@oracle-agent/oracle 0.35.54 → 0.35.56

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-var W=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import L from"node:fs";import ot from"node:os";import x from"node:path";import{fileURLToPath as it}from"node:url";function fe(){return process.env.ORACLE_FAKE_HOME||ot.homedir()}function at(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function $(){return at()?process.env.ORACLE_CONFIG_DIR||x.join(fe(),".config","oracle"):x.join(fe(),".config","oracle")}function ct(){return x.join($(),"desk.json")}function lt(){return x.join($(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=lt();if(L.existsSync(i))for(let o of L.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let l=a[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),t(a[1],l)}}catch{}try{let i=ct();if(L.existsSync(i)){let o=JSON.parse(L.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var st,Dr,pe=W(()=>{st=x.dirname(it(import.meta.url)),Dr=x.resolve(st,"../..");try{E()}catch{}});var Ee=W(()=>{});var wi,hi,D=W(()=>{wi=300*1e3,hi=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})()});pe();import m from"node:fs";import H from"node:path";import{createCipheriv as ut,createDecipheriv as dt,randomBytes as O,scryptSync as ft}from"node:crypto";import s from"node:fs";import p from"node:path";var me="ORACLE-LOCAL-VAULT",we=1,k=Object.freeze({N:1<<17,r:8,p:1}),pt=256*1024*1024,mt=16*1024;function P(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function he(e,n,t=k){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");if(r.includes("\0"))throw new Error("local-vault: refusing zeroed passphrase material");return ft(r,n,32,{...t,maxmem:pt})}function ge(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:me,version:we,kdf:{name:"scrypt",...k,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},l=he(n,i);try{let f=ut("aes-256-gcm",l,o);f.setAAD(Buffer.from(JSON.stringify(a)));let c=Buffer.concat([f.update(r),f.final()]);return{...a,ciphertext:c.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{l.fill(0),r.fill(0)}}function T(e,n){if(e?.magic!==me||e?.version!==we)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==k.N||e.kdf.r!==k.r||e.kdf.p!==k.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!t.includes(u)))throw new Error("local-vault: unexpected vault field");let r=P(e.kdf.salt,32,"salt"),i=P(e.cipher.iv,12,"iv"),o=P(e.tag,16,"tag"),a=P(e.ciphertext,1,"ciphertext",{max:mt}),{ciphertext:l,tag:f,...c}=e,d=he(n,r);try{let u=dt("aes-256-gcm",d,i);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(o),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function wt(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function U(e){let n=p.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(wt(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function N(e){return JSON.parse(h(e))}function ye(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
-`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(p.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let l=s.openSync(p.dirname(e),"r");try{s.fsyncSync(l)}finally{s.closeSync(l)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function g(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(p.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}function ht(e,n){try{s.linkSync(e,n)}catch(r){throw r?.code==="EEXIST"?new Error("export destination already exists; choose a new owner-only file"):r}s.chmodSync(n,384),s.unlinkSync(e);let t=s.openSync(p.dirname(n),"r");try{s.fsyncSync(t)}finally{s.closeSync(t)}}function be(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),U(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,String(n)),s.fsyncSync(r),s.closeSync(r),r=void 0,ht(t,e)}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}}import w from"node:path";import vr from"node:os";import{createHash as Ir,randomBytes as ad}from"node:crypto";import{Interface as ce,keccak256 as ld}from"ethers";import{Transaction as dd}from"@scure/btc-signer";import{ed25519 as pd}from"@noble/curves/ed25519.js";import{Interface as xt,MaxUint256 as Sn,isAddress as An,keccak256 as vn,toUtf8Bytes as In}from"ethers";import{Interface as bt,isAddress as rn}from"ethers";import{isAddress as Yr}from"ethers";var an=new bt(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as Et,isAddress as un}from"ethers";var mn=new Et(["function approve(address spender,uint256 amount) returns (bool)"]),wn=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var _n=new xt(["function approve(address spender,uint256 amount) returns (bool)"]);Ee();import{readFileSync as Pn,readdirSync as Bn,existsSync as St}from"node:fs";import{dirname as At,join as C}from"node:path";import{fileURLToPath as vt}from"node:url";var _=At(vt(import.meta.url));function It(){let e=[C(_,"descriptors"),C(_,"clear-sign","descriptors"),C(_,"..","clear-sign","descriptors"),C(_,"..","..","clear-sign","descriptors"),C(_,"..","..","..","clear-sign","descriptors")];for(let n of e)if(St(n))return n;return e[0]}var qn=It();var Mn=(1n<<256n)-1n;import{Address as Yn,NETWORK as Xn,OutScript as Zn,RawTx as Qn,SigHash as eo,TEST_NETWORK as to,Transaction as ro}from"@scure/btc-signer";import{createHash as kt}from"node:crypto";import{base58 as so}from"@scure/base";import{getCompiledTransactionMessageDecoder as co}from"@solana/transaction-messages";var xe=e=>kt("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),lo=new Map([[xe("route"),{name:"route",prefixBytes:0}],[xe("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);import{AsyncLocalStorage as Ot}from"node:async_hooks";var po=new Ot;var Ao=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,vo=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,Io=AbortSignal.prototype.throwIfAborted,ko=EventTarget.prototype.addEventListener,Oo=EventTarget.prototype.removeEventListener,To=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null;var