@oracle-agent/oracle 0.35.54 → 0.35.55

package/dist/assets/skills/oracle-desk-product/SKILL.md

@@ -97,7 +97,7 @@ does not prove npm users receive it. A locally hosted model/data/policy loop doe
 a bundled signer. A merged feature is not public until the npm artifact containing it is
 published and inspected.
 
-**Candidate release in this source tree:** public package `@oracle-agent/oracle@0.35.54`
+**Candidate release in this source tree:** public package `@oracle-agent/oracle@0.35.55`
 ships the encrypted local vault + short-lived loopback signer. Hosted/keyless
 Oracle cannot hold keys or move funds. Self-hosting with `oracle sign init` or
 `oracle sign import --kind evm --key-file <0600 file>` writes an encrypted vault and marks

package/dist/cli/commands/signer.mjs

@@ -20,7 +20,7 @@ Type digest ${t}: `}import{createHash as Zu,randomBytes as Qu,timingSafeEqual as
 `;for(;;)try{let w=J.openSync(f,"wx",384);try{J.writeFileSync(w,p),J.fsyncSync(w)}finally{J.closeSync(w)}try{J.linkSync(f,n)}finally{J.unlinkSync(f)}break}catch(w){try{J.existsSync(f)&&J.unlinkSync(f)}catch{}if(w?.code!=="EEXIST")throw new Error("cex-state: lock refused");let g;try{g=J.readFileSync(n,"utf8")}catch(b){if(b?.code==="ENOENT")continue;throw new Error("cex-state: corrupt lock refused")}let h;try{h=JSON.parse(g)}catch{throw new Error("cex-state: corrupt lock refused")}if(h?.version!==1||!/^[0-9a-f]{32}$/.test(h.token||"")||!Number.isSafeInteger(h.createdAtMs))throw new Error("cex-state: corrupt lock refused");if(s(h)===!1&&Date.now()-h.createdAtMs>3e4){try{J.unlinkSync(n)}catch{throw new Error("cex-state: stale lock recovery refused")}continue}if(Date.now()>=m)throw new Error("cex-state: lock busy");i(10)}try{return d()}finally{let w;try{w=JSON.parse(J.readFileSync(n,"utf8"))}catch{throw new Error("cex-state: lock ownership lost")}if(w.token!==u||w.pid!==process.pid||w.processStart!==o)throw new Error("cex-state: lock ownership lost");J.unlinkSync(n)}},a=()=>{let d=$a(t);try{if(!J.existsSync(e)){if(J.existsSync(r))throw new Error("cex-state: rollback detected");return{version:1,sequence:0,orders:[]}}let u=JSON.parse(L(e));if(!La(u.mac,en(d,u.state)))throw new Error("cex-state: integrity failed");let m=JSON.parse(L(r));if(!La(m.mac,en(d,m.marker))||m.marker.sequence!==u.state.sequence||m.marker.stateMac!==u.mac)throw new Error("cex-state: rollback detected");return u.state}finally{d.fill(0)}},c=d=>{let u=$a(t);try{let m={...d,sequence:d.sequence+1},f=en(u,m),p={version:1,sequence:m.sequence,stateMac:f};return J.mkdirSync(dt.dirname(e),{recursive:!0,mode:448}),J.mkdirSync(dt.dirname(r),{recursive:!0,mode:448}),Ae(r,JSON.stringify({marker:p,mac:en(u,p)})+`
 `),Ae(e,JSON.stringify({state:m,mac:f})+`
 `),m}finally{u.fill(0)}};return Object.freeze({getByTradeId(d){return l(()=>a().orders.find(u=>u.tradeId===d)||null)},prepare(d){return l(()=>{let u=a(),m=u.orders.find(p=>p.tradeId===d.tradeId||p.requestDigest===d.requestDigest);if(m)throw new Error(`cex-state: ${m.state} order requires status reconciliation; create not resent`);let f={...d,state:"prepared",preparedAtMs:d.nowMs};return c({...u,orders:[...u.orders,f]}),Object.freeze(f)})},transition(d,u,m,f={}){return l(()=>{let p=a(),w=p.orders.findIndex(h=>h.tradeId===d);if(w<0)throw new Error("cex-state: durable prior order required");if(![].concat(u).includes(p.orders[w].state))throw new Error(`cex-state: ${p.orders[w].state} status requires reconciliation`);let g={...p.orders[w],...f,state:m};return p.orders[w]=g,c(p),Object.freeze(g)})},requirePrior({venue:d,accountId:u,credentialRef:m,symbol:f,venueOrderId:p}){return l(()=>{let w=a().orders.find(g=>g.venue===d&&g.accountId===u&&g.credentialRef===m&&g.symbol===f&&g.venueOrderId===p);if(!w)throw new Error("cex-state: exact durable prior order required");return Object.freeze(w)})}})}import{createHash as xm}from"node:crypto";import{createHash as dm}from"node:crypto";var xo=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),cr=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),fm=/^(?:0|[1-9]\d*)(?:\.\d+)?$/,pm=/^(?=[A-Za-z0-9._-]{1,128}$)(?=.*[A-Za-z0-9])[A-Za-z0-9._-]+$/,Ba=(e,t)=>{let r=String(e??"");if(!fm.test(r))throw new Error(`cex: ${t} must be a decimal string`);let[n,o=""]=r.split(".");return{text:r,integer:BigInt(n+o),scale:o.length}};var bo=(e,t)=>{let r=String(e??"");if(!pm.test(r))throw new Error(`cex: bounded ${t} required`);return r},Eo=e=>{if(e===null||typeof e=="string"||typeof e=="boolean"||typeof e=="number")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(Eo).join(",")}]`;if(e&&typeof e=="object")return`{${Object.keys(e).filter(t=>e[t]!==void 0).sort().map(t=>`${JSON.stringify(t)}:${Eo(e[t])}`).join(",")}}`;throw new Error("cex: non-canonical request fact refused")};function mm(e){if(!e||!["create","cancel","status"].includes(e.operation))throw new Error("cex: operation refused");if(!/^[A-Z0-9._/-]{1,32}$/.test(String(e.symbol||"")))throw new Error("cex: symbol required");if(e.operation==="create"){if(!/^(?:buy|sell)$/.test(e.side)||e.timeInForce!==void 0&&e.timeInForce!=="GTC")throw new Error("cex: LIMIT GTC spot order required");Ba(e.baseSize,"baseSize"),Ba(e.limitPrice,"limitPrice"),bo(e.clientOrderId,"clientOrderId")}else bo(e.venueOrderId,"venueOrderId");return e}function wm(e,t){let r=t.side==="buy"?"BUY":"SELL";if(e==="binance")return t.operation==="create"?{params:{symbol:t.symbol,side:r,type:"LIMIT",timeInForce:"GTC",quantity:t.baseSize,price:t.limitPrice,newClientOrderId:t.clientOrderId}}:{params:{symbol:t.symbol,orderId:t.venueOrderId}};if(e==="bybit"){let n=t.operation==="create"?{category:"spot",symbol:t.symbol,side:r==="BUY"?"Buy":"Sell",orderType:"Limit",qty:t.baseSize,price:t.limitPrice,timeInForce:"GTC",orderLinkId:t.clientOrderId,isLeverage:0}:{category:"spot",symbol:t.symbol,orderId:t.venueOrderId};return t.operation==="status"?{params:n}:{body:n}}if(e==="okx"){let n=t.operation==="create"?{instId:t.symbol,tdMode:"cash",clOrdId:t.clientOrderId,side:t.side,ordType:"limit",sz:t.baseSize,px:t.limitPrice}:{instId:t.symbol,ordId:t.venueOrderId};return t.operation==="status"?{params:n}:{body:n}}if(e==="coinbase")return{body:t.operation==="create"?{type:"limit",side:t.side,product_id:t.symbol,size:t.baseSize,price:t.limitPrice,time_in_force:"GTC",client_oid:t.clientOrderId}:void 0};throw new Error("cex: venue refused")}function Da({venue:e,order:t,timestamp:r,recvWindow:n=5e3}){mm(t);let o=xo[e]?.[t.operation];if(!o)throw new Error("cex: venue or operation refused");if(!Number.isSafeInteger(n)||n<1||n>5e3)throw new Error("cex: recvWindow refused");let i=String(r??"");if(!(e==="okx"?/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(i):e==="coinbase"?/^\d{10}(?:\.\d{1,3})?$/.test(i):/^\d{13}$/.test(i)))throw new Error("cex: timestamp refused");let[s,l]=o;l.includes("{order_id}")&&(l=l.replace("{order_id}",encodeURIComponent(bo(t.venueOrderId,"venueOrderId"))));let a={venue:e,operation:t.operation,method:s,path:l,timestamp:i,recvWindow:n,...wm(e,t)};return Object.freeze({...a,params:a.params&&Object.freeze(a.params),body:a.body&&Object.freeze(a.body),requestDigest:dm("sha256").update(Eo(a)).digest("hex")})}import{createHmac as hm}from"node:crypto";var tn=(e,t,r="hex")=>hm("sha256",e).update(t).digest(r),ja=e=>new URLSearchParams(Object.entries(e||{})).toString(),gm=e=>e===void 0?"":JSON.stringify(e),So=(e,t)=>{if(!(Array.isArray(e)||e instanceof Uint8Array)||e.length<4||[...e].some(r=>!Number.isInteger(r)||r<0||r>255))throw new Error(`cex: invalid ${t}`);return Buffer.from(e)};function ym(e,t){let r=So(e.apiSecretBytes,"credential"),n=t==="coinbase"?"base64":"raw";if(e.apiSecretEncoding!==n)throw r.fill(0),new Error("cex: explicit secret encoding refused");if(n==="raw")return r;try{let o=r.toString("ascii");if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(o))throw new Error("base64");let i=Buffer.from(o,"base64");if(i.length<4||i.toString("base64")!==o)throw i.fill(0),new Error("base64");return i}finally{r.fill(0)}}var ft=e=>Buffer.from(e).toString("utf8");function Fa(e,t){if(t?.venue!==e.venue)throw new Error("cex: credential venue mismatch");let r=So(t.apiKeyBytes,"credential"),n=ym(t,e.venue),o=t.passphraseBytes?So(t.passphraseBytes,"credential"):null;try{let i={accept:"application/json"},s=gm(e.body);s&&(i["content-type"]="application/json");let l=ja(e.params),a=e.path;if(e.venue==="binance"){let c=ja({...e.params,timestamp:e.timestamp,recvWindow:String(e.recvWindow)});l=`${c}&signature=${tn(n,c)}`,i["X-MBX-APIKEY"]=ft(r)}else if(e.venue==="bybit"){let c=e.method==="GET"?l:s;Object.assign(i,{"X-BAPI-API-KEY":ft(r),"X-BAPI-TIMESTAMP":e.timestamp,"X-BAPI-RECV-WINDOW":String(e.recvWindow),"X-BAPI-SIGN":tn(n,e.timestamp+ft(r)+e.recvWindow+c)})}else if(e.venue==="okx"){let c=a+(l?`?${l}`:"");Object.assign(i,{"OK-ACCESS-KEY":ft(r),"OK-ACCESS-SIGN":tn(n,e.timestamp+e.method+c+s,"base64"),"OK-ACCESS-TIMESTAMP":e.timestamp,"OK-ACCESS-PASSPHRASE":ft(o||Buffer.alloc(0))})}else Object.assign(i,{"CB-ACCESS-KEY":ft(r),"CB-ACCESS-SIGN":tn(n,e.timestamp+e.method+a+s,"base64"),"CB-ACCESS-TIMESTAMP":e.timestamp,"CB-ACCESS-PASSPHRASE":ft(o||Buffer.alloc(0))});return{url:cr[e.venue]+a+(l?`?${l}`:""),method:e.method,headers:i,body:s||void 0}}finally{r.fill(0),n.fill(0),o?.fill(0)}}var Ma=256*1024,bm=/^(?=[A-Za-z0-9._-]{1,128}$)(?=.*[A-Za-z0-9])[A-Za-z0-9._-]+$/;function Em(e,t,r){if(!t.includes("{order_id}"))return r===t;let[n,o]=t.split("{order_id}");if(!r.startsWith(n)||!r.endsWith(o))return!1;let i=r.slice(n.length,r.length-o.length||void 0),s;try{s=decodeURIComponent(i)}catch{return!1}if(!bm.test(s)||encodeURIComponent(s)!==i)return!1;try{return new URL(r,e).pathname===r&&r===`${n}${i}${o}`}catch{return!1}}async function Ao(e,t){let r=xo[e.venue]?.[e.operation],n=cr[e.venue];if(!r||!n||r[0]!==e.method||!Em(n,r[1],e.path))throw new Error("cex transport refused");let o=Fa(e,t),i=new AbortController,s=setTimeout(()=>i.abort(),5e3);try{let l=await fetch(o.url,{method:o.method,headers:o.headers,body:o.body,redirect:"manual",signal:i.signal});if(l.status<200||l.status>=300)throw new Error("http status");if(l.status>=300&&l.status<400)throw new Error("redirect");let a=new URL(l.url||o.url),c=new URL(cr[e.venue]);if(a.origin!