@pixelzx/genesis 2026.5.3-2 → 2026.5.3-3

package/dist/service-BWLndtz9.js

@@ -0,0 +1,941 @@
+import { _ as resolveStateDir } from "./paths-DmR9mjUX.js";
+import { l as normalizeResolvedSecretInputString } from "./types.secrets-ews2W8BF.js";
+import { a as loadConfig } from "./io-CRPT2IUI.js";
+import "./config-DcheqK7J.js";
+import { s as writePrivateSecretFileAtomic } from "./secret-file-CkwEsjST.js";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { promisify } from "node:util";
+import { randomBytes, scrypt } from "node:crypto";
+import { Buffer as Buffer$1 } from "node:buffer";
+import { HDKey } from "@scure/bip32";
+import { generateMnemonic, mnemonicToSeedSync, validateMnemonic } from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
+import { Connection, Keypair, PublicKey, SystemProgram, Transaction, clusterApiUrl, sendAndConfirmTransaction } from "@solana/web3.js";
+import * as bitcoin from "bitcoinjs-lib";
+import { ECPairFactory } from "ecpair";
+import { HDNodeWallet, JsonRpcProvider, Wallet, formatEther, parseEther } from "ethers";
+import * as ecc from "tiny-secp256k1";
+import { TronWeb } from "tronweb";
+//#region src/wallet/amounts.ts
+function parseDecimalAmount(value, decimals) {
+	const trimmed = value.trim();
+	if (!/^\d+(?:\.\d+)?$/.test(trimmed)) throw new Error(`Invalid amount: ${value}`);
+	const [whole, fraction = ""] = trimmed.split(".");
+	if (fraction.length > decimals) throw new Error(`Amount has more than ${decimals} decimal places.`);
+	const paddedFraction = fraction.padEnd(decimals, "0");
+	return BigInt(`${whole}${paddedFraction}`.replace(/^0+(?=\d)/, "") || "0");
+}
+function formatAtomicAmount(value, decimals) {
+	const sign = value < 0n ? "-" : "";
+	const digits = (value < 0n ? -value : value).toString().padStart(decimals + 1, "0");
+	const whole = digits.slice(0, -decimals) || "0";
+	const fraction = decimals > 0 ? digits.slice(-decimals).replace(/0+$/, "") : "";
+	return `${sign}${whole}${fraction ? `.${fraction}` : ""}`;
+}
+function compareDecimalAmounts(left, right, decimals) {
+	const a = parseDecimalAmount(left, decimals);
+	const b = parseDecimalAmount(right, decimals);
+	return a === b ? 0 : a > b ? 1 : -1;
+}
+//#endregion
+//#region src/wallet/types.ts
+const WALLET_CHAINS = [
+	"btc",
+	"evm",
+	"sol",
+	"trx",
+	"xmr"
+];
+const LOCAL_KEYSTORE_WALLET_CHAINS = [
+	"btc",
+	"evm",
+	"sol",
+	"trx"
+];
+const DEFAULT_DERIVATION_PATHS = {
+	btc: "m/84'/0'/0'/0/0",
+	evm: "m/44'/60'/0'/0/0",
+	sol: "m/44'/501'/0'/0'",
+	trx: "m/44'/195'/0'/0/0"
+};
+//#endregion
+//#region src/wallet/chains.ts
+const ECPair = ECPairFactory(ecc);
+bitcoin.initEccLib(ecc);
+function normalizeAccountId(chain) {
+	return `${chain}:default`;
+}
+function nowIso() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+function enabled(config) {
+	return config?.enabled !== false;
+}
+function resolveBtcNetwork(config) {
+	const name = config?.network ?? "mainnet";
+	if (name === "testnet") return {
+		name,
+		coinType: 1,
+		network: bitcoin.networks.testnet
+	};
+	if (name === "regtest") return {
+		name,
+		coinType: 1,
+		network: bitcoin.networks.regtest
+	};
+	return {
+		name,
+		coinType: 0,
+		network: bitcoin.networks.bitcoin
+	};
+}
+function resolveBtcPath(config) {
+	const network = resolveBtcNetwork(config);
+	return config?.derivationPath ?? `m/84'/${network.coinType}'/0'/0/0`;
+}
+function resolveEvmPath(config) {
+	return config?.derivationPath ?? DEFAULT_DERIVATION_PATHS.evm;
+}
+function resolveSolPath(config) {
+	return config?.derivationPath ?? DEFAULT_DERIVATION_PATHS.sol;
+}
+function resolveTrxPath(config) {
+	return config?.derivationPath ?? DEFAULT_DERIVATION_PATHS.trx;
+}
+function resolveSecretString$1(value, path) {
+	return normalizeResolvedSecretInputString({
+		value,
+		path
+	});
+}
+async function loadEd25519HdKey() {
+	return await import("ed25519-hd-key");
+}
+function generateWalletMnemonic() {
+	return generateMnemonic(wordlist, 256);
+}
+function assertValidWalletMnemonic(mnemonic) {
+	const normalized = mnemonic.trim().replace(/\s+/g, " ");
+	if (!validateMnemonic(normalized, wordlist)) throw new Error("Invalid BIP39 mnemonic.");
