agentvault 1.0.1 → 1.0.5

package/dist/src/trading/consensus.js

@@ -0,0 +1,291 @@
+/**
+ * Multi-Agent Trade Consensus
+ *
+ * Implements a 2-of-2 vote gate that must pass before any trade is executed.
+ * Protects against:
+ *   - Laggy ICP agent double-execution (each proposal carries a monotonic nonce)
+ *   - Solo-agent trading (both agents must sign within the 30-second window)
+ *   - Replay attacks (nonce is unique per proposal; votes bind nonce + agentId)
+ *
+ * Flow:
+ *   1. Any agent calls proposeConsensus(signal) → returns sessionId + nonce
+ *   2. Both agents call castVote(sessionId, agentId, signature, approve=true)
+ *      Signature covers: sha256(sessionId + ":" + nonce + ":" + agentId + ":approve")
+ *   3. TradeConsensusManager.watchSession() resolves APPROVED once both votes arrive
+ *      or CANCELLED if the 30-second window expires with < 2 approvals.
+ *   4. Callers MUST await the result and abort if status !== 'approved'.
+ */
+import crypto from 'node:crypto';
+// ── Constants ────────────────────────────────────────────────────────────────
+/** Hard deadline: both agents must vote within this window or the trade cancels. */
+export const CONSENSUS_TIMEOUT_MS = 30_000;
+/** Required number of approving votes before a trade may fire. */
+export const REQUIRED_VOTES = 2;
+// ── Signature Helpers ────────────────────────────────────────────────────────
+/**
+ * Canonical vote payload string.
+ *
+ * Both agents must agree on this format — any deviation makes the signature invalid.
+ */
+function votePayload(sessionId, nonce, agentId, approve) {
+    const decision = approve ? 'approve' : 'veto';
+    return `${sessionId}:${nonce}:${agentId}:${decision}`;
+}
+/**
+ * Sign a vote using HMAC-SHA256.
+ *
+ * @param agentSecret - 32-byte (or longer) secret key unique to this agent.
+ *                      On ICP this can be derived from a VetKey.
+ *                      On Solana this can be derived from the wallet keypair.
+ */
+export function signVote(sessionId, nonce, agentId, approve, agentSecret) {
+    const payload = votePayload(sessionId, nonce, agentId, approve);
+    return crypto
+        .createHmac('sha256', agentSecret)
+        .update(payload)
+        .digest('hex');
+}
+/**
+ * Verify a vote signature using timing-safe comparison.
+ *
+ * @returns true if the signature is valid.
+ */
+export function verifyVote(vote, sessionId, agentSecret) {
+    const expected = signVote(sessionId, vote.nonce, vote.agentId, vote.approve, agentSecret);
+    const expectedBuf = Buffer.from(expected, 'hex');
+    const actualBuf = Buffer.from(vote.signature, 'hex');
+    // Buffers must be same length for timingSafeEqual; reject mismatched lengths.
+    if (expectedBuf.length !== actualBuf.length)
+        return false;
+    return crypto.timingSafeEqual(expectedBuf, actualBuf);
+}
+/**
+ * Manages the full lifecycle of multi-agent trade consensus sessions.
+ *
+ * Thread-safety note: JS is single-threaded, so Map operations are safe.
+ * However, the 30-second timer fires asynchronously — always check session
+ * status before acting on a resolved promise.
+ */
+export class TradeConsensusManager {
+    sessions = new Map();
+    timers = new Map();
+    opts;
+    constructor(options) {
+        this.opts = {
+            agentSecrets: options.agentSecrets,
+            timeoutMs: options.timeoutMs ?? CONSENSUS_TIMEOUT_MS,
+            onSessionUpdate: options.onSessionUpdate ?? (() => { }),
+        };
+    }
+    // ── Propose ───────────────────────────────────────────────────────────────
+    /**
+     * Open a new consensus session for a trade signal.
