dexbot 1.4.11 → 1.4.13

package/dist/modules/credential_policy.d.ts

@@ -31,7 +31,7 @@ declare const BUILTIN_DEFAULT_POLICY: Readonly<{
         credit_deal_repay: null;
         credit_deal_update: null;
     }>;
-    maxOpsPerBatch: 200;
+    maxOpsPerBatch: number;
     allowedAssetIds: null;
     executable: null;
 }>;
@@ -44,8 +44,7 @@ type AssetResolver = (assetRef: string) => Promise<string | null>;
 declare function setExternalAssetResolver(resolver: AssetResolver | null): void;
 /**
  * Check that a policy config file has restrictive permissions (0o600).
- * MIGRATION: Auto-remediates legacy 0o644 mode with a warning, matching
- * the behavior of checkKeysFileSecurity in chain_keys.ts.
+ * Fails closed on any violation (world-readable mode, symlink, wrong owner).
  *
  * @param {string} filePath - Path to daemon-policies.json
  */
@@ -161,13 +160,11 @@ declare function loadBotHmacSecret(accountName: string, policyConfigPath: string
  *
  * @param {object} request - Parsed request: { accountName, sessionId, operations, hmac }
  * @param {object|null} policyConfig - Loaded daemon-policies.json content
- * @returns {{ valid: boolean, reason: string|null, skipped: boolean }}
- *   skipped is always false — missing secrets are rejected in strict mode.
+ * @returns {{ valid: boolean, reason: string|null }}
  */
 declare function verifySourceHmac(request: any, policyConfig: any): {
     valid: boolean;
     reason: string | null;
-    skipped: boolean;
 };
 export { POLICY_DENIED_PREFIX, BUILTIN_DEFAULT_POLICY, checkPolicyFileSecurity, ensurePolicyConfig, loadPolicyConfig, loadRequiredPolicyConfig, reloadPolicyFromDisk, validatePolicyConfig, deriveDebtPolicyConstraints, resolveAccountPolicy, buildPolicyContext, evaluatePolicy, verifySourceHmac, loadBotHmacSecret, setExternalAssetResolver };
 //# sourceMappingURL=credential_policy.d.ts.map

package/dist/modules/credential_policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential_policy.d.ts","sourceRoot":"","sources":["../../modules/credential_policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH,QAAA,MAAM,oBAAoB,oBAAoB,CAAC;AAG/C,UAAU,aAAa;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,GAAG,EAAE,CAAC;CACrB;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;CAClD;AAKD,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;EAe1B,CAAC;AAMH,KAAK,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAGlE;;;;GAIG;AACH,iBAAS,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAEtE;AAsHD;;;;;;GAMG;AACH,iBAAS,uBAAuB,CAAC,QAAQ,EAAE,MAAM,QAchD;AAED;;;;;;;;GAQG;AACH,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAe1D;AAED;;;;;;;GAOG;AACH,iBAAS,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,YAAY,GAAG,IAAI,CAexG;AAED;;;;;;;;;;;;;GAaG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,YAAY,GAAG,IAAI,CASvG;AAED;;;;;;;GAOG;AACH,iBAAS,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAahE;AA6HD;;GAEG;AACH,iBAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA8C5E;AAwED;;;;;;;;;;GAUG;AACH,iBAAS,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkE7E;AAED;;;GAGG;AACH,iBAAS,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAwBnE;AAED;;GAEG;AACH,iBAAS,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,aAAa,CAQvD;AA4KD;;;GAGG;AACH,iBAAe,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA8J9I;AAwFD;;;;;;;;;;;;;;;;GAgBG;AACH,iBAAS,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,GAAG,IAAI,CA+E5I;AAED;;;;;;;;GAQG;AACH,iBAAS,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAmCtH;AAED,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAA"}
+{"version":3,"file":"credential_policy.d.ts","sourceRoot":"","sources":["../../modules/credential_policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgCH,QAAA,MAAM,oBAAoB,oBAAoB,CAAC;AAG/C,UAAU,aAAa;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,GAAG,EAAE,CAAC;CACrB;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;CAClD;AAKD,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;EAe1B,CAAC;AAMH,KAAK,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAGlE;;;;GAIG;AACH,iBAAS,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAEtE;AAsHD;;;;;GAKG;AACH,iBAAS,uBAAuB,CAAC,QAAQ,EAAE,MAAM,QAGhD;AAED;;;;;;;;GAQG;AACH,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAe1D;AAED;;;;;;;GAOG;AACH,iBAAS,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,YAAY,GAAG,IAAI,CAexG;AAED;;;;;;;;;;;;;GAaG;AACH,iBAAS,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,YAAY,GAAG,IAAI,CASvG;AAED;;;;;;;GAOG;AACH,iBAAS,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAahE;AA6HD;;GAEG;AACH,iBAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA8C5E;AA+DD;;;;;;;;;;GAUG;AACH,iBAAS,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkE7E;AAED;;;GAGG;AACH,iBAAS,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAwBnE;AAED;;GAEG;AACH,iBAAS,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,aAAa,CAQvD;AA4KD;;;GAGG;AACH,iBAAe,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA+I9I;AAwFD;;;;;;;;;;;;;;;;GAgBG;AACH,iBAAS,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,GAAG,IAAI,CA+E5I;AAED;;;;;;;GAOG;AACH,iBAAS,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAmCpG;AAED,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAA"}

package/dist/modules/credential_policy.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * DEXBot2 Credential Daemon Policy Engine
  *
@@ -7,82 +6,32 @@
  * AND semantics: all policies must allow, or signing is denied.
