@vizzor/cli 0.10.0 → 0.11.0

package/dist/index.js

@@ -62,18 +62,31 @@ var init_schema = __esm({
       api: z.object({
         port: z.number().default(3e3),
         host: z.string().default("0.0.0.0"),
-        enableAuth: z.boolean().default(false),
-        corsOrigin: z.string().default("*")
+        enableAuth: z.boolean().default(true),
+        corsOrigin: z.string().default("http://localhost:3000")
       }).default(() => ({
         port: 3e3,
         host: "0.0.0.0",
-        enableAuth: false,
-        corsOrigin: "*"
+        enableAuth: true,
+        corsOrigin: "http://localhost:3000"
       })),
       n8n: z.object({
         enabled: z.boolean().default(false),
         webhookUrl: z.string().optional()
       }).default(() => ({ enabled: false })),
+      realtime: z.object({
+        enabled: z.boolean().default(false),
+        provider: z.enum(["binance"]).default("binance"),
+        symbols: z.array(z.string()).default([])
+      }).optional(),
+      trading: z.object({
+        enabled: z.boolean().default(false),
+        maxSlippage: z.number().default(0.5),
+        gasMultiplier: z.number().default(1.2),
+        confirmBeforeExecute: z.boolean().default(true),
+        dryRun: z.boolean().default(true),
+        walletName: z.string().optional()
+      }).optional(),
       discordToken: z.string().optional(),
       discordGuildId: z.string().optional(),
       telegramToken: z.string().optional()
@@ -82,7 +95,15 @@ var init_schema = __esm({
 });
 
 // src/config/loader.ts
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+var loader_exports = {};
+__export(loader_exports, {
+  getConfig: () => getConfig,
+  getConfigDir: () => getConfigDir,
+  getSettableKeys: () => getSettableKeys,
+  loadConfig: () => loadConfig,
+  saveConfigValue: () => saveConfigValue
+});
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import yaml from "yaml";
@@ -209,7 +230,8 @@ function saveConfigValue(key, value) {
     raw[key] = value;
   }
   vizzorConfigSchema.parse(raw);
-  writeFileSync(configPath, yaml.stringify(raw), "utf-8");
+  writeFileSync(configPath, yaml.stringify(raw), { encoding: "utf-8", mode: 384 });
+  chmodSync(configPath, 384);
   cachedConfig = null;
   loadConfig();
 }
@@ -250,6 +272,20 @@ var init_loader = __esm({
   }
 });
 
+// src/utils/validate.ts
+function assertValidAddress(address) {
+  if (!EVM_ADDRESS_RE.test(address)) {
+    throw new Error(`Invalid address format: expected 0x followed by 40 hex characters`);
+  }
+}
+var EVM_ADDRESS_RE;
+var init_validate = __esm({
+  "src/utils/validate.ts"() {
+    "use strict";
+    EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
+  }
+});
+
 // src/chains/evm/abi/erc20.ts
 var erc20Abi;
 var init_erc20 = __esm({
@@ -595,11 +631,12 @@ import {
   createPublicClient,
   http
 } from "viem";
-import { mainnet, polygon, arbitrum, optimism, base } from "viem/chains";
+import { mainnet, polygon, arbitrum, optimism, base, bsc, avalanche } from "viem/chains";
 var CHAIN_MAP, EvmAdapter;
 var init_adapter = __esm({
   "src/chains/evm/adapter.ts"() {
     "use strict";
+    init_validate();
     init_erc20();
     init_etherscan();
     init_constants();
@@ -608,7 +645,9 @@ var init_adapter = __esm({
       polygon,
       arbitrum,
       optimism,
-      base
+      base,
+      bsc,
+      avalanche
     };
     EvmAdapter = class {
       chainId;
@@ -651,18 +690,23 @@ var init_adapter = __esm({
       isConnected() {
         return this.client !== null;
       }
+      /** Validate and cast to viem Address. */
+      toAddress(address) {
+        assertValidAddress(address);
+        return this.toAddress(address);
+      }
       // ── Balances ────────────────────────────────────────────────────────────
       async getBalance(address) {
         const client2 = this.requireClient();
-        return client2.getBalance({ address });
+        return client2.getBalance({ address: this.toAddress(address) });
       }
       async getTokenBalance(address, tokenAddress) {
         const client2 = this.requireClient();
         const balance = await client2.readContract({
-          address: tokenAddress,
+          address: this.toAddress(tokenAddress),
           abi: erc20Abi,
           functionName: "balanceOf",
-          args: [address]
+          args: [this.toAddress(address)]
         });
         return balance;
       }
@@ -687,13 +731,13 @@ var init_adapter = __esm({
       // ── Contracts ───────────────────────────────────────────────────────────
       async getContractCode(address) {
         const client2 = this.requireClient();
-        const code = await client2.getCode({ address });
+        const code = await client2.getCode({ address: this.toAddress(address) });
         return code ?? "0x";
       }
       async readContract(address, abi, functionName, args2) {
         const client2 = this.requireClient();
         return client2.readContract({
-          address,
+          address: this.toAddress(address),
           abi,
           functionName,
           args: args2
@@ -702,25 +746,25 @@ var init_adapter = __esm({
       async getContractEvents(address, abi, eventName, options) {
         const client2 = this.requireClient();
         const logs = await client2.getContractEvents({
-          address,
+          address: this.toAddress(address),
           abi,
           eventName,
           fromBlock: options?.fromBlock,
           toBlock: options?.toBlock,
           args: options?.args
         });
-        return logs.map((log4) => ({
-          eventName: log4.eventName ?? eventName,
-          blockNumber: log4.blockNumber ?? 0n,
-          transactionHash: log4.transactionHash ?? "0x",
-          args: log4.args ?? {},
-          logIndex: log4.logIndex ?? 0
+        return logs.map((log15) => ({
+          eventName: log15.eventName ?? eventName,
+          blockNumber: log15.blockNumber ?? 0n,
+          transactionHash: log15.transactionHash ?? "0x",
+          args: log15.args ?? {},
+          logIndex: log15.logIndex ?? 0
         }));
       }
       // ── Tokens ──────────────────────────────────────────────────────────────
       async getTokenInfo(address) {
         const client2 = this.requireClient();
-        const tokenAddr = address;
+        const tokenAddr = this.toAddress(address);
         const [name, symbol, decimals, totalSupply] = await Promise.all([
           client2.readContract({
             address: tokenAddr,
@@ -779,6 +823,46 @@ var init_adapter = __esm({
   }
 });
 
+// src/utils/logger.ts
+import pino from "pino";
+function createLogger(name) {
+  const isDev = process.env["NODE_ENV"] !== "production";
+  if (isDev) {
+    return pino({
+      name,
+      level,
+      transport: {
+        target: "pino-pretty",
+        options: {
+          colorize: true
+        }
+      }
+    });
+  }
+  return pino({ name, level });
+}
+var level;
+var init_logger = __esm({
+  "src/utils/logger.ts"() {
+    "use strict";
+    level = process.env["VIZZOR_LOG_LEVEL"] ?? "info";
+  }
+});
+
+// src/chains/evm/writable-adapter.ts
+import { createWalletClient, http as http2 } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { mainnet as mainnet2, polygon as polygon2, arbitrum as arbitrum2, optimism as optimism2, base as base2, bsc as bsc2, avalanche as avalanche2 } from "viem/chains";
+var log;
+var init_writable_adapter = __esm({
+  "src/chains/evm/writable-adapter.ts"() {
+    "use strict";
+    init_adapter();
+    init_logger();
+    log = createLogger("writable-evm");
+  }
+});
+
 // src/chains/zk/adapter.ts
 function getZkChainIds() {
   return Object.keys(ZK_CHAIN_CONFIG);
@@ -836,6 +920,457 @@ var init_adapter2 = __esm({
   }
 });
 
