slippage guard bounds are invalid");let i=BigInt(e.quoteAmountOut??0),d=BigInt(e.minAmountOut??0);if(i<=0n||d<=0n)throw new Error("auto-slippage guard amounts must be positive");let u=i*BigInt(1e4-a),l=u/10000n;if(u%10000n!==0n&&(l+=1n),d<l)throw new Error("auto-slippage guard is under-protected relative to its quote");let p=Pr(s);if(p!=null&&p!==d)throw new Error(`auto-slippage: calldata encodes floor ${p}, not the guard floor ${d} \u2014 refusing to bind`);return st({...he(e),calldataHash:Rr(s)},{secret:n})}function Or(e,t){let r=Buffer.from(String(e??""),"utf8"),s=Buffer.from(String(t??""),"utf8");return r.length!==s.length||r.length===0?!1:Tr(r,s)}function fe(e,t=0){let r=Number(e);return Number.isFinite(r)?r:t}function qr(e){let t=e==null?X:Number(e);if(!Number.isInteger(t)||t<0)throw new Error("auto-slippage cap must be a non-negative integer bps value");return Math.min(t,X)}function Ur({liquidityUsd:e,priceChange5m:t=0,quoteAgeMs:r=0,crossChain:s=!1,requestedCapBps:n}={}){let o=fe(e,0),a=o>0?o>=25e4?5:o>=1e5?10:o>=5e4?20:o>=1e4?40:70:s?30:10,c=Math.min(60,Math.abs(fe(t,0))*2),i=Math.min(40,Math.floor(Math.max(0,fe(r,0))/5e3)*5),d=Math.max(25,Math.ceil(20+a+c+i)),u=qr(n);return{mode:"auto",requiredBps:d,selectedBps:Math.min(d,u),capBps:u,executable:d<=u}}function at({chainId:e,venue:t,quoteAmountOut:r,liquidityUsd:s,priceChange5m:n=0,quoteAgeMs:o=0,crossChain:a=!1,requestedCapBps:c,quotedAtMs:i=Date.now(),ttlMs:d=rt,secret:u}={}){let l=BigInt(r??0);if(l<=0n)throw new Error("auto-slippage guard requires positive quoteAmountOut");let p=Ur({liquidityUsd:s,priceChange5m:n,quoteAgeMs:o,crossChain:a,requestedCapBps:c});if(!p.executable)throw new Error(`auto-slippage requires ${p.requiredBps} bps above hard/requested cap ${p.capBps}; route blocked`);let f=Number(i);if(!Number.isFinite(f))throw new Error("auto-slippage: quotedAtMs must be a finite number");let h=Math.min(3e4,Math.max(1e3,Number(d)||rt)),b=l*BigInt(1e4-p.selectedBps),m=b/10000n;if(b%10000n!==0n&&(m+=1n),m>l&&(m=l),l>0n&&m<=0n)throw new Error(`auto-slippage: quote ${l} is too small to express a ${p.selectedBps} bps floor without rounding to zero`);let A=Number((l-m)*10000n/(l===0n?1n:l));if(A>p.capBps)throw new Error(`auto-slippage: realised floor implies ${A} bps, above cap ${p.capBps} \u2014 refusing to issue a guard weaker than advertised`);return st({mode:"auto",chainId:Number(e),venue:String(t||"unknown"),quoteAmountOut:l.toString(),minAmountOut:m.toString(),requiredBps:p.requiredBps,selectedBps:p.selectedBps,capBps:p.capBps,quotedAtMs:f,expiresAtMs:f+h},{secret:u})}function Pr(e){let t=String(e||"");if(!/^0x[0-9a-fA-F]+$/.test(t)||t.length<10||t.length%2!==0)return null;let r=t.slice(0,10).toLowerCase(),s=[];for(let o=10;o+64<=t.length;o+=64)s.push(t.slice(o,o+64));let n=o=>s[o]==null?null:BigInt("0x"+s[o]);switch(r){case"0x414bf389":return n(6);case"0x04e45aaf":return n(5);case"0xc04b8d59":{let o=n(0);if(o==null)return null;let a=Number(o)/32;return!Number.isInteger(a)||a<0?null:n(a+4)}case"0xb858183f":{let o=n(0);if(o==null)return null;let a=Number(o)/32;return!Number.isInteger(a)||a<0?null:n(a+3)}case"0xa026383e":return n(6);case"0x38ed1739":case"0x5c11d795":return n(1);case"0x7ff36ab5":case"0xb6f9de95":return n(0);case"0x18cbafe5":case"0x791ac947":return n(1);default:return null}}var Br=Object.freeze({"8da5cb5b":{name:"owner()",weight:"low",note:"contract has an owner"},f2fde38b:{name:"transferOwnership(address)",weight:"low",note:"ownership transferable"},"40c10f19":{name:"mint(address,uint256)",weight:"high",note:"owner can mint new supply"},a0712d68:{name:"mint(uint256)",weight:"high",note:"owner can mint new supply"},f9f92be4:{name:"blacklist(address)",weight:"high",note:"addresses can be blocked from selling"},e4997dc5:{name:"removeBlackList(address)",weight:"high",note:"blacklist machinery present"},"8456cb59":{name:"pause()",weight:"high",note:"transfers can be frozen"},"3f4ba83a":{name:"unpause()",weight:"high",note:"pausable transfers"},c0246668:{name:"setFee/excludeFromFee",weight:"high",note:"transfer fees can be changed"},"3659cfe6":{name:"upgradeTo(address)",weight:"high",note:"logic can be replaced entirely"},"4f1ef286":{name:"upgradeToAndCall(address,bytes)",weight:"high",note:"logic can be replaced entirely"}}),$r=Object.freeze([{label:"eip1967",slot:"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc"},{label:"zeppelinos",slot:"0x7050c9e0f4ca769c69bd3a8ef740bc37934f8e2c036e5a723fd8ee048ed3f8c3"},{label:"eip1822",slot:"0xc5f16f0fcc639fa48a6947836d9850f504798523bf8c9a3a87d5876cf622bcf7"}]),Fr=`0x${"0".repeat(64)}`;function Dr(e){return!e||e==="0x"||e===Fr}async function ct(e={},t={}){let r=t.rpcCall||L,s=String(e.address||"").trim().toLowerCase(),n=Number(e.chainId);if(!/^0x[a-f0-9]{40}$/.test(s))return{status:"error",error:"address must be a 0x-prefixed EVM address",risk:"unknown-risk",findings:[],notes:[]};if(!Number.isInteger(n))return{status:"error",error:"chainId is required",risk:"unknown-risk",findings:[],notes:[]};let o;try{o=await r(n,"eth_getCode",[s,"latest"],t)}catch(h){return{address:s,chainId:n,status:"unavailable",error:h?.message||"eth_getCode failed",risk:"unknown-risk",findings:[],isProxy:!1,codeSize:0,notes:["could not read contract code; treat as unverified"]}}if(!o||o==="0x")return{address:s,chainId:n,status:"ok",risk:"high",findings:[{selector:"-",name:"no-code",weight:"high",note:"no contract deployed at this address"}],isProxy:!1,codeSize:0,notes:["nothing is deployed here \u2014 an approval or transfer to this address is unrecoverable"]};let a=[],c=[],i=o.slice(2).toLowerCase();for(let[h,b]of Object.entries(Br))i.includes(h)&&c.push({selector:`0x${h}`,...b});let d=!1,u=null,l=null;for(let{label:h,slot:b}of $r)try{let m=await r(n,"eth_getStorageAt",[s,b,"latest"],t);if(!Dr(m)){d=!0,u=h,l=`0x${String(m).slice(-40)}`;break}}catch{a.push(`proxy slot (${h}) unreadable; proxy status uncertain`)}d&&(c.push({selector:u,name:"proxy",weight:"high",note:"implementation is upgradeable \u2014 current behaviour is not a guarantee"}),a.push(`bytecode scan covers the proxy (${u}), not the implementation ${l} it delegates to`));let f=c.filter(h=>h.weight==="high").length>0?"high":c.length>0?"elevated":"unknown-risk";return f==="unknown-risk"&&a.push("no owner-power selectors found; this is weak evidence, not a safety guarantee"),{address:s,chainId:n,status:"ok",risk:f,findings:c,isProxy:d,proxyStandard:u,implementation:l,codeSize:Math.floor(i.length/2),notes:a}}var Mr=/^0x[0-9a-fA-F]{40}$/,Hr=4663;function Q(e,t){let r=String(e||"").trim();if(!Mr.test(r))throw new Error(`evm-token-sniper: ${t} must be a 0x EVM address`);return r}function me(e,t){let r=String(e??"").trim();if(!/^\d+$/.test(r)||BigInt(r)<=0n)throw new Error(`evm-token-sniper: ${t} must be a positive raw integer amount`);return r}function M(e,t){return e==null||e===""?null:me(e,t)}function Vr({chainId:e,tokenAddress:t,tokenIn:r,amountIn:s,recipient:n,quote:o,topPool:a,unsignedTx:c,args:i,opts:d}){let u=c?.tx;if(!u||typeof u!="object")throw new Error("local-signer envelope requires unsigned tx object");let l=Q(u.to,"prepared destination"),p=String(u.data||"").toLowerCase();if(!/^0x[0-9a-f]+$/.test(p))throw new Error("local-signer envelope requires hex calldata");let f=me(u.value??s,"prepared native value");if(BigInt(f)!==BigInt(s))throw new Error("local-signer envelope requires native value equal amountIn");let h=M(u.gasLimit??i.gasLimit,"gasLimit"),b=M(u.maxFeePerGas??i.maxFeePerGas,"maxFeePerGas");if(!h||!b)throw new Error("local-signer envelope requires explicit gasLimit and maxFeePerGas caps");let m=Number(d.nowMs??Date.now()),A=Math.min(6e4,Math.max(1e3,Number(i.ttlMs??i.expiresInMs??3e4)||3e4)),x=at({chainId:e,venue:"uniswap-v3",quoteAmountOut:o?.amountOut,liquidityUsd:a?.liquidityUsd,requestedCapBps:i.slippageBps??50,quotedAtMs:m,ttlMs:A,secret:d.routeAttestationSecret}),k=it(x,{chainId:e,venue:"uniswap-v3",data:p,secret:d.routeAttestationSecret}),y={chainId:e,from:n,to:l,data:p,value:f,gasLimit:h,maxFeePerGas:b,slippageBps:k.selectedBps,expiresAtMs:m+A},S=M(u.maxPriorityFeePerGas??i.maxPriorityFeePerGas,"maxPriorityFeePerGas");return S&&(y.maxPriorityFeePerGas=S),i.nonce!