+     *
+     * @returns The session (status = 'pending').  Callers should then
+     *          distribute the sessionId + nonce to both agents so they can vote.
+     */
+    proposeConsensus(signal) {
+        const sessionId = `cs_${Date.now()}_${crypto.randomBytes(6).toString('hex')}`;
+        const nonce = crypto.randomBytes(16).toString('hex');
+        const session = {
+            sessionId,
+            nonce,
+            signal,
+            status: 'pending',
+            votes: [],
+            createdAt: new Date().toISOString(),
+        };
+        this.sessions.set(sessionId, session);
+        // Arm the 30-second kill timer.
+        const timer = setTimeout(() => {
+            this._expire(sessionId, 'timeout: 30-second window elapsed without 2 approvals');
+        }, this.opts.timeoutMs);
+        // Allow Node to exit even if a session is pending (don't block teardown).
+        if (typeof timer === 'object' && 'unref' in timer) {
+            timer.unref();
+        }
+        this.timers.set(sessionId, timer);
+        this.opts.onSessionUpdate(session);
+        return { ...session };
+    }
+    // ── Vote ──────────────────────────────────────────────────────────────────
+    /**
+     * Cast an agent's vote on a pending session.
+     *
+     * Accepts only if:
+     *   1. The session exists and is still 'pending'.
+     *   2. The nonce in the vote matches the session nonce (anti-replay).
+     *   3. The agent secret is registered in the manager.
+     *   4. The HMAC-SHA256 signature over the canonical payload verifies.
+     *   5. The agentId has not already voted in this session (no double-vote).
+     *
+     * @returns The updated session snapshot.
+     * @throws If the session is not found, already resolved, or the vote is invalid.
+     */
+    castVote(sessionId, vote) {
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            throw new Error(`Consensus session not found: ${sessionId}`);
+        }
+        if (session.status !== 'pending') {
+            throw new Error(`Session ${sessionId} is already ${session.status} — votes are no longer accepted`);
+        }
+        // Anti-replay: nonce must exactly match.
+        if (vote.nonce !== session.nonce) {
+            throw new Error(`Vote nonce mismatch for session ${sessionId} — possible replay attack`);
+        }
+        // Check for duplicate vote from this agent.
+        if (session.votes.some((v) => v.agentId === vote.agentId)) {
+            throw new Error(`Agent ${vote.agentId} has already voted in session ${sessionId}`);
+        }
+        // Verify signature.
+        const secret = this.opts.agentSecrets.get(vote.agentId);
+        if (!secret) {
+            throw new Error(`Unknown agentId ${vote.agentId} — no secret registered`);
+        }
+        if (!verifyVote(vote, sessionId, secret)) {
+            throw new Error(`Invalid vote signature from agent ${vote.agentId}`);
+        }
+        // Record the vote.
+        session.votes.push({ ...vote });
+        // If any agent vetoes, cancel immediately — no trade.
+        if (!vote.approve) {
+            this._resolve(session, 'cancelled', `agent ${vote.agentId} vetoed the trade`);
+            return { ...session };
+        }
+        // Check if we have reached the required quorum.
+        const approvals = session.votes.filter((v) => v.approve).length;
+        if (approvals >= REQUIRED_VOTES) {
+            this._resolve(session, 'approved');
+        }
+        else {
+            this.opts.onSessionUpdate(session);
+        }
+        return { ...session };
+    }
+    // ── Query ─────────────────────────────────────────────────────────────────
+    /** Return a snapshot of a session, or undefined if not found. */
+    getSession(sessionId) {
+        const s = this.sessions.get(sessionId);
+        return s ? { ...s } : undefined;
+    }
+    /** Return all sessions that match a given status. */
+    listSessions(status) {
+        const result = [];
+        for (const s of this.sessions.values()) {
+            if (!status || s.status === status) {
+                result.push({ ...s });
+            }
+        }
+        return result;
+    }
+    // ── Watch ─────────────────────────────────────────────────────────────────
+    /**
+     * Await the final outcome of a consensus session.
