@oracle-agent/oracle 0.35.9 → 0.35.11

package/dist/cli/commands/sign.mjs

@@ -1,7 +1,7 @@
-var Ie=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import I from"node:fs";import ke from"node:os";import b from"node:path";import{fileURLToPath as Te}from"node:url";function K(){return process.env.ORACLE_FAKE_HOME||ke.homedir()}function Ce(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function k(){return Ce()?process.env.ORACLE_CONFIG_DIR||b.join(K(),".config","oracle"):b.join(K(),".config","oracle")}function Ne(){return b.join(k(),"desk.json")}function Le(){return b.join(k(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=Le();if(I.existsSync(i))for(let o of I.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let c=a[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),t(a[1],c)}}catch{}try{let i=Ne();if(I.existsSync(i)){let o=JSON.parse(I.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var Oe,_t,X=Ie(()=>{Oe=b.dirname(Te(import.meta.url)),_t=b.resolve(Oe,"../..");try{E()}catch{}});X();import m from"node:fs";import V from"node:path";import{createCipheriv as $e,createDecipheriv as Be,randomBytes as O,scryptSync as Re}from"node:crypto";import s from"node:fs";import w from"node:path";var Y="ORACLE-LOCAL-VAULT",Q=1,A=Object.freeze({N:1<<17,r:8,p:1}),Pe=256*1024*1024,_e=16*1024;function T(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function Z(e,n,t=A){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Re(r,n,32,{...t,maxmem:Pe})}function ee(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=O(32),o=O(12),a={magic:Y,version:Q,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},c=Z(n,i);try{let l=$e("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(a)));let u=Buffer.concat([l.update(r),l.final()]);return{...a,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),r.fill(0)}}function P(e,n){if(e?.magic!==Y||e?.version!==Q)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(d=>!["address","addresses","kind","createdAt"].includes(d))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(d=>!t.includes(d)))throw new Error("local-vault: unexpected vault field");let r=T(e.kdf.salt,32,"salt"),i=T(e.cipher.iv,12,"iv"),o=T(e.tag,16,"tag"),a=T(e.ciphertext,1,"ciphertext",{max:_e}),{ciphertext:c,tag:l,...u}=e,f=Z(n,r);try{let d=Be("aes-256-gcm",f,i);return d.setAAD(Buffer.from(JSON.stringify(u))),d.setAuthTag(o),Buffer.concat([d.update(a),d.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function Fe(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function te(e){let n=w.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(Fe(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function _(e){return JSON.parse(h(e))}function re(e,n){s.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),te(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
-`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(w.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let c=s.openSync(w.dirname(e),"r");try{s.fsyncSync(c)}finally{s.closeSync(c)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function y(e,n){s.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),te(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${O(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(w.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}import p from"node:path";import St from"node:os";import{createHash as At,randomBytes as cs}from"node:crypto";import{Interface as G,keccak256 as ls}from"ethers";import{Transaction as fs}from"@scure/btc-signer";import{ed25519 as ms}from"@noble/curves/ed25519.js";import{base58 as ci}from"@scure/base";import{Interface as ue}from"ethers";import{Interface as Ue,MaxUint256 as br,isAddress as xr,keccak256 as Sr,toUtf8Bytes as Ar}from"ethers";import{Interface as qe,isAddress as tr}from"ethers";import{isAddress as Kt}from"ethers";var ir=new qe(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as je,isAddress as cr}from"ethers";var fr=new je(["function approve(address spender,uint256 amount) returns (bool)"]),pr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Cr=new Ue(["function approve(address spender,uint256 amount) returns (bool)"]);var Lr=300*1e3,$r=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as Fr,NETWORK as Dr,OutScript as Mr,RawTx as qr,SigHash as jr,TEST_NETWORK as Ur,Transaction as zr}from"@scure/btc-signer";import{createHash as ze}from"node:crypto";import{base58 as Gr}from"@scure/base";import{getCompiledTransactionMessageDecoder as Kr}from"@solana/transaction-messages";var oe=e=>ze("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),Xr=new Map([[oe("route"),{name:"route",prefixBytes:0}],[oe("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var on=64*1024;var hn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),gn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var bn="0x"+"00".repeat(32);var He=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),In=Object.freeze(He.map(e=>e[0]));import{TypedDataEncoder as ro,getAddress as no}from"ethers";import{TypedDataEncoder as Nn,getAddress as Ln,isAddress as $n}from"ethers";var Ge=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),Ve=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as zn,getAddress as Wn,isAddress as Hn}from"ethers";var Pn=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var Ke=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),Qn=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Xe=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),Zn=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var ao=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var rt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var