tollkit-wallet 0.2.1 → 0.2.2

package/dist/keystore.d.ts

@@ -3,6 +3,15 @@
  * EVM: the standard Ethereum JSON keystore (ethers v6, scrypt + AES-128-CTR).
  * Solana: the 64-byte secret key, scrypt-derived key + AES-256-GCM.
  * Tollkit never sees either key or the password.
+ *
+ * New wallets come from a 12-word BIP-39 recovery phrase, derived the way
+ * MetaMask and Phantom do it, so the same phrase restores the same addresses
+ * there too (checked 2026-10-14):
+ *   EVM    m/44'/60'/0'/0/0  (MetaMask: "default BIP-44 derivation path (m/44'/60'/0'/0)";
+ *                             Phantom default bip44Change "m/44'/60'/0'/0/${index}")
+ *   Solana m/44'/501'/0'/0'  (Phantom default bip44Change "m/44'/501'/${index}'/0'"),
+ *          ed25519 via SLIP-0010 (hardened only).
+ * The phrase is kept encrypted like the keys so the owner can view it again with the password.
  */
 import { Keypair } from "@solana/web3.js";
 import { Wallet, HDNodeWallet } from "ethers";
@@ -18,30 +27,67 @@ export interface KeystoreFile {
     evm_address: string;
     solana_address: string;
     evm: string;
-    solana: {
-        kdf: "scrypt";
-        N: number;
-        r: number;
-        p: number;
-        salt: string;
-        iv: string;
-        tag: string;
-        ct: string;
-    };
+    solana: Sealed;
+    /** The recovery phrase, sealed like the Solana key. Absent on wallets made before 0.2.2 (keys only). */
+    phrase?: Sealed;
 }
+type Sealed = {
+    kdf: "scrypt";
+    N: number;
+    r: number;
+    p: number;
+    salt: string;
+    iv: string;
+    tag: string;
+    ct: string;
+};
+export declare const EVM_PATH = "m/44'/60'/0'/0/0";
+export declare const SOLANA_PATH = "m/44'/501'/0'/0'";
+/** SLIP-0010 ed25519 private key for a hardened-only path, from a BIP-39 seed. */
+export declare function slip10Ed25519(seed: Uint8Array, path: string): Uint8Array;
+/** Both keys from a recovery phrase. Throws on an invalid phrase. */
+export declare function keysFromPhrase(phrase: string): {
+    evm: HDNodeWallet;
+    solana: Keypair;
+    phrase: string;
+};
+export declare function newPhrase(): string;
 export interface Keys {
     evm: Wallet | HDNodeWallet;
     solana: Keypair;
 }
-/** Make a new wallet (or import keys). Refuses to overwrite an existing one. */
+/**
+ * Make a new wallet from a fresh recovery phrase, restore one from a phrase, or import raw keys.
+ * Refuses to overwrite an existing wallet unless `replace` is set, which keeps the old file as keystore.json.replaced-<time>.
+ */
 export declare function createKeystore(password: string, opts?: {
     dir?: string;
+    phrase?: string;
     evmPrivateKey?: string;
     solanaSecretKey?: Uint8Array;
     scrypt?: ScryptParams;
+    replace?: boolean;
 }): Promise<{
     evm: string;
     solana: string;
+    phrase: string | undefined;
+}>;
+/** Whether the owner has confirmed they wrote the backup down. */
+export declare function backupDone(dir?: string): boolean;
+export declare function markBackedUp(dir?: string): void;
+/** Is there a recovery phrase, or only keys (wallets made before 0.2.2)? */
+export declare function backupKind(dir?: string): "phrase" | "keys";
+/**
+ * What the owner writes down to restore the wallet: the phrase, or for older wallets
+ * the two private keys (EVM hex, Solana base58, the formats other wallets import).
+ */
+export declare function revealBackup(password: string, dir?: string): Promise<{
+    kind: "phrase";
+    phrase: string;
+} | {
+    kind: "keys";
+    evm_private_key: string;
+    solana_secret_key: string;
 }>;
 export declare function readKeystore(dir?: string): KeystoreFile;
 /** Public addresses only; no password needed. */
@@ -51,3 +97,4 @@ export declare function addresses(dir?: string): {
 };
 /** Unlock both keys. Throws "wrong password" on a bad password. */
 export declare function unlock(password: string, dir?: string): Promise<Keys>;
+export {};

