paralith-mcp 0.3.2 → 0.4.1

package/dist/bridge.mjs

@@ -0,0 +1,898 @@
+#!/usr/bin/env node
+
+// ../paralith-bridge/src/cli.mjs
+import crypto2 from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createPublicClient, createWalletClient, encodeAbiParameters, http, keccak256, parseAbi, recoverMessageAddress, toBytes } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { base as baseChain } from "viem/chains";
+import {
+  Connection,
+  Ed25519Program,
+  Keypair,
+  PublicKey,
+  SYSVAR_INSTRUCTIONS_PUBKEY,
+  Transaction,
+  TransactionInstruction,
+  sendAndConfirmTransaction
+} from "@solana/web3.js";
+import { SuiGrpcClient } from "@mysten/sui/grpc";
+import { Transaction as SuiTransaction } from "@mysten/sui/transactions";
+import { bcs } from "@mysten/sui/bcs";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+
+// ../../backend/native/hbclient.mjs
+import crypto from "node:crypto";
+var CRLF = "\r\n";
+var MAX_HEADER_LENGTH = 4096;
+var DERIVED_COMPONENTS = /* @__PURE__ */ new Set([
+  "method",
+  "target-uri",
+  "authority",
+  "scheme",
+  "request-target",
+  "path",
+  "query",
+  "query-param"
+]);
+var b64url = (buf) => Buffer.from(buf).toString("base64url");
+var b64urlDec = (s) => Buffer.from(s, "base64url");
+var b64std = (buf) => Buffer.from(buf).toString("base64");
+var sha256 = (b) => crypto.createHash("sha256").update(b).digest();
+function sfString(s) {
+  return '"' + String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
+}
+function sfBareItem(v) {
+  if (v && v.__sf === "binary") return ":" + b64std(v.value) + ":";
+  if (v && v.__sf === "token") return String(v.value);
+  if (v && v.__sf === "string") return sfString(v.value);
+  if (typeof v === "number") return String(v);
+  return sfString(v);
+}
+var sfStr = (s) => ({ __sf: "string", value: s });
+function sfParams(params) {
+  return params.map(([k, v]) => ";" + k + "=" + sfBareItem(v)).join("");
+}
+function sfInnerList(items, params) {
+  return "(" + items.map((i) => sfBareItem(i)).join(" ") + ")" + sfParams(params || []);
+}
+function sfDict(entries) {
+  return entries.map(([k, v]) => k + "=" + v).join(", ");
+}
+function binCmp(a, b) {
+  return Buffer.compare(Buffer.from(a, "binary"), Buffer.from(b, "binary"));
+}
+var sortedKeys = (obj) => Object.keys(obj).sort(binCmp);
+function encodeHeaderValue(v) {
+  const s = Buffer.isBuffer(v) ? v.toString("latin1") : String(v);
+  return s.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+}
+var URI_SAFE = /^[a-z0-9.\-_/?&]*$/;
+function escapeKey(k) {
+  if (URI_SAFE.test(k)) return k;
+  let out = "";
+  for (const byte of Buffer.from(k, "utf8")) {
+    const c = String.fromCharCode(byte);
+    if (/[a-z0-9.\-_/?&]/.test(c)) out += c;
+    else out += "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+var IS_ID = (k) => /^[a-zA-Z0-9_-]{43}$/.test(k);
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Buffer.isBuffer(v) && !Array.isArray(v);
+}
+function toTabm(value) {
+  if (Buffer.isBuffer(value)) return value;
+  if (typeof value === "string") return Buffer.from(value, "utf8");
+  if (Array.isArray(value)) {
+    const numbered = {};
+    value.forEach((v, i) => {
+      numbered[String(i + 1)] = v;
+    });
+    const m = toTabm(numbered);
+    const types = parseAoTypes(m["ao-types"]);
+    types["."] = "list";
+    m["ao-types"] = Buffer.from(encodeAoTypes(types), "utf8");
+    return m;
+  }
+  if (isPlainObject(value)) {
+    const types = {};
+    const out = {};
+    for (const key of sortedKeys(value)) {
+      if (key === "commitments" || key === "priv" || key.startsWith("priv/")) continue;
+      const v = value[key];
+      if (v === void 0) continue;
+      if (typeof v === "string" || Buffer.isBuffer(v)) {
+        out[key] = toTabm(v);
+      } else if (Array.isArray(v) || isPlainObject(v)) {
+        out[key] = toTabm(v);
+      } else if (typeof v === "number") {
+        if (Number.isInteger(v)) {
+          types[key] = "integer";
+          out[key] = Buffer.from(String(v));
+        } else {
+          types[key] = "float";
+          out[key] = Buffer.from(String(v));
+        }
+      } else if (typeof v === "boolean" || v === null) {
+        types[key] = "atom";
+        out[key] = Buffer.from(v === null ? "null" : String(v));
+      }
+    }
+    if (Object.keys(types).length) out["ao-types"] = Buffer.from(encodeAoTypes(types), "utf8");
+    return out;
+  }
+  return Buffer.from(String(value), "utf8");
+}