+     *
+     * Resolves once the session reaches 'approved' or 'cancelled'.
+     * The returned status is authoritative — callers must check it before executing
+     * any trade.
+     *
+     * @example
+     * ```ts
+     * const { status } = await manager.watchSession(sessionId);
+     * if (status !== 'approved') return; // abort — no solo trades
+     * await executeTrade(signal);
+     * ```
+     */
+    watchSession(sessionId) {
+        return new Promise((resolve, reject) => {
+            const poll = () => {
+                const session = this.sessions.get(sessionId);
+                if (!session) {
+                    return reject(new Error(`Session ${sessionId} not found`));
+                }
+                if (session.status === 'approved' || session.status === 'cancelled') {
+                    return resolve({ ...session });
+                }
+                // Re-install the hook by wrapping onSessionUpdate.
+                const original = this.opts.onSessionUpdate;
+                this.opts.onSessionUpdate = (updated) => {
+                    original(updated);
+                    if (updated.sessionId === sessionId &&
+                        (updated.status === 'approved' || updated.status === 'cancelled')) {
+                        this.opts.onSessionUpdate = original;
+                        resolve({ ...updated });
+                    }
+                };
+            };
+            poll();
+        });
+    }
+    // ── Cleanup ───────────────────────────────────────────────────────────────
+    /**
+     * Remove a session from memory after it has been acted upon.
+     * Call this once the trade outcome (executed or cancelled) has been recorded.
+     */
+    pruneSession(sessionId) {
+        this.sessions.delete(sessionId);
+        const timer = this.timers.get(sessionId);
+        if (timer) {
+            clearTimeout(timer);
+            this.timers.delete(sessionId);
+        }
+    }
+    /** Cancel all pending sessions and clear all timers (e.g. on shutdown). */
+    shutdown() {
+        for (const [id, session] of this.sessions.entries()) {
+            if (session.status === 'pending') {
+                this._resolve(session, 'cancelled', 'manager shutdown');
+            }
+            const timer = this.timers.get(id);
+            if (timer)
+                clearTimeout(timer);
+        }
+        this.timers.clear();
+    }
+    // ── Private ───────────────────────────────────────────────────────────────
+    _resolve(session, status, cancelReason) {
+        session.status = status;
+        session.resolvedAt = new Date().toISOString();
+        if (cancelReason)
+            session.cancelReason = cancelReason;
+        // Disarm the timeout timer.
+        const timer = this.timers.get(session.sessionId);
+        if (timer) {
+            clearTimeout(timer);
+            this.timers.delete(session.sessionId);
+        }
+        this.opts.onSessionUpdate({ ...session });
+    }
+    _expire(sessionId, reason) {
+        const session = this.sessions.get(sessionId);
+        if (session && session.status === 'pending') {
+            this._resolve(session, 'cancelled', reason);
+        }
+        this.timers.delete(sessionId);
+    }
+}
+// ── Standalone Helpers ───────────────────────────────────────────────────────
+/**
+ * Build a ConsensusVote ready to submit.
+ *
+ * Agents call this locally before sending the vote to the consensus manager.