+	return normalized;
+}
+function deriveBtcMaterial(mnemonic, config) {
+	const seed = mnemonicToSeedSync(mnemonic);
+	const path = resolveBtcPath(config);
+	const hd = HDKey.fromMasterSeed(seed).derive(path);
+	if (!hd.privateKey || !hd.publicKey) throw new Error("Unable to derive Bitcoin private key.");
+	const network = resolveBtcNetwork(config);
+	const keyPair = ECPair.fromPrivateKey(Buffer$1.from(hd.privateKey), { network: network.network });
+	const payment = bitcoin.payments.p2wpkh({
+		pubkey: Buffer$1.from(keyPair.publicKey),
+		network: network.network
+	});
+	if (!payment.address) throw new Error("Unable to derive Bitcoin address.");
+	return {
+		chain: "btc",
+		address: payment.address,
+		privateKey: hd.privateKey,
+		publicKey: hd.publicKey,
+		derivationPath: path,
+		network: network.name
+	};
+}
+function deriveEvmMaterial(mnemonic, config) {
+	const path = resolveEvmPath(config);
+	const wallet = HDNodeWallet.fromPhrase(mnemonic, void 0, path);
+	return {
+		chain: "evm",
+		address: wallet.address,
+		privateKey: wallet.privateKey,
+		publicKey: wallet.publicKey ? Buffer$1.from(wallet.publicKey.slice(2), "hex") : void 0,
+		derivationPath: path,
+		network: config?.name ?? (config?.chainId ? `chain-${config.chainId}` : "evm")
+	};
+}
+async function deriveSolMaterial(mnemonic, config) {
+	const path = resolveSolPath(config);
+	const seed = mnemonicToSeedSync(mnemonic);
+	const { derivePath } = await loadEd25519HdKey();
+	const derived = derivePath(path, Buffer$1.from(seed).toString("hex"));
+	const keypair = Keypair.fromSeed(derived.key);
+	return {
+		chain: "sol",
+		address: keypair.publicKey.toBase58(),
+		privateKey: derived.key,
+		publicKey: keypair.publicKey.toBytes(),
+		derivationPath: path,
+		network: config?.network ?? "mainnet-beta"
+	};
+}
+function deriveTrxMaterial(mnemonic, config) {
+	const path = resolveTrxPath(config);
+	const account = TronWeb.fromMnemonic(mnemonic, path);
+	return {
+		chain: "trx",
+		address: account.address,
+		privateKey: account.privateKey,
+		publicKey: Buffer$1.from(account.publicKey.replace(/^0x/, ""), "hex"),
+		derivationPath: path,
+		network: "tron"
+	};
+}
+async function derivePrivateMaterial(params) {
+	const mnemonic = assertValidWalletMnemonic(params.mnemonic);
+	if (params.chain === "btc") return deriveBtcMaterial(mnemonic, params.config?.networks?.btc);
+	if (params.chain === "evm") return deriveEvmMaterial(mnemonic, params.config?.networks?.evm);
+	if (params.chain === "sol") return deriveSolMaterial(mnemonic, params.config?.networks?.sol);
+	return deriveTrxMaterial(mnemonic, params.config?.networks?.trx);
+}
+async function derivePublicAccounts(params) {
+	const createdAt = nowIso();
+	const chains = params.chains ?? LOCAL_KEYSTORE_WALLET_CHAINS;
+	const accounts = [];
+	for (const chain of chains) {
+		const networkConfig = params.config?.networks?.[chain];
+		if (!enabled(networkConfig)) continue;
+		const material = await derivePrivateMaterial({
+			mnemonic: params.mnemonic,
+			chain,
+			config: params.config
+		});
+		accounts.push({
+			id: normalizeAccountId(chain),
+			chain,
+			address: material.address,
+			derivationPath: material.derivationPath,
+			network: material.network,
+			createdAt,
+			updatedAt: createdAt
+		});
+	}
+	return accounts;
+}
+function requireAccount(accounts, chain, accountId) {
+	const id = accountId?.trim() || normalizeAccountId(chain);
+	const account = accounts.find((entry) => entry.id === id && entry.chain === chain);
+	if (!account) throw new Error(`Wallet account not found for ${chain}: ${id}`);
+	return account;
+}
+function resolveEvmProvider(config) {
+	const rpcUrl = resolveSecretString$1(config?.rpcUrl, "wallet.networks.evm.rpcUrl");
+	if (!rpcUrl) throw new Error("wallet.networks.evm.rpcUrl is required for EVM balance and send.");
+	return new JsonRpcProvider(rpcUrl, config?.chainId);
+}
+function resolveSolConnection(config) {
+	return new Connection(resolveSecretString$1(config?.rpcUrl, "wallet.networks.sol.rpcUrl") ?? clusterApiUrl(config?.network ?? "mainnet-beta"), "confirmed");
+}
+function resolveTronWeb(config, privateKey) {