==c.origin)throw new Error("origin");if(!String(l.headers.get("content-type")||"").toLowerCase().startsWith("application/json"))throw new Error("content type");let d=Number(l.headers.get("content-length"));if(Number.isFinite(d)&&d>Ma)throw new Error("size");let u=new Uint8Array(await l.arrayBuffer());if(u.length>Ma)throw new Error("size");let m;try{m=JSON.parse(new TextDecoder().decode(u))}catch{throw new Error("json")}return{statusCode:l.status,value:m,responseBodyBytes:u}}catch{throw new Error("cex transport refused")}finally{clearTimeout(s);for(let l of Object.values(o.headers));o.headers=null,o.body=void 0}}var Sm=e=>xm("sha256").update(e).digest("hex"),Am=(e,t)=>e==="okx"?new Date(t).toISOString():String(e==="coinbase"?t/1e3:t),vo=e=>/^(?=[A-Za-z0-9._-]{1,128}$)(?=.*[A-Za-z0-9])[A-Za-z0-9._-]+$/.test(String(e||""))?String(e):null,lr=e=>typeof e=="string"&&/^(?:0|[1-9]\d*)(?:\.\d+)?$/.test(e)?e:null;var qa=e=>/^0(?:\.0+)?$/.test(String(e));function vm(e,t){if(!lr(e)||!lr(t))throw new Error("cex authoritative decimal refused");let[r,n=""]=e.split("."),[o,i=""]=t.split("."),s=n.length+i.length,l=BigInt(r+n)*BigInt(o+i);if(!s)return l.toString();let a=l.toString().padStart(s+1,"0");return`${a.slice(0,-s)}.${a.slice(-s)}`}function Im(e,t,r){let n,o,i;return e==="binance"&&t?.code===void 0?(n=t?.orderId,o=t?.symbol,i=t?.clientOrderId):e==="bybit"&&t?.retCode===0?(n=t?.result?.orderId,o=t?.result?.symbol,i=t?.result?.orderLinkId):e==="okx"&&t?.code==="0"&&t?.data?.length===1&&t.data[0]?.sCode==="0"?(n=t.data[0].ordId,o=t.data[0].instId,i=t.data[0].clOrdId):e==="coinbase"&&!t?.message&&(n=t?.id,o=t?.product_id,i=t?.client_oid),o!==void 0&&o!==r.symbol||i!==void 0&&i!==r.clientOrderId?null:vo(n)}function km(e,t,r){let n=null;return e==="binance"&&t&&typeof t=="object"&&t.code===void 0?n=t.orderId:e==="bybit"&&t?.retCode===0?n=t?.result?.orderId:e==="okx"&&t?.code==="0"&&t?.data?.length===1&&t.data[0]?.sCode==="0"?n=t.data[0].ordId:e==="coinbase"&&typeof t=="string"&&(n=t),vo(n)===r.venueOrderId}function Om(e,t,r){let n=t,o,i,s,l,a;if(e==="binance"?(o=t?.orderId,i=t?.clientOrderId,s=t?.symbol,l={CANCELED:"cancelled",REJECTED:"rejected",FILLED:"filled",PARTIALLY_FILLED:"partial",NEW:"open",PENDING_CANCEL:"open"}[t?.status],a=t?.cummulativeQuoteQty):e==="bybit"&&t?.retCode===0&&t?.result?.list?.length===1?(n=t.result.list[0],o=n.orderId,i=n.orderLinkId,s=n.symbol,l={Cancelled:"cancelled",Rejected:"rejected",Filled:"filled",PartiallyFilled:"partial",New:"open"}[n.orderStatus],a=n.cumExecValue):e==="okx"&&t?.code==="0"&&t?.data?.length===1?(n=t.data[0],o=n.ordId,i=n.clOrdId,s=n.instId,l={canceled:"cancelled",filled:"filled",partially_filled:"partial",live:"open"}[n.state],lr(n.accFillSz)&&lr(n.avgPx)&&(qa(n.accFillSz)||!qa(n.avgPx))&&(a=vm(n.accFillSz,n.avgPx))):e==="coinbase"&&(o=t?.id,i=t?.client_oid,s=t?.product_id,l=t?.status==="done"?t?.done_reason==="canceled"?"cancelled":"filled":{rejected:"rejected",open:"open",pending:"open",active:"open"}[t?.status],a=t?.executed_value),vo(o)!==r.venueOrderId||String(s||"")!==r.symbol||r.clientOrderId&&String(i||"")!==r.clientOrderId||!l||!lr(a))throw new Error("cex authoritative status identity refused");return{status:l,filledQuote:a}}async function Tm(e,t){let r=t?.nowMs?.()??Date.now(),n=t?.transport||Ao,o=t.credential(e.credentialRef);if(!o||o.accountId!==e.accountId||o.venue!==e.venue)throw new Error("cex: credential binding refused");let i=e.order.operation!=="create"?e.store.requirePrior({...e,...e.order}):null,s=i?.tradeId||e.tradeId,l=Da({venue:e.venue,order:e.order,timestamp:Am(e.venue,r),recvWindow:5e3}),a;e.order.operation==="create"?a=e.store.prepare({tradeId:e.tradeId,venue:e.venue,accountId:e.accountId,credentialRef:e.credentialRef,symbol:e.order.symbol,clientOrderId:e.order.clientOrderId,reservedNotional:e.reservedNotional,requestDigest:l.requestDigest,nowMs:r}):a=e.store.transition(s,["open","uncertain","sent","cancel-pending","settlement-pending"],"prepared",{operation:e.order.operation,requestDigest:l.requestDigest,nowMs:r}),e.store.transition(s,"prepared","sent",{sentAtMs:r});let c;try{c=await n(l,o)}catch{throw e.store.transition(s,"sent","uncertain",{uncertainAtMs:r}),new Error("cex transport refused; order is uncertain and requires status reconciliation")}let d=Sm(c.responseBodyBytes);if(e.order.operation==="create"){let f=Im(e.venue,c.value,e.order);if(!f)throw e.store.transition(s,"sent","uncertain",{responseDigest:d}),new Error("cex response refused; order is uncertain and requires status reconciliation");return e.store.transition(s,"sent","open",{venueOrderId:f,responseDigest:d,openedAtMs:r})}if(e.order.operation==="cancel")return e.store.transition(s,"sent",km(e.venue,c.value,i)?"cancel-pending":"uncertain",{responseDigest:d,observedAtMs:r});let u;try{u=Om(e.venue,c.value,i)}catch{return e.store.transition(s,"sent","uncertain",{responseDigest:d,observedAtMs:r})}let m=["cancelled","rejected","filled"].includes(u.status);if(m||u.status==="partial"){e.store.transition(s,"sent","settlement-pending",{responseDigest:d,observedAtMs:r,status:u.status,filledQuote:u.filledQuote});let f=m&&(u.status==="cancelled"||u.status==="rejected")&&/^0(?:\.0+)?$/.test(u.filledQuote)?"release":"commit";return await t.settleLedger({tradeId:i.tradeId,filledQuote:u.filledQuote,disposition:f}),e.store.transition(s,"settlement-pending","terminal",{settledAtMs:r})}return e.store.transition(s,"sent","open",{responseDigest:d,observedAtMs:r,status:u.status,filledQuote:u.filledQuote})}function Ha(e){if(!e||typeof e.credential!="function"||typeof e.settleLedger!="function")throw new Error("cex: sealed runtime dependencies required");let t=Object.freeze({credential:e.credential,transport:e.transport||Ao,nowMs:e.nowMs||Date.now,settleLedger:e.settleLedger});return Object.freeze({execute:r=>Tm(r,t)})}import{createHash as Nm,createHmac as za,randomBytes as Cm,timingSafeEqual as _m}from"node:crypto";var Ua="oracle-local-signer-cex-owner-allow-v1",Ft=e=>/^(?:0|[1-9]\d{0,19})$/.test(String(e||""))?String(e):null,Wa=e=>JSON.stringify(e),Rm=(e,t)=>{let r=Buffer.from(String(e)),n=Buffer.from(String(t));return r.length===n.length&&_m(r,n)};function Va({keyFile:e,approvedTelegramOwners:t,nowMs:r=Date.now}={}){if(!e)throw new Error("cex owner proof: signer policy key required");let n=new Set((t||[]).map(Ft).filter(Boolean));if(!n.size)throw new Error("cex owner proof: approved owner context required");let o=new Set,i=l=>{let a=Buffer.from(L(e));try{return l(a)}finally{a.fill(0)}},s=i(l=>Nm("sha256").update("cex-owner-instance\0").update(l).digest("hex"));return Object.freeze({mint({digest:l,senderId:a,chatId:c,platform:d,ttlMs:u=15e3}={}){let m=Ft(a),f=Ft(c),p=r();if(d!=="telegram"||!m||f!==m||!n.has(m))throw new Error("cex owner proof: exact Telegram owner DM required");if(!/^[0-9a-f]{64}$/.test(String(l||""))||!Number.isSafeInteger(u)||u<1||u>3e4)throw new Error("cex owner proof: binding refused");let w={version:1,decision:"Allow",digest:l,ownerSenderId:m,telegramChatId:f,audience:Ua,instance:s,nonce:Cm(16).toString("hex"),issuedAtMs:p,expiresAtMs:p+u},g=i(h=>za("sha256",h).update(Wa(w)).digest("hex"));return{claims:w,mac:g}},verify(l,{digest:a}={}){let c=l?.claims,d=r();if(!c||c.version!==1||c.decision!=="Allow"||c.digest!==a||c.audience!==Ua||c.instance!==s||!/^[0-9a-f]{32}$/.test(c.nonce||"")||Ft(c.ownerSenderId)!==Ft(c.telegramChatId)||!n.has(Ft(c.ownerSenderId))||!Number.isSafeInteger(c.issuedAtMs)||!Number.isSafeInteger(c.expiresAtMs)||c.expiresAtMs<=d||c.issuedAtMs>d||c.expiresAtMs-c.issuedAtMs>3e4||o.has(c.nonce))return!1;let u=i(m=>za("sha256",m).update(Wa(c)).digest("hex"));return Rm(l.mac,u)?(o.add(c.nonce),!0):!1}})}var Re=new Co(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Ka=new Co(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),ko=new Co(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Mm({isArmed:e,disarmNow:t}){if(typeof e!="function"||typeof t!="function")throw new TypeError("signer: serialized arm fence callbacks required");let r=1,n=Promise.resolve(),o=i=>{let s=n.then(i,i);return n=s.then(()=>{},()=>{}),s};return Object.freeze({armGeneration:()=>r,disarm:()=>o(()=>(r+=1,t(),!0)),broadcastWithArmFence:(i,s)=>o(async()=>{if(i!==r||!e())throw new Error("signer: disarmed generation changed before broadcast handoff");return s()})})}function qm(e){let t=process.env.ORACLE_SIGNER_STATE_DIR||re.join(process.env.XDG_STATE_HOME||re.join(Lm.homedir(),".local","state"),"oracle"),r=$m("sha256").update(re.resolve(e)).digest("hex").slice(0,16);return{vault:re.join(e,"vault.json"),policy:re.join(e,"signer-policy.json"),policyKey:re.join(e,"policy-integrity-key"),policyAnchor:re.join(t,`signer-policy-${r}.high-water`),ledger:re.join(e,"signer-ledger.json"),ledgerAnchor:re.join(t,`signer-ledger-${r}.high-water`),executionOutbox:re.join(e,"signer-execution-outbox.json"),cexOrders:re.join(e,"cex-orders.json"),cexOrdersAnchor:re.join(t,`cex-orders-${r}.high-water`),token:re.join(e,"signer-token"),lock:re.join(t,`signer-${r}.lock`),workflowLedger:re.join(e,"workflow-events.jsonl")}}function Hm(e){try{return L(e)}catch(r){if(r.code!=="ENOENT")throw r}let t=Pm(32).toString("hex");return Ae(e,t+`