==void 0&&(y.nonce=Number(i.nonce)),(i.txType!==void 0||S)&&(y.type=Number(i.txType??2)),i.l1FeeWei!==void 0&&(y.l1FeeWei=M(i.l1FeeWei,"l1FeeWei")??"0"),i.operatorFeeWei!==void 0&&(y.operatorFeeWei=M(i.operatorFeeWei,"operatorFeeWei")??"0"),{version:1,surface:"evm-swap",action:"swap",provider:"uniswap-v3",owner:n,destination:l,tradeId:i.tradeId||`evm-token-sniper-${e}-${t.toLowerCase()}`,slippageBps:k.selectedBps,expiresAtMs:m+A,fee:{oracleFeeBps:5},autoSlippage:k,artifact:{chainId:e,owner:n,transactions:[y]},meta:{source:"evm-token-sniper",tokenIn:r,tokenOut:t}}}function Wr(e,t){if(t){if(Number(t.chainId)!==e)throw new Error(`evm-token-sniper: supplied scanner chain ${t.chainId} does not match ${e}`);return t}et();let r=Ge(e);if(!r)throw new Error(`evm-token-sniper: unsupported EVM chainId ${e}`);return r}function zr({token:e,pools:t,structuralRisk:r,scannerRisk:s,sellability:n,quote:o,args:a,scanner:c}){let i=[];return e?.evidence!==w.LIVE&&i.push("token identity is not live-verified"),(!Array.isArray(t?.pools)||t.pools.length===0)&&i.push("no liquid pool was resolved"),r?.status!=="ok"&&i.push("structural contract risk is unavailable"),r?.risk==="high"&&i.push("structural contract risk is high"),s?.verdict!==g.PASS&&i.push(`scanner risk verdict is ${s?.verdict||"UNKNOWN"}`),c.supports?.("sellSimulation")?n?.verdict!==g.PASS&&i.push(`sellability verdict is ${n?.verdict||"UNKNOWN"}`):i.push("sell simulation is unavailable on this chain"),c.supports?.("quote")?o?.evidence!==w.LIVE&&i.push("no live quote was returned"):i.push("live quoting is unavailable on this chain"),c.supports?.("prepareUnsignedTx")||i.push("unsigned transaction preparation is unavailable on this chain"),a.tokenIn||i.push("tokenIn is required to prepare"),a.amountIn||i.push("amountIn is required to prepare"),a.recipient||i.push("recipient is required to prepare"),i}async function ut(e={},t={}){let r=Number(e.chainId??Hr);if(!Number.isInteger(r)||r<=0)throw new Error("evm-token-sniper: chainId must be a positive integer");let s=Q(e.tokenAddress||e.address||e.token,"tokenAddress"),n=e.tokenIn?Q(e.tokenIn,"tokenIn"):null,o=e.recipient?Q(e.recipient,"recipient"):null,a=e.amountIn==null?null:me(e.amountIn,"amountIn"),c=Wr(r,t.scanner),i=t.scanContractRisk||ct,[d,u,l]=await Promise.all([c.resolveToken(s),c.resolvePools(s),i({address:s,chainId:r},t.contractRiskOpts||t)]),p=await c.scoreRisk(s),f=null;c.supports?.("sellSimulation")&&a?f=await c.sellSimulation({token:s,amountIn:a,base:n||void 0}):c.supports?.("sellSimulation")&&(f=await c.sellSimulation({token:s,amountIn:"10000000000000000"}));let h=null;c.supports?.("quote")&&n&&a&&(h=await c.quote({tokenIn:n,tokenOut:s,amountIn:a}));let b={...e,tokenIn:n,amountIn:a,recipient:o},m=zr({token:d,pools:u,structuralRisk:l,scannerRisk:p,sellability:f,quote:h,args:b,scanner:c}),A=null,x=null,k=null;if(e.prepare===!0&&m.length===0){A=await c.prepareUnsignedTx({tokenIn:n,tokenOut:s,amountIn:a,recipient:o,slippageBps:e.slippageBps??50,fee:h?.fee});try{x=Vr({chainId:r,tokenAddress:s,tokenIn:n,amountIn:a,recipient:o,quote:h,topPool:u?.pools?.[0]||null,unsignedTx:A,args:e,opts:t})}catch(y){k=String(y?.message||y).slice(0,200)}}return{provider:"evm-token-sniper",execution:"armed-local",armed:!!x,signing:"local-signer",broadcasting:"local-signer",chainId:r,chain:{key:c.key,name:c.name,nativeCurrency:c.nativeCurrency},token:d,pools:u,topPool:u?.pools?.[0]||null,structuralRisk:l,scannerRisk:p,sellability:f,quote:h,blockedReasons:m,prepared:!!A,unsignedTx:A,localSignerEnvelope:x,localSignerBlockedReason:k,signed:x?"pending-local-signer":!1,broadcast:x?"pending-local-signer":!1}}import{homedir as be}from"node:os";import{join as ge}from"node:path";var lt=process.env.ORACLE_PUBLIC_DESKTOP==="1",Gr=lt?process.env.ORACLE_CONFIG_DIR||ge(be(),".config","oracle"):ge(be(),".config","oracle"),lo=lt?Gr:ge(be(),".config","mad-desk");var jr=4663,Kr="EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",Xr="Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";function we(e=process.env){return String((e||process.env).ORACLE_SNIPE_EXECUTE||"").trim()==="1"}function dt(e){return String(e||"").trim().replace(/^@/,"")}async function Yr({handle:e,limit:t=5,xurlFn:r=Ce}={},s={}){let n=dt(e);if(!n)throw new Error("twitter-ca-watch: handle required");let o=await r("xurl",{command:"search",query:`from:${n}`,limit:Math.min(20,Math.max(1,Number(t)||5))},s);return o?.ok?{ok:!0,tweets:ye(o.stdout),raw:o}:{ok:!1,error:o?.error||"xurl search failed",tweets:[]}}async function Qr(e,{chainId:t,amountIn:r,tokenIn:s,recipient:n,prepare:o},a){let c=await ut({chainId:t,tokenAddress:e,amountIn:r,tokenIn:s,recipient:n,prepare:o===!0},a),i=c.topPool||c.pools?.pools?.[0]||null;return{chainFamily:"evm",chainId:t,address:e,topPool:i,quoteAsset:c.pools?.quoteAsset||null,sellability:c.sellability||null,blockedReasons:c.blockedReasons||[],prepared:!!c.prepared,unsignedTx:c.unsignedTx||null,localSignerEnvelope:c.localSignerEnvelope||null,execution:!1,broadcast:!1}}async function Zr(e,t){let r=await Ve(e,{chainSlug:"solana",stables:[Kr,Xr]},t);return{chainFamily:"solana",chainId:"solana",address:e,topPool:r.topPool,pools:r.pools,prepared:!1,execution:!1,broadcast:!1,note:"Solana CA ranked on USD book. Prepare stays Jupiter/local-signer; this tick does not broadcast."}}async function Jr(e,t={},r={}){let s=Number(t.chainId??jr),n=[];for(let o of e.evm||[])n.push(await Qr(o,{...t,chainId:s},r));for(let o of e.solana||[])n.push(await Zr(o,r));return n}async function pt(e={},t={}){let r=dt(e.handle),s=e.seen instanceof Set?e.seen:new Set(e.seen||[]),n=await Yr({handle:r,limit:e.limit,xurlFn:t.xurlFn},t);if(!n.ok)return{ok:!1,handle:r,error:n.error,hits:[],seen:[...s]};let o=[];for(let c of n.tweets){let i=c.id||`${r}:${c.text.slice(0,80)}`;if(s.has(i))continue;let d=ve(c.text,{extras:c.urls||[]});if(!d.all.length){s.add(i);continue}let l=await(t.evaluateFn||Jr)(d,e,t);s.add(i),o.push({tweetId:c.id||null,handle:r,text:c.text,contracts:d,evaluations:l})}let a=e.automated!==!1;return{ok:!0,handle:r,source:"twitter-ca-watch",automated:a,card:!1,notify:!1,telegram:!1,execution:!1,broadcast:!1,snipeExecuteEnabled:we(t.env||process.env),hits:o,seen:[...s]}}var ft=`oracle snipe twitter <handle> [--chain 4663] [--json]
+  - `)}`);let n=e.capabilities||{},o=j.filter(c=>typeof n[c]=="function"),a={key:e.key,chainId:e.chainId,name:e.name,rpcEnv:[...e.rpcEnv],nativeCurrency:e.nativeCurrency?{...e.nativeCurrency}:null,wrappedNative:e.wrappedNative||null,explorer:e.explorer||null,venues:(e.venues||[]).map(c=>({...c})),warnings:s,capabilities(){return{chainId:e.chainId,key:e.key,supported:[...o],unsupported:j.filter(c=>!o.includes(c))}},supports(c){return o.includes(c)}};for(let c of j)o.includes(c)?a[c]=async(...i)=>n[c](...i,{scanner:a}):a[c]=async()=>{throw new Error(`${e.key} (chain ${e.chainId}) does not implement "${c}". Supported: ${o.join(", ")||"none"}. An unimplemented capability is absent, not assumed -- implement it or treat this chain as fail-closed for that operation.`)};return Object.freeze(a)}var Xe=new Map;function Ye(e){let t=Lr(e);return Xe.set(t.chainId,t),t}function Ze(e){return Xe.get(Number(e))||null}var le={getAmountsOut:"d06ca61f",swapExactTokensForTokens:"38ed1739",swapExactETHForTokens:"7ff36ab5"},T=e=>BigInt(e).toString(16).padStart(64,"0"),D=e=>e.slice(2).toLowerCase().padStart(64,"0");function Tr(e,t){return`0x${le.getAmountsOut}`+T(e)+T(64)+T(t.length)+t.map(D).join("")}function Rr(e){if(!e||e==="0x")return null;let t=e.slice(2);if(t.length<128)return null;let r=Number(BigInt(`0x${t.slice(64,128)}`));if(!Number.isFinite(r)||r<1||r>16)return null;let s=[];for(let n=0;n<r;n++){let o=128+n*64;if(t.length<o+64)return null;s.push(BigInt(`0x${t.slice(o,o+64)}`))}return s}function ue(e,t="router"){return(e?.venues||[]).find(s=>s.kind===t)?.address??null}var de=100;function Or(e,t){let r=Number(t);if(!Number.isFinite(r)||r<0)throw new Error("slippageBps must be a non-negative number");if(r>de)throw new Error(`slippageBps ${r} exceeds the ${de} bps ceiling. Block and requote or split the order -- do not widen the guard to force a fill.