+	const fullHost = resolveSecretString$1(config?.fullHost, "wallet.networks.trx.fullHost") ?? "https://api.trongrid.io";
+	const apiKey = resolveSecretString$1(config?.apiKey, "wallet.networks.trx.apiKey");
+	return new TronWeb({
+		fullHost,
+		privateKey,
+		headers: apiKey ? { "TRON-PRO-API-KEY": apiKey } : void 0
+	});
+}
+function resolveBtcEsploraUrl(config) {
+	const explicit = resolveSecretString$1(config?.esploraUrl, "wallet.networks.btc.esploraUrl");
+	if (explicit) return explicit.replace(/\/+$/, "");
+	const network = resolveBtcNetwork(config).name;
+	if (network === "mainnet") return "https://blockstream.info/api";
+	if (network === "testnet") return "https://blockstream.info/testnet/api";
+	throw new Error("wallet.networks.btc.esploraUrl is required for regtest.");
+}
+async function fetchJson(url, init) {
+	const response = await fetch(url, init);
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`HTTP ${response.status} from ${url}${body ? `: ${body.slice(0, 300)}` : ""}`);
+	}
+	return await response.json();
+}
+async function fetchText(url, init) {
+	const response = await fetch(url, init);
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`HTTP ${response.status} from ${url}${body ? `: ${body.slice(0, 300)}` : ""}`);
+	}
+	return response.text();
+}
+async function fetchBtcUtxos(address, config) {
+	return fetchJson(`${resolveBtcEsploraUrl(config)}/address/${address}/utxo`);
+}
+async function quoteBtc(params) {
+	const account = requireAccount(params.accounts, "btc", params.accountId);
+	const amountAtomic = parseDecimalAmount(params.amount, 8);
+	const network = resolveBtcNetwork(params.config);
+	bitcoin.address.toOutputScript(params.to, network.network);
+	const utxos = (await fetchBtcUtxos(account.address, params.config)).filter((utxo) => utxo.status?.confirmed !== false);
+	const feeRate = params.config?.feeRateSatPerVbyte ?? 5;
+	let selected = 0n;
+	let selectedCount = 0;
+	let fee = 0n;
+	for (const utxo of utxos.toSorted((a, b) => b.value - a.value)) {
+		selected += BigInt(utxo.value);
+		selectedCount += 1;
+		fee = BigInt(Math.ceil((10 + selectedCount * 68 + 62) * feeRate));
+		if (selected >= amountAtomic + fee) break;
+	}
+	if (selected < amountAtomic + fee) throw new Error("Insufficient confirmed Bitcoin UTXO balance.");
+	return {
+		chain: "btc",
+		accountId: account.id,
+		network: account.network,
+		from: account.address,
+		to: params.to,
+		asset: "BTC",
+		amountAtomic: amountAtomic.toString(),
+		amount: formatAtomicAmount(amountAtomic, 8),
+		estimatedFeeAtomic: fee.toString(),
+		estimatedFee: formatAtomicAmount(fee, 8)
+	};
+}
+async function getWalletBalance(params) {
+	if (params.chain === "btc") {
+		const account = requireAccount(params.accounts, "btc", params.accountId);
+		const utxos = await fetchBtcUtxos(account.address, params.config?.networks?.btc);
+		const confirmed = utxos.filter((utxo) => utxo.status?.confirmed !== false).reduce((sum, utxo) => sum + BigInt(utxo.value), 0n);
+		const total = utxos.reduce((sum, utxo) => sum + BigInt(utxo.value), 0n);
+		return {
+			chain: "btc",
+			accountId: account.id,
+			address: account.address,
+			network: account.network,
+			asset: "BTC",
+			amountAtomic: total.toString(),
+			amount: formatAtomicAmount(total, 8),
+			confirmedAmountAtomic: confirmed.toString(),
+			pendingAmountAtomic: (total - confirmed).toString()
+		};
+	}
+	if (params.chain === "evm") {
+		const account = requireAccount(params.accounts, "evm", params.accountId);
+		const balance = await resolveEvmProvider(params.config?.networks?.evm).getBalance(account.address);
+		return {
+			chain: "evm",
+			accountId: account.id,
+			address: account.address,
+			network: account.network,
+			asset: params.config?.networks?.evm?.currencySymbol ?? "ETH",
+			amountAtomic: balance.toString(),
+			amount: formatEther(balance)
+		};
+	}
+	if (params.chain === "sol") {
+		const account = requireAccount(params.accounts, "sol", params.accountId);
+		const connection = resolveSolConnection(params.config?.networks?.sol);
+		const balance = BigInt(await connection.getBalance(new PublicKey(account.address)));
+		return {
+			chain: "sol",
+			accountId: account.id,
+			address: account.address,