  * Default-deny on errors: validation failures, executable timeouts, etc.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BUILTIN_DEFAULT_POLICY = exports.POLICY_DENIED_PREFIX = void 0;
-exports.checkPolicyFileSecurity = checkPolicyFileSecurity;
-exports.ensurePolicyConfig = ensurePolicyConfig;
-exports.loadPolicyConfig = loadPolicyConfig;
-exports.loadRequiredPolicyConfig = loadRequiredPolicyConfig;
-exports.reloadPolicyFromDisk = reloadPolicyFromDisk;
-exports.validatePolicyConfig = validatePolicyConfig;
-exports.deriveDebtPolicyConstraints = deriveDebtPolicyConstraints;
-exports.resolveAccountPolicy = resolveAccountPolicy;
-exports.buildPolicyContext = buildPolicyContext;
-exports.evaluatePolicy = evaluatePolicy;
-exports.verifySourceHmac = verifySourceHmac;
-exports.loadBotHmacSecret = loadBotHmacSecret;
-exports.setExternalAssetResolver = setExternalAssetResolver;
-const path_api_1 = require("./path_api");
-const sync_1 = require("./crypto/sync");
-const client = __importStar(require("./bitshares_client"));
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+import { path } from './path_api.js';
+import { randomBytes, createHmac, timingSafeEqual } from './crypto/sync.js';
+import * as client from './bitshares_client.js';
 const { BitShares } = client;
-const math_1 = require("./order/utils/math");
-const system_1 = require("./order/utils/system");
-const constants_1 = require("./constants");
-const credential_runtime_1 = require("./credential_runtime");
-const paths_1 = require("./paths");
-const logger_1 = __importDefault(require("./logger"));
-const storage_1 = require("./storage");
-const runtime_1 = require("./runtime");
-const fs_utils_1 = require("./utils/fs_utils");
-const lru_cache_1 = require("./bitshares-native/lru_cache");
-const errors_1 = require("./utils/errors");
-const { RESOLVERS } = constants_1.NATIVE_CLIENT;
-const storage = (0, storage_1.getStorage)();
+import { isPositiveInt } from './order/utils/math.js';
+import { parseJsonWithComments } from './order/utils/system.js';
+import { FEE_PARAMETERS, NATIVE_CLIENT } from './constants.js';
+import { getCredentialReadyFilePath, assertPrivatePathSecurity } from './credential_runtime.js';
+import { PATHS } from './paths.js';
+import Logger from './logger.js';
+import { getStorage } from './storage/index.js';
+import { runtime } from './runtime.js';
+import { LRUCache } from './bitshares-native/lru_cache.js';
+import { getErrorMessage } from './utils/errors.js';
+const { RESOLVERS } = NATIVE_CLIENT;
+const storage = getStorage();
+const { readJSON } = storage;
 // Module-scope logger for library-style helpers that don't own a process
 // logger.  The class honours PM2 auto-quiet and routes to a log file when one
 // is configured, matching the rest of the codebase.