vo=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var nt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Io=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),ko=new ue(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),To=new ue(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),Oo=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var ot=Object.freeze([...rt]),Co=Object.freeze({...nt});import{ed25519 as Ho}from"@noble/curves/ed25519.js";import{base58 as Go}from"@scure/base";import{RawTx as Ko,SigHash as Xo,Transaction as Yo}from"@scure/btc-signer";import{Transaction as Zo,keccak256 as ei,verifyTypedData as ti}from"ethers";import{encode as $o}from"@msgpack/msgpack";import{keccak256 as Ro,verifyTypedData as Po}from"ethers";var _o=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),Fo=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var bi=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as ct,randomBytes as Ri,timingSafeEqual as ut}from"node:crypto";import lt from"node:fs";import x from"node:path";import{homedir as q}from"node:os";import{join as j}from"node:path";var de=process.env.ORACLE_PUBLIC_DESKTOP==="1",st=de?process.env.ORACLE_CONFIG_DIR||j(q(),".config","oracle"):j(q(),".config","oracle"),vi=de?st:j(q(),".config","mad-desk");var Ci="0".repeat(64),Ni=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var Li=Promise.resolve();function dt(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return lt.realpathSync(a)}catch{return x.resolve(a)}},r=t(x.dirname(x.resolve(e))),i=t(x.dirname(x.resolve(n))),o=(a,c)=>c===a||c.startsWith(a+x.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var U=(e,n)=>ct("sha256",n).update(L(e)).digest("hex"),ft=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&ut(t,r)};function pt(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:U(r,n)}}}function fe(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!ft(r?.integrity?.mac,U(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function mt(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=fe(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),y(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:U(a,t)}})+`
+var Ie=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t=[r],r}};import k from"node:fs";import ke from"node:os";import b from"node:path";import{fileURLToPath as Te}from"node:url";function X(){return process.env.ORACLE_FAKE_HOME||ke.homedir()}function Ce(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function T(){return Ce()?process.env.ORACLE_CONFIG_DIR||b.join(X(),".config","oracle"):b.join(X(),".config","oracle")}function Ne(){return b.join(T(),"desk.json")}function Le(){return b.join(T(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let n={},t=(i,o)=>{if(o==null)return;let a=String(o).trim();a&&(process.env[i]!=null&&String(process.env[i]).trim()!==""||(process.env[i]=a,n[i]=a))};try{let i=Le();if(k.existsSync(i))for(let o of k.readFileSync(i,"utf8").split(/\r?\n/)){let a=o.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!a||a[2].startsWith("#"))continue;let c=a[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),t(a[1],c)}}catch{}try{let i=Ne();if(k.existsSync(i)){let o=JSON.parse(k.readFileSync(i,"utf8"));o&&typeof o=="object"&&(t("ORACLE_DESK_URL",o.deskUrl||o.dataUrl||o.url),t("ORACLE_DATA_URL",o.dataUrl||o.deskUrl||o.url),t("ORACLE_API_URL",o.apiUrl||o.dataUrl||o.deskUrl),t("ORACLE_PUBLIC_URL",o.publicUrl||o.deskUrl||o.dataUrl),t("ORACLE_EXEC_URL",o.execUrl),t("MAD_DESK_URL",o.deskUrl||o.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(t("ORACLE_DESK_URL",r),t("ORACLE_DATA_URL",r),t("ORACLE_API_URL",r),t("ORACLE_PUBLIC_URL",r),t("MAD_DESK_URL",r)),E._result=Object.keys(n).length?n:null,E._result}var Oe,qt,Y=Ie(()=>{Oe=b.dirname(Te(import.meta.url)),qt=b.resolve(Oe,"../..");try{E()}catch{}});Y();import m from"node:fs";import K from"node:path";import{createCipheriv as $e,createDecipheriv as Re,randomBytes as C,scryptSync as Be}from"node:crypto";import s from"node:fs";import w from"node:path";var Q="ORACLE-LOCAL-VAULT",Z=1,A=Object.freeze({N:1<<17,r:8,p:1}),Pe=256*1024*1024,_e=16*1024;function O(e,n,t,{max:r=n}={}){if(typeof e!="string"||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e))throw new Error(`local-vault: invalid ${t} encoding`);let i=Buffer.from(e,"base64");if(i.toString("base64")!==e||i.length<n||i.length>r)throw new Error(`local-vault: invalid ${t} length`);return i}function ee(e,n,t=A){let r=String(e??"");if(r.length<12)throw new Error("local-vault: passphrase must be at least 12 characters");return Be(r,n,32,{...t,maxmem:Pe})}function te(e,n,t={}){let r=Buffer.isBuffer(e)?Buffer.from(e):Buffer.from(String(e));if(!r.length)throw new Error("local-vault: refusing empty key material");let i=C(32),o=C(12),a={magic:Q,version:Z,kdf:{name:"scrypt",...A,salt:i.toString("base64")},cipher:{name:"aes-256-gcm",iv:o.toString("base64")},meta:{address:t.address?String(t.address).toLowerCase():null,addresses:t.addresses||void 0,kind:t.kind||"evm",createdAt:new Date().toISOString()}},c=ee(n,i);try{let l=$e("aes-256-gcm",c,o);l.setAAD(Buffer.from(JSON.stringify(a)));let u=Buffer.concat([l.update(r),l.final()]);return{...a,ciphertext:u.toString("base64"),tag:l.getAuthTag().toString("base64")}}finally{c.fill(0),r.fill(0)}}function P(e,n){if(e?.magic!==Q||e?.version!==Z)throw new Error("local-vault: unsupported vault file");if(e?.kdf?.name!=="scrypt"||e?.cipher?.name!=="aes-256-gcm")throw new Error("local-vault: unsupported cryptography");if(e.kdf.N!==A.N||e.kdf.r!==A.r||e.kdf.p!==A.p)throw new Error("local-vault: unsupported KDF parameters");if(Object.keys(e.kdf).sort().join(",")!