package/dist/keystore.js

@@ -3,22 +3,64 @@
  * EVM: the standard Ethereum JSON keystore (ethers v6, scrypt + AES-128-CTR).
  * Solana: the 64-byte secret key, scrypt-derived key + AES-256-GCM.
  * Tollkit never sees either key or the password.
+ *
+ * New wallets come from a 12-word BIP-39 recovery phrase, derived the way
+ * MetaMask and Phantom do it, so the same phrase restores the same addresses
+ * there too (checked 2026-10-14):
+ *   EVM    m/44'/60'/0'/0/0  (MetaMask: "default BIP-44 derivation path (m/44'/60'/0'/0)";
+ *                             Phantom default bip44Change "m/44'/60'/0'/0/${index}")
+ *   Solana m/44'/501'/0'/0'  (Phantom default bip44Change "m/44'/501'/${index}'/0'"),
+ *          ed25519 via SLIP-0010 (hardened only).
+ * The phrase is kept encrypted like the keys so the owner can view it again with the password.
  */
 import { Keypair } from "@solana/web3.js";
-import { Wallet, encryptKeystoreJson } from "ethers";
+import { Wallet, HDNodeWallet, Mnemonic, encryptKeystoreJson, computeHmac, getBytes, concat, toBeArray, zeroPadValue, encodeBase58, randomBytes as ethersRandom } from "ethers";
 import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCb } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { files, walletHome } from "./paths.js";
+import path from "node:path";
 export const DEFAULT_SCRYPT = { N: 1 << 17, r: 8, p: 1 };
+export const EVM_PATH = "m/44'/60'/0'/0/0";
+export const SOLANA_PATH = "m/44'/501'/0'/0'";
+/** SLIP-0010 ed25519 private key for a hardened-only path, from a BIP-39 seed. */
+export function slip10Ed25519(seed, path) {
+    if (!/^m(\/\d+')*$/.test(path))
+        throw new Error("ed25519 paths must be fully hardened, e.g. m/44'/501'/0'/0'");
+    let I = getBytes(computeHmac("sha512", new TextEncoder().encode("ed25519 seed"), seed));
+    let key = I.slice(0, 32), chain = I.slice(32);
+    for (const seg of path.split("/").slice(1)) {
+        const index = (Number(seg.slice(0, -1)) + 0x80000000) >>> 0;
+        const data = concat([new Uint8Array([0]), key, zeroPadValue(toBeArray(index), 4)]);
+        I = getBytes(computeHmac("sha512", chain, data));
+        key = I.slice(0, 32);
+        chain = I.slice(32);
+    }
+    return key;
+}
+/** Both keys from a recovery phrase. Throws on an invalid phrase. */
+export function keysFromPhrase(phrase) {
+    const clean = phrase.trim().toLowerCase().split(/\s+/).join(" ");
+    let m;
+    try {
+        m = Mnemonic.fromPhrase(clean);
+    }
+    catch {
+        throw new Error("That recovery phrase isn't valid. Check the words and their order.");
+    }
+    const evm = HDNodeWallet.fromMnemonic(m, EVM_PATH);
+    const solana = Keypair.fromSeed(slip10Ed25519(getBytes(m.computeSeed()), SOLANA_PATH));
+    return { evm, solana, phrase: m.phrase };
+}
+export function newPhrase() { return Mnemonic.fromEntropy(ethersRandom(16)).phrase; }
 const scrypt = (pw, salt, s) => new Promise((res, rej) => scryptCb(pw, salt, 32, { N: s.N, r: s.r, p: s.p, maxmem: 256 * 1024 * 1024 }, (e, k) => (e ? rej(e) : res(k))));
-async function sealSolana(secret, pw, s) {
+async function seal(secret, pw, s) {
     const salt = randomBytes(16), iv = randomBytes(12);
     const key = await scrypt(pw, salt, s);
     const c = createCipheriv("aes-256-gcm", key, iv);
     const ct = Buffer.concat([c.update(Buffer.from(secret)), c.final()]);
     return { kdf: "scrypt", ...s, salt: salt.toString("hex"), iv: iv.toString("hex"), tag: c.getAuthTag().toString("hex"), ct: ct.toString("hex") };
 }
-async function openSolana(box, pw) {
+async function openSealed(box, pw) {
     const key = await scrypt(pw, Buffer.from(box.salt, "hex"), { N: box.N, r: box.r, p: box.p });
     const d = createDecipheriv("aes-256-gcm", key, Buffer.from(box.iv, "hex"));
     d.setAuthTag(Buffer.from(box.tag, "hex"));
@@ -29,21 +71,38 @@ async function openSolana(box, pw) {
     catch {
         throw new Error("wrong password");
     }
-    return Keypair.fromSecretKey(new Uint8Array(secret));
+    return secret;
 }
+const openSolana = async (box, pw) => Keypair.fromSecretKey(new Uint8Array(await openSealed(box, pw)));
 function checkPassword(pw) {
     if (typeof pw !== "string" || pw.length < 12)