-`),t}function Oo(e,t,r){if(!t)throw new Error(`signer: ${e} key is required by policy`);let n=new Set((r||[]).map(o=>String(o).toLowerCase()));if(!t.addresses.some(o=>n.has(String(o).toLowerCase())))throw new Error(`signer: ${e} vault address is not an allowed policy owner`);return!0}function Ga(e){return e.surfaces.some(t=>String(t).startsWith("evm"))}function K(e,t){return e.surfaces.includes(t)}function _e(e,t){let r=String(e||"").toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(r))throw new Error(`signer: invalid ${t}`);return r}function Ya(e,t){return Object.entries(e||{}).find(([r])=>r.toLowerCase()===t)?.[1]}function zm(e,t){let r=e?.anvilQuote;if(!r||typeof r!="object"||Array.isArray(r))throw new Error("signer: exact prepared Anvil quote is required");if(!e?.artifact?.anvilQuote||JSON.stringify(e.artifact.anvilQuote)!==JSON.stringify(r))throw new Error("signer: exact prepared Anvil quote artifact mismatch");return Object.freeze(t==="buy"?{totalCostRaw:BigInt(r.totalCostRaw).toString(),baseCostRaw:BigInt(r.baseCostRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString(),available:r.available===!0}:{netPayoutRaw:BigInt(r.netPayoutRaw).toString(),grossPayoutRaw:BigInt(r.grossPayoutRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString()})}function Um(e,t,r){if(e.preconditions?.exactQuoteConfirmed!==!0)throw new Error("signer: exact prepared Anvil quote confirmation required");let n=e.artifact,o=t==="buy"?[r.totalCostRaw,e.maxPaymentTokenAmountRaw,n?.maxPaymentTokenAmountRaw,e.exactQuoteTotalCostRaw,n?.exactQuoteTotalCostRaw,e.preconditions?.confirmedTotalCostRaw]:[r.netPayoutRaw,e.minPayoutRaw,n?.minPayoutRaw,e.exactQuoteNetPayoutRaw,n?.exactQuoteNetPayoutRaw,e.preconditions?.confirmedNetPayoutRaw],i;try{i=BigInt(o[0]);for(let c of o.slice(1))if(BigInt(c)!==i)throw new Error("mismatch")}catch{throw new Error(`signer: exact Anvil ${t} settlement limit mismatch`)}let s=n?.transactions;if(!Array.isArray(s)||s.length!==1)throw new Error("signer: exact Anvil action transaction required");let l=t==="buy"?"buySpecificNFT":"sellNFT",a;try{if(a=Re.decodeFunctionData(l,s[0].data),Re.encodeFunctionData(l,[a[0],a[1]]).toLowerCase()!==String(s[0].data).toLowerCase())throw new Error("non-canonical")}catch{throw new Error(`signer: exact Anvil ${t} calldata required`)}if(BigInt(a[0])!==BigInt(e.tokenId)||BigInt(a[1])!==i)throw new Error(`signer: exact Anvil ${t} calldata limit mismatch`);return i}async function ze(e,t,r,n,o,i=[]){let s=await e.send("eth_call",[{to:t,data:r.encodeFunctionData(n,i)},o]);return r.decodeFunctionResult(n,s)[0]}async function Wm(e,t,r,{nowMs:n=Date.now(),signerAddress:o}={}){if(t?.surface!=="evm-nft"||String(t?.provider).toLowerCase()!=="anvil-nft")return null;if(!e||typeof e.send!="function")throw new Error("signer: trusted RPC cannot attest Anvil market");let i=_e(t.destination,"Anvil market"),s=_e(t.contract,"Anvil collection"),l=_e(t.paymentToken,"Anvil payment token"),a=BigInt(t.nativeSwapFeeWei),c=Number(t.paymentTokenDecimals),d=_e(o,"Anvil signer identity"),u=_e(t.owner,"Anvil envelope owner");if(d!==u)throw new Error("signer: Anvil signer identity mismatch");let m=BigInt(t.tokenId);if(m<0n)throw new Error("signer: invalid Anvil tokenId");let f=String(t.nftAction||"").toLowerCase();if(f!=="buy"&&f!=="sell")throw new Error("signer: unsupported Anvil NFT action");let p=zm(t,f),w=Um(t,f,p),g=t.anvilAttestation;if(!g||typeof g!="object"||Number(g.snapshotExpiresAtMs)<=Number(n))throw new Error("signer: fresh provider Anvil attestation required");let h=String(Ya(r.anvilRuntimeCodeHashes,i)||"").toLowerCase();if(!/^0x[0-9a-f]{64}$/.test(h)||h!==String(g.runtimeCodeHash||"").toLowerCase())throw new Error("signer: Anvil runtime is not reviewed by policy");let y=Ya(r.nftPaymentTokenCaps,l);if(!y||Number(y.decimals)!==c)throw new Error("signer: Anvil payment token decimals are not reviewed by policy");let b=String(await e.send("eth_chainId",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(b)||BigInt(b)!==4663n)throw new Error("signer: trusted RPC Anvil chain mismatch");let x=String(await e.send("eth_blockNumber",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(x))throw new Error("signer: trusted RPC returned an invalid Anvil block number");let A=BigInt(x),k=await e.send("eth_getBlockByNumber",[x,!1]),v=String(k?.hash||"").toLowerCase();if(String(k?.number||"").toLowerCase()!==x||!/^0x[0-9a-f]{64}$/.test(v))throw new Error("signer: trusted RPC returned an invalid Anvil block attestation");let _=Object.freeze({blockHash:v,requireCanonical:!0}),C=String(await e.send("eth_getCode",[i,_])).toLowerCase();if(!/^0x[0-9a-f]+$/.test(C)||C==="0x")throw new Error("signer: Anvil market runtime is empty");let z=jm(C).toLowerCase();if(z!==h)throw new Error("signer: Anvil market runtime mismatch with reviewed policy");let[U,R,$]=await Promise.all([ze(e,i,Re,"collection",_),ze(e,i,Re,"token",_),ze(e,i,Re,"robinhoodSwapFeeWei",_)]),Ke=_e(U,"live Anvil collection"),pt=_e(R,"live Anvil payment token"),Mt=BigInt($).toString();if(Ke!==s)throw new Error("signer: live Anvil collection mismatch");if(pt!==l)throw new Error("signer: live Anvil payment token mismatch");if(Mt!==a.toString())throw new Error("signer: live Anvil native swap fee mismatch");let qt=Number(await ze(e,pt,Ka,"decimals",_));if(!Number.isSafeInteger(qt)||qt!==c)throw new Error("signer: live Anvil payment token decimals mismatch");let mt=_e(await ze(e,Ke,ko,"ownerOf",_,[m]),"live Anvil token owner"),Ge=null,Ye=null,Xe=null,Ze=null,M;if(f==="buy"){let[Ue,wt,E]=await Promise.all([ze(e,i,Re,"inventory",_,[m]),ze(e,pt,Ka,"allowance",_,[d,i]),e.send("eth_call",[{to:i,data:Re.encodeFunctionData("quoteSpecificBuy",[m])},_])]);Ge=!!Ue,Ye=BigInt(wt).toString();let I=Re.decodeFunctionResult("quoteSpecificBuy",E);if(M=Object.freeze({totalCostRaw:BigInt(I[0]).toString(),baseCostRaw:BigInt(I[1]).toString(),feeRaw:BigInt(I[2]).toString(),protocolFeeRaw:BigInt(I[3]).toString(),available:!!I[4]}),JSON.stringify(M)!==JSON.stringify(p))throw new Error("signer: exact Anvil buy quote changed after preparation");if(mt!==i)throw new Error("signer: exact Anvil token owner is not the market");if(!Ge)throw new Error("signer: exact Anvil token is not in market inventory");if(BigInt(Ye)!==BigInt(t.preconditions?.allowanceRaw))throw new Error("signer: live Anvil ERC20 allowance changed after preparation");if(BigInt(Ye)<w)throw new Error("signer: live Anvil ERC20 allowance is insufficient");if(!M.available)throw new Error("signer: exact Anvil buy quote is unavailable");if(BigInt(M.totalCostRaw)!==w)throw new Error("signer: live Anvil buy quote does not equal exact payment limit");if(BigInt(M.totalCostRaw)!==BigInt(M.baseCostRaw)+BigInt(M.feeRaw)+BigInt(M.protocolFeeRaw))throw new Error("signer: exact Anvil buy quote fee arithmetic mismatch")}else{let[Ue,wt,E]=await Promise.all([ze(e,Ke,ko,"getApproved",_,[m]),ze(e,Ke,ko,"isApprovedForAll",_,[d,i]),e.send("eth_call",[{to:i,data:Re.encodeFunctionData("quoteSellNFT")},_])]);Xe=_e(Ue,"live Anvil token approval"),Ze=!!wt;let I=Re.decodeFunctionResult("quoteSellNFT",E);if(M=Object.freeze({netPayoutRaw:BigInt(I[0]).toString(),grossPayoutRaw:BigInt(I[1]).toString(),feeRaw:BigInt(I[2]).toString(),protocolFeeRaw:BigInt(I[3]).toString()}),JSON.stringify(M)!==JSON.stringify(p))throw new Error("signer: exact Anvil sell quote changed after preparation");if(mt!==d)throw new Error("signer: exact Anvil token owner does not match signer");if(Xe!==i&&!Ze)throw new Error("signer: live Anvil NFT approval is insufficient");if(Xe!==_e(t.preconditions?.approvedAddress,"prepared Anvil token approval")||Ze!==!!t.preconditions?.approvedForAll)throw new Error("signer: live Anvil NFT approval changed after preparation");if(BigInt(M.netPayoutRaw)!==w)throw new Error("signer: live Anvil sell quote does not equal exact payout limit");if(BigInt(M.netPayoutRaw)+BigInt(M.feeRaw)+BigInt(M.protocolFeeRaw)!==BigInt(M.grossPayoutRaw))throw new Error("signer: exact Anvil sell quote fee arithmetic mismatch")}return Object.freeze({source:"local-signer-trusted-rpc",chainId:4663,market:i,collection:Ke,paymentToken:pt,paymentTokenDecimals:qt,nativeSwapFeeWei:Mt,signerAddress:d,nftAction:f,tokenId:m.toString(),tokenOwner:mt,inventoryMember:Ge,allowanceRaw:Ye,approvedAddress:Xe,approvedForAll:Ze,quote:M,blockNumber:A.toString(),blockHash:v,runtimeCodeHash:z,verifiedAtMs:Number(n)})}function Xa(e,t,r="execution"){if(!e||!t)throw new Error("signer: complete Anvil revalidation evidence required");for(let n of["runtimeCodeHash","market","collection","paymentToken","paymentTokenDecimals","nativeSwapFeeWei","signerAddress","nftAction","tokenId","tokenOwner","inventoryMember","allowanceRaw","approvedAddress","approvedForAll"])if(String(t[n]).toLowerCase()!==String(e[n]).toLowerCase())throw new Error(`signer: Anvil ${n} changed after simulation at ${r}`);if(JSON.stringify(t.quote)!==JSON.stringify(e.quote))throw new Error(`signer: Anvil quote changed after simulation at ${r}`);return!0}function Vm(e,t,r,n,{nowMs:o=Date.now(),timeoutMs:i=15e3,signerAddress:s}={}){let l=Dm(new URL("./anvil-attestation-worker.mjs",import.meta.url)),a={anvilRuntimeCodeHashes:n?.anvilRuntimeCodeHashes,nftPaymentTokenCaps:n?.nftPaymentTokenCaps},c;try{c=Bm(process.execPath,[l],{input:JSON.stringify({rpcUrl:e,chainId:t,envelope:r,policy:a,nowMs:Number(o),signerAddress:s}),encoding:"utf8",timeout:i,maxBuffer:64e3,env:{PATH:process.env.PATH||"",HOME:process.env.HOME||"",NODE_OPTIONS:""},stdio:["pipe","pipe","pipe"]})}catch{throw new Error("signer: fresh independent Anvil attestation failed before reservation")}let d;try{d=JSON.parse(c)}catch{throw new Error("signer: invalid Anvil reservation attestation result")}if(!d||d.source!=="local-signer-trusted-rpc"||!/^0x[0-9a-f]{64}$/.test(String(d.blockHash||"")))throw new Error("signer: invalid Anvil reservation attestation result");return Object.freeze(d)}async function ur(e,t){let r=await fetch(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),n=await r.text();if(!r.ok)throw new Error(`rpc: HTTP ${r.status}`);let o=JSON.parse(n||"{}");if(o.error)throw new Error(`rpc: ${o.error.message||"request failed"}`);return o.result}function No(e){let t=Buffer.from(e),r=t[0]===128?t[1]:t[0];if(!Number.isInteger(r)||r<1||r>8)throw new Error(`signer: Solana message declares an implausible signature count (${r})`);return r}function To(e,t){let r=Array.isArray(t)?t:[t],n=No(e);if(r.length!==n)throw new Error(`signer: Solana message needs ${n} signature(s), got ${r.length}`);for(let o of r)if(Buffer.from(o).length!==64)throw new Error("signer: Solana signature must be 64 bytes");return Buffer.concat([Buffer.from([n]),...r.map(o=>Buffer.from(o)),Buffer.from(e)]).toString("base64")}function Jm({provider:e=null,readPolicy:t,rpc:r=ur,fetchImpl:n=fetch}={}){if(typeof t!="function")throw new TypeError("signer: execution observer requires readPolicy");return async o=>{let i=String(o?.surface||""),s=String(o?.signedTransactionId||"");if(!s)throw new Error("signer: execution observer requires signed transaction identity");if(i==="evm"||i==="evm-swap"||i==="evm-bridge"||i==="evm-nft"){if(!e||typeof e.getTransactionReceipt!