@oracle-agent/oracle 0.35.43 → 0.35.44

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-var W=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import L from"node:fs";import et from"node:os";import x from"node:path";import{fileURLToPath as tt}from"node:url";function fe(){return process.env.ORACLE_FAKE_HOME||et.homedir()}function nt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function $(){return nt()?process.env.ORACLE_CONFIG_DIR||x.join(fe(),".config","oracle"):x.join(fe(),".config","oracle")}function ot(){return x.join($(),"desk.json")}function it(){return x.join($(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=it();if(L.existsSync(i))for(let o of L.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let l=a[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),t(a[1],l)}}catch{}try{let i=ot();if(L.existsSync(i)){let o=JSON.parse(L.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var rt,Pr,pe=W(()=>{rt=x.dirname(tt(import.meta.url)),Pr=x.resolve(rt,"../..");try{E()}catch{}});var _n,Rn,D=W(()=>{_n=300*1e3,Rn=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})()});var je=W(()=>{});pe();import m from"node:fs";import H from"node:path";import{createCipheriv as st,createDecipheriv as at,randomBytes as O,scryptSync as ct}from"node:crypto";import s from"node:fs";import p from"node:path";var me="ORACLE-LOCAL-VAULT",we=1,k=Object.freeze({N:1<<17,r:8,p:1}),lt=256*1024*1024,ut=16*1024;function P(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function he(e,n,t=k){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");if(r.includes("\0"))throw new Error("local-vault: refusing zeroed passphrase material");return ct(r,n,32,{...t,maxmem:lt})}function ge(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:me,version:we,kdf:{name:"scrypt",...k,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},l=he(n,i);try{let f=st("aes-256-gcm",l,o);f.setAAD(Buffer.from(JSON.stringify(a)));let c=Buffer.concat([f.update(r),f.final()]);return{...a,ciphertext:c.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{l.fill(0),r.fill(0)}}function T(e,n){if(e?.magic!==me||e?.version!==we)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==k.N||e.kdf.r!==k.r||e.kdf.p!==k.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!t.includes(u)))throw new Error("local-vault: unexpected vault field");let r=P(e.kdf.salt,32,"salt"),i=P(e.cipher.iv,12,"iv"),o=P(e.tag,16,"tag"),a=P(e.ciphertext,1,"ciphertext",{max:ut}),{ciphertext:l,tag:f,...c}=e,d=he(n,r);try{let u=at("aes-256-gcm",d,i);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(o),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function dt(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function U(e){let n=p.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(dt(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function N(e){return JSON.parse(h(e))}function ye(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
-`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(p.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let l=s.openSync(p.dirname(e),"r");try{s.fsyncSync(l)}finally{s.closeSync(l)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function g(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(p.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}function ft(e,n){try{s.linkSync(e,n)}catch(r){throw r?.code==="EEXIST"?new Error("export destination already exists; choose a new owner-only file"):r}s.chmodSync(n,384),s.unlinkSync(e);let t=s.openSync(p.dirname(n),"r");try{s.fsyncSync(t)}finally{s.closeSync(t)}}function be(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,String(n)),s.fsyncSync(r),s.closeSync(r),r=void 0,ft(t,e)}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}}import w from"node:path";import Sr from"node:os";import{createHash as Ar,randomBytes as Uu}from"node:crypto";import{Interface as ce,keccak256 as Ku}from"ethers";import{Transaction as Gu}from"@scure/btc-signer";import{ed25519 as Xu}from"@noble/curves/ed25519.js";import{base58 as ys}from"@scure/base";import{Interface as Ie}from"ethers";import{Interface as gt,MaxUint256 as En,isAddress as xn,keccak256 as Sn,toUtf8Bytes as An}from"ethers";import{Interface as wt,isAddress as en}from"ethers";import{isAddress as Jr}from"ethers";var on=new wt(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ht,isAddress as cn}from"ethers";var fn=new ht(["function approve(address spender,uint256 amount) returns (bool)"]),pn=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Nn=new gt(["function approve(address spender,uint256 amount) returns (bool)"]);D();import{Address as Dn,NETWORK as Fn,OutScript as jn,RawTx as qn,SigHash as Mn,TEST_NETWORK as Hn,Transaction as zn}from"@scure/btc-signer";import{createHash as yt}from"node:crypto";import{base58 as Kn}from"@scure/base";import{getCompiledTransactionMessageDecoder as Gn}from"@solana/transaction-messages";var Ee=e=>yt("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Yn=new