=="N,name,p,r,salt"||Object.keys(e.cipher).sort().join(",")!=="iv,name")throw new Error("local-vault: unexpected cryptography field");if(!e.meta||Object.keys(e.meta).some(d=>!["address","addresses","kind","createdAt"].includes(d))||String(e.meta.kind||"").length>16||String(e.meta.address||"").length>128||JSON.stringify(e.meta.addresses||{}).length>1024||!Number.isFinite(Date.parse(e.meta.createdAt)))throw new Error("local-vault: invalid metadata");let t=["magic","version","kdf","cipher","meta","ciphertext","tag"];if(Object.keys(e).some(d=>!t.includes(d)))throw new Error("local-vault: unexpected vault field");let r=O(e.kdf.salt,32,"salt"),i=O(e.cipher.iv,12,"iv"),o=O(e.tag,16,"tag"),a=O(e.ciphertext,1,"ciphertext",{max:_e}),{ciphertext:c,tag:l,...u}=e,f=ee(n,r);try{let d=Re("aes-256-gcm",f,i);return d.setAAD(Buffer.from(JSON.stringify(u))),d.setAuthTag(o),Buffer.concat([d.update(a),d.final()])}catch{throw new Error("local-vault: wrong passphrase or tampered vault")}finally{f.fill(0)}}function Fe(e){if(!e.isFile())throw new Error("local-vault: secret source must be a regular file");if(e.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(e.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((e.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function re(e){let n=w.dirname(e),t=s.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("local-vault: unsafe destination directory");if(t.uid!==process.getuid?.())throw new Error("local-vault: destination directory must be owned by this user");if((t.mode&63)!==0)throw new Error("local-vault: destination directory must be owner-only (0700)");try{let r=s.lstatSync(e);if(r.isSymbolicLink())throw new Error("local-vault: refusing symlink destination");if(!r.isFile()||r.uid!==process.getuid?.()||r.nlink!==1)throw new Error("local-vault: unsafe destination file");if(r.dev!==t.dev)throw new Error("local-vault: destination device mismatch")}catch(r){if(r.code!=="ENOENT")throw r}}function h(e){let n;try{n=s.openSync(e,s.constants.O_RDONLY|s.constants.O_NOFOLLOW)}catch(t){throw t.code==="ELOOP"?new Error("local-vault: refusing symlink"):t}try{let t=s.fstatSync(n);if(Fe(t),t.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let r=s.lstatSync(e);if(r.isSymbolicLink()||r.dev!==t.dev||r.ino!==t.ino)throw new Error("local-vault: secret source changed or is too large");return s.readFileSync(n,"utf8").replace(/[\r\n]+$/,"")}finally{s.closeSync(n)}}function _(e){return JSON.parse(h(e))}function ne(e,n){s.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),re(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${C(6).toString("hex")}.tmp`),r;try{r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384),s.writeFileSync(r,JSON.stringify(n,null,2)+`
+`),s.fsyncSync(r),s.closeSync(r),r=void 0;let i=s.openSync(t,s.constants.O_RDONLY|s.constants.O_NOFOLLOW),o;try{o=s.fstatSync(i)}finally{s.closeSync(i)}let a=s.lstatSync(w.dirname(e));if(o.nlink!==1||o.dev!==a.dev||o.uid!==process.getuid?.())throw new Error("local-vault: unsafe temporary file");s.renameSync(t,e),s.chmodSync(e,384);let c=s.openSync(w.dirname(e),"r");try{s.fsyncSync(c)}finally{s.closeSync(c)}}catch(i){if(r!==void 0)try{s.closeSync(r)}catch{}try{s.unlinkSync(t)}catch{}throw i}return e}function y(e,n){s.mkdirSync(w.dirname(e),{recursive:!0,mode:448}),re(e);let t=w.join(w.dirname(e),`.${w.basename(e)}.${process.pid}.${C(6).toString("hex")}.tmp`);try{let r=s.openSync(t,s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_WRONLY|s.constants.O_NOFOLLOW,384);try{s.writeFileSync(r,String(n)),s.fsyncSync(r)}finally{s.closeSync(r)}s.renameSync(t,e),s.chmodSync(e,384);let i=s.openSync(w.dirname(e),"r");try{s.fsyncSync(i)}finally{s.closeSync(i)}}catch(r){try{s.unlinkSync(t)}catch{}throw r}}import p from"node:path";import kt from"node:os";import{createHash as Tt,randomBytes as bs}from"node:crypto";import{Interface as V,keccak256 as Ss}from"ethers";import{Transaction as vs}from"@scure/btc-signer";import{ed25519 as ks}from"@noble/curves/ed25519.js";import{base58 as fi}from"@scure/base";import{Interface as ue}from"ethers";import{Interface as Ue,MaxUint256 as vr,isAddress as Ir,keccak256 as kr,toUtf8Bytes as Tr}from"ethers";import{Interface as qe,isAddress as ir}from"ethers";import{isAddress as Zt}from"ethers";var ur=new qe(["function approve(address spender,uint256 amount) returns (bool)"]);import{Interface as je,isAddress as fr}from"ethers";var hr=new je(["function approve(address spender,uint256 amount) returns (bool)"]),gr=Object.freeze({42161:"0x1c3fa76e6e1088bce750f23a5bfcffa1efef6a41",43114:"0x8f550e53dfe96c055d5bdb267c21f268fcaf63b2"});var Rr=new Ue(["function approve(address spender,uint256 amount) returns (bool)"]);var Pr=300*1e3,_r=(()=>{let e=Number(process.env.ORACLE_PREPARE_HARD_MAX_AGE_MS);return Number.isFinite(e)&&e>0?e:1800*1e3})();import{Address as jr,NETWORK as Ur,OutScript as zr,RawTx as Wr,SigHash as Hr,TEST_NETWORK as Jr,Transaction as Gr}from"@scure/btc-signer";import{createHash as ze}from"node:crypto";import{base58 as Yr}from"@scure/base";import{getCompiledTransactionMessageDecoder as Zr}from"@solana/transaction-messages";var oe=e=>ze("sha256").update(`global:${e}`).digest().subarray(0,8).toString("hex"),en=new Map([[oe("route"),{name:"route",prefixBytes:0}],[oe("shared_accounts_route"),{name:"shared_accounts_route",prefixBytes:1}]]);var un=64*1024;var bn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"leverage","perp-isolated-margin":"margin","builder-fee-approval":"approveBuilder","hype-stake-deposit":"stake","hype-stake-withdraw":"unstake","hype-delegate":"delegate","hype-undelegate":"delegate"}),xn=Object.freeze({"perp-order":"order","hip3-order":"order","hip4-order":"order","perp-bracket":"order","perp-cancel":"cancel","perp-leverage":"updateLeverage","perp-isolated-margin":"updateIsolatedMargin","builder-fee-approval":"approveBuilderFee","hype-stake-deposit":"cDeposit","hype-stake-withdraw":"cWithdraw","hype-delegate":"tokenDelegate","hype-undelegate":"tokenDelegate"});var