No=64*1024,Co=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024});var qo=Object.freeze({tradexyz:"xyz",ventuals:"vntl",hypernova:"hyna",paradex:"para",entropy:"io",entropyio:"io"});var Uo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Vo=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Go="0x"+"00".repeat(32);var Nt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),ei=Object.freeze(Nt.map(e=>e[0]));import{base58 as Qs}from"@scure/base";import{Interface as Ne}from"ethers";D();import{TypedDataEncoder as Ki,getAddress as Ji}from"ethers";D();import{TypedDataEncoder as xi,getAddress as Si,isAddress as Ai}from"ethers";var _t=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),Rt=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as $i,getAddress as Pi,isAddress as Bi}from"ethers";var ki=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});D();var Lt=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),zi=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var $t=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),Wi=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var Xi=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Dt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var ms=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var jt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),ws=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),hs=new Ne(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),gs=new Ne(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),ys=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var Ft=Object.freeze([...Dt]),bs=Object.freeze({...jt});import{ed25519 as Ps}from"@noble/curves/ed25519.js";import{base58 as Ds}from"@scure/base";import{RawTx as Fs,SigHash as qs,Transaction as Ms}from"@scure/btc-signer";import{Transaction as zs,keccak256 as Ws,verifyTypedData as Us}from"ethers";import{encode as Ss}from"@msgpack/msgpack";import{keccak256 as vs,verifyTypedData as Is}from"ethers";var ks=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Os=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{closeSync as wa,constants as zt,fchmodSync as ha,fsyncSync as ga,lstatSync as ya,mkdirSync as ba,openSync as Ea,readFileSync as xa,renameSync as Sa,rmSync as Aa,writeFileSync as va}from"node:fs";import{wordlists as fa}from"ethers";var Oa=zt.O_NOFOLLOW??0;import{wordlists as Ca}from"ethers";var _e=64*1024;var Ra=32*1024;var Vt=["schemaVersion","buildVersion","recordType","execution","custody"],Pa=[...Vt,"recordHash"];var Ba=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Kt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),qe=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),Ma=new Set(qe);var Qt=64*1024*1024;var Ja=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),Ga=Object.freeze(["read","simulate"]);var Ya=1440*60;var ic=Object.freeze(["privkey","wif","xprv","seed"]);var sc=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),ac=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var te=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),dc=Object.freeze(Object.fromEntries(te.map((e,n)=>[e,Object.freeze(n+1<te.length?[te[n+1]]:[])])));var er=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var rr=Object.freeze(["owner","operator","agent","viewer"]),nr=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),or=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),Gc=Object.freeze(["owner"]),Yc=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),Xc=new Set(rr),Zc=new Set(nr),Qc=new Set(Object.values(or));var ir=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),el=Object.freeze(Object.fromEntries(Object.entries(ir).map(([e,n])=>[e,Object.freeze([...n])])));var sr=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),ar=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),cr=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var ol=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),il=new Set(sr),sl=new Set(ar),al=new Set(cr);var cl=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var ll=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var wl=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var xl=32*1024*1024;var Al=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as ur,randomBytes as Dl,timingSafeEqual as dr}from"node:crypto";import fr from"node:fs";import S from"node:path";import{homedir as re}from"node:os";import{join as ne}from"node:path";var Me=process.env.ORACLE_PUBLIC_DESKTOP==="1",lr=Me?process.env.ORACLE_CONFIG_DIR||ne(re(),".config","oracle"):ne(re(),".config","oracle"),Ol=Me?lr:ne(re(),".config","mad-desk");var Rl="0".repeat(64),Ll=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function F(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(F).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+F(e[t])).join(",")+"}"}var $l=Promise.resolve();function pr(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return fr.realpathSync(a)}catch{return S.resolve(a)}},r=t(S.dirname(S.resolve(e))),i=t(S.dirname(S.resolve(n))),o=(a,l)=>l===a||l.startsWith(a+S.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var oe=(e,n)=>ur("sha256",n).update(F(e)).digest("hex"),mr=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&dr(t,r)};function wr(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:oe(r,n)}}}function He(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!mr(r?.integrity?.mac,oe(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function hr(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let l=He(e,t);o=l.present&&l.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:oe(a,t)}})+`
-`)}function ze(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=He(r,i);pr(r,e);let a=Number(o.sequence||0)+1,l=wr(t,i,{sequence:a});hr(r,a,i,l?.integrity?.mac??null),g(e,JSON.stringify(l,null,2)+`
