tenjin-cli 0.1.0-alpha.0 → 0.1.0-alpha.1

package/dist/chunk-EXBMF5X7.js

@@ -0,0 +1,1198 @@
+import { createRequire as __tenjinCreateRequire } from 'node:module'; const require = __tenjinCreateRequire(import.meta.url);
+import {
+  hashAuthorization,
+  hashMessage,
+  hashTypedData,
+  keccak256 as keccak2562,
+  publicKeyToAddress,
+  serializeSignature,
+  serializeTransaction
+} from "./chunk-T4LKNY7T.js";
+import {
+  hmac,
+  secp256k1,
+  sha256
+} from "./chunk-Q53IYV2G.js";
+import {
+  InvalidAddressError,
+  concat3 as concat,
+  from2 as from,
+  hexToBytes,
+  isAddress,
+  isEqual,
+  isHex,
+  keccak256,
+  numberToHex,
+  random,
+  slice3 as slice,
+  toHex,
+  toHex2
+} from "./chunk-BRJHUQSY.js";
+import {
+  ahash,
+  anumber,
+  asyncLoop,
+  checkOpts,
+  clean,
+  createView,
+  kdfInputToBytes,
+  rotl,
+  swap32IfBE,
+  u32
+} from "./chunk-CUWUHTIL.js";
+import {
+  PRIVATE_KEY_RE,
+  readWalletRecord,
+  walletFileMode,
+  writeWalletRecord
+} from "./chunk-DXPYFVKG.js";
+import {
+  writeFileAtomic
+} from "./chunk-ZPZFPVDN.js";
+import {
+  CliError,
+  passphraseBlobPath,
+  walletPath
+} from "./chunk-YG2DO46P.js";
+
+// node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/pbkdf2.js
+function pbkdf2Init(hash, _password, _salt, _opts) {
+  ahash(hash);
+  const opts = checkOpts({ dkLen: 32, asyncTick: 10 }, _opts);
+  const { c, dkLen, asyncTick } = opts;
+  anumber(c);
+  anumber(dkLen);
+  anumber(asyncTick);
+  if (c < 1)
+    throw new Error("iterations (c) should be >= 1");
+  const password = kdfInputToBytes(_password);
+  const salt = kdfInputToBytes(_salt);
+  const DK = new Uint8Array(dkLen);
+  const PRF = hmac.create(hash, password);
+  const PRFSalt = PRF._cloneInto().update(salt);
+  return { c, dkLen, asyncTick, DK, PRF, PRFSalt };
+}
+function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
+  PRF.destroy();
+  PRFSalt.destroy();
+  if (prfW)
+    prfW.destroy();
+  clean(u);
+  return DK;
+}
+function pbkdf2(hash, password, salt, opts) {
+  const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
+  let prfW;
+  const arr = new Uint8Array(4);
+  const view = createView(arr);
+  const u = new Uint8Array(PRF.outputLen);
+  for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+    const Ti = DK.subarray(pos, pos + PRF.outputLen);
+    view.setInt32(0, ti, false);
+    (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
+    Ti.set(u.subarray(0, Ti.length));
+    for (let ui = 1; ui < c; ui++) {
+      PRF._cloneInto(prfW).update(u).digestInto(u);
+      for (let i = 0; i < Ti.length; i++)
+        Ti[i] ^= u[i];
+    }
+  }
+  return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/generatePrivateKey.js
+function generatePrivateKey() {
+  return toHex(secp256k1.utils.randomPrivateKey());
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/toAccount.js
+function toAccount(source) {
+  if (typeof source === "string") {
+    if (!isAddress(source, { strict: false }))
+      throw new InvalidAddressError({ address: source });
+    return {
+      address: source,
+      type: "json-rpc"
+    };
+  }
+  if (!isAddress(source.address, { strict: false }))
+    throw new InvalidAddressError({ address: source.address });
+  return {
+    address: source.address,
+    nonceManager: source.nonceManager,
+    sign: source.sign,
+    signAuthorization: source.signAuthorization,
+    signMessage: source.signMessage,
+    signTransaction: source.signTransaction,
+    signTypedData: source.signTypedData,
+    source: "custom",
+    type: "local"
+  };
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/utils/sign.js
+var extraEntropy = false;
+async function sign({ hash, privateKey, to = "object" }) {
+  const { r, s, recovery } = secp256k1.sign(hash.slice(2), privateKey.slice(2), {
+    lowS: true,
+    extraEntropy: isHex(extraEntropy, { strict: false }) ? hexToBytes(extraEntropy) : extraEntropy
+  });
+  const signature = {
+    r: numberToHex(r, { size: 32 }),
+    s: numberToHex(s, { size: 32 }),
+    v: recovery ? 28n : 27n,
+    yParity: recovery
+  };
+  return (() => {
+    if (to === "bytes" || to === "hex")
+      return serializeSignature({ ...signature, to });
+    return signature;
+  })();
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/utils/signAuthorization.js
+async function signAuthorization(parameters) {
+  const { chainId, nonce, privateKey, to = "object" } = parameters;
+  const address = parameters.contractAddress ?? parameters.address;
+  const signature = await sign({
+    hash: hashAuthorization({ address, chainId, nonce }),