vn="0x"+"00".repeat(32);var He=Object.freeze([["salt","uint256"],["maker","address"],["signer","address"],["tokenId","uint256"],["makerAmount","uint256"],["takerAmount","uint256"],["side","uint8"],["signatureType","uint8"],["timestamp","uint256"],["metadata","bytes32"],["builder","bytes32"]]),Cn=Object.freeze(He.map(e=>e[0]));import{TypedDataEncoder as ao,getAddress as so}from"ethers";import{TypedDataEncoder as Bn,getAddress as Pn,isAddress as _n}from"ethers";var Ge=Object.freeze({1:"0x111111125421cA6dc452d289314280a0f8842A65",8453:"0x111111125421cA6dc452d289314280a0f8842A65",42161:"0x111111125421cA6dc452d289314280a0f8842A65",10:"0x111111125421cA6dc452d289314280a0f8842A65",137:"0x111111125421cA6dc452d289314280a0f8842A65",56:"0x111111125421cA6dc452d289314280a0f8842A65"}),Ve=Object.freeze({Order:[{name:"salt",type:"uint256"},{name:"maker",type:"address"},{name:"receiver",type:"address"},{name:"makerAsset",type:"address"},{name:"takerAsset",type:"address"},{name:"makingAmount",type:"uint256"},{name:"takingAmount",type:"uint256"},{name:"makerTraits",type:"uint256"}]});import{TypedDataEncoder as Gn,getAddress as Vn,isAddress as Kn}from"ethers";var Mn=Object.freeze({READ:"read",PREPARE:"prepare",EXECUTE:"execute",AUTONOMOUS:"autonomous"});var Ke=Object.freeze({1:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",100:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",42161:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41",8453:"0x9008D19f58AAbD9eD0D60971565AA8510560ab41"}),ro=Object.freeze({1:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",100:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",42161:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110",8453:"0xC92E8bdf79f0507f65a392b0ab4667716BFE0110"});var Xe=Object.freeze({Order:[{name:"sellToken",type:"address"},{name:"buyToken",type:"address"},{name:"receiver",type:"address"},{name:"sellAmount",type:"uint256"},{name:"buyAmount",type:"uint256"},{name:"validTo",type:"uint32"},{name:"appData",type:"bytes32"},{name:"feeAmount",type:"uint256"},{name:"kind",type:"string"},{name:"partiallyFillable",type:"bool"},{name:"sellTokenBalance",type:"string"},{name:"buyTokenBalance",type:"string"}]}),no=Object.freeze({OrderCancellations:[{name:"orderUids",type:"bytes[]"}]});var lo=Object.freeze(["https://limit-orders.1inch.io","https://api.1inch.dev/orderbook"]);var rt=new Set(["evm","evm-swap","evm-bridge","evm-nft","evm-order","btc","sol","hl","poly","lighter"]);var Oo=Object.freeze({swap:5,bridge:5,perps:0,nft:0,mint:0,transfer:0,approve:0,delegate:0,identity:0,order:0,cancel:0,leverage:0,margin:0,approveBuilder:0,stake:0,unstake:0});var nt=Object.freeze({"0x04e45aaf":{provider:"uniswap-v3",action:"swap",layout:"router02-exact-input-single"},"0x414bf389":{provider:"uniswap-v3",action:"swap",layout:"swap-router-exact-input-single"},"0xc04b8d59":{provider:"uniswap-v3",action:"swap",layout:"exact-input-deadline"},"0xb858183f":{provider:"uniswap-v3",action:"swap",layout:"exact-input"},"0x5ae401dc":{provider:"uniswap-v3",action:"swap",layout:"multicall-deadline"},"0xa026383e":{provider:"aerodrome",action:"swap",layout:"aerodrome-exact-input-single"},"0x7b939232":{provider:"across-v3",action:"bridge",layout:"across-deposit-v3"}}),Co=Object.freeze({"0x161ac21f":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-public"},"0xc2f6663a":{provider:"opensea-nft",action:"mint",layout:"seadrop-mint-allowlist"}}),No=new ue(["function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),Lo=new ue(["function mintAllowList(address nftContract,address feeRecipient,address minterIfNotPayer,uint256 quantity,(uint80 mintPrice,uint48 maxTotalMintableByWallet,uint48 startTime,uint48 endTime,uint48 dropStageIndex,uint32 maxTokenSupplyForStage,uint16 feeBps,bool restrictFeeRecipients) mintParams,bytes32[] proof) payable"]),$o=Object.freeze({"0xa0712d68":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0x1249c58b":{provider:"nft-mint",action:"mint",layout:"mint-no-args"},"0x2db11544":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xefef39a1":{provider:"nft-mint",action:"mint",layout:"mint-quantity"},"0xa6f2ae3a":{provider:"nft-mint",action:"mint",layout:"mint-no-args"}});var ot=Object.freeze([...rt]),Ro=Object.freeze({...nt});import{ed25519 as Ko}from"@noble/curves/ed25519.js";import{base58 as Yo}from"@scure/base";import{RawTx as Zo,SigHash as ei,Transaction as ti}from"@scure/btc-signer";import{Transaction as ni,keccak256 as oi,verifyTypedData as ii}from"ethers";import{encode as _o}from"@msgpack/msgpack";import{keccak256 as Do,verifyTypedData as Mo}from"ethers";var qo=Object.freeze({name:"Exchange",version:"1",chainId:1337,verifyingContract:"0x0000000000000000000000000000000000000000"}),jo=Object.freeze({Agent:[{name:"source",type:"string"},{name:"connectionId",type:"bytes32"}]});var vi=Object.freeze({1:{name:"ethereum",mode:"mempool-private",endpoints:["https://rpc.flashbots.net/fast","https://rpc.mevblocker.io"]},8453:{name:"base",mode:"sequencer",endpoints:["https://mainnet-sequencer.base.org"]},10:{name:"optimism",mode:"sequencer",endpoints:["https://mainnet-sequencer.optimism.io"]},42161:{name:"arbitrum",mode:"sequencer",endpoints:["https://arb1-sequencer.arbitrum.io/rpc"]},56:{name:"bsc",mode:"mempool-private",endpoints:["https://rpc.48.club","https://bsc.rpc.blxrbdn.com"]},137:{name:"polygon",mode:"mempool-private",endpoints:["https://polygon-bor-rpc.publicnode.com"]},43114:{name:"avalanche",mode:"public-only",endpoints:[]},999:{name:"hyperevm",mode:"public-only",endpoints:[]}});import{createHmac as ct,randomBytes as Di,timingSafeEqual as ut}from"node:crypto";import lt from"node:fs";import x from"node:path";import{homedir as j}from"node:os";import{join as U}from"node:path";var de=process.env.ORACLE_PUBLIC_DESKTOP==="1",st=de?process.env.ORACLE_CONFIG_DIR||U(j(),".config","oracle"):U(j(),".config","oracle"),Oi=de?st:U(j(),".config","mad-desk");var Ri="0".repeat(64),Bi=Object.freeze({PREPARE:"exec.prepare",SIGN:"exec.sign",BROADCAST:"exec.broadcast",POLICY_REJECT:"policy.reject",AUTH_GRANT:"auth.grant",AUTH_OK:"auth.verify.ok",AUTH_FAIL:"auth.verify.fail"});function L(e){return e==null?"null":typeof e!