gnoman 0.1.0

package/dist/main/src/utils/abiResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abiResolver.js","sourceRoot":"","sources":["../../../../src/utils/abiResolver.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,4CAAoB;AACpB,gDAAwB;AACxB,mCAA+C;AAC/C,mDAAgD;AAChD,uDAAkD;AAClD,iEAA8D;AAW9D,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;AAEzD,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAE,EAAE;IAC3C,IAAI,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAA,mBAAU,EAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AAClH,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;AAI5F,MAAM,SAAS,GAAG,CAAC,OAAe,EAA8B,EAAE;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA+B,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,KAAiC,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,YAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,OAAyB,EAAE,EAAE;IACjF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,YAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACtF,OAAO;KACR,CAAC;IACF,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAa,EAAE;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAe,EAAE,OAAe,EAAE,EAAE;IACrE,MAAM,GAAG,GAAG,kDAAkD,OAAO,IAAI,OAAO,gBAAgB,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAI,QAAQ,CAAC,IAAoG,IAAI,EAAE,CAAC;QACpI,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACxF,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpI,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,EAAE,OAAe,EAAE,OAAe,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,+BAAa,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,MAAM,WAAI,CAAC,GAAG,CAAC,EAAE,EAAE;QACxC,MAAM,EAAE;YACN,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,OAAO;YAChB,OAAO;YACP,MAAM,EAAE,MAAM;SACf;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,IAA8E,CAAC;IAC7G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,4CAA4C,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAExJ,MAAM,WAAW,GAAG,MAAM,WAAI,CAAC,GAAG,CAAC,EAAE,EAAE;QACrC,MAAM,EAAE;YACN,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,MAAM;SACf;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,IAA4C,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO;QACL,GAAG;QACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,IAAI;QAC9D,MAAM,EAAE,WAAoB;QAC5B,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAA8E,CAAC;IAC/I,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;QACtC,MAAM,EAAE,QAAiB;QACzB,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAa,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,YAAoB;QACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,YAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAqB,CAAC;YACtF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/K,2CAAoB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClP,OAAO,MAAM,CAAC;QAChB,CAAC;QAGD,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;QAClG,IAAI,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAoC,CAAC;YAClG,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAqB;gBAChC,GAAG;gBACH,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,IAAI;gBAC/D,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,aAAa;gBACxB,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACjL,2CAAoB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtP,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,QAAQ,IAAI,SAAS,IAAI,MAAM,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAqB;YAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,aAAa;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;QACF,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzL,2CAAoB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9P,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AApDD,kCAoDC;AAEY,QAAA,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/main/src/utils/runtimeObservability.js

@@ -0,0 +1,78 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeObservability = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const MAX_EVENTS = 20;
+const debugPath = path_1.default.join(process.cwd(), '.gnoman', 'run-debug.jsonl');
+const state = {
+    secrets: [],
+    abiResolves: [],
+    robinhoodEnabled: false,
+    robinhoodAuth: { ok: false, reason: 'Not attempted' },
+    robinhoodRequests: [],
+    robinhoodOrders: [],
+    noBroadcastReason: null,
+    safeExecutionTrace: null
+};
+const pushBounded = (arr, value) => {
+    arr.unshift(value);
+    if (arr.length > MAX_EVENTS) {
+        arr.splice(MAX_EVENTS);
+    }
+};
+const appendArtifact = (type, payload) => {
+    fs_1.default.mkdirSync(path_1.default.dirname(debugPath), { recursive: true });
+    fs_1.default.appendFileSync(debugPath, `${JSON.stringify({ type, at: new Date().toISOString(), payload })}\n`, 'utf8');
+};
+exports.runtimeObservability = {
+    setSecretAudit(records) {
+        state.secrets = records;
+        appendArtifact('SECRET_AUDIT', records);
+    },
+    pushAbiResolved(event) {
+        pushBounded(state.abiResolves, event);
+        appendArtifact('ABI_RESOLVED', event);
+    },
+    setRobinhoodEnabled(enabled) {
+        state.robinhoodEnabled = enabled;
+    },
+    setRobinhoodAuth(ok, reason) {
+        state.robinhoodAuth = { ok, reason };
+        appendArtifact('ROBINHOOD_AUTH', state.robinhoodAuth);
+    },
+    pushRobinhoodRequest(event) {
+        pushBounded(state.robinhoodRequests, event);
+        appendArtifact('ROBINHOOD_REQUEST', event);
+    },
+    pushRobinhoodOrder(event) {
+        pushBounded(state.robinhoodOrders, event);
+        appendArtifact('ROBINHOOD_ORDER', event);
+    },
+    setNoBroadcastReason(reason) {
+        state.noBroadcastReason = reason;
+        appendArtifact('NO_BROADCAST_REASON', reason);
+    },
+    setSafeExecutionTrace(trace) {
+        state.safeExecutionTrace = trace;
+        appendArtifact('SAFE_EXECUTION_TRACE', trace);
+    },
+    snapshot() {
+        return {
+            secrets: state.secrets,
+            abiResolves: state.abiResolves,
+            robinhood: {
+                enabled: state.robinhoodEnabled,
+                auth: state.robinhoodAuth,
+                requests: state.robinhoodRequests,
+                orders: state.robinhoodOrders
+            },
+            noBroadcastReason: state.noBroadcastReason,
+            safeExecutionTrace: state.safeExecutionTrace
+        };
+    }
+};
+//# sourceMappingURL=runtimeObservability.js.map