+ *
+ * @param sessionId - Returned by proposeConsensus()
+ * @param nonce     - Returned by proposeConsensus()
+ * @param agentId   - Unique identifier for this agent (e.g. "icp-agent-1")
+ * @param chain     - The chain this agent runs on
+ * @param approve   - true to approve, false to veto
+ * @param agentSecret - The agent's signing secret
+ */
+export function buildVote(sessionId, nonce, agentId, chain, approve, agentSecret) {
+    return {
+        agentId,
+        chain,
+        nonce,
+        approve,
+        signature: signVote(sessionId, nonce, agentId, approve, agentSecret),
+        votedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=consensus.js.map

package/dist/src/trading/consensus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consensus.js","sourceRoot":"","sources":["../../../src/trading/consensus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,gFAAgF;AAEhF,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AA6DhC,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,WAAW,CAClB,SAAiB,EACjB,KAAa,EACb,OAAe,EACf,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,GAAG,SAAS,IAAI,KAAK,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAiB,EACjB,KAAa,EACb,OAAe,EACf,OAAgB,EAChB,WAAmB;IAEnB,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;SACjC,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAmB,EAAE,SAAiB,EAAE,WAAmB;IACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1F,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,8EAA8E;IAC9E,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC/C,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC1D,IAAI,CAAoC;IAEzD,YAAY,OAAgC;QAC1C,IAAI,CAAC,IAAI,GAAG;YACV,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,oBAAoB;YACpD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E;;;;;OAKG;IACH,gBAAgB,CAAC,MAAmB;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,OAAO,GAAqB;YAChC,SAAS;YACT,KAAK;YACL,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEtC,gCAAgC;QAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uDAAuD,CAAC,CAAC;QACnF,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAExB,0EAA0E;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;YACjD,KAAwB,CAAC,KAAK,EAAE,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAiB,EAAE,IAAmB;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,eAAe,OAAO,CAAC,MAAM,iCAAiC,CACnF,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,2BAA2B,CAAC,CAAC;QAC3F,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,iCAAiC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,OAAO,yBAAyB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,mBAAmB;QACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAEhC,sDAAsD;QACtD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,IAAI,CAAC,OAAO,mBAAmB,CAAC,CAAC;YAC9E,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,gDAAgD;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,6EAA6E;IAE7E,iEAAiE;IACjE,UAAU,CAAC,SAAiB;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,qDAAqD;IACrD,YAAY,CAAC,MAAwB;QACnC,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,SAAS,YAAY,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBACpE,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;gBACjC,CAAC;gBACD,mDAAmD;gBACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,EAAE,EAAE;oBACtC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAClB,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;wBAC/B,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;wBACtE,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;wBACrC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,QAAQ;QACN,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,6EAA6E;IAErE,QAAQ,CACd,OAAyB,EACzB,MAAgC,EAChC,YAAqB;QAErB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,YAAY;YAAE,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;QAEtD,4BAA4B;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,OAAO,CAAC,SAAiB,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;CACF;AAED,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CACvB,SAAiB,EACjB,KAAa,EACb,OAAe,EACf,KAAiB,EACjB,OAAgB,EAChB,WAAmB;IAEnB,OAAO;QACL,OAAO;QACP,KAAK;QACL,KAAK;QACL,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC;QACpE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;AACJ,CAAC"}

package/dist/src/trading/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Trading Security Module
+ *
+ * Exports all components that implement the trading-specific threat model:
+ *
+ *   - ApiKeyManager: Binance API key storage with mandatory weekly rotation.
+ *   - IpWhitelistManager: IP / CIDR allowlist with firewall rule generation.
+ *   - SkillSandbox: Runtime sandbox enforcing no-root + /tmp write confinement
+ *     for OpenClaw / Clawdbot skills.
+ */
+export { ApiKeyManager, getRotationStatus, isKeyValid, KEY_ROTATION_INTERVAL_DAYS, } from './api-key-manager.js';
+export type { BinanceApiKey, KeyRotationStatus, } from './api-key-manager.js';
+export { IpWhitelistManager, isIpAllowed, validateCidr, generateFirewallRules, } from './ip-whitelist.js';
+export type { WhitelistEntry, WhitelistValidationResult, FirewallRules, } from './ip-whitelist.js';
+export { SkillSandbox, defaultSandbox, SKILL_WRITE_ROOT, } from './skill-sandbox.js';
+export type { SandboxViolation, } from './skill-sandbox.js';
+export { TradeConsensusManager, buildVote, signVote, verifyVote, CONSENSUS_TIMEOUT_MS, REQUIRED_VOTES, } from './consensus.js';
+export type { AgentChain, TradeDirection, TradeSignal, ConsensusVote, ConsensusSession, ConsensusStatus, ConsensusManagerOptions, } from './consensus.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/trading/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/trading/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,yBAAyB,EACzB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,cAAc,EACd,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,uBAAuB,GACxB,MAAM,gBAAgB,CAAC"}

package/dist/src/trading/index.js

@@ -0,0 +1,15 @@
+/**
+ * Trading Security Module
+ *
+ * Exports all components that implement the trading-specific threat model:
+ *
+ *   - ApiKeyManager: Binance API key storage with mandatory weekly rotation.