`);return BigInt(e)*BigInt(1e4-Math.floor(r))/10000n}function Qe(e){let{chainId:t,wrappedNative:r}=e;async function s(n,o,a,c){let i=await L(t,"eth_call",[{to:n,data:Tr(o,a)},"latest"],c);return Rr(i?.result??i)}return{async quote({tokenIn:n,tokenOut:o,amountIn:a,path:c},i={}){let d=ue(i.scanner);if(!d)return{chainId:t,evidence:w.UNAVAILABLE,reason:"no verified router configured for this chain; quoting stays fail-closed rather than guessing a venue address"};let u=c||[n,o];if(u.some(p=>!/^0x[0-9a-fA-F]{40}$/.test(p||"")))throw new Error("quote requires valid 20-byte addresses");let l=await s(d,a,u,i);return l?{chainId:t,router:d,path:u,amountIn:String(a),amountOut:l[l.length-1].toString(),hops:u.length-1,evidence:w.LIVE,note:"exact-input quote at current reserves; not a guaranteed fill"}:{chainId:t,router:d,path:u,evidence:w.UNKNOWN,reason:"router returned no amounts -- no pool for this path, or the call reverted"}},async sellSimulation({token:n,amountIn:o,base:a},c={}){let i=ue(c.scanner),d=a||r;if(d&&String(n).toLowerCase()===String(d).toLowerCase())return{chainId:t,token:n,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:"token is the base asset for this chain, so there is nothing to round-trip against. Sellability must be judged against a different quote asset."};if(!i||!d)return{chainId:t,token:n,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:i?"no wrappedNative configured for this chain, so no base asset to round-trip against":"no verified router configured for this chain"};let u=await s(i,o,[d,n],c);if(!u)return{chainId:t,token:n,verdict:g.FAIL,evidence:w.LIVE,leg:"buy",reason:"buy leg returned no amounts -- no route in"};let l=u[u.length-1];if(l===0n)return{chainId:t,token:n,verdict:g.FAIL,evidence:w.LIVE,leg:"buy",reason:"buy leg quotes zero output"};let p=await s(i,l,[n,d],c);if(!p)return{chainId:t,token:n,verdict:g.FAIL,evidence:w.LIVE,leg:"sell",bought:l.toString(),reason:"SELL LEG FAILED while the buy leg quoted fine. This is the honeypot signature: do not trade."};let f=p[p.length-1],h=Number(f*10000n/BigInt(o)),m=g.PASS,b="round trip completes with expected fee/impact loss";return h<5e3?(m=g.FAIL,b=`round trip returns only ${(h/100).toFixed(2)}% -- punitive tax or no real liquidity`):h<9e3&&(m=g.CAUTION,b=`round trip returns ${(h/100).toFixed(2)}% -- transfer tax or thin liquidity at this size`),{chainId:t,token:n,base:d,router:i,verdict:m,reason:b,amountIn:String(o),bought:l.toString(),returned:f.toString(),retentionBps:h,evidence:w.LIVE,note:"Quote-level round trip. It does not prove transfer hooks absent at execution time."}},async prepareUnsignedTx({tokenIn:n,tokenOut:o,amountIn:a,recipient:c,slippageBps:i=50,deadlineSeconds:d=900,path:u},l={}){let p=l.scanner,f=ue(p);if(!f)throw new Error(`chain ${t} has no verified router; preparing a swap stays fail-closed. Add a venue with recorded provenance first (see docs/adding-a-chain.md).`);if(!/^0x[0-9a-fA-F]{40}$/.test(c||""))throw new Error("prepareUnsignedTx requires a valid recipient address");let h=u||[n,o],m=await this.quote({tokenIn:n,tokenOut:o,amountIn:a,path:h},l);if(m.evidence!==w.LIVE)throw new Error(`cannot prepare without a live quote (${m.evidence}: ${m.reason??"no reason given"})`);let b=Or(m.amountOut,i);if(b<=0n)throw new Error("computed minOut is zero -- refusing to prepare");let A=BigInt(Math.floor(Date.now()/1e3)+Number(d)),x=r&&h[0].toLowerCase()===r.toLowerCase()&&l.useNative,k=x?`0x${le.swapExactETHForTokens}`+T(b)+T(128)+D(c)+T(A)+T(h.length)+h.map(D).join(""):`0x${le.swapExactTokensForTokens}`+T(a)+T(b)+T(160)+D(c)+T(A)+T(h.length)+h.map(D).join("");return{unsigned:!0,signedBy:"user-wallet",chainId:t,tx:{to:f,data:k,value:x?`0x${BigInt(a).toString(16)}`:"0x0"},guard:{quotedOut:m.amountOut,minOut:b.toString(),slippageBps:i,maxSlippageBps:de,deadline:A.toString()},requires:x?[]:[{step:"approve",token:h[0],spender:f,amount:String(a)}],note:"UNSIGNED. Re-verify the guard against a fresh quote immediately before signing -- a quote-time minimum is not a minimum at broadcast time."}}}}var qr=[100,500,3e3,1e4],Je={quoteExactInputSingle:"c6a5026a",exactInputSingle:"04e45aaf"},U=e=>BigInt(e).toString(16).padStart(64,"0"),M=e=>e.slice(2).toLowerCase().padStart(64,"0"),et=/^0x[0-9a-fA-F]{40}$/,fe=100;function Ur(e,t){let r=Number(t);if(!Number.isFinite(r)||r<0)throw new Error("slippageBps must be a non-negative number");if(r>fe)throw new Error(`slippageBps ${r} exceeds the ${fe} bps ceiling. Block and requote or split the order -- do not widen the guard to force a fill.`);return BigInt(e)*BigInt(1e4-Math.floor(r))/10000n}function pe(e,t){return(e?.venues||[]).find(r=>r.kind===t)?.address??null}function tt(e){let{chainId:t,wrappedNative:r}=e;async function s({quoter:o,tokenIn:a,tokenOut:c,amountIn:i,fee:d},u){let l=`0x${Je.quoteExactInputSingle}`+M(a)+M(c)+U(i)+U(d)+U(0),p=await L(t,"eth_call",[{to:o,data:l},"latest"],u).catch(()=>null),f=p?.result??p;if(!f||f==="0x"||f.length<66)return null;let h=BigInt(`0x${f.slice(2,66)}`);return h>0n?h:null}async function n({quoter:o,tokenIn:a,tokenOut:c,amountIn:i},d){let u=await Promise.all(qr.map(async p=>{let f=await s({quoter:o,tokenIn:a,tokenOut:c,amountIn:i,fee:p},d);return{fee:p,amountOut:f?f.toString():null,out:f}})),l=null;for(let p of u)p.out&&(!l||p.out>l.amountOut)&&(l={fee:p.fee,amountOut:p.out});return{best:l,tried:u.map(({fee:p,amountOut:f})=>({fee:p,amountOut:f}))}}return{async quote({tokenIn:o,tokenOut:a,amountIn:c},i={}){let d=pe(i.scanner,"quoter");if(!d)return{chainId:t,evidence:w.UNAVAILABLE,reason:"no verified quoter configured for this chain; quoting stays fail-closed rather than guessing a venue address"};for(let p of[o,a])if(!et.test(p||""))throw new Error("quote requires valid 20-byte addresses");let{best:u,tried:l}=await n({quoter:d,tokenIn:o,tokenOut:a,amountIn:c},i);return u?{chainId:t,venue:"uniswap-v3",quoter:d,tokenIn:o,tokenOut:a,amountIn:String(c),amountOut:u.amountOut.toString(),fee:u.fee,useNative:!!r&&String(o).toLowerCase()===String(r).toLowerCase(),triedFeeTiers:l,evidence:w.LIVE,note:"exact-input single-hop quote at current tick; not a guaranteed fill"}:{chainId:t,quoter:d,tokenIn:o,tokenOut:a,triedFeeTiers:l,evidence:w.UNKNOWN,reason:"no fee tier returned a quote -- no V3 pool for this pair, or no liquidity"}},async sellSimulation({token:o,amountIn:a,base:c},i={}){let d=pe(i.scanner,"quoter"),u=(e.stableQuoteAssets||[]).map(S=>String(S).toLowerCase()),l=null;!c&&typeof e.resolveQuoteAsset=="function"&&(l=await e.resolveQuoteAsset(o,i).catch(()=>null));let p=String(o).toLowerCase(),f=String(r||"").toLowerCase();if(f&&p===f)return{chainId:t,token:o,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:"token is the base asset for this chain, so there is nothing to round-trip against. Sellability must be judged against a different quote asset."};let h=c||l||(u[0]&&p!==u[0]?u[0]:null)||r;if(h&&p===String(h).toLowerCase())return{chainId:t,token:o,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:"token is the base asset for this chain, so there is nothing to round-trip against. Sellability must be judged against a different quote asset."};if(!d||!h)return{chainId:t,token:o,verdict:g.UNKNOWN,evidence:w.UNAVAILABLE,reason:d?"no wrappedNative configured, so there is no base asset to round-trip against":"no verified quoter configured for this chain"};let m=await n({quoter:d,tokenIn:h,tokenOut:o,amountIn:a},i);if(!m.best){let S=u.find(E=>E&&E!==String(h).toLowerCase()&&E!==String(o).toLowerCase());if(S){let E=await n({quoter:d,tokenIn:S,tokenOut:o,amountIn:a},i);if(E.best){let y=await n({quoter:d,tokenIn:o,tokenOut:S,amountIn:E.best.amountOut},i);if(y.best){let I=y.best.amountOut,_=Number(I*10000n/BigInt(a)),C=g.PASS,N="round trip vs dollar book completes with expected fee/impact loss";return _<5e3?(C=g.FAIL,N=`round trip vs dollar book returns only ${(_/100).toFixed(2)}% -- punitive tax or no real liquidity`):_<9e3&&(C=g.CAUTION,N=`round trip vs dollar book returns ${(_/100).toFixed(2)}% -- transfer tax or thin liquidity at this size`),{chainId:t,venue:"uniswap-v3",token:o,base:S,quoteAsset:S,verdict:C,reason:N,amountIn:String(a),bought:E.best.amountOut.toString(),returned:I.toString(),retentionBps:_,buyFee:E.best.fee,sellFee:y.best.fee,evidence:w.LIVE,note:"Quoted against the dollar book, not wrapped native. A missing WETH pool is not a honeypot."