+    privateKey,
+    to
+  });
+  if (to === "object")
+    return {
+      address,
+      chainId,
+      nonce,
+      ...signature
+    };
+  return signature;
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/utils/signMessage.js
+async function signMessage({ message, privateKey }) {
+  return await sign({ hash: hashMessage(message), privateKey, to: "hex" });
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/utils/signTransaction.js
+async function signTransaction(parameters) {
+  const { privateKey, transaction, serializer = serializeTransaction } = parameters;
+  const signableTransaction = (() => {
+    if (transaction.type === "eip4844")
+      return {
+        ...transaction,
+        sidecars: false
+      };
+    return transaction;
+  })();
+  const signature = await sign({
+    hash: keccak256(await serializer(signableTransaction)),
+    privateKey
+  });
+  return await serializer(transaction, signature);
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/utils/signTypedData.js
+async function signTypedData(parameters) {
+  const { privateKey, ...typedData } = parameters;
+  return await sign({
+    hash: hashTypedData(typedData),
+    privateKey,
+    to: "hex"
+  });
+}
+
+// node_modules/.pnpm/viem@2.55.2_typescript@6.0.3_zod@4.4.3/node_modules/viem/_esm/accounts/privateKeyToAccount.js
+function privateKeyToAccount(privateKey, options = {}) {
+  const { nonceManager } = options;
+  const publicKey = toHex(secp256k1.getPublicKey(privateKey.slice(2), false));
+  const address = publicKeyToAddress(publicKey);
+  const account = toAccount({
+    address,
+    nonceManager,
+    async sign({ hash }) {
+      return sign({ hash, privateKey, to: "hex" });
+    },
+    async signAuthorization(authorization) {
+      return signAuthorization({ ...authorization, privateKey });
+    },
+    async signMessage({ message }) {
+      return signMessage({ message, privateKey });
+    },
+    async signTransaction(transaction, { serializer } = {}) {
+      return signTransaction({ privateKey, transaction, serializer });
+    },
+    async signTypedData(typedData) {
+      return signTypedData({ ...typedData, privateKey });
+    }
+  });
+  return {
+    ...account,
+    publicKey,
+    source: "privateKey"
+  };
+}
+
+// node_modules/.pnpm/@noble+ciphers@1.3.0/node_modules/@noble/ciphers/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function u8(arr) {
+  return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function u322(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean2(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function overlapBytes(a, b) {
+  return a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy
+  a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end
+  b.byteOffset < a.byteOffset + a.byteLength;
+}
+function complexOverlapBytes(input, output) {
+  if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)
+    throw new Error("complex overlap of input and output is not supported");
+}
+var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
+  function wrappedCipher(key, ...args) {
+    abytes(key);
+    if (!isLE)
+      throw new Error("Non little-endian hardware is not yet supported");
+    if (params.nonceLength !== void 0) {
+      const nonce = args[0];
+      if (!nonce)
+        throw new Error("nonce / iv required");
+      if (params.varSizeNonce)
+        abytes(nonce);
+      else
+        abytes(nonce, params.nonceLength);
+    }
+    const tagl = params.tagLength;
+    if (tagl && args[1] !== void 0) {
+      abytes(args[1]);
+    }
+    const cipher = constructor(key, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== void 0) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes(output);
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes(data);
+        checkOutput(cipher.encrypt.length, output);
+        return cipher.encrypt(data, output);
+      },
+      decrypt(data, output) {
+        abytes(data);
+        if (tagl && data.length < tagl)
+          throw new Error("invalid ciphertext length: smaller than tagLength=" + tagl);
+        checkOutput(cipher.decrypt.length, output);
+        return cipher.decrypt(data, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === void 0)
+    return new Uint8Array(expectedLength);
+  if (out.length !== expectedLength)
+    throw new Error("invalid output length, expected " + expectedLength + ", got: " + out.length);
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(bytes);
+}
+
+// node_modules/.pnpm/@noble+ciphers@1.3.0/node_modules/@noble/ciphers/esm/aes.js