Map([[Ee("route"),{name:"route",prefixBytes:0}],[Ee("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var oo=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,io=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,so=AbortSignal.prototype.throwIfAborted,ao=EventTarget.prototype.addEventListener,co=EventTarget.prototype.removeEventListener,lo=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null;var uo=64*1024,fo=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024});var So=Object.freeze({tradexyz:"xyz",ventuals:"vntl",hypernova:"hyna",paradex:"para",entropy:"io",entropyio:"io"});var Oo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),To=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var _o="0x"+"00".repeat(32);var Et=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Bo=Object.freeze(Et.map(e=>e[0]));import{TypedDataEncoder as pi,getAddress as mi}from"ethers";D();import{TypedDataEncoder as Mo,getAddress as Ho,isAddress as zo}from"ethers";var St=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),At=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as ei,getAddress as ti,isAddress as ri}from"ethers";var Vo=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});D();var vt=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),li=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var It=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),ui=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var gi=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var _t=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var $i=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var Rt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Pi=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Bi=new Ie(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Di=new Ie(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Fi=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Lt=Object.freeze([..._t]),ji=Object.freeze({...Rt});import{ed25519 as ts}from"@noble/curves/ed25519.js";import{base58 as ns}from"@scure/base";import{RawTx as is,SigHash as ss,Transaction as as}from"@scure/btc-signer";import{Transaction as ls,keccak256 as us,verifyTypedData as ds}from"ethers";import{encode as Hi}from"@msgpack/msgpack";import{keccak256 as Wi,verifyTypedData as Ui}from"ethers";var Vi=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Ki=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{closeSync as $s,constants as Dt,fchmodSync as Ps,fsyncSync as Bs,lstatSync as Ds,mkdirSync as Fs,openSync as js,readFileSync as qs,renameSync as Ms,rmSync as Hs,writeFileSync as zs}from"node:fs";import{wordlists as _s}from"ethers";var Vs=Dt.O_NOFOLLOW??0;import{wordlists as Gs}from"ethers";var ke=64*1024;var Xs=32*1024;var qt=["schemaVersion","buildVersion","recordType","execution","custody"],ea=[...qt,"recordHash"];var ta=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Mt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Pe=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),sa=new Set(Pe);var Kt=64*1024*1024;var pa=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),ma=Object.freeze(["read","simulate"]);var wa=1440*60;var va=Object.freeze(["privkey","wif","xprv","seed"]);var Ia=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),ka=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var te=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Ca=Object.freeze(Object.fromEntries(te.map((e,n)=>[e,Object.freeze(n+1<te.length?[te[n+1]]:[])])));var Jt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var Yt=Object.freeze(["owner","operator","agent","viewer"]),Xt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),Zt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),mc=Object.freeze(["owner"]),wc=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),hc=new Set(Yt),gc=new Set(Xt),yc=new Set(Object.values(Zt));var Qt=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),bc=Object.freeze(Object.fromEntries(Object.entries(Qt).map(([e,n])=>[e,Object.freeze([...n])])));var er=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),tr=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),rr=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Ac=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),vc=new Set(er),Ic=new Set(tr),kc=new Set(rr);var Oc=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var Tc=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var $c=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var qc=32*1024*1024;var Hc=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as or,randomBytes as rl,timingSafeEqual as ir}from"node:crypto";import sr from"node:fs";import S from"node:path";import{homedir as re}from"node:os";import{join as ne}from"node:path";var Be=process.env.ORACLE_PUBLIC_DESKTOP==="1",nr=Be?process.env.ORACLE_CONFIG_DIR||ne(re(),".config","oracle"):ne(re(),".config","oracle"),Vc=Be?nr:ne(re(),".config","mad-desk");var Xc="0".repeat(64),Zc=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function j(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(j).