}}}}return{chainId:t,token:o,verdict:g.FAIL,evidence:w.LIVE,leg:"buy",reason:"no V3 pool priced the buy leg on any fee tier against wrapped native or the dollar book"}}let b=await n({quoter:d,tokenIn:o,tokenOut:h,amountIn:m.best.amountOut},i);if(!b.best){let S=u.find(E=>E&&E!==String(h).toLowerCase()&&E!==String(o).toLowerCase());if(S){let E=await n({quoter:d,tokenIn:S,tokenOut:o,amountIn:a},i),y=E.best?await n({quoter:d,tokenIn:o,tokenOut:S,amountIn:E.best.amountOut},i):{best:null};if(E.best&&y.best){let I=y.best.amountOut,_=Number(I*10000n/BigInt(a)),C=g.PASS,N="round trip vs dollar book completes; missing WETH sell pool is not a honeypot";return _<5e3?(C=g.FAIL,N=`dollar-book round trip returns only ${(_/100).toFixed(2)}%`):_<9e3&&(C=g.CAUTION,N=`dollar-book round trip returns ${(_/100).toFixed(2)}%`),{chainId:t,venue:"uniswap-v3",token:o,base:S,quoteAsset:S,verdict:C,reason:N,amountIn:String(a),bought:E.best.amountOut.toString(),returned:I.toString(),retentionBps:_,buyFee:E.best.fee,sellFee:y.best.fee,evidence:w.LIVE,note:"Sell vs wrapped native failed; dollar book succeeded. Not labelled honeypot."}}}return{chainId:t,token:o,verdict:g.FAIL,evidence:w.LIVE,leg:"sell",bought:m.best.amountOut.toString(),reason:"SELL LEG FAILED against wrapped native and the dollar book. This is the honeypot signature: do not trade."}}let A=b.best.amountOut,x=Number(A*10000n/BigInt(a)),k=g.PASS,v="round trip completes with expected fee/impact loss";return x<5e3?(k=g.FAIL,v=`round trip returns only ${(x/100).toFixed(2)}% -- punitive tax or no real liquidity`):x<9e3&&(k=g.CAUTION,v=`round trip returns ${(x/100).toFixed(2)}% -- transfer tax or thin liquidity at this size`),{chainId:t,venue:"uniswap-v3",token:o,base:h,verdict:k,reason:v,amountIn:String(a),bought:m.best.amountOut.toString(),returned:A.toString(),retentionBps:x,buyFee:m.best.fee,sellFee:b.best.fee,evidence:w.LIVE,note:"Quote-level round trip. It does not prove transfer hooks absent at execution time."}},async prepareUnsignedTx({tokenIn:o,tokenOut:a,amountIn:c,recipient:i,slippageBps:d=50,fee:u},l={}){let p=pe(l.scanner,"router");if(!p)throw new Error(`chain ${t} has no verified V3 router; preparing a swap stays fail-closed. Add a venue with recorded provenance first (see docs/adding-a-chain.md).`);if(!et.test(i||""))throw new Error("prepareUnsignedTx requires a valid recipient address");let f=await this.quote({tokenIn:o,tokenOut:a,amountIn:c},l);if(f.evidence!==w.LIVE)throw new Error(`cannot prepare without a live quote (${f.evidence}: ${f.reason??"no reason given"})`);let h=u??f.fee,m=Ur(f.amountOut,d);if(m<=0n)throw new Error("computed minOut is zero -- refusing to prepare");let b=!!(l.useNative||f.useNative)&&r&&String(o).toLowerCase()===String(r).toLowerCase(),A=`0x${Je.exactInputSingle}`+M(o)+M(a)+U(h)+M(i)+U(c)+U(m)+U(0);return{unsigned:!0,signedBy:"user-wallet",chainId:t,venue:"uniswap-v3",tx:{to:p,data:A,value:b?String(c):"0x0"},guard:{quotedOut:f.amountOut,minOut:m.toString(),slippageBps:d,maxSlippageBps:fe,fee:h},requires:b?[]:[{step:"approve",token:o,spender:p,amount:String(c)}],note:"UNSIGNED. Re-verify the guard against a fresh quote immediately before signing -- a quote-time minimum is not a minimum at broadcast time."}}}}var K={decimals:"0x313ce567",symbol:"0x95d89b41",name:"0x06fdde03",totalSupply:"0x18160ddd",owner:"0x8da5cb5b"};function rt(e){if(!e||e==="0x")return null;try{return BigInt(e)}catch{return null}}function nt(e){if(!e||e==="0x")return null;let t=e.slice(2);if(t.length>=128){let s=Number(BigInt(`0x${t.slice(64,128)}`));if(s>0&&s<=256&&t.length>=128+s*2){let n=t.slice(128,128+s*2),o=Buffer.from(n,"hex").toString("utf8").replace(/\0+$/,"");if(o)return o}}return Buffer.from(t.slice(0,64),"hex").toString("utf8").replace(/\0+$/,"")||null}function Pr(e){let{chainId:t}=e;async function r(s,n,o){return L(t,"eth_call",[{to:s,data:n},"latest"],o)}return{async blockNumber(s={}){let n=await Ve(t,s);return{chainId:t,blockNumber:n?.blockNumber??n,evidence:w.LIVE}},async nativeBalance(s,n={}){let o=await We(t,s,n);return{chainId:t,address:s,wei:o?.wei??o?.balance??null,symbol:e.nativeCurrency?.symbol??null,decimals:e.nativeCurrency?.decimals??18,evidence:w.LIVE}},async tokenBalance({token:s,owner:n},o={}){let a=await ze({chainId:t,token:s,owner:n},o);return{chainId:t,token:s,owner:n,raw:a?.balance??a,evidence:w.LIVE}},async resolveToken(s,n={}){if(!/^0x[0-9a-fA-F]{40}$/.test(s||""))return{chainId:t,token:s,evidence:w.UNKNOWN,error:"resolveToken needs a 20-byte address; symbol lookup is a market-data concern"};let[o,a,c,i]=await Promise.all([r(s,K.decimals,n).catch(()=>null),r(s,K.symbol,n).catch(()=>null),r(s,K.name,n).catch(()=>null),r(s,K.totalSupply,n).catch(()=>null)]),d=rt(o?.result??o),u=d!==null||a?.result||c?.result;return{chainId:t,address:s,decimals:d===null?null:Number(d),symbol:nt(a?.result??a),name:nt(c?.result??c),totalSupply:(rt(i?.result??i)??null)?.toString()??null,evidence:u?w.LIVE:w.UNKNOWN,warning:u?void 0:"no ERC-20 metadata returned -- may not be a token contract"}},async resolvePools(s,n={}){let o=e.dexscreenerSlug;if(!o)return{chainId:t,token:s,pools:[],evidence:w.UNAVAILABLE,reason:"no dexscreenerSlug configured for this chain; pool discovery is unavailable rather than guessed"};let a=await ce(s,n).catch(()=>null),i=(a?.pairs||a?.data?.pairs||[]).filter(u=>String(u.chainId).toLowerCase()===String(o).toLowerCase()).map(u=>({pair:u.pairAddress,dex:u.dexId,base:u.baseToken?.address,quote:u.quoteToken?.address,liquidityUsd:u.liquidity?.usd??null,priceUsd:u.priceUsd??null,volume24hUsd:u.volume?.h24??null,createdAt:u.pairCreatedAt??null})).sort((u,l)=>(l.liquidityUsd??0)-(u.liquidityUsd??0)),d=G(s,i,{stables:e.stableQuoteAssets||[],wrappedNative:e.wrappedNative});return{chainId:t,token:s,pools:d,topPool:d[0]||null,quoteAsset:je(s,d),evidence:d.length?w.LIVE:w.UNKNOWN}},async scanBlocks({fromBlock:s,toBlock:n,address:o,topics:a,chunkSize:c=2e3}={},i={}){if(!Number.isInteger(s)||!Number.isInteger(n))throw new Error("scanBlocks requires integer fromBlock and toBlock");if(n<s)throw new Error("toBlock must be >= fromBlock");let d=[],u=[];for(let p=s;p<=n;p+=c){let f=Math.min(p+c-1,n);u.push([p,f])}let l=await Pe(u,4,async([p,f])=>{let h={fromBlock:`0x${p.toString(16)}`,toBlock:`0x${f.toString(16)}`};o&&(h.address=o),a&&(h.topics=a);let m=await L(t,"eth_getLogs",[h],i).catch(b=>({error:String(b?.message||b)}));return{start:p,end:f,res:m}});for(let{start:p,end:f,res:h}of l){if(h?.error)return{chainId:t,fromBlock:s,toBlock:n,logs:d,complete:!1,failedAt:[p,f],error:h.error,evidence:w.UNKNOWN};for(let m of h?.result??h??[])d.push(m)}return{chainId:t,fromBlock:s,toBlock:n,logs:d,complete:!0,chunks:u.length,evidence:w.LIVE}},async scoreRisk(s,n={}){let o=[],a=g.PASS,c=u=>{let l={[g.PASS]:0,[g.CAUTION]:1,[g.UNKNOWN]:2,[g.FAIL]:3};l[u]>l[a]&&(a=u)},[i,d]=await Promise.all([this.resolveToken(s,n),this.resolvePools(s,n)]);if(i.evidence!==w.LIVE?(o.push({check:"erc20-metadata",result:g.UNKNOWN,detail:i.warning}),c(g.UNKNOWN)):o.push({check:"erc20-metadata",result:g.PASS,detail:`${i.symbol} / ${i.decimals}d`}),d.evidence===w.UNAVAILABLE)o.push({check:"liquidity",result:g.UNKNOWN,detail:d.reason}),c(g.UNKNOWN);else if(!d.pools.length)o.push({check:"liquidity",result:g.FAIL,detail:"no pool with liquidity found"}),c(g.FAIL);else{let u=d.pools[0],l=u.liquidityUsd??0;l<5e3?(o.push({check:"liquidity",result:g.CAUTION,detail:`top pool only $${l}`}),c(g.CAUTION)):o.push({check:"liquidity",result:g.PASS,detail:`$${l} on ${u.dex}`}),u.createdAt&&Date.now()-u.createdAt<24*3600*1e3&&(o.push({check:"age",result:g.CAUTION,detail:"pool under 24h old"}),c(g.CAUTION))}if(typeof this.sellSimulation=="function"){let u=await this.sellSimulation({token:s,amountIn:(10n**16n).toString()},n).catch(l=>({verdict:g.UNKNOWN,reason:String(l?.message||l)}));o.push({check:"sellability",result:u.verdict,detail:u.retentionBps!=null?