+function encodeAoTypes(types) {
+  return sfDict(sortedKeys(types).map((k) => [escapeKey(k), sfString(types[k])]));
+}
+function parseAoTypes(bin) {
+  if (!bin) return {};
+  const s = Buffer.isBuffer(bin) ? bin.toString("utf8") : String(bin);
+  const out = {};
+  for (const part of s.split(",")) {
+    const m = part.trim().match(/^([^=]+)="([^"]*)"$/);
+    if (m) out[m[1]] = m[2];
+  }
+  return out;
+}
+function inlineKey(msg) {
+  const explicit = msg["ao-body-key"];
+  if (explicit !== void 0) {
+    return { extra: {}, key: Buffer.isBuffer(explicit) ? explicit.toString() : String(explicit) };
+  }
+  if (Object.prototype.hasOwnProperty.call(msg, "body")) return { extra: {}, key: "body" };
+  if (Object.prototype.hasOwnProperty.call(msg, "data")) {
+    return { extra: { "ao-body-key": Buffer.from("data") }, key: "data" };
+  }
+  return { extra: {}, key: "body" };
+}
+function groupMaps(map, parent, top) {
+  const flattened = {};
+  for (const key of sortedKeys(map)) {
+    const value = map[key];
+    const normKey = key;
+    const flatK = parent === "" ? normKey : parent + "/" + normKey;
+    if (isPlainObject(value)) {
+      if (Object.keys(value).length === 0) {
+        top[flatK] = { "ao-types": Buffer.from("empty-message") };
+      } else {
+        top = groupMaps(value, flatK, top);
+      }
+    } else {
+      const buf = Buffer.isBuffer(value) ? value : Buffer.from(String(value));
+      if (normKey === "content-disposition" || buf.length > MAX_HEADER_LENGTH) {
+        top[flatK] = buf;
+      } else {
+        flattened[normKey] = buf;
+      }
+    }
+  }
+  if (Object.keys(flattened).length === 0) return top;
+  if (parent === "") return Object.assign({}, top, flattened);
+  top[parent] = flattened;
+  return top;
+}
+function encodeFlatMsg(msg) {
+  const headerKeys = sortedKeys(msg).filter((k) => k !== "body" && k !== "priv");
+  const headers = headerKeys.map((k) => Buffer.concat([Buffer.from(k + ": "), asBuf(msg[k])])).reduce((acc, b, i) => i === 0 ? [b] : acc.concat([Buffer.from(CRLF), b]), []);
+  const head = Buffer.concat(headers);
+  const body = msg.body === void 0 ? Buffer.alloc(0) : asBuf(msg.body);
+  if (body.length === 0) return head;
+  return Buffer.concat([head, Buffer.from(CRLF + CRLF), body]);
+}
+var asBuf = (v) => Buffer.isBuffer(v) ? v : Buffer.from(String(v));
+function encodeBodyPart(partName, part, inlKey) {
+  const disposition = partName === inlKey ? "inline" : `form-data;name="${partName}"`;
+  if (isPlainObject(part)) {
+    return encodeFlatMsg(Object.assign({}, part, {
+      "content-disposition": Buffer.from(disposition)
+    }));
+  }
+  return Buffer.concat([
+    Buffer.from("content-disposition: " + disposition + CRLF + CRLF),
+    asBuf(part)
+  ]);
+}
+function tabmToHttp(tabm) {
+  const stripped = {};
+  for (const k of Object.keys(tabm)) {
+    if (["commitments", "signature", "signature-input", "priv"].includes(k)) continue;
+    stripped[IS_ID(k) ? escapeKey(k) : k] = tabm[k];
+  }
+  const { extra, key: inlKey } = inlineKey(stripped);
+  const headers = {};
+  const bodyMap = {};
+  for (const [k, v] of Object.entries(extra)) headers[k] = v;
+  for (const key of sortedKeys(stripped)) {
+    const value = stripped[key];
+    if (key === "body") {
+      bodyMap["body"] = value;
+      continue;
+    }
+    if (key === inlKey) {
+      bodyMap[inlKey] = value;
+      continue;
+    }
+    if (isPlainObject(value)) {
+      bodyMap[key] = value;
+      continue;
+    }
+    const buf = asBuf(value);
+    if (buf.length <= MAX_HEADER_LENGTH) headers[key] = buf;
+    else bodyMap[key] = buf;
+  }
+  const grouped = groupMaps(bodyMap, "", {});
+  const gKeys = sortedKeys(grouped);
+  let body = null;
+  if (gKeys.length === 0) {
+    body = null;
+  } else if (gKeys.length === 1 && gKeys[0] === inlKey && Buffer.isBuffer(grouped[inlKey])) {
+    body = grouped[inlKey];
+  } else {
+    const parts = gKeys.map((k) => {
+      const v = grouped[k];
+      if (isPlainObject(v) && Object.keys(v).length === 1 && Object.prototype.hasOwnProperty.call(v, "body")) {
+        return encodeBodyPart(k + "/body", v, "body");
+      }
+      return encodeBodyPart(k, v, inlKey);
+    });
+    const joined = parts.reduce(
+      (acc, p, i) => i === 0 ? [p] : acc.concat([Buffer.from(CRLF), p]),
+      []
+    );
+    const boundary = b64url(sha256(Buffer.concat(joined)));
+    const withMarkers = parts.reduce(
+      (acc, p, i) => acc.concat(
+        i === 0 ? [] : [Buffer.from(CRLF)],