="function")return null;let a=await e.getTransactionReceipt(s);return a?{transactionHash:s,status:a.status}:null}let l=t();if(i==="hl"){let{owner:a,cloid:c}=o;if(!/^0x[0-9a-f]{40}$/i.test(String(a))||!/^0x[0-9a-f]{32}$/i.test(String(c)))return null;let d=o.hlTestnet===!0?"https://api.hyperliquid-testnet.xyz/info":"https://api.hyperliquid.xyz/info",u=await n(d,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({type:"orderStatus",user:a,oid:c})});if(!u.ok)return null;let m=await u.json();if(m?.status!=="order"||m.order?.order?.cloid!==c)return null;let{status:f,order:p}=m.order;if(f==="filled")return{transactionHash:s,status:1,order:{orderId:String(p.oid),status:"filled",cloid:c}};let w=y=>/^\d+(?:\.\d+)?$/.test(String(y))?String(y).replace(/^0+(?=\d)/,"").replace(/(\.\d*?)0+$/,"$1").replace(/\.$/,""):null,g=w(p.origSz),h=w(p.sz);return(/^(?:canceled|rejected|scheduledCancel)$/.test(f)||/(?:Canceled|Rejected)$/.test(f))&&g!==null&&Number(g)>0&&g===h?{transactionHash:s,status:0}:null}if(i==="sol"){let a=String(l.solRpcUrl||l.solanaRpcUrl||"");if(!a)return null;let d=(await r(a,{jsonrpc:"2.0",id:1,method:"getSignatureStatuses",params:[[s],{searchTransactionHistory:!0}]}))?.value?.[0];return d?d.err?{transactionHash:s,status:0}:d.confirmationStatus==="confirmed"||d.confirmationStatus==="finalized"||d.confirmations===null?{transactionHash:s,status:1}:null:null}if(i==="btc"){let a=String(l.btcRpcUrl||l.bitcoinRpcUrl||"").replace(/\/$/,"");if(!a)return null;try{let c=a.endsWith("/tx")?a.slice(0,-3):a,d=await n(`${c}/tx/${s}/status`);if(d.ok)return(await d.json())?.confirmed===!0?{transactionHash:s,status:1}:null}catch{}try{let c=await r(a,{jsonrpc:"1.0",id:"oracle",method:"getrawtransaction",params:[s,!0]});return Number(c?.confirmations||0)>0?{transactionHash:s,status:1}:null}catch{return null}}return null}}async function Qa(e,t,r){let n=String(e.btcRpcUrl||e.bitcoinRpcUrl||"").replace(/\/$/,"");if(!n)throw new Error("signer: btcRpcUrl required for Bitcoin simulation and broadcast");return ur(n,{jsonrpc:"1.0",id:"oracle",method:t,params:r})}async function Km(e,t,r){let n=String(e.btcRpcUrl||e.bitcoinRpcUrl||"").replace(/\/$/,"");if(!n)throw new Error("signer: btcRpcUrl required for Bitcoin simulation");let o=n.endsWith("/tx")?n.slice(0,-3):n;try{let s=await fetch(`${o}/tx/${t}/outspend/${r}`);if(s.ok){let l=await s.json();if(l?.spent===!0)throw new Error("signer: Bitcoin input already spent");if(l?.spent===!1)return!0}}catch(s){if(/already spent/.test(String(s?.message||s)))throw s}if(!await Qa(e,"gettxout",[t,Number(r),!0]))throw new Error("signer: Bitcoin input unavailable for simulation");return!0}function Gm(e){if(!e||typeof e!="object"||!e.value||typeof e.value!="object"||!Object.prototype.hasOwnProperty.call(e.value,"err"))throw new Error("signer: Solana simulation result missing");if(e.value.err!==null)throw new Error("signer: Solana simulation failed");return!0}function Ym(e,t,{fetchImpl:r=fetch}={}){return{simulate:async(n,o)=>(Pe(o,e()),!0),sign:async(n,o)=>{Pe(o,e());let i=e();if(!(Array.isArray(i.owners)?i.owners:[]).some(l=>String(l).toLowerCase()===String(t.address).toLowerCase()))throw new Error("signer: HL wallet is not an allowed policy owner");if(String(o.owner||"").toLowerCase()!==String(t.address).toLowerCase())throw new Error("signer: HL wallet must match envelope owner");return n?.typedData?(qi(n),t.signTypedData(n.typedData.domain,n.typedData.types,n.typedData.message)):Hi({wallet:t,action:n.action,nonce:n.nonce,isMainnet:!String(n.submitTo||"").includes("testnet")})},broadcast:async(n,o,i)=>{Pe(i,e());let{Signature:s,keccak256:l}=await import("ethers"),a=s.from(n),c=await r(o.submitTo,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({action:o.action,nonce:o.nonce,signature:{r:a.r,s:a.s,v:a.v}})}),d=await c.json();if(!c.ok||d?.status!=="ok")throw new Error("signer: Hyperliquid exchange rejected the action");let u=o.action.type==="order"?d.response?.data?.statuses?.[0]:null;if(u&&Object.hasOwn(u,"error"))throw new Error("signer: Hyperliquid rejected the order");let m=u?.filled?"filled":u?.resting?"resting":null,f=m?u[m]:null;return{hash:l(n),status:1,...f?.oid!=null?{order:{orderId:String(f.oid),status:m,cloid:o.action.orders[0].c??null}}:{}}}}}function Xm(e){return{simulate:async(t,r)=>(De(r,e()),!0),sign:async(t,r)=>{De(r,e());let n=e();if(typeof n.lighterSignImpl!="function")throw new Error("lighter: official Lighter signer required");let o=await n.lighterSignImpl(t,r);return er(t,o),typeof o=="string"?o:JSON.stringify(o)},broadcast:async(t,r,n)=>{let o=De(n,e()),i=er(r,t),s=Wi(i),l=await fetch(o.submitTo,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:s}),a=await l.json().catch(()=>({}));if(!l.ok||Number(a?.code)!==200)throw new Error("signer: Lighter sendTx rejected the order");return{hash:String(a?.tx_hash||a?.txHash||"lighter"),status:1}}}}function Zm(e,t){return{simulate:async(r,n)=>(rt(n,e()),!0),sign:async(r,n)=>{rt(n,e());let o=e();if(!(Array.isArray(o.owners)?o.owners:[]).some(c=>String(c).toLowerCase()===String(t.address).toLowerCase()))throw new Error("signer: order wallet is not an allowed policy owner");if(String(n.owner||"").toLowerCase()!==String(t.address).toLowerCase())throw new Error("signer: order wallet must match envelope owner");let s=r.domain||r.typedData.domain,l=r.types||r.typedData.types,a=r.message||r.typedData.message;return t.signTypedData(s,l,a)},broadcast:async(r,n,o)=>{let i=rt(o,e()),{keccak256:s}=await import("ethers"),l=n.message||n.typedData.message,a=i.kind==="cow"?{sellToken:l.sellToken,buyToken:l.buyToken,receiver:l.receiver,sellAmount:l.sellAmount,buyAmount:l.buyAmount,validTo:l.validTo,appData:l.appData,feeAmount:l.feeAmount,kind:l.kind,partiallyFillable:l.partiallyFillable,sellTokenBalance:l.sellTokenBalance,buyTokenBalance:l.buyTokenBalance,from:o.owner,signature:r,signingScheme:"eip712",quoteId:n.quoteId??void 0}:{orderHash:i.digest,signature:r,data:l},c=await fetch(i.submitTo,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)}),d=await c.json().catch(()=>({}));if(!c.ok||d?.error||d?.success===!1)throw new Error(i.kind==="cow"?"signer: CoW orderbook rejected the order":"signer: 1inch orderbook rejected the order");return{hash:s(r),status:1,orderHash:i.digest,uid:typeof d=="string"?d:d?.uid||null}}}}function Qm(e,t){return{simulate:async(r,n)=>(Be(n,e()),!0),sign:async(r,n)=>{Be(n,e());let o=e();if(!(Array.isArray(o.owners)?o.owners:[]).some(s=>String(s).toLowerCase()===String(t.address).toLowerCase()))throw new Error("signer: Poly wallet is not an allowed policy owner");if(String(n.owner||"").toLowerCase()!==String(t.address).toLowerCase())throw new Error("signer: Poly wallet must match envelope owner");return t.signTypedData(r.domain,r.types,r.message)},broadcast:async(r,n,o)=>{let i=e(),s=Be(o,i),l=En(i),{keccak256:a}=await import("ethers"),c=di({message:n.message,side:n.side,signature:r,orderType:n.orderType||"GTC",apiKey:l.key}),d=JSON.stringify(c),u=li({creds:l,address:o.owner,method:"POST",path:"/order",body:d}),m=await fetch(s.submitTo,{method:"POST",headers:u,body:d}),f=await m.json().catch(()=>({}));if(!m.ok||f?.success===!1||f?.error||f?.errorMsg)throw new Error("signer: Polymarket CLOB rejected the order");return{hash:a(r),status:1}}}}function ew(e,t){let r=go(t);return{simulate:async n=>{let o=e(),i=Io.fromPSBT(Buffer.from(n.psbt,"base64"));return await Promise.all(Array.from({length:i.inputsLength},(s,l)=>{let a=i.getInput(l),c=Buffer.from(a.txid||[]).toString("hex");return Km(o,c,a.index)})),!0},sign:n=>{let o=Io.fromPSBT(Buffer.from(n.psbt,"base64"));return o.sign(r),Buffer.from(o.toPSBT()).toString("base64")},broadcast:async n=>{let o=e(),i=String(o.btcRpcUrl||o.bitcoinRpcUrl||"").replace(/\/$/,"");if(!i)throw new Error("signer: btcRpcUrl required for Bitcoin broadcast");let s=Io.fromPSBT(Buffer.from(n,"base64"));s.finalize(),s.extract();let l;try{let c=await fetch(i.endsWith("/tx")?i:`${i}/tx`,{method:"POST",headers:{"content-type":"text/plain"},body:s.hex});if(l=(await c.text()).trim(),!c.ok)throw new Error(`signer: Bitcoin broadcast failed ${c.status}`)}catch(c){if(!/Bitcoin broadcast failed 404/.test(String(c?.message||c)))throw c;l=await Qa(o,"sendrawtransaction",[s.hex])}if(l&&String(l).toLowerCase()!==s.id.toLowerCase())throw new Error("signer: Bitcoin broadcast txid mismatch");let a=null;try{let c=i.endsWith("/tx")?i.slice(0,-3):i,d=await fetch(`${c}/tx/${s.id}/status`);d.ok&&(a=(await d.json())?.confirmed===!0?1:null)}catch{}return{hash:s.id,status:a}}}}function tw(e,t){let r=go(t);return{simulate:async n=>{let o=e(),i=String(o.solRpcUrl||o.solanaRpcUrl||"");if(!i)throw new Error("signer: solRpcUrl required for Solana simulation");let s=Buffer.from(n.messageBase64,"base64"),l=No(s),a=To(s,Array.from({length:l},()=>new Uint8Array(64))),c=await ur(i,{jsonrpc:"2.0",id:1,method:"simulateTransaction",params:[a,{encoding:"base64",sigVerify:!1,replaceRecentBlockhash:!1}]});return Gm(c)},sign:n=>{let o=Buffer.from(n.messageBase64,"base64"),i=No(o),s=Fm.sign(o,r);if(i===1)return To(o,[s]);let l=Array.isArray(n.cosignatures)?n.cosignatures:[];if(l.length!==i-1)throw new Error(`signer: Solana message needs ${i-1} cosignature(s), got ${l.length}`);return To(o,[s,...l.map(a=>Buffer.from(String(a),"base64"))])},broadcast:async n=>{let o=e(),i=String(o.solRpcUrl||o.solanaRpcUrl||"");if(!i)throw new Error("signer: solRpcUrl required for Solana broadcast");let s=await ur(i,{jsonrpc:"2.0",id:1,method:"sendTransaction",params:[n,{encoding:"base64",skipPreflight:!1,maxRetries:3}]}),a=(await ur(i,{jsonrpc:"2.0",id:1,method:"getSignatureStatuses",params:[[s],{searchTransactionHistory:!0}]}))?.value?.[0];if(a?.err)return{hash:s,status:0};let c=a?.confirmationStatus==="confirmed"||a?.confirmationStatus==="finalized"||a?.confirmations===null;return{hash:s,status:c?1:null}}}}function rw(e,t={}){for(let r of Object.keys(t||{}))if(Object.prototype.hasOwnProperty.call(e,r))throw new Error(`signer: cannot replace built-in ${r} transport`)}async function nw(e,t,r,n,{submitPrivate:o}={}){if((await e.getNetwork()).chainId!