+			network: account.network,
+			asset: "SOL",
+			amountAtomic: balance.toString(),
+			amount: formatAtomicAmount(balance, 9)
+		};
+	}
+	if (params.chain === "trx") {
+		const account = requireAccount(params.accounts, "trx", params.accountId);
+		const tronWeb = resolveTronWeb(params.config?.networks?.trx);
+		const balance = BigInt(await tronWeb.trx.getBalance(account.address));
+		return {
+			chain: "trx",
+			accountId: account.id,
+			address: account.address,
+			network: account.network,
+			asset: "TRX",
+			amountAtomic: balance.toString(),
+			amount: formatAtomicAmount(balance, 6)
+		};
+	}
+	throw new Error("Use the Monero wallet RPC helper for XMR balances.");
+}
+async function quoteWalletSend(params) {
+	if (params.chain === "btc") return quoteBtc({
+		accounts: params.accounts,
+		accountId: params.accountId,
+		to: params.to,
+		amount: params.amount,
+		config: params.config?.networks?.btc
+	});
+	if (params.chain === "evm") {
+		const account = requireAccount(params.accounts, "evm", params.accountId);
+		const provider = resolveEvmProvider(params.config?.networks?.evm);
+		const amountAtomic = parseEther(params.amount);
+		const fee = await provider.estimateGas({
+			from: account.address,
+			to: params.to,
+			value: amountAtomic
+		});
+		const feeData = await provider.getFeeData();
+		const estimatedFee = fee * (feeData.gasPrice ?? feeData.maxFeePerGas ?? 0n);
+		return {
+			chain: "evm",
+			accountId: account.id,
+			network: account.network,
+			from: account.address,
+			to: params.to,
+			asset: params.config?.networks?.evm?.currencySymbol ?? "ETH",
+			amountAtomic: amountAtomic.toString(),
+			amount: formatEther(amountAtomic),
+			estimatedFeeAtomic: estimatedFee.toString(),
+			estimatedFee: formatEther(estimatedFee)
+		};
+	}
+	if (params.chain === "sol") {
+		const account = requireAccount(params.accounts, "sol", params.accountId);
+		const amountAtomic = parseDecimalAmount(params.amount, 9);
+		return {
+			chain: "sol",
+			accountId: account.id,
+			network: account.network,
+			from: account.address,
+			to: params.to,
+			asset: "SOL",
+			amountAtomic: amountAtomic.toString(),
+			amount: formatAtomicAmount(amountAtomic, 9),
+			estimatedFeeAtomic: "5000",
+			estimatedFee: formatAtomicAmount(5000n, 9)
+		};
+	}
+	const account = requireAccount(params.accounts, "trx", params.accountId);
+	const amountAtomic = parseDecimalAmount(params.amount, 6);
+	return {
+		chain: "trx",
+		accountId: account.id,
+		network: account.network,
+		from: account.address,
+		to: params.to,
+		asset: "TRX",
+		amountAtomic: amountAtomic.toString(),
+		amount: formatAtomicAmount(amountAtomic, 6)
+	};
+}
+async function sendWalletTransaction(params) {
+	const quote = await quoteWalletSend(params);
+	const material = await derivePrivateMaterial({
+		mnemonic: params.mnemonic,
+		chain: params.chain,
+		config: params.config
+	});
+	if (params.chain === "btc") {
+		const btcConfig = params.config?.networks?.btc;
+		const network = resolveBtcNetwork(btcConfig);
+		const keyPair = ECPair.fromPrivateKey(Buffer$1.from(material.privateKey), { network: network.network });
+		const payment = bitcoin.payments.p2wpkh({
+			pubkey: Buffer$1.from(keyPair.publicKey),
+			network: network.network
+		});
+		if (!payment.output) throw new Error("Unable to build Bitcoin witness output.");
+		const utxos = (await fetchBtcUtxos(material.address, btcConfig)).filter((utxo) => utxo.status?.confirmed !== false);
+		const fee = BigInt(quote.estimatedFeeAtomic ?? "0");
+		const target = BigInt(quote.amountAtomic);
+		let selected = 0n;
+		const selectedUtxos = [];
+		for (const utxo of utxos.toSorted((a, b) => b.value - a.value)) {
+			selected += BigInt(utxo.value);
+			selectedUtxos.push(utxo);
+			if (selected >= target + fee) break;
+		}
+		const psbt = new bitcoin.Psbt({ network: network.network });
+		for (const utxo of selectedUtxos) psbt.addInput({
+			hash: utxo.txid,
+			index: utxo.vout,
+			witnessUtxo: {
+				script: payment.output,
+				value: BigInt(utxo.value)
+			}
+		});
+		psbt.addOutput({
+			address: params.to,
+			value: target
+		});
+		const change = selected - target - fee;