         throw new Error("Use a password of at least 12 characters.");
 }
-/** Make a new wallet (or import keys). Refuses to overwrite an existing one. */
+/**
+ * Make a new wallet from a fresh recovery phrase, restore one from a phrase, or import raw keys.
+ * Refuses to overwrite an existing wallet unless `replace` is set, which keeps the old file as keystore.json.replaced-<time>.
+ */
 export async function createKeystore(password, opts = {}) {
     checkPassword(password);
     const f = files(walletHome(opts.dir));
-    if (existsSync(f.keystore))
-        throw new Error(`A wallet already exists at ${f.keystore}. Back it up and remove it first if you want a new one.`);
+    if (existsSync(f.keystore)) {
+        if (!opts.replace)
+            throw new Error(`A wallet already exists at ${f.keystore}. Back it up and remove it first if you want a new one.`);
+        // Keep the old wallet's files (renamed, never deleted). Its limits and saved password were sealed with the old password.
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        for (const old of [f.keystore, f.policy, f.backup, path.join(walletHome(opts.dir), "password")])
+            if (existsSync(old))
+                renameSync(old, `${old}.replaced-${stamp}`);
+    }
     const s = opts.scrypt ?? DEFAULT_SCRYPT;
-    const evm = opts.evmPrivateKey ? new Wallet(opts.evmPrivateKey) : Wallet.createRandom();
-    const sol = opts.solanaSecretKey ? Keypair.fromSecretKey(opts.solanaSecretKey) : Keypair.generate();
+    const importing = !!(opts.evmPrivateKey || opts.solanaSecretKey);
+    if (importing && opts.phrase)
+        throw new Error("Give a recovery phrase or keys, not both.");
+    if (importing && !(opts.evmPrivateKey && opts.solanaSecretKey))
+        throw new Error("Importing keys needs both the EVM private key and the Solana secret key.");
+    const fromPhrase = importing ? null : keysFromPhrase(opts.phrase ?? newPhrase());
+    const evm = fromPhrase ? fromPhrase.evm : new Wallet(opts.evmPrivateKey);
+    const sol = fromPhrase ? fromPhrase.solana : Keypair.fromSecretKey(opts.solanaSecretKey);
     const evmJson = await encryptKeystoreJson({ address: evm.address, privateKey: evm.privateKey }, password, { scrypt: { N: s.N, r: s.r, p: s.p } });
     const ks = {
         version: 1,
@@ -51,12 +110,29 @@ export async function createKeystore(password, opts = {}) {
         evm_address: evm.address,
         solana_address: sol.publicKey.toBase58(),
         evm: evmJson,
-        solana: await sealSolana(sol.secretKey, password, s),
+        solana: await seal(sol.secretKey, password, s),
+        ...(fromPhrase ? { phrase: await seal(new TextEncoder().encode(fromPhrase.phrase), password, s) } : {}),
     };
     const tmp = f.keystore + ".tmp";
     writeFileSync(tmp, JSON.stringify(ks, null, 2), { mode: 0o600 });
     renameSync(tmp, f.keystore);
-    return { evm: ks.evm_address, solana: ks.solana_address };
+    return { evm: ks.evm_address, solana: ks.solana_address, phrase: fromPhrase?.phrase };
+}
+/** Whether the owner has confirmed they wrote the backup down. */
+export function backupDone(dir) { return existsSync(files(walletHome(dir)).backup); }
+export function markBackedUp(dir) { writeFileSync(files(walletHome(dir)).backup, JSON.stringify({ confirmed_at: new Date().toISOString() }) + "\n", { mode: 0o600 }); }
+/** Is there a recovery phrase, or only keys (wallets made before 0.2.2)? */
+export function backupKind(dir) { return readKeystore(dir).phrase ? "phrase" : "keys"; }
+/**
+ * What the owner writes down to restore the wallet: the phrase, or for older wallets
+ * the two private keys (EVM hex, Solana base58, the formats other wallets import).
+ */
+export async function revealBackup(password, dir) {
+    const ks = readKeystore(dir);
+    if (ks.phrase)
+        return { kind: "phrase", phrase: new TextDecoder().decode(await openSealed(ks.phrase, password)) };
+    const k = await unlock(password, dir);
+    return { kind: "keys", evm_private_key: k.evm.privateKey, solana_secret_key: encodeBase58(k.solana.secretKey) };
 }
 export function readKeystore(dir) {
     const f = files(walletHome(dir));