="object"?JSON.stringify(e):Array.isArray(e)?"["+e.map(L).join(",")+"]":"{"+Object.keys(e).sort().map(t=>JSON.stringify(t)+":"+L(e[t])).join(",")+"}"}var Pi=Promise.resolve();function dt(e,n){if(!e)throw new Error("ledger: separate freshness anchor required");let t=a=>{try{return lt.realpathSync(a)}catch{return x.resolve(a)}},r=t(x.dirname(x.resolve(e))),i=t(x.dirname(x.resolve(n))),o=(a,c)=>c===a||c.startsWith(a+x.sep);if(o(r,i)||o(i,r))throw new Error("ledger: separate freshness anchor required")}var z=(e,n)=>ct("sha256",n).update(L(e)).digest("hex"),ft=(e,n)=>{let t=Buffer.from(String(e)),r=Buffer.from(String(n));return t.length===r.length&&ut(t,r)};function pt(e,n,{sequence:t}={}){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("policy: object required");let r=t===void 0?e:{...e,policySequence:Number(t)};return{policy:r,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:z(r,n)}}}function fe(e,n){if(!e)throw new Error("policy: sequence anchor required");let t;try{t=h(e)}catch{return{sequence:0,present:!1}}let r;try{r=JSON.parse(t)}catch{throw new Error("policy: sequence anchor is unreadable")}if(!ft(r?.integrity?.mac,z(r?.marker,n)))throw new Error("policy: sequence anchor integrity failed");return{sequence:Number(r?.marker?.policySequence||0),policyMac:r?.marker?.policyMac??null,present:!0,ledgerInitialized:r?.marker?.ledgerInitialized===!0}}function mt(e,n,t,r=null,{ledgerInitialized:i}={}){if(r==null||!String(r))throw new Error("policy: sequence anchor must bind the sealed policy MAC");let o=i===!0;if(i===void 0)try{let c=fe(e,t);o=c.present&&c.ledgerInitialized===!0}catch{o=!1}let a={policySequence:Number(n),policyMac:String(r)};o&&(a.ledgerInitialized=!0),y(e,JSON.stringify({marker:a,integrity:{algorithm:"hmac-sha256-canonical-json-v1",mac:z(a,t)}})+`
 `)}function pe(e,n,t,{sequenceAnchorFile:r}={}){let i=h(n);if(!r)throw new Error("policy: sequence anchor required");let o=fe(r,i);dt(r,e);let a=Number(o.sequence||0)+1,c=pt(t,i,{sequence:a});mt(r,a,i,c?.integrity?.mac??null),y(e,JSON.stringify(c,null,2)+`
-`)}import{Wallet as z}from"ethers";import{base58 as W}from"@scure/base";import{ed25519 as ge}from"@noble/curves/ed25519.js";import{NETWORK as ye,TEST_NETWORK as Ee,WIF as wt,p2wpkh as me}from"@scure/btc-signer";import{pubECDSA as ht}from"@scure/btc-signer/utils.js";var $=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},gt=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},we=e=>{let n=String(e||"").trim();try{let t=Buffer.from(W.decode(n));return W.encode(t)===n?t:null}catch{return null}},H=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(ge.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},he=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),g=(e,n)=>{if(n==="sol")return H(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},yt=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return g(t,n)};function S(e,n){let t=String(n||"").trim();if(e==="evm")return new z(t).privateKey;if(e==="btc")for(let o of[ye,Ee])try{return Buffer.from(wt(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let u=$(t.slice(4));if(!u)throw new Error("sol: invalid explicit hex private key");return g(u,"sol")}if(/^base58:/i.test(t)){let u=we(t.slice(7));if(!he(u))throw new Error("sol: invalid explicit base58 private key");return H(u)}if(/^0x/i.test(t)){let u=$(t);if(!u)throw new Error("sol: invalid explicit hex private key");return g(u,"sol")}let o=$(t),a=o&&(o.length===32||o.length===64)?g(o,"sol"):null,c=we(t),l=he(c);if(a&&l&&!a.equals(l))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(l)return H(c);if(o)return g(o,"sol")}let r=$(t);if(r)return e==="evm"?new z(`0x${r.toString("hex")}`).privateKey:g(r,e);let i=gt(t);if(i)return g(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return yt(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return S(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function v(e,n){if(e==="evm"){let t=new z(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=g(n,"btc"),r=ht(t);return{kind:e,secret:t.toString("hex"),addresses:[me(r,ye).address,me(r,Ee).address]}}if(e==="sol"){let t=g(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[W.encode(ge.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function J(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:v(n.kind||"evm",S(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=v(o,S(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let c=(u,f=!0)=>{let d=a[u];if(!(!f&&d===void 0)){if(!Array.isArray(d)||d.length<4||d.some(R=>!Number.isInteger(R)||R<0||R>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(d)}},l=a.apiSecretEncoding;if(l!