-`)}import{Wallet as ie}from"ethers";import{base58 as se}from"@scure/base";import{ed25519 as Ke}from"@noble/curves/ed25519.js";import{NETWORK as Je,TEST_NETWORK as Ge,WIF as gr,p2wpkh as We}from"@scure/btc-signer";import{pubECDSA as yr}from"@scure/btc-signer/utils.js";var q=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},br=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},Ue=e=>{let n=String(e||"").trim();try{let t=Buffer.from(se.decode(n));return se.encode(t)===n?t:null}catch{return null}},ae=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(Ke.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},Ve=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),y=(e,n)=>{if(n==="sol")return ae(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},Er=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return y(t,n)};function b(e,n){let t=String(n||"").trim();if(e==="evm")return new ie(t).privateKey;if(e==="btc")for(let o of[Je,Ge])try{return Buffer.from(gr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let c=q(t.slice(4));if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}if(/^base58:/i.test(t)){let c=Ue(t.slice(7));if(!Ve(c))throw new Error("sol: invalid explicit base58 private key");return ae(c)}if(/^0x/i.test(t)){let c=q(t);if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}let o=q(t),a=o&&(o.length===32||o.length===64)?y(o,"sol"):null,l=Ue(t),f=Ve(l);if(a&&f&&!a.equals(f))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(f)return ae(l);if(o)return y(o,"sol")}let r=q(t);if(r)return e==="evm"?new ie(`0x${r.toString("hex")}`).privateKey:y(r,e);let i=br(t);if(i)return y(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return Er(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return b(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let t=new ie(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=y(n,"btc"),r=yr(t);return{kind:e,secret:t.toString("hex"),addresses:[We(r,Je).address,We(r,Ge).address]}}if(e==="sol"){let t=y(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[se.encode(Ke.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function M(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=A(o,b(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let l=(c,d=!0)=>{let u=a[c];if(!(!d&&u===void 0)){if(!Array.isArray(u)||u.length<4||u.some(I=>!Number.isInteger(I)||I<0||I>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(u)}},f=a.apiSecretEncoding;if(f!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:l("apiKeyBytes"),apiSecretBytes:l("apiSecretBytes"),apiSecretEncoding:f,passphraseBytes:l("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function Ye(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function Xe(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var Ql=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),eu=Object.freeze(["binance","bybit","okx","coinbase"]),tu=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),ru=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),nu=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),ou=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),iu=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),su=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),au=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),cu=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),lu=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var Ar=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Ze=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var bu=256*1024;var Md=new ce(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Hd=new ce(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),zd=new ce(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Qe(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||w.join(process.env.XDG_STATE_HOME||w.join(vr.homedir(),".local","state"),"oracle"),t=Ir("sha256").update(w.resolve(e)).digest("hex").slice(0,16);return{vault:w.join(e,"vault.json"),policy:w.join(e,"signer-policy.json"),policyKey:w.join(e,"policy-integrity-key"),policyAnchor:w.join(n,`signer-policy-${t}.high-water`),ledger:w.join(e,"signer-ledger.json"),ledgerAnchor:w.join(n,`signer-ledger-${t}.high-water`),executionOutbox:w.join(e,"signer-execution-outbox.json"),cexOrders:w.join(e,"cex-orders.json"),cexOrdersAnchor:w.join(n,`cex-orders-${t}.high-water`),token:w.join(e,"signer-token"),lock:w.join(n,`signer-${t}.lock`),workflowLedger:w.join(e,"workflow-events.jsonl")}}import{randomBytes as kr}from"node:crypto";import{Wallet as et}from"ethers";var rt=`oracle sign init|import|import-phrase|export|policy|status|unlock|lock|doctor
+var V=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import R from"node:fs";import it from"node:os";import x from"node:path";import{fileURLToPath as st}from"node:url";function me(){return process.env.ORACLE_FAKE_HOME||it.homedir()}function ct(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function $(){return ct()?process.env.ORACLE_CONFIG_DIR||x.join(me(),".config","oracle"):x.join(me(),".config","oracle")}function lt(){return x.join($(),"desk.json")}function ut(){return x.join($(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=ut();if(R.existsSync(i))for(let o of R.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let l=a[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),t(a[1],l)}}catch{}try{let i=lt();if(R.existsSync(i)){let o=JSON.parse(R.