package/dist/keystore.js.map

@@ -1 +1 @@
-{"version":3,"file":"keystore.js","sourceRoot":"","sources":["../src/keystore.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAgB,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG/C,MAAM,CAAC,MAAM,cAAc,GAAiB,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAavE,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,CAAe,EAAE,EAAE,CAC3D,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC/B,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpH,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,EAAU,EAAE,CAAe;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,QAAiB,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3J,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAA2B,EAAE,EAAU;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAClF,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC7G,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAsG,EAAE;IAC7J,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,QAAQ,yDAAyD,CAAC,CAAC;IAC/I,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpG,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClJ,MAAM,EAAE,GAAiB;QACvB,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,GAAG,CAAC,OAAO;QACxB,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE;QACxC,GAAG,EAAE,OAAO;QACZ,MAAM,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;KACrD,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAiB,CAAC;AACtE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;AAC5D,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,GAAY;IACzD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAA0B,CAAC;IAC/B,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpJ,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"keystore.js","sourceRoot":"","sources":["../src/keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEhL,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,MAAM,cAAc,GAAiB,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAcvE,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAE9C,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,IAAY;IAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/G,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAW,CAAC;IAChB,IAAI,CAAC;QAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAAC,CAAC;IACxI,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,KAAa,OAAO,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAI7F,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,CAAe,EAAE,EAAE,CAC3D,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC/B,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpH,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,EAAU,EAAE,CAAe;IACjE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,QAAiB,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3J,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,EAAU;IAC/C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAClF,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEvH,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC7G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA0I,EAAE;IACjM,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,QAAQ,yDAAyD,CAAC,CAAC;QACtI,yHAAyH;QACzH,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;YAAE,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,aAAa,KAAK,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;IACjE,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3F,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC5J,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAc,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,eAAgB,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClJ,MAAM,EAAE,GAAiB;QACvB,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,GAAG,CAAC,OAAO;QACxB,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE;QACxC,GAAG,EAAE,OAAO;QACZ,MAAM,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxG,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACxF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,GAAY,IAAa,OAAO,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvG,MAAM,UAAU,YAAY,CAAC,GAAY,IAAI,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAEhL,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,GAAY,IAAuB,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAY;IAC/D,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAiB,CAAC;AACtE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;AAC5D,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,GAAY;IACzD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAA0B,CAAC;IAC/B,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpJ,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC"}