package/dist/main/src/utils/runtimeObservability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeObservability.js","sourceRoot":"","sources":["../../../../src/utils/runtimeObservability.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAoCxB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEzE,MAAM,KAAK,GAAG;IACZ,OAAO,EAAE,EAAyB;IAClC,WAAW,EAAE,EAAuB;IACpC,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE;IACrD,iBAAiB,EAAE,EAA6B;IAChD,eAAe,EAAE,EAA2B;IAC5C,iBAAiB,EAAE,IAAsC;IACzD,kBAAkB,EAAE,IAAsC;CAC3D,CAAC;AAEF,MAAM,WAAW,GAAG,CAAI,GAAQ,EAAE,KAAQ,EAAE,EAAE;IAC5C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE;IACxD,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,YAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/G,CAAC,CAAC;AAEW,QAAA,oBAAoB,GAAG;IAClC,cAAc,CAAC,OAA4B;QACzC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,eAAe,CAAC,KAAsB;QACpC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtC,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,mBAAmB,CAAC,OAAgB;QAClC,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC;IACnC,CAAC;IACD,gBAAgB,CAAC,EAAW,EAAE,MAAc;QAC1C,KAAK,CAAC,aAAa,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACrC,cAAc,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC;IACD,oBAAoB,CAAC,KAA4B;QAC/C,WAAW,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,kBAAkB,CAAC,KAA0B;QAC3C,WAAW,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC1C,cAAc,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,oBAAoB,CAAC,MAA+B;QAClD,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACjC,cAAc,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,qBAAqB,CAAC,KAA8B;QAClD,KAAK,CAAC,kBAAkB,GAAG,KAAK,CAAC;QACjC,cAAc,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE;gBACT,OAAO,EAAE,KAAK,CAAC,gBAAgB;gBAC/B,IAAI,EAAE,KAAK,CAAC,aAAa;gBACzB,QAAQ,EAAE,KAAK,CAAC,iBAAiB;gBACjC,MAAM,EAAE,KAAK,CAAC,eAAe;aAC9B;YACD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/main/src/utils/secretsResolver.js