==BigInt(r.chainId))throw new Error("signer: RPC chain mismatch");let s={native:(await e.getBalance(r.from)).toString()},l=n&&n.privateRelay;if(l&&typeof o=="function"){let u=l==="require"||l?.mode==="require";try{let m=await o(t,{chainId:Number(r.chainId),requirePrivate:u,allowPublicFallback:!u});if(!m.fellBack&&m.hash){let f=await e.waitForTransaction(m.hash),p={native:(await e.getBalance(r.from)).toString()};return{hash:m.hash,status:f?.status??null,verifiedBefore:s,verifiedAfter:p,submission:{path:"private",mode:m.mode,endpoint:m.endpoint}}}}catch(m){if(u)throw m}}let a=await e.broadcastTransaction(t),c=await a.wait(),d={native:(await e.getBalance(r.from)).toString()};return{hash:c?.hash??a.hash,status:c?.status??null,verifiedBefore:s,verifiedAfter:d,submission:{path:"public"}}}async function ec({configDir:e,passphraseFile:t,credentialService:r,surfaceTransports:n={},host:o="127.0.0.1",port:i=9462,sessionMs:s=12e4}={}){let{JsonRpcProvider:l,Wallet:a}=await import("ethers");if(!t&&!r)throw new Error("signer: --credential-service or --passphrase-file is required for non-interactive service start");if(s<1e3||s>12e4)throw new Error("signer: session must be at most 120 seconds");let c=qm(e),d=()=>Object.freeze(Xr(c.policy,c.policyKey,{sequenceAnchorFile:c.policyAnchor})),u=d(),m=String(process.env.ORACLE_OWNER_TELEGRAM||"").split(",").map(E=>E.trim()).filter(Boolean),f=m.length?Va({keyFile:c.policyKey,approvedTelegramOwners:m}):null;if(K(u,"cex")&&!f)throw new Error("signer: cex requires an approved Telegram owner context");if(!["exact-human","auto-within-rails"].includes(u.confirmationMode))throw new Error("signer: confirmationMode must be exact-human or auto-within-rails");if(u.confirmationMode==="auto-within-rails"&&process.env.ORACLE_AUTONOMOUS_TRADING!=="1")throw new Error("signer: auto-within-rails requires ORACLE_AUTONOMOUS_TRADING=1");let p=["surfaces","actions","destinations","owners"];u.surfaces.some(E=>String(E).startsWith("evm"))&&p.push("chains","spenders");for(let E of p)if(!Array.isArray(u[E])||u[E].length===0)throw new Error(`signer: ${E} allowlist is empty`);if(u.surfaces.some(E=>E==="evm-swap"||E==="evm-bridge"||E==="evm-nft"||E==="evm-order")){for(let E of["providers"])if(!Array.isArray(u[E])||u[E].length===0)throw new Error(`signer: ${E} allowlist is empty`)}if(u.surfaces.some(E=>E==="evm-swap"||E==="evm-bridge"||E==="evm-order")&&(!Array.isArray(u.tokens)||u.tokens.length===0))throw new Error("signer: tokens allowlist is empty");if(u.surfaces.some(E=>String(E).startsWith("evm")&&E!=="evm-order")&&(!Array.isArray(u.selectors)||u.selectors.length===0))throw new Error("signer: selectors allowlist is empty");if(u.surfaces.includes("sol")&&(!Array.isArray(u.programs)||u.programs.length===0))throw new Error("signer: programs allowlist is empty");if(K(u,"poly")&&(En(u),!Array.isArray(u.polyTokens)||u.polyTokens.length===0))throw new Error("signer: polyTokens allowlist is empty");if(K(u,"lighter")&&(!Array.isArray(u.lighterMarkets)||u.lighterMarkets.length===0))throw new Error("signer: lighterMarkets allowlist is empty");if(K(u,"cex")&&(!u.cexAccounts||Object.keys(u.cexAccounts).length===0))throw new Error("signer: cexAccounts allowlist is empty");if(K(u,"hl")){let E=Array.isArray(u.coins)?u.coins.map(String):[],I=Array.isArray(u.hlMarkets)?u.hlMarkets:[];if(E.filter(F=>F!=="*"&&F!=="#*").length&&!E.includes("*")&&I.length===0)throw new Error("signer: restricted hl coins require hlMarkets pairs")}let w=r?Sa(r):L(t),g=da(c.vault),h=ua(g,w),y;try{y=Ca(h,g.meta)}finally{h.fill(0)}if((Ga(u)||K(u,"hl")||K(u,"poly"))&&Oo("evm",y.evm,u.owners),K(u,"btc")&&Oo("btc",y.btc,u.owners),K(u,"sol")&&Oo("sol",y.sol,u.owners),K(u,"cex")){if(!y.cex||Object.keys(y.cex).length===0)throw new Error("signer: local CEX credential records required");for(let[E,I]of Object.entries(u.cexAccounts)){let T=y.cex[E];if(!T||T.accountId!==I.accountId||!I.venues.includes(T.venue)||I.credentialRecordRef!==E)throw new Error("signer: CEX credential venue/account binding refused")}}let b=Array.isArray(u.chains)?u.chains.filter(E=>Number.isInteger(Number(E))&&String(E).trim()!==""):[],x=Ga(u);if(x&&(b.length!==1||!u.rpcUrl))throw new Error("signer: EVM surfaces require one chain and one RPC URL");if(K(u,"btc")&&!(u.btcRpcUrl||u.bitcoinRpcUrl))throw new Error("signer: btcRpcUrl required for Bitcoin broadcast");if(K(u,"sol")&&!(u.solRpcUrl||u.solanaRpcUrl))throw new Error("signer: solRpcUrl required for Solana simulation and broadcast");let A=x?new l(u.rpcUrl,Number(b[0])):null,k=y.evm&&(x||K(u,"hl")||K(u,"poly"))?A?new a(y.evm.secret).connect(A):new a(y.evm.secret):null,v=A?{simulate:async E=>{if((await A.getNetwork()).chainId!==BigInt(E.chainId))throw new Error("signer: RPC chain mismatch");return await A.call(E),!0},sign:E=>k.signTransaction(E),broadcast:(E,I,T)=>nw(A,E,I,T,{submitPrivate:pa})}:null,_=A?async E=>ow(A,E):void 0,C=new Map,z=E=>E?.surface==="evm-nft"&&String(E?.provider).toLowerCase()==="anvil-nft",U=async(E,I=d(),T="execution")=>{if(!z(E))return null;let F=await Wm(A,E,I,{nowMs:Date.now(),signerAddress:k.address}),Y=C.get(G(E));return Y&&Xa(Y,F,T),F},R={...v?{evm:v,"evm-swap":v,"evm-bridge":v,"evm-nft":v}:{},...k&&K(u,"evm-order")?{"evm-order":Zm(d,k)}:{},...y.btc?{btc:ew(d,y.btc)}:{},...y.sol?{sol:tw(d,y.sol)}:{},...k&&K(u,"hl")?{hl:Ym(d,k)}:{},...k&&K(u,"poly")?{poly:Qm(d,k)}:{},...K(u,"lighter")?{lighter:Xm(d)}:{}};rw(R,n);let $=Fi({...R,...n}),Ke=new Set(Object.keys(R)),pt=new Set(Object.keys(n||{})),Mt=u.surfaces.filter(E=>E!=="cex"&&!Ke.has(E)&&!pt.has(E));if(Mt.length)throw new Error(`signer: ${Mt.join(",")} require local keys or injected surface transports`);let qt=Date.now(),mt=qt+s,Ge=!1,Ye=!1,Xe=()=>{if(!Ye){Ye=!0;for(let E of Object.values(y.cex||{}))for(let I of["apiKeyBytes","apiSecretBytes","passphraseBytes"])E[I]?.fill?.(0)}},Ze=()=>Ge?!1:Ja.existsSync(c.lock)?(Ge=!0,!1):Ja.existsSync(c.vault)&&Date.now()<mt,M=Mm({isArmed:Ze,disarmNow:()=>{Ge=!0,Xe(),Ae(c.lock,`disarmed ${new Date().toISOString()}
+`),t}function Oo(e,t,r){if(!t)throw new Error(`signer: ${e} key is required by policy`);let n=new Set((r||[]).map(o=>String(o).toLowerCase()));if(!t.addresses.some(o=>n.has(String(o).toLowerCase())))throw new Error(`signer: ${e} vault address is not an allowed policy owner`);return!0}function Ga(e){return e.surfaces.some(t=>String(t).startsWith("evm"))}function K(e,t){return e.surfaces.includes(t)}function _e(e,t){let r=String(e||"").toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(r))throw new Error(`signer: invalid ${t}`);return r}function Ya(e,t){return Object.entries(e||{}).find(([r])=>r.toLowerCase()===t)?.[1]}function zm(e,t){let r=e?.anvilQuote;if(!r||typeof r!="object"||Array.isArray(r))throw new Error("signer: exact prepared Anvil quote is required");if(!e?.artifact?.anvilQuote||JSON.stringify(e.artifact.anvilQuote)!==JSON.stringify(r))throw new Error("signer: exact prepared Anvil quote artifact mismatch");return Object.freeze(t==="buy"?{totalCostRaw:BigInt(r.totalCostRaw).toString(),baseCostRaw:BigInt(r.baseCostRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString(),available:r.available===!0}:{netPayoutRaw:BigInt(r.netPayoutRaw).toString(),grossPayoutRaw:BigInt(r.grossPayoutRaw).toString(),feeRaw:BigInt(r.feeRaw).toString(),protocolFeeRaw:BigInt(r.protocolFeeRaw).toString()})}function Um(e,t,r){if(e.preconditions?.exactQuoteConfirmed!==!0)throw new Error("signer: exact prepared Anvil quote confirmation required");let n=e.artifact,o=t==="buy"?[r.totalCostRaw,e.maxPaymentTokenAmountRaw,n?.maxPaymentTokenAmountRaw,e.exactQuoteTotalCostRaw,n?.exactQuoteTotalCostRaw,e.preconditions?.confirmedTotalCostRaw]:[r.netPayoutRaw,e.minPayoutRaw,n?.minPayoutRaw,e.exactQuoteNetPayoutRaw,n?.exactQuoteNetPayoutRaw,e.preconditions?.confirmedNetPayoutRaw],i;try{i=BigInt(o[0]);for(let c of o.slice(1))if(BigInt(c)!==i)throw new Error("mismatch")}catch{throw new Error(`signer: exact Anvil ${t} settlement limit mismatch`)}let s=n?.transactions;if(!Array.isArray(s)||s.length!==1)throw new Error("signer: exact Anvil action transaction required");let l=t==="buy"?"buySpecificNFT":"sellNFT",a;try{if(a=Re.decodeFunctionData(l,s[0].data),Re.encodeFunctionData(l,[a[0],a[1]]).toLowerCase()!==String(s[0].data).toLowerCase())throw new Error("non-canonical")}catch{throw new Error(`signer: exact Anvil ${t} calldata required`)}if(BigInt(a[0])!==BigInt(e.tokenId)||BigInt(a[1])!==i)throw new Error(`signer: exact Anvil ${t} calldata limit mismatch`);return i}async function ze(e,t,r,n,o,i=[]){let s=await e.send("eth_call",[{to:t,data:r.encodeFunctionData(n,i)},o]);return r.decodeFunctionResult(n,s)[0]}async function Wm(e,t,r,{nowMs:n=Date.now(),signerAddress:o}={}){if(t?.surface!=="evm-nft"||String(t?.provider).toLowerCase()!=="anvil-nft")return null;if(!e||typeof e.send!="function")throw new Error("signer: trusted RPC cannot attest Anvil market");let i=_e(t.destination,"Anvil market"),s=_e(t.contract,"Anvil collection"),l=_e(t.paymentToken,"Anvil payment token"),a=BigInt(t.nativeSwapFeeWei),c=Number(t.paymentTokenDecimals),d=_e(o,"Anvil signer identity"),u=_e(t.owner,"Anvil envelope owner");if(d!==u)throw new Error("signer: Anvil signer identity mismatch");let m=BigInt(t.tokenId);if(m<0n)throw new Error("signer: invalid Anvil tokenId");let f=String(t.nftAction||"").toLowerCase();if(f!=="buy"&&f!=="sell")throw new Error("signer: unsupported Anvil NFT action");let p=zm(t,f),w=Um(t,f,p),g=t.anvilAttestation;if(!g||typeof g!="object"||Number(g.snapshotExpiresAtMs)<=Number(n))throw new Error("signer: fresh provider Anvil attestation required");let h=String(Ya(r.anvilRuntimeCodeHashes,i)||"").toLowerCase();if(!/^0x[0-9a-f]{64}$/.test(h)||h!==String(g.runtimeCodeHash||"").toLowerCase())throw new Error("signer: Anvil runtime is not reviewed by policy");let y=Ya(r.nftPaymentTokenCaps,l);if(!y||Number(y.decimals)!==c)throw new Error("signer: Anvil payment token decimals are not reviewed by policy");let b=String(await e.send("eth_chainId",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(b)||BigInt(b)!