package/dist/ledger.d.ts

@@ -1,5 +1,5 @@
 import type { Policy } from "./policy.js";
-export type Kind = "trade" | "payment" | "withdrawal";
+export type Kind = "trade" | "payment" | "withdrawal" | "stake" | "move" | "dapp";
 export type Status = "pending" | "done" | "failed";
 export interface Entry {
     id: string;

package/dist/mcp.d.ts

@@ -2,7 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { TollkitWallet } from "./wallet.js";
 /** The only tools the wallet's built-in AI chat gets: read, look at prices, and suggest rules for the owner to turn on. */
 export declare const ADVISOR_TOOLS: string[];
-export declare const VERSION = "0.2.1";
+export declare const VERSION = "0.2.2";
 export declare function passwordFromEnv(): string;
 export declare function buildServer(w: TollkitWallet, o?: {
     advisor?: boolean;

package/dist/mcp.js

@@ -13,7 +13,7 @@ import { TollkitWallet } from "./wallet.js";
 import { ACTIONS, proposeRules } from "./actions.js";
 /** The only tools the wallet's built-in AI chat gets: read, look at prices, and suggest rules for the owner to turn on. */
 export const ADVISOR_TOOLS = ["wallet_status", "wallet_balances", "swap_quote", "receipts", "market_prices", "price_history", "autopilot_rules", "autopilot_propose", "paper_status"];
-export const VERSION = "0.2.1";
+export const VERSION = "0.2.2";
 export function passwordFromEnv() {
     const file = process.env.TOLLKIT_WALLET_PASSWORD_FILE;
     if (file)

package/dist/netguard.d.ts

@@ -0,0 +1,8 @@
+/** Keeping agent-driven requests on the public internet. */
+/** This computer and private networks (so an agent can't reach the local dashboard or devices). */
+export declare function isLocalUrl(u: string): boolean;
+/**
+ * fetch that refuses this computer and private networks, on the first URL and on every redirect
+ * (Node's fetch would otherwise follow a redirect to 127.0.0.1 with the same method and headers).
+ */
+export declare function publicFetch(f?: typeof fetch): typeof fetch;

package/dist/netguard.js

@@ -0,0 +1,44 @@
+/** Keeping agent-driven requests on the public internet. */
+/** This computer and private networks (so an agent can't reach the local dashboard or devices). */
+export function isLocalUrl(u) {
+    let h;
+    try {
+        h = new URL(u).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    }
+    catch {
+        return true;
+    }
+    if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h === "0.0.0.0" || h === "::" || h === "::1")
+        return true;
+    if (h.includes(":"))
+        return /^(fe80|fc|fd)/.test(h) || h.startsWith("::ffff:");
+    const m = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(h);
+    if (!m)
+        return false;
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    return a === 127 || a === 10 || a === 0 || (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127);
+}
+/**
+ * fetch that refuses this computer and private networks, on the first URL and on every redirect
+ * (Node's fetch would otherwise follow a redirect to 127.0.0.1 with the same method and headers).
+ */
+export function publicFetch(f = fetch) {
+    return (async (input, init = {}) => {
+        let url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+        let opts = { ...init };
+        for (let hop = 0; hop <= 5; hop++) {
+            if (isLocalUrl(url))
+                throw new Error("Refused: that address is on this computer or a private network.");
+            const r = await f(url, { ...opts, redirect: "manual" });
+            const loc = r.headers.get("location");
+            if (![301, 302, 303, 307, 308].includes(r.status) || !loc)
+                return r;
+            url = new URL(loc, url).href;
+            const m = String(opts.method ?? "GET").toUpperCase();
+            if (r.status === 303 || ((r.status === 301 || r.status === 302) && m === "POST"))
+                opts = { ...opts, method: "GET", body: undefined };
+        }
+        throw new Error("Too many redirects.");
+    });
+}
+//# sourceMappingURL=netguard.js.map