+        [Buffer.from("--" + boundary + CRLF), p]
+      ),
+      []
+    );
+    body = Buffer.concat([
+      Buffer.concat(withMarkers),
+      Buffer.from(CRLF + "--" + boundary + "--")
+    ]);
+    headers["content-type"] = Buffer.from(`multipart/form-data; boundary="${boundary}"`);
+  }
+  const outHeaders = {};
+  for (const k of Object.keys(headers)) outHeaders[k] = encodeHeaderValue(headers[k]);
+  if (body && body.length) {
+    outHeaders["content-digest"] = "sha-256=:" + b64std(sha256(body)) + ":";
+  }
+  return { headers: outHeaders, body };
+}
+function addDerivedSpecifiers(keys) {
+  return keys.map((k) => {
+    const bare = k.startsWith("@") ? k.slice(1) : k;
+    return DERIVED_COMPONENTS.has(bare) ? "@" + bare : bare;
+  });
+}
+function signatureBase(encHeaders, committed, params) {
+  const lines = committed.map((name) => {
+    const v = encHeaders[name];
+    if (v === void 0) {
+      throw new Error("missing_key_for_signature_component_line: " + name);
+    }
+    return `"${name}": ${v}`;
+  });
+  const paramsLine = sfInnerList(
+    addDerivedSpecifiers(committed).map((k) => sfStr(k)),
+    params
+  );
+  return Buffer.from(lines.join("\n") + '\n"@signature-params": ' + paramsLine, "utf8");
+}
+function commitmentParams({ alg, bundle, created, expires, keyid, nonce, tag }) {
+  const out = [];
+  if (alg !== void 0) out.push(["alg", sfStr(alg)]);
+  if (bundle !== void 0) out.push(["bundle", sfStr(bundle)]);
+  if (created !== void 0) out.push(["created", created]);
+  if (expires !== void 0) out.push(["expires", expires]);
+  if (keyid !== void 0) out.push(["keyid", sfStr(keyid)]);
+  if (nonce !== void 0) out.push(["nonce", sfStr(nonce)]);
+  if (tag !== void 0) out.push(["tag", sfStr(tag)]);
+  return out;
+}
+function jwkToPrivateKey(jwk) {
+  return crypto.createPrivateKey({ key: { ...jwk, kty: "RSA" }, format: "jwk" });
+}
+function pubKeyBuf(jwk) {
+  return b64urlDec(jwk.n);
+}
+function ownerToAddress(nB64url) {
+  return b64url(sha256(b64urlDec(nB64url)));
+}
+function jwkToAddress(jwk) {
+  return ownerToAddress(jwk.n);
+}
+function rsaPssSign(jwk, data) {
+  return crypto.sign("sha512", data, {
+    key: jwkToPrivateKey(jwk),
+    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: 64
+    // SHA-512 digest length; ar_wallet/rsa_pss uses saltLen == hashLen
+  });
+}
+function wireToMessageKeys(wire, bodyKeys, headers) {
+  let out = [];
+  for (const k of wire) {
+    if (k === "content-digest") out.push(...bodyKeys);
+    else out.push(k);
+  }
+  if (headers["ao-body-key"] !== void 0) {
+    const abk = String(headers["ao-body-key"]);
+    out = out.flatMap((k) => k === "body" ? [abk] : [k]).filter((k) => k !== "ao-body-key");
+  }
+  if (/^multipart\//.test(String(headers["content-type"] || ""))) {
+    out = out.filter((k) => k !== "content-type");
+  }
+  return out;
+}
+function isListTabm(sub) {
+  const t = parseAoTypes(sub["ao-types"]);
+  return t["."] === "list";
+}
+function hmacCommit(subTabm) {
+  const bare = { ...subTabm };
+  delete bare.commitments;
+  const { headers } = tabmToHttp(bare);
+  const wire = sortedKeys(headers).filter((k) => k !== "signature" && k !== "signature-input");
+  const params = commitmentParams({ alg: "hmac-sha256", keyid: "constant:ao" });
+  const base = signatureBase(headers, wire, params);
+  const mac = crypto.createHmac("sha256", "constant:ao").update(base).digest();
+  const id = b64url(mac);
+  const rawInputs = sortedKeys(bare);
+  const bodyKeys = rawInputs.filter((k) => headers[k] === void 0 && headers[k + "+link"] === void 0);
+  const committed = wireToMessageKeys(wire, bodyKeys, headers);
+  return {
+    ...subTabm,
+    commitments: {
+      [id]: {
+        "commitment-device": Buffer.from("httpsig@1.0"),
+        committed: toTabm(committed),
+        keyid: Buffer.from("constant:ao"),
+        signature: Buffer.from(id),
+        type: Buffer.from("hmac-sha256")
+      }
+    }
+  };
+}
+function withNestedHmacs(tabm) {
+  if (!isPlainObject(tabm)) return tabm;
+  const out = {};
+  for (const [k, v] of Object.entries(tabm)) {
+    if (k === "commitments") {
+      out[k] = v;
+      continue;
+    }
+    if (isPlainObject(v)) {
+      const inner = withNestedHmacs(v);
+      out[k] = isListTabm(v) || v.commitments ? inner : hmacCommit(inner);
+    } else out[k] = v;
+  }
+  return out;
+}
+var durMs = (from, to) => Number(to - from) / 1e6;
+function commit(msg, jwk, opts = {}) {