+// src/chains/solana/adapter.ts
+var log2, SolanaAdapter;
+var init_adapter3 = __esm({
+  "src/chains/solana/adapter.ts"() {
+    "use strict";
+    init_logger();
+    log2 = createLogger("solana-adapter");
+    SolanaAdapter = class {
+      chainId = "solana";
+      name = "Solana";
+      nativeCurrency = { symbol: "SOL", decimals: 9 };
+      rpcUrl = "https://api.mainnet-beta.solana.com";
+      connected = false;
+      async connect(rpcUrl) {
+        if (rpcUrl) this.rpcUrl = rpcUrl;
+        this.connected = true;
+        log2.info(`Connected to Solana: ${this.rpcUrl}`);
+      }
+      async disconnect() {
+        this.connected = false;
+      }
+      isConnected() {
+        return this.connected;
+      }
+      async rpc(method, params = []) {
+        const res = await fetch(this.rpcUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+          signal: AbortSignal.timeout(15e3)
+        });
+        const json = await res.json();
+        if (json.error) throw new Error(`Solana RPC: ${json.error.message}`);
+        return json.result;
+      }
+      async getBalance(address) {
+        const result = await this.rpc("getBalance", [address]);
+        return BigInt(result.value);
+      }
+      async getTokenBalance(address, tokenAddress) {
+        const result = await this.rpc("getTokenAccountsByOwner", [
+          address,
+          { mint: tokenAddress },
+          { encoding: "jsonParsed" }
+        ]);
+        if (result.value.length === 0) return 0n;
+        return BigInt(result.value[0].account.data.parsed.info.tokenAmount.amount);
+      }
+      async getTransactionHistory(address, options) {
+        const limit = options?.limit ?? 20;
+        const sigs = await this.rpc("getSignaturesForAddress", [address, { limit }]);
+        return sigs.map((s) => ({
+          hash: s.signature,
+          blockNumber: BigInt(s.slot),
+          from: address,
+          to: null,
+          value: 0n,
+          gasUsed: 0n,
+          gasPrice: 0n,
+          timestamp: s.blockTime ?? 0,
+          status: s.err ? "reverted" : "success",
+          input: ""
+        }));
+      }
+      async getTokenTransfers(_address, _options) {
+        return [];
+      }
+      async getContractCode(address) {
+        const result = await this.rpc("getAccountInfo", [address, { encoding: "base64" }]);
+        return result?.value?.data?.[0] ?? "";
+      }
+      async readContract(_address, _abi, _functionName, _args) {
+        throw new Error("readContract not supported on Solana \u2014 use program-specific methods");
+      }
+      async getContractEvents(_address, _abi, _eventName, _options) {
+        return [];
+      }
+      async getTokenInfo(address) {
+        const result = await this.rpc("getAccountInfo", [address, { encoding: "jsonParsed" }]);
+        const info = result?.value?.data?.parsed?.info;
+        return {
+          address,
+          name: "SPL Token",
+          symbol: "SPL",
+          decimals: info?.decimals ?? 9,
+          totalSupply: BigInt(info?.supply ?? "0")
+        };
+      }
+      async getTopHolders(_tokenAddress, _limit) {
+        return [];
+      }
+      async getBlockNumber() {
+        const slot = await this.rpc("getSlot");
+        return BigInt(slot);
+      }
+      async getBlock(blockNumber) {
+        const result = await this.rpc("getBlock", [
+          Number(blockNumber),
+          { transactionDetails: "none" }
+        ]);
+        return {
+          number: blockNumber,
+          hash: result?.blockhash ?? "",
+          parentHash: "",
+          timestamp: result?.blockTime ?? 0,
+          gasUsed: 0n,
+          gasLimit: 0n,
+          baseFeePerGas: null,
+          transactionCount: result?.transactions?.length ?? 0
+        };
+      }
+    };
+  }
+});
+
+// src/chains/sui/adapter.ts
+var log3, SuiAdapter;
+var init_adapter4 = __esm({
+  "src/chains/sui/adapter.ts"() {
+    "use strict";
+    init_logger();
+    log3 = createLogger("sui-adapter");
+    SuiAdapter = class {
+      chainId = "sui";
+      name = "Sui";
+      nativeCurrency = { symbol: "SUI", decimals: 9 };
+      rpcUrl = "https://fullnode.mainnet.sui.io:443";
+      connected = false;
+      async connect(rpcUrl) {
+        if (rpcUrl) this.rpcUrl = rpcUrl;
+        this.connected = true;
+        log3.info(`Connected to Sui: ${this.rpcUrl}`);
+      }
+      async disconnect() {
+        this.connected = false;
+      }
+      isConnected() {
+        return this.connected;
+      }
+      async rpc(method, params = []) {
+        const res = await fetch(this.rpcUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+          signal: AbortSignal.timeout(15e3)
+        });
+        const json = await res.json();
+        if (json.error) throw new Error(`Sui RPC: ${json.error.message}`);
+        return json.result;
+      }
+      async getBalance(address) {
+        const result = await this.rpc("suix_getBalance", [address, "0x2::sui::SUI"]);
+        return BigInt(result.totalBalance);
+      }
+      async getTokenBalance(address, tokenAddress) {
+        const result = await this.rpc("suix_getBalance", [address, tokenAddress]);
+        return BigInt(result.totalBalance);
+      }
+      async getTransactionHistory(address, options) {
+        const limit = options?.limit ?? 20;
+        const result = await this.rpc("suix_queryTransactionBlocks", [
+          { filter: { FromAddress: address } },
+          null,
+          limit,
+          true
+        ]);
+        return (result.data ?? []).map((tx) => ({
+          hash: tx.digest,
+          blockNumber: BigInt(tx.checkpoint ?? "0"),
+          from: address,
+          to: null,
+          value: 0n,
+          gasUsed: 0n,
+          gasPrice: 0n,
+          timestamp: Math.floor(Number(tx.timestampMs) / 1e3),
+          status: "success",
+          input: ""
+        }));
+      }
+      async getTokenTransfers(_address, _options) {
+        return [];
+      }
+      async getContractCode(address) {
+        const result = await this.rpc("sui_getObject", [address, { showContent: true }]);
+        return result.data?.content?.type ?? "";
+      }
+      async readContract(_address, _abi, _functionName, _args) {
+        throw new Error("readContract not supported on Sui \u2014 use Move call methods");
+      }
+      async getContractEvents(_address, _abi, _eventName, _options) {
+        return [];
+      }
+      async getTokenInfo(address) {
+        const result = await this.rpc("suix_getCoinMetadata", [address]);
+        return {
+          address,
+          name: result?.name ?? "Unknown",
+          symbol: result?.symbol ?? "???",
+          decimals: result?.decimals ?? 9,
+          totalSupply: 0n
+        };
+      }
+      async getTopHolders(_tokenAddress, _limit) {
+        return [];
+      }
+      async getBlockNumber() {
+        const result = await this.rpc("sui_getLatestCheckpointSequenceNumber");
+        return BigInt(result);
+      }
+      async getBlock(blockNumber) {
+        const result = await this.rpc("sui_getCheckpoint", [String(blockNumber)]);
+        return {
+          number: blockNumber,
+          hash: result?.digest ?? "",
+          parentHash: result?.previousDigest ?? "",
+          timestamp: result ? Math.floor(Number(result.timestampMs) / 1e3) : 0,
+          gasUsed: 0n,
+          gasLimit: 0n,
+          baseFeePerGas: null,
+          transactionCount: result?.transactions?.length ?? 0
+        };
+      }
+    };
+  }
+});
+
+// src/chains/aptos/adapter.ts
+var log4, AptosAdapter;
+var init_adapter5 = __esm({
+  "src/chains/aptos/adapter.ts"() {
+    "use strict";
+    init_logger();
+    log4 = createLogger("aptos-adapter");
+    AptosAdapter = class {
+      chainId = "aptos";
+      name = "Aptos";
+      nativeCurrency = { symbol: "APT", decimals: 8 };
+      apiUrl = "https://fullnode.mainnet.aptoslabs.com/v1";
+      connected = false;
+      async connect(rpcUrl) {
+        if (rpcUrl) this.apiUrl = rpcUrl;
+        this.connected = true;
+        log4.info(`Connected to Aptos: ${this.apiUrl}`);
+      }
+      async disconnect() {
+        this.connected = false;
+      }
+      isConnected() {
+        return this.connected;
+      }
+      async api(path) {
+        const res = await fetch(`${this.apiUrl}${path}`, {
+          signal: AbortSignal.timeout(15e3)
+        });
+        if (!res.ok) throw new Error(`Aptos API: ${res.status} ${res.statusText}`);
+        return res.json();
+      }
+      async getBalance(address) {
+        try {
+          const result = await this.api(
+            `/accounts/${address}/resource/0x1::coin::CoinStore<0x1::aptos_coin::AptosCoin>`
+          );
+          return BigInt(result.data.coin.value);
+        } catch {
+          return 0n;
+        }
+      }
+      async getTokenBalance(address, tokenAddress) {
+        try {
+          const result = await this.api(
+            `/accounts/${address}/resource/0x1::coin::CoinStore<${tokenAddress}>`
+          );
+          return BigInt(result.data.coin.value);
+        } catch {
+          return 0n;
+        }
+      }
+      async getTransactionHistory(address, options) {
+        const limit = options?.limit ?? 20;
+        const txns = await this.api(`/accounts/${address}/transactions?limit=${limit}`);
+        return txns.map((tx) => ({
+          hash: tx.hash,
+          blockNumber: BigInt(tx.version),
+          from: tx.sender,
+          to: null,
+          value: 0n,
+          gasUsed: BigInt(tx.gas_used),
+          gasPrice: BigInt(tx.gas_unit_price),
+          timestamp: Math.floor(Number(tx.timestamp) / 1e6),
+          status: tx.success ? "success" : "reverted",
+          input: ""
+        }));
+      }
+      async getTokenTransfers(_address, _options) {
+        return [];
+      }
+      async getContractCode(address) {
+        try {
+          const result = await this.api(`/accounts/${address}/modules`);
+          return result.map((m) => m.bytecode).join("");
+        } catch {
+          return "";
+        }
+      }
+      async readContract(_address, _abi, _functionName, _args) {
+        throw new Error("readContract not supported on Aptos \u2014 use Move view functions");
+      }
+      async getContractEvents(_address, _abi, _eventName, _options) {
+        return [];
+      }
+      async getTokenInfo(address) {
+        return {
+          address,
+          name: "Move Coin",
+          symbol: "MOVE",
+          decimals: 8,
+          totalSupply: 0n
+        };
+      }
+      async getTopHolders(_tokenAddress, _limit) {
+        return [];
+      }
+      async getBlockNumber() {
+        const result = await this.api("/");
+        return BigInt(result.ledger_version);
+      }
+      async getBlock(blockNumber) {
+        const result = await this.api(`/blocks/by_version/${blockNumber}`);
+        return {
+          number: BigInt(result.block_height),
+          hash: result.block_hash,
+          parentHash: "",
+          timestamp: Math.floor(Number(result.block_timestamp) / 1e6),
+          gasUsed: 0n,
+          gasLimit: 0n,
+          baseFeePerGas: null,
+          transactionCount: result.transactions?.length ?? 0
+        };
+      }
+    };
+  }
+});
+
+// src/chains/ton/adapter.ts
+var log5, TonAdapter;
+var init_adapter6 = __esm({
+  "src/chains/ton/adapter.ts"() {
+    "use strict";
+    init_logger();
+    log5 = createLogger("ton-adapter");
+    TonAdapter = class {
+      chainId = "ton";
+      name = "TON";
+      nativeCurrency = { symbol: "TON", decimals: 9 };
+      apiUrl = "https://toncenter.com/api/v2";
+      connected = false;
+      async connect(rpcUrl) {
+        if (rpcUrl) this.apiUrl = rpcUrl;
+        this.connected = true;
+        log5.info(`Connected to TON: ${this.apiUrl}`);
+      }
+      async disconnect() {
+        this.connected = false;
+      }
+      isConnected() {
+        return this.connected;
+      }
+      async api(method, params = {}) {
+        const qs = new URLSearchParams(params).toString();
+        const url = `${this.apiUrl}/${method}${qs ? `?${qs}` : ""}`;
+        const res = await fetch(url, { signal: AbortSignal.timeout(15e3) });
+        if (!res.ok) throw new Error(`TON API: ${res.status}`);
+        const json = await res.json();
+        if (!json.ok) throw new Error(`TON API: ${json.error ?? "unknown error"}`);
+        return json.result;
+      }
+      async getBalance(address) {
+        const result = await this.api("getAddressBalance", { address });
+        return BigInt(result);
+      }
+      async getTokenBalance(_address, _tokenAddress) {
+        return 0n;
+      }
+      async getTransactionHistory(address, options) {
+        const limit = options?.limit ?? 20;
+        const txns = await this.api("getTransactions", {
+          address,
+          limit: String(limit)
+        });
+        return txns.map((tx) => ({
+          hash: tx.transaction_id.hash,
+          blockNumber: 0n,
+          from: tx.in_msg?.source ?? address,
+          to: tx.in_msg?.destination ?? null,
+          value: BigInt(tx.in_msg?.value ?? "0"),
+          gasUsed: BigInt(tx.fee),
+          gasPrice: 0n,
+          timestamp: tx.utime,
+          status: "success",
+          input: ""
+        }));
+      }
+      async getTokenTransfers(_address, _options) {
+        return [];
+      }
+      async getContractCode(address) {
+        try {
+          const result = await this.api("getAddressInformation", { address });
+          return result.code ?? "";
+        } catch {
+          return "";
+        }
+      }
+      async readContract(_address, _abi, _functionName, _args) {
+        throw new Error("readContract not supported on TON \u2014 use get methods");
+      }
+      async getContractEvents(_address, _abi, _eventName, _options) {
+        return [];
+      }
+      async getTokenInfo(_address) {
+        return {
+          address: _address,
+          name: "Jetton",
+          symbol: "JET",
+          decimals: 9,
+          totalSupply: 0n
+        };
+      }
+      async getTopHolders(_tokenAddress, _limit) {
+        return [];
+      }
+      async getBlockNumber() {
+        const result = await this.api("getMasterchainInfo");
+        return BigInt(result.last.seqno);
+      }
+      async getBlock(blockNumber) {
+        return {
+          number: blockNumber,
+          hash: "",
+          parentHash: "",
+          timestamp: 0,
+          gasUsed: 0n,
+          gasLimit: 0n,
+          baseFeePerGas: null,
+          transactionCount: 0
+        };
+      }
+    };
+  }
+});
+
 // src/chains/registry.ts
 function getAdapter(chainId) {
   const factory = registry.get(chainId);
@@ -854,7 +1389,12 @@ var init_registry = __esm({
   "src/chains/registry.ts"() {
     "use strict";
     init_adapter();
+    init_writable_adapter();
     init_adapter2();
+    init_adapter3();
+    init_adapter4();
+    init_adapter5();
+    init_adapter6();
     registry = /* @__PURE__ */ new Map();
     evmFactory = (chainId) => new EvmAdapter(chainId);
     BUILTIN_EVM_CHAINS = ["ethereum", "polygon", "arbitrum", "optimism", "base"];
@@ -865,32 +1405,12 @@ var init_registry = __esm({
     for (const chainId of getZkChainIds()) {
       registry.set(chainId, zkFactory);
     }
-  }
-});
-
-// src/utils/logger.ts
-import pino from "pino";
-function createLogger(name) {
-  const isDev = process.env["NODE_ENV"] !== "production";
-  if (isDev) {
-    return pino({
-      name,
-      level,
-      transport: {
-        target: "pino-pretty",
-        options: {
-          colorize: true
-        }
-      }
-    });
-  }
-  return pino({ name, level });
-}
-var level;
-var init_logger = __esm({
-  "src/utils/logger.ts"() {
-    "use strict";
-    level = process.env["VIZZOR_LOG_LEVEL"] ?? "info";
+    registry.set("bsc", evmFactory);
+    registry.set("avalanche", evmFactory);
+    registry.set("solana", () => new SolanaAdapter());
+    registry.set("sui", () => new SuiAdapter());
+    registry.set("aptos", () => new AptosAdapter());
+    registry.set("ton", () => new TonAdapter());
   }
 });
 
@@ -902,12 +1422,12 @@ function initMLClient(url) {
 function getMLClient() {
   return mlClient;
 }
-var log, MLClient, mlClient;
+var log6, MLClient, mlClient;
 var init_client = __esm({
   "src/ml/client.ts"() {
     "use strict";
     init_logger();
-    log = createLogger("ml-client");
+    log6 = createLogger("ml-client");
     MLClient = class {
       baseUrl;
       healthy = false;
@@ -925,7 +1445,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML predict failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML predict failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -941,7 +1461,7 @@ var init_client = __esm({
           const data = await res.json();
           return data.predictions;
         } catch (err) {
-          log.debug(`ML batch predict failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML batch predict failed: ${err instanceof Error ? err.message : String(err)}`);
           return [];
         }
       }
@@ -957,7 +1477,7 @@ var init_client = __esm({
           const data = await res.json();
           return data.anomalies;
         } catch (err) {
-          log.debug(`ML anomaly detection failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML anomaly detection failed: ${err instanceof Error ? err.message : String(err)}`);
           return [];
         }
       }
@@ -984,7 +1504,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML rug predict failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML rug predict failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -999,7 +1519,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML wallet classify failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML wallet classify failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1014,7 +1534,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML sentiment failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML sentiment failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1030,7 +1550,7 @@ var init_client = __esm({
           const data = await res.json();
           return data.results;
         } catch (err) {
-          log.debug(`ML sentiment batch failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML sentiment batch failed: ${err instanceof Error ? err.message : String(err)}`);
           return [];
         }
       }
@@ -1048,7 +1568,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML trend score failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML trend score failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1063,7 +1583,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML TA interpret failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML TA interpret failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1078,7 +1598,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML strategy eval failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML strategy eval failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1093,7 +1613,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML regime detect failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML regime detect failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1108,7 +1628,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML project risk failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML project risk failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1123,7 +1643,7 @@ var init_client = __esm({
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML portfolio opt failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML portfolio opt failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1132,43 +1652,74 @@ var init_client = __esm({
           const res = await fetch(`${this.baseUrl}/predict/intent`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ text }),
+            body: JSON.stringify({ text }),
+            signal: AbortSignal.timeout(5e3)
+          });
+          if (!res.ok) return null;
+          return await res.json();
+        } catch (err) {
+          log6.debug(`ML intent classify failed: ${err instanceof Error ? err.message : String(err)}`);
+          return null;
+        }
+      }
+      async scoreBytecodeRisk(features) {
+        try {
+          const res = await fetch(`${this.baseUrl}/predict/bytecode-risk`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(features),
+            signal: AbortSignal.timeout(5e3)
+          });
+          if (!res.ok) return null;
+          return await res.json();
+        } catch (err) {
+          log6.debug(`ML bytecode risk failed: ${err instanceof Error ? err.message : String(err)}`);
+          return null;
+        }
+      }
+      async predictPortfolioForward(features) {
+        try {
+          const res = await fetch(`${this.baseUrl}/predict/portfolio-forward`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(features),
             signal: AbortSignal.timeout(5e3)
           });
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML intent classify failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML portfolio forward failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
-      async scoreBytecodeRisk(features) {
+      async trainModel(modelName, params) {
         try {
-          const res = await fetch(`${this.baseUrl}/predict/bytecode-risk`, {
+          const res = await fetch(`${this.baseUrl}/train`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(features),
-            signal: AbortSignal.timeout(5e3)
+            body: JSON.stringify({ model: modelName, ...params }),
+            signal: AbortSignal.timeout(3e5)
+            // 5 min for training
           });
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML bytecode risk failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML train failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
-      async predictPortfolioForward(features) {
+      async evaluateModel(modelName) {
         try {
-          const res = await fetch(`${this.baseUrl}/predict/portfolio-forward`, {
+          const res = await fetch(`${this.baseUrl}/evaluate`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(features),
-            signal: AbortSignal.timeout(5e3)
+            body: JSON.stringify({ model: modelName }),
+            signal: AbortSignal.timeout(6e4)
           });
           if (!res.ok) return null;
           return await res.json();
         } catch (err) {
-          log.debug(`ML portfolio forward failed: ${err instanceof Error ? err.message : String(err)}`);
+          log6.debug(`ML evaluate failed: ${err instanceof Error ? err.message : String(err)}`);
           return null;
         }
       }
@@ -1342,6 +1893,7 @@ __export(scan_exports, {
 import chalk from "chalk";
 import ora from "ora";
 async function handleScan(project, options) {
+  assertValidAddress(project);
   const spinner = ora(`Scanning ${project} on ${options.chain}...`).start();
   try {
     const adapter = getAdapter(options.chain);
@@ -1396,6 +1948,7 @@ var init_scan = __esm({
     init_loader();
     init_project_analyzer();
     init_risk_scorer();
+    init_validate();
   }
 });
 