+		if (change > 546n) psbt.addOutput({
+			address: material.address,
+			value: change
+		});
+		psbt.signAllInputs(keyPair);
+		psbt.finalizeAllInputs();
+		const txHex = psbt.extractTransaction().toHex();
+		const txId = await fetchText(`${resolveBtcEsploraUrl(btcConfig)}/tx`, {
+			method: "POST",
+			headers: { "content-type": "text/plain" },
+			body: txHex
+		});
+		return {
+			...quote,
+			txId: txId.trim(),
+			explorerUrl: void 0
+		};
+	}
+	if (params.chain === "evm") {
+		const provider = resolveEvmProvider(params.config?.networks?.evm);
+		const tx = await new Wallet(material.privateKey, provider).sendTransaction({
+			to: params.to,
+			value: BigInt(quote.amountAtomic)
+		});
+		return {
+			...quote,
+			txId: tx.hash,
+			explorerUrl: params.config?.networks?.evm?.explorerTxUrl ? `${params.config.networks.evm.explorerTxUrl.replace(/\/+$/, "")}/${tx.hash}` : void 0
+		};
+	}
+	if (params.chain === "sol") {
+		const connection = resolveSolConnection(params.config?.networks?.sol);
+		const keypair = Keypair.fromSeed(material.privateKey);
+		const amountAtomic = Number(BigInt(quote.amountAtomic));
+		if (!Number.isSafeInteger(amountAtomic) || amountAtomic <= 0) throw new Error("SOL amount is outside the supported range.");
+		const txId = await sendAndConfirmTransaction(connection, new Transaction().add(SystemProgram.transfer({
+			fromPubkey: keypair.publicKey,
+			toPubkey: new PublicKey(params.to),
+			lamports: amountAtomic
+		})), [keypair]);
+		return {
+			...quote,
+			txId,
+			explorerUrl: params.config?.networks?.sol?.explorerTxUrl ? `${params.config.networks.sol.explorerTxUrl.replace(/\/+$/, "")}/${txId}` : void 0
+		};
+	}
+	const tronConfig = params.config?.networks?.trx;
+	const tronWeb = resolveTronWeb(tronConfig, String(material.privateKey).replace(/^0x/, ""));
+	const amountAtomic = Number(BigInt(quote.amountAtomic));
+	if (!Number.isSafeInteger(amountAtomic) || amountAtomic <= 0) throw new Error("TRX amount is outside the supported range.");
+	const raw = await tronWeb.trx.sendTransaction(params.to, amountAtomic);
+	const txId = typeof raw.txid === "string" ? raw.txid : "";
+	if (!txId) throw new Error("TRON broadcast did not return a transaction id.");
+	return {
+		...quote,
+		txId,
+		explorerUrl: tronConfig?.explorerTxUrl ? `${tronConfig.explorerTxUrl.replace(/\/+$/, "")}/${txId}` : void 0,
+		raw
+	};
+}
+function isLocalKeystoreWalletChain(chain) {
+	return LOCAL_KEYSTORE_WALLET_CHAINS.includes(chain);
+}
+//#endregion
+//#region src/wallet/keystore.ts
+const scryptAsync = promisify(scrypt);
+const KEYSTORE_VERSION = 1;
+const KEY_LENGTH = 32;
+const SCRYPT_PARAMS = {
+	N: 32768,
+	r: 8,
+	p: 1,
+	maxmem: 128 * 1024 * 1024
+};
+function resolveWalletKeystorePaths(env = process.env) {
+	const stateDir = resolveStateDir(env);
+	const rootDir = path.join(stateDir, "credentials");
+	return {
+		rootDir,
+		filePath: path.join(rootDir, "wallets.json")
+	};
+}
+function encodeBase64Url(bytes) {
+	return Buffer.from(bytes).toString("base64url");
+}
+function decodeBase64Url(value) {
+	return Buffer.from(value, "base64url");
+}
+async function deriveKey(passphrase, salt, params = SCRYPT_PARAMS) {
+	if (!passphrase.trim()) throw new Error("Wallet passphrase is required.");
+	return scryptAsync(passphrase, salt, KEY_LENGTH, params);
+}
+async function encryptWalletPayload(params) {
+	const salt = randomBytes(16);
+	const nonce = randomBytes(12);
+	const key = await deriveKey(params.passphrase, salt);
+	const { createCipheriv } = await import("node:crypto");
+	const cipher = createCipheriv("aes-256-gcm", key, nonce);
+	const plaintext = Buffer.from(JSON.stringify(params.payload), "utf8");
+	const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return {
+		version: KEYSTORE_VERSION,
+		public: {
+			primaryAccount: params.primaryAccount,
+			accounts: params.publicAccounts,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		crypto: {
+			kdf: "scrypt",
+			salt: encodeBase64Url(salt),
+			n: SCRYPT_PARAMS.N,
+			r: SCRYPT_PARAMS.r,
+			p: SCRYPT_PARAMS.p,
+			maxmem: SCRYPT_PARAMS.maxmem,
+			keyLength: KEY_LENGTH,
+			cipher: "aes-256-gcm",
+			nonce: encodeBase64Url(nonce),