`round trip returns ${(u.retentionBps/100).toFixed(2)}% -- ${u.reason}`:u.reason}),c(u.verdict)}else o.push({check:"sellability",result:g.UNKNOWN,detail:"no verified router on this chain, so a round-trip sell simulation cannot run. Treat as unproven -- a buy path is not an exit path."}),c(g.UNKNOWN);return{chainId:t,token:s,verdict:a,checks:o,note:"Structural checks only. UNKNOWN is not PASS. A token is not tradeable until a sell simulation succeeds."}}}}function ot(e){let r={...Pr(e)},s=new Set((e.venues||[]).map(o=>o.kind));e.venueKind==="uniswap-v3"&&s.has("quoter")&&s.has("router")?Object.assign(r,tt({chainId:e.chainId,wrappedNative:e.wrappedNative,stableQuoteAssets:e.stableQuoteAssets||[],resolveQuoteAsset:async(o,a)=>(await r.resolvePools(o,a)).quoteAsset||null})):e.venueKind==="uniswap-v2"&&s.has("router")&&Object.assign(r,Qe({chainId:e.chainId,wrappedNative:e.wrappedNative}));let n={};for(let[o,a]of Object.entries(r))n[o]=a.bind(r);return{key:e.key,chainId:e.chainId,name:e.name,rpcEnv:e.rpcEnv,nativeCurrency:e.nativeCurrency,explorer:e.explorer,venues:e.venues||[],capabilities:n}}var Br=Object.freeze([{key:"ethereum",chainId:1,name:"Ethereum",rpcEnv:["ETH_RPC_URL","ETHEREUM_RPC_URL","MAINNET_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://etherscan.io",dexscreenerSlug:"ethereum",venueKind:"uniswap-v3",wrappedNative:"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",stableQuoteAssets:["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48","0xdAC17F958D2ee523a2206206994597C13D831ec7"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDC fee 500 quoted 1908.71 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:1}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:1}}]},{key:"optimism",chainId:10,name:"OP Mainnet",rpcEnv:["OPTIMISM_RPC_URL","OP_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://optimistic.etherscan.io",dexscreenerSlug:"optimism",venueKind:"uniswap-v3",wrappedNative:"0x4200000000000000000000000000000000000006",stableQuoteAssets:["0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85","0x94b008aA00579c1307B0EF2c499aD98a8ce58e58"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDC fee 500 quoted 1905.23 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:10}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:10}}]},{key:"bsc",chainId:56,name:"BNB Smart Chain",rpcEnv:["BSC_RPC_URL","BNB_RPC_URL"],nativeCurrency:{symbol:"BNB",decimals:18},explorer:"https://bscscan.com",dexscreenerSlug:"bsc",venueKind:"uniswap-v3",wrappedNative:"0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c",stableQuoteAssets:["0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d","0x55d398326f99059fF775485246999027B3197955"],venues:[{kind:"quoter",address:"0x78D78E420Da98ad378D7799bE8f4AF69033EB077",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WBNB->USDC fee 500 quoted 413.86 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:56}},{kind:"router",address:"0xB971eF87ede563556b2ED4b1C0b0019111Dd85d2",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:56}}]},{key:"polygon",chainId:137,name:"Polygon",rpcEnv:["POLYGON_RPC_URL","POLYGON_RPC"],nativeCurrency:{symbol:"POL",decimals:18},explorer:"https://polygonscan.com",dexscreenerSlug:"polygon",venueKind:"uniswap-v3",wrappedNative:"0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270",stableQuoteAssets:["0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359","0xc2132D05D31c914a87C6611C10748AEb04B58e8F"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WMATIC->USDC fee 500 quoted 0.0720 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:137}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:137}}]},{key:"stable",chainId:988,name:"Stable Mainnet",rpcEnv:["STABLE_RPC_URL","STABLE_RPC"],nativeCurrency:{symbol:"USDT0",decimals:18},venueKind:"uniswap-v3",wrappedNative:"0x5d442b349590a6048Eb2dC0eC346cAA5F47A9ab5",venues:[{kind:"quoter",address:"0xb070179E7032CdA868b53e6C1742F80c9e940d1A",label:"Uniswap V3 QuoterV2 (canonical)",verified:{method:"Stable is on the OFFICIAL Uniswap v3 Deployments List (governance-recognised 2026-05-12, UAC process completed 2026-04, deployed by Protofire), so this is a canonical deployment rather than a fork. eth_getCode returned 8273 bytes, the same size as the canonical quoter on the seven already-verified chains. Functional probe on a live pool (TOAST -> USDT0, fee 10000): 100 in -> 0.000003, 1000 -> 0.000031, 10000 -> 0.000319 USDT0. Output scales monotonically with input, which is a working quoter answering, not a revert. Two of three sampled pools carry non-zero liquidity. NOTE: the pools discovered so far are thin, so real routing size is limited -- the venue is proved, deep liquidity is not.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:988}},{kind:"router",address:"0x32eaf9B5d5F2CD7361c5012890C943D7de84C22a",label:"Uniswap SwapRouter02 (canonical)",verified:{method:"eth_getCode returned 24497 bytes. Cross-checked on-chain rather than trusted from docs: router.factory() returns 0x88f0a512ef09175d456bc9547f914f48c013e4aa, the same v3 core factory that created the pools quoted above, and router.WETH9() returns the wrappedNative recorded on this chain entry. Address published in the Stable docs DEX reference and the Uniswap deployments list.",source:"docs.stable.xyz/en/reference/dexes + on-chain factory()/WETH9() round-trip",date:"2026-08-05",chainId:988}}]},{key:"hyperevm",chainId:999,name:"HyperEVM",rpcEnv:["HYPEREVM_RPC_URL","HYPER_EVM_RPC"],nativeCurrency:{symbol:"HYPE",decimals:18},dexscreenerSlug:"hyperevm",venueKind:"uniswap-v3",wrappedNative:"0x5555555555555555555555555555555555555555",venues:[{kind:"quoter",address:"0x03A918028f22D9E1473B7959C927AD7425A45C7C",label:"HyperSwap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle(1 WHYPE -> USDT0) returned live output on all four fee tiers (100: 57.3385, 500: 57.4187, 3000: 57.3237, 10000: 56.1963 USDT0). Decimals read on-chain: WHYPE 18, USDT0 6. Best tier checked against an INDEPENDENT control the same minute -- Hyperliquid allMids put HYPE at 57.3205, so the pool is 0.171% from the perp mid, which is the right shape for fee plus impact rather than a wrong contract or a decimals bug.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:999}},{kind:"router",address:"0x4E2960a8cd19B467b82d26D83fAcb0fAE26b094D",label:"HyperSwap V3 SwapRouter",verified:{method:"eth_getCode returned 12070 bytes, and it is the router paired with the quoter proved above -- the same pair already shipped in UNI_V3_VENUES[999].hyperswap, which is the map the quote/prepare path actually routes through.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:999}}]},{key:"abstract",chainId:2741,name:"Abstract",rpcEnv:["ABSTRACT_RPC_URL","ABS_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},venueKind:"uniswap-v3",wrappedNative:"0x3439153EB7AF838Ad19d56E1571FBD09333C2809",venues:[{kind:"quoter",address:"0x728BD3eC25D5EDBafebB84F3d67367Cd9EBC7693",label:"Uniswap V3 QuoterV2 (Abstract deployment)",verified:{method:"Abstract is a ZK-stack chain, so CREATE2 addresses differ and the canonical Uniswap addresses are NOT valid here -- probing them returns codesize 0, which is what previously made this chain look like it had no V3 at all. Found the real deployment from live traffic instead: scanned recent Swap(...) logs, took the busiest pool, read pool.factory() = 0xa1160e73b63f322ae88cc2d8e700833e71d0b2a1, then enumerated that factory's deployer (0xf3d63166F0Ca56C3c1A3508FcE03Ff0Cf3Fb691e) and probed each of its 56 contracts with a real quoteExactInputSingle call. Exactly one answered: 1 WETH -> 1846.475731 USDC.e at fee 500. Independent sanity check: the pool's own slot0() spot price is 1873.11 USDC.e per WETH, so the quoter sits ~1.4% below spot, the right shape for fee plus price impact on this size.",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-08-05",chainId:2741}},{kind:"router",address:"0x7712FA47387542819d4E35A23f8116C90C18767C",label:"Uniswap SwapRouter02 (Abstract deployment)",verified:{method:"eth_getCode returned 167392 bytes and the runtime contains the exactInputSingle selector. router.factory() matches the factory proved above and router.WETH9() matches the