package/dist/netguard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"netguard.js","sourceRoot":"","sources":["../src/netguard.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,mGAAmG;AACnG,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvI,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;AAC7K,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAkB,KAAK;IACjD,OAAO,CAAC,KAAK,EAAE,KAAwB,EAAE,OAAoB,EAAE,EAAE,EAAE;QACjE,IAAI,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5F,IAAI,IAAI,GAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;QACpC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACxG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBAAE,OAAO,CAAC,CAAC;YACpE,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;gBAAE,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACvI,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC,CAAiB,CAAC;AACrB,CAAC"}

package/dist/paths.d.ts

@@ -10,4 +10,5 @@ export declare const files: (dir: string) => {
     lock: string;
     sanctions: string;
     telegram: string;
+    backup: string;
 };

package/dist/paths.js

@@ -18,5 +18,6 @@ export const files = (dir) => ({
     lock: path.join(dir, ".lock"),
     sanctions: path.join(dir, "sanctions.json"),
     telegram: path.join(dir, "telegram.json"),
+    backup: path.join(dir, "backup.json"),
 });
 //# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC/F,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;AACrF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEvI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IACrC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;CAC1C,CAAC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC/F,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;AACrF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEvI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IACrC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;CACtC,CAAC,CAAC"}

package/dist/policy.d.ts

@@ -17,12 +17,12 @@ export declare const PolicySchema: z.ZodObject<{
         address: z.ZodString;
         label: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        chain: "base" | "ethereum" | "solana";
         address: string;
+        chain: "base" | "ethereum" | "solana";
         label: string;
     }, {
-        chain: "base" | "ethereum" | "solana";
         address: string;
+        chain: "base" | "ethereum" | "solana";
         label?: string | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
@@ -37,8 +37,8 @@ export declare const PolicySchema: z.ZodObject<{
     block_seller_warnings: boolean;
     agent_rules: "propose" | "auto";
     withdraw_addresses: {
-        chain: "base" | "ethereum" | "solana";
         address: string;
+        chain: "base" | "ethereum" | "solana";
         label: string;
     }[];
 }, {
@@ -53,8 +53,8 @@ export declare const PolicySchema: z.ZodObject<{
     block_seller_warnings: boolean;
     agent_rules?: "propose" | "auto" | undefined;
     withdraw_addresses?: {
-        chain: "base" | "ethereum" | "solana";
         address: string;
+        chain: "base" | "ethereum" | "solana";
         label?: string | undefined;
     }[] | undefined;
 }>;

package/dist/rules.d.ts

@@ -31,12 +31,12 @@ export declare const RuleInput: z.ZodObject<{
     /** Id of an existing rule this one replaces: turning this on cancels that one (e.g. moving a stop-loss up). */
     replaces: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    chain: "base" | "ethereum" | "solana";
     kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+    chain: "base" | "ethereum" | "solana";
     token: string;
     every?: "hour" | "day" | "week" | undefined;
-    reason?: string | undefined;
     name?: string | undefined;
+    reason?: string | undefined;
     sell_amount?: string | undefined;
     amount_usd?: number | undefined;
     sell_percent?: number | undefined;
@@ -49,12 +49,12 @@ export declare const RuleInput: z.ZodObject<{
     expires_at?: string | undefined;
     replaces?: string | undefined;
 }, {
-    chain: "base" | "ethereum" | "solana";
     kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+    chain: "base" | "ethereum" | "solana";
     token: string;
     every?: "hour" | "day" | "week" | undefined;
-    reason?: string | undefined;
     name?: string | undefined;
+    reason?: string | undefined;
     sell_amount?: string | undefined;
     amount_usd?: number | undefined;
     sell_percent?: number | undefined;