==4663n)throw new Error("signer: trusted RPC Anvil chain mismatch");let x=String(await e.send("eth_blockNumber",[])).toLowerCase();if(!/^0x(?:0|[1-9a-f][0-9a-f]*)$/.test(x))throw new Error("signer: trusted RPC returned an invalid Anvil block number");let A=BigInt(x),k=await e.send("eth_getBlockByNumber",[x,!1]),v=String(k?.hash||"").toLowerCase();if(String(k?.number||"").toLowerCase()!==x||!/^0x[0-9a-f]{64}$/.test(v))throw new Error("signer: trusted RPC returned an invalid Anvil block attestation");let _=Object.freeze({blockHash:v,requireCanonical:!0}),C=String(await e.send("eth_getCode",[i,_])).toLowerCase();if(!/^0x[0-9a-f]+$/.test(C)||C==="0x")throw new Error("signer: Anvil market runtime is empty");let z=jm(C).toLowerCase();if(z!==h)throw new Error("signer: Anvil market runtime mismatch with reviewed policy");let[U,R,$]=await Promise.all([ze(e,i,Re,"collection",_),ze(e,i,Re,"token",_),ze(e,i,Re,"robinhoodSwapFeeWei",_)]),Ke=_e(U,"live Anvil collection"),pt=_e(R,"live Anvil payment token"),Mt=BigInt($).toString();if(Ke!==s)throw new Error("signer: live Anvil collection mismatch");if(pt!==l)throw new Error("signer: live Anvil payment token mismatch");if(Mt!==a.toString())throw new Error("signer: live Anvil native swap fee mismatch");let qt=Number(await ze(e,pt,Ka,"decimals",_));if(!Number.isSafeInteger(qt)||qt!==c)throw new Error("signer: live Anvil payment token decimals mismatch");let mt=_e(await ze(e,Ke,ko,"ownerOf",_,[m]),"live Anvil token owner"),Ge=null,Ye=null,Xe=null,Ze=null,M;if(f==="buy"){let[Ue,wt,E]=await Promise.all([ze(e,i,Re,"inventory",_,[m]),ze(e,pt,Ka,"allowance",_,[d,i]),e.send("eth_call",[{to:i,data:Re.encodeFunctionData("quoteSpecificBuy",[m])},_])]);Ge=!!Ue,Ye=BigInt(wt).toString();let I=Re.decodeFunctionResult("quoteSpecificBuy",E);if(M=Object.freeze({totalCostRaw:BigInt(I[0]).toString(),baseCostRaw:BigInt(I[1]).toString(),feeRaw:BigInt(I[2]).toString(),protocolFeeRaw:BigInt(I[3]).toString(),available:!!I[4]}),JSON.stringify(M)!==JSON.stringify(p))throw new Error("signer: exact Anvil buy quote changed after preparation");if(mt!==i)throw new Error("signer: exact Anvil token owner is not the market");if(!Ge)throw new Error("signer: exact Anvil token is not in market inventory");if(BigInt(Ye)!==BigInt(t.preconditions?.allowanceRaw))throw new Error("signer: live Anvil ERC20 allowance changed after preparation");if(BigInt(Ye)<w)throw new Error("signer: live Anvil ERC20 allowance is insufficient");if(!M.available)throw new Error("signer: exact Anvil buy quote is unavailable");if(BigInt(M.totalCostRaw)!==w)throw new Error("signer: live Anvil buy quote does not equal exact payment limit");if(BigInt(M.totalCostRaw)!==BigInt(M.baseCostRaw)+BigInt(M.feeRaw)+BigInt(M.protocolFeeRaw))throw new Error("signer: exact Anvil buy quote fee arithmetic mismatch")}else{let[Ue,wt,E]=await Promise.all([ze(e,Ke,ko,"getApproved",_,[m]),ze(e,Ke,ko,"isApprovedForAll",_,[d,i]),e.send("eth_call",[{to:i,data:Re.encodeFunctionData("quoteSellNFT")},_])]);Xe=_e(Ue,"live Anvil token approval"),Ze=!!wt;let I=Re.decodeFunctionResult("quoteSellNFT",E);if(M=Object.freeze({netPayoutRaw:BigInt(I[0]).toString(),grossPayoutRaw:BigInt(I[1]).toString(),feeRaw:BigInt(I[2]).toString(),protocolFeeRaw:BigInt(I[3]).toString()}),JSON.stringify(M)!==JSON.stringify(p))throw new Error("signer: exact Anvil sell quote changed after preparation");if(mt!==d)throw new Error("signer: exact Anvil token owner does not match signer");if(Xe!==i&&!Ze)throw new Error("signer: live Anvil NFT approval is insufficient");if(Xe!==_e(t.preconditions?.approvedAddress,"prepared Anvil token approval")||Ze!==!!t.preconditions?.approvedForAll)throw new Error("signer: live Anvil NFT approval changed after preparation");if(BigInt(M.netPayoutRaw)!==w)throw new Error("signer: live Anvil sell quote does not equal exact payout limit");if(BigInt(M.netPayoutRaw)+BigInt(M.feeRaw)+BigInt(M.protocolFeeRaw)!==BigInt(M.grossPayoutRaw))throw new Error("signer: exact Anvil sell quote fee arithmetic mismatch")}return Object.freeze({source:"local-signer-trusted-rpc",chainId:4663,market:i,collection:Ke,paymentToken:pt,paymentTokenDecimals:qt,nativeSwapFeeWei:Mt,signerAddress:d,nftAction:f,tokenId:m.toString(),tokenOwner:mt,inventoryMember:Ge,allowanceRaw:Ye,approvedAddress:Xe,approvedForAll:Ze,quote:M,blockNumber:A.toString(),blockHash:v,runtimeCodeHash:z,verifiedAtMs:Number(n)})}function Xa(e,t,r="execution"){if(!e||!t)throw new Error("signer: complete Anvil revalidation evidence required");for(let n of["runtimeCodeHash","market","collection","paymentToken","paymentTokenDecimals","nativeSwapFeeWei","signerAddress","nftAction","tokenId","tokenOwner","inventoryMember","allowanceRaw","approvedAddress","approvedForAll"])if(String(t[n]).toLowerCase()!==String(e[n]).toLowerCase())throw new Error(`signer: Anvil ${n} changed after simulation at ${r}`);if(JSON.stringify(t.quote)!==JSON.stringify(e.quote))throw new Error(`signer: Anvil quote changed after simulation at ${r}`);return!0}function Vm(e,t,r,n,{nowMs:o=Date.now(),timeoutMs:i=15e3,signerAddress:s}={}){let l=Dm(new URL("./anvil-attestation-worker.mjs",import.meta.url)),a={anvilRuntimeCodeHashes:n?.anvilRuntimeCodeHashes,nftPaymentTokenCaps:n?.nftPaymentTokenCaps},c;try{c=Bm(process.execPath,[l],{input:JSON.stringify({rpcUrl:e,chainId:t,envelope:r,policy:a,nowMs:Number(o),signerAddress:s}),encoding:"utf8",timeout:i,maxBuffer:64e3,env:{PATH:process.env.PATH||"",HOME:process.env.HOME||"",NODE_OPTIONS:""},stdio:["pipe","pipe","pipe"]})}catch{throw new Error("signer: fresh independent Anvil attestation failed before reservation")}let d;try{d=JSON.parse(c)}catch{throw new Error("signer: invalid Anvil reservation attestation result")}if(!d||d.source!=="local-signer-trusted-rpc"||!/^0x[0-9a-f]{64}$/.test(String(d.blockHash||"")))throw new Error("signer: invalid Anvil reservation attestation result");return Object.freeze(d)}async function ur(e,t){let r=await fetch(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),n=await r.text();if(!r.ok)throw new Error(`rpc: HTTP ${r.status}`);let o=JSON.parse(n||"{}");if(o.error)throw new Error(`rpc: ${o.error.message||"request failed"}`);return o.result}function No(e){let t=Buffer.from(e),r=t[0]===128?t[1]:t[0];if(!Number.isInteger(r)||r<1||r>8)throw new Error(`signer: Solana message declares an implausible signature count (${r})`);return r}function To(e,t){let r=Array.isArray(t)?t:[t],n=No(e);if(r.length!==n)throw new Error(`signer: Solana message needs ${n} signature(s), got ${r.length}`);for(let o of r)if(Buffer.from(o).length!==64)throw new Error("signer: Solana signature must be 64 bytes");return Buffer.concat([Buffer.from([n]),...r.map(o=>Buffer.from(o)),Buffer.from(e)]).toString("base64")}function Jm({provider:e=null,readPolicy:t,rpc:r=ur,fetchImpl:n=fetch}={}){if(typeof t!="function")throw new TypeError("signer: execution observer requires readPolicy");return async o=>{let i=String(o?.surface||""),s=String(o?.signedTransactionId||"");if(!s)throw new Error("signer: execution observer requires signed transaction identity");if(i==="evm"||i==="evm-swap"||i==="evm-bridge"||i==="evm-nft"){if(!e||typeof e.getTransactionReceipt!="function")return null;let a=await e.getTransactionReceipt(s);return a?{transactionHash:s,status:a.status}:null}let l=t();if(i==="hl"){let{owner:a,cloid:c}=o;if(!/^0x[0-9a-f]{40}$/i.test(String(a))||!/^0x[0-9a-f]{32}$/i.test(String(c)))return null;let d=o.hlTestnet===!0?"https://api.hyperliquid-testnet.xyz/info":"https://api.hyperliquid.xyz/info",u=await n(d,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({type:"orderStatus",user:a,oid:c})});if(!u.ok)return null;let m=await u.json();if(m?.status!=="order"||m.order?.order?.cloid!==c)return null;let{status:f,order:p}=m.order;if(f==="filled")return{transactionHash:s,status:1,order:{orderId:String(p.oid),status:"filled",cloid:c}};let w=y=>/^\d+(?:\.\d+)?$/.test(String(y))?String(y).replace(/^0+(?=\d)/,"").replace(/(\.\d*?)0+$/,"$1").replace(/\.$/,""):null,g=w(p.origSz),h=w(p.sz);return(/^(?:canceled|rejected|scheduledCancel)$/.test(f)||/(?:Canceled|Rejected)$/.test(f))&&g!==null&&Number(g)>0&&g===h?{transactionHash:s,status:0}:null}if(i==="sol"){let a=String(l.solRpcUrl||l.solanaRpcUrl||"");if(!a)return null;let d=(await r(a,{jsonrpc:"2.0",id:1,method:"getSignatureStatuses",params:[[s],{searchTransactionHistory:!0}]}))?.value?.[0];return d?d.err?{transactionHash:s,status:0}:d.confirmationStatus==="confirmed"||d.confirmationStatus==="finalized"||d.confirmations===null?{transactionHash:s,status:1}:null:null}if(i==="btc"){let a=String(l.btcRpcUrl||l.bitcoinRpcUrl||"").replace(/\/$/,"");if(!a)return null;try{let c=a.endsWith("/tx")?a.slice(0,-3):a,d=await n(`${c}/tx/${s}/status`);if(d.ok)return(await d.json())?.confirmed===!0?{transactionHash:s,status:1}:null}catch{}try{let c=await r(a,{jsonrpc:"1.0",id:"oracle",method:"getrawtransaction",params:[s,!0]});return Number(c?.confirmations||0)>0?{transactionHash:s,status:1}:null}catch{return null}}return null}}async function Qa(e,t,r){let n=String(e.btcRpcUrl||e.bitcoinRpcUrl||"").replace(/\/$/,"");if(!n)throw new Error("signer: btcRpcUrl required for Bitcoin simulation and broadcast");return ur(n,{jsonrpc:"1.0",id:"oracle",method:t,params:r})}async function Km(e,t,r){let n=String(e.btcRpcUrl||e.bitcoinRpcUrl||"").replace(/\/$/,"");if(!n)throw new Error("signer: btcRpcUrl required for Bitcoin simulation");let o=n.endsWith("/tx")?n.slice(0,-3):n;try{let s=await fetch(`${o}/tx/${t}/outspend/${r}`);if(s.ok){let l=await s.json();if(l?.spent===!0)throw new Error("signer: Bitcoin input already spent");if(l?.spent===!1)return!0}}catch(s){if(/already spent/.test(String(s?.message||s)))throw s}if(!await Qa(e,"gettxout",[t,Number(r),!0]))throw new Error("signer: Bitcoin input unavailable for simulation");return!0}function Gm(e){if(!e||typeof e!="object"||!e.value||typeof e.value!="object"||!Object.prototype.hasOwnProperty.call(e.value,"err"))throw new Error("signer: Solana simulation result missing");if(e.value.err!==null)throw new Error("signer: Solana simulation failed");return!0}function Ym(e,t,{fetchImpl:r=fetch}={}){return{simulate:async(n,o)=>(Pe(o,e()),!0),sign:async(n,o)=>{Pe(o,e());let i=e();if(!