wrappedNative on this entry. Chosen over its byte-identical twin (0xfD6257F4...) because this is the address real users actually route through: it appeared as tx.to on live swaps against the WETH/USDC.e pool.",source:"on-chain factory()/WETH9() round-trip + live swap tx.to sampling",date:"2026-08-05",chainId:2741}}]},{key:"robinhood",chainId:4663,name:"Robinhood Chain",rpcEnv:["RH_CHAIN_RPC","ROBINHOOD_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},dexscreenerSlug:"robinhood",venueKind:"uniswap-v3",wrappedNative:"0x0bd7d308f8e1639fab988df18a8011f41eacad73",stableQuoteAssets:["0x5fc5360d0400a0fd4f2af552add042d716f1d168"],venues:[{kind:"quoter",address:"0x33e885ed0ec9bf04ecfb19341582aadcb4c8a9e7",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDG fee 100 quoted 1866.58 USDG, and USDG->CASHCAT fee 10000 quoted a live amount). A contract that correctly prices known pairs IS a working V3 quoter",source:"live eth_call against rpc.mainnet.chain.robinhood.com",date:"2026-07-31",chainId:4663}},{kind:"router",address:"0xcaf681a66d020601342297493863e78c959e5cb2",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode (24497 bytes) on this chain and the paired quoter at the same deployment passed a live functional quote",source:"live eth_getCode against rpc.mainnet.chain.robinhood.com",date:"2026-07-31",chainId:4663}},{kind:"factory",address:"0x1f7d7550b1b028f7571e69a784071f0205fd2efa",label:"Uniswap V3 Factory",verified:{method:"eth_getCode returned real bytecode (24535 bytes) and a PoolCreated log scan over this factory returned 76 pools in ~9000 recent blocks",source:"live eth_getLogs against rpc.mainnet.chain.robinhood.com",date:"2026-07-31",chainId:4663}}]},{key:"base",chainId:8453,name:"Base",rpcEnv:["BASE_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://basescan.org",dexscreenerSlug:"base",venueKind:"uniswap-v3",wrappedNative:"0x4200000000000000000000000000000000000006",stableQuoteAssets:["0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"],venues:[{kind:"quoter",address:"0x3d4e44Eb1374240CE5F1B871ab261CD16335B76a",label:"Uniswap V3 QuoterV2 (Base)",verified:{method:"functional probe: quoteExactInputSingle returned WETH->USDC at fee 500 = 1908.44 USDC, a live sane price. The canonical mainnet quoter address also has bytecode on Base but does NOT price this pair, which is exactly the false positive a codesize-only check accepts",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:8453}},{kind:"router",address:"0x2626664c2603336E57B271c5C0b26F421741e481",label:"Uniswap V3 SwapRouter02 (Base)",verified:{method:"eth_getCode returned real bytecode and the paired Base quoter passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:8453}},{kind:"router-v2",address:"0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24",label:"Uniswap V2 Router02 (Base)",verified:{method:"eth_getCode returned 17891 bytes; live getAmountsOut on WETH->USDC round-tripped to 98.75% (2x0.30% fee + impact)",source:"https://docs.uniswap.org/contracts/v2/reference/smart-contracts/v2-deployments",date:"2026-07-30",chainId:8453}}]},{key:"arbitrum",chainId:42161,name:"Arbitrum One",rpcEnv:["ARBITRUM_RPC_URL","ARB_RPC_URL"],nativeCurrency:{symbol:"ETH",decimals:18},explorer:"https://arbiscan.io",dexscreenerSlug:"arbitrum",venueKind:"uniswap-v3",wrappedNative:"0x82aF49447D8a07e3bd95BD0d56f35241523fBab1",stableQuoteAssets:["0xaf88d065e77c8cC2239327C5EDb3A432268e5831","0xFd086bC7CD5C481DCC9C85ebE478A1C0b69FCbb9"],venues:[{kind:"quoter",address:"0x61fFE014bA17989E743c5F6cB21bF9697530B21e",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WETH->USDC fee 500 quoted 1908.72 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:42161}},{kind:"router",address:"0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:42161}}]},{key:"avalanche",chainId:43114,name:"Avalanche C-Chain",rpcEnv:["AVALANCHE_RPC_URL","AVAX_RPC_URL"],nativeCurrency:{symbol:"AVAX",decimals:18},explorer:"https://snowtrace.io",dexscreenerSlug:"avalanche",venueKind:"uniswap-v3",wrappedNative:"0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7",stableQuoteAssets:["0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E"],venues:[{kind:"quoter",address:"0xbe0F5544EC67e9B3b2D979aaA43f18Fd87E6257F",label:"Uniswap V3 QuoterV2",verified:{method:"functional probe, not a codesize check: quoteExactInputSingle returned a live sane price (WAVAX->USDC fee 500 quoted 6.48 USDC). A contract that correctly prices a known pair IS a working V3 quoter",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:43114}},{kind:"router",address:"0xbb00FF08d01D300023C629E8fFfFcb65A5a578cE",label:"Uniswap V3 SwapRouter02",verified:{method:"eth_getCode returned real bytecode on this chain and the paired quoter at the same deployment passed a live functional quote",source:"scripts/verify-v3-venues.mjs (re-runnable)",date:"2026-07-30",chainId:43114}}]}]);function st(){return Br.map(e=>Ye(ot(e)))}import{createHash as Mr,createHmac as ct,timingSafeEqual as Hr}from"node:crypto";import{readFileSync as $r}from"node:fs";import{homedir as Fr}from"node:os";import{join as X}from"node:path";function Dr(){if(process.env.ORACLE_TEST_ISOLATE_SECRETS==="1"){let r=(process.env.ORACLE_EXEC_ENV_FILE||"").trim();return r?[r]:[]}let e=(process.env.ORACLE_EXEC_ENV_FILE||process.env.MAD_EXEC_ENV_FILE||"").trim(),t=Fr();if(process.env.ORACLE_PUBLIC_DESKTOP==="1"){let r=(process.env.ORACLE_CONFIG_DIR||X(t,".config","oracle")).trim();return[e,X(r,"exec.env")].filter(Boolean)}return[e,X(t,".config","oracle","exec.env"),X(t,".config","mad-desk","exec.env")].filter(Boolean)}function it(e,t,r){let s=e??process.env[t]??process.env[r];if(!String(s||"").trim())for(let n of Dr())try{let o=$r(n,"utf8"),a=o.match(new RegExp(`^${t}=(.*)$`,"m"))||o.match(new RegExp(`^${r}=(.*)$`,"m"));if(a&&(s=a[1].trim(),s))break}catch{}if(!String(s||"").trim())throw new Error(`${t} required for attestation. Set it in the environment, or place ${t}=<value> in ~/.config/oracle/exec.env`);return s}var Y=100,at=2e4;function Z(e){return Array.isArray(e)?`[${e.map(Z).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${Z(e[t])}`).join(",")}}`:JSON.stringify(e??null)}function ut(e,{required:t=!1}={}){try{return it(e,"ORACLE_ROUTE_ATTESTATION_SECRET","MAD_ROUTE_ATTESTATION_SECRET")}catch(r){if(t)throw r;return null}}function me(e){let{signature:t,...r}=e;return r}function lt(e,{secret:t}={}){let r=ut(t);return r?{...e,signature:ct("sha256",r).update(Z(me(e))).digest("hex")}:e}function Vr(e){let t=String(e||"").toLowerCase();if(!/^0x[0-9a-f]+$/.test(t)||t.length<10||t.length%2!==0)throw new Error("auto-slippage calldata must be even-length hex with a selector");return Mr("sha256").update(Buffer.from(t.slice(2),"hex")).digest("hex")}function dt(e,{chainId:t,venue:r,data:s,secret:n}={}){if(!e||e.mode!=="auto")throw new Error("bounded auto-slippage guard required");if(Number(e.chainId)!==Number(t))throw new Error("auto-slippage guard chain mismatch");if(String(e.venue).toLowerCase()!==String(r||"").toLowerCase())throw new Error("auto-slippage guard venue mismatch");let o=ut(n);if(o){let f=ct("sha256",o).update(Z(me(e))).digest("hex");if(!Wr(e.signature,f))throw new Error("auto-slippage guard signature mismatch \u2014 refusing to bind a guard this Oracle did not issue")}let a=Number(e.selectedBps),c=Number(e.capBps);if(!Number.isInteger(a)||a<0||a>Y||!Number.isInteger(c)||c<0||c>Y||a>c)throw new Error("auto-slippage guard bounds are invalid");let i=BigInt(e.quoteAmountOut??0),d=BigInt(e.minAmountOut??0);if(i<=0n||d<=0n)throw new Error("auto-slippage guard amounts must be positive");let u=i*BigInt(1e4-a),l=u/10000n;if(u%10000n!==0n&&(l+=1n),d<l)throw new Error("auto-slippage guard is under-protected relative to its quote");let p=jr(s);if(p!=null&&p!==d)throw new Error(`auto-slippage: calldata encodes floor ${p}, not the guard floor ${d} \u2014 refusing to bind`);return lt({...me(e),calldataHash:Vr(s)},{secret:n})}function Wr(e,t){let r=Buffer.from(String(e??""),"utf8"),s=Buffer.from(String(t??""),"utf8");return r.length!