+var BLOCK_SIZE = 16;
+var BLOCK_SIZE32 = 4;
+var POLY = 283;
+function mul2(n) {
+  return n << 1 ^ POLY & -(n >> 7);
+}
+function mul(a, b) {
+  let res = 0;
+  for (; b > 0; b >>= 1) {
+    res ^= a & -(b & 1);
+    a = mul2(a);
+  }
+  return res;
+}
+var sbox = /* @__PURE__ */ (() => {
+  const t = new Uint8Array(256);
+  for (let i = 0, x = 1; i < 256; i++, x ^= mul2(x))
+    t[i] = x;
+  const box = new Uint8Array(256);
+  box[0] = 99;
+  for (let i = 0; i < 255; i++) {
+    let x = t[255 - i];
+    x |= x << 8;
+    box[t[i]] = (x ^ x >> 4 ^ x >> 5 ^ x >> 6 ^ x >> 7 ^ 99) & 255;
+  }
+  clean2(t);
+  return box;
+})();
+var rotr32_8 = (n) => n << 24 | n >>> 8;
+var rotl32_8 = (n) => n << 8 | n >>> 24;
+function genTtable(sbox2, fn) {
+  if (sbox2.length !== 256)
+    throw new Error("Wrong sbox length");
+  const T0 = new Uint32Array(256).map((_, j) => fn(sbox2[j]));
+  const T1 = T0.map(rotl32_8);
+  const T2 = T1.map(rotl32_8);
+  const T3 = T2.map(rotl32_8);
+  const T01 = new Uint32Array(256 * 256);
+  const T23 = new Uint32Array(256 * 256);
+  const sbox22 = new Uint16Array(256 * 256);
+  for (let i = 0; i < 256; i++) {
+    for (let j = 0; j < 256; j++) {
+      const idx = i * 256 + j;
+      T01[idx] = T0[i] ^ T1[j];
+      T23[idx] = T2[i] ^ T3[j];
+      sbox22[idx] = sbox2[i] << 8 | sbox2[j];
+    }
+  }
+  return { sbox: sbox2, sbox2: sbox22, T0, T1, T2, T3, T01, T23 };
+}
+var tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => mul(s, 3) << 24 | s << 16 | s << 8 | mul(s, 2));
+var xPowers = /* @__PURE__ */ (() => {
+  const p = new Uint8Array(16);
+  for (let i = 0, x = 1; i < 16; i++, x = mul2(x))
+    p[i] = x;
+  return p;
+})();
+function expandKeyLE(key) {
+  abytes(key);
+  const len = key.length;
+  if (![16, 24, 32].includes(len))
+    throw new Error("aes: invalid key size, should be 16, 24 or 32, got " + len);
+  const { sbox2 } = tableEncoding;
+  const toClean = [];
+  if (!isAligned32(key))
+    toClean.push(key = copyBytes(key));
+  const k32 = u322(key);
+  const Nk = k32.length;
+  const subByte = (n) => applySbox(sbox2, n, n, n, n);
+  const xk = new Uint32Array(len + 28);
+  xk.set(k32);
+  for (let i = Nk; i < xk.length; i++) {
+    let t = xk[i - 1];
+    if (i % Nk === 0)
+      t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];
+    else if (Nk > 6 && i % Nk === 4)
+      t = subByte(t);
+    xk[i] = xk[i - Nk] ^ t;
+  }
+  clean2(...toClean);
+  return xk;
+}
+function apply0123(T01, T23, s0, s1, s2, s3) {
+  return T01[s0 << 8 & 65280 | s1 >>> 8 & 255] ^ T23[s2 >>> 8 & 65280 | s3 >>> 24 & 255];
+}
+function applySbox(sbox2, s0, s1, s2, s3) {
+  return sbox2[s0 & 255 | s1 & 65280] | sbox2[s2 >>> 16 & 255 | s3 >>> 16 & 65280] << 16;
+}
+function encrypt(xk, s0, s1, s2, s3) {
+  const { sbox2, T01, T23 } = tableEncoding;
+  let k = 0;
+  s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
+  const rounds = xk.length / 4 - 2;
+  for (let i = 0; i < rounds; i++) {
+    const t02 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
+    const t12 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
+    const t22 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
+    const t32 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
+    s0 = t02, s1 = t12, s2 = t22, s3 = t32;
+  }
+  const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);
+  const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);
+  const t2 = xk[k++] ^ applySbox(sbox2, s2, s3, s0, s1);
+  const t3 = xk[k++] ^ applySbox(sbox2, s3, s0, s1, s2);
+  return { s0: t0, s1: t1, s2: t2, s3: t3 };
+}
+function ctrCounter(xk, nonce, src, dst) {
+  abytes(nonce, BLOCK_SIZE);
+  abytes(src);
+  const srcLen = src.length;
+  dst = getOutput(srcLen, dst);
+  complexOverlapBytes(src, dst);
+  const ctr2 = nonce;
+  const c32 = u322(ctr2);
+  let { s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]);
+  const src32 = u322(src);
+  const dst32 = u322(dst);
+  for (let i = 0; i + 4 <= src32.length; i += 4) {
+    dst32[i + 0] = src32[i + 0] ^ s0;
+    dst32[i + 1] = src32[i + 1] ^ s1;
+    dst32[i + 2] = src32[i + 2] ^ s2;
+    dst32[i + 3] = src32[i + 3] ^ s3;
+    let carry = 1;
+    for (let i2 = ctr2.length - 1; i2 >= 0; i2--) {
+      carry = carry + (ctr2[i2] & 255) | 0;
+      ctr2[i2] = carry & 255;
+      carry >>>= 8;
+    }
+    ({ s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]));
+  }
+  const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);
+  if (start < srcLen) {
+    const b32 = new Uint32Array([s0, s1, s2, s3]);
+    const buf = u8(b32);