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var at,qr,we=V(()=>{at=x.dirname(st(import.meta.url)),qr=x.resolve(at,"../..");try{E()}catch{}});var Se=V(()=>{});var yi,bi,D=V(()=>{yi=300*1e3,bi=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})()});we();import m from"node:fs";import W from"node:path";import{createCipheriv as dt,createDecipheriv as ft,randomBytes as O,scryptSync as pt}from"node:crypto";import s from"node:fs";import p from"node:path";var he="ORACLE-LOCAL-VAULT",ge=1,k=Object.freeze({N:1<<17,r:8,p:1}),mt=256*1024*1024,wt=16*1024;function P(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function ye(e,n,t=k){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");if(r.includes("\0"))throw new Error("local-vault: refusing zeroed passphrase material");return pt(r,n,32,{...t,maxmem:mt})}function be(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:he,version:ge,kdf:{name:"scrypt",...k,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},l=ye(n,i);try{let f=dt("aes-256-gcm",l,o);f.setAAD(Buffer.from(JSON.stringify(a)));let c=Buffer.concat([f.update(r),f.final()]);return{...a,ciphertext:c.toString("base64"),tag:f.getAuthTag().toString("base64")}}finally{l.fill(0),r.fill(0)}}function T(e,n){if(e?.magic!==he||e?.version!==ge)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==k.N||e.kdf.r!==k.r||e.kdf.p!==k.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(u=>!["address","addresses","kind","createdAt"].includes(u))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(u=>!t.includes(u)))throw new Error("local-vault: unexpected vault field");let r=P(e.kdf.salt,32,"salt"),i=P(e.cipher.iv,12,"iv"),o=P(e.tag,16,"tag"),a=P(e.ciphertext,1,"ciphertext",{max:wt}),{ciphertext:l,tag:f,...c}=e,d=ye(n,r);try{let u=ft("aes-256-gcm",d,i);return u.setAAD(Buffer.from(JSON.stringify(c))),u.setAuthTag(o),Buffer.concat([u.update(a),u.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{d.fill(0)}}function ht(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function J(e){let n=p.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(ht(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function N(e){return JSON.parse(h(e))}function Ee(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),J(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
+`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(p.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let l=s.openSync(p.dirname(e),"r");try{s.fsyncSync(l)}finally{s.closeSync(l)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function g(e,n,{beforeRename:t}={}){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),J(e);let r=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let i=s.openSync(r,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(i,String(n)),s.fsyncSync(i)}finally{s.closeSync(i)}t?.(),s.renameSync(r,e),s.chmodSync(e,384);let o=s.openSync(p.dirname(e),"r");try{s.fsyncSync(o)}finally{s.closeSync(o)}}catch(i){try{s.unlinkSync(r)}catch{}throw i}}function gt(e,n){try{s.linkSync(e,n)}catch(r){throw r?.code==="EEXIST"?new Error("export destination already exists; choose a new owner-only file"):r}s.chmodSync(n,384),s.unlinkSync(e);let t=s.openSync(p.dirname(n),"r");try{s.fsyncSync(t)}finally{s.closeSync(t)}}function xe(e,n){s.mkdirSync(p.dirname(e),{recursive:!0,mode:448}),J(e);let t=p.join(p.dirname(e),`.${p.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,String(n)),s.fsyncSync(r),s.closeSync(r),r=void 0,gt(t,e)}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}}import w from"node:path";import Tr from"node:os";import{createHash as Nr,randomBytes as vd}from"node:crypto";import{Interface as ue,keccak256 as kd}from"ethers";import{Transaction as Td}from"@scure/btc-signer";import{ed25519 as Cd}from"@noble/curves/ed25519.js";import{Interface as St,MaxUint256 as kn,isAddress as On,keccak256 as Tn,toUtf8Bytes as Nn}from"ethers";import{Interface as Et,isAddress as an}from"ethers";import{isAddress as en}from"ethers";var dn=new Et(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as xt,isAddress as mn}from"ethers";var yn=new xt(["function approve(address spender,uint256 amount) returns (bool)"]),bn=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Pn=new St(["function approve(address spender,uint256 amount) returns (bool)"]);Se();import{readFileSync as Fn,readdirSync as jn,existsSync as At}from"node:fs";import{dirname as vt,join as C}from"node:path";import{fileURLToPath as It}from"node:url";var L=vt(It(import.meta.url));function kt(){let e=[C(L,"descriptors"),C(L,"clear-sign","descriptors"),C(L,"..","clear-sign","descriptors"),C(L,"..","..","clear-sign","descriptors"),C(L,"..","..","..","clear-sign","descriptors")];for(let n of e)if(At(n))return n;return e[0]}var Wn=kt();var Un=(1n<<256n)-1n;import{Address as eo,NETWORK as to,OutScript as ro,RawTx as no,SigHash as oo,TEST_NETWORK as io,Transaction as so}from"@scure/btc-signer";import{createHash as Ot}from"node:crypto";import{base58 as uo}from"@scure/base";import{getCompiledTransactionMessageDecoder as po}from"@solana/transaction-messages";var Ae=e=>Ot("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),mo=new Map([[Ae("route"),{name:"route",prefixBytes:0}],[Ae("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);import{AsyncLocalStorage as Tt}from"node:async_hooks";var go=new Tt;var Oo=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get,To=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"reason")?.get,No=AbortSignal.prototype.throwIfAborted,Co=EventTarget.prototype.addEventListener,Lo=EventTarget.prototype.removeEventListener,_o=typeof AbortSignal.any=="function"?AbortSignal.any.bind(AbortSignal):null;var Ro=64*1024,$o=Object.freeze({depth:32,nodes:1e4,fields:1e4,arrayLength:1e4,bytes:1024*1024});var Wo=Object.freeze({tradexyz:"xyz",ventuals:"vntl",hypernova:"hyna",paradex:"para",entropy:"io",entropyio:"io"});var Ko=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),Go=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var Zo="0x"+"00".repeat(32);var Lt=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),ni=Object.freeze(Lt.map(e=>e[0]));import{base58 as ra}from"@scure/base";import{Interface as Ce}from"ethers";D();import{TypedDataEncoder as Yi,getAddress as Xi}from"ethers";D();import{TypedDataEncoder