@@ -1560,9 +2113,18 @@ async function fetchCryptoNews(symbol, apiToken) {
   const url = `${BASE_URL2}/posts/?${params.toString()}`;
   const res = await fetch(url);
   if (!res.ok) {
-    throw new Error(`CryptoPanic API error: ${res.status} ${res.statusText}`);
+    return [];
+  }
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) {
+    return [];
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch {
+    return [];
   }
-  const data = await res.json();
   const posts = data.results ?? [];
   return posts.map((post) => {
     const { positive, negative } = post.votes;
@@ -1718,7 +2280,7 @@ async function fetchJson2(url) {
 }
 async function fetchTickerPrice(symbol) {
   const pair = resolvePair(symbol);
-  const data = await fetchJson2(`${BASE_URL3}/ticker/24hr?symbol=${pair}`);
+  const data = await fetchJson2(`${BASE_URL3}/ticker/24hr?symbol=${encodeURIComponent(pair)}`);
   return {
     symbol: symbol.toUpperCase(),
     price: parseFloat(data.lastPrice),
@@ -1728,7 +2290,7 @@ async function fetchTickerPrice(symbol) {
 async function fetchKlines(symbol, interval, limit = 100) {
   const pair = resolvePair(symbol);
   const data = await fetchJson2(
-    `${BASE_URL3}/klines?symbol=${pair}&interval=${interval}&limit=${limit}`
+    `${BASE_URL3}/klines?symbol=${encodeURIComponent(pair)}&interval=${interval}&limit=${limit}`
   );
   return data.map((k) => ({
     openTime: Number(k[0]),
@@ -1744,7 +2306,7 @@ async function fetchKlines(symbol, interval, limit = 100) {
 }
 async function fetchFundingRate(symbol) {
   const pair = resolvePair(symbol);
-  const data = await fetchJson2(`${FUTURES_URL}/premiumIndex?symbol=${pair}`);
+  const data = await fetchJson2(`${FUTURES_URL}/premiumIndex?symbol=${encodeURIComponent(pair)}`);
   const item = data[0];
   if (!item) throw new Error(`No funding data for ${pair}`);
   return {
@@ -1758,9 +2320,11 @@ async function fetchOpenInterest(symbol) {
   const pair = resolvePair(symbol);
   const [oiData, tickerData] = await Promise.all([
     fetchJson2(
-      `${FUTURES_URL}/openInterest?symbol=${pair}`
+      `${FUTURES_URL}/openInterest?symbol=${encodeURIComponent(pair)}`
     ),
-    fetchJson2(`${FUTURES_URL}/ticker/price?symbol=${pair}`)
+    fetchJson2(
+      `${FUTURES_URL}/ticker/price?symbol=${encodeURIComponent(pair)}`
+    )
   ]);
   const oi = parseFloat(oiData.openInterest);
   const price = parseFloat(tickerData.lastPrice);
@@ -1790,7 +2354,7 @@ async function fetchTopGainersLosers(limit = 10) {
 async function isValidSymbol(symbol) {
   try {
     const pair = resolvePair(symbol);
-    await fetchJson2(`${BASE_URL3}/ticker/price?symbol=${pair}`);
+    await fetchJson2(`${BASE_URL3}/ticker/price?symbol=${encodeURIComponent(pair)}`);
     return true;
   } catch {
     return false;
@@ -2811,6 +3375,7 @@ __export(track_exports, {
 import chalk3 from "chalk";
 import ora3 from "ora";
 async function handleTrack(wallet, options) {
+  assertValidAddress(wallet);
   const spinner = ora3(`Analyzing wallet ${wallet.slice(0, 10)}... on ${options.chain}`).start();
   try {
     const adapter = getAdapter(options.chain);
@@ -2871,6 +3436,7 @@ var init_track = __esm({
     init_registry();
     init_loader();
     init_wallet_analyzer();
+    init_validate();
   }
 });
 
@@ -3163,6 +3729,7 @@ __export(audit_exports, {
 import chalk5 from "chalk";
 import ora5 from "ora";
 async function handleAudit(contract, options) {
+  assertValidAddress(contract);
   const spinner = ora5(`Auditing contract ${contract.slice(0, 10)}... on ${options.chain}`).start();
   try {
     const adapter = getAdapter(options.chain);
@@ -3240,6 +3807,7 @@ var init_audit = __esm({
     init_registry();
     init_loader();
     init_contract_auditor();
+    init_validate();
   }
 });
 