(Array.isArray(i.owners)?i.owners:[]).some(l=>String(l).toLowerCase()===String(t.address).toLowerCase()))throw new Error("signer: HL wallet is not an allowed policy owner");if(String(o.owner||"").toLowerCase()!==String(t.address).toLowerCase())throw new Error("signer: HL wallet must match envelope owner");return n?.typedData?(qi(n),t.signTypedData(n.typedData.domain,n.typedData.types,n.typedData.message)):Hi({wallet:t,action:n.action,nonce:n.nonce,isMainnet:!String(n.submitTo||"").includes("testnet")})},broadcast:async(n,o,i)=>{Pe(i,e());let{Signature:s,keccak256:l}=await import("ethers"),a=s.from(n),c=await r(o.submitTo,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({action:o.action,nonce:o.nonce,signature:{r:a.r,s:a.s,v:a.v}})});if(!c.ok)throw new Error("signer: Hyperliquid exchange rejected the action");let d=await c.json().catch(()=>{throw new Error("signer: Hyperliquid exchange rejected the action")});if(d?.status!=="ok")throw new Error("signer: Hyperliquid exchange rejected the action");let u=o.action.type==="order"?d.response?.data?.statuses?.[0]:null;if(u&&Object.hasOwn(u,"error"))throw new Error("signer: Hyperliquid rejected the order");let m=u?.filled?"filled":u?.resting?"resting":null,f=m?u[m]:null;return{hash:l(n),status:1,...f?.oid!=null?{order:{orderId:String(f.oid),status:m,cloid:o.action.orders[0].c??null}}:{}}}}}function Xm(e){return{simulate:async(t,r)=>(De(r,e()),!0),sign:async(t,r)=>{De(r,e());let n=e();if(typeof n.lighterSignImpl!="function")throw new Error("lighter: official Lighter signer required");let o=await n.lighterSignImpl(t,r);return er(t,o),typeof o=="string"?o:JSON.stringify(o)},broadcast:async(t,r,n)=>{let o=De(n,e()),i=er(r,t),s=Wi(i),l=await fetch(o.submitTo,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:s}),a=await l.json().catch(()=>({}));if(!l.ok||Number(a?.code)!==200)throw new Error("signer: Lighter sendTx rejected the order");return{hash:String(a?.tx_hash||a?.txHash||"lighter"),status:1}}}}function Zm(e,t){return{simulate:async(r,n)=>(rt(n,e()),!0),sign:async(r,n)=>{rt(n,e());let o=e();if(!(Array.isArray(o.owners)?o.owners:[]).some(c=>String(c).toLowerCase()===String(t.address).toLowerCase()))throw new Error("signer: order wallet is not an allowed policy owner");if(String(n.owner||"").toLowerCase()!==String(t.address).toLowerCase())throw new Error("signer: order wallet must match envelope owner");let s=r.domain||r.typedData.domain,l=r.types||r.typedData.types,a=r.message||r.typedData.message;return t.signTypedData(s,l,a)},broadcast:async(r,n,o)=>{let i=rt(o,e()),{keccak256:s}=await import("ethers"),l=n.message||n.typedData.message,a=i.kind==="cow"?{sellToken:l.sellToken,buyToken:l.buyToken,receiver:l.receiver,sellAmount:l.sellAmount,buyAmount:l.buyAmount,validTo:l.validTo,appData:l.appData,feeAmount:l.feeAmount,kind:l.kind,partiallyFillable:l.partiallyFillable,sellTokenBalance:l.sellTokenBalance,buyTokenBalance:l.buyTokenBalance,from:o.owner,signature:r,signingScheme:"eip712",quoteId:n.quoteId??void 0}:{orderHash:i.digest,signature:r,data:l},c=await fetch(i.submitTo,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)}),d=await c.json().catch(()=>({}));if(!c.ok||d?.error||d?.success===!1)throw new Error(i.kind==="cow"?"signer: CoW orderbook rejected the order":"signer: 1inch orderbook rejected the order");return{hash:s(r),status:1,orderHash:i.digest,uid:typeof d=="string"?d:d?.uid||null}}}}function Qm(e,t){return{simulate:async(r,n)=>(Be(n,e()),!0),sign:async(r,n)=>{Be(n,e());let o=e();if(!(Array.isArray(o.owners)?o.owners:[]).some(s=>String(s).toLowerCase()===String(t.address).toLowerCase()))throw new Error("signer: Poly wallet is not an allowed policy owner");if(String(n.owner||"").toLowerCase()!==String(t.address).toLowerCase())throw new Error("signer: Poly wallet must match envelope owner");return t.signTypedData(r.domain,r.types,r.message)},broadcast:async(r,n,o)=>{let i=e(),s=Be(o,i),l=En(i),{keccak256:a}=await import("ethers"),c=di({message:n.message,side:n.side,signature:r,orderType:n.orderType||"GTC",apiKey:l.key}),d=JSON.stringify(c),u=li({creds:l,address:o.owner,method:"POST",path:"/order",body:d}),m=await fetch(s.submitTo,{method:"POST",headers:u,body:d}),f=await m.json().catch(()=>({}));if(!m.ok||f?.success===!1||f?.error||f?.errorMsg)throw new Error("signer: Polymarket CLOB rejected the order");return{hash:a(r),status:1}}}}function ew(e,t){let r=go(t);return{simulate:async n=>{let o=e(),i=Io.fromPSBT(Buffer.from(n.psbt,"base64"));return await Promise.all(Array.from({length:i.inputsLength},(s,l)=>{let a=i.getInput(l),c=Buffer.from(a.txid||[]).toString("hex");return Km(o,c,a.index)})),!0},sign:n=>{let o=Io.fromPSBT(Buffer.from(n.psbt,"base64"));return o.sign(r),Buffer.from(o.toPSBT()).toString("base64")},broadcast:async n=>{let o=e(),i=String(o.btcRpcUrl||o.bitcoinRpcUrl||"").replace(/\/$/,"");if(!i)throw new Error("signer: btcRpcUrl required for Bitcoin broadcast");let s=Io.fromPSBT(Buffer.from(n,"base64"));s.finalize(),s.extract();let l;try{let c=await fetch(i.endsWith("/tx")?i:`${i}/tx`,{method:"POST",headers:{"content-type":"text/plain"},body:s.hex});if(l=(await c.text()).trim(),!c.ok)throw new Error(`signer: Bitcoin broadcast failed ${c.status}`)}catch(c){if(!/Bitcoin broadcast failed 404/.test(String(c?.message||c)))throw c;l=await Qa(o,"sendrawtransaction",[s.hex])}if(l&&String(l).toLowerCase()!==s.id.toLowerCase())throw new Error("signer: Bitcoin broadcast txid mismatch");let a=null;try{let c=i.endsWith("/tx")?i.slice(0,-3):i,d=await fetch(`${c}/tx/${s.id}/status`);d.ok&&(a=(await d.json())?.confirmed===!0?1:null)}catch{}return{hash:s.id,status:a}}}}function tw(e,t){let r=go(t);return{simulate:async n=>{let o=e(),i=String(o.solRpcUrl||o.solanaRpcUrl||"");if(!i)throw new Error("signer: solRpcUrl required for Solana simulation");let s=Buffer.from(n.messageBase64,"base64"),l=No(s),a=To(s,Array.from({length:l},()=>new Uint8Array(64))),c=await ur(i,{jsonrpc:"2.0",id:1,method:"simulateTransaction",params:[a,{encoding:"base64",sigVerify:!1,replaceRecentBlockhash:!1}]});return Gm(c)},sign:n=>{let o=Buffer.from(n.messageBase64,"base64"),i=No(o),s=Fm.sign(o,r);if(i===1)return To(o,[s]);let l=Array.isArray(n.cosignatures)?n.cosignatures:[];if(l.length!==i-1)throw new Error(`signer: Solana message needs ${i-1} cosignature(s), got ${l.length}`);return To(o,[s,...l.map(a=>Buffer.from(String(a),"base64"))])},broadcast:async n=>{let o=e(),i=String(o.solRpcUrl||o.solanaRpcUrl||"");if(!i)throw new Error("signer: solRpcUrl required for Solana broadcast");let s=await ur(i,{jsonrpc:"2.0",id:1,method:"sendTransaction",params:[n,{encoding:"base64",skipPreflight:!1,maxRetries:3}]}),a=(await ur(i,{jsonrpc:"2.0",id:1,method:"getSignatureStatuses",params:[[s],{searchTransactionHistory:!0}]}))?.value?.[0];if(a?.err)return{hash:s,status:0};let c=a?.confirmationStatus==="confirmed"||a?.confirmationStatus==="finalized"||a?.confirmations===null;return{hash:s,status:c?1:null}}}}function rw(e,t={}){for(let r of Object.keys(t||{}))if(Object.prototype.hasOwnProperty.call(e,r))throw new Error(`signer: cannot replace built-in ${r} transport`)}async function nw(e,t,r,n,{submitPrivate:o}={}){if((await e.getNetwork()).chainId!==BigInt(r.chainId))throw new Error("signer: RPC chain mismatch");let s={native:(await e.getBalance(r.from)).toString()},l=n&&n.privateRelay;if(l&&typeof o=="function"){let u=l==="require"||l?.mode==="require";try{let m=await o(t,{chainId:Number(r.chainId),requirePrivate:u,allowPublicFallback:!u});if(!m.fellBack&&m.hash){let f=await e.waitForTransaction(m.hash),p={native:(await e.getBalance(r.from)).toString()};return{hash:m.hash,status:f?.status??null,verifiedBefore:s,verifiedAfter:p,submission:{path:"private",mode:m.mode,endpoint:m.endpoint}}}}catch(m){if(u)throw m}}let a=await e.broadcastTransaction(t),c=await a.wait(),d={native:(await e.getBalance(r.from)).toString()};return{hash:c?.hash??a.hash,status:c?.status??null,verifiedBefore:s,verifiedAfter:d,submission:{path:"public"}}}async function ec({configDir:e,passphraseFile:t,credentialService:r,surfaceTransports:n={},host:o="127.0.0.1",port:i=9462,sessionMs:s=12e4}={}){let{JsonRpcProvider:l,Wallet:a}=await import("ethers");if(!t&&!r)throw new Error("signer: --credential-service or --passphrase-file is required for non-interactive service start");if(s<1e3||s>12e4)throw new Error("signer: session must be at most 120 seconds");let c=qm(e),d=()=>Object.freeze(Xr(c.policy,c.policyKey,{sequenceAnchorFile:c.policyAnchor})),u=d(),m=String(process.env.ORACLE_OWNER_TELEGRAM||"").split(",").map(E=>E.trim()).filter(Boolean),f=m.length?Va({keyFile:c.policyKey,approvedTelegramOwners:m}):null;if(K(u,"cex")&&!f)throw new Error("signer: cex requires an approved Telegram owner context");if(!["exact-human","auto-within-rails"].includes(u.confirmationMode))throw new Error("signer: confirmationMode must be exact-human or auto-within-rails");if(u.confirmationMode==="auto-within-rails"&&process.env.ORACLE_AUTONOMOUS_TRADING!=="1")throw new Error("signer: auto-within-rails requires ORACLE_AUTONOMOUS_TRADING=1");let p=["surfaces","actions","destinations","owners"];u.surfaces.some(E=>String(E).startsWith("evm"))&&p.push("chains","spenders");for(let E of p)if(!Array.isArray(u[E])||u[E].length===0)throw new Error(`signer: ${E} allowlist is empty`);if(u.surfaces.some(E=>E==="evm-swap"||E==="evm-bridge"||E==="evm-nft"||E==="evm-order")){for(let E of["providers"])if(!Array.isArray(u[E])||u[E].length===0)throw new Error(`signer: ${E} allowlist is empty`)}if(u.surfaces.some(E=>E==="evm-swap"||E==="evm-bridge"||E==="evm-order")&&(!Array.isArray(u.tokens)||u.tokens.length===0))throw new Error("signer: tokens allowlist is empty");if(u.surfaces.some(E=>String(E).startsWith("evm")&&E!