as vi,getAddress as Ii,isAddress as ki}from"ethers";var Rt=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),$t=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as Mi,getAddress as Di,isAddress as Fi}from"ethers";var Ni=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});D();var Pt=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),Vi=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Bt=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),Ji=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var es=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var Ft=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var gs=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var jt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),ys=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),bs=new Ce(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Es=new Ce(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),xs=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var qt=Object.freeze([...Ft]),Ss=Object.freeze({...jt});import{ed25519 as Ds}from"@noble/curves/ed25519.js";import{base58 as js}from"@scure/base";import{RawTx as Hs,SigHash as zs,Transaction as Ws}from"@scure/btc-signer";import{Transaction as Vs,keccak256 as Js,verifyTypedData as Ks}from"ethers";import{encode as Is}from"@msgpack/msgpack";import{keccak256 as Os,verifyTypedData as Ts}from"ethers";var Ns=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Cs=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});import{closeSync as Aa,constants as Jt,fchmodSync as va,fsyncSync as Ia,lstatSync as ka,mkdirSync as Oa,openSync as Ta,readFileSync as Na,renameSync as Ca,rmSync as La,writeFileSync as _a}from"node:fs";import{wordlists as wa}from"ethers";import F from"node:fs";var Ea=F.constants.O_CREAT|F.constants.O_EXCL|F.constants.O_WRONLY|(F.constants.O_NOFOLLOW||0);var Ma=Jt.O_NOFOLLOW??0;import{wordlists as ja}from"ethers";var _e=64*1024;var Ha=32*1024;var Yt=["schemaVersion","buildVersion","recordType","execution","custody"],Ua=[...Yt,"recordHash"];var Va=Object.freeze({signed:new Set(["workflow.signed","legacy.signed"]),submitted:new Set(["workflow.submitted","legacy.broadcast"]),finalized:new Set(["workflow.finalized"]),reorged:new Set(["workflow.reorged"]),orphaned:new Set(["workflow.orphaned"]),compensating:new Set(["workflow.compensating"]),compensated:new Set(["workflow.compensated"])});var Xt=Object.freeze(["draft","checked","approval","signed","submitted","finalized","reorged","orphaned","compensating","compensated","failed","cancelled"]),qe=Object.freeze(["workflow.drafted","workflow.checked","workflow.approval_requested","workflow.approval_granted","workflow.signed","workflow.submitted","workflow.finalized","workflow.reorged","workflow.orphaned","workflow.compensating","workflow.compensated","workflow.failed","workflow.cancelled","workflow.annotated"]),Xa=new Set(qe);var nr=64*1024*1024;var oc=Object.freeze(["chainId","agentAddress","accountAddress","actions","targets","maxValueWei","maxGasWei","maxSlippageBps","expiresAt","nonce","revocationKey"]),ic=Object.freeze(["read","simulate"]);var sc=1440*60;var wc=Object.freeze(["privkey","wif","xprv","seed"]);var hc=Object.freeze([{rule:"raw-32-byte-hex-key",re:/^0x[0-9a-fA-F]{64}$/},{rule:"raw-32-byte-hex-bare",re:/^[0-9a-fA-F]{64}$/},{rule:"extended-private-key",re:/\b(?:xprv|tprv|yprv|zprv)[1-9A-HJ-NP-Za-km-z]{107}\b/},{rule:"bitcoin-wif",re:/\b[59KLc][1-9A-HJ-NP-Za-km-z]{50,51}\b/},{rule:"bip39-mnemonic",re:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/},{rule:"bearer-token",re:/bearer\s+[A-Za-z0-9._~+/=-]+/i},{rule:"pem-private-key",re:/-----BEGIN[A-Z ]*PRIVATE KEY-----/},{rule:"keystore-path",re:/keystore/i},{rule:"signer-url",re:/https?:\/\/\S*sign/i},{rule:"authorization-header",re:/authorization\s*:/i}]),gc=Object.freeze(["grantid","id","hash","sha256","sha256hex","checksum","txhash","transactionhash","blockhash","digest","userophash","commithash","prevhash","intenthash","canonicalhash","payloadhash","requestid"]);var ne=Object.freeze(["intent","quote_comparison","simulation","prepared","approval","signed","broadcast","settlement","balance_delta","position"]),xc=Object.freeze(Object.fromEntries(ne.map((e,n)=>[e,Object.freeze(n+1<ne.length?[ne[n+1]]:[])])));var or=Object.freeze({intent:"draft",quote_comparison:"draft",simulation:"draft",prepared:"checked",approval:"approval",signed:"signed",broadcast:"submitted",settlement:"finalized",balance_delta:"compensated",position:"compensated"});var sr=Object.freeze(["owner","operator","agent","viewer"]),ar=Object.freeze(["tenant","config","policy","grant","workflow","trade","receipt","audit","telemetry","context","lifecycle"]),cr=Object.freeze({read:"read",create:"create",update:"update",delete:"delete",manage:"manage",prepare:"prepare",cancel:"cancel",export:"export",approve:"approve"}),il=Object.freeze(["owner"]),sl=Object.freeze({ALLOW_ROLE_PERMISSION:"allow.role_permission",DENY_MISSING_CONTEXT:"deny.missing_context",DENY_INVALID_CONTEXT:"deny.invalid_context",DENY_INVALID_REQUEST:"deny.invalid_request",DENY_UNKNOWN_RESOURCE:"deny.unknown_resource",DENY_UNKNOWN_ACTION:"deny.unknown_action",DENY_UNBOUND_OBJECT:"deny.unbound_object",DENY_TENANT_MISMATCH:"deny.tenant_mismatch",DENY_RESOURCE_MISMATCH:"deny.resource_mismatch",DENY_ROLE_PERMISSION:"deny.role_permission",DENY_POLICY_NOT_APPROVER:"deny.policy_not_approver"}),al=new Set(sr),cl=new Set(ar),ll=new Set(Object.values(cr));var