@@ -4292,7 +4860,9 @@ async function fetchJson6(url) {
 }
 async function checkTokenSecurity(contractAddress, chain) {
   const chainId = resolveChainId(chain);
-  const data = await fetchJson6(`${BASE_URL6}/token_security/${chainId}?contract_addresses=${contractAddress.toLowerCase()}`);
+  const data = await fetchJson6(
+    `${BASE_URL6}/token_security/${encodeURIComponent(chainId)}?contract_addresses=${encodeURIComponent(contractAddress.toLowerCase())}`
+  );
   if (data.code !== 1) return null;
   const addr = contractAddress.toLowerCase();
   const raw = data.result[addr];
@@ -4347,7 +4917,9 @@ async function checkTokenSecurity(contractAddress, chain) {
 }
 async function checkAddressSecurity(address, chain) {
   const chainId = resolveChainId(chain);
-  const data = await fetchJson6(`${BASE_URL6}/address_security/${chainId}?address=${address.toLowerCase()}`);
+  const data = await fetchJson6(
+    `${BASE_URL6}/address_security/${encodeURIComponent(chainId)}?address=${encodeURIComponent(address.toLowerCase())}`
+  );
   if (data.code !== 1) return null;
   const raw = data.result;
   const toBool = (v) => v === "1" || v === 1 || v === true;
@@ -4374,7 +4946,81 @@ var init_goplus = __esm({
       optimism: "10",
       base: "8453",
       avalanche: "43114",
-      solana: "solana"
+      solana: "solana",
+      sui: "sui",
+      aptos: "aptos",
+      ton: "ton"
+    };
+  }
+});
+
+// src/ai/sanitize.ts
+function sanitizeExternalData(text, maxLen = LIMITS.generic) {
+  let cleaned = text;
+  for (const pattern of INJECTION_PATTERNS) {
+    cleaned = cleaned.replace(pattern, "[FILTERED]");
+  }
+  cleaned = cleaned.replace(/^#{1,6}\s+/gm, "");
+  cleaned = cleaned.replace(/```[\s\S]*?```/g, "[CODE]");
+  if (cleaned.length > maxLen) {
+    cleaned = cleaned.slice(0, maxLen) + "...";
+  }
+  return cleaned;
+}
+function sanitizeTokenName(name) {
+  return sanitizeExternalData(name, LIMITS.tokenName);
+}
+function sanitizeHeadline(headline) {
+  return sanitizeExternalData(headline, LIMITS.headline);
+}
+function wrapUntrustedData(label, data) {
+  return `[BEGIN EXTERNAL DATA: ${label}]
+${data}
+[END EXTERNAL DATA: ${label}]`;
+}
+function sanitizeToolResult(result) {
+  if (typeof result === "string") {
+    return sanitizeExternalData(result);
+  }
+  if (Array.isArray(result)) {
+    return result.map(sanitizeToolResult);
+  }
+  if (result !== null && typeof result === "object") {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(result)) {
+      sanitized[key] = sanitizeToolResult(value);
+    }
+    return sanitized;
+  }
+  return result;
+}
+var INJECTION_PATTERNS, LIMITS;
+var init_sanitize = __esm({
+  "src/ai/sanitize.ts"() {
+    "use strict";
+    INJECTION_PATTERNS = [
+      /ignore\s+(all\s+)?previous\s+instructions/gi,
+      /ignore\s+(all\s+)?above/gi,
+      /you\s+are\s+now/gi,
+      /system\s*:/gi,
+      /assistant\s*:/gi,
+      /\[system\]/gi,
+      /\[instruction\]/gi,
+      /<\/?system>/gi,
+      /repeat\s+(everything|the\s+prompt|your\s+instructions)/gi,
+      /reveal\s+(your|the)\s+(prompt|instructions|config)/gi,
+      /forget\s+(everything|your\s+instructions)/gi,
+      /override\s+(previous|your|all)/gi,
+      /new\s+instructions?\s*:/gi,
+      /\bdo\s+not\s+follow\b/gi,
+      /\bact\s+as\b/gi,
+      /\brole\s*:\s*(system|assistant)\b/gi
+    ];
+    LIMITS = {
+      tokenName: 60,
+      headline: 250,
+      description: 500,
+      generic: 1e3
     };
   }
 });
@@ -4601,10 +5247,11 @@ async function buildContextBlock(userMessage) {
   }
   output.push(...buildInstructions(queryType, hasSpecificToken, isComplexQuery));
   output.push("");
-  return output.join("\n");
+  const raw = output.join("\n");
+  return wrapUntrustedData("MARKET_CONTEXT", raw);
 }
 function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
-  const base2 = [
+  const base3 = [
     "CRITICAL INSTRUCTIONS (MUST FOLLOW):",
     '- NEVER output "--- REAL-TIME DATA ---" or "--- END REAL-TIME DATA ---" markers.',
     "- You MUST use ONLY the real-time data above. Do NOT invent or fabricate any data.",
@@ -4613,7 +5260,7 @@ function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
   ];
   switch (queryType) {
     case "news":
-      base2.push(
+      base3.push(
         "",
         "QUERY TYPE: NEWS \u2014 The user wants crypto news and market updates.",
         "- Summarize the news headlines from the data above.",
@@ -4624,7 +5271,7 @@ function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
       );
       break;
     case "trends":
-      base2.push(
+      base3.push(
         "",
         "QUERY TYPE: TRENDS/MARKET OVERVIEW \u2014 The user wants to know what is trending.",
         "- Lead with the overall market sentiment (Fear & Greed + BTC direction).",
@@ -4635,7 +5282,7 @@ function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
       );
       break;
     case "token_analysis":
-      base2.push(
+      base3.push(
         "",
         "QUERY TYPE: TOKEN ANALYSIS \u2014 The user wants deep analysis of a specific token.",
         "- Follow the analysis report structure above (Verdict \u2192 Market \u2192 Security \u2192 Signals \u2192 Risks).",
@@ -4646,7 +5293,7 @@ function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
       );
       break;
     case "prediction":
-      base2.push(
+      base3.push(
         "",
         "QUERY TYPE: PRICE PREDICTION \u2014 The user wants future price projections.",
         "- ALWAYS include the PRICE PREDICTION SCENARIOS with the exact dollar values from the data.",
@@ -4659,7 +5306,7 @@ function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
       );
       break;
     default:
-      base2.push(
+      base3.push(
         "",
         "QUERY TYPE: GENERAL \u2014 Answer naturally using the data above as context.",
         "- Use the real-time prices and sentiment as background context.",
@@ -4670,12 +5317,12 @@ function buildInstructions(queryType, hasSpecificToken, isComplexQuery) {
       break;
   }
   if (isComplexQuery && hasSpecificToken) {
-    base2.push(
+    base3.push(
       "",
       "COMPLEX ANALYSIS: Structure your reasoning as Data \u2192 Signals \u2192 Alignment \u2192 Confidence \u2192 Risks \u2192 Conclusion."
     );
   }
-  return base2;
+  return base3;
 }
 async function fetchTokenData(tokens, address) {
   const lines = ["## Token / Price Data"];
@@ -4685,7 +5332,7 @@ async function fetchTokenData(tokens, address) {
       const pair = pairs[0];
       if (pair) {
         lines.push(
-          `${pair.baseToken.name} (${pair.baseToken.symbol}) on ${pair.chainId}:`,
+          `${sanitizeTokenName(pair.baseToken.name)} (${sanitizeTokenName(pair.baseToken.symbol)}) on ${pair.chainId}:`,
           `  Price: $${pair.priceUsd ?? "?"}`,
           `  24h Volume: $${(pair.volume?.h24 ?? 0).toLocaleString()}`,
           `  Liquidity: $${(pair.liquidity?.usd ?? 0).toLocaleString()}`,
@@ -4754,7 +5401,7 @@ async function fetchTokenData(tokens, address) {
       const pair = pairs[0];
       if (pair) {
         lines.push(
-          `${pair.baseToken.name} (${pair.baseToken.symbol}) on ${pair.chainId}:`,
+          `${sanitizeTokenName(pair.baseToken.name)} (${sanitizeTokenName(pair.baseToken.symbol)}) on ${pair.chainId}:`,
           `  Price: $${pair.priceUsd ?? "?"}`,
           `  24h Volume: $${(pair.volume?.h24 ?? 0).toLocaleString()}`,
           `  24h Change: ${(pair.priceChange?.h24 ?? 0) > 0 ? "+" : ""}${(pair.priceChange?.h24 ?? 0).toFixed(2)}%`,
@@ -4773,7 +5420,7 @@ async function fetchTrendingData() {
     const lines = ["## Trending Tokens (live)"];
     for (const t of trending.slice(0, 10)) {
       lines.push(
-        `- ${t.name} (${t.symbol}) on ${t.chain}: $${t.priceUsd} | 24h: ${t.priceChange24h > 0 ? "+" : ""}${t.priceChange24h.toFixed(1)}% | Vol: $${t.volume24h.toLocaleString()} [${t.source}]`
+        `- ${sanitizeTokenName(t.name)} (${sanitizeTokenName(t.symbol)}) on ${t.chain}: $${t.priceUsd} | 24h: ${t.priceChange24h > 0 ? "+" : ""}${t.priceChange24h.toFixed(1)}% | Vol: $${t.volume24h.toLocaleString()} [${t.source}]`
       );
     }
     return lines.join("\n");
@@ -4797,7 +5444,9 @@ async function fetchNewsData(symbol) {
               const n = headlines[i];
               const ml = mlResults[i];
               const label = ml ? `${ml.sentiment.toUpperCase()} (${(ml.confidence * 100).toFixed(0)}%)` : n.sentiment.toUpperCase();
-              lines.push(`- [${label}] ${n.title} (${n.source.title}, ${n.publishedAt})`);
+              lines.push(
+                `- [${label}] ${sanitizeHeadline(n.title)} (${sanitizeTokenName(n.source.title)}, ${n.publishedAt})`
+              );
             }
             const avgScore = mlResults.reduce((s, r) => s + r.score, 0) / mlResults.length;
             const avgSentiment = avgScore > 0.2 ? "BULLISH" : avgScore < -0.2 ? "BEARISH" : "NEUTRAL";
@@ -4810,7 +5459,7 @@ ML Aggregate Sentiment: ${avgSentiment} (score: ${avgScore.toFixed(3)})`);
       }
       for (const n of headlines) {
         lines.push(
-          `- [${n.sentiment.toUpperCase()}] ${n.title} (${n.source.title}, ${n.publishedAt})`
+          `- [${n.sentiment.toUpperCase()}] ${sanitizeHeadline(n.title)} (${sanitizeTokenName(n.source.title)}, ${n.publishedAt})`
         );
       }
       return lines.join("\n");
@@ -4850,7 +5499,7 @@ async function fetchRaisesData() {
       const amount = r.amount ? r.amount >= 1e9 ? `$${(r.amount / 1e9).toFixed(1)}B` : r.amount >= 1e6 ? `$${(r.amount / 1e6).toFixed(1)}M` : r.amount >= 1e3 ? `$${(r.amount / 1e3).toFixed(0)}K` : `$${r.amount.toLocaleString()}` : "undisclosed";
       const date = new Date(r.date * 1e3).toISOString().split("T")[0];
       lines.push(
-        `- ${r.name} \u2014 ${r.round} (${amount}) on ${r.chains.join(", ") || "multi-chain"} [${date}]${r.leadInvestors.length > 0 ? ` Led by: ${r.leadInvestors.join(", ")}` : ""}`
+        `- ${sanitizeTokenName(r.name)} \u2014 ${sanitizeExternalData(r.round, 50)} (${amount}) on ${r.chains.join(", ") || "multi-chain"} [${date}]${r.leadInvestors.length > 0 ? ` Led by: ${r.leadInvestors.map((inv) => sanitizeTokenName(inv)).join(", ")}` : ""}`
       );
     }
     return lines.join("\n");
@@ -4865,7 +5514,9 @@ async function fetchPumpData() {
     const lines = ["## Latest Pump.fun Launches (Solana)"];
     for (const c of coins) {
       const mcap = c.usd_market_cap ? `$${c.usd_market_cap.toFixed(0)}` : "?";
-      lines.push(`- ${c.name} (${c.symbol}) \u2014 MC: ${mcap} | Replies: ${c.reply_count}`);
+      lines.push(
+        `- ${sanitizeTokenName(c.name)} (${sanitizeTokenName(c.symbol)}) \u2014 MC: ${mcap} | Replies: ${c.reply_count}`
+      );
     }
     return lines.join("\n");
   } catch {
@@ -5785,6 +6436,7 @@ var init_context_injector = __esm({
     init_loader();
     init_constants();
     init_client();
+    init_sanitize();
     PRICE_KEYWORDS = ["price", "worth", "cost", "value", "how much"];
     TRENDING_KEYWORDS = ["trending", "hot", "popular", "top", "best", "hype"];
     NEWS_KEYWORDS = ["news", "latest", "update", "happening", "announcement"];
@@ -6524,7 +7176,12 @@ function getCached(key) {
     getDb().prepare("DELETE FROM cache WHERE key = ?").run(key);
     return null;
   }
-  return JSON.parse(row.value);
+  try {
+    return JSON.parse(row.value);
+  } catch {
+    getDb().prepare("DELETE FROM cache WHERE key = ?").run(key);
+    return null;
+  }
 }
 function setCache(key, value, ttlSeconds) {
   const now = Math.floor(Date.now() / 1e3);
@@ -6556,12 +7213,14 @@ var init_engine = __esm({
     logger = createLogger("agent-engine");
     AgentEngine = class {
       timer = null;
+      running = false;
       state;
       strategy;
       constructor(config2) {
         this.strategy = getStrategy(config2.strategy);
+        const interval = Math.max(30, config2.interval);
         this.state = {
-          config: config2,
+          config: { ...config2, interval },
           status: "idle",
           lastCycle: null,
           cycleCount: 0,
@@ -6575,25 +7234,35 @@ var init_engine = __esm({
         if (this.state.status === "running") return;
         this.state.status = "running";
         this.state.error = null;
+        this.running = true;
         logger.info(`Agent ${this.state.config.name} started (${this.strategy.name})`);
-        void this.runCycle();
-        this.timer = setInterval(() => {
-          void this.runCycle();
-        }, this.state.config.interval * 1e3);
+        void this.scheduleNextCycle(true);
       }
       stop() {
+        this.running = false;
         if (this.timer) {
-          clearInterval(this.timer);
+          clearTimeout(this.timer);
           this.timer = null;
         }
         this.state.status = "stopped";
         logger.info(`Agent ${this.state.config.name} stopped`);
       }
+      async scheduleNextCycle(immediate = false) {
+        if (!this.running) return;
+        if (!immediate) {
+          await new Promise((resolve4) => {
+            this.timer = setTimeout(resolve4, this.state.config.interval * 1e3);
+          });
+        }
+        if (!this.running) return;
+        await this.runCycle();
+        void this.scheduleNextCycle(false);
+      }
       async runCycle() {
         for (const symbol of this.state.config.pairs) {
           try {
             const signals = await this.gatherSignals(symbol);
-            const decision = this.strategy.evaluate(signals);
+            const decision = this.strategy.evaluateAsync ? await this.strategy.evaluateAsync(signals, symbol) : this.strategy.evaluate(signals);
             const result = {
               agentId: this.state.config.id,
               symbol,
@@ -6890,6 +7559,60 @@ function evaluateWithRules(signals) {
     reasoning: [...reasoning, "Mixed signals \u2014 holding"]
   };
 }
+async function evaluateWithML(symbol, signals) {
+  const mlClient2 = getMLClient();
+  if (!mlClient2) return evaluateWithRules(signals);
+  try {
+    const regime = await detectMarketRegime(symbol, {
+      returns_1d: signals.priceChange24h ?? 0,
+      returns_7d: 0,
+      volatility_14d: signals.atr !== null && signals.price !== null && signals.price > 0 ? signals.atr / signals.price * 100 : 3,
+      volume_ratio: 1,
+      rsi: signals.rsi ?? 50,
+      bb_width: 0,
+      fear_greed: signals.fearGreed ?? 50,
+      funding_rate: signals.fundingRate ?? 0,
+      price_vs_sma200: 0
+    });
+    const strategyResult = await mlClient2.evaluateStrategy({
+      rsi: signals.rsi ?? 50,
+      macd_histogram: signals.macdHistogram ?? 0,
+      ema12: signals.ema12 ?? 0,
+      ema26: signals.ema26 ?? 0,
+      bollinger_pct_b: signals.bollingerPercentB ?? 0.5,
+      atr: signals.atr ?? 0,
+      obv: signals.obv ?? 0,
+      funding_rate: signals.fundingRate ?? 0,
+      fear_greed: signals.fearGreed ?? 50,
+      price_change_24h: signals.priceChange24h ?? 0,
+      price: signals.price ?? 0,
+      regime: regime.regime
+    });
+    if (strategyResult && strategyResult.confidence > 60) {
+      return {
+        action: strategyResult.action,
+        confidence: Math.round(strategyResult.confidence),
+        reasoning: [
+          `Regime: ${regime.regime} (${regime.confidence.toFixed(0)}% confidence)`,
+          ...strategyResult.reasoning
+        ]
+      };
+    }
+    const ruleDecision = evaluateWithRules(signals);
+    return {
+      action: ruleDecision.action,
+      confidence: Math.round(((strategyResult?.confidence ?? 0) + ruleDecision.confidence) / 2),
+      reasoning: [
+        `Regime: ${regime.regime}`,
+        ...strategyResult?.reasoning ?? [],
+        "(Low ML confidence \u2014 blending with rules)",
+        ...ruleDecision.reasoning
+      ]
+    };
+  } catch {
+    return evaluateWithRules(signals);
+  }
+}
 var mlAdaptiveStrategy;
 var init_ml_adaptive = __esm({
   "src/core/agent/strategies/ml-adaptive.ts"() {
@@ -6901,6 +7624,9 @@ var init_ml_adaptive = __esm({
       description: "ML-powered strategy using contextual bandit approach. Uses LSTM/RF predictions when available, falls back to rule-based when < 100 training samples.",
       evaluate(signals) {
         return evaluateWithRules(signals);
+      },
+      async evaluateAsync(signals, symbol) {
+        return evaluateWithML(symbol, signals);
       }
     };
   }
@@ -6948,6 +7674,10 @@ function ensureAgentTables() {
 function createAgent(name, strategy, pairs, interval = 60) {
   ensureAgentTables();
   getStrategy(strategy);
+  const existing = getAgentByName(name);
+  if (existing) {
+    throw new Error(`Agent "${name}" already exists. Delete it first or choose a different name.`);
+  }
   const id = randomUUID();
   const now = Date.now();
   getDb().prepare(
@@ -7004,24 +7734,32 @@ function deleteAgent(id) {
     engine.stop();
     engines.delete(id);
   }
-  const result = getDb().prepare("DELETE FROM agents WHERE id = ?").run(id);
   getDb().prepare("DELETE FROM agent_decisions WHERE agent_id = ?").run(id);
+  const result = getDb().prepare("DELETE FROM agents WHERE id = ?").run(id);
   return result.changes > 0;
 }
 function startAgent(id) {
   const config2 = getAgentById(id);
   if (!config2) throw new Error(`Agent not found: ${id}`);
-  let engine = engines.get(id);
-  if (!engine) {
-    engine = new AgentEngine(config2);
-    engines.set(id, engine);
+  const existing = engines.get(id);
+  if (existing) {
+    const state = existing.getState();
+    if (state.status === "running") {
+      return state;
+    }
   }
+  const engine = new AgentEngine(config2);
+  engines.set(id, engine);
   engine.start();
   return engine.getState();
 }
 function stopAgent(id) {
   const engine = engines.get(id);
-  if (!engine) throw new Error(`Agent not running: ${id}`);
+  if (!engine) {
+    const config2 = getAgentById(id);
+    if (!config2) throw new Error(`Agent not found: ${id}`);
+    return { config: config2, status: "idle", lastCycle: null, cycleCount: 0, error: null };
+  }
   engine.stop();
   return engine.getState();
 }
@@ -7052,23 +7790,43 @@ function logDecision(result) {
     JSON.stringify(result.signals),
     result.timestamp
   );
+  pruneCounter++;
+  if (pruneCounter >= 100) {
+    pruneCounter = 0;
+    pruneDecisions(result.agentId, 1e3);
+  }
+}
+function pruneDecisions(agentId, keep = 1e3) {
+  ensureAgentTables();
+  const result = getDb().prepare(
+    `DELETE FROM agent_decisions WHERE agent_id = ? AND id NOT IN (
+        SELECT id FROM agent_decisions WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?
+      )`
+  ).run(agentId, agentId, keep);
+  return result.changes;
 }
 function getRecentDecisions(agentId, limit = 20) {
   ensureAgentTables();
   const rows = getDb().prepare(`SELECT * FROM agent_decisions WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?`).all(agentId, limit);
-  return rows.map((r) => ({
-    agentId: r.agent_id,
-    symbol: r.symbol,
-    timestamp: r.created_at,
-    signals: JSON.parse(r.signals),
-    decision: {
-      action: r.action,
-      confidence: r.confidence,
-      reasoning: JSON.parse(r.reasoning)
+  return rows.map((r) => {
+    try {
+      return {
+        agentId: r.agent_id,
+        symbol: r.symbol,
+        timestamp: r.created_at,
+        signals: JSON.parse(r.signals),
+        decision: {
+          action: r.action,
+          confidence: r.confidence,
+          reasoning: JSON.parse(r.reasoning)
+        }
+      };
+    } catch {
+      return null;
     }
-  }));
+  }).filter((r) => r !== null);
 }
-var STRATEGIES, engines;
+var STRATEGIES, engines, pruneCounter;
 var init_manager = __esm({
   "src/core/agent/manager.ts"() {
     "use strict";
@@ -7083,12 +7841,13 @@ var init_manager = __esm({
       "ml-adaptive": mlAdaptiveStrategy
     };
     engines = /* @__PURE__ */ new Map();
+    pruneCounter = 0;
   }
 });
 
 // src/core/agent/wallet.ts
-import { createPublicClient as createPublicClient2, http as http2, formatEther } from "viem";
-import { mainnet as mainnet2 } from "viem/chains";
+import { createPublicClient as createPublicClient2, http as http3, formatEther } from "viem";
+import { mainnet as mainnet3 } from "viem/chains";
 async function getWalletBalance(address) {
   const balance = await client.getBalance({ address });
   return formatEther(balance);
@@ -7101,8 +7860,8 @@ var init_wallet = __esm({
   "src/core/agent/wallet.ts"() {
     "use strict";
     client = createPublicClient2({
-      chain: mainnet2,
-      transport: http2()
+      chain: mainnet3,
+      transport: http3()
     });
   }
 });
@@ -7547,8 +8306,176 @@ var init_store_factory = __esm({
   }
 });
 