@@ -0,0 +1,138 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditSecretsAtBoot = exports.resolveSecret = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const fileBackend_1 = require("../core/backends/fileBackend");
+const keyringAccessor_1 = __importDefault(require("../../backend/services/keyringAccessor"));
+const runtimeObservability_1 = require("./runtimeObservability");
+const bootEnvKeys = new Set(Object.keys(process.env));
+let dotenvLoaded = false;
+let fileBackend = null;
+let fileSecrets = new Map();
+const GUI_KEYRING_ALLOWED = Boolean(process.env.DISPLAY && process.env.DBUS_SESSION_BUS_ADDRESS);
+const redact = (value) => {
+    if (!value) {
+        return 'MISSING';
+    }
+    const trimmed = value.trim();
+    if (trimmed.length <= 4) {
+        return '****';
+    }
+    return `****${trimmed.slice(-4)}`;
+};
+const loadDotenvFile = () => {
+    const envPath = path_1.default.join(process.cwd(), '.env');
+    if (!fs_1.default.existsSync(envPath)) {
+        return;
+    }
+    const raw = fs_1.default.readFileSync(envPath, 'utf8');
+    for (const line of raw.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        const eq = trimmed.indexOf('=');
+        if (eq === -1) {
+            continue;
+        }
+        const key = trimmed.slice(0, eq).trim();
+        const value = trimmed.slice(eq + 1).trim().replace(/^['"]|['"]$/g, '');
+        if (!(key in process.env)) {
+            process.env[key] = value;
+        }
+    }
+};
+const ensureDotenvLoaded = () => {
+    if (dotenvLoaded) {
+        return;
+    }
+    loadDotenvFile();
+    dotenvLoaded = true;
+};
+const ensureFileSecretsLoaded = async () => {
+    if (fileBackend) {
+        return;
+    }
+    const filePath = process.env.GNOMAN_KEYRING_FILE ?? path_1.default.join(process.cwd(), '.gnoman', 'secrets.enc');
+    fileBackend = new fileBackend_1.FileBackend(filePath);
+    try {
+        await fileBackend.initialize();
+        const listed = await fileBackend.list();
+        fileSecrets = new Map(Object.entries(listed));
+    }
+    catch (error) {
+        console.error(JSON.stringify({ event: 'FILE_SECRET_BACKEND_ERROR', message: String(error) }));
+    }
+};
+const detectEnvSource = (key) => {
+    const value = process.env[key];
+    if (!value?.trim()) {
+        return null;
+    }
+    return bootEnvKeys.has(key) ? 'env' : 'dotenv';
+};
+const resolveSecret = async (key, required = false) => {
+    ensureDotenvLoaded();
+    await ensureFileSecretsLoaded();
+    const checkedSources = ['env', 'dotenv', 'file'];
+    const envSource = detectEnvSource(key);
+    if (envSource) {
+        return { value: process.env[key].trim(), source: envSource, checkedSources };
+    }
+    const fileValue = fileSecrets.get(key)?.trim();
+    if (fileValue) {
+        return { value: fileValue, source: 'file', checkedSources };
+    }
+    if (GUI_KEYRING_ALLOWED) {
+        checkedSources.push('keyring');
+        try {
+            const keyringValue = await keyringAccessor_1.default.get(key);
+            if (keyringValue?.trim()) {
+                return { value: keyringValue.trim(), source: 'keyring', checkedSources };
+            }
+        }
+        catch (error) {
+            console.warn(`Unable to resolve ${key} from keyring`, error);
+        }
+    }
+    const missing = { event: 'MISSING_SECRET', key, checkedSources };
+    console.error(JSON.stringify(missing));
+    if (required) {
+        throw new Error(`${key} is required for this run mode.`);
+    }
+    return { value: undefined, source: 'missing', checkedSources };
+};
+exports.resolveSecret = resolveSecret;
+const auditSecretsAtBoot = async (keys) => {
+    ensureDotenvLoaded();
+    await ensureFileSecretsLoaded();
+    const records = [];
+    for (const { key, required } of keys) {
+        const resolved = await (0, exports.resolveSecret)(key, false);
+        records.push({
+            key,
+            required,
+            present: Boolean(resolved.value),
+            source: resolved.source,
+            redacted: redact(resolved.value),
+            checkedSources: resolved.checkedSources
+        });
+    }
+    runtimeObservability_1.runtimeObservability.setSecretAudit(records);
+    console.info(JSON.stringify({
+        event: 'SECRETS_AUDIT',
+        secrets: records.map((r) => ({
+            key: r.key,
+            required: r.required,
+            present: r.present,
+            source: r.source,
+            value: r.redacted
+        }))
+    }));
+};
+exports.auditSecretsAtBoot = auditSecretsAtBoot;
+//# sourceMappingURL=secretsResolver.js.map