lr=Object.freeze({owner:Object.freeze(["tenant:read","tenant:manage","config:read","config:manage","policy:read","policy:manage","grant:read","grant:create","grant:update","grant:delete","grant:manage","workflow:read","workflow:create","workflow:update","workflow:delete","workflow:cancel","workflow:approve","trade:read","trade:prepare","receipt:read","receipt:export","audit:read","audit:export","telemetry:read","telemetry:create","telemetry:export","context:read","context:create","context:update","context:delete","context:manage","context:export","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:delete","lifecycle:manage","lifecycle:approve","lifecycle:export"]),operator:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","workflow:cancel","trade:read","trade:prepare","receipt:read","audit:read","telemetry:read","telemetry:create","context:read","context:create","context:update","context:delete","lifecycle:read","lifecycle:create","lifecycle:update","lifecycle:manage"]),agent:Object.freeze(["tenant:read","config:read","policy:read","grant:read","workflow:read","workflow:create","workflow:update","trade:read","trade:prepare","receipt:read","telemetry:create","context:read","context:create","context:update","lifecycle:read"]),viewer:Object.freeze(["tenant:read","config:read","grant:read","workflow:read","trade:read","receipt:read","audit:read","telemetry:read","context:read","lifecycle:read"])}),ul=Object.freeze(Object.fromEntries(Object.entries(lr).map(([e,n])=>[e,Object.freeze([...n])])));var ur=Object.freeze(["succeeded","denied","invalid","failed","cancelled","timed_out","unavailable","skipped"]),dr=Object.freeze(["workflow","task","intent","plan","run","event","eval"]),fr=Object.freeze(["taskId","intentId","planId","runId","eventId"]);var ml=Object.freeze({maxAttributes:24,maxKeyLength:48,maxStringLength:256,maxArrayLength:8}),wl=new Set(ur),hl=new Set(dr),gl=new Set(fr);var yl=Object.freeze(["authorization","bearer","cookie","credential","password","passphrase","secret","token","privatekey","privkey","seed","mnemonic","keystore","signature","prompt","systemmessage","usermessage","assistantmessage","rawtransaction","signedtransaction","serializedtransaction","transactionbytes","calldata","callbytes","inputdata"]);var bl=Object.freeze({taskId:"x-oracle-task-id",intentId:"x-oracle-intent-id",planId:"x-oracle-plan-id",runId:"x-oracle-run-id",eventId:"x-oracle-event-id"});var Il=Object.freeze({"workflow.cancelled":"cancelled","workflow.failed":"failed"});var Ll=32*1024*1024;var Rl=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as mr,timingSafeEqual as wr}from"node:crypto";import hr from"node:fs";import S from"node:path";import{homedir as oe}from"node:os";import{join as ie}from"node:path";var He=process.env.ORACLE_PUBLIC_DESKTOP==="1",pr=He?process.env.ORACLE_CONFIG_DIR||ie(oe(),".config","oracle"):ie(oe(),".config","oracle"),Ml=He?pr:ie(oe(),".config","mad-desk");var Hl="0".repeat(64),zl=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function q(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(q).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+q(e[t])).join(",")+"}"}var Wl=Promise.resolve();function gr(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return hr.realpathSync(a)}catch{return S.resolve(a)}},r=t(S.dirname(S.resolve(e))),i=t(S.dirname(S.resolve(n))),o=(a,l)=>l===a||l.startsWith(a+S.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var se=(e,n)=>mr("sha256",n).update(q(e)).digest("hex"),yr=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&wr(t,r)};function br(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:se(r,n)}}}function ze(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!yr(r?.integrity?.mac,se(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function Er(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let l=ze(e,t);o=l.present&&l.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),g(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:se(a,t)}})+`
+`)}function We(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=ze(r,i);gr(r,e);let a=Number(o.sequence||0)+1,l=br(t,i,{sequence:a});Er(r,a,i,l?.integrity?.mac??null),g(e,JSON.stringify(l,null,2)+`
+`)}import{Wallet as ae}from"ethers";import{base58 as ce}from"@scure/base";import{ed25519 as Ke}from"@noble/curves/ed25519.js";import{NETWORK as Ge,TEST_NETWORK as Ye,WIF as xr,p2wpkh as Ue}from"@scure/btc-signer";import{pubECDSA as Sr}from"@scure/btc-signer/utils.js";var H=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},Ar=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},Ve=e=>{let n=String(e||"").trim();try{let t=Buffer.from(ce.decode(n));return ce.encode(t)===n?t:null}catch{return null}},le=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(Ke.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},Je=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),y=(e,n)=>{if(n==="sol")return le(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},vr=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return y(t,n)};function b(e,n){let t=String(n||"").trim();if(e==="evm")return new ae(t).privateKey;if(e==="btc")for(let o of[Ge,Ye])try{return Buffer.from(xr(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let c=H(t.slice(4));if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}if(/^base58:/i.test(t)){let c=Ve(t.slice(7));if(!Je(c))throw new Error("sol: invalid explicit base58 private key");return le(c)}if(/^0x/i.test(t)){let c=H(t);if(!c)throw new Error("sol: invalid explicit hex private key");return y(c,"sol")}let o=H(t),a=o&&(o.length===32||o.length===64)?y(o,"sol"):null,l=Ve(t),f=Je(l);if(a&&f&&!a.equals(f))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(f)return le(l);if(o)return y(o,"sol")}let r=H(t);if(r)return e==="evm"?new ae(`0x${r.toString("hex")}`).privateKey:y(r,e);let i=Ar(t);if(i)return y(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return vr(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return b(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function A(e,n){if(e==="evm"){let t=new ae(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=y(n,"btc"),r=Sr(t);return{kind:e,secret:t.toString("hex"),addresses:[Ue(r,Ge).address,Ue(r,Ye).address]}}if(e==="sol"){let t=y(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[ce.encode(Ke.