+ *   - IpWhitelistManager: IP / CIDR allowlist with firewall rule generation.
+ *   - SkillSandbox: Runtime sandbox enforcing no-root + /tmp write confinement
+ *     for OpenClaw / Clawdbot skills.
+ */
+export { ApiKeyManager, getRotationStatus, isKeyValid, KEY_ROTATION_INTERVAL_DAYS, } from './api-key-manager.js';
+export { IpWhitelistManager, isIpAllowed, validateCidr, generateFirewallRules, } from './ip-whitelist.js';
+export { SkillSandbox, defaultSandbox, SKILL_WRITE_ROOT, } from './skill-sandbox.js';
+export { TradeConsensusManager, buildVote, signVote, verifyVote, CONSENSUS_TIMEOUT_MS, REQUIRED_VOTES, } from './consensus.js';
+//# sourceMappingURL=index.js.map

package/dist/src/trading/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/trading/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,gBAAgB,CAAC"}

package/dist/src/trading/ip-whitelist.d.ts

@@ -0,0 +1,70 @@
+/**
+ * IP Whitelist Manager
+ *
+ * Manages the set of IPs / CIDR blocks that are permitted to reach the
+ * trading VPS.  Provides:
+ *   - Validation of individual addresses and CIDR blocks.
+ *   - Membership testing (does this source IP pass the whitelist?).
+ *   - Firewall rule generation for iptables and ufw so the VPS can be
+ *     bootstrapped from the same config that the application uses.
+ *
+ * Threat model: only traffic originating from known, controlled IPs should
+ * reach the Binance proxy endpoint.  This module makes that policy explicit
+ * and machine-verifiable.
+ */
+export interface WhitelistEntry {
+    /** Human-readable label (e.g. "office-nat", "vps-egress"). */
+    label: string;
+    /** IPv4 / IPv6 address or CIDR block, e.g. "203.0.113.5" or "10.0.0.0/8". */
+    cidr: string;
+    /** Optional note about why this entry exists. */
+    note?: string;
+}
+export interface WhitelistValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+export interface FirewallRules {
+    /** Raw iptables commands (IPv4). */
+    iptables: string[];
+    /** ufw allow commands. */
+    ufw: string[];
+    /** ip6tables commands (IPv6). */
+    ip6tables: string[];
+}
+/** Validate a single CIDR / address string. */
+export declare function validateCidr(value: string): WhitelistValidationResult;
+/**
+ * Test whether `sourceIp` is permitted by the given whitelist entries.
+ */
+export declare function isIpAllowed(sourceIp: string, entries: WhitelistEntry[]): boolean;
+/**
+ * Generate iptables / ufw / ip6tables rules that allow only whitelisted IPs
+ * to reach `port` (TCP) and drop everything else.
+ *
+ * The generated commands are idempotent-safe: they use INSERT (iptables) and
+ * `ufw allow from ... to any port ...` forms that are safe to run repeatedly.