-const policyLogger = new logger_1.default('credential-policy');
-const BOTS_JSON_PATH = paths_1.PATHS.PROFILES.BOTS_JSON;
+const policyLogger = new Logger('credential-policy');
+const BOTS_JSON_PATH = PATHS.PROFILES.BOTS_JSON;
 const ASSET_OBJECT_ID_PATTERN = /^1\.3\.\d+$/;
 const POLICY_DENIED_PREFIX = 'POLICY_DENIED: ';
-exports.POLICY_DENIED_PREFIX = POLICY_DENIED_PREFIX;
 const EXECUTABLE_TIMEOUT_MS = 5000;
 // Hardcoded baseline policy used when resolving policy layers in-process.
 // The credential daemon now requires an explicit on-disk policy file and
@@ -99,13 +48,12 @@ const BUILTIN_DEFAULT_POLICY = Object.freeze({
         credit_deal_repay: null,
         credit_deal_update: null,
     }),
-    maxOpsPerBatch: 200,
+    maxOpsPerBatch: NATIVE_CLIENT.TRANSACTION.MAX_OPS_PER_TX,
     allowedAssetIds: null,
     executable: null,
 });
-exports.BUILTIN_DEFAULT_POLICY = BUILTIN_DEFAULT_POLICY;
 const policyCache = new Map();
-const assetRefResolutionCache = new lru_cache_1.LRUCache(RESOLVERS.LRU_DEFAULT_SIZE, RESOLVERS.ASSET_TTL_MS);
+const assetRefResolutionCache = new LRUCache(RESOLVERS.LRU_DEFAULT_SIZE, RESOLVERS.ASSET_TTL_MS);
 let _externalAssetResolver = null;
 /**
  * Register an external asset-ref resolver used by the credential daemon.
@@ -188,7 +136,7 @@ function normalizeGrapheneCollateralRatio(value) {
     const numeric = Number(value);
     if (!Number.isFinite(numeric) || numeric <= 0)
         return null;
-    const denom = constants_1.FEE_PARAMETERS.GRAPHENE_COLLATERAL_RATIO_DENOM;
+    const denom = FEE_PARAMETERS.GRAPHENE_COLLATERAL_RATIO_DENOM;
     return numeric >= denom ? numeric / denom : numeric;
 }
 function createMinimalPolicyConfig() {
@@ -206,13 +154,13 @@ function readPolicyConfigDetailed(filePath) {
     }
     let raw;
     try {
-        raw = (0, fs_utils_1.readJSON)(filePath);
+        raw = readJSON(filePath);
     }
     catch (error) {
         return {
             status: 'invalid',
             config: null,
-            error: `failed to load config: ${(0, errors_1.getErrorMessage)(error)}`,
+            error: `failed to load config: ${getErrorMessage(error)}`,
         };
     }
     const { valid, errors } = validatePolicyConfig(raw);
@@ -231,27 +179,14 @@ function readPolicyConfigDetailed(filePath) {
 }
 /**
  * Check that a policy config file has restrictive permissions (0o600).
- * MIGRATION: Auto-remediates legacy 0o644 mode with a warning, matching
- * the behavior of checkKeysFileSecurity in chain_keys.ts.
+ * Fails closed on any violation (world-readable mode, symlink, wrong owner).
  *
  * @param {string} filePath - Path to daemon-policies.json
  */
 function checkPolicyFileSecurity(filePath) {
     if (!storage.exists(filePath))
         return;
-    try {
-        (0, credential_runtime_1.assertPrivatePathSecurity)(filePath, { expectedType: 'file', requiredMode: 0o600 });
-    }
-    catch (err) {
-        const stat = storage.lstat(filePath);
-        const mode = stat.mode & 0o777;
-        if (mode === 0o644 && !stat.isSymbolicLink()) {
-            storage.chmod(filePath, 0o600);
-            policyLogger.warn(`[security] Auto-fixed ${filePath} permissions from 0o644 to 0o600. Run: chmod 600 profiles/daemon-policies.json`);
-            return;
-        }
-        throw err;
-    }
+    assertPrivatePathSecurity(filePath, { expectedType: 'file', requiredMode: 0o600 });
 }
 /**
  * Ensure daemon-policies.json exists before the credential daemon starts.