package/dist/main/src/utils/secretsResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsResolver.js","sourceRoot":"","sources":["../../../../src/utils/secretsResolver.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AACxB,8DAA2D;AAC3D,6FAAqE;AACrE,iEAAsF;AAItF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,IAAI,YAAY,GAAG,KAAK,CAAC;AACzB,IAAI,WAAW,GAAuB,IAAI,CAAC;AAC3C,IAAI,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAEjG,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAE,EAAE;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,GAAG,EAAE;IAC1B,MAAM,OAAO,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAG,EAAE;IAC9B,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,cAAc,EAAE,CAAC;IACjB,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,KAAK,IAAI,EAAE;IACzC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACvG,WAAW,GAAG,IAAI,yBAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACxC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAuB,EAAE;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC,CAAC;AAEK,MAAM,aAAa,GAAG,KAAK,EAAE,GAAW,EAAE,QAAQ,GAAG,KAAK,EAAE,EAAE;IACnE,kBAAkB,EAAE,CAAC;IACrB,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAe,EAAE,cAAc,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,yBAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,SAAkB,EAAE,cAAc,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,qBAAqB,GAAG,eAAe,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAkB,EAAE,cAAc,EAAE,CAAC;AAC1E,CAAC,CAAC;AAjCW,QAAA,aAAa,iBAiCxB;AAEK,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAA+C,EAAE,EAAE;IAC1F,kBAAkB,EAAE,CAAC;IACrB,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC;YACX,GAAG;YACH,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC,CAAC,CAAC;IACL,CAAC;IACD,2CAAoB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,kBAAkB,sBA4B7B"}