+ */
+export declare function generateFirewallRules(entries: WhitelistEntry[], port: number, chain?: string): FirewallRules;
+export declare class IpWhitelistManager {
+    private entries;
+    constructor(entries?: WhitelistEntry[]);
+    /** Add a new entry, validating first. Throws on invalid input. */
+    add(entry: WhitelistEntry): void;
+    /** Remove all entries matching `label`. */
+    remove(label: string): void;
+    /** Return all entries. */
+    getEntries(): Readonly<WhitelistEntry[]>;
+    /** Test whether `sourceIp` is allowed by the current whitelist. */
+    isAllowed(sourceIp: string): boolean;
+    /**
+     * Assert that `sourceIp` is whitelisted. Throws if it is not.
+     * Use this as a guard at trade-execution entry points.
+     */
+    assertAllowed(sourceIp: string): void;
+    /** Validate every entry and return aggregated errors. */
+    validate(): WhitelistValidationResult;
+    /** Generate firewall rules for a given port. */
+    generateRules(port: number, chain?: string): FirewallRules;
+}
+//# sourceMappingURL=ip-whitelist.d.ts.map

package/dist/src/trading/ip-whitelist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-whitelist.d.ts","sourceRoot":"","sources":["../../../src/trading/ip-whitelist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,iCAAiC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AA+BD,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,yBAAyB,CAcrE;AAgED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CA0BhF;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,cAAc,EAAE,EACzB,IAAI,EAAE,MAAM,EACZ,KAAK,SAAU,GACd,aAAa,CAsCf;AAMD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,OAAO,CAAmB;gBAEtB,OAAO,GAAE,cAAc,EAAO;IAI1C,kEAAkE;IAClE,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAQhC,2CAA2C;IAC3C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI3B,0BAA0B;IAC1B,UAAU,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;IAIxC,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;OAGG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IASrC,yDAAyD;IACzD,QAAQ,IAAI,yBAAyB;IAWrC,gDAAgD;IAChD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa;CAG3D"}

package/dist/src/trading/ip-whitelist.js

@@ -0,0 +1,239 @@
+/**
+ * IP Whitelist Manager
+ *
+ * Manages the set of IPs / CIDR blocks that are permitted to reach the
+ * trading VPS.  Provides:
+ *   - Validation of individual addresses and CIDR blocks.
+ *   - Membership testing (does this source IP pass the whitelist?).
+ *   - Firewall rule generation for iptables and ufw so the VPS can be
+ *     bootstrapped from the same config that the application uses.
+ *
+ * Threat model: only traffic originating from known, controlled IPs should
+ * reach the Binance proxy endpoint.  This module makes that policy explicit
+ * and machine-verifiable.
+ */
+import * as net from 'node:net';
+// ---------------------------------------------------------------------------
+// Validation helpers
+// ---------------------------------------------------------------------------
+/** Return true if `s` is a plain IPv4 or IPv6 address (no prefix length). */
+function isPlainIp(s) {
+    return net.isIP(s) !== 0;
+}
+/**
+ * Return true if `s` is a valid CIDR block.
+ * Accepts both IPv4 (e.g. "192.168.1.0/24") and IPv6 (e.g. "2001:db8::/32").
+ */
+function isCidr(s) {
+    const slashIdx = s.lastIndexOf('/');
+    if (slashIdx === -1)
+        return false;
+    const ip = s.slice(0, slashIdx);
+    const prefixStr = s.slice(slashIdx + 1);
+    const prefix = parseInt(prefixStr, 10);
+    if (isNaN(prefix) || prefixStr.trim() === '')
+        return false;
+    const ipVersion = net.isIP(ip);
+    if (ipVersion === 4 && prefix >= 0 && prefix <= 32)
+        return true;
+    if (ipVersion === 6 && prefix >= 0 && prefix <= 128)
+        return true;
+    return false;
+}
+/** Validate a single CIDR / address string. */
+export function validateCidr(value) {
+    const errors = [];
+    const trimmed = value.trim();
+    if (!trimmed) {
+        errors.push('Entry is empty');
+        return { valid: false, errors };
+    }
+    if (!isPlainIp(trimmed) && !isCidr(trimmed)) {
+        errors.push(`"${trimmed}" is not a valid IPv4/IPv6 address or CIDR block`);
+    }
+    return { valid: errors.length === 0, errors };
+}
+// ---------------------------------------------------------------------------
+// Membership testing
+// ---------------------------------------------------------------------------
+/**
+ * Convert an IPv4 address string to a 32-bit unsigned integer.