+// src/core/backtest/engine.ts
+var engine_exports = {};
+__export(engine_exports, {
+  BacktestEngine: () => BacktestEngine
+});
+var log7, BacktestEngine;
+var init_engine2 = __esm({
+  "src/core/backtest/engine.ts"() {
+    "use strict";
+    init_binance();
+    init_manager();
+    init_logger();
+    log7 = createLogger("backtest");
+    BacktestEngine = class {
+      config;
+      constructor(config2) {
+        this.config = config2;
+      }
+      async run() {
+        log7.info(
+          `Backtest: ${this.config.strategy} on ${this.config.pair} (${this.config.from} \u2192 ${this.config.to})`
+        );
+        const strategy = getStrategy(this.config.strategy);
+        const klines = await fetchKlines(this.config.pair, this.config.timeframe, 1e3);
+        const fromTs = new Date(this.config.from).getTime();
+        const toTs = new Date(this.config.to).getTime();
+        const filtered = klines.filter((k) => k.openTime >= fromTs && k.openTime <= toTs);
+        if (filtered.length === 0) {
+          return this.emptyResult();
+        }
+        const trades = [];
+        const equityCurve = [];
+        const drawdownCurve = [];
+        let cash = this.config.initialCapital;
+        let position = null;
+        let peak = cash;
+        for (const candle of filtered) {
+          const price = candle.close;
+          const equity = position ? cash + position.size * price : cash;
+          if (equity > peak) peak = equity;
+          const drawdown = peak > 0 ? (peak - equity) / peak * 100 : 0;
+          equityCurve.push({ time: candle.openTime, equity });
+          drawdownCurve.push({ time: candle.openTime, drawdown });
+          const signals = {
+            rsi: null,
+            macdHistogram: null,
+            ema12: null,
+            ema26: null,
+            bollingerPercentB: null,
+            atr: null,
+            obv: null,
+            fundingRate: null,
+            fearGreed: null,
+            priceChange24h: null,
+            price
+          };
+          const decision = strategy.evaluate(signals);
+          if (decision.action === "buy" && !position && cash > 0) {
+            const size = cash * 0.95 / price;
+            const commission = cash * 0.95 * (this.config.commissionPct / 100);
+            cash -= size * price + commission;
+            position = { side: "long", entryPrice: price, entryTime: candle.openTime, size };
+          } else if (decision.action === "sell" && position) {
+            const exitValue = position.size * price;
+            const commission = exitValue * (this.config.commissionPct / 100);
+            const pnl = exitValue - position.size * position.entryPrice - commission;
+            const pnlPct = pnl / (position.size * position.entryPrice) * 100;
+            trades.push({
+              entryTime: position.entryTime,
+              exitTime: candle.openTime,
+              side: position.side,
+              entryPrice: position.entryPrice,
+              exitPrice: price,
+              size: position.size,
+              pnl,
+              pnlPct,
+              reason: decision.reasoning.join("; ")
+            });
+            cash += exitValue - commission;
+            position = null;
+          }
+        }
+        if (position && filtered.length > 0) {
+          const lastPrice = filtered[filtered.length - 1].close;
+          const exitValue = position.size * lastPrice;
+          const pnl = exitValue - position.size * position.entryPrice;
+          trades.push({
+            entryTime: position.entryTime,
+            exitTime: filtered[filtered.length - 1].openTime,
+            side: position.side,
+            entryPrice: position.entryPrice,
+            exitPrice: lastPrice,
+            size: position.size,
+            pnl,
+            pnlPct: pnl / (position.size * position.entryPrice) * 100,
+            reason: "End of backtest period"
+          });
+          cash += exitValue;
+        }
+        const metrics = this.calculateMetrics(trades, cash);
+        return {
+          config: this.config,
+          trades,
+          metrics,
+          equityCurve,
+          drawdownCurve
+        };
+      }
+      calculateMetrics(trades, finalCash) {
+        const wins = trades.filter((t) => t.pnl > 0);
+        const losses = trades.filter((t) => t.pnl <= 0);
+        const totalReturn = finalCash - this.config.initialCapital;
+        const totalReturnPct = totalReturn / this.config.initialCapital * 100;
+        const winRate = trades.length > 0 ? wins.length / trades.length : 0;
+        const grossProfit = wins.reduce((sum, t) => sum + t.pnl, 0);
+        const grossLoss = Math.abs(losses.reduce((sum, t) => sum + t.pnl, 0));
+        const profitFactor = grossLoss > 0 ? grossProfit / grossLoss : grossProfit > 0 ? Infinity : 0;
+        const returns = trades.map((t) => t.pnlPct / 100);
+        const avgReturn = returns.length > 0 ? returns.reduce((a, b) => a + b, 0) / returns.length : 0;
+        const variance = returns.length > 1 ? returns.reduce((s, r) => s + (r - avgReturn) ** 2, 0) / (returns.length - 1) : 0;
+        const sharpeRatio = Math.sqrt(variance) > 0 ? avgReturn / Math.sqrt(variance) * Math.sqrt(365) : 0;
+        let maxDrawdown = 0;
+        let peak = this.config.initialCapital;
+        let running = this.config.initialCapital;
+        for (const t of trades) {
+          running += t.pnl;
+          if (running > peak) peak = running;
+          const dd = peak > 0 ? (peak - running) / peak * 100 : 0;
+          if (dd > maxDrawdown) maxDrawdown = dd;
+        }
+        const avgHoldingPeriodMs = trades.length > 0 ? trades.reduce((sum, t) => sum + (t.exitTime - t.entryTime), 0) / trades.length : 0;
+        return {
+          totalReturn,
+          totalReturnPct,
+          winRate,
+          totalTrades: trades.length,
+          profitFactor,
+          sharpeRatio,
+          maxDrawdown,
+          avgHoldingPeriodMs
+        };
+      }
+      emptyResult() {
+        return {
+          config: this.config,
+          trades: [],
+          metrics: {
+            totalReturn: 0,
+            totalReturnPct: 0,
+            winRate: 0,
+            totalTrades: 0,
+            profitFactor: 0,
+            sharpeRatio: 0,
+            maxDrawdown: 0,
+            avgHoldingPeriodMs: 0
+          },
+          equityCurve: [],
+          drawdownCurve: []
+        };
+      }
+    };
+  }
+});
+
 // src/ai/tool-handler.ts
 async function handleTool(name, input) {
+  const raw = await handleToolUnsafe(name, input);
+  return sanitizeToolResult(raw);
+}
+async function handleToolUnsafe(name, input) {
   const params = input;
   switch (name) {
     case "get_token_info": {
@@ -8220,6 +9147,92 @@ async function handleTool(name, input) {
         }))
       };
     }
+    case "get_ml_model_health": {
+      let mlClient2 = getMLClient();
+      if (!mlClient2) {
+        try {
+          const cfg = getConfig();
+          if (cfg.ml?.enabled && cfg.ml.sidecarUrl) {
+            mlClient2 = initMLClient(cfg.ml.sidecarUrl);
+          }
+        } catch {
+        }
+      }
+      if (!mlClient2) {
+        return { error: "ML sidecar not configured" };
+      }
+      const health = await mlClient2.getModelHealth();
+      if (!health) {
+        return { error: "ML sidecar not responding" };
+      }
+      return {
+        models: health.models.map((m) => ({
+          name: m.name,
+          version: m.version,
+          loaded: m.loaded,
+          lastTrained: m.lastTrained,
+          accuracy: m.accuracy
+        })),
+        uptime: health.uptime,
+        predictionsServed: health.predictionsServed
+      };
+    }
+    case "classify_user_intent": {
+      const text = String(params["text"] ?? "");
+      let mlClient2 = getMLClient();
+      if (!mlClient2) {
+        try {
+          const cfg = getConfig();
+          if (cfg.ml?.enabled && cfg.ml.sidecarUrl) {
+            mlClient2 = initMLClient(cfg.ml.sidecarUrl);
+          }
+        } catch {
+        }
+      }
+      if (!mlClient2) {
+        return { error: "ML sidecar not configured for intent classification" };
+      }
+      const intent = await mlClient2.classifyIntent(text);
+      if (!intent) {
+        return { error: "Intent classification failed" };
+      }
+      return {
+        intent: intent.intent,
+        confidence: intent.confidence,
+        secondaryIntent: intent.secondary_intent,
+        detectedTokens: intent.detected_tokens,
+        detectedAddresses: intent.detected_addresses,
+        model: intent.model
+      };
+    }
+    case "run_backtest": {
+      const { BacktestEngine: BacktestEngine2 } = await Promise.resolve().then(() => (init_engine2(), engine_exports));
+      const engine = new BacktestEngine2({
+        strategy: String(params["strategy"] ?? "momentum"),
+        pair: String(params["pair"] ?? "BTCUSDT"),
+        from: String(params["from"] ?? ""),
+        to: String(params["to"] ?? ""),
+        initialCapital: 1e4,
+        timeframe: String(params["timeframe"] ?? "4h"),
+        slippageBps: 10,
+        commissionPct: 0.1
+      });
+      const result = await engine.run();
+      return {
+        strategy: result.config.strategy,
+        pair: result.config.pair,
+        period: `${result.config.from} \u2192 ${result.config.to}`,
+        metrics: result.metrics,
+        tradeCount: result.trades.length,
+        lastTrades: result.trades.slice(-5).map((t) => ({
+          entry: t.entryPrice,
+          exit: t.exitPrice,
+          pnl: t.pnl,
+          pnlPct: t.pnlPct,
+          side: t.side
+        }))
+      };
+    }
     default:
       return { error: `Unknown tool: ${name}` };
   }
@@ -8248,6 +9261,7 @@ var init_tool_handler = __esm({
     init_client();
     init_feature_engineer();
     init_store_factory();
+    init_sanitize();
   }
 });
 
@@ -8651,6 +9665,59 @@ var init_tools = __esm({
           required: ["agentName"]
         }
       },
+      {
+        name: "get_ml_model_health",
+        description: "Get health status of all ML models in the sidecar including loaded status, version, last training date, accuracy, uptime, and total predictions served.",
+        input_schema: {
+          type: "object",
+          properties: {},
+          required: []
+        }
+      },
+      {
+        name: "classify_user_intent",
+        description: "Classify a user message into an intent category (e.g. price_check, token_analysis, prediction, news, portfolio, agent_management) using ML NLP. Returns intent, confidence, detected tokens, and detected addresses.",
+        input_schema: {
+          type: "object",
+          properties: {
+            text: {
+              type: "string",
+              description: "The user message text to classify."
+            }
+          },
+          required: ["text"]
+        }
+      },
+      {
+        name: "run_backtest",
+        description: "Run a historical backtest for a trading strategy. Simulates strategy execution on historical kline data and returns trades, metrics (return, win rate, Sharpe, drawdown), and equity curve.",
+        input_schema: {
+          type: "object",
+          properties: {
+            strategy: {
+              type: "string",
+              description: 'Strategy name: "momentum", "trend-following", or "ml-adaptive".'
+            },
+            pair: {
+              type: "string",
+              description: 'Trading pair (e.g. "BTCUSDT").'
+            },
+            from: {
+              type: "string",
+              description: "Start date (YYYY-MM-DD)."
+            },
+            to: {
+              type: "string",
+              description: "End date (YYYY-MM-DD)."
+            },
+            timeframe: {
+              type: "string",
+              description: 'Candle timeframe: "1h", "4h", "1d". Defaults to "4h".'
+            }
+          },
+          required: ["strategy", "pair", "from", "to"]
+        }
+      },
       {
         name: "create_agent",
         description: "Create an autonomous trading agent that monitors crypto pairs using a strategy (momentum or trend-following). Returns the created agent config.",
@@ -9288,13 +10355,16 @@ async function startDiscordBot() {
   client2.on("messageCreate", async (message) => {
     if (message.author.bot) return;
     if (!client2.user || !message.mentions.has(client2.user)) return;
-    const text = message.content.replace(/<@!?\d+>/g, "").trim();
+    let text = message.content.replace(/<@!?\d+>/g, "").trim();
     if (!text) {
       await message.reply(
         "Mention me with a question! e.g. `@Vizzor what is BTC price?`\nOr use slash commands: `/scan` `/trends` `/track` `/ico` `/audit` `/help`"
       );
       return;
     }
+    if (text.length > 2e3) {
+      text = text.slice(0, 2e3);
+    }
     await message.reply("\u{1F52E} Analyzing...");
     try {
       const response = await analyze(buildChatSystemPrompt(), text, VIZZOR_TOOLS);
@@ -9964,8 +11034,11 @@ async function startTelegramBot() {
   bot.use(rateLimitMiddleware);
   registerCommands(bot);
   bot.on("message:text", async (ctx) => {
-    const text = ctx.message.text;
+    let text = ctx.message.text;
     if (text.startsWith("/")) return;
+    if (text.length > 4e3) {
+      text = text.slice(0, 4e3);
+    }
     await ctx.reply("\u{1F52E} Analyzing...");
     try {
       const response = await analyze(buildChatSystemPrompt(), text, VIZZOR_TOOLS);
@@ -10095,13 +11168,13 @@ var init_bot3 = __esm({
 });
 