package/docs/development-guide.md

@@ -0,0 +1,203 @@
+# GNOMAN 2.0 Development Guide
+
+This guide documents the authoritative workflow for standing up a GNOMAN 2.0
+workstation, exercising the offline licensing stack, and producing builds that
+match what ships to customers. Every path is written relative to the repository
+root (the directory that contains `package.json`).
+
+> ℹ️ A byte-for-byte copy of this guide lives at
+> `docs/wiki/development-guide.md` for the in-app wiki. Whenever you update this
+> file, mirror the edits in the wiki directory so desktop users and GitHub
+> readers see the same information.
+
+## 1. Tooling prerequisites
+
+| Tool | Required version | Notes |
+| ---- | ---------------- | ----- |
+| Node.js | 18 LTS | Bundles npm 9, which is required by the build scripts. |
+| npm | 9.x | Installed with Node.js. |
+| Python | 3.10 or newer | Powers the Ed25519 licensing utilities. |
+| pip package | `cryptography` | Install with `pip install cryptography`. |
+| Native build chain | OS specific | Xcode Command Line Tools on macOS, `build-essential` on Linux, or Windows Build Tools to compile `better-sqlite3`. The AES keyring runs entirely in user space (no native bindings). |
+
+Clone the repository and install dependencies:
+
+```bash
+npm install
+(cd renderer && npm install)
+```
+
+The root install triggers the renderer install via the `postinstall` hook, but
+running both commands explicitly surfaces dependency errors sooner.
+
+## 2. Environment configuration
+
+1. Copy the template to create a working `.env`:
+   ```bash
+   cp .env.example .env
+   ```
+2. Adjust variables as needed:
+   - `PORT` controls the Express API port (defaults to `4399`).
+   - `VITE_DEV_SERVER_URL` points the Electron shell at the renderer dev server
+     during development.
+   - `LICENSE_PRIVATE_KEY` points to the Ed25519 signing key used by
+     `backend/licenses/gen_license.py`. The default
+     `backend/licenses/license_private.pem` is resolved relative to the
+     repository root. Keep the actual private key outside of source control.
+
+### 2.1 AES keyring management
+
+The backend, main process, and renderer now rely on a unified keyring manager
+that can hot-swap between the system keychain, an AES-GCM encrypted file store,
+or an in-memory fallback. Use the REST endpoints to administer secrets without
+restarting the app:
+
+```bash
+# List masked secrets for the active backend
+curl http://127.0.0.1:${PORT:-4399}/api/keyring | jq
+
+# Store a secret
+curl -X POST http://127.0.0.1:${PORT:-4399}/api/keyring/RPC_URL \
+  -H 'Content-Type: application/json' \
+  -d '{"value":"https://sepolia.infura.io/v3/..."}'
+
+# Reveal a secret (returns the decrypted payload)
+curl http://127.0.0.1:${PORT:-4399}/api/keyring/RPC_URL | jq
+
+# Remove a secret
+curl -X DELETE http://127.0.0.1:${PORT:-4399}/api/keyring/RPC_URL
+
+# Inspect the active backend and available backends
+curl http://127.0.0.1:${PORT:-4399}/api/keyring/backend | jq
+
+# Switch to another backend and reload configuration in place
+curl -X POST http://127.0.0.1:${PORT:-4399}/api/keyring/backend/file
+```
+
+When the system keychain is unavailable (for example, inside a sandboxed CI
+runner), the manager automatically falls back to the encrypted file store and,
+if needed, to the in-memory backend while logging warnings so you know secrets
+may not persist between restarts.
+
+## 3. Running the stack locally
+
+Use separate terminals so logs stay readable.
+
+```bash
+npm run dev:backend    # Express API at http://localhost:4399
+npm run dev:renderer   # Vite dev server at http://localhost:5173
+```
+
+If you prefer to start both web stacks together, run `npm run dev`, which wraps
+the two commands above with `concurrently`.
+
+Launch the Electron shell after the TypeScript projects finish compiling:
+
+```bash
+npm run dev:electron   # Builds backend/main/renderer and opens the desktop window
+```
+
+The Electron shell loads the renderer URL in development and the packaged
+`dist/renderer/index.html` file after a production build.
+
+## 4. Offline licensing workflows
+
+GNOMAN 2.0 keeps the private key offline and validates tokens locally. The
+preload bridge (`main/preload/licenseBridge.ts`) invokes the existing Python
+verifier and persists successful validations under `.safevault/license.env`.
+
+### 4.1 Generate an Ed25519 keypair (one-time)
+
+```bash
+python backend/licenses/make_keys.py
+```
+
+The command writes two files:
+
+- `backend/licenses/license_private.pem` – keep this file offline and untracked.
+- `backend/licenses/license_public.pem` – commit this file; it ships with the
+  application and is used by the verifier.
+
+### 4.2 Issue a license token
+
+Run the issuer from the repository root so relative paths resolve correctly:
+
+```bash
+python backend/licenses/gen_license.py \
+  --priv backend/licenses/license_private.pem \
+  --id workstation-001 \
+  --product GNOMAN \
+  --version 2.0.0 \
+  --days 365
+```
+
+The script prints two representations:
+
+- **RAW TOKEN** – base64url payload and signature separated by a dot.
+- **HUMAN-FRIENDLY** – dashed Base32 string that is easier to transcribe.
+
+Either format can be supplied to the desktop client. Store the value somewhere
+secure so you do not need to reissue it later.
+
+### 4.3 Validate a token without the UI
+
+Use the Python helper to verify a token directly from the command line. The
+verifier returns `True` for a valid token and `False` otherwise.
+
+```bash
+python -c "import sys; from backend.licenses.verify_license import verify_token; print(verify_token(sys.argv[1], sys.argv[2], 'GNOMAN', '2.0.0'))" backend/licenses/license_public.pem <token>
+```
+
+Replace `<token>` with either the raw token or a Base32 string that decodes to
+one. The helper resolves relative paths with respect to the repository root, so
+invoking it from other directories works as long as you supply the correct
+inputs.
+
+### 4.4 Desktop activation flow
+
+1. Launch the Electron shell (`npm run dev:electron`) and navigate to the
+   license screen if it does not appear automatically.
+2. Enter either token representation. The preload bridge runs
+   `verify_license.py` with the checked-in public key.
+3. When verification succeeds, the preload writes `.safevault/license.env` with:
+   ```
+   LICENSE_KEY=<raw token>
+   VALIDATED_AT=<unix timestamp>
+   ```
+4. On subsequent launches the preload re-verifies the stored token. If it has
+   expired or the verification fails, the renderer prompts for a new license.
+
+For headless automation or regression tests, the REST endpoint
+`POST /api/license` remains available. It performs the same Ed25519 checks using
+Node.js and persists JSON metadata under `.gnoman/license.json` for backwards
+compatibility.
+
+## 5. Build, lint, and packaging commands
+
+| Command | Description |
+| ------- | ----------- |
+| `npm run lint` | Run ESLint across the backend, main process, renderer, and shared modules. |
+| `npm run build:backend` | Compile the Express API to `dist/backend`. |
+| `npm run build:main` | Compile the Electron main process to `dist/main`. |
+| `npm run build:renderer` | Build the renderer UI into `renderer/dist`. |
+| `npm run build` | Clean and produce all distributable artifacts (backend, main, renderer). |
+| `npm start` | Rebuild and launch the packaged Electron shell. |
+| `npm run start:backend` | Run the compiled backend directly from `dist/backend/index.js`. |
+
+Distribution builds live under the `dist/` directory. The `scripts/copyRenderer.js`
+helper copies the renderer bundle into `dist/main/` so the packaged Electron app
+can load it from disk.
+
+## 6. Troubleshooting checklist
+
+| Symptom | Suggested fix |
+| ------- | -------------- |
+| `ModuleNotFoundError: No module named 'cryptography'` | Install the Python dependency with `pip install cryptography`. |
+| `python3` not found when validating a license | Ensure Python 3.10+ is installed and available on your `PATH`. Update the preload bridge to point at the correct executable if you use pyenv. |
+| `better-sqlite3` fails to compile | Install the platform build tools (Xcode CLI tools, `build-essential`, or Windows Build Tools) before running `npm install` again. |
+| Renderer cannot reach the backend | Confirm `npm run dev:backend` is running and the port matches `renderer/src/config/api.ts`. |
+| License verification unexpectedly fails | Delete `.safevault/license.env` and re-run activation to ensure the stored token has not been corrupted. |
+| Electron window opens without UI in production mode | Run `npm run build:renderer` before launching `npm start` so the packaged assets exist. |
+
+Following these conventions keeps every workstation aligned with the offline
+licensing flow and build system that GNOMAN 2.0 expects in production.