+ */
+function ipv4ToInt(ip) {
+    return ip
+        .split('.')
+        .reduce((acc, octet) => (acc << 8) | parseInt(octet, 10), 0) >>> 0;
+}
+/**
+ * Return true if `ip` falls within the given IPv4 CIDR block.
+ */
+function ipv4InCidr(ip, cidr) {
+    const parts = cidr.split('/');
+    if (parts.length !== 2)
+        return false;
+    const [network, prefixStr] = parts;
+    const prefix = parseInt(prefixStr, 10);
+    if (isNaN(prefix) || prefix < 0 || prefix > 32)
+        return false;
+    const mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;
+    return (ipv4ToInt(ip) & mask) === (ipv4ToInt(network) & mask);
+}
+/**
+ * Normalise an IPv6 address to its fully-expanded form using the Node.js
+ * URL API (cheapest reliable approach without external deps).
+ */
+function normaliseIpv6(ip) {
+    try {
+        // Wrapping in brackets lets URL parse it as a host.
+        const url = new URL(`http://[${ip}]`);
+        // url.hostname strips brackets.
+        return url.hostname.slice(1, -1);
+    }
+    catch {
+        return ip;
+    }
+}
+/**
+ * Return true if `ip` falls within the given IPv6 CIDR block.
+ * Uses BigInt for correct 128-bit arithmetic.
+ */
+function ipv6InCidr(ip, cidr) {
+    const parts = cidr.split('/');
+    if (parts.length !== 2)
+        return false;
+    const [network, prefixStr] = parts;
+    const prefixNum = parseInt(prefixStr, 10);
+    if (isNaN(prefixNum) || prefixNum < 0 || prefixNum > 128)
+        return false;
+    const prefix = BigInt(prefixNum);
+    const expand = (addr) => {
+        const norm = normaliseIpv6(addr).replace(/:/g, '');
+        return BigInt('0x' + norm.padStart(32, '0'));
+    };
+    const mask = prefix === 0n ? 0n : (~0n << (128n - prefix)) & ((1n << 128n) - 1n);
+    return (expand(ip) & mask) === (expand(network) & mask);
+}
+/**
+ * Test whether `sourceIp` is permitted by the given whitelist entries.
+ */
+export function isIpAllowed(sourceIp, entries) {
+    const ipVersion = net.isIP(sourceIp.trim());
+    if (ipVersion === 0)
+        return false; // Not a valid IP at all.
+    for (const entry of entries) {
+        const cidr = entry.cidr.trim();
+        // Plain IP — exact match.
+        if (isPlainIp(cidr)) {
+            if (cidr === sourceIp.trim())
+                return true;
+            continue;
+        }
+        // CIDR block.
+        if (isCidr(cidr)) {
+            const networkIp = cidr.split('/')[0];
+            if (!networkIp)
+                continue;
+            const networkVersion = net.isIP(networkIp);
+            if (networkVersion !== ipVersion)
+                continue; // IPv4 vs IPv6 mismatch.
+            if (ipVersion === 4 && ipv4InCidr(sourceIp.trim(), cidr))
+                return true;
+            if (ipVersion === 6 && ipv6InCidr(sourceIp.trim(), cidr))
+                return true;
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Firewall rule generation
+// ---------------------------------------------------------------------------
+/**
+ * Generate iptables / ufw / ip6tables rules that allow only whitelisted IPs
+ * to reach `port` (TCP) and drop everything else.
+ *
+ * The generated commands are idempotent-safe: they use INSERT (iptables) and
+ * `ufw allow from ... to any port ...` forms that are safe to run repeatedly.