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+j(e[t])).join(",")+"}"}var Qc=Promise.resolve();function ar(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return sr.realpathSync(a)}catch{return S.resolve(a)}},r=t(S.dirname(S.resolve(e))),i=t(S.dirname(S.resolve(n))),o=(a,l)=>l===a||l.startsWith(a+S.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var oe=(e,n)=>or("sha256",n).update(j(e)).digest("hex"),cr=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&ir(t,r)};function lr(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:oe(r,n)}}}function De(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!cr(r?.integrity?.mac,oe(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function ur(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let l=De(e,t);o=l.present&&l.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:oe(a,t)}})+`
-`)}function Fe(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=De(r,i);ar(r,e);let a=Number(o.sequence||0)+1,l=lr(t,i,{sequence:a});ur(r,a,i,l?.integrity?.mac??null),g(e,JSON.stringify(l,null,2)+`
-`)}je();import{readFileSync as pl,readdirSync as ml,existsSync as dr}from"node:fs";import{dirname as fr,join as _}from"node:path";import{fileURLToPath as pr}from"node:url";var R=fr(pr(import.meta.url));function mr(){let e=[_(R,"descriptors"),_(R,"clear-sign","descriptors"),_(R,"..","clear-sign","descriptors"),_(R,"..","..","clear-sign","descriptors"),_(R,"..","..","..","clear-sign","descriptors")];for(let n of e)if(dr(n))return n;return e[0]}var yl=mr();var bl=(1n<<256n)-1n;import{Wallet as ie}from"ethers";import{base58 as se}from"@scure/base";import{ed25519 as ze}from"@noble/curves/ed25519.js";import{NETWORK as We,TEST_NETWORK as Ue,WIF as wr,p2wpkh as qe}from"@scure/btc-signer";import{pubECDSA as hr}from"@scure/btc-signer/utils.js";var q=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},gr=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},Me=e=>{let n=String(e||"").trim();try{let t=Buffer.from(se.decode(n));return se.encode(t)===n?t:null}catch{return null}},ae=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(ze.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},He=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),y=(e,n)=>{if(n==="sol")return ae(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},yr=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return y(t,n)};function b(e,n){let t=String(n||"").trim();if(e==="evm")return new ie(t).privateKey;if(e==="btc")for(let o of[We,Ue])try{return Buffer.from(wr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let c=q(t.slice(4));if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}if(/^base58:/i.test(t)){let c=Me(t.slice(7));if(!He(c))throw new Error("sol: invalid explicit base58 private key");return ae(c)}if(/^0x/i.test(t)){let c=q(t);if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}let o=q(t),a=o&&(o.length===32||o.length===64)?y(o,"sol"):null,l=Me(t),f=He(l);if(a&&f&&!a.equals(f))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(f)return ae(l);if(o)return y(o,"sol")}let r=q(t);if(r)return e==="evm"?new ie(`0x${r.toString("hex")}`).privateKey:y(r,e);let i=gr(t);if(i)return y(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return yr(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return b(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let t=new ie(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=y(n,"btc"),r=hr(t);return{kind:e,secret:t.toString("hex"),addresses:[qe(r,We).address,qe(r,Ue).address]}}if(e==="sol"){let t=y(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[se.encode(ze.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function M(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=A(o,b(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let l=(c,d=!0)=>{let u=a[c];if(!(!d&&u===void 0)){if(!Array.isArray(u)||u.length<4||u.some(I=>!Number.isInteger(I)||I<0||I>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(u)}},f=a.apiSecretEncoding;if(f!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:l("apiKeyBytes"),apiSecretBytes:l("apiSecretBytes"),apiSecretEncoding:f,passphraseBytes:l("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function Ve(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function Ke(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var $l=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),Pl=Object.freeze(["binance","bybit","okx","coinbase"]),Bl=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),Dl=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),Fl=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),jl=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),ql=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),Ml=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),Hl=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),zl=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Wl=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var