@@ -265,12 +200,12 @@ function checkPolicyFileSecurity(filePath) {
 function ensurePolicyConfig(filePath) {
     if (!storage.exists(filePath)) {
         try {
-            storage.ensureDir(path_api_1.path.dirname(filePath));
+            storage.ensureDir(path.dirname(filePath));
             storage.writeJSON(filePath, createMinimalPolicyConfig(), { mode: 0o600, flag: 'wx' });
         }
         catch (err) {
             if (err.code !== 'EEXIST') {
-                const wrapped = new Error(`Failed to create required policy config: ${(0, errors_1.getErrorMessage)(err)}`);
+                const wrapped = new Error(`Failed to create required policy config: ${getErrorMessage(err)}`);
                 wrapped.code = 'POLICY_CONFIG_CREATE_FAILED';
                 throw wrapped;
             }
@@ -322,7 +257,7 @@ function reloadPolicyFromDisk(filePath, options = {}) {
     catch (err) {
         if (strict)
             throw err;
-        policyLogger.warn(`[policy] Reload from ${filePath} failed: ${(0, errors_1.getErrorMessage)(err)} — keeping in-memory config`);
+        policyLogger.warn(`[policy] Reload from ${filePath} failed: ${getErrorMessage(err)} — keeping in-memory config`);
         return null;
     }
 }
@@ -365,7 +300,7 @@ function validateOpConstraints(opName, constraints) {
             errors.push('allowedToAccounts must be an array of strings');
         if (constraints.allowedAssets !== undefined && !isStringArray(constraints.allowedAssets))
             errors.push('allowedAssets must be an array of strings');
-        if (constraints.maxAmount !== undefined && !(0, math_1.isPositiveInt)(constraints.maxAmount))
+        if (constraints.maxAmount !== undefined && !isPositiveInt(constraints.maxAmount))
             errors.push('maxAmount must be a positive integer');
     }
     // Fields valid for limit_order_create and limit_order_update
@@ -381,16 +316,16 @@ function validateOpConstraints(opName, constraints) {
     }
     // maxSellAmount, maxReceiveAmount, allowFillOrKill — only for limit_order_create
     if (opName === 'limit_order_create') {
-        if (constraints.maxSellAmount !== undefined && !(0, math_1.isPositiveInt)(constraints.maxSellAmount))
+        if (constraints.maxSellAmount !== undefined && !isPositiveInt(constraints.maxSellAmount))
             errors.push('maxSellAmount must be a positive integer');
-        if (constraints.maxReceiveAmount !== undefined && !(0, math_1.isPositiveInt)(constraints.maxReceiveAmount))
+        if (constraints.maxReceiveAmount !== undefined && !isPositiveInt(constraints.maxReceiveAmount))
             errors.push('maxReceiveAmount must be a positive integer');
         if (constraints.allowFillOrKill !== undefined && typeof constraints.allowFillOrKill !== 'boolean')
             errors.push('allowFillOrKill must be a boolean');
     }
     // maxDeltaSellAmount — only for limit_order_update
     if (opName === 'limit_order_update') {
-        if (constraints.maxDeltaSellAmount !== undefined && !(0, math_1.isPositiveInt)(constraints.maxDeltaSellAmount))
+        if (constraints.maxDeltaSellAmount !== undefined && !isPositiveInt(constraints.maxDeltaSellAmount))
             errors.push('maxDeltaSellAmount must be a positive integer');
     }
     // call_order_update
@@ -401,9 +336,9 @@ function validateOpConstraints(opName, constraints) {
             errors.push('collateralAsset must be a string');
         if (constraints.allowedCollateralAssets !== undefined && !isStringArray(constraints.allowedCollateralAssets))
             errors.push('allowedCollateralAssets must be an array of strings');
-        if (constraints.maxDeltaCollateral !== undefined && !(0, math_1.isPositiveInt)(constraints.maxDeltaCollateral))
+        if (constraints.maxDeltaCollateral !== undefined && !isPositiveInt(constraints.maxDeltaCollateral))
             errors.push('maxDeltaCollateral must be a positive integer');