==s.length||r.length===0?!1:Hr(r,s)}function he(e,t=0){let r=Number(e);return Number.isFinite(r)?r:t}function zr(e){let t=e==null?Y:Number(e);if(!Number.isInteger(t)||t<0)throw new Error("auto-slippage cap must be a non-negative integer bps value");return Math.min(t,Y)}function Gr({liquidityUsd:e,priceChange5m:t=0,quoteAgeMs:r=0,crossChain:s=!1,requestedCapBps:n}={}){let o=he(e,0),a=o>0?o>=25e4?5:o>=1e5?10:o>=5e4?20:o>=1e4?40:70:s?30:10,c=Math.min(60,Math.abs(he(t,0))*2),i=Math.min(40,Math.floor(Math.max(0,he(r,0))/5e3)*5),d=Math.max(25,Math.ceil(20+a+c+i)),u=zr(n);return{mode:"auto",requiredBps:d,selectedBps:Math.min(d,u),capBps:u,executable:d<=u}}function pt({chainId:e,venue:t,quoteAmountOut:r,liquidityUsd:s,priceChange5m:n=0,quoteAgeMs:o=0,crossChain:a=!1,requestedCapBps:c,quotedAtMs:i=Date.now(),ttlMs:d=at,secret:u}={}){let l=BigInt(r??0);if(l<=0n)throw new Error("auto-slippage guard requires positive quoteAmountOut");let p=Gr({liquidityUsd:s,priceChange5m:n,quoteAgeMs:o,crossChain:a,requestedCapBps:c});if(!p.executable)throw new Error(`auto-slippage requires ${p.requiredBps} bps above hard/requested cap ${p.capBps}; route blocked`);let f=Number(i);if(!Number.isFinite(f))throw new Error("auto-slippage: quotedAtMs must be a finite number");let h=Math.min(3e4,Math.max(1e3,Number(d)||at)),m=l*BigInt(1e4-p.selectedBps),b=m/10000n;if(m%10000n!==0n&&(b+=1n),b>l&&(b=l),l>0n&&b<=0n)throw new Error(`auto-slippage: quote ${l} is too small to express a ${p.selectedBps} bps floor without rounding to zero`);let A=Number((l-b)*10000n/(l===0n?1n:l));if(A>p.capBps)throw new Error(`auto-slippage: realised floor implies ${A} bps, above cap ${p.capBps} \u2014 refusing to issue a guard weaker than advertised`);return lt({mode:"auto",chainId:Number(e),venue:String(t||"unknown"),quoteAmountOut:l.toString(),minAmountOut:b.toString(),requiredBps:p.requiredBps,selectedBps:p.selectedBps,capBps:p.capBps,quotedAtMs:f,expiresAtMs:f+h},{secret:u})}function jr(e){let t=String(e||"");if(!/^0x[0-9a-fA-F]+$/.test(t)||t.length<10||t.length%2!==0)return null;let r=t.slice(0,10).toLowerCase(),s=[];for(let o=10;o+64<=t.length;o+=64)s.push(t.slice(o,o+64));let n=o=>s[o]==null?null:BigInt("0x"+s[o]);switch(r){case"0x414bf389":return n(6);case"0x04e45aaf":return n(5);case"0xc04b8d59":{let o=n(0);if(o==null)return null;let a=Number(o)/32;return!Number.isInteger(a)||a<0?null:n(a+4)}case"0xb858183f":{let o=n(0);if(o==null)return null;let a=Number(o)/32;return!Number.isInteger(a)||a<0?null:n(a+3)}case"0xa026383e":return n(6);case"0x38ed1739":case"0x5c11d795":return n(1);case"0x7ff36ab5":case"0xb6f9de95":return n(0);case"0x18cbafe5":case"0x791ac947":return n(1);default:return null}}var Kr=Object.freeze({"8da5cb5b":{name:"owner()",weight:"low",note:"contract has an owner"},f2fde38b:{name:"transferOwnership(address)",weight:"low",note:"ownership transferable"},"40c10f19":{name:"mint(address,uint256)",weight:"high",note:"owner can mint new supply"},a0712d68:{name:"mint(uint256)",weight:"high",note:"owner can mint new supply"},f9f92be4:{name:"blacklist(address)",weight:"high",note:"addresses can be blocked from selling"},e4997dc5:{name:"removeBlackList(address)",weight:"high",note:"blacklist machinery present"},"8456cb59":{name:"pause()",weight:"high",note:"transfers can be frozen"},"3f4ba83a":{name:"unpause()",weight:"high",note:"pausable transfers"},c0246668:{name:"setFee/excludeFromFee",weight:"high",note:"transfer fees can be changed"},"3659cfe6":{name:"upgradeTo(address)",weight:"high",note:"logic can be replaced entirely"},"4f1ef286":{name:"upgradeToAndCall(address,bytes)",weight:"high",note:"logic can be replaced entirely"}}),Xr=Object.freeze([{label:"eip1967",slot:"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc"},{label:"zeppelinos",slot:"0x7050c9e0f4ca769c69bd3a8ef740bc37934f8e2c036e5a723fd8ee048ed3f8c3"},{label:"eip1822",slot:"0xc5f16f0fcc639fa48a6947836d9850f504798523bf8c9a3a87d5876cf622bcf7"}]),Yr=`0x${"0".repeat(64)}`;function Zr(e){return!e||e==="0x"||e===Yr}async function ft(e={},t={}){let r=t.rpcCall||L,s=String(e.address||"").trim().toLowerCase(),n=Number(e.chainId);if(!/^0x[a-f0-9]{40}$/.test(s))return{status:"error",error:"address must be a 0x-prefixed EVM address",risk:"unknown-risk",findings:[],notes:[]};if(!Number.isInteger(n))return{status:"error",error:"chainId is required",risk:"unknown-risk",findings:[],notes:[]};let o;try{o=await r(n,"eth_getCode",[s,"latest"],t)}catch(m){return{address:s,chainId:n,status:"unavailable",error:m?.message||"eth_getCode failed",risk:"unknown-risk",findings:[],isProxy:!1,codeSize:0,notes:["could not read contract code; treat as unverified"]}}if(!o||o==="0x")return{address:s,chainId:n,status:"ok",risk:"high",findings:[{selector:"-",name:"no-code",weight:"high",note:"no contract deployed at this address"}],isProxy:!1,codeSize:0,notes:["nothing is deployed here \u2014 an approval or transfer to this address is unrecoverable"]};let a=[],c=[],i=o.slice(2).toLowerCase();for(let[m,b]of Object.entries(Kr))i.includes(m)&&c.push({selector:`0x${m}`,...b});let d=!1,u=null,l=null,p=await Promise.all(Xr.map(async({label:m,slot:b})=>{try{let A=await r(n,"eth_getStorageAt",[s,b,"latest"],t);return{label:m,word:A,error:null}}catch{return{label:m,word:null,error:`proxy slot (${m}) unreadable; proxy status uncertain`}}}));for(let m of p)m.error&&a.push(m.error),!d&&m.word&&!Zr(m.word)&&(d=!0,u=m.label,l=`0x${String(m.word).slice(-40)}`);d&&(c.push({selector:u,name:"proxy",weight:"high",note:"implementation is upgradeable \u2014 current behaviour is not a guarantee"}),a.push(`bytecode scan covers the proxy (${u}), not the implementation ${l} it delegates to`));let h=c.filter(m=>m.weight==="high").length>0?"high":c.length>0?"elevated":"unknown-risk";return h==="unknown-risk"&&a.push("no owner-power selectors found; this is weak evidence, not a safety guarantee"),{address:s,chainId:n,status:"ok",risk:h,findings:c,isProxy:d,proxyStandard:u,implementation:l,codeSize:Math.floor(i.length/2),notes:a}}var Qr=/^0x[0-9a-fA-F]{40}$/,Jr=4663;function Q(e,t){let r=String(e||"").trim();if(!Qr.test(r))throw new Error(`evm-token-sniper: ${t} must be a 0x EVM address`);return r}function be(e,t){let r=String(e??"").trim();if(!/^\d+$/.test(r)||BigInt(r)<=0n)throw new Error(`evm-token-sniper: ${t} must be a positive raw integer amount`);return r}function H(e,t){return e==null||e===""?null:be(e,t)}function en({chainId:e,tokenAddress:t,tokenIn:r,amountIn:s,recipient:n,quote:o,topPool:a,unsignedTx:c,args:i,opts:d}){let u=c?.tx;if(!u||typeof u!="object")throw new Error("local-signer envelope requires unsigned tx object");let l=Q(u.to,"prepared destination"),p=String(u.data||"").toLowerCase();if(!/^0x[0-9a-f]+$/.test(p))throw new Error("local-signer envelope requires hex calldata");let f=be(u.value??s,"prepared native value");if(BigInt(f)!==BigInt(s))throw new Error("local-signer envelope requires native value equal amountIn");let h=H(u.gasLimit??i.gasLimit,"gasLimit"),m=H(u.maxFeePerGas??i.maxFeePerGas,"maxFeePerGas");if(!h||!m)throw new Error("local-signer envelope requires explicit gasLimit and maxFeePerGas caps");let b=Number(d.nowMs??Date.now()),A=Math.min(6e4,Math.max(1e3,Number(i.ttlMs??i.expiresInMs??3e4)||3e4)),x=pt({chainId:e,venue:"uniswap-v3",quoteAmountOut:o?.amountOut,liquidityUsd:a?.liquidityUsd,requestedCapBps:i.slippageBps??50,quotedAtMs:b,ttlMs:A,secret:d.routeAttestationSecret}),k=dt(x,{chainId:e,venue:"uniswap-v3",data:p,secret:d.routeAttestationSecret}),v={chainId:e,from:n,to:l,data:p,value:f,gasLimit:h,maxFeePerGas:m,slippageBps:k.selectedBps,expiresAtMs:b+A},S=H(u.maxPriorityFeePerGas??i.maxPriorityFeePerGas,"maxPriorityFeePerGas");return S&&(v.maxPriorityFeePerGas=S),i.nonce!==void 0&&(v.nonce=Number(i.nonce)),(i.txType!==void 0||S)&&(v.type=Number(i.txType??2)),i.l1FeeWei!==void 0&&(v.l1FeeWei=H(i.l1FeeWei,"l1FeeWei")??"0"),i.operatorFeeWei!==void 0&&(v.operatorFeeWei=H(i.operatorFeeWei,"operatorFeeWei")??"0"),{version:1,surface:"evm-swap",action:"swap",provider:"uniswap-v3",owner:n,destination:l,tradeId:i.tradeId||`evm-token-sniper-${e}-${t.toLowerCase()}`,slippageBps:k.selectedBps,expiresAtMs:b+A,fee:{oracleFeeBps:5},autoSlippage:k,artifact:{chainId:e,owner:n,transactions:[v]},meta:{source:"evm-token-sniper",tokenIn:r,tokenOut:t}}}function tn(e,t){if(t){if(Number(t.chainId)!