+			tag: encodeBase64Url(tag),
+			ciphertext: encodeBase64Url(ciphertext)
+		}
+	};
+}
+async function decryptWalletPayload(file, passphrase) {
+	if (file.version !== KEYSTORE_VERSION || file.crypto.cipher !== "aes-256-gcm") throw new Error("Unsupported wallet keystore version.");
+	const salt = decodeBase64Url(file.crypto.salt);
+	const nonce = decodeBase64Url(file.crypto.nonce);
+	const tag = decodeBase64Url(file.crypto.tag);
+	const ciphertext = decodeBase64Url(file.crypto.ciphertext);
+	const key = await deriveKey(passphrase, salt, {
+		N: file.crypto.n,
+		r: file.crypto.r,
+		p: file.crypto.p,
+		maxmem: file.crypto.maxmem ?? SCRYPT_PARAMS.maxmem
+	});
+	const { createDecipheriv } = await import("node:crypto");
+	const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+	decipher.setAuthTag(tag);
+	try {
+		const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+		return JSON.parse(plaintext.toString("utf8"));
+	} catch (error) {
+		throw new Error("Unable to decrypt wallet keystore. Check the passphrase.", { cause: error });
+	}
+}
+async function readWalletKeystore(env = process.env) {
+	const { filePath } = resolveWalletKeystorePaths(env);
+	try {
+		const raw = await fs.readFile(filePath, "utf8");
+		return JSON.parse(raw);
+	} catch (error) {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function writeWalletKeystore(file, env = process.env) {
+	const { rootDir, filePath } = resolveWalletKeystorePaths(env);
+	await fs.mkdir(rootDir, {
+		recursive: true,
+		mode: 448
+	});
+	await writePrivateSecretFileAtomic({
+		rootDir,
+		filePath,
+		content: `${JSON.stringify(file, null, 2)}\n`
+	});
+	return filePath;
+}
+//#endregion
+//#region src/wallet/xmr-rpc.ts
+function resolveSecretString(value, path) {
+	return normalizeResolvedSecretInputString({
+		value,
+		path
+	});
+}
+function resolveXmrConfig(config) {
+	return config?.networks?.xmr;
+}
+function requireRpcUrl(config) {
+	const url = resolveSecretString(config?.walletRpcUrl, "wallet.networks.xmr.walletRpcUrl");
+	if (!url) throw new Error("wallet.networks.xmr.walletRpcUrl is required for Monero wallet RPC.");
+	return url;
+}
+function atomicFromRpcValue(value, label) {
+	if (value === void 0) return 0n;
+	if (typeof value === "number") {
+		if (!Number.isSafeInteger(value) || value < 0) throw new Error(`monero-wallet-rpc returned an unsafe ${label} amount.`);
+		return BigInt(value);
+	}
+	return BigInt(value);
+}
+function safeRpcAmountNumber(value, label) {
+	const numeric = Number(value);
+	if (!Number.isSafeInteger(numeric) || numeric <= 0) throw new Error(`${label} is outside the supported Monero wallet RPC number range.`);
+	return numeric;
+}
+async function callMoneroWalletRpc(params) {
+	const url = requireRpcUrl(params.config);
+	const headers = { "content-type": "application/json" };
+	const username = resolveSecretString(params.config?.username, "wallet.networks.xmr.username");
+	const password = resolveSecretString(params.config?.password, "wallet.networks.xmr.password");
+	if (username || password) headers.authorization = `Basic ${Buffer$1.from(`${username ?? ""}:${password ?? ""}`).toString("base64")}`;
+	const response = await fetch(url, {
+		method: "POST",
+		headers,
+		body: JSON.stringify({
+			jsonrpc: "2.0",
+			id: "genesis-wallet",
+			method: params.method,
+			params: params.body ?? {}
+		})
+	});
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`monero-wallet-rpc HTTP ${response.status}${text ? `: ${text}` : ""}`);
+	}
+	const payload = await response.json();
+	if (payload.error) throw new Error(payload.error.message ?? `monero-wallet-rpc error ${payload.error.code}`);
+	if (payload.result === void 0) throw new Error("monero-wallet-rpc returned no result.");
+	return payload.result;
+}
+async function getXmrAddress(config) {
+	const xmr = resolveXmrConfig(config);
+	const accountIndex = xmr?.accountIndex ?? 0;
+	const addressIndex = xmr?.addressIndex ?? 0;
+	const result = await callMoneroWalletRpc({
+		config: xmr,
+		method: "get_address",
+		body: {
+			account_index: accountIndex,
+			address_index: [addressIndex]
+		}
+	});
+	const address = result.addresses?.find((entry) => entry.address_index === addressIndex)?.address ?? result.address;