xr=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Je=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var eu=256*1024;var Td=new ce(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Nd=new ce(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Cd=new ce(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ge(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||w.join(process.env.XDG_STATE_HOME||w.join(Sr.homedir(),".local","state"),"oracle"),t=Ar("sha256").update(w.resolve(e)).digest("hex").slice(0,16);return{vault:w.join(e,"vault.json"),policy:w.join(e,"signer-policy.json"),policyKey:w.join(e,"policy-integrity-key"),policyAnchor:w.join(n,`signer-policy-${t}.high-water`),ledger:w.join(e,"signer-ledger.json"),ledgerAnchor:w.join(n,`signer-ledger-${t}.high-water`),executionOutbox:w.join(e,"signer-execution-outbox.json"),cexOrders:w.join(e,"cex-orders.json"),cexOrdersAnchor:w.join(n,`cex-orders-${t}.high-water`),token:w.join(e,"signer-token"),lock:w.join(n,`signer-${t}.lock`),workflowLedger:w.join(e,"workflow-events.jsonl")}}import{randomBytes as vr}from"node:crypto";import{Wallet as Ye}from"ethers";var Ze=`oracle sign init|import|import-phrase|export|policy|status|unlock|lock|doctor
+var W=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import R from"node:fs";import et from"node:os";import x from"node:path";import{fileURLToPath as tt}from"node:url";function fe(){return process.env.ORACLE_FAKE_HOME||et.homedir()}function nt(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function $(){return nt()?process.env.ORACLE_CONFIG_DIR||x.join(fe(),".config","oracle"):x.join(fe(),".config","oracle")}function ot(){return x.join($(),"desk.json")}function it(){return x.join($(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=it();if(R.existsSync(i))for(let o of R.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let l=a[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),t(a[1],l)}}catch{}try{let i=ot();if(R.existsSync(i)){let o=JSON.parse(R.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var rt,Br,pe=W(()=>{rt=x.dirname(tt(import.meta.url)),Br=x.resolve(rt,"../..");try{E()}catch{}});var Ln,Rn,D=W(()=>{Ln=300*1e3,Rn=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})()});var je=W(()=>{});pe();import m from"node:fs";import H from"node:path";import{createCipheriv as st,createDecipheriv as at,randomBytes as O,scryptSync as ct}from"node:crypto";import s from"node:fs";import p from"node:path";var me="ORACLE-LOCAL-VAULT",we=1,k=Object.freeze({N:1<<17,r:8,p:1}),lt=256*1024*1024,ut=16*1024;function P(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function he(e,n,t=k){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");if(r.includes("\0"))throw new Error("local-vault: refusing zeroed passphrase material");return ct(r,n,32,{...t,maxmem:lt})}function ge(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:me,version:we,kdf:{name:"scrypt",...k,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},l=he(n,i);try{let f=st("aes-256-gcm",l,o);f.setAAD(Buffer.from(JSON.stringify(a)));let c=Buffer.concat([f.update(r),f.final()]);return{...a,ciphertext:c.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{l.fill(0),r.fill(0)}}function T(e,n){if(e?.magic!==me||e?.version!==we)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==k.N||e.kdf.r!==k.r||e.kdf.p!==k.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!t.includes(u)))throw new Error("local-vault: unexpected vault field");let r=P(e.kdf.salt,32,"salt"),i=P(e.cipher.iv,12,"iv"),o=P(e.tag,16,"tag"),a=P(e.ciphertext,1,"ciphertext",{max:ut}),{ciphertext:l,tag:f,...c}=e,d=he(n,r);try{let u=at("aes-256-gcm",d,i);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(o),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function dt(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function U(e){let n=p.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(dt(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function N(e){return JSON.parse(h(e))}function ye(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
+`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(p.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let l=s.openSync(p.dirname(e),"r");try{s.fsyncSync(l)}finally{s.closeSync(l)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function g(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(p.