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:c("apiKeyBytes"),apiSecretBytes:c("apiSecretBytes"),apiSecretEncoding:l,passphraseBytes:c("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function be(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function xe(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var ta=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),ra=Object.freeze(["binance","bybit","okx","coinbase"]),na=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),oa=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),ia=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),aa=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),sa=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),ca=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),ua=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),la=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),da=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var xt=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Se=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var xa=256*1024;var Us=new G(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),zs=new G(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),Ws=new G(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ae(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||p.join(process.env.XDG_STATE_HOME||p.join(St.homedir(),".local","state"),"oracle"),t=At("sha256").update(p.resolve(e)).digest("hex").slice(0,16);return{vault:p.join(e,"vault.json"),policy:p.join(e,"signer-policy.json"),policyKey:p.join(e,"policy-integrity-key"),policyAnchor:p.join(n,`signer-policy-${t}.high-water`),ledger:p.join(e,"signer-ledger.json"),ledgerAnchor:p.join(n,`signer-ledger-${t}.high-water`),cexOrders:p.join(e,"cex-orders.json"),cexOrdersAnchor:p.join(n,`cex-orders-${t}.high-water`),token:p.join(e,"signer-token"),lock:p.join(n,`signer-${t}.lock`)}}import{randomBytes as vt}from"node:crypto";import{Wallet as It}from"ethers";var ve=`oracle sign init|import|policy|status|lock|doctor
+`)}import{dirname as wt,join as ht}from"node:path";import{fileURLToPath as gt}from"node:url";var yt=wt(gt(import.meta.url)),Yi=ht(yt,"descriptors");var Qi=(1n<<256n)-1n;import{Wallet as W}from"ethers";import{base58 as H}from"@scure/base";import{ed25519 as ge}from"@noble/curves/ed25519.js";import{NETWORK as ye,TEST_NETWORK as Ee,WIF as Et,p2wpkh as me}from"@scure/btc-signer";import{pubECDSA as bt}from"@scure/btc-signer/utils.js";var $=e=>{let n=String(e||"").trim().replace(/^0x/i,"");return!/^[0-9a-fA-F]+$/.test(n)||n.length%2?null:Buffer.from(n,"hex")},xt=e=>{let n=String(e||"").trim();if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(n))return null;let t=Buffer.from(n,"base64");return t.toString("base64")===n?t:null},we=e=>{let n=String(e||"").trim();try{let t=Buffer.from(H.decode(n));return H.encode(t)===n?t:null}catch{return null}},J=e=>{if(!(e instanceof Uint8Array))throw new Error("sol: key bytes required");if(e.length!==32&&e.length!==64)throw new Error("sol: expected 32-byte private key material");let n=Buffer.from(e.subarray(0,32));if(e.length===64){let t=Buffer.from(e.subarray(32,64)),r=Buffer.from(ge.getPublicKey(n));if(!t.equals(r))throw new Error("sol: supplied public key does not match seed")}return n},he=e=>!(e instanceof Uint8Array)||e.length!==32&&e.length!==64?null:Buffer.from(e.subarray(0,32)),g=(e,n)=>{if(n==="sol")return J(e);if(!(e instanceof Uint8Array))throw new Error(`${n}: key bytes required`);if(e.length===32)return Buffer.from(e);if(e.length===64)return Buffer.from(e.subarray(0,32));throw new Error(`${n}: expected 32-byte private key material`)},St=(e,n)=>{if(!Array.isArray(e))throw new Error(`${n}: expected byte array`);let t=Buffer.alloc(e.length);for(let r=0;r<e.length;r++){let i=e[r];if(typeof i!="number"||!Number.isSafeInteger(i)||i<0||i>255)throw new Error(`${n}: expected integer bytes in 0..255`);t[r]=i}return g(t,n)};function S(e,n){let t=String(n||"").trim();if(e==="evm")return new W(t).privateKey;if(e==="btc")for(let o of[ye,Ee])try{return Buffer.from(Et(o).decode(t))}catch{}if(e==="sol"){if(/^hex:/i.test(t)){let u=$(t.slice(4));if(!u)throw new Error("sol: invalid explicit hex private key");return g(u,"sol")}if(/^base58:/i.test(t)){let u=we(t.slice(7));if(!he(u))throw new Error("sol: invalid explicit base58 private key");return J(u)}if(/^0x/i.test(t)){let u=$(t);if(!u)throw new Error("sol: invalid explicit hex private key");return g(u,"sol")}let o=$(t),a=o&&(o.length===32||o.length===64)?g(o,"sol"):null,c=we(t),l=he(c);if(a&&l&&!a.equals(l))throw new Error("sol: ambiguous private key format; prefix with hex: or base58:");if(l)return J(c);if(o)return g(o,"sol")}let r=$(t);if(r)return e==="evm"?new W(`0x${r.toString("hex")}`).privateKey:g(r,e);let i=xt(t);if(i)return g(i,e);if(t.startsWith("[")||t.startsWith("{")){let o=JSON.parse(t);if(Array.isArray(o))return St(o,e);let a=o.privateKey??o.secretKey??o.key;if(a)return S(e,Array.isArray(a)?JSON.stringify(a):String(a))}throw new Error(`${e}: unsupported private key format`)}function I(e,n){if(e==="evm"){let t=new W(String(n));return{kind:e,secret:t.privateKey,addresses:[t.address.toLowerCase()]}}if(e==="btc"){let t=g(n,"btc"),r=bt(t);return{kind:e,secret:t.toString("hex"),addresses:[me(r,ye).address,me(r,Ee).address]}}if(e==="sol"){let t=g(n,"sol");return{kind:e,secret:t.toString("hex"),addresses:[H.encode(ge.getPublicKey(t))]}}throw new Error(`unsupported signer kind ${e}`)}function G(e,n={}){let t=Buffer.isBuffer(e)?e.toString("utf8"):String(e||"");if(String(n.kind||"")!=="multichain")return{[n.kind||"evm"]:I(n.kind||"evm",S(n.kind||"evm",t))};let r=JSON.parse(t),i={};for(let o of["evm","btc","sol"])r[o]&&(i[o]=I(o,S(o,r[o])));if(r.cex!==void 0){if(!r.cex||typeof r.cex!="object"||Array.isArray(r.cex))throw new Error("local-vault: cex credential records invalid");i.cex={};for(let[o,a]of Object.entries(r.cex)){if(!