+  const { bundle = "true", nestedHmacs = true, ...params0 } = opts;
+  const tEncode = process.hrtime.bigint();
+  const tabm = nestedHmacs ? withNestedHmacs(toTabm(msg)) : toTabm(msg);
+  const { headers, body } = tabmToHttp(tabm);
+  const committed = sortedKeys(headers).filter(
+    (k) => k !== "signature" && k !== "signature-input"
+  );
+  const keyid = "publickey:" + b64std(pubKeyBuf(jwk));
+  const params = commitmentParams({ alg: "rsa-pss-sha512", bundle, keyid, ...params0 });
+  const base = signatureBase(headers, committed, params);
+  const tSign = process.hrtime.bigint();
+  const sig = rsaPssSign(jwk, base);
+  const tSeal = process.hrtime.bigint();
+  const name = "comm-" + b64url(sha256(sig)).toLowerCase();
+  const outHeaders = { ...headers };
+  outHeaders["signature"] = sfDict([[name, ":" + b64std(sig) + ":"]]);
+  outHeaders["signature-input"] = sfDict([[name, sfInnerList(
+    addDerivedSpecifiers(committed).map((k) => sfStr(k)),
+    params
+  )]]);
+  return {
+    headers: outHeaders,
+    body,
+    signatureBase: base,
+    committed,
+    sigName: name,
+    timing: {
+      encodeMs: durMs(tEncode, tSign),
+      signMs: durMs(tSign, tSeal),
+      sealMs: durMs(tSeal, process.hrtime.bigint())
+    }
+  };
+}
+var httpRequests = 0;
+async function send(node, path2, method, headers, body) {
+  const url = transportNode(node) + (path2.startsWith("/") ? path2 : "/" + path2);
+  httpRequests += 1;
+  const res = await fetch(url, {
+    method,
+    headers: { ...headers, "accept-bundle": "true" },
+    body: body && body.length ? body : void 0,
+    redirect: "follow"
+  });
+  const buf = Buffer.from(await res.arrayBuffer());
+  const h = {};
+  res.headers.forEach((v, k) => {
+    h[k] = v;
+  });
+  return { status: res.status, headers: h, body: buf, url };
+}
+function transportNode(node) {
+  return (process.env.NODE_TRANSPORT_URL || node).replace(/\/$/, "");
+}
+function hbError(res) {
+  const t = res.body.toString();
+  const m = t.match(/Error details:([\s\S]*?)<\/pre>/);
+  const dec = (x) => x.replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&").replace(/&#39;/g, "'");
+  if (m) return dec(m[1]).replace(/\s+/g, " ").trim();
+  return res.headers["details"] || t.slice(0, 400);
+}
+async function postSigned(node, path2, msg, jwk, opts = {}) {
+  const { headers, body, signatureBase: base, committed, timing } = commit(msg, jwk, opts);
+  const tPost = process.hrtime.bigint();
+  const res = await send(node, path2, "POST", headers, body);
+  const postMs = durMs(tPost, process.hrtime.bigint());
+  res.request = { headers, body, base, committed };
+  res.timing = { ...timing, postMs, bytes: body ? body.length : 0 };
+  return res;
+}
+var SCHEDULE_ROUTE = /* @__PURE__ */ new Map();
+var sendObserver = null;
+var sendRoles = {};
+var unsettledSends = [];
+function observeSend(timing, observer = sendObserver) {
+  if (!observer) return;
+  try {
+    observer(timing);
+  } catch {
+  }
+}
+async function sendMessage({
+  node,
+  jwk,
+  process: pid,
+  action,
+  tags = {},
+  data,
+  body,
+  path: path2,
+  push = true
+}) {
+  const t0 = Date.now();
+  const started = process.hrtime.bigint();
+  const fields = /* @__PURE__ */ new Map();
+  const put = (k, v) => {
+    if (v === void 0 || v === null) return;
+    fields.set(String(k).toLowerCase(), typeof v === "string" ? v : String(v));
+  };
+  put("target", pid);
+  put("type", "Message");
+  put("subject", "self");
+  if (action) put("action", action);
+  for (const [k, v] of Object.entries(tags)) put(k, v);
+  if (data !== void 0) put("data", data);
+  put("random-seed", String(Math.floor(Math.random() * 1e9)));
+  const msg = {
+    ...Object.fromEntries(fields),
+    ...body === void 0 ? {} : { body }
+  };
+  const sentAction = fields.get("action")?.toLowerCase() ?? null;
+  const timing = (outcome, { res = null, slot = null, error: error2 } = {}) => {
+    const t = res?.timing;
+    return {
+      action: sentAction,
+      slot: slot === null || slot === void 0 ? null : Number(slot),
+      node,
+      pid,
+      pidRole: sentAction?.startsWith("admin.") ? "admin" : sendRoles[pid] ?? null,
+      t0,
+      t1: Date.now(),
+      buildMs: t ? t.encodeMs : 0,
+      signMs: t ? t.signMs + t.sealMs : 0,
+      postMs: t ? t.postMs : 0,
+      sendMs: durMs(started, process.hrtime.bigint()),
+      bytes: t ? t.bytes : 0,
+      // As in `TransportTiming`: a reply was read, which a refusal also is.