+    for (let i = start, pos = 0; i < srcLen; i++, pos++)
+      dst[i] = src[i] ^ buf[pos];
+    clean2(b32);
+  }
+  return dst;
+}
+var ctr = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, function aesctr(key, nonce) {
+  function processCtr(buf, dst) {
+    abytes(buf);
+    if (dst !== void 0) {
+      abytes(dst);
+      if (!isAligned32(dst))
+        throw new Error("unaligned destination");
+    }
+    const xk = expandKeyLE(key);
+    const n = copyBytes(nonce);
+    const toClean = [xk, n];
+    if (!isAligned32(buf))
+      toClean.push(buf = copyBytes(buf));
+    const out = ctrCounter(xk, n, buf, dst);
+    clean2(...toClean);
+    return out;
+  }
+  return {
+    encrypt: (plaintext, dst) => processCtr(plaintext, dst),
+    decrypt: (ciphertext, dst) => processCtr(ciphertext, dst)
+  };
+});
+
+// node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/scrypt.js
+function XorAndSalsa(prev, pi, input, ii, out, oi) {
+  let y00 = prev[pi++] ^ input[ii++], y01 = prev[pi++] ^ input[ii++];
+  let y02 = prev[pi++] ^ input[ii++], y03 = prev[pi++] ^ input[ii++];
+  let y04 = prev[pi++] ^ input[ii++], y05 = prev[pi++] ^ input[ii++];
+  let y06 = prev[pi++] ^ input[ii++], y07 = prev[pi++] ^ input[ii++];
+  let y08 = prev[pi++] ^ input[ii++], y09 = prev[pi++] ^ input[ii++];
+  let y10 = prev[pi++] ^ input[ii++], y11 = prev[pi++] ^ input[ii++];
+  let y12 = prev[pi++] ^ input[ii++], y13 = prev[pi++] ^ input[ii++];
+  let y14 = prev[pi++] ^ input[ii++], y15 = prev[pi++] ^ input[ii++];
+  let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;
+  for (let i = 0; i < 8; i += 2) {
+    x04 ^= rotl(x00 + x12 | 0, 7);
+    x08 ^= rotl(x04 + x00 | 0, 9);
+    x12 ^= rotl(x08 + x04 | 0, 13);
+    x00 ^= rotl(x12 + x08 | 0, 18);
+    x09 ^= rotl(x05 + x01 | 0, 7);
+    x13 ^= rotl(x09 + x05 | 0, 9);
+    x01 ^= rotl(x13 + x09 | 0, 13);
+    x05 ^= rotl(x01 + x13 | 0, 18);
+    x14 ^= rotl(x10 + x06 | 0, 7);
+    x02 ^= rotl(x14 + x10 | 0, 9);
+    x06 ^= rotl(x02 + x14 | 0, 13);
+    x10 ^= rotl(x06 + x02 | 0, 18);
+    x03 ^= rotl(x15 + x11 | 0, 7);
+    x07 ^= rotl(x03 + x15 | 0, 9);
+    x11 ^= rotl(x07 + x03 | 0, 13);
+    x15 ^= rotl(x11 + x07 | 0, 18);
+    x01 ^= rotl(x00 + x03 | 0, 7);
+    x02 ^= rotl(x01 + x00 | 0, 9);
+    x03 ^= rotl(x02 + x01 | 0, 13);
+    x00 ^= rotl(x03 + x02 | 0, 18);
+    x06 ^= rotl(x05 + x04 | 0, 7);
+    x07 ^= rotl(x06 + x05 | 0, 9);
+    x04 ^= rotl(x07 + x06 | 0, 13);
+    x05 ^= rotl(x04 + x07 | 0, 18);
+    x11 ^= rotl(x10 + x09 | 0, 7);
+    x08 ^= rotl(x11 + x10 | 0, 9);
+    x09 ^= rotl(x08 + x11 | 0, 13);
+    x10 ^= rotl(x09 + x08 | 0, 18);
+    x12 ^= rotl(x15 + x14 | 0, 7);
+    x13 ^= rotl(x12 + x15 | 0, 9);
+    x14 ^= rotl(x13 + x12 | 0, 13);
+    x15 ^= rotl(x14 + x13 | 0, 18);
+  }
+  out[oi++] = y00 + x00 | 0;
+  out[oi++] = y01 + x01 | 0;
+  out[oi++] = y02 + x02 | 0;
+  out[oi++] = y03 + x03 | 0;
+  out[oi++] = y04 + x04 | 0;
+  out[oi++] = y05 + x05 | 0;
+  out[oi++] = y06 + x06 | 0;
+  out[oi++] = y07 + x07 | 0;
+  out[oi++] = y08 + x08 | 0;
+  out[oi++] = y09 + x09 | 0;
+  out[oi++] = y10 + x10 | 0;
+  out[oi++] = y11 + x11 | 0;
+  out[oi++] = y12 + x12 | 0;
+  out[oi++] = y13 + x13 | 0;
+  out[oi++] = y14 + x14 | 0;
+  out[oi++] = y15 + x15 | 0;
+}
+function BlockMix(input, ii, out, oi, r) {
+  let head = oi + 0;
+  let tail = oi + 16 * r;
+  for (let i = 0; i < 16; i++)
+    out[tail + i] = input[ii + (2 * r - 1) * 16 + i];
+  for (let i = 0; i < r; i++, head += 16, ii += 16) {
+    XorAndSalsa(out, tail, input, ii, out, head);
+    if (i > 0)
+      tail += 16;
+    XorAndSalsa(out, head, input, ii += 16, out, tail);
+  }
+}
+function scryptInit(password, salt, _opts) {
+  const opts = checkOpts({
+    dkLen: 32,
+    asyncTick: 10,
+    maxmem: 1024 ** 3 + 1024
+  }, _opts);
+  const { N, r, p, dkLen, asyncTick, maxmem, onProgress } = opts;
+  anumber(N);
+  anumber(r);
+  anumber(p);
+  anumber(dkLen);
+  anumber(asyncTick);
+  anumber(maxmem);
+  if (onProgress !== void 0 && typeof onProgress !== "function")
+    throw new Error("progressCb should be function");
+  const blockSize = 128 * r;
+  const blockSize32 = blockSize / 4;
+  const pow32 = Math.pow(2, 32);
+  if (N <= 1 || (N & N - 1) !== 0 || N > pow32) {
+    throw new Error("Scrypt: N must be larger than 1, a power of 2, and less than 2^32");
+  }
+  if (p < 0 || p > (pow32 - 1) * 32 / blockSize) {
+    throw new Error("Scrypt: p must be a positive integer less than or equal to ((2^32 - 1) * 32) / (128 * r)");
+  }
+  if (dkLen < 0 || dkLen > (pow32 - 1) * 32) {