package/dist/sell.d.ts

@@ -0,0 +1,60 @@
+import type { Chain } from "./chains.js";
+export declare const SELL_ASSETS: Record<Chain, string[]>;
+/** Coinbase's window after "Cash out now" (docs.cdp.coinbase.com/onramp/offramp/offramp-integration-guide). */
+export declare const SEND_WINDOW_MS: number;
+export interface Sale {
+    ref: string;
+    ts: string;
+    chain: Chain;
+    asset: string;
+    amount: string | null;
+    state: "open" | "sending" | "sent" | "done" | "failed" | "expired";
+    tx?: string;
+    payout?: string;
+    reason?: string;
+}
+export interface OfframpTx {
+    id: string;
+    status: string;
+    asset: string;
+    network: string;
+    sell_amount: {
+        value: string;
+        currency: string;
+    } | null;
+    total: {
+        value: string;
+        currency: string;
+    } | null;
+    coinbase_fee: {
+        value: string;
+        currency: string;
+    } | null;
+    to_address: string;
+    from_address: string;
+    tx_hash: string;
+    created_at: string;
+    updated_at: string;
+}
+type Fetch = typeof fetch;
+export declare class Sales {
+    private o;
+    private file;
+    constructor(o: {
+        dir?: string;
+        proxy?: string;
+        fetch?: Fetch;
+    });
+    private get f();
+    private get proxy();
+    list(): Sale[];
+    get(ref: string): Sale | undefined;
+    update(ref: string, patch: Partial<Sale>): void;
+    start(address: string, chain: Chain, asset: string, amount?: string): Promise<{
+        url: string;
+        ref: string;
+    }>;
+    /** Coinbase's latest word on a sale (null until the owner has started on Coinbase). */
+    status(address: string, ref: string): Promise<OfframpTx | null>;
+}
+export {};