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function z(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:A(n.kind||"evm",b(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=A(o,b(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let l=(c,d=!0)=>{let u=a[c];if(!(!d&&u===void 0)){if(!Array.isArray(u)||u.length<4||u.some(I=>!Number.isInteger(I)||I<0||I>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(u)}},f=a.apiSecretEncoding;if(f!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:l("apiKeyBytes"),apiSecretBytes:l("apiSecretBytes"),apiSecretEncoding:f,passphraseBytes:l("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function Xe(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function Ze(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var du=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),fu=Object.freeze(["binance","bybit","okx","coinbase"]),pu=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),mu=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),wu=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),hu=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),gu=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),yu=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),bu=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Eu=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),xu=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var Or=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Qe=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Lu=256*1024;var cf=new ue(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),lf=new ue(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),uf=new ue(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function et(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||w.join(process.env.XDG_STATE_HOME||w.join(Tr.homedir(),".local","state"),"oracle"),t=Nr("sha256").update(w.resolve(e)).digest("hex").slice(0,16);return{vault:w.join(e,"vault.json"),policy:w.join(e,"signer-policy.json"),policyKey:w.join(e,"policy-integrity-key"),policyAnchor:w.join(n,`signer-policy-${t}.high-water`),ledger:w.join(e,"signer-ledger.json"),ledgerAnchor:w.join(n,`signer-ledger-${t}.high-water`),executionOutbox:w.join(e,"signer-execution-outbox.json"),cexOrders:w.join(e,"cex-orders.json"),cexOrdersAnchor:w.join(n,`cex-orders-${t}.high-water`),token:w.join(e,"signer-token"),lock:w.join(n,`signer-${t}.lock`),workflowLedger:w.join(e,"workflow-events.jsonl")}}import{randomBytes as Cr}from"node:crypto";import{Wallet as tt}from"ethers";var nt=`oracle sign init|import|import-phrase|export|policy|status|unlock|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -15,18 +15,18 @@ var W=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,v=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},tt=e=>{let n=String(v(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Or(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=l=>{for(let f of l){if(f===3){a(),r(new Error("cancelled"));return}if(f===13||f===10){a(),process.stderr.write(`
-`),t(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function le(e,n){let t=v(e,"--passphrase-file");return t?h(t):Or("Vault passphrase: ",n)}function Tr(e){return e.addresses.join(", ")}function Nr(e,n){m.mkdirSync(H.dirname(e.vault),{recursive:!0,mode:448}),g(e.lock,`locked
-`),ye(e.vault,n),m.existsSync(e.policyKey)||g(e.policyKey,kr(32).toString("hex")+`
-`)}async function Cr(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||$(),o=Qe(H.join(i,"signer"));if(!r||r==="help")return t.write(rt+`
+They are never accepted as argument values or inherited environment variables.`,v=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},rt=e=>{let n=String(v(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Lr(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=l=>{for(let f of l){if(f===3){a(),r(new Error("cancelled"));return}if(f===13||f===10){a(),process.stderr.write(`
+`),t(i);return}f===127?i=i.slice(0,-1):i+=String.fromCharCode(f)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function de(e,n){let t=v(e,"--passphrase-file");return t?h(t):Lr("Vault passphrase: ",n)}function _r(e){return e.addresses.join(", ")}function Rr(e,n){m.mkdirSync(W.dirname(e.vault),{recursive:!0,mode:448}),g(e.lock,`locked
+`),Ee(e.vault,n),m.existsSync(e.policyKey)||g(e.policyKey,Cr(32).toString("hex")+`
+`)}async function $r(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||$(),o=et(W.join(i,"signer"));if(!r||r==="help")return t.write(nt+`
 `),0;if(r==="status")return t.write(JSON.stringify({initialized:m.existsSync(o.vault),policyConfigured:m.existsSync(o.policy),armed:m.existsSync(o.vault)&&!m.existsSync(o.lock),disarmed:m.existsSync(o.lock)})+`
-`),0;if(r==="lock")return m.mkdirSync(H.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
+`),0;if(r==="lock")return m.mkdirSync(W.dirname(o.lock),{recursive:!0,mode:448}),g(o.lock,`locked
 `),t.write(`Local signer locked.
-`),0;if(r==="unlock"){if(!e.includes("--acknowledge-local-signing"))throw new Error("unlock requires --acknowledge-local-signing");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=await le(e,n);T(N(o.vault),c).fill(0);try{m.unlinkSync(o.lock)}catch(u){if(u.code!=="ENOENT")throw u}return t.write(`Local signer unlocked. Transaction signing still requires exact policy and owner confirmation.
+`),0;if(r==="unlock"){if(!e.includes("--acknowledge-local-signing"))throw new Error("unlock requires --acknowledge-local-signing");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=await de(e,n);T(N(o.vault),c).fill(0);try{m.unlinkSync(o.lock)}catch(u){if(u.code!=="ENOENT")throw u}return t.write(`Local signer unlocked. Transaction signing still requires exact policy and owner confirmation.