+    throw new Error("Scrypt: dkLen should be positive integer less than or equal to (2^32 - 1) * 32");
+  }
+  const memUsed = blockSize * (N + p);
+  if (memUsed > maxmem) {
+    throw new Error("Scrypt: memused is bigger than maxMem. Expected 128 * r * (N + p) > maxmem of " + maxmem);
+  }
+  const B = pbkdf2(sha256, password, salt, { c: 1, dkLen: blockSize * p });
+  const B32 = u32(B);
+  const V = u32(new Uint8Array(blockSize * N));
+  const tmp = u32(new Uint8Array(blockSize));
+  let blockMixCb = () => {
+  };
+  if (onProgress) {
+    const totalBlockMix = 2 * N * p;
+    const callbackPer = Math.max(Math.floor(totalBlockMix / 1e4), 1);
+    let blockMixCnt = 0;
+    blockMixCb = () => {
+      blockMixCnt++;
+      if (onProgress && (!(blockMixCnt % callbackPer) || blockMixCnt === totalBlockMix))
+        onProgress(blockMixCnt / totalBlockMix);
+    };
+  }
+  return { N, r, p, dkLen, blockSize32, V, B32, B, tmp, blockMixCb, asyncTick };
+}
+function scryptOutput(password, dkLen, B, V, tmp) {
+  const res = pbkdf2(sha256, password, B, { c: 1, dkLen });
+  clean(B, V, tmp);
+  return res;
+}
+async function scryptAsync(password, salt, opts) {
+  const { N, r, p, dkLen, blockSize32, V, B32, B, tmp, blockMixCb, asyncTick } = scryptInit(password, salt, opts);
+  swap32IfBE(B32);
+  for (let pi = 0; pi < p; pi++) {
+    const Pi = blockSize32 * pi;
+    for (let i = 0; i < blockSize32; i++)
+      V[i] = B32[Pi + i];
+    let pos = 0;
+    await asyncLoop(N - 1, asyncTick, () => {
+      BlockMix(V, pos, V, pos += blockSize32, r);
+      blockMixCb();
+    });
+    BlockMix(V, (N - 1) * blockSize32, B32, Pi, r);
+    blockMixCb();
+    await asyncLoop(N, asyncTick, () => {
+      const j = B32[Pi + blockSize32 - 16] % N;
+      for (let k = 0; k < blockSize32; k++)
+        tmp[k] = B32[Pi + k] ^ V[j * blockSize32 + k];
+      BlockMix(tmp, 0, B32, Pi, r);
+      blockMixCb();
+    });
+  }
+  swap32IfBE(B32);
+  return scryptOutput(password, dkLen, B, V, tmp);
+}
+
+// node_modules/.pnpm/ox@0.14.30_typescript@6.0.3_zod@4.4.3/node_modules/ox/_esm/core/Keystore.js
+function decrypt(keystore, key, options = {}) {
+  const { as = "Hex" } = options;
+  const key_ = from(typeof key === "function" ? key() : key);
+  const encKey = slice(key_, 0, 16);
+  const macKey = slice(key_, 16, 32);
+  const ciphertext = from(`0x${keystore.crypto.ciphertext}`);
+  const mac = keccak2562(concat(macKey, ciphertext));
+  if (!isEqual(mac, from(`0x${keystore.crypto.mac}`)))
+    throw new Error("corrupt keystore");
+  const data = ctr(encKey, from(`0x${keystore.crypto.cipherparams.iv}`)).decrypt(ciphertext);
+  if (as === "Hex")
+    return toHex2(data);
+  return data;
+}
+function encrypt2(privateKey, key, options) {
+  const { id = crypto.randomUUID(), kdf, kdfparams, iv } = options;
+  const key_ = from(typeof key === "function" ? key() : key);
+  const value_ = from(privateKey);
+  const encKey = slice(key_, 0, 16);
+  const macKey = slice(key_, 16, 32);
+  const ciphertext = ctr(encKey, iv).encrypt(value_);
+  const mac = keccak2562(concat(macKey, ciphertext));
+  return {
+    crypto: {
+      cipher: "aes-128-ctr",
+      ciphertext: toHex2(ciphertext).slice(2),
+      cipherparams: { iv: toHex2(iv).slice(2) },
+      kdf,
+      kdfparams,
+      mac: toHex2(mac).slice(2)
+    },
+    id,
+    version: 3
+  };
+}
+function pbkdf22(options) {
+  const { iv, iterations = 262144, password } = options;
+  const salt = options.salt ? from(options.salt) : random(32);
+  const key = toHex2(pbkdf2(sha256, password, salt, { c: iterations, dkLen: 32 }));
+  return defineKey(() => key, {
+    iv,
+    kdfparams: {
+      c: iterations,
+      dklen: 32,
+      prf: "hmac-sha256",
+      salt: toHex2(salt).slice(2)
+    },
+    kdf: "pbkdf2"
+  });
+}
+async function scryptAsync2(options) {
+  const { iv, n = 262144, password } = options;
+  const p = 8;
+  const r = 1;
+  const salt = options.salt ? from(options.salt) : random(32);
+  const key = toHex2(await scryptAsync(password, salt, { N: n, dkLen: 32, r, p }));
+  return defineKey(() => key, {
+    iv,
+    kdfparams: {
+      dklen: 32,
+      n,
+      p,
+      r,
+      salt: toHex2(salt).slice(2)
+    },
+    kdf: "scrypt"
+  });
+}
+async function toKeyAsync(keystore, options) {
+  const { crypto: crypto2 } = keystore;
+  const { password } = options;
+  const { cipherparams, kdf, kdfparams } = crypto2;
+  const { iv } = cipherparams;
+  const { c, n, p, r, salt } = kdfparams;
+  const [key] = await (async () => {
+    switch (kdf) {