package/docs/etherscan-chainlink-integration.md

@@ -0,0 +1,44 @@
+# Etherscan + Chainlink Integration
+
+## Environment Variables
+
+Required for Etherscan features:
+
+- `ETHERSCAN_API_KEY`
+
+Optional Etherscan overrides:
+
+- `ETHERSCAN_CHAIN_ID` (default `1`)
+- `ETHERSCAN_BASE_URL` (default `https://api.etherscan.io/api`)
+
+Required for Chainlink runtime configuration:
+
+- `CHAINLINK_NODE_URL`
+- `CHAINLINK_JOB_ID`
+- `CHAINLINK_OPERATOR_ADDRESS`
+- `CHAINLINK_LINK_TOKEN`
+- `RPC_URL` (or `GNOMAN_RPC_URL` / `SAFE_RPC_URL`)
+
+## Service Modules
+
+- `backend/services/etherscanService.ts`
+  - ABI auto-resolve by address
+  - proxy-aware implementation ABI resolution (`getsourcecode` then `getabi`)
+  - address-tethered cache + metadata sidecar
+  - in-process cache and per-process fetch-once semantics
+  - 3 req/sec limiter for free-tier compatibility
+  - tx history and gas oracle helpers
+- `backend/services/chainlinkService.ts`
+  - price feed helper for `latestRoundData`
+  - runtime env validation helper for node/job/operator/link settings
+- `backend/utils/http.ts`
+  - reusable axios HTTP client for Etherscan
+- `backend/utils/signer.ts`
+  - backend signer helper for server-side execution
+
+## Solidity Examples
+
+- `contracts/PriceFeedConsumer.sol`
+- `contracts/OracleConsumer.sol`
+
+These examples are minimal references for using Chainlink feed reads and oracle request/fulfillment flow scaffolding.