+ */
+export function generateFirewallRules(entries, port, chain = 'INPUT') {
+    const iptables = [];
+    const ip6tables = [];
+    const ufw = [];
+    for (const entry of entries) {
+        const cidr = entry.cidr.trim();
+        const comment = entry.label.replace(/[^a-zA-Z0-9_-]/g, '-');
+        if (isPlainIp(cidr) || isCidr(cidr)) {
+            const networkIp = isPlainIp(cidr) ? cidr : cidr.split('/')[0];
+            if (!networkIp)
+                continue;
+            const version = net.isIP(networkIp);
+            if (version === 4) {
+                iptables.push(`iptables -I ${chain} -p tcp --dport ${port} -s ${cidr} -j ACCEPT -m comment --comment "av-whitelist-${comment}"`);
+                ufw.push(`ufw allow from ${cidr} to any port ${port} proto tcp comment "av-whitelist-${comment}"`);
+            }
+            else if (version === 6) {
+                ip6tables.push(`ip6tables -I ${chain} -p tcp --dport ${port} -s ${cidr} -j ACCEPT -m comment --comment "av-whitelist-${comment}"`);
+                ufw.push(`ufw allow from ${cidr} to any port ${port} proto tcp comment "av-whitelist-${comment}"`);
+            }
+        }
+    }
+    // Default-deny rules go last (lowest priority in iptables INSERT order).
+    iptables.push(`iptables -A ${chain} -p tcp --dport ${port} -j DROP -m comment --comment "av-whitelist-default-deny"`);
+    ip6tables.push(`ip6tables -A ${chain} -p tcp --dport ${port} -j DROP -m comment --comment "av-whitelist-default-deny"`);
+    ufw.push(`ufw deny ${port}/tcp comment "av-whitelist-default-deny"`);
+    return { iptables, ufw, ip6tables };
+}
+// ---------------------------------------------------------------------------
+// IpWhitelistManager
+// ---------------------------------------------------------------------------
+export class IpWhitelistManager {
+    entries;
+    constructor(entries = []) {
+        this.entries = entries;
+    }
+    /** Add a new entry, validating first. Throws on invalid input. */
+    add(entry) {
+        const result = validateCidr(entry.cidr);
+        if (!result.valid) {
+            throw new Error(`Invalid whitelist entry "${entry.cidr}": ${result.errors.join('; ')}`);
+        }
+        this.entries.push(entry);
+    }
+    /** Remove all entries matching `label`. */
+    remove(label) {
+        this.entries = this.entries.filter(e => e.label !== label);
+    }
+    /** Return all entries. */
+    getEntries() {
+        return this.entries;
+    }
+    /** Test whether `sourceIp` is allowed by the current whitelist. */
+    isAllowed(sourceIp) {
+        return isIpAllowed(sourceIp, this.entries);
+    }
+    /**
+     * Assert that `sourceIp` is whitelisted. Throws if it is not.
+     * Use this as a guard at trade-execution entry points.
+     */
+    assertAllowed(sourceIp) {
+        if (!this.isAllowed(sourceIp)) {
+            throw new Error(`Blocked: source IP ${sourceIp} is not in the trading whitelist. ` +
+                'Update the whitelist configuration and restart the service.');
+        }
+    }
+    /** Validate every entry and return aggregated errors. */
+    validate() {
+        const errors = [];
+        for (const entry of this.entries) {
+            const r = validateCidr(entry.cidr);
+            if (!r.valid) {
+                errors.push(`[${entry.label}] ${r.errors.join('; ')}`);
+            }
+        }
+        return { valid: errors.length === 0, errors };
+    }
+    /** Generate firewall rules for a given port. */
+    generateRules(port, chain) {
+        return generateFirewallRules(this.entries, port, chain);
+    }
+}
+//# sourceMappingURL=ip-whitelist.js.map