+      case "scrypt":
+        return await scryptAsync2({
+          iv: from(`0x${iv}`),
+          n,
+          p,
+          r,
+          salt: from(`0x${salt}`),
+          password
+        });
+      case "pbkdf2":
+        return await pbkdf22({
+          iv: from(`0x${iv}`),
+          iterations: c,
+          password,
+          salt: from(`0x${salt}`)
+        });
+      default:
+        throw new Error("unsupported kdf");
+    }
+  })();
+  return key;
+}
+function defineKey(key, options) {
+  const iv = options.iv ? from(options.iv) : random(16);
+  return [key, { ...options, iv }];
+}
+
+// src/lib/wallet/passphrase.ts
+import { execFile } from "child_process";
+import { randomBytes } from "crypto";
+import { readFile } from "fs/promises";
+var KEYCHAIN_SERVICE = "tenjin-cli";
+var KEYCHAIN_ACCOUNT = "wallet";
+var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+var defaultExec = (file, args, stdin) => new Promise((resolve, reject) => {
+  const child = execFile(file, args, { encoding: "utf8" }, (err, stdout, stderr) => {
+    if (err) reject(err);
+    else resolve({ stdout, stderr });
+  });
+  if (stdin !== void 0) {
+    child.stdin?.on("error", () => void 0);
+    child.stdin?.end(stdin);
+  }
+});
+function storeFor(deps) {
+  switch (deps.platform ?? process.platform) {
+    case "darwin":
+      return keychainStore(deps);
+    case "win32":
+      return dpapiStore(deps);
+    case "linux":
+      return secretServiceStore(deps);
+    default:
+      return null;
+  }
+}
+async function resolvePassphrase(deps) {
+  const fromEnv = envPassphrase(deps.env);
+  if (fromEnv !== null) return { passphrase: fromEnv, source: "env" };
+  const store = storeFor(deps);
+  if (store !== null) {
+    const fromStore = await store.read();
+    if (fromStore !== null) return { passphrase: fromStore, source: store.source };
+  }
+  if (canPrompt(deps)) {
+    const entered = await promptOf(deps)("Wallet passphrase: ");
+    if (entered.length === 0) throw noPassphraseError();
+    return { passphrase: entered, source: "prompt" };
+  }
+  throw noPassphraseError();
+}
+async function resolvePassphraseForCreate(deps) {
+  const fromEnv = envPassphrase(deps.env);
+  if (fromEnv !== null) return { passphrase: fromEnv, source: "env" };
+  const store = storeFor(deps);
+  if (store !== null) {
+    const generated = randomBytes(32).toString("base64url");
+    if (await store.store(generated)) {
+      return { passphrase: generated, source: store.source };
+    }
+  }
+  if (canPrompt(deps)) {
+    const prompt = promptOf(deps);
+    const first = await prompt("Set a wallet passphrase: ");
+    if (first.length === 0) {
+      throw new CliError("USAGE", "The wallet passphrase must not be empty.", {
+        fix: "Enter a non-empty passphrase, or set TENJIN_WALLET_PASSPHRASE."
+      });
+    }
+    const second = await prompt("Confirm passphrase: ");
+    if (first !== second) {
+      throw new CliError("USAGE", "The passphrases did not match.", {
+        fix: "Run `tenjin wallet create` again and enter the same passphrase both times."
+      });
+    }
+    return { passphrase: first, source: "prompt" };
+  }
+  throw noPassphraseError();
+}
+function keychainStore(deps) {
+  const exec = deps.exec ?? defaultExec;
+  return {
+    source: "keychain",
+    async read() {
+      try {
+        const { stdout } = await exec("security", [
+          "find-generic-password",
+          "-s",
+          KEYCHAIN_SERVICE,
+          "-a",
+          KEYCHAIN_ACCOUNT,
+          "-w"
+        ]);
+        return trimmedNonEmpty(stdout);
+      } catch {
+        return null;
+      }
+    },
+    async store(passphrase) {
+      if (!BASE64URL_RE.test(passphrase)) return false;
+      try {
+        const command = `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${KEYCHAIN_ACCOUNT} -w '${passphrase}'
+`;
+        await exec("security", ["-i"], command);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+var DPAPI_PROTECT_SCRIPT = [
+  "Add-Type -AssemblyName System.Security;",
+  "$in = [Console]::In.ReadToEnd();",
+  "$bytes = [System.Text.Encoding]::UTF8.GetBytes($in);",
+  "$prot = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, 'CurrentUser');",
+  "[Console]::Out.Write([Convert]::ToBase64String($prot));"
+].join(" ");
+var DPAPI_UNPROTECT_SCRIPT = [
+  "Add-Type -AssemblyName System.Security;",
+  "$in = [Console]::In.ReadToEnd();",
+  "$blob = [Convert]::FromBase64String($in.Trim());",
+  "$plain = [System.Security.Cryptography.ProtectedData]::Unprotect($blob, $null, 'CurrentUser');",