package/docs/license-dev-guide.md

@@ -0,0 +1,106 @@
+# GNOMAN 2.0 License Development Guide
+
+This reference walks through generating, issuing, and validating offline license
+tokens for GNOMAN 2.0. All examples assume you run commands from the repository
+root (the directory containing `package.json`).
+
+> ℹ️ A mirrored copy of this document lives at
+> `docs/wiki/license-dev-guide.md` so the in-app wiki surfaces the same
+> instructions. Update both files whenever you make changes.
+
+## 1. Prerequisites
+
+- Python 3.10 or newer
+- `pip install cryptography`
+- Access to the environment-specific Ed25519 private key (keep it offline)
+
+## 2. Generate a keypair
+
+Run the helper once per environment to mint a fresh Ed25519 keypair:
+
+```bash
+python backend/licenses/make_keys.py
+```
+
+Outputs:
+
+- `backend/licenses/license_private.pem` – keep offline, never commit.
+- `backend/licenses/license_public.pem` – check into source control and ship
+  with the application.
+
+## 3. Configure the CLI environment
+
+Copy `.env.example` to `.env` and set `LICENSE_PRIVATE_KEY` to the path of the
+private key relative to the repository root. The default value
+`backend/licenses/license_private.pem` is resolved automatically.
+
+## 4. Issue a license token
+
+Run the issuer with explicit arguments so the command is copy/paste friendly:
+
+```bash
+python backend/licenses/gen_license.py \
+  --priv backend/licenses/license_private.pem \
+  --id customer-or-workstation \
+  --product GNOMAN \
+  --version 2.0.0 \
+  --days 365
+```
+
+- `--priv` overrides the default private key path.
+- `--id` can be any identifier useful for auditing (customer, workstation, etc.).
+- `--product` and `--version` must match what the application expects.
+- `--days` controls the validity window.
+
+The script prints:
+
+- **RAW TOKEN** – base64url payload + signature separated by a dot.
+- **HUMAN-FRIENDLY** – Base32 groups separated by dashes for manual entry.
+
+Store the raw token securely. If you need the Base32 form later, you can derive
+it by running the same command again or by base32-encoding the raw value with a
+short Python snippet.
+
+## 5. Validate a token locally
+
+Confirm a token is still valid before distributing it:
+
+```bash
+python -c "import sys; from backend.licenses.verify_license import verify_token; print(verify_token(sys.argv[1], sys.argv[2], 'GNOMAN', '2.0.0'))" backend/licenses/license_public.pem <token>
+```
+
+Substitute `<token>` with either representation. A valid token prints `True`;
+any failure (bad signature, wrong product/version, expired timestamp) prints
+`False`.
+
+## 6. Desktop activation flow
+
+1. Launch the Electron app (`npm run dev:electron`).
+2. Enter the raw or Base32 token on the activation screen.
+3. The preload bridge executes `verify_license.py` with the checked-in public
+   key. Successful validation creates `.safevault/license.env` containing:
+   ```
+   LICENSE_KEY=<raw token>
+   VALIDATED_AT=<unix timestamp>
+   ```
+4. On subsequent launches the preload re-verifies the stored token. Expired or
+   tampered tokens force the user back to the activation screen.
+
+## 7. Backend compatibility endpoint
+
+Automation can continue to call the REST endpoint `POST /api/license`. It
+performs the same Ed25519 verification in Node.js and persists metadata to
+`.gnoman/license.json`. The renderer no longer depends on this file, but legacy
+integrations may still read it.
+
+## 8. Troubleshooting
+
+| Symptom | Resolution |
+| --- | --- |
+| `FileNotFoundError` for the private key | Confirm `LICENSE_PRIVATE_KEY` points at the correct path and that the key lives outside version control. |
+| `ModuleNotFoundError: No module named 'cryptography'` | Install the dependency with `pip install cryptography`. |
+| Token prints `False` unexpectedly | Decode the payload with `python -c "import base64,sys; payload=sys.argv[1].split('.')[0]; pad='='*((4-len(payload)%4)%4); print(base64.urlsafe_b64decode(payload+pad).decode())" <token>` to confirm the product, version, and expiry are correct. |
+| Desktop app refuses a known-good token | Delete `.safevault/license.env` and re-run activation to ensure the cached token has not been modified. |
+
+Following this checklist ensures every issued license aligns with the offline
+verification logic that ships with GNOMAN 2.0.

package/docs/robinhood-integration.md

@@ -0,0 +1,30 @@
+# Robinhood integration templates for Gnoman
+
+Robinhood currently publishes official developer APIs for **crypto trading**, while stock/ETF execution relies on undocumented endpoints used by first-party applications.
+
+## Supported path: Robinhood Crypto API
+
+The backend includes template helpers under `backend/services/robinhood`:
+
+- `auth.ts` – ECDSA request-signing helper (`signRobinhoodRequest`).
+- `client.ts` – `RobinhoodCryptoClient` with:
+  - `getAccountBalance()`
+  - `placeOrder(symbol, amountCash)`
+  - `getOrderStatus(orderID)`
+  - built-in HTTP 429 retry handling
+- `purchaseCryptoWithCash(...)` convenience helper for Gnoman purchase flows.
+
+### Environment variables
+
+- `ROBINHOOD_API_KEY` – API key from Robinhood portal.
+- `ROBINHOOD_PRIVATE_KEY` – PEM private key used to sign requests.
+
+## Unsupported path: Robinhood equity endpoints (use at your own risk)
+
+`unofficialClient.ts` is intentionally guarded behind:
+
+- `GNOMAN_ENABLE_UNOFFICIAL_ROBINHOOD=true`
+
+If the feature flag is not set, calls throw immediately.
+
+> ⚠️ Undocumented endpoints can change without notice and may violate platform terms. Use only for local experiments.