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}function ft(e,n){try{s.linkSync(e,n)}catch(r){throw r?.code==="EEXIST"?new Error("export destination already exists; choose a new owner-only file"):r}s.chmodSync(n,384),s.unlinkSync(e);let t=s.openSync(p.dirname(n),"r");try{s.fsyncSync(t)}finally{s.closeSync(t)}}function be(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,String(n)),s.fsyncSync(r),s.closeSync(r),r=void 0,ft(t,e)}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}}import w from"node:path";import Ar from"node:os";import{createHash as vr,randomBytes as Xu}from"node:crypto";import{Interface as ce,keccak256 as Qu}from"ethers";import{Transaction as td}from"@scure/btc-signer";import{ed25519 as nd}from"@noble/curves/ed25519.js";import{base58 as vs}from"@scure/base";import{Interface as Ie}from"ethers";import{Interface as gt,MaxUint256 as xn,isAddress as Sn,keccak256 as An,toUtf8Bytes as vn}from"ethers";import{Interface as wt,isAddress as tn}from"ethers";import{isAddress as Gr}from"ethers";var sn=new wt(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as ht,isAddress as ln}from"ethers";var pn=new ht(["function approve(address spender,uint256 amount) returns (bool)"]),mn=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Cn=new gt(["function approve(address spender,uint256 amount) returns (bool)"]);D();import{Address as Fn,NETWORK as jn,OutScript as Mn,RawTx as qn,SigHash as Hn,TEST_NETWORK as zn,Transaction as Wn}from"@scure/btc-signer";import{createHash as yt}from"node:crypto";import{base58 as Jn}from"@scure/base";import{getCompiledTransactionMessageDecoder as Yn}from"@solana/transaction-messages";var Ee=e=>yt("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Xn=new Map([[Ee("route"),{name:"route",prefixBytes:0}],[Ee("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);import{AsyncLocalStorage as bt}from"node:async_hooks";var eo=new bt;var uo=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,fo=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,po=AbortSignal.prototype.throwIfAborted,mo=EventTarget.prototype.addEventListener,wo=EventTarget.prototype.removeEventListener,ho=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null;var go=64*1024,yo=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024});var To=Object.freeze({tradexyz:"xyz",ventuals:"vntl",hypernova:"hyna",paradex:"para",entropy:"io",entropyio:"io"});var Ro=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),$o=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Do="0x"+"00".repeat(32);var xt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Ho=Object.freeze(xt.map(e=>e[0]));import{TypedDataEncoder as bi,getAddress as Ei}from"ethers";D();import{TypedDataEncoder as Ko,getAddress as Jo,isAddress as Go}from"ethers";var At=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),vt=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as si,getAddress as ai,isAddress as ci}from"ethers";var Zo=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});D();var It=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),wi=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var kt=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),hi=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var Ai=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Lt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var Mi=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var Rt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),qi=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),Hi=new Ie(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),zi=new Ie(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Wi=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var $t=Object.freeze([...Lt]),Ui=Object.freeze({...Rt});import{ed25519 as as}from"@noble/curves/ed25519.js";import{base58 as ls}from"@scure/base";import{RawTx as ds,SigHash as fs,Transaction as ps}from"@scure/btc-signer";import{Transaction as ws,keccak256 as hs,verifyTypedData as gs}from"ethers";import{encode as Ji}from"@msgpack/msgpack";import{keccak256 as Yi,verifyTypedData as Xi}from"ethers";var Zi=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Qi=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{closeSync as Ms,constants as Ft,fchmodSync as qs,fsyncSync as Hs,lstatSync as zs,mkdirSync as Ws,openSync as Us,readFileSync as Vs,renameSync as Ks,rmSync as Js,writeFileSync as Gs}from"node:fs";import{wordlists as Ds}from"ethers";var Zs=Ft.O_NOFOLLOW??0;import{wordlists as ta}from"ethers";var ke=64*1024;var na=32*1024;var qt=["schemaVersion","buildVersion","recordType","execution","custody"],sa=[...qt,"recordHash"];var aa=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Ht=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),Pe=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),fa=new Set(Pe);var Jt=64*1024*1024;var ba=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),Ea=Object.freeze(["read","simulate"]);var xa=1440*60;var Ca=Object.freeze(["privkey","wif","xprv","seed"]);var _a=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),La=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var te=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),Ba=Object.freeze(Object.fromEntries(te.map((e,n)=>[e,Object.freeze(n+1<te.length?