+      ok: outcome === "ok" || outcome === "rejected",
+      outcome,
+      ...error2 === void 0 ? {} : { error: error2 }
+    };
+  };
+  const report = (outcome, detail) => {
+    if (sendObserver) observeSend(timing(outcome, detail));
+  };
+  const candidates = path2 ? [path2] : [`/${pid}~process@1.0/schedule`, `/${pid}~scheduler@1.0/schedule`, `/${pid}/schedule`];
+  const known = SCHEDULE_ROUTE.get(node);
+  const ordered = known && !path2 ? [known, ...candidates.filter((p) => p !== known)] : candidates;
+  const tried = [];
+  let lastResponse = null;
+  for (const candidate of ordered) {
+    let res;
+    try {
+      res = await postSigned(node, candidate, msg, jwk);
+    } catch (error2) {
+      report("post-failed", { error: error2 instanceof Error ? `${error2.name}: ${error2.message}` : String(error2) });
+      throw error2;
+    }
+    lastResponse = res;
+    if (res.status === 200) {
+      if (!path2) SCHEDULE_ROUTE.set(node, candidate);
+      const slot = res.headers["slot"];
+      if (push && slot !== void 0 && slot !== null) {
+        queuePush({ node, process: pid, slot });
+      }
+      if (sendObserver && slot !== void 0 && slot !== null && Number.isSafeInteger(Number(slot))) {
+        unsettledSends.push({
+          node: transportNode(node),
+          pid,
+          slot: Number(slot),
+          timing: timing("accepted-unread", { res, slot }),
+          observer: sendObserver
+        });
+      } else {
+        report("accepted-unread", { res, slot });
+      }
+      return { slot, headers: res.headers };
+    }
+    tried.push(`${candidate} -> ${res.status} ${hbError(res)}`);
+    if (res.status !== 404) break;
+  }
+  const error = new Error(`send failed on ${node}:
+  ${tried.join("\n  ")}`);
+  error.status = lastResponse?.status ?? null;
+  report(
+    error.status === 429 ? "rate-limited" : error.status === 408 ? "timeout" : "post-failed",
+    { res: lastResponse, error: error.message }
+  );
+  throw error;
+}
+async function pushSlot({ node, process: pid, slot }) {
+  try {
+    const res = await send(node, `/${pid}~process@1.0/push&slot=${slot}`, "GET", {});
+    return res.status === 200;
+  } catch {
+    return false;
+  }
+}
+var PUSH_QUEUES = /* @__PURE__ */ new Map();
+function queuePush({ node, process: pid, slot }) {
+  const key = `${node}|${pid}`;
+  const tail = (PUSH_QUEUES.get(key) ?? Promise.resolve()).then(() => pushSlot({ node, process: pid, slot })).catch(() => false);
+  PUSH_QUEUES.set(key, tail);
+  return tail;
+}
+async function pendingPushes({ node, process: pid } = {}) {
+  const queues = node && pid ? [PUSH_QUEUES.get(`${node}|${pid}`)] : [...PUSH_QUEUES.values()];
+  await Promise.all(queues.filter(Boolean));
+}
+process.on("beforeExit", () => {
+  void pendingPushes();
+});
+
+// ../paralith-bridge/src/cli.mjs
+var MANIFEST = "https://bridge.paralithmarkets.com/bridge.json";
+var HELP = `paralith-bridge <command>
+
+  status                          the set, open changes, each chain's epoch
+  propose-add <node-url>          propose adding a node (its keys are read from the node)
+  propose-remove <node-ao>        propose removing one
+  propose-migrate <new-pusd>      propose moving the set to a replacement PUSD; every node follows
+  approve <id>                    approve as operator; your nodes then vote by themselves
+  apply <id>                      carry the votes to Base, Solana and Sui (pays each chain's gas;
+                                  --chain base|solana|sui for one)
+  pause                           stop PUSD minting, redeeming and signing releases (any operator)
+  unpause                         start it again (the PUSD owner only)
+
+Keys are read from ~/.paralith/bridge/ unless a flag names another file:
+  operator.json       the operator's Arweave keyfile           (--wallet <file>)
+  base.key            Base gas payer, 0x-hex private key        (--key <file>)
+  solana.json         Solana gas payer, keypair JSON array      (--key <file>)
+  sui.key             Sui gas payer, suiprivkey1...             (--key <file>)
+
+  --operator <addr>   propose-add: the new node's operator (default: --wallet's address)
+  --rpc <url>         apply's RPC (or PARALITH_BASE_RPC / _SOLANA_RPC / _SUI_RPC)
+  --pusd <id>         act on this PUSD, not the manifest's (approve on a PUSD being replaced)
+  --manifest <url>    the deployment description (default ${MANIFEST})`;
+var CHAINS = ["base", "solana", "sui"];
+var argv = process.argv.slice(2);
+var opt = (name) => {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? argv[i + 1] : void 0;
+};
+var positional = argv.filter((a, i) => !a.startsWith("--") && !argv[i - 1]?.startsWith("--"));