-        if (constraints.maxDeltaDebt !== undefined && !(0, math_1.isPositiveInt)(constraints.maxDeltaDebt))
+        if (constraints.maxDeltaDebt !== undefined && !isPositiveInt(constraints.maxDeltaDebt))
             errors.push('maxDeltaDebt must be a positive integer');
         if (constraints.minCollateralRatio !== undefined && typeof constraints.minCollateralRatio !== 'number')
             errors.push('minCollateralRatio must be a number');
@@ -422,18 +357,18 @@ function validateOpConstraints(opName, constraints) {
             errors.push('allowedCollateralAssets must be an array of strings');
         if (constraints.allowedDebtAssets !== undefined && !isStringArray(constraints.allowedDebtAssets))
             errors.push('allowedDebtAssets must be an array of strings');
-        if (constraints.maxFeeRate !== undefined && !(0, math_1.isPositiveInt)(constraints.maxFeeRate))
+        if (constraints.maxFeeRate !== undefined && !isPositiveInt(constraints.maxFeeRate))
             errors.push('maxFeeRate must be a positive integer');
-        if (constraints.minDurationSeconds !== undefined && !(0, math_1.isPositiveInt)(constraints.minDurationSeconds))
+        if (constraints.minDurationSeconds !== undefined && !isPositiveInt(constraints.minDurationSeconds))
             errors.push('minDurationSeconds must be a positive integer');
     }
     // credit_deal_repay
     if (opName === 'credit_deal_repay') {
         if (constraints.disallowedDealIds !== undefined && !isStringArray(constraints.disallowedDealIds))
             errors.push('disallowedDealIds must be an array of strings');
-        if (constraints.maxRepayAmount !== undefined && !(0, math_1.isPositiveInt)(constraints.maxRepayAmount))
+        if (constraints.maxRepayAmount !== undefined && !isPositiveInt(constraints.maxRepayAmount))
             errors.push('maxRepayAmount must be a positive integer');
-        if (constraints.maxCreditFee !== undefined && !(0, math_1.isPositiveInt)(constraints.maxCreditFee))
+        if (constraints.maxCreditFee !== undefined && !isPositiveInt(constraints.maxCreditFee))
             errors.push('maxCreditFee must be a positive integer');
     }
     // credit_deal_update
@@ -451,7 +386,7 @@ function validateOpConstraints(opName, constraints) {
             errors.push('allowedSellAssets must be an array of strings');
         if (constraints.allowedReceiveAssets !== undefined && !isStringArray(constraints.allowedReceiveAssets))
             errors.push('allowedReceiveAssets must be an array of strings');
-        if (constraints.maxSellAmount !== undefined && !(0, math_1.isPositiveInt)(constraints.maxSellAmount))
+        if (constraints.maxSellAmount !== undefined && !isPositiveInt(constraints.maxSellAmount))
             errors.push('maxSellAmount must be a positive integer');
     }
     // limit_order_cancel has no constraints
@@ -510,15 +445,6 @@ function validatePolicyConfig(raw) {
  */
 function validatePolicyObject(policy) {
     const errors = [];
-    // allowedOpTypes: must be array of strings
-    if (policy.allowedOpTypes !== undefined) {
-        if (!Array.isArray(policy.allowedOpTypes)) {
-            errors.push('allowedOpTypes must be an array');
-        }
-        else if (!policy.allowedOpTypes.every((x) => typeof x === 'string')) {
-            errors.push('allowedOpTypes must be an array of strings');
-        }
-    }
     // maxOpsPerBatch: must be positive integer
     if (policy.maxOpsPerBatch !== undefined) {
         if (typeof policy.maxOpsPerBatch !== 'number' || policy.maxOpsPerBatch <= 0) {
@@ -590,7 +516,7 @@ function deriveDebtPolicyConstraints(accountName) {
         if (!storage.exists(BOTS_JSON_PATH))
             return {};
         const raw = storage.readFile(BOTS_JSON_PATH);
-        const parsed = (0, system_1.parseJsonWithComments)(raw);
+        const parsed = parseJsonWithComments(raw);
         const bots = Array.isArray(parsed)