[te[n+1]]:[])])));var Gt=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var Xt=Object.freeze(["owner","operator","agent","viewer"]),Zt=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),Qt=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),Ec=Object.freeze(["owner"]),xc=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),Sc=new Set(Xt),Ac=new Set(Zt),vc=new Set(Object.values(Qt));var er=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),Ic=Object.freeze(Object.fromEntries(Object.entries(er).map(([e,n])=>[e,Object.freeze([...n])])));var tr=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),rr=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),nr=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var Nc=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),Cc=new Set(tr),_c=new Set(rr),Lc=new Set(nr);var Rc=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var $c=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var Mc=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var Vc=32*1024*1024;var Jc=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as ir,randomBytes as cl,timingSafeEqual as sr}from"node:crypto";import ar from"node:fs";import S from"node:path";import{homedir as re}from"node:os";import{join as ne}from"node:path";var Be=process.env.ORACLE_PUBLIC_DESKTOP==="1",or=Be?process.env.ORACLE_CONFIG_DIR||ne(re(),".config","oracle"):ne(re(),".config","oracle"),Zc=Be?or:ne(re(),".config","mad-desk");var nl="0".repeat(64),ol=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function j(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(j).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+j(e[t])).join(",")+"}"}var il=Promise.resolve();function cr(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return ar.realpathSync(a)}catch{return S.resolve(a)}},r=t(S.dirname(S.resolve(e))),i=t(S.dirname(S.resolve(n))),o=(a,l)=>l===a||l.startsWith(a+S.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var oe=(e,n)=>ir("sha256",n).update(j(e)).digest("hex"),lr=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&sr(t,r)};function ur(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:oe(r,n)}}}function De(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!lr(r?.integrity?.mac,oe(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function dr(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let l=De(e,t);o=l.present&&l.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:oe(a,t)}})+`
+`)}function Fe(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=De(r,i);cr(r,e);let a=Number(o.sequence||0)+1,l=ur(t,i,{sequence:a});dr(r,a,i,l?.integrity?.mac??null),g(e,JSON.stringify(l,null,2)+`
+`)}je();import{readFileSync as bl,readdirSync as El,existsSync as fr}from"node:fs";import{dirname as pr,join as _}from"node:path";import{fileURLToPath as mr}from"node:url";var L=pr(mr(import.meta.url));function wr(){let e=[_(L,"descriptors"),_(L,"clear-sign","descriptors"),_(L,"..","clear-sign","descriptors"),_(L,"..","..","clear-sign","descriptors"),_(L,"..","..","..","clear-sign","descriptors")];for(let n of e)if(fr(n))return n;return e[0]}var vl=wr();var Il=(1n<<256n)-1n;import{Wallet as ie}from"ethers";import{base58 as se}from"@scure/base";import{ed25519 as ze}from"@noble/curves/ed25519.js";import{NETWORK as We,TEST_NETWORK as Ue,WIF as hr,p2wpkh as Me}from"@scure/btc-signer";import{pubECDSA as gr}from"@scure/btc-signer/utils.js";var M=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},yr=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},qe=e=>{let n=String(e||"").trim();try{let t=Buffer.from(se.decode(n));return se.encode(t)===n?t:null}catch{return null}},ae=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(ze.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},He=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),y=(e,n)=>{if(n==="sol")return ae(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},br=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return y(t,n)};function b(e,n){let t=String(n||"").trim();if(e==="evm")return new ie(t).privateKey;if(e==="btc")for(let o of[We,Ue])try{return Buffer.from(hr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let c=M(t.slice(4));if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}if(/^base58:/i.test(t)){let c=qe(t.slice(7));if(!He(c))throw new Error("sol: invalid explicit base58 private key");return ae(c)}if(/^0x/i.test(t)){let c=M(t);if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}let o=M(t),a=o&&(o.length===32||o.length===64)?y(o,"sol"):null,l=qe(t),f=He(l);if(a&&f&&!a.equals(f))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(f)return ae(l);if(o)return y(o,"sol")}let r=M(t);if(r)return e==="evm"?new ie(`0x${r.toString("hex")}`).privateKey:y(r,e);let i=yr(t);if(i)return y(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return br(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return b(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let t=new ie(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=y(n,"btc"),r=gr(t);return{kind:e,secret:t.toString("hex"),addresses:[Me(r,We).address,Me(r,Ue).address]}}if(e==="sol"){let t=y(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[se.encode(ze.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function q(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=A(o,b(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let l=(c,d=!0)=>{let u=a[c];if(!