+  "[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($plain));"
+].join(" ");
+function powershellArgs(script) {
+  return ["-NoProfile", "-NonInteractive", "-Command", script];
+}
+function dpapiStore(deps) {
+  const exec = deps.exec ?? defaultExec;
+  const blobPath = passphraseBlobPath(deps.dir);
+  return {
+    source: "dpapi",
+    async read() {
+      let blob;
+      try {
+        blob = await readFile(blobPath, "utf8");
+      } catch {
+        return null;
+      }
+      try {
+        const { stdout } = await exec(
+          "powershell.exe",
+          powershellArgs(DPAPI_UNPROTECT_SCRIPT),
+          blob
+        );
+        const passphrase = stdout.replace(/\r?\n$/, "");
+        return passphrase.length > 0 ? passphrase : null;
+      } catch {
+        return null;
+      }
+    },
+    async store(passphrase) {
+      try {
+        const { stdout } = await exec(
+          "powershell.exe",
+          powershellArgs(DPAPI_PROTECT_SCRIPT),
+          passphrase
+        );
+        const blob = stdout.replace(/\r?\n$/, "").trim();
+        if (blob.length === 0) return false;
+        await writeFileAtomic(blobPath, blob, { mode: 384 });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function secretServiceStore(deps) {
+  const exec = deps.exec ?? defaultExec;
+  return {
+    source: "secret-service",
+    async read() {
+      try {
+        const { stdout } = await exec("secret-tool", [
+          "lookup",
+          "service",
+          KEYCHAIN_SERVICE,
+          "account",
+          KEYCHAIN_ACCOUNT
+        ]);
+        return trimmedNonEmpty(stdout);
+      } catch {
+        return null;
+      }
+    },
+    async store(passphrase) {
+      try {
+        await exec(
+          "secret-tool",
+          [
+            "store",
+            "--label=tenjin-cli-wallet",
+            "service",
+            KEYCHAIN_SERVICE,
+            "account",
+            KEYCHAIN_ACCOUNT
+          ],
+          passphrase
+        );
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function trimmedNonEmpty(stdout) {
+  const value = stdout.replace(/\r?\n$/, "");
+  return value.length > 0 ? value : null;
+}
+function envPassphrase(env) {
+  const value = env.TENJIN_WALLET_PASSPHRASE;
+  return value !== void 0 && value.length > 0 ? value : null;
+}
+function canPrompt(deps) {
+  return deps.isTTY ?? Boolean(process.stdin.isTTY);
+}
+function promptOf(deps) {
+  return deps.prompt ?? promptHidden;
+}
+function noPassphraseError() {
+  return new CliError("USAGE", "No wallet passphrase is available.", {
+    fix: "Set TENJIN_WALLET_PASSPHRASE (headless) or run in a terminal."
+  });
+}
+var CTRL_C = 3;
+var CTRL_D = 4;
+var BACKSPACE = 127;
+var BACKSPACE_ALT = 8;
+function promptHidden(label) {
+  return new Promise((resolve, reject) => {
+    const stdin = process.stdin;
+    const stderr = process.stderr;
+    const wasRaw = stdin.isRaw;
+    let value = "";
+    const cleanup = () => {
+      stdin.setRawMode?.(wasRaw ?? false);
+      stdin.pause();
+      stdin.removeListener("data", onData);
+    };
+    const onData = (chunk) => {
+      for (const ch of chunk.toString("utf8")) {
+        const code = ch.charCodeAt(0);
+        if (ch === "\n" || ch === "\r" || code === CTRL_D) {
+          cleanup();
+          stderr.write("\n");
+          resolve(value);
+          return;
+        }
+        if (code === CTRL_C) {
+          cleanup();
+          stderr.write("\n");
+          reject(
+            new CliError("USAGE", "Passphrase entry was cancelled.", {
+              fix: "Run the command again, or set TENJIN_WALLET_PASSPHRASE."
+            })
+          );
+          return;
+        }
+        if (code === BACKSPACE || code === BACKSPACE_ALT) {
+          value = value.slice(0, -1);
+        } else {
+          value += ch;
+        }
+      }
+    };
+    stderr.write(label);
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+
+// src/lib/wallet/local.ts
+var isWindows = process.platform === "win32";
+var KEY_STORAGE = "encrypted (keystore v3, scrypt)";
+var signerCache = /* @__PURE__ */ new Map();
+function createLocalProvider(deps) {
+  return {
+    id: "local",
+    async describe() {
+      const cred = resolveCredentialOrThrow(await loadCredential(deps));
+      return {
+        // A file credential's address is stored cleartext and returned as-is —
+        // no decryption. An env credential derives (and thereby validates) its
+        // key. getSigner is where a file wallet's key/address match is checked.