/^[A-Za-z0-9._-]{1,64}$/.test(o)||!a||typeof a!="object")throw new Error("local-vault: cex credential record invalid");if(!/^(?:binance|bybit|okx|coinbase)$/.test(a.venue)||!/^[A-Za-z0-9._-]{1,64}$/.test(a.accountId||""))throw new Error("local-vault: cex credential binding invalid");let c=(u,f=!0)=>{let d=a[u];if(!(!f&&d===void 0)){if(!Array.isArray(d)||d.length<4||d.some(B=>!Number.isInteger(B)||B<0||B>255))throw new Error("local-vault: cex credential bytes invalid");return Buffer.from(d)}},l=a.apiSecretEncoding;if(l!==(a.venue==="coinbase"?"base64":"raw"))throw new Error("local-vault: explicit cex secret encoding refused");i.cex[o]=Object.freeze({venue:a.venue,accountId:a.accountId,apiKeyBytes:c("apiKeyBytes"),apiSecretBytes:c("apiSecretBytes"),apiSecretEncoding:l,passphraseBytes:c("passphraseBytes",!1)})}if(!Object.keys(i.cex).length)throw new Error("local-vault: empty cex credential records refused");Object.freeze(i.cex)}if(!Object.keys(i).length)throw new Error("local-vault: multichain vault is empty");return i}function be(e){let n={};for(let t of["evm","btc","sol"])e[t]&&(n[t]=t==="evm"?e[t].secret:`0x${e[t].secret}`);return e.cex&&(n.cex=Object.fromEntries(Object.entries(e.cex).map(([t,r])=>[t,{venue:r.venue,accountId:r.accountId,apiKeyBytes:[...r.apiKeyBytes],apiSecretBytes:[...r.apiSecretBytes],apiSecretEncoding:r.apiSecretEncoding,...r.passphraseBytes?{passphraseBytes:[...r.passphraseBytes]}:{}}]))),Buffer.from(JSON.stringify(n))}function xe(e){let n={};for(let[t,r]of Object.entries(e))r?.addresses&&(n[t]=r.addresses);return{kind:"multichain",address:null,addresses:n}}var pa=Object.freeze(["spot-limit-create","spot-limit-cancel","spot-order-status"]),ma=Object.freeze(["binance","bybit","okx","coinbase"]),wa=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"}),ha=Object.freeze({binance:"/api/v3",bybit:"/v5/order",okx:"/api/v5/trade",coinbase:"/orders"}),ga=Object.freeze(["version","surface","kind","venue","credentialRef","symbol","base","quote","side","baseSize","limitPrice","maxQuoteNotional","timeInForce","clientOrderId","expiresAtMs","venueOrderId","nonce","grantId","artifactHash"]),ya=Object.freeze(["market-create","withdraw","transfer","subaccount","leverage","futures","margin","convert","api-key"]),Ea=Object.freeze(["url","host","path","method","headers","signature","apiKey","apiSecret","passphrase","privateKey","redirect","proxy"]),ba=Object.freeze(["ccxt","binance-api-node","node-binance-api","coinbase-advanced-node","@okx-dex/okx-dex-sdk","bybit-api"]),xa=Object.freeze({perOrderQuote:"sealed-owner-policy",dailyGrossQuote:"sealed-owner-policy",scope:Object.freeze(["per-order","UTC-day","account","venue","quote"]),envelopeFieldIsNotCeiling:!0}),Sa=Object.freeze({binanceRecvWindowMs:5e3,bybitWindowMs:5e3,maxLocalSkewMs:2e3}),Aa=Object.freeze({perSecond:1,perMinute:30,bind:"tighter"});var It=Object.freeze({binance:Object.freeze({create:["POST","/api/v3/order"],cancel:["DELETE","/api/v3/order"],status:["GET","/api/v3/order"]}),bybit:Object.freeze({create:["POST","/v5/order/create"],cancel:["POST","/v5/order/cancel"],status:["GET","/v5/order/realtime"]}),okx:Object.freeze({create:["POST","/api/v5/trade/order"],cancel:["POST","/api/v5/trade/cancel-order"],status:["GET","/api/v5/trade/order"]}),coinbase:Object.freeze({create:["POST","/orders"],cancel:["DELETE","/orders/{order_id}"],status:["GET","/orders/{order_id}"]})}),Se=Object.freeze({binance:"https://api.binance.com",bybit:"https://api.bybit.com",okx:"https://openapi.okx.com",coinbase:"https://api.exchange.coinbase.com"});var Ra=256*1024;var ec=new V(["function collection() view returns (address)","function token() view returns (address)","function robinhoodSwapFeeWei() view returns (uint256)","function quoteSpecificBuy(uint256 tokenId) view returns (uint256 totalCost,uint256 baseCost,uint256 fee,uint256 protocolFee,bool available)","function quoteSellNFT() view returns (uint256 netPayout,uint256 grossPayout,uint256 fee,uint256 protocolFee)","function inventory(uint256 tokenId) view returns (bool)","function buySpecificNFT(uint256 tokenId,uint256 maxCost) payable","function sellNFT(uint256 tokenId,uint256 minPayout) payable"]),tc=new V(["function decimals() view returns (uint8)","function allowance(address owner,address spender) view returns (uint256)"]),rc=new V(["function ownerOf(uint256 tokenId) view returns (address)","function getApproved(uint256 tokenId) view returns (address)","function isApprovedForAll(address owner,address operator) view returns (bool)"]);function Ae(e){let n=process.env.ORACLE_SIGNER_STATE_DIR||p.join(process.env.XDG_STATE_HOME||p.join(kt.homedir(),".local","state"),"oracle"),t=Tt("sha256").update(p.resolve(e)).digest("hex").slice(0,16);return{vault:p.join(e,"vault.json"),policy:p.join(e,"signer-policy.json"),policyKey:p.join(e,"policy-integrity-key"),policyAnchor:p.join(n,`signer-policy-${t}.high-water`),ledger:p.join(e,"signer-ledger.json"),ledgerAnchor:p.join(n,`signer-ledger-${t}.high-water`),cexOrders:p.join(e,"cex-orders.json"),cexOrdersAnchor:p.join(n,`cex-orders-${t}.high-water`),token:p.join(e,"signer-token"),lock:p.join(n,`signer-${t}.lock`)}}import{randomBytes as Ot}from"node:crypto";import{Wallet as Ct}from"ethers";var ve=`oracle sign init|import|policy|status|lock|doctor
 
   oracle sign init [--passphrase-file <0600 file>]
   oracle sign import --kind evm|btc|sol --key-file <0600 file> [--passphrase-file <0600 file>]
@@ -11,14 +11,14 @@ var Ie=(e,n,t)=>()=>{if(t)throw t[0];try{return e&&(n=e(e=0)),n}catch(r){throw t
   oracle sign doctor
 
 Secrets are accepted only from a hidden TTY or protected owner-only files.