+var [cmd, target] = positional;
+var die = (msg) => {
+  console.error(`error: ${msg}`);
+  process.exit(1);
+};
+var KEYS = path.join(os.homedir(), ".paralith", "bridge");
+var readFile = (file, what) => {
+  try {
+    return fs.readFileSync(file, "utf8").trim();
+  } catch {
+    die(`no ${what} at ${file}`);
+  }
+};
+var threshold = (n) => Math.floor((3 * n + 4) / 5);
+async function getJson(url) {
+  const r = await fetch(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(15e3) });
+  const text = await r.text();
+  if (!r.ok) throw new Error(`${url}: HTTP ${r.status}`);
+  if (text.trimStart().startsWith("<")) throw new Error(`${url}: not found`);
+  return JSON.parse(text);
+}
+if (!["status", "propose-add", "propose-remove", "propose-migrate", "approve", "apply"].includes(cmd)) {
+  console.log(HELP);
+  process.exit(cmd ? 1 : 0);
+}
+var deployment = await getJson(opt("manifest") ?? MANIFEST).catch((e) => die(`manifest: ${e.message}`));
+var NODE = deployment.node;
+var PUSD = opt("pusd") ?? deployment.pusd;
+async function bridgeInfo(pid = PUSD) {
+  let v = await getJson(`${NODE}/${pid}~process@1.0/now/bridgeinfo`);
+  if (v && typeof v === "object" && "body" in v) v = v.body;
+  return typeof v === "string" ? JSON.parse(v) : v;
+}
+var proposal = (info, id) => (info.proposals ?? []).find((p) => String(p.id) === String(id)) ?? die(`no proposal #${id}`);
+function wallet() {
+  const jwk = JSON.parse(readFile(
+    opt("wallet") ?? process.env.PARALITH_AO_WALLET ?? path.join(KEYS, "operator.json"),
+    "operator wallet (your operator's Arweave keyfile)"
+  ));
+  return { jwk, address: jwkToAddress(jwk) };
+}
+async function pusd(tags) {
+  const w = wallet();
+  console.log(`signing as ${w.address}`);
+  const { slot } = await sendMessage({ node: NODE, jwk: w.jwk, process: PUSD, action: tags.Action, tags });
+  for (let i = 0; i < 40; i++) {
+    await new Promise((r) => setTimeout(r, 1500));
+    try {
+      const r = await fetch(
+        `${NODE}/${PUSD}~process@1.0/compute&slot=${slot}/results/output/data`,
+        { headers: { accept: "text/plain" }, signal: AbortSignal.timeout(3e4) }
+      );
+      const body = r.ok ? (await r.text()).trim() : "";
+      if (!body || body.startsWith("<")) continue;
+      const reply = JSON.parse(body);
+      if (reply.error) die(reply.error);
+      return reply;
+    } catch {
+    }
+  }
+  die(`sent (slot ${slot}) but no reply yet; run status before sending again`);
+}
+var RELEASE_ATTESTORS = "PARALITH_ATTESTORS_V1";
+var hexBytes = (h) => toBytes(h);
+var u64 = (n) => {
+  const b = Buffer.alloc(8);
+  b.writeBigUInt64LE(BigInt(n));
+  return b;
+};
+var utf8 = (s) => Buffer.from(s, "utf8");
+function voters(p) {
+  const v = p.prior.flatMap((member, at) => p.votes?.[member.ao] ? [{ at, member, vote: p.votes[member.ao] }] : []);
+  if (v.length < threshold(p.prior.length)) die(`#${p.id} has ${v.length} of ${threshold(p.prior.length)} votes`);
+  return v;
+}
+var rpcFor = (chain) => opt("rpc") ?? process.env[`PARALITH_${chain.toUpperCase()}_RPC`] ?? deployment[chain].rpc;
+var KEY_FILE = { base: "base.key", solana: "solana.json", sui: "sui.key" };
+var keyFor = (chain) => readFile(opt("key") ?? process.env[`PARALITH_${chain.toUpperCase()}_KEY`] ?? path.join(KEYS, KEY_FILE[chain]), `${chain} gas payer key`);
+var BASE_ABI = parseAbi([
+  "function setAttestors(address[] set, uint64 newEpoch, bytes[] sigs)",
+  "function epoch() view returns (uint64)"
+]);
+function baseClients(withKey) {
+  const cfg = deployment.base;
+  const chain = { ...baseChain, id: cfg.chainId, rpcUrls: { default: { http: [rpcFor("base")] } } };
+  const pub = createPublicClient({ chain, transport: http(rpcFor("base")) });
+  if (!withKey) return { pub };
+  const account = privateKeyToAccount(keyFor("base"));
+  return { pub, account, wallet: createWalletClient({ account, chain, transport: http(rpcFor("base")) }) };
+}
+var solanaProgram = () => new PublicKey(deployment.solana.programId);
+var solanaConfig = () => PublicKey.findProgramAddressSync([utf8("config")], solanaProgram())[0];
+var anchorIx = (name) => crypto2.createHash("sha256").update(`global:${name}`).digest().subarray(0, 8);
+function ed25519Ix(entries, msg) {
+  const head = 2 + 14 * entries.length;
+  const msgOff = head + 96 * entries.length;
+  const data = Buffer.alloc(msgOff + msg.length);
+  data[0] = entries.length;
+  entries.forEach(({ pubkey, sig }, i) => {
+    const at = head + 96 * i;
+    const e = 2 + 14 * i;
+    [at + 32, 65535, at, 65535, msgOff, msg.length, 65535].forEach((v, k) => data.writeUInt16LE(v, e + 2 * k));
+    data.set(pubkey, at);
+    data.set(sig, at + 32);
+  });