==e)throw new Error(`evm-token-sniper: supplied scanner chain ${t.chainId} does not match ${e}`);return t}st();let r=Ze(e);if(!r)throw new Error(`evm-token-sniper: unsupported EVM chainId ${e}`);return r}function rn({token:e,pools:t,structuralRisk:r,scannerRisk:s,sellability:n,quote:o,args:a,scanner:c}){let i=[];return e?.evidence!==w.LIVE&&i.push("token identity is not live-verified"),(!Array.isArray(t?.pools)||t.pools.length===0)&&i.push("no liquid pool was resolved"),r?.status!=="ok"&&i.push("structural contract risk is unavailable"),r?.risk==="high"&&i.push("structural contract risk is high"),s?.verdict!==g.PASS&&i.push(`scanner risk verdict is ${s?.verdict||"UNKNOWN"}`),c.supports?.("sellSimulation")?n?.verdict!==g.PASS&&i.push(`sellability verdict is ${n?.verdict||"UNKNOWN"}`):i.push("sell simulation is unavailable on this chain"),c.supports?.("quote")?o?.evidence!==w.LIVE&&i.push("no live quote was returned"):i.push("live quoting is unavailable on this chain"),c.supports?.("prepareUnsignedTx")||i.push("unsigned transaction preparation is unavailable on this chain"),a.tokenIn||i.push("tokenIn is required to prepare"),a.amountIn||i.push("amountIn is required to prepare"),a.recipient||i.push("recipient is required to prepare"),i}async function ht(e={},t={}){let r=Number(e.chainId??Jr);if(!Number.isInteger(r)||r<=0)throw new Error("evm-token-sniper: chainId must be a positive integer");let s=Q(e.tokenAddress||e.address||e.token,"tokenAddress"),n=e.tokenIn?Q(e.tokenIn,"tokenIn"):null,o=e.recipient?Q(e.recipient,"recipient"):null,a=e.amountIn==null?null:be(e.amountIn,"amountIn"),c=tn(r,t.scanner),i=t.scanContractRisk||ft,[d,u,l]=await Promise.all([c.resolveToken(s),c.resolvePools(s),i({address:s,chainId:r},t.contractRiskOpts||t)]),p=await c.scoreRisk(s),f=null;c.supports?.("sellSimulation")&&a?f=await c.sellSimulation({token:s,amountIn:a,base:n||void 0}):c.supports?.("sellSimulation")&&(f=await c.sellSimulation({token:s,amountIn:"10000000000000000"}));let h=null;c.supports?.("quote")&&n&&a&&(h=await c.quote({tokenIn:n,tokenOut:s,amountIn:a}));let m={...e,tokenIn:n,amountIn:a,recipient:o},b=rn({token:d,pools:u,structuralRisk:l,scannerRisk:p,sellability:f,quote:h,args:m,scanner:c}),A=null,x=null,k=null;if(e.prepare===!0&&b.length===0){A=await c.prepareUnsignedTx({tokenIn:n,tokenOut:s,amountIn:a,recipient:o,slippageBps:e.slippageBps??50,fee:h?.fee});try{x=en({chainId:r,tokenAddress:s,tokenIn:n,amountIn:a,recipient:o,quote:h,topPool:u?.pools?.[0]||null,unsignedTx:A,args:e,opts:t})}catch(v){k=String(v?.message||v).slice(0,200)}}return{provider:"evm-token-sniper",execution:"armed-local",armed:!!x,signing:"local-signer",broadcasting:"local-signer",chainId:r,chain:{key:c.key,name:c.name,nativeCurrency:c.nativeCurrency},token:d,pools:u,topPool:u?.pools?.[0]||null,structuralRisk:l,scannerRisk:p,sellability:f,quote:h,blockedReasons:b,prepared:!!A,unsignedTx:A,localSignerEnvelope:x,localSignerBlockedReason:k,signed:x?"pending-local-signer":!1,broadcast:x?"pending-local-signer":!1}}import{homedir as ge}from"node:os";import{join as we}from"node:path";var mt=process.env.ORACLE_PUBLIC_DESKTOP==="1",nn=mt?process.env.ORACLE_CONFIG_DIR||we(ge(),".config","oracle"):we(ge(),".config","oracle"),Ao=mt?nn:we(ge(),".config","mad-desk");var on=4663,sn="EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",an="Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";function ye(e=process.env){return String((e||process.env).ORACLE_SNIPE_EXECUTE||"").trim()==="1"}function bt(e){return String(e||"").trim().replace(/^@/,"")}async function cn({handle:e,limit:t=5,xurlFn:r=ke}={},s={}){let n=bt(e);if(!n)throw new Error("twitter-ca-watch: handle required");let o=await r("xurl",{command:"search",query:`from:${n}`,limit:Math.min(20,Math.max(1,Number(t)||5))},s);return o?.ok?{ok:!0,tweets:Ee(o.stdout),raw:o}:{ok:!1,error:o?.error||"xurl search failed",tweets:[]}}async function un(e,{chainId:t,amountIn:r,tokenIn:s,recipient:n,prepare:o},a){let c=await ht({chainId:t,tokenAddress:e,amountIn:r,tokenIn:s,recipient:n,prepare:o===!0},a),i=c.topPool||c.pools?.pools?.[0]||null;return{chainFamily:"evm",chainId:t,address:e,topPool:i,quoteAsset:c.pools?.quoteAsset||null,sellability:c.sellability||null,blockedReasons:c.blockedReasons||[],prepared:!!c.prepared,unsignedTx:c.unsignedTx||null,localSignerEnvelope:c.localSignerEnvelope||null,execution:!1,broadcast:!1}}async function ln(e,t){let r=await Ke(e,{chainSlug:"solana",stables:[sn,an]},t);return{chainFamily:"solana",chainId:"solana",address:e,topPool:r.topPool,pools:r.pools,prepared:!1,execution:!1,broadcast:!1,note:"Solana CA ranked on USD book. Prepare stays Jupiter/local-signer; this tick does not broadcast."}}async function dn(e,t={},r={}){let s=Number(t.chainId??on),n=[];for(let o of e.evm||[])n.push(await un(o,{...t,chainId:s},r));for(let o of e.solana||[])n.push(await ln(o,r));return n}async function gt(e={},t={}){let r=bt(e.handle),s=e.seen instanceof Set?e.seen:new Set(e.seen||[]),n=await cn({handle:r,limit:e.limit,xurlFn:t.xurlFn},t);if(!n.ok)return{ok:!1,handle:r,error:n.error,hits:[],seen:[...s]};let o=[];for(let c of n.tweets){let i=c.id||`${r}:${c.text.slice(0,80)}`;if(s.has(i))continue;let d=ve(c.text,{extras:c.urls||[]});if(!d.all.length){s.add(i);continue}let l=await(t.evaluateFn||dn)(d,e,t);s.add(i),o.push({tweetId:c.id||null,handle:r,text:c.text,contracts:d,evaluations:l})}let a=e.automated!==!1;return{ok:!0,handle:r,source:"twitter-ca-watch",automated:a,card:!1,notify:!1,telegram:!1,execution:!1,broadcast:!1,snipeExecuteEnabled:ye(t.env||process.env),hits:o,seen:[...s]}}var wt=`oracle snipe twitter <handle> [--chain 4663] [--json]
 
 Watch one X/Twitter account for contract addresses, rank the USD book, sell-sim,
 and PREPARE only. This does not broadcast.
@@ -13,12 +15,12 @@ and PREPARE only. This does not broadcast.
 Automated ticks never send a Telegram / Claude / Codex card.
 Fill still requires the local signer + Telegram Allow / /approve.
 ORACLE_SNIPE_EXECUTE=1 does not start an autonomous loop.
-`;function ht(e,t){let r=e.indexOf(`--${t}`);if(r>=0&&e[r+1]&&!e[r+1].startsWith("--"))return e[r+1];let s=e.find(n=>n.startsWith(`--${t}=`));return s?s.split("=").slice(1).join("="):null}var Eo={name:"snipe",summary:"Twitter CA watch \u2192 USD-book prepare (no broadcast)",group:"read",usage:ft,async run(e){let t=e.argv||[];if(!t.length||t[0]==="--help"||t[0]==="-h")return process.stdout.write(ft),0;if(t[0]!=="twitter")return process.stderr.write(`usage: oracle snipe twitter <handle>
+`;function yt(e,t){let r=e.indexOf(`--${t}`);if(r>=0&&e[r+1]&&!e[r+1].startsWith("--"))return e[r+1];let s=e.find(n=>n.startsWith(`--${t}=`));return s?s.split("=").slice(1).join("="):null}var Oo={name:"snipe",summary:"Twitter CA watch \u2192 USD-book prepare (no broadcast)",group:"read",usage:wt,async run(e){let t=e.argv||[];if(!t.length||t[0]==="--help"||t[0]==="-h")return process.stdout.write(wt),0;if(t[0]!=="twitter")return process.stderr.write(`usage: oracle snipe twitter <handle>
 `),1;let r=t[1];if(!r)return process.stderr.write(`snipe twitter requires a handle
-`),1;let s=await pt({handle:r,chainId:ht(t,"chain")?Number(ht(t,"chain")):4663});if(t.includes("--json"))return process.stdout.write(`${JSON.stringify({...s,snipeExecuteEnabled:we()},null,2)}
+`),1;let s=await gt({handle:r,chainId:yt(t,"chain")?Number(yt(t,"chain")):4663});if(t.includes("--json"))return process.stdout.write(`${JSON.stringify({...s,snipeExecuteEnabled:ye()},null,2)}
 `),s.ok?0:1;if(!s.ok)return process.stderr.write(`${s.error}
 `),1;if(!s.hits.length)return process.stdout.write(`no new CA tweets from @${r}
 `),0;for(let n of s.hits){process.stdout.write(`@${r} ${n.tweetId||""} ${n.contracts.all.map(o=>o.address).join(" ")}
 `);for(let o of n.evaluations){let a=o.topPool;process.stdout.write(`  ${o.chainFamily} ${o.address} pool=${a?.dex||"none"} liq=${a?.liquidityUsd??"n/a"} prepared=${o.prepared} broadcast=false
 `)}}return process.stdout.write(`PREPARE only. No card. Allow on Telegram / local signer still required to fill.
-`),0}};export{Eo as default};
+`),0}};export{Oo as default};