package/dist/sell.js

@@ -0,0 +1,71 @@
+/**
+ * "Cash out": sell crypto to your bank or PayPal through Coinbase Offramp.
+ *
+ * 1. The wallet asks Tollkit's server (POST {proxy}/offramp) for a single-use Coinbase sell link and a reference.
+ * 2. The owner signs in to Coinbase, picks where the money goes and clicks "Cash out now".
+ * 3. Coinbase then says where to send the crypto (GET {proxy}/offramp/status). The wallet shows that to the owner,
+ *    who confirms with the password; only then is the crypto sent. Coinbase allows 30 minutes for this.
+ * Only the public address, network, coin and amount are sent to Tollkit's server. A Coinbase account is required.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { DEFAULT_PROXY } from "./swap.js";
+import { walletHome } from "./paths.js";
+export const SELL_ASSETS = { base: ["USDC", "ETH"], ethereum: ["USDC", "ETH"], solana: ["USDC", "SOL"] };
+/** Coinbase's window after "Cash out now" (docs.cdp.coinbase.com/onramp/offramp/offramp-integration-guide). */
+export const SEND_WINDOW_MS = 30 * 60_000;
+export class Sales {
+    o;
+    file;
+    constructor(o) {
+        this.o = o;
+        this.file = path.join(walletHome(o.dir), "sales.json");
+    }
+    get f() { return this.o.fetch ?? fetch; }
+    get proxy() { return this.o.proxy ?? DEFAULT_PROXY; }
+    list() { try {
+        return existsSync(this.file) ? JSON.parse(readFileSync(this.file, "utf8")) : [];
+    }
+    catch {
+        return [];
+    } }
+    get(ref) { return this.list().find((s) => s.ref === ref); }
+    update(ref, patch) {
+        const l = this.list().map((s) => (s.ref === ref ? { ...s, ...patch } : s));
+        writeFileSync(this.file, JSON.stringify(l, null, 2), { mode: 0o600 });
+    }
+    async start(address, chain, asset, amount) {
+        if (!SELL_ASSETS[chain]?.includes(asset))
+            throw new Error(`On ${chain} you can cash out ${(SELL_ASSETS[chain] ?? []).join(" or ")}.`);
+        if (amount === undefined || !(/^\d+(\.\d+)?$/.test(amount) && Number(amount) > 0))
+            throw new Error("Enter how much to cash out, like 25 or 0.05.");
+        const r = await this.f(`${this.proxy}/offramp`, { method: "POST", headers: { "content-type": "application/json" }, signal: AbortSignal.timeout(25_000), body: JSON.stringify({ address, network: chain, asset, ...(amount ? { amount } : {}) }) });
+        const j = await r.json().catch(() => ({}));
+        if (!r.ok)
+            throw new Error(r.status === 404 ? "Cashing out isn't available from Tollkit's server yet." : j?.message ?? `Tollkit's server answered HTTP ${r.status}.`);
+        if (typeof j.url !== "string" || !j.url.startsWith("https://pay.coinbase.com/v3/sell/") || !/^tw-[0-9a-f]{16}-[0-9a-f]{16}$/.test(String(j.ref)))
+            throw new Error("Didn't get a Coinbase sell link.");
+        const sale = { ref: j.ref, ts: new Date().toISOString(), chain, asset, amount: amount ?? null, state: "open" };
+        writeFileSync(this.file, JSON.stringify([sale, ...this.list()].slice(0, 50), null, 2), { mode: 0o600 });
+        return { url: j.url, ref: j.ref };
+    }
+    /** Coinbase's latest word on a sale (null until the owner has started on Coinbase). */
+    async status(address, ref) {
+        const r = await this.f(`${this.proxy}/offramp/status?${new URLSearchParams({ ref, address })}`, { signal: AbortSignal.timeout(20_000) });
+        const j = await r.json().catch(() => ({}));
+        if (!r.ok)
+            throw new Error(j?.message ?? `Tollkit's server answered HTTP ${r.status}.`);
+        const t = j.transaction;
+        if (t) {
+            const s = this.get(ref);
+            if (s && s.state !== "done" && /SUCCESS/.test(t.status))
+                this.update(ref, { state: "done", payout: t.total ? `${t.total.value} ${t.total.currency}` : undefined });
+            else if (s && s.state !== "failed" && /FAILED/.test(t.status))
+                this.update(ref, { state: "failed" });
+            else if (s && s.state === "open" && /EXPIRED/.test(t.status))
+                this.update(ref, { state: "expired" });
+        }
+        return t;
+    }
+}
+//# sourceMappingURL=sell.js.map

package/dist/sell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sell.js","sourceRoot":"","sources":["../src/sell.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,MAAM,CAAC,MAAM,WAAW,GAA4B,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAClI,+GAA+G;AAC/G,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAO1C,MAAM,OAAO,KAAK;IAEI;IADZ,IAAI,CAAS;IACrB,YAAoB,CAAkD;QAAlD,MAAC,GAAD,CAAC,CAAiD;QAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IAAC,CAAC;IACnI,IAAY,CAAC,KAAY,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;IACxD,IAAY,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC;IAE7D,IAAI,KAAa,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC,CAAC,CAAC;IAChI,GAAG,CAAC,GAAW,IAAsB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,GAAW,EAAE,KAAoB;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,KAAY,EAAE,KAAa,EAAE,MAAe;QACvE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtI,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACnJ,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnP,MAAM,CAAC,GAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,kCAAkC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtK,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,mCAAmC,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtM,MAAM,IAAI,GAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACrH,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxG,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,mBAAmB,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzI,MAAM,CAAC,GAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,kCAAkC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,CAAC,CAAC,WAA+B,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;iBAC9J,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;iBAChG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;CACF"}