+  data.set(msg, msgOff);
+  return new TransactionInstruction({ programId: Ed25519Program.programId, keys: [], data });
+}
+var suiClient = () => new SuiGrpcClient({ network: deployment.sui.network, baseUrl: rpcFor("sui") });
+var vecBytes = bcs.vector(bcs.vector(bcs.u8()));
+var vecU64 = bcs.vector(bcs.u64());
+var epochOf = {
+  async base() {
+    return Number(await baseClients(false).pub.readContract({ address: deployment.base.bridge, abi: BASE_ABI, functionName: "epoch" }));
+  },
+  async solana() {
+    const info = await new Connection(rpcFor("solana"), "confirmed").getAccountInfo(solanaConfig());
+    if (!info) throw new Error("config not found");
+    const n = info.data.readUInt32LE(40);
+    return Number(info.data.readBigUInt64LE(44 + 32 * n));
+  },
+  async sui() {
+    const tx = new SuiTransaction();
+    tx.moveCall({ target: `${deployment.sui.package}::para_bridge::epoch`, arguments: [tx.object(deployment.sui.bridge)] });
+    tx.setSender("0x0");
+    const r = await suiClient().simulateTransaction({ transaction: tx, include: { commandResults: true }, checksEnabled: false });
+    const bytes = r.commandResults?.[0]?.returnValues?.[0]?.bcs;
+    if (!bytes) throw new Error("epoch read returned nothing");
+    return Number(Buffer.from(bytes).readBigUInt64LE(0));
+  }
+};
+var applyOn = {
+  async base(p) {
+    const { pub, wallet: w, account } = baseClients(true);
+    console.log(`paying as ${account.address}`);
+    const set = p.set.map((m) => m.base);
+    const epoch = BigInt(p.epoch);
+    const inner = keccak256(encodeAbiParameters(
+      [{ type: "bytes32" }, { type: "uint256" }, { type: "address" }, { type: "uint64" }, { type: "address[]" }],
+      [keccak256(toBytes(RELEASE_ATTESTORS)), BigInt(deployment.base.chainId), deployment.base.bridge, epoch, set]
+    ));
+    const allowed = new Set(p.prior.map((m) => m.base.toLowerCase()));
+    const rows = await Promise.all(voters(p).map(async (v) => ({
+      sig: v.vote.base,
+      who: (await recoverMessageAddress({ message: { raw: inner }, signature: v.vote.base })).toLowerCase()
+    })));
+    const sigs = rows.filter((r2) => allowed.has(r2.who)).sort((a, b) => BigInt(a.who) < BigInt(b.who) ? -1 : 1).map((r2) => r2.sig);
+    const hash = await w.writeContract({ address: deployment.base.bridge, abi: BASE_ABI, functionName: "setAttestors", args: [set, epoch, sigs] });
+    const r = await pub.waitForTransactionReceipt({ hash });
+    if (r.status !== "success") die(`reverted ${hash}`);
+    return hash;
+  },
+  async solana(p) {
+    const payer = Keypair.fromSecretKey(Uint8Array.from(JSON.parse(keyFor("solana"))));
+    console.log(`paying as ${payer.publicKey.toBase58()}`);
+    const program = solanaProgram();
+    const set = p.set.map((m) => new PublicKey(m.solana));
+    const msg = Buffer.concat([
+      utf8(RELEASE_ATTESTORS),
+      program.toBuffer(),
+      u64(p.epoch),
+      Buffer.from([set.length]),
+      ...set.map((k) => k.toBuffer())
+    ]);
+    const len = Buffer.alloc(4);
+    len.writeUInt32LE(set.length);
+    const tx = new Transaction().add(
+      ed25519Ix(voters(p).map((v) => ({ pubkey: new PublicKey(v.member.solana).toBytes(), sig: hexBytes(v.vote.solana) })), msg),
+      new TransactionInstruction({
+        programId: program,
+        keys: [
+          { pubkey: solanaConfig(), isSigner: false, isWritable: true },
+          { pubkey: SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false }
+        ],
+        data: Buffer.concat([anchorIx("set_attestors"), len, ...set.map((k) => k.toBuffer()), u64(p.epoch)])
+      })
+    );
+    return sendAndConfirmTransaction(new Connection(rpcFor("solana"), "confirmed"), tx, [payer], { commitment: "confirmed" });
+  },
+  async sui(p) {
+    const signer = Ed25519Keypair.fromSecretKey(keyFor("sui"));
+    console.log(`paying as ${signer.getPublicKey().toSuiAddress()}`);
+    const v = voters(p);
+    const tx = new SuiTransaction();
+    tx.moveCall({
+      target: `${deployment.sui.package}::para_bridge::set_attestors`,
+      arguments: [
+        tx.object(deployment.sui.bridge),
+        tx.pure(vecBytes.serialize(p.set.map((m) => Array.from(hexBytes(m.sui))))),
+        tx.pure.u64(BigInt(p.epoch)),
+        tx.pure(vecU64.serialize(v.map((x) => BigInt(x.at)))),
+        tx.pure(vecBytes.serialize(v.map((x) => Array.from(hexBytes(x.vote.sui)))))
+      ]
+    });
+    const client = suiClient();
+    const r = await client.signAndExecuteTransaction({ transaction: tx, signer, include: { effects: true } });
+    const t = r.Transaction ?? r.FailedTransaction;
+    if (!t.status.success) die(`failed ${t.digest}: ${JSON.stringify(t.status.error)}`);