 // src/data/collector.ts
-var log2, MAJOR_SYMBOLS, TIMEFRAMES, COLLECTION_INTERVAL_MS, DataCollector;
+var log8, MAJOR_SYMBOLS, TIMEFRAMES, COLLECTION_INTERVAL_MS, DataCollector;
 var init_collector = __esm({
   "src/data/collector.ts"() {
     "use strict";
     init_binance();
     init_logger();
-    log2 = createLogger("collector");
+    log8 = createLogger("collector");
     MAJOR_SYMBOLS = [
       "BTC",
       "ETH",
@@ -10152,10 +11225,10 @@ var init_collector = __esm({
       }
       start() {
         if (this.status.running) {
-          log2.warn("Collector already running");
+          log8.warn("Collector already running");
           return;
         }
-        log2.info(
+        log8.info(
           `Starting data collector: ${this.symbols.length} symbols, ${TIMEFRAMES.length} timeframes, every ${this.intervalMs / 1e3}s`
         );
         this.status.running = true;
@@ -10168,10 +11241,10 @@ var init_collector = __esm({
           this.timer = null;
         }
         this.status.running = false;
-        log2.info("Data collector stopped");
+        log8.info("Data collector stopped");
       }
       async collectAll() {
-        log2.info("Collection cycle starting");
+        log8.info("Collection cycle starting");
         const start = Date.now();
         for (const timeframe of TIMEFRAMES) {
           for (const symbol of this.symbols) {
@@ -10179,7 +11252,7 @@ var init_collector = __esm({
               await this.collectSymbol(symbol, timeframe);
             } catch (err) {
               this.status.errors++;
-              log2.error(
+              log8.error(
                 `Failed to collect ${symbol}/${timeframe}: ${err instanceof Error ? err.message : String(err)}`
               );
             }
@@ -10187,7 +11260,7 @@ var init_collector = __esm({
         }
         this.status.lastRun = Date.now();
         const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-        log2.info(
+        log8.info(
           `Collection cycle complete in ${elapsed}s (total records: ${this.status.totalRecords})`
         );
       }
@@ -10296,42 +11369,171 @@ async function registerMarketRoutes(server) {
       return handleTool("get_trending", {});
     }
   });
-  server.get("/fear-greed", {
+  server.get("/fear-greed", {
+    schema: {
+      tags: ["Market"],
+      summary: "Get Crypto Fear & Greed Index with history"
+    },
+    handler: async () => {
+      return handleTool("get_fear_greed", {});
+    }
+  });
+  server.get("/news", {
+    schema: {
+      tags: ["Market"],
+      summary: "Get latest crypto news with sentiment",
+      querystring: {
+        type: "object",
+        properties: { symbol: { type: "string" } }
+      }
+    },
+    handler: async (request) => {
+      try {
+        const { symbol } = request.query;
+        return await handleTool("get_crypto_news", { symbol });
+      } catch {
+        return { news: [] };
+      }
+    }
+  });
+  server.get("/prediction", {
+    schema: {
+      tags: ["Market"],
+      summary: "Get AI prediction for a symbol",
+      querystring: {
+        type: "object",
+        properties: { symbol: { type: "string" } },
+        required: ["symbol"]
+      }
+    },
+    handler: async (request) => {
+      const { symbol } = request.query;
+      return handleTool("get_prediction", { symbol });
+    }
+  });
+  server.get("/dex/search", {
+    schema: {
+      tags: ["Market"],
+      summary: "Search tokens on decentralized exchanges",
+      querystring: {
+        type: "object",
+        properties: { q: { type: "string" } },
+        required: ["q"]
+      }
+    },
+    handler: async (request) => {
+      const { q } = request.query;
+      return handleTool("search_token_dex", { query: q });
+    }
+  });
+  server.get("/ml-health", {
+    schema: {
+      tags: ["Market"],
+      summary: "Get ML sidecar health and model status"
+    },
+    handler: async () => {
+      let mlClient2 = getMLClient();
+      if (!mlClient2) {
+        const cfg = loadConfig();
+        if (cfg.ml?.enabled && cfg.ml.sidecarUrl) {
+          mlClient2 = initMLClient(cfg.ml.sidecarUrl);
+        }
+      }
+      if (!mlClient2) {
+        return { available: false, models: [], uptime: 0, predictionsServed: 0 };
+      }
+      const health = await mlClient2.getModelHealth();
+      if (!health) {
+        return { available: false, models: [], uptime: 0, predictionsServed: 0 };
+      }
+      return { available: true, ...health };
+    }
+  });
+  server.post("/ml/sentiment", {
     schema: {
       tags: ["Market"],
-      summary: "Get Crypto Fear & Greed Index with history"
+      summary: "Analyze text sentiment via ML",
+      body: {
+        type: "object",
+        properties: { text: { type: "string" } },
+        required: ["text"]
+      }
     },
-    handler: async () => {
-      return handleTool("get_fear_greed", {});
+    handler: async (request) => {
+      const { text } = request.body;
+      let mlClient2 = getMLClient();
+      if (!mlClient2) {
+        const cfg = loadConfig();
+        if (cfg.ml?.enabled && cfg.ml.sidecarUrl) {
+          mlClient2 = initMLClient(cfg.ml.sidecarUrl);
+        }
+      }
+      if (!mlClient2) return { error: "ML sidecar unavailable" };
+      const result = await mlClient2.analyzeSentiment(text);
+      return result ?? { error: "Sentiment analysis failed" };
     }
   });
-  server.get("/news", {
+  server.post("/ml/regime", {
     schema: {
       tags: ["Market"],
-      summary: "Get latest crypto news with sentiment",
-      querystring: {
+      summary: "Detect market regime via ML",
+      body: {
         type: "object",
-        properties: { symbol: { type: "string" } }
+        properties: {
+          returns_1d: { type: "number" },
+          returns_7d: { type: "number" },
+          volatility_14d: { type: "number" },
+          volume_ratio: { type: "number" },
+          rsi: { type: "number" },
+          bb_width: { type: "number" },
+          fear_greed: { type: "number" },
+          funding_rate: { type: "number" },
+          price_vs_sma200: { type: "number" }
+        }
       }
     },
     handler: async (request) => {
-      const { symbol } = request.query;
-      return handleTool("get_crypto_news", { symbol });
+      const features = request.body;
+      let mlClient2 = getMLClient();
+      if (!mlClient2) {
+        const cfg = loadConfig();
+        if (cfg.ml?.enabled && cfg.ml.sidecarUrl) {
+          mlClient2 = initMLClient(cfg.ml.sidecarUrl);
+        }
+      }
+      if (!mlClient2) return { error: "ML sidecar unavailable" };
+      const result = await mlClient2.detectRegime(features);
+      return result ?? { error: "Regime detection failed" };
     }
   });
-  server.get("/dex/search", {
+  server.post("/ml/trend", {
     schema: {
       tags: ["Market"],
-      summary: "Search tokens on decentralized exchanges",
-      querystring: {
+      summary: "Score trend via ML",
+      body: {
         type: "object",
-        properties: { q: { type: "string" } },
-        required: ["q"]
+        properties: {
+          price_change_24h: { type: "number" },
+          price_change_7d: { type: "number" },
+          volume_24h: { type: "number" },
+          market_cap: { type: "number" },
+          volume_to_mcap_ratio: { type: "number" },
+          rank: { type: "number" }
+        }
       }
     },
     handler: async (request) => {
-      const { q } = request.query;
-      return handleTool("search_token_dex", { query: q });
+      const features = request.body;
+      let mlClient2 = getMLClient();
+      if (!mlClient2) {
+        const cfg = loadConfig();
+        if (cfg.ml?.enabled && cfg.ml.sidecarUrl) {
+          mlClient2 = initMLClient(cfg.ml.sidecarUrl);
+        }
+      }
+      if (!mlClient2) return { error: "ML sidecar unavailable" };
+      const result = await mlClient2.scoreTrend(features);
+      return result ?? { error: "Trend scoring failed" };
     }
   });
   server.get("/derivatives/:symbol", {
@@ -10350,6 +11552,8 @@ var init_market3 = __esm({
   "src/api/routes/v1/market.ts"() {
     "use strict";
     init_tool_handler();
+    init_client();
+    init_loader();
   }
 });
 
@@ -10482,6 +11686,134 @@ var init_security = __esm({
   }
 });
 
+// src/api/routes/v1/backtest.ts
+async function backtestRoutes(fastify) {
+  fastify.post("/v1/backtest", async (request, reply) => {
+    const body = request.body;
+    const config2 = {
+      strategy: String(body["strategy"] ?? "momentum"),
+      pair: String(body["pair"] ?? "BTCUSDT"),
+      from: String(body["from"] ?? ""),
+      to: String(body["to"] ?? ""),
+      initialCapital: Number(body["initialCapital"] ?? 1e4),
+      timeframe: String(body["timeframe"] ?? "4h"),
+      slippageBps: Number(body["slippageBps"] ?? 10),
+      commissionPct: Number(body["commissionPct"] ?? 0.1)
+    };
+    if (!config2.from || !config2.to) {
+      return reply.status(400).send({ error: "from and to dates are required" });
+    }
+    const engine = new BacktestEngine(config2);
+    const result = await engine.run();
+    return result;
+  });
+}
+var init_backtest = __esm({
+  "src/api/routes/v1/backtest.ts"() {
+    "use strict";
+    init_engine2();
+  }
+});
+
+// src/api/routes/v1/agents.ts
+async function agentRoutes(fastify) {
+  fastify.get("/v1/agents", async () => {
+    const agents = listAgents();
+    return {
+      agents: agents.map((a) => {
+        const status = getAgentStatus(a.id);
+        return {
+          name: a.name,
+          strategy: a.strategy,
+          pairs: a.pairs,
+          interval: a.interval,
+          status: status?.status ?? "idle",
+          cycleCount: status?.cycleCount ?? 0
+        };
+      })
+    };
+  });
+  fastify.post("/v1/agents", async (request) => {
+    const body = request.body;
+    const name = String(body["name"] ?? "");
+    const strategy = String(body["strategy"] ?? "momentum");
+    const pairs = body["pairs"] ?? ["BTC", "ETH"];
+    const interval = Number(body["interval"] ?? 60);
+    const agent = createAgent(name, strategy, pairs, interval);
+    return { id: agent.id, name: agent.name, strategy: agent.strategy, pairs: agent.pairs };
+  });
+  fastify.get("/v1/agents/:name", async (request) => {
+    const { name } = request.params;
+    const agent = getAgentByName(name);
+    if (!agent) return { error: "Agent not found" };
+    const status = getAgentStatus(agent.id);
+    return {
+      name: agent.name,
+      strategy: agent.strategy,
+      pairs: agent.pairs,
+      status: status?.status ?? "idle",
+      cycleCount: status?.cycleCount ?? 0
+    };
+  });
+  fastify.post("/v1/agents/:name/start", async (request) => {
+    const { name } = request.params;
+    const agent = getAgentByName(name);
+    if (!agent) return { error: "Agent not found" };
+    startAgent(agent.id);
+    return { message: `Agent "${name}" started` };
+  });
+  fastify.post("/v1/agents/:name/stop", async (request) => {
+    const { name } = request.params;
+    const agent = getAgentByName(name);
+    if (!agent) return { error: "Agent not found" };
+    stopAgent(agent.id);
+    return { message: `Agent "${name}" stopped` };
+  });
+  fastify.delete("/v1/agents/:name", async (request) => {
+    const { name } = request.params;
+    const agent = getAgentByName(name);
+    if (!agent) return { error: "Agent not found" };
+    deleteAgent(agent.id);
+    return { message: `Agent "${name}" deleted` };
+  });
+}
+var init_agents = __esm({
+  "src/api/routes/v1/agents.ts"() {
+    "use strict";
+    init_agent();
+  }
+});
+
+// src/api/routes/v1/portfolio.ts
+async function portfolioRoutes(fastify) {
+  fastify.get("/v1/portfolio/:agentId", async (request) => {
+    const { agentId } = request.params;
+    return {
+      agentId,
+      totalValue: 1e4,
+      cash: 1e4,
+      positions: [],
+      totalReturn: 0,
+      totalReturnPct: 0,
+      winRate: 0,
+      sharpeRatio: 0,
+      maxDrawdown: 0
+    };
+  });
+  fastify.get("/v1/portfolio/:agentId/trades", async (request) => {
+    const { agentId } = request.params;
+    return {
+      agentId,
+      trades: []
+    };
+  });
+}
+var init_portfolio = __esm({
+  "src/api/routes/v1/portfolio.ts"() {
+    "use strict";
+  }
+});
+
 // src/api/auth/keys.ts
 import { randomBytes, scryptSync } from "crypto";
 function hashApiKey(key) {
@@ -10543,19 +11875,26 @@ var init_keys2 = __esm({
 });
 
 // src/api/auth/middleware.ts
+import { timingSafeEqual } from "crypto";
 async function authMiddleware(request, reply) {
-  if (PUBLIC_PATHS.some((p) => request.url === p) || request.url.startsWith("/docs/")) {
+  if (PUBLIC_PATHS.some((p) => request.url === p)) {
+    return;
+  }
+  if (request.url === "/docs" || request.url.startsWith("/docs/")) {
+    if (process.env["NODE_ENV"] === "production") {
+      return reply.status(404).send({ error: "Not found" });
+    }
     return;
   }
   const apiKey = request.headers["x-api-key"];
-  if (!apiKey) {
+  if (!apiKey || apiKey.length > 256) {
     return reply.status(401).send({
       error: "Unauthorized",
-      message: "Missing X-API-Key header"
+      message: "Missing or invalid X-API-Key header"
     });
   }
   const keyHash = hashApiKey(apiKey);
-  const valid = await validateKey2(keyHash);
+  const valid = validateKey2(keyHash);
   if (!valid) {
     return reply.status(403).send({
       error: "Forbidden",
@@ -10563,20 +11902,43 @@ async function authMiddleware(request, reply) {
     });
   }
 }
-async function validateKey2(keyHash) {
-  const store = getStoreInstance();
-  if (!store) return false;
-  const cached = await store.getCached(`apikey:${keyHash}`);
-  if (cached !== null) return cached.valid;
-  return true;
+function validateKey2(keyHash) {
+  try {
+    const db2 = getDb();
+    db2.exec(`
+      CREATE TABLE IF NOT EXISTS api_keys (
+        id TEXT PRIMARY KEY,
+        label TEXT NOT NULL,
+        key_hash TEXT NOT NULL UNIQUE,
+        key_prefix TEXT NOT NULL,
+        rate_limit INTEGER NOT NULL DEFAULT 100,
+        created_at INTEGER NOT NULL,
+        revoked_at INTEGER
+      )
+    `);
+    const row = db2.prepare("SELECT key_hash FROM api_keys WHERE revoked_at IS NULL").all();
+    if (row.length === 0) {
+      return false;
+    }
+    const inputBuf = Buffer.from(keyHash, "hex");
+    for (const r of row) {
+      const storedBuf = Buffer.from(r.key_hash, "hex");
+      if (inputBuf.length === storedBuf.length && timingSafeEqual(inputBuf, storedBuf)) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
 }
 var PUBLIC_PATHS;
 var init_middleware = __esm({
   "src/api/auth/middleware.ts"() {
     "use strict";
     init_keys2();
-    init_store_factory();
-    PUBLIC_PATHS = ["/health", "/docs", "/docs/"];
+    init_cache();
+    PUBLIC_PATHS = ["/health"];
   }
 });
 