+	if (!address) throw new Error("monero-wallet-rpc returned no address.");
+	return address;
+}
+async function getXmrBalance(config) {
+	const xmr = resolveXmrConfig(config);
+	const accountIndex = xmr?.accountIndex ?? 0;
+	const address = await getXmrAddress(config);
+	const result = await callMoneroWalletRpc({
+		config: xmr,
+		method: "get_balance",
+		body: { account_index: accountIndex }
+	});
+	const balance = atomicFromRpcValue(result.balance, "balance");
+	const unlocked = atomicFromRpcValue(result.unlocked_balance, "unlocked balance");
+	return {
+		chain: "xmr",
+		accountId: "xmr:rpc",
+		address,
+		network: "monero-wallet-rpc",
+		asset: "XMR",
+		amountAtomic: balance.toString(),
+		amount: formatAtomicAmount(balance, 12),
+		confirmedAmountAtomic: unlocked.toString(),
+		pendingAmountAtomic: (balance - unlocked).toString()
+	};
+}
+async function quoteXmrSend(params) {
+	const address = await getXmrAddress(params.config);
+	const amountAtomic = parseDecimalAmount(params.amount, 12);
+	return {
+		chain: "xmr",
+		accountId: "xmr:rpc",
+		network: "monero-wallet-rpc",
+		from: address,
+		to: params.to,
+		asset: "XMR",
+		amountAtomic: amountAtomic.toString(),
+		amount: formatAtomicAmount(amountAtomic, 12)
+	};
+}
+async function sendXmrTransaction(params) {
+	const quote = await quoteXmrSend(params);
+	const amountAtomic = BigInt(quote.amountAtomic);
+	const result = await callMoneroWalletRpc({
+		config: resolveXmrConfig(params.config),
+		method: "transfer",
+		body: {
+			destinations: [{
+				address: params.to,
+				amount: safeRpcAmountNumber(amountAtomic, "XMR amount")
+			}],
+			account_index: params.config?.networks?.xmr?.accountIndex ?? 0,
+			priority: 0,
+			get_tx_key: true
+		}
+	});
+	if (!result.tx_hash) throw new Error("monero-wallet-rpc transfer returned no tx_hash.");
+	return {
+		...quote,
+		txId: result.tx_hash,
+		explorerUrl: params.config?.networks?.xmr?.explorerTxUrl ? `${params.config.networks.xmr.explorerTxUrl.replace(/\/+$/, "")}/${result.tx_hash}` : void 0,
+		raw: result
+	};
+}
+//#endregion
+//#region src/wallet/service.ts
+function resolveConfig(config) {
+	return config ?? loadConfig().wallet;
+}
+function walletEnabled(config) {
+	return config?.enabled !== false;
+}
+function primaryAccount(accounts, config) {
+	const configured = config?.primaryAccount?.trim();
+	if (configured && accounts.some((account) => account.id === configured)) return configured;
+	return accounts[0]?.id;
+}
+function nativeAssetDecimals(chain) {
+	if (chain === "btc") return 8;
+	if (chain === "sol") return 9;
+	if (chain === "trx") return 6;
+	if (chain === "xmr") return 12;
+	return 18;
+}
+async function getWalletSummary(options = {}) {
+	const config = resolveConfig(options.config);
+	const warnings = [];
+	const keystore = await readWalletKeystore(options.env);
+	const accounts = keystore?.public.accounts ? [...keystore.public.accounts] : [];
+	if (!walletEnabled(config)) warnings.push("wallet disabled by config");
+	if (config?.networks?.xmr?.enabled !== false && config?.networks?.xmr?.walletRpcUrl) try {
+		const address = await getXmrAddress(config);
+		accounts.push({
+			id: "xmr:rpc",
+			chain: "xmr",
+			address,
+			network: "monero-wallet-rpc",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	} catch (error) {
+		warnings.push(error instanceof Error ? error.message : String(error));
+	}
+	return {
+		enabled: walletEnabled(config),
+		keystore: {
+			exists: Boolean(keystore),
+			locked: true
+		},
+		primaryAccount: keystore?.public.primaryAccount ?? primaryAccount(accounts, config),
+		accounts,
+		warnings
+	};
+}
+async function initWallet(params) {
+	if (await readWalletKeystore(params.env) && !params.overwrite) throw new Error("Wallet keystore already exists. Pass --overwrite to replace it.");
+	const config = resolveConfig(params.config);
+	const mnemonic = params.mnemonic ? assertValidWalletMnemonic(params.mnemonic) : generateWalletMnemonic();
+	const payload = {
+		version: 1,
+		mnemonic,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const accounts = await derivePublicAccounts({
+		mnemonic,
+		config,