+        address: cred.source === "env" ? accountFromKey(cred.key, "env").address : cred.address,
+        provider: "local",
+        credentialSource: cred.source,
+        policyEnforcement: "client-only"
+      };
+    },
+    async getSigner() {
+      const cred = resolveCredentialOrThrow(await loadCredential(deps));
+      const account = await accountForSigning(cred, deps);
+      return {
+        address: account.address,
+        signMessage: (args) => account.signMessage({ message: args.message }),
+        signTypedData: (args) => account.signTypedData(args)
+      };
+    },
+    diagnostics() {
+      return localWalletDiagnostics(deps);
+    }
+  };
+}
+async function localWalletDiagnostics(deps) {
+  const mode = await walletFileMode(deps.dir);
+  const fileExists = mode !== null;
+  const envKey = deps.env.TENJIN_WALLET_KEY;
+  const envSet = envKey !== void 0 && envKey.length > 0;
+  const path = walletPath(deps.dir);
+  const warnings = [];
+  if (envSet && fileExists) {
+    warnings.push("TENJIN_WALLET_KEY is set and shadows the wallet file at runtime.");
+  }
+  if (mode !== null) {
+    if (isWindows) {
+      warnings.push("File permission checks are not available on Windows.");
+    } else if (mode !== 384) {
+      warnings.push(
+        `Wallet file permissions are ${mode.toString(8)}, expected 600. Run \`chmod 600 ${path}\`.`
+      );
+    }
+  }
+  const passphraseSource = deps.env.TENJIN_WALLET_PASSPHRASE !== void 0 && deps.env.TENJIN_WALLET_PASSPHRASE.length > 0 ? "TENJIN_WALLET_PASSPHRASE" : void 0;
+  return {
+    ...fileExists ? { walletPath: path, keyStorage: KEY_STORAGE } : {},
+    ...fileExists && passphraseSource !== void 0 ? { passphraseSource } : {},
+    warnings
+  };
+}
+async function createLocalWallet(dir, passphrase) {
+  const key = generatePrivateKey();
+  const address = privateKeyToAccount(key).address;
+  const keystore = await encryptToKeystore(key, passphrase);
+  await writeWalletRecord(dir, walletRecord(address, keystore));
+  return { address, walletPath: walletPath(dir) };
+}
+async function loadCredential(deps) {
+  const envKey = deps.env.TENJIN_WALLET_KEY;
+  if (envKey !== void 0 && envKey.trim().length > 0) {
+    const key = envKey.trim();
+    if (!PRIVATE_KEY_RE.test(key)) {
+      throw new CliError("WALLET_INVALID_KEY", "TENJIN_WALLET_KEY is not a valid private key.", {
+        fix: "Set TENJIN_WALLET_KEY to a 0x-prefixed 32-byte hex key, or unset it to use the wallet file."
+      });
+    }
+    return { source: "env", key };
+  }
+  const record = await readWalletRecord(deps.dir);
+  if (record !== null) {
+    return { source: "file", keystore: record.keystore, address: record.address };
+  }
+  return null;
+}
+async function accountForSigning(cred, deps) {
+  if (cred.source === "env") return accountFromKey(cred.key, "env");
+  const cached = signerCache.get(cred.keystore.id);
+  if (cached !== void 0) return cached;
+  const { passphrase } = await resolvePassphrase({
+    env: deps.env,
+    dir: deps.dir,
+    ...deps.passphrase
+  });
+  let key;
+  try {
+    const derived = await toKeyAsync(cred.keystore, { password: passphrase });
+    key = decrypt(cred.keystore, derived);
+  } catch (err) {
+    throw new CliError("WALLET_INVALID_KEY", "Could not decrypt the wallet keystore.", {
+      fix: "Check the passphrase: TENJIN_WALLET_PASSPHRASE, the macOS keychain (service tenjin-cli), or the one you enter when prompted.",
+      cause: err
+    });
+  }
+  const account = accountFromKey(key, "file");
+  if (account.address.toLowerCase() !== cred.address.toLowerCase()) {
+    throw new CliError(
+      "WALLET_INVALID_KEY",
+      `The decrypted key derives ${account.address}, not the wallet file's stored address ${cred.address}.`,
+      {
+        fix: "The wallet file may be tampered. Move it aside, then run `tenjin wallet create` for a fresh key or set TENJIN_WALLET_KEY to use the intended one."
+      }
+    );
+  }
+  signerCache.set(cred.keystore.id, account);
+  return account;
+}
+function accountFromKey(key, source) {
+  try {
+    return privateKeyToAccount(key);
+  } catch (err) {
+    throw new CliError("WALLET_INVALID_KEY", "The private key is not a valid secp256k1 key.", {
+      fix: source === "file" ? "Move the wallet file aside, then run `tenjin wallet create` for a fresh key or set TENJIN_WALLET_KEY to use the intended one." : "Set TENJIN_WALLET_KEY to a valid 0x-prefixed 32-byte hex key.",
+      cause: err
+    });
+  }
+}
+async function encryptToKeystore(key, passphrase) {
+  const [derivedKey, opts] = await scryptAsync2({ password: passphrase });
+  return encrypt2(key, derivedKey, opts);
+}
+function resolveCredentialOrThrow(cred) {
+  if (cred === null) {
+    throw new CliError("WALLET_MISSING", "No wallet found.", {
+      fix: "Run `tenjin wallet create` to create one."
+    });
+  }
+  return cred;
+}
+function walletRecord(address, keystore) {
+  return {
+    schemaVersion: 2,
+    provider: "local",
+    address,
+    keystore,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/lib/wallet/index.ts
+function resolveWalletProvider(ctx, opts = {}) {
+  if (opts.provider !== void 0) return opts.provider;
+  return createLocalProvider({ dir: ctx.dataDir, env: process.env });
+}
+async function describeWallet(provider) {
+  try {
+    return await provider.describe();
+  } catch (err) {
+    if (err instanceof CliError) throw err;
+    const message = err instanceof Error ? err.message : "unknown error";
+    throw new CliError("PROVIDER_ERROR", `Wallet provider "${provider.id}" failed: ${message}`, {
+      fix: "Check the wallet provider and try again.",
+      cause: err
+    });
+  }
+}
+
+export {
+  resolvePassphraseForCreate,
+  createLocalWallet,
+  resolveWalletProvider,
+  describeWallet
+};
+/*! Bundled license information:
+
+@noble/ciphers/esm/utils.js:
+  (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
+*/
+//# sourceMappingURL=chunk-EXBMF5X7.js.map