@@ -10613,7 +11975,11 @@ import swagger from "@fastify/swagger";
 import swaggerUi from "@fastify/swagger-ui";
 async function startApiServer(options) {
   const server = Fastify({ logger: false });
-  await server.register(cors, { origin: true });
+  const isProd = process.env["NODE_ENV"] === "production";
+  const origin = options.corsOrigin ?? "http://localhost:3000";
+  await server.register(cors, {
+    origin: isProd ? origin : true
+  });
   await server.register(rateLimit, {
     max: 100,
     timeWindow: "1 minute"
@@ -10623,7 +11989,7 @@ async function startApiServer(options) {
       info: {
         title: "Vizzor API",
         description: "AI-powered crypto intelligence REST API",
-        version: "0.7.0"
+        version: "0.11.0"
       },
       servers: [{ url: `http://${options.host}:${options.port}` }],
       components: {
@@ -10637,27 +12003,41 @@ async function startApiServer(options) {
       }
     }
   });
-  await server.register(swaggerUi, {
-    routePrefix: "/docs"
-  });
-  if (options.enableAuth) {
+  if (!isProd) {
+    await server.register(swaggerUi, {
+      routePrefix: "/docs"
+    });
+  }
+  if (options.enableAuth !== false) {
     server.addHook("onRequest", authMiddleware);
+  } else if (isProd) {
+    log9.warn("API authentication is DISABLED in production \u2014 this is insecure");
   }
   server.setErrorHandler(errorHandler);
-  server.get("/health", async () => ({
-    status: "ok",
-    version: "0.7.0",
-    uptime: process.uptime(),
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  }));
+  server.get("/health", async () => {
+    if (isProd) {
+      return { status: "ok" };
+    }
+    return {
+      status: "ok",
+      version: "0.11.0",
+      uptime: process.uptime(),
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  });
   await server.register(registerMarketRoutes, { prefix: "/v1/market" });
   await server.register(registerAnalysisRoutes, { prefix: "/v1/analysis" });
   await server.register(registerSecurityRoutes, { prefix: "/v1/security" });
+  await server.register(backtestRoutes);
+  await server.register(agentRoutes);
+  await server.register(portfolioRoutes);
   await server.listen({ port: options.port, host: options.host });
-  log3.info(`Vizzor API listening on ${options.host}:${options.port}`);
-  log3.info(`OpenAPI docs at http://${options.host}:${options.port}/docs`);
+  log9.info(`Vizzor API listening on ${options.host}:${options.port}`);
+  if (!isProd) {
+    log9.info(`OpenAPI docs at http://${options.host}:${options.port}/docs`);
+  }
 }
-var log3;
+var log9;
 var init_server = __esm({
   "src/api/server.ts"() {
     "use strict";
@@ -10665,9 +12045,12 @@ var init_server = __esm({
     init_market3();
     init_analysis();
     init_security();
+    init_backtest();
+    init_agents();
+    init_portfolio();
     init_middleware();
     init_error_handler();
-    log3 = createLogger("api");
+    log9 = createLogger("api");
   }
 });
 
@@ -10749,6 +12132,480 @@ var init_api = __esm({
   }
 });
 