+		chains: params.chains
+	});
+	await writeWalletKeystore(await encryptWalletPayload({
+		payload,
+		publicAccounts: accounts,
+		primaryAccount: primaryAccount(accounts, config),
+		passphrase: params.passphrase
+	}), params.env);
+	return {
+		mnemonicGenerated: !params.mnemonic,
+		summary: await getWalletSummary({
+			config,
+			env: params.env
+		})
+	};
+}
+async function importWallet(params) {
+	return initWallet(params);
+}
+async function setWalletRecoveryPhrase(params) {
+	const mnemonic = params.mode === "generate" ? generateWalletMnemonic() : assertValidWalletMnemonic(params.mnemonic ?? "");
+	const result = await initWallet({
+		config: params.config,
+		env: params.env,
+		passphrase: params.passphrase,
+		mnemonic,
+		overwrite: params.overwrite
+	});
+	return {
+		mnemonicGenerated: params.mode === "generate",
+		...params.mode === "generate" ? { mnemonic } : {},
+		summary: result.summary
+	};
+}
+async function unlockWalletMnemonic(params) {
+	const keystore = await readWalletKeystore(params.env);
+	if (!keystore) throw new Error("Wallet keystore not found. Run genesis wallet init or import first.");
+	return assertValidWalletMnemonic((await decryptWalletPayload(keystore, params.passphrase)).mnemonic);
+}
+async function getWalletAccounts(options = {}) {
+	return (await getWalletSummary(options)).accounts;
+}
+async function getWalletBalanceForChain(params) {
+	const config = resolveConfig(params.config);
+	if (params.chain === "xmr") return getXmrBalance(config);
+	const accounts = await getWalletAccounts({
+		config,
+		env: params.env
+	});
+	return getWalletBalance({
+		chain: params.chain,
+		accountId: params.accountId,
+		accounts,
+		config
+	});
+}
+function assertSpendGuard(params) {
+	const spending = params.config?.spending;
+	if (spending?.enabled !== true) throw new Error("Wallet spending is disabled. Set wallet.spending.enabled: true.");
+	if (params.guard?.yes !== true) throw new Error("Wallet send requires --yes.");
+	if ((spending.requireAllowEnv ?? true) && params.guard.allowEnv?.GENESIS_WALLET_ALLOW_SPEND !== "1") throw new Error("Wallet send requires GENESIS_WALLET_ALLOW_SPEND=1.");
+	if (spending.maxNativeAmount) {
+		const decimals = nativeAssetDecimals(params.chain);
+		if (compareDecimalAmounts(params.amount, spending.maxNativeAmount, decimals) > 0) throw new Error(`Wallet send exceeds wallet.spending.maxNativeAmount (${spending.maxNativeAmount}).`);
+	}
+}
+function unsupportedWalletChainError(chain) {
+	return /* @__PURE__ */ new Error(`Unsupported wallet chain: ${chain}`);
+}
+async function quoteWalletTransaction(params) {
+	const config = resolveConfig(params.config);
+	if (params.chain === "xmr") return quoteXmrSend({
+		to: params.to,
+		amount: params.amount,
+		config
+	});
+	if (!isLocalKeystoreWalletChain(params.chain)) throw unsupportedWalletChainError(params.chain);
+	const accounts = await getWalletAccounts({
+		config,
+		env: params.env
+	});
+	return quoteWalletSend({
+		chain: params.chain,
+		accounts,
+		accountId: params.accountId,
+		to: params.to,
+		amount: params.amount,
+		config
+	});
+}
+async function sendWallet(params) {
+	const config = resolveConfig(params.config);
+	assertSpendGuard({
+		chain: params.chain,
+		amount: params.amount,
+		config,
+		guard: params.guard
+	});
+	if (params.chain === "xmr") return sendXmrTransaction({
+		to: params.to,
+		amount: params.amount,
+		config
+	});
+	if (!isLocalKeystoreWalletChain(params.chain)) throw unsupportedWalletChainError(params.chain);
+	const mnemonic = await unlockWalletMnemonic({
+		passphrase: params.passphrase,
+		env: params.env
+	});
+	const accounts = await getWalletAccounts({
+		config,
+		env: params.env
+	});
+	return sendWalletTransaction({
+		chain: params.chain,
+		accounts,
+		accountId: params.accountId,
+		to: params.to,
+		amount: params.amount,
+		mnemonic,
+		config
+	});
+}
+//#endregion
+export { initWallet as a, setWalletRecoveryPhrase as c, WALLET_CHAINS as d, importWallet as i, generateWalletMnemonic as l, getWalletBalanceForChain as n, quoteWalletTransaction as o, getWalletSummary as r, sendWallet as s, getWalletAccounts as t, LOCAL_KEYSTORE_WALLET_CHAINS as u };