             ? parsed.filter(Boolean)
             : (Array.isArray(parsed?.bots) ? parsed.bots.filter(Boolean) : []);
@@ -880,7 +806,7 @@ async function evaluateOpConstraints(opName, opData, constraints) {
  */
 async function evaluatePolicy(policy, context) {
     try {
-        // Step 1: allowedOps check (if present) or allowedOpTypes fallback
+        // Step 1: allowedOps check (if present)
         if (policy.allowedOps && typeof policy.allowedOps === 'object') {
             for (const op of context.operations) {
                 if (!op || typeof op !== 'object')
@@ -902,26 +828,9 @@ async function evaluatePolicy(policy, context) {
                 }
             }
         }
-        else {
-            // Fallback: allowedOpTypes check (backward compat)
-            const allowed = policy.allowedOpTypes || [];
-            if (Array.isArray(allowed) && allowed.length > 0) {
-                for (const op of context.operations) {
-                    if (!op || typeof op !== 'object')
-                        continue;
-                    if (!allowed.includes(op.op_name)) {
-                        return {
-                            allow: false,
-                            reason: `op type "${op.op_name}" not permitted`,
-                            policyId: 'allowedOpTypes',
-                        };
-                    }
-                }
-            }
-        }
         // Step 2: maxOpsPerBatch check
         {
-            const max = policy.maxOpsPerBatch || 200;
+            const max = policy.maxOpsPerBatch || NATIVE_CLIENT.TRANSACTION.MAX_OPS_PER_TX;
             if (context.operations.length > max) {
                 return {
                     allow: false,
@@ -1025,7 +934,7 @@ async function evaluatePolicy(policy, context) {
         // Any evaluation error → deny
         return {
             allow: false,
-            reason: `policy evaluation error: ${(0, errors_1.getErrorMessage)(error)}`,
+            reason: `policy evaluation error: ${getErrorMessage(error)}`,
             policyId: 'policy_eval_error',
         };
     }
@@ -1072,7 +981,7 @@ function evaluateExecutable(exePath, context) {
                 resolve({ allow: false, reason: `executable timed out after ${EXECUTABLE_TIMEOUT_MS}ms` });
             }
             else {
-                resolve({ allow: false, reason: `executable spawn failed: ${(0, errors_1.getErrorMessage)(error)}` });
+                resolve({ allow: false, reason: `executable spawn failed: ${getErrorMessage(error)}` });
             }
         });
         child.on('close', (code, signal) => {
@@ -1095,7 +1004,7 @@ function evaluateExecutable(exePath, context) {
                 });
             }
             catch (error) {
-                resolve({ allow: false, reason: `executable output invalid JSON: ${(0, errors_1.getErrorMessage)(error)}` });
+                resolve({ allow: false, reason: `executable output invalid JSON: ${getErrorMessage(error)}` });
             }
         });
         // Send context to stdin
@@ -1105,7 +1014,7 @@ function evaluateExecutable(exePath, context) {
         }
         catch (error) {
             child.kill();
-            resolve({ allow: false, reason: `failed to pipe context to executable: ${(0, errors_1.getErrorMessage)(error)}` });
+            resolve({ allow: false, reason: `failed to pipe context to executable: ${getErrorMessage(error)}` });
         }
     });
 }
@@ -1155,7 +1064,7 @@ function loadBotHmacSecret(accountName, policyConfigPath, options = {}) {
         config.accounts[accountName] = {};
     let secret = config.accounts[accountName].botHmacSecret;
     if (!secret) {
-        const newSecret = (0, sync_1.randomBytes)(32).toString('hex');
+        const newSecret = randomBytes(32).toString('hex');
         config.accounts[accountName].botHmacSecret = newSecret;
         // Atomic write via unified StorageAdapter.