+    await client.waitForTransaction({ digest: t.digest });
+    return t.digest;
+  }
+};
+var short = (s = "") => s.length > 18 ? `${s.slice(0, 8)}\u2026${s.slice(-6)}` : s;
+async function status() {
+  const info = await bridgeInfo();
+  const set = info.attestors ?? [];
+  console.log(`PUSD ${PUSD} on ${NODE}`);
+  if (info.predecessor) console.log(`replaces ${info.predecessor}`);
+  if (info.pausedBy) console.log(`PAUSED by ${info.pausedBy}`);
+  if (info.successor) console.log(`MOVED to ${info.successor}: the set and every node follow it there`);
+  console.log(`set: ${set.length} node(s), k ${threshold(set.length)}, epoch ${info.epoch ?? 0}`);
+  for (const m of set) console.log(`  ${m.ao}  operator ${m.operator ?? "-"}`);
+  const epochs = await Promise.all(CHAINS.map((c) => epochOf[c]().catch((e) => `? (${e.message})`)));
+  console.log(`chains: ${CHAINS.map((c, i) => `${c} ${epochs[i]}`).join(", ")}`);
+  for (const p of info.proposals ?? []) {
+    if (p.status === "superseded") continue;
+    const need = threshold(p.prior.length);
+    const behind = CHAINS.filter((c, i) => typeof epochs[i] === "number" && epochs[i] < p.epoch);
+    if (p.status === "applied" && !behind.length) continue;
+    console.log(`#${p.id} ${p.op} ${p.op === "migrate" ? `to ${p.successor}` : `${short(p.member?.ao)} -> epoch ${p.epoch}`}: ${p.status}, approved ${Object.keys(p.approvals ?? {}).length}, votes ${Object.keys(p.votes ?? {}).length}/${need}` + (p.status === "applied" ? `, apply on: ${behind.join(" ")}` : ""));
+  }
+}
+async function main() {
+  if (cmd === "status") return status();
+  if (cmd === "propose-add") {
+    if (!target) die("propose-add <node-url>");
+    const url = target.replace(/\/+$/, "").replace(/^(?!https?:\/\/)/, "https://");
+    const k = await getJson(`${url}/~bridge@1.0/keys`);
+    if (!k.ao || !k.base || !k.solana || !k.sui) die(`${url} published incomplete keys`);
+    const operator = opt("operator") ?? wallet().address;
+    console.log(`node ${k.ao}
+  base ${k.base}
+  solana ${k.solana}
+  sui ${k.sui}
+operator ${operator}`);
+    const r = await pusd({ Action: "Attestor-Propose", Op: "add", Ao: k.ao, Base: k.base, Solana: k.solana, Sui: k.sui, Operator: operator });
+    return console.log(`proposed #${r.ProposalId ?? "?"}; next: approve ${r.ProposalId ?? "<id>"}`);
+  }
+  if (cmd === "propose-remove") {
+    if (!target) die("propose-remove <node-ao>");
+    const r = await pusd({ Action: "Attestor-Propose", Op: "remove", Ao: target });
+    return console.log(`proposed #${r.ProposalId ?? "?"}; next: approve ${r.ProposalId ?? "<id>"}`);
+  }
+  if (cmd === "propose-migrate") {
+    if (!target) die("propose-migrate <new-pusd>");
+    const next = await bridgeInfo(target);
+    if (!next.predecessor) die(`${target} names no predecessor`);
+    PUSD = next.predecessor;
+    const here = await bridgeInfo();
+    const members = (i) => JSON.stringify((i.attestors ?? []).map((m) => [m.ao, m.base, m.solana, m.sui]));
+    if (members(next) !== members(here) || Number(next.epoch) !== Number(here.epoch)) {
+      die(`${target} does not hold ${PUSD}'s set at epoch ${here.epoch}; nodes would refuse to follow it`);
+    }
+    console.log(`moving the set of ${PUSD}
+  to ${target}`);
+    const r = await pusd({ Action: "Attestor-Propose", Op: "migrate", Successor: target });
+    return console.log(`proposed #${r.ProposalId ?? "?"}; next: approve ${r.ProposalId ?? "<id>"} --pusd ${PUSD}`);
+  }
+  if (cmd === "approve") {
+    if (!target) die("approve <id>");
+    await pusd({ Action: "Attestor-Approve", ProposalId: String(target) });
+    return console.log(`approved #${target}; your nodes vote on their next pass`);
+  }
+  if (cmd === "pause" || cmd === "unpause") {
+    await pusd({ Action: cmd === "pause" ? "Bridge-Pause" : "Bridge-Unpause" });
+    return console.log(cmd === "pause" ? "paused" : "running");
+  }
+  if (cmd === "apply") {
+    const chain = opt("chain");
+    if (!target || chain && !CHAINS.includes(chain)) die("apply <id> [--chain base|solana|sui]");
+    const p = proposal(await bridgeInfo(), target);
+    if (p.status !== "applied") die(`#${p.id} is ${p.status}; it needs its votes first`);
+    for (const c of chain ? [chain] : CHAINS) {
+      const now = await epochOf[c]();
+      if (now >= p.epoch) {
+        console.log(`${c}: already at epoch ${now}`);
+        continue;
+      }
+      if (now !== p.epoch - 1) die(`${c} is at epoch ${now}; apply the change to epoch ${now + 1} first`);
+      console.log(`${c}: epoch ${p.epoch}, ${await applyOn[c](p)}`);
+    }
+    return;
+  }
+}
+await main().catch((e) => die(e.shortMessage ?? e.message ?? String(e)));