(!d&&u===void 0)){if(!Array.isArray(u)||u.length<4||u.some(I=>!Number.isInteger(I)||I<0||I>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(u)}},f=a.apiSecretEncoding;if(f!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:l("apiKeyBytes"),apiSecretBytes:l("apiSecretBytes"),apiSecretEncoding:f,passphraseBytes:l("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function Ve(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function Ke(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var Ml=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),ql=Object.freeze(["binance","bybit","okx","coinbase"]),Hl=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),zl=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),Wl=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),Ul=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),Vl=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),Kl=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),Jl=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Gl=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Yl=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var Sr=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Je=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var su=256*1024;var $d=new ce(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Pd=new ce(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Bd=new ce(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ge(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||w.join(process.env.XDG_STATE_HOME||w.join(Ar.homedir(),".local","state"),"oracle"),t=vr("sha256").update(w.resolve(e)).digest("hex").slice(0,16);return{vault:w.join(e,"vault.json"),policy:w.join(e,"signer-policy.json"),policyKey:w.join(e,"policy-integrity-key"),policyAnchor:w.join(n,`signer-policy-${t}.high-water`),ledger:w.join(e,"signer-ledger.json"),ledgerAnchor:w.join(n,`signer-ledger-${t}.high-water`),executionOutbox:w.join(e,"signer-execution-outbox.json"),cexOrders:w.join(e,"cex-orders.json"),cexOrdersAnchor:w.join(n,`cex-orders-${t}.high-water`),token:w.join(e,"signer-token"),lock:w.join(n,`signer-${t}.lock`),workflowLedger:w.join(e,"workflow-events.jsonl")}}import{randomBytes as Ir}from"node:crypto";import{Wallet as Ye}from"ethers";var Ze=`oracle sign init|import|import-phrase|export|policy|status|unlock|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -15,10 +15,10 @@ var W=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,v=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},Xe=e=>{let n=String(v(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Ir(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=l=>{for(let f of l){if(f===3){a(),r(new Error("cancelled"));return}if(f===13||f===10){a(),process.stderr.write(`
-`),t(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function le(e,n){let t=v(e,"--passphrase-file");return t?h(t):Ir("Vault passphrase: ",n)}function kr(e){return e.addresses.join(", ")}function Or(e,n){m.mkdirSync(H.dirname(e.vault),{recursive:!0,mode:448}),g(e.lock,`locked
-`),ye(e.vault,n),m.existsSync(e.policyKey)||g(e.policyKey,vr(32).toString("hex")+`
-`)}async function Tr(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||$(),o=Ge(H.join(i,"signer"));if(!r||r==="help")return t.write(Ze+`
+They are never accepted as argument values or inherited environment variables.`,v=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},Xe=e=>{let n=String(v(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function kr(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=l=>{for(let f of l){if(f===3){a(),r(new Error("cancelled"));return}if(f===13||f===10){a(),process.stderr.write(`
+`),t(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function le(e,n){let t=v(e,"--passphrase-file");return t?h(t):kr("Vault passphrase: ",n)}function Or(e){return e.addresses.join(", ")}function Tr(e,n){m.mkdirSync(H.dirname(e.vault),{recursive:!0,mode:448}),g(e.lock,`locked
+`),ye(e.vault,n),m.existsSync(e.policyKey)||g(e.policyKey,Ir(32).toString("hex")+`
+`)}async function Nr(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||$(),o=Ge(H.join(i,"signer"));if(!r||r==="help")return t.write(Ze+`
 `),0;if(r==="status")return t.write(JSON.stringify({initialized:m.existsSync(o.vault),policyConfigured:m.existsSync(o.policy),armed:m.existsSync(o.vault)&&!m.existsSync(o.lock),disarmed:m.existsSync(o.lock)})+`
 `),0;if(r==="lock")return m.mkdirSync(H.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),t.write(`Local signer locked.
@@ -26,7 +26,7 @@ They are never accepted as argument values or inherited environment variables.`,
 `),0}if(r==="doctor"){let c=[];return m.existsSync(o.vault)||c.push("vault missing"),m.existsSync(o.policy)||c.push("policy missing (empty allowlists fail closed)"),t.write(c.length?`Signer not ready: ${c.join("; ")}
 `:`Signer files ready; explicitly unlock locally before a bounded signing session.