 `),0}if(r==="doctor"){let c=[];return m.existsSync(o.vault)||c.push("vault missing"),m.existsSync(o.policy)||c.push("policy missing (empty allowlists fail closed)"),t.write(c.length?`Signer not ready: ${c.join("; ")}
 `:`Signer files ready; explicitly unlock locally before a bounded signing session.
-`),c.length?1:0}if(r==="policy"){if(!m.existsSync(o.vault)||!m.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let c=v(e,"--policy-file");if(!c)throw new Error("policy requires --policy-file <0600 JSON file>");let d;try{d=JSON.parse(h(c))}catch{throw new Error("policy file must contain valid JSON")}for(let u of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(d[u])||d[u].length===0)throw new Error(`policy: ${u} allowlist is empty`);return ze(o.policy,o.policyKey,d,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(r==="export"){if(!e.includes("--acknowledge-raw-key-export"))throw new Error("export requires --acknowledge-raw-key-export");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=tt(e),d=v(e,"--output-file");if(!d)throw new Error("export requires --output-file <0600 file>");let u=H.resolve(d),I=await le(e,n),ue=N(o.vault),de=T(ue,I);try{let z=M(de,ue.meta)[c];if(!z)throw new Error(`local signer has no ${c} key`);let nt=c==="evm"?z.secret:`0x${z.secret.replace(/^0x/,"")}`;be(u,`${nt}
+`),c.length?1:0}if(r==="policy"){if(!m.existsSync(o.vault)||!m.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let c=v(e,"--policy-file");if(!c)throw new Error("policy requires --policy-file <0600 JSON file>");let d;try{d=JSON.parse(h(c))}catch{throw new Error("policy file must contain valid JSON")}for(let u of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(d[u])||d[u].length===0)throw new Error(`policy: ${u} allowlist is empty`);return We(o.policy,o.policyKey,d,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(r==="export"){if(!e.includes("--acknowledge-raw-key-export"))throw new Error("export requires --acknowledge-raw-key-export");if(!m.existsSync(o.vault))throw new Error("local signer vault is not initialized");let c=rt(e),d=v(e,"--output-file");if(!d)throw new Error("export requires --output-file <0600 file>");let u=W.resolve(d),I=await de(e,n),fe=N(o.vault),pe=T(fe,I);try{let U=z(pe,fe.meta)[c];if(!U)throw new Error(`local signer has no ${c} key`);let ot=c==="evm"?U.secret:`0x${U.secret.replace(/^0x/,"")}`;xe(u,`${ot}
 `),t.write(`Private key exported to owner-only file ${u}. Protect it as wallet custody.
-`)}finally{de.fill(0)}return 0}if(r!=="init"&&r!=="import"&&r!=="import-phrase")throw new Error(`unknown subcommand '${r}'`);let a=await le(e,n),l={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let c=N(o.vault),d=T(c,a);try{l=M(d,c.meta)}finally{d.fill(0)}}if(r==="init"){let c=et.createRandom();l.evm=A("evm",b("evm",c.privateKey))}else if(r==="import"){let c=tt(e),d=v(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");l[c]=A(c,b(c,h(d)))}else{let c=v(e,"--phrase-file");if(!c)throw new Error("import-phrase requires --phrase-file <0600 file>");if(l.evm&&!e.includes("--replace-evm"))throw new Error("local signer already holds an evm key; pass --replace-evm to overwrite it");let d=et.fromPhrase(h(c).trim().replace(/\s+/g," "));l.evm=A("evm",b("evm",d.privateKey))}Nr(o,ge(Ye(l),a,Xe(l)));let f=Object.entries(l).map(([c,d])=>`${c}:${Tr(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
-`),0}var tf={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:rt,run:e=>Cr(e.argv||[])};export{tf as default,Nr as publishLockedVault,Cr as run};
+`)}finally{pe.fill(0)}return 0}if(r!=="init"&&r!=="import"&&r!=="import-phrase")throw new Error(`unknown subcommand '${r}'`);let a=await de(e,n),l={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let c=N(o.vault),d=T(c,a);try{l=z(d,c.meta)}finally{d.fill(0)}}if(r==="init"){let c=tt.createRandom();l.evm=A("evm",b("evm",c.privateKey))}else if(r==="import"){let c=rt(e),d=v(e,"--key-file");if(!d)throw new Error("import requires --key-file <0600 file>");l[c]=A(c,b(c,h(d)))}else{let c=v(e,"--phrase-file");if(!c)throw new Error("import-phrase requires --phrase-file <0600 file>");if(l.evm&&!e.includes("--replace-evm"))throw new Error("local signer already holds an evm key; pass --replace-evm to overwrite it");let d=tt.fromPhrase(h(c).trim().replace(/\s+/g," "));l.evm=A("evm",b("evm",d.privateKey))}Rr(o,be(Xe(l),a,Ze(l)));let f=Object.entries(l).map(([c,d])=>`${c}:${_r(d)}`).join(" ");return t.write(`Encrypted local vault initialized for ${f}. Configure sealed policy rails before starting a signer session.
+`),0}var Sf={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:nt,run:e=>$r(e.argv||[])};export{Sf as default,Rr as publishLockedVault,$r as run};