-They are never accepted as argument values or inherited environment variables.`,B=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},kt=e=>{let n=String(B(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Tt(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=c=>{for(let l of c){if(l===3){a(),r(new Error("cancelled"));return}if(l===13||l===10){a(),process.stderr.write(`
-`),t(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function Ot(e,n){let t=B(e,"--passphrase-file");return t?h(t):Tt("Vault passphrase: ",n)}function Ct(e){return e.addresses.join(", ")}async function Nt(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||k(),o=Ae(V.join(i,"signer"));if(!r||r==="help")return t.write(ve+`
+They are never accepted as argument values or inherited environment variables.`,R=(e,n)=>{let t=e.indexOf(n);return t>=0?e[t+1]:null},Nt=e=>{let n=String(R(e,"--kind")||"evm").toLowerCase();if(!["evm","btc","sol"].includes(n))throw new Error("import requires --kind evm|btc|sol");return n};async function Lt(e,n={}){if(n.readHidden)return n.readHidden(e);if(!process.stdin.isTTY)throw new Error("passphrase requires a TTY or --passphrase-file");return process.stderr.write(e),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((t,r)=>{let i="",o=c=>{for(let l of c){if(l===3){a(),r(new Error("cancelled"));return}if(l===13||l===10){a(),process.stderr.write(`
+`),t(i);return}l===127?i=i.slice(0,-1):i+=String.fromCharCode(l)}},a=()=>{process.stdin.off("data",o),process.stdin.setRawMode(!1),process.stdin.pause()};process.stdin.on("data",o)})}async function $t(e,n){let t=R(e,"--passphrase-file");return t?h(t):Lt("Vault passphrase: ",n)}function Rt(e){return e.addresses.join(", ")}async function Bt(e=[],n={}){let t=n.out||process.stdout,r=e[0],i=n.configDir||T(),o=Ae(K.join(i,"signer"));if(!r||r==="help")return t.write(ve+`
 `),0;if(r==="status")return t.write(JSON.stringify({initialized:m.existsSync(o.vault),policyConfigured:m.existsSync(o.policy),armed:m.existsSync(o.vault)&&!m.existsSync(o.lock),disarmed:m.existsSync(o.lock)})+`
-`),0;if(r==="lock")return m.mkdirSync(V.dirname(o.lock),{recursive:!0,mode:448}),y(o.lock,`locked
+`),0;if(r==="lock")return m.mkdirSync(K.dirname(o.lock),{recursive:!0,mode:448}),y(o.lock,`locked
 `),t.write(`Local signer locked.
 `),0;if(r==="doctor"){let u=[];return m.existsSync(o.vault)||u.push("vault missing"),m.existsSync(o.policy)||u.push("policy missing (empty allowlists fail closed)"),t.write(u.length?`Signer not ready: ${u.join("; ")}
 `:`Signer files ready; vault remains locked until a short-lived signer session starts.
-`),u.length?1:0}if(r==="policy"){if(!m.existsSync(o.vault)||!m.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=B(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let f;try{f=JSON.parse(h(u))}catch{throw new Error("policy file must contain valid JSON")}for(let d of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(f[d])||f[d].length===0)throw new Error(`policy: ${d} allowlist is empty`);return pe(o.policy,o.policyKey,f,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
-`),0}if(r!=="init"&&r!=="import")throw new Error(`unknown subcommand '${r}'`);let a=await Ot(e,n),c={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let u=_(o.vault),f=P(u,a);try{c=J(f,u.meta)}finally{f.fill(0)}}if(r==="init"){let u=It.createRandom();c.evm=v("evm",S("evm",u.privateKey))}else{let u=kt(e),f=B(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");c[u]=v(u,S(u,h(f)))}m.mkdirSync(V.dirname(o.vault),{recursive:!0,mode:448}),re(o.vault,ee(be(c),a,xe(c))),m.existsSync(o.policyKey)||y(o.policyKey,vt(32).toString("hex")+`
-`);let l=Object.entries(c).map(([u,f])=>`${u}:${Ct(f)}`).join(" ");return t.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
-`),0}var tc={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:ve,run:e=>Nt(e.argv||[])};export{tc as default,Nt as run};
+`),u.length?1:0}if(r==="policy"){if(!m.existsSync(o.vault)||!m.existsSync(o.policyKey))throw new Error("initialize the local signer before sealing policy");let u=R(e,"--policy-file");if(!u)throw new Error("policy requires --policy-file <0600 JSON file>");let f;try{f=JSON.parse(h(u))}catch{throw new Error("policy file must contain valid JSON")}for(let d of["surfaces","actions","chains","destinations","owners"])if(!Array.isArray(f[d])||f[d].length===0)throw new Error(`policy: ${d} allowlist is empty`);return pe(o.policy,o.policyKey,f,{sequenceAnchorFile:o.policyAnchor}),t.write(`Signer policy sealed with local integrity and freshness protection.
+`),0}if(r!=="init"&&r!=="import")throw new Error(`unknown subcommand '${r}'`);let a=await $t(e,n),c={};if(m.existsSync(o.vault)){if(r==="init")throw new Error("local signer vault already exists");let u=_(o.vault),f=P(u,a);try{c=G(f,u.meta)}finally{f.fill(0)}}if(r==="init"){let u=Ct.createRandom();c.evm=I("evm",S("evm",u.privateKey))}else{let u=Nt(e),f=R(e,"--key-file");if(!f)throw new Error("import requires --key-file <0600 file>");c[u]=I(u,S(u,h(f)))}m.mkdirSync(K.dirname(o.vault),{recursive:!0,mode:448}),ne(o.vault,te(be(c),a,xe(c))),m.existsSync(o.policyKey)||y(o.policyKey,Ot(32).toString("hex")+`
+`);let l=Object.entries(c).map(([u,f])=>`${u}:${Rt(f)}`).join(" ");return t.write(`Encrypted local vault initialized for ${l}. Configure sealed policy rails before starting a signer session.
+`),0}var pc={name:"sign",summary:"manage the encrypted self-hosted signing vault",usage:ve,run:e=>Bt(e.argv||[])};export{pc as default,Bt as run};