+// src/cli/commands/backtest.ts
+var backtest_exports = {};
+__export(backtest_exports, {
+  registerBacktestCommand: () => registerBacktestCommand
+});
+function registerBacktestCommand(program2) {
+  program2.command("backtest").description("Run a historical backtest for a trading strategy").requiredOption(
+    "-s, --strategy <strategy>",
+    "Strategy name (momentum, trend-following, ml-adaptive)"
+  ).requiredOption("--pair <pair>", "Trading pair (e.g. BTCUSDT)").requiredOption("--from <date>", "Start date (YYYY-MM-DD)").requiredOption("--to <date>", "End date (YYYY-MM-DD)").option("-c, --capital <amount>", "Initial capital in USD", "10000").option("-t, --timeframe <tf>", "Candle timeframe", "4h").option("--slippage <bps>", "Slippage in basis points", "10").option("--commission <pct>", "Commission percentage", "0.1").action(async (opts) => {
+    try {
+      const engine = new BacktestEngine({
+        strategy: opts.strategy,
+        pair: opts.pair,
+        from: opts.from,
+        to: opts.to,
+        initialCapital: Number(opts.capital),
+        timeframe: opts.timeframe,
+        slippageBps: Number(opts.slippage),
+        commissionPct: Number(opts.commission)
+      });
+      console.log(
+        `Running backtest: ${opts.strategy} on ${opts.pair} (${opts.from} \u2192 ${opts.to})...
+`
+      );
+      const result = await engine.run();
+      console.log("=== Backtest Results ===");
+      console.log(`Strategy: ${result.config.strategy}`);
+      console.log(`Pair: ${result.config.pair}`);
+      console.log(`Period: ${result.config.from} \u2192 ${result.config.to}`);
+      console.log(`Initial Capital: $${result.config.initialCapital.toLocaleString()}`);
+      console.log("");
+      console.log(
+        `Total Return: $${result.metrics.totalReturn.toFixed(2)} (${result.metrics.totalReturnPct.toFixed(2)}%)`
+      );
+      console.log(`Win Rate: ${(result.metrics.winRate * 100).toFixed(1)}%`);
+      console.log(`Total Trades: ${result.metrics.totalTrades}`);
+      console.log(
+        `Profit Factor: ${result.metrics.profitFactor === Infinity ? "\u221E" : result.metrics.profitFactor.toFixed(2)}`
+      );
+      console.log(`Sharpe Ratio: ${result.metrics.sharpeRatio.toFixed(2)}`);
+      console.log(`Max Drawdown: ${result.metrics.maxDrawdown.toFixed(2)}%`);
+      if (result.trades.length > 0) {
+        console.log("\nLast 5 Trades:");
+        for (const t of result.trades.slice(-5)) {
+          const dir = t.pnl >= 0 ? "+" : "";
+          console.log(
+            `  ${new Date(t.entryTime).toISOString().split("T")[0]} \u2192 ${new Date(t.exitTime).toISOString().split("T")[0]} | ${t.side} | Entry: $${t.entryPrice.toFixed(2)} \u2192 Exit: $${t.exitPrice.toFixed(2)} | PnL: ${dir}$${t.pnl.toFixed(2)} (${dir}${t.pnlPct.toFixed(2)}%)`
+          );
+        }
+      }
+    } catch (err) {
+      log10.error(`Backtest failed: ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+    }
+  });
+}
+var log10;
+var init_backtest2 = __esm({
+  "src/cli/commands/backtest.ts"() {
+    "use strict";
+    init_engine2();
+    init_logger();
+    log10 = createLogger("cli-backtest");
+  }
+});
+
+// src/core/agent/wallet-manager.ts
+import { randomBytes as randomBytes2, scryptSync as scryptSync2, createCipheriv, createDecipheriv } from "crypto";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3,
+  unlinkSync,
+  readdirSync
+} from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+function ensureDir() {
+  if (!existsSync3(WALLETS_DIR)) {
+    mkdirSync2(WALLETS_DIR, { recursive: true });
+  }
+}
+function deriveKey(password, salt) {
+  return scryptSync2(password, salt, KEY_LENGTH, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+}
+function encrypt(plaintext, password) {
+  const salt = randomBytes2(32);
+  const key = deriveKey(password, salt);
+  const iv = randomBytes2(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    salt: salt.toString("hex"),
+    iv: iv.toString("hex"),
+    tag: tag.toString("hex"),
+    ciphertext: encrypted.toString("hex")
+  };
+}
+function createWallet(name, password) {
+  ensureDir();
+  const filePath = join3(WALLETS_DIR, `${name}.json`);
+  if (existsSync3(filePath)) {
+    throw new Error(`Wallet "${name}" already exists`);
+  }
+  const privateKey = `0x${randomBytes2(32).toString("hex")}`;
+  const { salt, iv, tag, ciphertext } = encrypt(privateKey, password);
+  const wallet = {
+    name,
+    address: "(derived on load)",
+    salt,
+    iv,
+    tag,
+    ciphertext,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync3(filePath, JSON.stringify(wallet, null, 2));
+  log11.info(`Wallet "${name}" created at ${filePath}`);
+  return { name, address: wallet.address };
+}
+function importWallet(name, privateKey, password) {
+  ensureDir();
+  const filePath = join3(WALLETS_DIR, `${name}.json`);
+  if (existsSync3(filePath)) {
+    throw new Error(`Wallet "${name}" already exists`);
+  }
+  const pk = privateKey.startsWith("0x") ? privateKey : `0x${privateKey}`;
+  const { salt, iv, tag, ciphertext } = encrypt(pk, password);
+  const wallet = {
+    name,
+    address: "(derived on load)",
+    salt,
+    iv,
+    tag,
+    ciphertext,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync3(filePath, JSON.stringify(wallet, null, 2));
+  log11.info(`Wallet "${name}" imported`);
+  return { name, address: wallet.address };
+}
+function listWallets() {
+  ensureDir();
+  const files = readdirSync(WALLETS_DIR).filter((f) => f.endsWith(".json"));
+  return files.map((f) => {
+    const wallet = JSON.parse(readFileSync3(join3(WALLETS_DIR, f), "utf8"));
+    return { name: wallet.name, address: wallet.address, createdAt: wallet.createdAt };
+  });
+}
+function deleteWallet(name) {
+  const filePath = join3(WALLETS_DIR, `${name}.json`);
+  if (!existsSync3(filePath)) {
+    throw new Error(`Wallet "${name}" not found`);
+  }
+  unlinkSync(filePath);
+  log11.info(`Wallet "${name}" deleted`);
+}
+var log11, WALLETS_DIR, SCRYPT_N, SCRYPT_R, SCRYPT_P, KEY_LENGTH, IV_LENGTH;
+var init_wallet_manager = __esm({
+  "src/core/agent/wallet-manager.ts"() {
+    "use strict";
+    init_logger();
+    log11 = createLogger("wallet-manager");
+    WALLETS_DIR = join3(homedir2(), ".vizzor", "wallets");
+    SCRYPT_N = 2 ** 14;
+    SCRYPT_R = 8;
+    SCRYPT_P = 1;
+    KEY_LENGTH = 32;
+    IV_LENGTH = 12;
+  }
+});
+
+// src/cli/commands/wallet.ts
+var wallet_exports = {};
+__export(wallet_exports, {
+  registerWalletCommand: () => registerWalletCommand
+});
+function registerWalletCommand(program2) {
+  const wallet = program2.command("wallet").description("Manage encrypted trading wallets");
+  wallet.command("create <name>").description("Create a new wallet with a random private key").requiredOption("-p, --password <password>", "Encryption password").action((name, opts) => {
+    try {
+      const result = createWallet(name, opts.password);
+      console.log(`Wallet "${result.name}" created successfully.`);
+      console.log(`Address: ${result.address}`);
+      console.log("Stored in ~/.vizzor/wallets/");
+    } catch (err) {
+      log12.error(`Failed to create wallet: ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+    }
+  });
+  wallet.command("import <name>").description("Import a wallet from a private key").requiredOption("-k, --key <privateKey>", "Private key (hex)").requiredOption("-p, --password <password>", "Encryption password").action((name, opts) => {
+    try {
+      const result = importWallet(name, opts.key, opts.password);
+      console.log(`Wallet "${result.name}" imported successfully.`);
+    } catch (err) {
+      log12.error(`Failed to import wallet: ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+    }
+  });
+  wallet.command("list").description("List all saved wallets").action(() => {
+    const wallets = listWallets();
+    if (wallets.length === 0) {
+      console.log("No wallets found.");
+      return;
+    }
+    console.log("Wallets:");
+    for (const w of wallets) {
+      console.log(`  ${w.name} \u2014 ${w.address} (created: ${w.createdAt})`);
+    }
+  });
+  wallet.command("delete <name>").description("Delete a wallet").action((name) => {
+    try {
+      deleteWallet(name);
+      console.log(`Wallet "${name}" deleted.`);
+    } catch (err) {
+      log12.error(`Failed to delete wallet: ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+    }
+  });
+}
+var log12;
+var init_wallet2 = __esm({
+  "src/cli/commands/wallet.ts"() {
+    "use strict";
+    init_wallet_manager();
+    init_logger();
+    log12 = createLogger("cli-wallet");
+  }
+});
+
+// src/data/sources/binance-ws.ts
+import { EventEmitter } from "events";
+var log13, BASE_URL7, BinanceWebSocket;
+var init_binance_ws = __esm({
+  "src/data/sources/binance-ws.ts"() {
+    "use strict";
+    init_logger();
+    log13 = createLogger("binance-ws");
+    BASE_URL7 = "wss://stream.binance.com:9443/ws";
+    BinanceWebSocket = class extends EventEmitter {
+      ws = null;
+      streams = [];
+      reconnectDelay = 1e3;
+      maxReconnectDelay = 3e4;
+      heartbeatTimer = null;
+      reconnecting = false;
+      closed = false;
+      constructor(streams) {
+        super();
+        this.streams = streams;
+      }
+      connect() {
+        if (this.closed) return;
+        const url = this.streams.length === 1 ? `${BASE_URL7}/${this.streams[0]}` : `${BASE_URL7}/${this.streams.join("/")}`;
+        log13.debug(`Connecting to ${url}`);
+        this.ws = new WebSocket(url);
+        this.ws.onopen = () => {
+          log13.info(`WebSocket connected (${this.streams.length} streams)`);
+          this.reconnectDelay = 1e3;
+          this.reconnecting = false;
+          this.startHeartbeat();
+          this.emit("connected");
+        };
+        this.ws.onmessage = (event) => {
+          try {
+            const data = JSON.parse(String(event.data));
+            this.handleMessage(data);
+          } catch {
+          }
+        };
+        this.ws.onclose = () => {
+          this.stopHeartbeat();
+          if (!this.closed) {
+            this.scheduleReconnect();
+          }
+        };
+        this.ws.onerror = () => {
+          log13.debug("WebSocket error");
+        };
+      }
+      close() {
+        this.closed = true;
+        this.stopHeartbeat();
+        if (this.ws) {
+          this.ws.close();
+          this.ws = null;
+        }
+      }
+      handleMessage(data) {
+        const eventType = data["e"];
+        if (eventType === "trade") {
+          const trade = {
+            symbol: String(data["s"]),
+            price: Number(data["p"]),
+            quantity: Number(data["q"]),
+            time: Number(data["T"]),
+            isBuyerMaker: Boolean(data["m"])
+          };
+          this.emit("trade", trade);
+        } else if (eventType === "kline") {
+          const k = data["k"];
+          const kline = {
+            symbol: String(data["s"]),
+            interval: String(k["i"]),
+            open: Number(k["o"]),
+            high: Number(k["h"]),
+            low: Number(k["l"]),
+            close: Number(k["c"]),
+            volume: Number(k["v"]),
+            openTime: Number(k["t"]),
+            closeTime: Number(k["T"]),
+            isClosed: Boolean(k["x"])
+          };
+          this.emit("kline", kline);
+        } else if (eventType === "24hrTicker") {
+          const ticker = {
+            symbol: String(data["s"]),
+            price: Number(data["c"]),
+            priceChange: Number(data["p"]),
+            priceChangePct: Number(data["P"]),
+            volume: Number(data["v"]),
+            quoteVolume: Number(data["q"])
+          };
+          this.emit("ticker", ticker);
+        }
+      }
+      scheduleReconnect() {
+        if (this.reconnecting || this.closed) return;
+        this.reconnecting = true;
+        log13.info(`Reconnecting in ${this.reconnectDelay}ms...`);
+        setTimeout(() => {
+          this.connect();
+        }, this.reconnectDelay);
+        this.reconnectDelay = Math.min(this.reconnectDelay * 2, this.maxReconnectDelay);
+      }
+      startHeartbeat() {
+        this.heartbeatTimer = setInterval(() => {
+          if (this.ws?.readyState === WebSocket.OPEN) {
+            this.ws.send(JSON.stringify({ method: "PING" }));
+          }
+        }, 3e4);
+      }
+      stopHeartbeat() {
+        if (this.heartbeatTimer) {
+          clearInterval(this.heartbeatTimer);
+          this.heartbeatTimer = null;
+        }
+      }
+    };
+  }
+});
+
+// src/data/sources/ws-manager.ts
+var ws_manager_exports = {};
+__export(ws_manager_exports, {
+  WSManager: () => WSManager,
+  getWSManager: () => getWSManager,
+  initWSManager: () => initWSManager
+});
+function getWSManager() {
+  return instance2;
+}
+function initWSManager() {
+  if (!instance2) {
+    instance2 = new WSManager();
+  }
+  return instance2;
+}
+var log14, MAX_STREAMS_PER_CONN, MAX_CONNECTIONS, WSManager, instance2;
+var init_ws_manager = __esm({
+  "src/data/sources/ws-manager.ts"() {
+    "use strict";
+    init_binance_ws();
+    init_logger();
+    log14 = createLogger("ws-manager");
+    MAX_STREAMS_PER_CONN = 1024;
+    MAX_CONNECTIONS = 5;
+    WSManager = class {
+      connections = [];
+      priceCache = /* @__PURE__ */ new Map();
+      subscriptions = /* @__PURE__ */ new Map();
+      // symbol → stream types
+      tradeCallbacks = /* @__PURE__ */ new Map();
+      klineCallbacks = /* @__PURE__ */ new Map();
+      started = false;
+      subscribe(symbol, streams = ["trade", "ticker"]) {
+        const existing = this.subscriptions.get(symbol) ?? /* @__PURE__ */ new Set();
+        for (const s of streams) {
+          existing.add(s);
+        }
+        this.subscriptions.set(symbol, existing);
+      }
+      unsubscribe(symbol) {
+        this.subscriptions.delete(symbol);
+        this.priceCache.delete(symbol.toUpperCase());
+      }
+      start() {
+        if (this.started) return;
+        this.started = true;
+        const allStreams = [];
+        for (const [symbol, types] of this.subscriptions) {
+          const lower = symbol.toLowerCase();
+          for (const type of types) {
+            if (type === "trade") allStreams.push(`${lower}@trade`);
+            else if (type === "kline_1m") allStreams.push(`${lower}@kline_1m`);
+            else if (type === "ticker") allStreams.push(`${lower}@ticker`);
+          }
+        }
+        if (allStreams.length === 0) {
+          log14.info("No subscriptions \u2014 WebSocket manager idle");
+          return;
+        }
+        for (let i = 0; i < allStreams.length; i += MAX_STREAMS_PER_CONN) {
+          if (this.connections.length >= MAX_CONNECTIONS) break;
+          const chunk = allStreams.slice(i, i + MAX_STREAMS_PER_CONN);
+          const ws = new BinanceWebSocket(chunk);
+          ws.on("trade", (trade) => {
+            this.priceCache.set(trade.symbol, { price: trade.price, time: trade.time });
+            const callbacks = this.tradeCallbacks.get(trade.symbol);
+            if (callbacks) {
+              for (const cb of callbacks) cb(trade);
+            }
+          });
+          ws.on("ticker", (ticker) => {
+            this.priceCache.set(ticker.symbol, { price: ticker.price, time: Date.now() });
+          });
+          ws.on("kline", (kline) => {
+            const key = `${kline.symbol}:${kline.interval}`;
+            const callbacks = this.klineCallbacks.get(key);
+            if (callbacks) {
+              for (const cb of callbacks) cb(kline);
+            }
+          });
+          ws.connect();
+          this.connections.push(ws);
+        }
+        log14.info(
+          `WebSocket manager started: ${this.connections.length} connections, ${allStreams.length} streams`
+        );
+      }
+      stop() {
+        for (const ws of this.connections) {
+          ws.close();
+        }
+        this.connections = [];
+        this.started = false;
+        log14.info("WebSocket manager stopped");
+      }
+      getLatestPrice(symbol) {
+        const upper = symbol.toUpperCase().replace("/", "");
+        const cached = this.priceCache.get(upper);
+        if (!cached) return null;
+        if (Date.now() - cached.time > 6e4) return null;
+        return cached.price;
+      }
+      onTrade(symbol, callback) {
+        const upper = symbol.toUpperCase();
+        const set = this.tradeCallbacks.get(upper) ?? /* @__PURE__ */ new Set();
+        set.add(callback);
+        this.tradeCallbacks.set(upper, set);
+      }
+      onKline(symbol, interval, callback) {
+        const key = `${symbol.toUpperCase()}:${interval}`;
+        const set = this.klineCallbacks.get(key) ?? /* @__PURE__ */ new Set();
+        set.add(callback);
+        this.klineCallbacks.set(key, set);
+      }
+    };
+    instance2 = null;
+  }
+});
+
 // src/tui/components/status-bar.tsx
 import React, { useState, useEffect } from "react";
 import { Box, Text, Spacer } from "ink";
@@ -10873,7 +12730,7 @@ function WelcomeBanner() {
     /* @__PURE__ */ jsxs3(Box3, { children: [
       /* @__PURE__ */ jsx3(Text3, { bold: true, color: "cyan", children: "  " }),
       /* @__PURE__ */ jsx3(Text3, { bold: true, color: "blue", children: "vizzor" }),
-      /* @__PURE__ */ jsx3(Text3, { bold: true, color: "cyan", children: " v0.10.0" }),
+      /* @__PURE__ */ jsx3(Text3, { bold: true, color: "cyan", children: " v0.11.0" }),
       /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: " \u2014 AI-powered crypto chronovisor" })
     ] }),
     /* @__PURE__ */ jsx3(Box3, { children: /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "  ML models: LSTM + Random Forest + Isolation Forest + GBM Rug + Wallet LSTM + DistilBERT NLP" }) }),
@@ -11561,6 +13418,8 @@ async function executeCommand(name, args2) {
       return handleConfig(args2);
     case "agent":
       return handleAgent(args2);
+    case "backtest":
+      return handleBacktest(args2);
     case "clear":
       return { blocks: [], text: "" };
     case "exit":
@@ -11910,6 +13769,7 @@ function handleHelp() {
     "  /trends                              Live trending tokens + top gainers/losers",
     "  /audit <contract> [--chain <chain>]  Audit a smart contract (bytecode scanning)",
     "  /agent <sub>                         Manage autonomous trading agents",
+    "  /backtest -s <strat> --pair <P> --from <D> --to <D>  Run a historical backtest",
     "  /provider [list|<name>]              Show/switch AI provider",
     "  /config [set <key> <value>]           Show or update configuration",
     "  /clear                               Clear message history",
@@ -11922,6 +13782,62 @@ function handleHelp() {
   ].join("\n");
   return { blocks: [], text };
 }
+async function handleBacktest(args2) {
+  const stratIdx = args2.indexOf("-s") !== -1 ? args2.indexOf("-s") : args2.indexOf("--strategy");
+  const pairIdx = args2.indexOf("--pair");
+  const fromIdx = args2.indexOf("--from");
+  const toIdx = args2.indexOf("--to");
+  const tfIdx = args2.indexOf("--timeframe");
+  const strategy = stratIdx !== -1 && stratIdx + 1 < args2.length ? args2[stratIdx + 1] : "";
+  const pair = pairIdx !== -1 && pairIdx + 1 < args2.length ? args2[pairIdx + 1] : "";
+  const from = fromIdx !== -1 && fromIdx + 1 < args2.length ? args2[fromIdx + 1] : "";
+  const to = toIdx !== -1 && toIdx + 1 < args2.length ? args2[toIdx + 1] : "";
+  const timeframe = tfIdx !== -1 && tfIdx + 1 < args2.length ? args2[tfIdx + 1] : "4h";
+  if (!strategy || !pair || !from || !to) {
+    return {
+      blocks: [],
+      text: "Usage: /backtest -s <strategy> --pair <PAIR> --from <YYYY-MM-DD> --to <YYYY-MM-DD> [--timeframe <tf>]"
+    };
+  }
+  try {
+    const { BacktestEngine: BacktestEngine2 } = await Promise.resolve().then(() => (init_engine2(), engine_exports));
+    const engine = new BacktestEngine2({
+      strategy,
+      pair,
+      from,
+      to,
+      initialCapital: 1e4,
+      timeframe,
+      slippageBps: 10,
+      commissionPct: 0.1
+    });
+    const result = await engine.run();
+    const lines = [
+      `Backtest: ${result.config.strategy} on ${result.config.pair} (${result.config.from} \u2192 ${result.config.to})`,
+      `Initial Capital: $${result.config.initialCapital.toLocaleString()}`,
+      "",
+      `Total Return: $${result.metrics.totalReturn.toFixed(2)} (${result.metrics.totalReturnPct.toFixed(2)}%)`,
+      `Win Rate: ${(result.metrics.winRate * 100).toFixed(1)}%`,
+      `Total Trades: ${result.metrics.totalTrades}`,
+      `Profit Factor: ${result.metrics.profitFactor === Infinity ? "\u221E" : result.metrics.profitFactor.toFixed(2)}`,
+      `Sharpe Ratio: ${result.metrics.sharpeRatio.toFixed(2)}`,
+      `Max Drawdown: ${result.metrics.maxDrawdown.toFixed(2)}%`
+    ];
+    if (result.trades.length > 0) {
+      lines.push("", "Last 5 Trades:");
+      for (const t of result.trades.slice(-5)) {
+        const dir = t.pnl >= 0 ? "+" : "";
+        lines.push(
+          `  ${new Date(t.entryTime).toISOString().split("T")[0]} \u2192 ${new Date(t.exitTime).toISOString().split("T")[0]} | ${t.side} | $${t.entryPrice.toFixed(2)} \u2192 $${t.exitPrice.toFixed(2)} | ${dir}$${t.pnl.toFixed(2)} (${dir}${t.pnlPct.toFixed(2)}%)`
+        );
+      }
+    }
+    return { blocks: [], text: lines.join("\n") };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { blocks: [], text: `Backtest failed: ${message}` };
+  }
+}
 async function handleConfig(args2) {
   if (args2[0] === "set") {
     const key = args2[1];
@@ -12503,12 +14419,12 @@ var init_app = __esm({
 // src/index.ts
 init_loader();
 import { Command } from "commander";
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname2, resolve as resolve3 } from "path";
 var __filename2 = fileURLToPath2(import.meta.url);
 var __dirname2 = dirname2(__filename2);
-var pkg = JSON.parse(readFileSync3(resolve3(__dirname2, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync4(resolve3(__dirname2, "..", "package.json"), "utf-8"));
 var program = new Command().name("vizzor").description("Crypto chronovisor \u2014 AI-powered on-chain intelligence").version(pkg.version);
 program.hook("preAction", async () => {
   await loadConfig();
@@ -12583,9 +14499,30 @@ apiKeyCmd.command("revoke <id>").description("Revoke an API key").action(async (
   const { handleApiKeyRevoke: handleApiKeyRevoke2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   handleApiKeyRevoke2(id);
 });
+apiCmd.command("start").description("Start the REST API server").option("--port <port>", "Server port", (v) => parseInt(v, 10), 3e3).option("--host <host>", "Server host", "0.0.0.0").option("--auth", "Enable API key authentication", false).action(async (options) => {
+  const { handleServe: handleServe2 } = await Promise.resolve().then(() => (init_serve(), serve_exports));
+  await handleServe2(options);
+});
+var { registerBacktestCommand: registerBacktestCommand2 } = await Promise.resolve().then(() => (init_backtest2(), backtest_exports));
+registerBacktestCommand2(program);
+var { registerWalletCommand: registerWalletCommand2 } = await Promise.resolve().then(() => (init_wallet2(), wallet_exports));
+registerWalletCommand2(program);
 var args = process.argv.slice(2);
 if (args.length === 0) {
   await loadConfig();
+  const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_loader(), loader_exports));
+  try {
+    const config2 = getConfig2();
+    if (config2.realtime?.enabled) {
+      const { initWSManager: initWSManager2 } = await Promise.resolve().then(() => (init_ws_manager(), ws_manager_exports));
+      const wsManager = initWSManager2();
+      for (const symbol of config2.realtime.symbols) {
+        wsManager.subscribe(symbol);
+      }
+      wsManager.start();
+    }
+  } catch {
+  }
   const { startTUI: startTUI2 } = await Promise.resolve().then(() => (init_app(), app_exports));
   startTUI2();
 } else {