         storage.writeJSON(policyConfigPath, config, { mode: 0o600, fsync: true });
@@ -1170,7 +1079,7 @@ function loadBotHmacSecret(accountName, policyConfigPath, options = {}) {
         //   - process.kill error (ESRCH=process gone, EPERM=not allowed):
         //     warn — the fs.watch safety net will still pick up the change
         try {
-            const readyFile = (0, credential_runtime_1.getCredentialReadyFilePath)({ root: paths_1.PATHS.PROJECT_ROOT });
+            const readyFile = getCredentialReadyFilePath({ root: PATHS.PROJECT_ROOT });
             if (!storage.exists(readyFile)) {
                 info(`[policy] Ready file ${readyFile} not present; daemon not running, SIGHUP skipped`);
                 secret = newSecret;
@@ -1187,7 +1096,7 @@ function loadBotHmacSecret(accountName, policyConfigPath, options = {}) {
             }
             const daemonInfo = JSON.parse(raw);
             if (daemonInfo && typeof daemonInfo.pid === 'number') {
-                runtime_1.runtime.kill(daemonInfo.pid, 'SIGHUP');
+                runtime.kill(daemonInfo.pid, 'SIGHUP');
                 info(`[policy] Sent SIGHUP to credential daemon (pid ${daemonInfo.pid}) to activate new secret`);
             }
             else {
@@ -1199,13 +1108,13 @@ function loadBotHmacSecret(accountName, policyConfigPath, options = {}) {
                 info(`[policy] Ready file not present; daemon not running, SIGHUP skipped`);
             }
             else if (e instanceof SyntaxError) {
-                warn(`[policy] Ready file is malformed JSON (${(0, errors_1.getErrorMessage)(e)}); SIGHUP skipped, fs.watch will pick up the change`);
+                warn(`[policy] Ready file is malformed JSON (${getErrorMessage(e)}); SIGHUP skipped, fs.watch will pick up the change`);
             }
             else if (e && (e.code === 'ESRCH' || e.code === 'EPERM')) {
-                warn(`[policy] SIGHUP to daemon failed (${e.code}: ${(0, errors_1.getErrorMessage)(e)}); fs.watch will pick up the change`);
+                warn(`[policy] SIGHUP to daemon failed (${e.code}: ${getErrorMessage(e)}); fs.watch will pick up the change`);
             }
             else {
-                warn(`[policy] Unexpected error signalling daemon (${e && (0, errors_1.getErrorMessage)(e)}); fs.watch will pick up the change`);
+                warn(`[policy] Unexpected error signalling daemon (${e && getErrorMessage(e)}); fs.watch will pick up the change`);
             }
         }
         secret = newSecret;
@@ -1218,35 +1127,35 @@ function loadBotHmacSecret(accountName, policyConfigPath, options = {}) {
  *
  * @param {object} request - Parsed request: { accountName, sessionId, operations, hmac }
  * @param {object|null} policyConfig - Loaded daemon-policies.json content
- * @returns {{ valid: boolean, reason: string|null, skipped: boolean }}
- *   skipped is always false — missing secrets are rejected in strict mode.
+ * @returns {{ valid: boolean, reason: string|null }}
  */
 function verifySourceHmac(request, policyConfig) {
     const accountPolicy = policyConfig && policyConfig.accounts && policyConfig.accounts[request.accountName];
     const secretHex = accountPolicy && accountPolicy.botHmacSecret;
     // Strict Mode Enforcement: Reject instantly if no secret is configured
     if (!secretHex) {
-        return { valid: false, reason: 'Strict Mode: botHmacSecret missing in daemon-policies.json', skipped: false };
+        return { valid: false, reason: 'Strict Mode: botHmacSecret missing in daemon-policies.json' };
     }
     const providedHmac = request.hmac;
     if (!providedHmac || typeof providedHmac !== 'string') {
-        return { valid: false, reason: 'missing hmac field', skipped: false };
+        return { valid: false, reason: 'missing hmac field' };
     }
     // Canonical signing payload: must match exactly what the bot computed
     const signingPayload = JSON.stringify({
         sessionId: request.sessionId,
         operations: request.operations,
     });
-    const expected = (0, sync_1.createHmac)('sha256', Buffer.from(secretHex, 'hex'))
+    const expected = createHmac('sha256', Buffer.from(secretHex, 'hex'))
         .update(signingPayload)
         .digest('hex');
     try {
-        const valid = (0, sync_1.timingSafeEqual)(Buffer.from(expected, 'hex'), Buffer.from(providedHmac, 'hex'));
-        return { valid, reason: valid ? null : 'hmac mismatch', skipped: false };
+        const valid = timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(providedHmac, 'hex'));
+        return { valid, reason: valid ? null : 'hmac mismatch' };
     }
     catch {
         // Buffer.from throws if provided hmac is not valid hex or wrong length
-        return { valid: false, reason: 'invalid hmac format', skipped: false };
+        return { valid: false, reason: 'invalid hmac format' };
     }
 }
+export { POLICY_DENIED_PREFIX, BUILTIN_DEFAULT_POLICY, checkPolicyFileSecurity, ensurePolicyConfig, loadPolicyConfig, loadRequiredPolicyConfig, reloadPolicyFromDisk, validatePolicyConfig, deriveDebtPolicyConstraints, resolveAccountPolicy, buildPolicyContext, evaluatePolicy, verifySourceHmac, loadBotHmacSecret, setExternalAssetResolver };
 //# sourceMappingURL=credential_policy.js.map