=="evm-order")&&(!Array.isArray(u.selectors)||u.selectors.length===0))throw new Error("signer: selectors allowlist is empty");if(u.surfaces.includes("sol")&&(!Array.isArray(u.programs)||u.programs.length===0))throw new Error("signer: programs allowlist is empty");if(K(u,"poly")&&(En(u),!Array.isArray(u.polyTokens)||u.polyTokens.length===0))throw new Error("signer: polyTokens allowlist is empty");if(K(u,"lighter")&&(!Array.isArray(u.lighterMarkets)||u.lighterMarkets.length===0))throw new Error("signer: lighterMarkets allowlist is empty");if(K(u,"cex")&&(!u.cexAccounts||Object.keys(u.cexAccounts).length===0))throw new Error("signer: cexAccounts allowlist is empty");if(K(u,"hl")){let E=Array.isArray(u.coins)?u.coins.map(String):[],I=Array.isArray(u.hlMarkets)?u.hlMarkets:[];if(E.filter(F=>F!=="*"&&F!=="#*").length&&!E.includes("*")&&I.length===0)throw new Error("signer: restricted hl coins require hlMarkets pairs")}let w=r?Sa(r):L(t),g=da(c.vault),h=ua(g,w),y;try{y=Ca(h,g.meta)}finally{h.fill(0)}if((Ga(u)||K(u,"hl")||K(u,"poly"))&&Oo("evm",y.evm,u.owners),K(u,"btc")&&Oo("btc",y.btc,u.owners),K(u,"sol")&&Oo("sol",y.sol,u.owners),K(u,"cex")){if(!y.cex||Object.keys(y.cex).length===0)throw new Error("signer: local CEX credential records required");for(let[E,I]of Object.entries(u.cexAccounts)){let T=y.cex[E];if(!T||T.accountId!==I.accountId||!I.venues.includes(T.venue)||I.credentialRecordRef!==E)throw new Error("signer: CEX credential venue/account binding refused")}}let b=Array.isArray(u.chains)?u.chains.filter(E=>Number.isInteger(Number(E))&&String(E).trim()!==""):[],x=Ga(u);if(x&&(b.length!==1||!u.rpcUrl))throw new Error("signer: EVM surfaces require one chain and one RPC URL");if(K(u,"btc")&&!(u.btcRpcUrl||u.bitcoinRpcUrl))throw new Error("signer: btcRpcUrl required for Bitcoin broadcast");if(K(u,"sol")&&!(u.solRpcUrl||u.solanaRpcUrl))throw new Error("signer: solRpcUrl required for Solana simulation and broadcast");let A=x?new l(u.rpcUrl,Number(b[0])):null,k=y.evm&&(x||K(u,"hl")||K(u,"poly"))?A?new a(y.evm.secret).connect(A):new a(y.evm.secret):null,v=A?{simulate:async E=>{if((await A.getNetwork()).chainId!==BigInt(E.chainId))throw new Error("signer: RPC chain mismatch");return await A.call(E),!0},sign:E=>k.signTransaction(E),broadcast:(E,I,T)=>nw(A,E,I,T,{submitPrivate:pa})}:null,_=A?async E=>ow(A,E):void 0,C=new Map,z=E=>E?.surface==="evm-nft"&&String(E?.provider).toLowerCase()==="anvil-nft",U=async(E,I=d(),T="execution")=>{if(!z(E))return null;let F=await Wm(A,E,I,{nowMs:Date.now(),signerAddress:k.address}),Y=C.get(G(E));return Y&&Xa(Y,F,T),F},R={...v?{evm:v,"evm-swap":v,"evm-bridge":v,"evm-nft":v}:{},...k&&K(u,"evm-order")?{"evm-order":Zm(d,k)}:{},...y.btc?{btc:ew(d,y.btc)}:{},...y.sol?{sol:tw(d,y.sol)}:{},...k&&K(u,"hl")?{hl:Ym(d,k)}:{},...k&&K(u,"poly")?{poly:Qm(d,k)}:{},...K(u,"lighter")?{lighter:Xm(d)}:{}};rw(R,n);let $=Fi({...R,...n}),Ke=new Set(Object.keys(R)),pt=new Set(Object.keys(n||{})),Mt=u.surfaces.filter(E=>E!=="cex"&&!Ke.has(E)&&!pt.has(E));if(Mt.length)throw new Error(`signer: ${Mt.join(",")} require local keys or injected surface transports`);let qt=Date.now(),mt=qt+s,Ge=!1,Ye=!1,Xe=()=>{if(!Ye){Ye=!0;for(let E of Object.values(y.cex||{}))for(let I of["apiKeyBytes","apiSecretBytes","passphraseBytes"])E[I]?.fill?.(0)}},Ze=()=>Ge?!1:Ja.existsSync(c.lock)?(Ge=!0,!1):Ja.existsSync(c.vault)&&Date.now()<mt,M=Mm({isArmed:Ze,disarmNow:()=>{Ge=!0,Xe(),Ae(c.lock,`disarmed ${new Date().toISOString()}
 `)}}),Ue=os({host:o,port:i,token:Hm(c.token),policy:u,readPolicy:d,isArmed:Ze,disarm:M.disarm,armGeneration:M.armGeneration,broadcastWithArmFence:M.broadcastWithArmFence,sessionExpiresAtMs:mt,executionOutbox:bs({path:c.executionOutbox,now:Date.now}),observeExecutionTransaction:Jm({provider:A,readPolicy:d}),nowMs:Date.now,simulate:async(E,I)=>(await U(I,d(),"before simulation"),vr(I,$).simulate(E,I)),estimateNetworkFees:_,sign:async(E,I)=>(await U(I,d(),"before signing"),vr(I,$).sign(E,I)),verifySigned:(E,I,T)=>Yi(T?.surface||"evm",E,I,T),broadcast:async(E,I,T)=>(await U(T,d(),"before broadcast"),vr(T,$).broadcast(E,I,T)),confirmArtifact:async(E,I,T)=>{let F=await U(E,T),Y=await sw(E,I,T,F);return Y===!0&&F&&C.set(I,F),Y},decodeEconomics:(E,I)=>Cn(E,I),reserveLedger:(E,I,T={})=>{let F=E?.version===1&&E?.surface?E:null,Y=F?.artifact||E;if(z(F)){let Qe=G(F),We=C.get(Qe);if(!We||Date.now()-Number(We.verifiedAtMs)>15e3)throw new Error("signer: fresh independent Anvil attestation required before reservation");let Ht=Vm(I.rpcUrl,Y.chainId,F,I,{nowMs:Date.now(),signerAddress:k.address});Xa(We,Ht,"before reservation"),C.set(Qe,Ht)}let dr=F?.tradeId||Y?.tradeId;if(!dr)throw new Error("ledger: executable artifact requires a tradeId");let ye;if(F)ye=Cn(F,I);else{if(Y?.value===void 0)throw new Error("ledger: executable artifact value required");let Qe=BigInt(Y.value),We=BigInt(Y.gasLimit??0),Ht=BigInt(Y.maxFeePerGas??Y.gasPrice??0);if(We<=0n||Ht<=0n)throw new Error("ledger: legacy EVM artifact requires gasLimit and fee per gas");let _o=We*Ht+BigInt(Y.l1FeeWei??0)+BigInt(Y.operatorFeeWei??0);ye={unit:"wei",value:Qe.toString(),notional:(Qe+_o).toString(),fee:_o.toString()}}if(Array.isArray(ye.units))return ar({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,tradeId:dr,units:ye.units,policy:I,retryReleasedTradeId:T.retryReleasedTradeId});if(ye.value===void 0||ye.notional===void 0)throw new Error("ledger: decoded value and notional required");return ar({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,tradeId:dr,...ye,policy:I,retryReleasedTradeId:T.retryReleasedTradeId})},commitLedger:E=>ha({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,tradeId:E.tradeId}),releaseLedger:E=>ga({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,tradeId:E.tradeId}),settleFailedLedger:E=>ba({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,tradeId:E.tradeId}),validateReservation:(E,I,T)=>wa({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,reservation:E,policy:I,economics:T}),verifyFeeWaiver:(E,I)=>xa(E,I,c.policyKey),verifyTriggerAttestation:(E,I,T)=>Ea(E,I,c.policyKey,T),inspectCex:Qr,verifyOwnerProof:f?(E,I)=>f.verify(E,I):void 0,verifyCexOwnerProof:f?(E,I)=>f.verify(E,I):void 0,cexExecute:K(u,"cex")?async E=>{let I=d(),T=Qr(E,I,Date.now()),F=T.kind==="spot-limit-create"?"create":T.kind==="spot-limit-cancel"?"cancel":"status";F==="create"&&Ra({envelope:E,paths:c,nowMs:Date.now()});let Y=F==="create"?{operation:F,symbol:T.symbol,side:T.side,baseSize:T.baseSize,limitPrice:T.limitPrice,clientOrderId:T.clientOrderId}:{operation:F,symbol:T.symbol,venueOrderId:T.venueOrderId};return Ha({credential:ye=>y.cex[ye],settleLedger:({tradeId:ye,disposition:Qe,filledQuote:We})=>ya({file:c.ledger,keyFile:c.policyKey,anchorFile:c.ledgerAnchor,policyAnchorFile:c.policyAnchor,tradeId:ye,expectedUnit:T.unit,filledQuote:We,disposition:Qe})}).execute({venue:T.venue,accountId:T.accountId,credentialRef:T.credentialRef,tradeId:T.tradeId,reservedNotional:T.notional,order:Y,store:Pa({file:c.cexOrders,keyFile:c.policyKey,anchorFile:c.cexOrdersAnchor})})}:void 0,ledgerObserver:sa(process.env)?aa({path:c.workflowLedger,telemetry:la(process.env),onError:E=>{try{console.error(`signer: ${E}`)}catch{}}}):null,autonomous:process.env.ORACLE_AUTONOMOUS_TRADING==="1",env:process.env}),wt=setTimeout(()=>Ue.close(),s);return wt.unref(),Ue.on("close",()=>{clearTimeout(wt),Xe()}),Ue.listen(i,o),Ue}var rn="0x420000000000000000000000000000000000000F";function Za(e){let t=e?.code;if(t==="CALL_EXCEPTION"||t==="BAD_DATA")return!0;let r=String(e?.shortMessage||e?.message||e);return/network|timeout|ECONN|ENOTFOUND|EAI_AGAIN|server error|fetch failed|socket/i.test(r)?!1:/execution reverted|revert|invalid opcode|function selector|could not decode/i.test(r)}async function ow(e,t){if(!ke(t?.chainId))return{l1FeeWei:"0",operatorFeeWei:"0"};if(!e||typeof e.call!="function")throw new Error("policy: rollup fee estimate required");let{Interface:r,Transaction:n}=await import("ethers"),o=new r(["function getL1Fee(bytes) view returns (uint256)","function getOperatorFee(uint256) view returns (uint256)","function operatorFeeScalar() view returns (uint32)","function operatorFeeConstant() view returns (uint64)"]),i;try{i=n.from({chainId:t.chainId,to:t.to,data:t.data,value:t.value,gasLimit:t.gasLimit,gasPrice:t.gasPrice,maxFeePerGas:t.maxFeePerGas,maxPriorityFeePerGas:t.maxPriorityFeePerGas,nonce:t.nonce??0,type:t.type,accessList:t.accessList}).unsignedSerialized}catch{throw new Error("policy: rollup fee estimate required")}let s;try{let l=await e.call({to:rn,data:o.encodeFunctionData("getL1Fee",[i])});s=o.decodeFunctionResult("getL1Fee",l)[0].toString()}catch{throw new Error("policy: rollup fee estimate required")}return{l1FeeWei:s,operatorFeeWei:await iw(e,o,t.gasLimit)}}async function iw(e,t,r){let n;try{n=BigInt(r)}catch{throw new Error("policy: rollup fee estimate required")}if(n<0n)throw new Error("policy: rollup fee estimate required");try{let o=await e.call({to:rn,data:t.encodeFunctionData("getOperatorFee",[n])});return t.decodeFunctionResult("getOperatorFee",o)[0].toString()}catch(o){if(!Za(o))throw new Error("policy: rollup fee estimate required")}try{let o=await e.call({to:rn,data:t.encodeFunctionData("operatorFeeScalar")}),i=await e.call({to:rn,data:t.encodeFunctionData("operatorFeeConstant")}),s=BigInt(t.decodeFunctionResult("operatorFeeScalar",o)[0]),l=BigInt(t.decodeFunctionResult("operatorFeeConstant",i)[0]);return(n*s/1000000n+l).toString()}catch(o){if(!Za(o))throw new Error("policy: rollup fee estimate required");return"0"}}async function sw(e,t,r,n=null){return process.stdin.isTTY?(process.stderr.write(br(e,t,r,n)),process.stdin.resume(),new Promise(o=>{let i=s=>{process.stdin.off("data",i),process.stdin.pause(),o(String(s).trim()===t)};process.stdin.once("data",i)})):!1}var tc=`oracle signer (--credential-service oracle-local-signer | --passphrase-file <0600 file>) [--port 9462] [--session-seconds 120]
 Starts a loopback-only, short-lived local signer. No secret may be passed directly or through the environment.`,nn=(e,t,r)=>{let n=e.indexOf(t);return n>=0?e[n+1]:r};async function cw(e=[],t={}){if(e.includes("--help"))return(t.out||process.stdout).write(tc+`
 `),0;let r=nn(e,"--passphrase-file"),n=await ec({configDir:aw.join(t.configDir||pr(),"signer"),passphraseFile:r,credentialService:nn(e,"--credential-service"),port:Number(nn(e,"--port",9462)),sessionMs:Number(nn(e,"--session-seconds",120))*1e3});return(t.out||process.stdout).write(`Oracle signer listening on loopback for a short-lived session.