 `),c.length?1:0}if(r==="policy"){if(!m.existsSync(o.vault)||!m.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let c=v(e,"--policy-file");if(!c)throw new Error("policy requires --policy-file <0600 JSON file>");let d;try{d=JSON.parse(h(c))}catch{throw new Error("policy file must contain valid JSON")}for(let u of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(d[u])||d[u].length===0)throw new Error(`policy: ${u} allowlist is empty`);return Fe(o.policy,o.policyKey,d,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(r==="export"){if(!e.includes("--acknowledge-raw-key-export"))throw new Error("export requires --acknowledge-raw-key-export");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=Xe(e),d=v(e,"--output-file");if(!d)throw new Error("export requires --output-file <0600 file>");let u=H.resolve(d),I=await le(e,n),ue=N(o.vault),de=T(ue,I);try{let z=M(de,ue.meta)[c];if(!z)throw new Error(`local signer has no ${c} key`);let Qe=c==="evm"?z.secret:`0x${z.secret.replace(/^0x/,"")}`;be(u,`${Qe}
+`),0}if(r==="export"){if(!e.includes("--acknowledge-raw-key-export"))throw new Error("export requires --acknowledge-raw-key-export");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=Xe(e),d=v(e,"--output-file");if(!d)throw new Error("export requires --output-file <0600 file>");let u=H.resolve(d),I=await le(e,n),ue=N(o.vault),de=T(ue,I);try{let z=q(de,ue.meta)[c];if(!z)throw new Error(`local signer has no ${c} key`);let Qe=c==="evm"?z.secret:`0x${z.secret.replace(/^0x/,"")}`;be(u,`${Qe}
 `),t.write(`Private key exported to owner-only file ${u}. Protect it as wallet custody.
-`)}finally{de.fill(0)}return 0}if(r!=="init"&&r!=="import"&&r!=="import-phrase")throw new Error(`unknown subcommand '${r}'`);let a=await le(e,n),l={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let c=N(o.vault),d=T(c,a);try{l=M(d,c.meta)}finally{d.fill(0)}}if(r==="init"){let c=Ye.createRandom();l.evm=A("evm",b("evm",c.privateKey))}else if(r==="import"){let c=Xe(e),d=v(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");l[c]=A(c,b(c,h(d)))}else{let c=v(e,"--phrase-file");if(!c)throw new Error("import-phrase requires --phrase-file <0600 file>");if(l.evm&&!e.includes("--replace-evm"))throw new Error("local signer already holds an evm key; pass --replace-evm to overwrite it");let d=Ye.fromPhrase(h(c).trim().replace(/\s+/g," "));l.evm=A("evm",b("evm",d.privateKey))}Or(o,ge(Ve(l),a,Ke(l)));let f=Object.entries(l).map(([c,d])=>`${c}:${kr(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
-`),0}var Md={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:Ze,run:e=>Tr(e.argv||[])};export{Md as default,Or as publishLockedVault,Tr as run};
+`)}finally{de.fill(0)}return 0}if(r!=="init"&&r!=="import"&&r!=="import-phrase")throw new Error(`unknown subcommand '${r}'`);let a=await le(e,n),l={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let c=N(o.vault),d=T(c,a);try{l=q(d,c.meta)}finally{d.fill(0)}}if(r==="init"){let c=Ye.createRandom();l.evm=A("evm",b("evm",c.privateKey))}else if(r==="import"){let c=Xe(e),d=v(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");l[c]=A(c,b(c,h(d)))}else{let c=v(e,"--phrase-file");if(!c)throw new Error("import-phrase requires --phrase-file <0600 file>");if(l.evm&&!e.includes("--replace-evm"))throw new Error("local signer already holds an evm key; pass --replace-evm to overwrite it");let d=Ye.fromPhrase(h(c).trim().replace(/\s+/g," "));l.evm=A("evm",b("evm",d.privateKey))}Tr(o,ge(Ve(l),a,Ke(l)));let f=Object.entries(l).map(([c,d])=>`${c}:${Or(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
+`),0}var Kd={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:Ze,run:e=>Nr(e.argv||[])};export{Kd as default,Tr as publishLockedVault,Nr as run};