diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 832c369d..d276deff 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -1,42 +1,21 @@ -# Known advisories in transitive dependencies from the Blueprint SDK, -# Sandbox runtime, and the ethers-v2 stack used by Hyperliquid. -# These are not direct deps of ai-trading-blueprint. -# -# Each ID is matched 1:1 with deny.toml's [advisories].ignore list and -# documented in audits/static-analysis-triage.md. Re-evaluate quarterly -# (first Monday of each quarter) or when a fix lands upstream. +# Current transitive advisories that cannot be removed by this workspace. +# Dependency paths and applicability are kept in the static-analysis triage. [advisories] ignore = [ - # ── substrate / blueprint-sdk transitive ──────────────────────────────── - "RUSTSEC-2021-0141", # ansi_term unmaintained (via substrate) - "RUSTSEC-2024-0384", # instant unmaintained (via substrate) - "RUSTSEC-2024-0388", # derivative unmaintained (via Alloy/ruint) - "RUSTSEC-2024-0436", # paste unmaintained (via substrate) - "RUSTSEC-2025-0009", # ring < 0.17.12 panic (via substrate) - "RUSTSEC-2025-0010", # ring < 0.17 unmaintained (via substrate) - "RUSTSEC-2025-0012", # ring transitive (via substrate) - "RUSTSEC-2025-0055", # tracing-subscriber 0.2 ANSI escape (via substrate) - "RUSTSEC-2025-0111", # tokio-tar PAX header (testcontainers, dev-only) - "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (via substrate) - "RUSTSEC-2025-0141", # bincode 1.x unmaintained (via substrate / solana) - "RUSTSEC-2025-0161", # libsecp256k1 unmaintained (via blueprint-networking) - "RUSTSEC-2026-0002", # lru IterMut Stacked Borrows (via substrate) - "RUSTSEC-2026-0044", # aws-lc-sys < 0.39.0 (via substrate) - "RUSTSEC-2026-0048", # aws-lc-sys < 0.39.0 (via substrate) - "RUSTSEC-2026-0049", # substrate transitive - "RUSTSEC-2026-0067", # substrate transitive - "RUSTSEC-2026-0068", # substrate transitive - "RUSTSEC-2026-0097", # rand 0.7 unsoundness (via substrate) - "RUSTSEC-2026-0098", # rustls-webpki name constraints (via substrate) - "RUSTSEC-2026-0099", # rustls-webpki wildcard names (via substrate) - "RUSTSEC-2026-0104", # rustls-webpki CRL parser panic (via substrate) - "RUSTSEC-2026-0118", # transitive (via substrate) - "RUSTSEC-2026-0119", # hickory-proto O(n²) (via substrate) - "RUSTSEC-2026-0173", # proc-macro-error2 unmaintained (compile-time, via alloy-sol-macro) - # ── sandbox-runtime TEE attestation transitive ────────────────────────── - "RUSTSEC-2023-0071", # rsa Marvin timing — verify-only (RSA-PSS attestation sig verification in sandbox-runtime tee-verify); no private-key decryption; no upstream fix - # ── ethers-v2 and remaining upstream transitive dependencies ───────────── - "RUSTSEC-2025-0057", # fxhash unmaintained (via ethers-providers v2) - "RUSTSEC-2021-0145", # atty unaligned read (via solana-logger) + # Vulnerabilities with no consumable fixed path. + "RUSTSEC-2023-0071", # rsa: verify-only TEE attestation path; no fixed release + "RUSTSEC-2025-0055", # tracing-subscriber 0.2: inactive lock-only Ark dependency + "RUSTSEC-2025-0111", # tokio-tar: testcontainers dev path; no fixed release + "RUSTSEC-2026-0118", # hickory-proto: inactive lock-only libp2p dependency; no fix + "RUSTSEC-2026-0119", # hickory-proto: inactive lock-only libp2p dependency + + # Unmaintained upstream transitive packages. + "RUSTSEC-2021-0141", # dotenv + "RUSTSEC-2024-0388", # derivative + "RUSTSEC-2024-0436", # paste + "RUSTSEC-2025-0134", # rustls-pemfile + "RUSTSEC-2025-0141", # bincode 1 + "RUSTSEC-2025-0161", # libsecp256k1 + "RUSTSEC-2026-0173", # proc-macro-error2 ] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c1f4fdc..11ee5ddb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -302,36 +302,8 @@ jobs: - uses: Swatinem/rust-cache@v2 - # Ignore known transitive advisories from blueprint-sdk -> substrate deps. - # These come through libp2p, ring, aws-lc-sys, and legacy rustls stacks - # pulled in via Blueprint git dependencies; tracked upstream. - name: Run audit - run: | - cargo audit \ - --ignore RUSTSEC-2021-0141 \ - --ignore RUSTSEC-2024-0384 \ - --ignore RUSTSEC-2024-0388 \ - --ignore RUSTSEC-2024-0436 \ - --ignore RUSTSEC-2025-0009 \ - --ignore RUSTSEC-2025-0010 \ - --ignore RUSTSEC-2025-0012 \ - --ignore RUSTSEC-2025-0055 \ - --ignore RUSTSEC-2025-0111 \ - --ignore RUSTSEC-2025-0134 \ - --ignore RUSTSEC-2025-0141 \ - --ignore RUSTSEC-2025-0161 \ - --ignore RUSTSEC-2026-0002 \ - --ignore RUSTSEC-2026-0044 \ - --ignore RUSTSEC-2026-0048 \ - --ignore RUSTSEC-2026-0049 \ - --ignore RUSTSEC-2026-0067 \ - --ignore RUSTSEC-2026-0068 \ - --ignore RUSTSEC-2026-0097 \ - --ignore RUSTSEC-2026-0098 \ - --ignore RUSTSEC-2026-0099 \ - --ignore RUSTSEC-2026-0104 \ - --ignore RUSTSEC-2026-0118 \ - --ignore RUSTSEC-2026-0119 + run: cargo audit -D warnings # ── Evals (TypeScript) ──────────────────────────────────────────────────── evals: diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 8e2d84d9..06696655 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -140,11 +140,8 @@ jobs: - name: Install cargo-audit run: cargo install cargo-audit --locked - # Reads .cargo/audit.toml for the ignore list. Every entry there - # is cross-referenced in deny.toml's [advisories].ignore and in - # audits/static-analysis-triage.md. `-D warnings` denies on - # unmaintained / unsound / yanked; whitelisted IDs cover known - # transitive deps (substrate / solana-sdk / ethers-v2). + # Reads .cargo/audit.toml. `-D warnings` also checks unmaintained, + # unsound, and yanked packages. - name: Run cargo audit run: cargo audit -D warnings diff --git a/Cargo.lock b/Cargo.lock index 36fbd149..2975af30 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -138,7 +138,7 @@ dependencies = [ [[package]] name = "ai-agent-sandbox-blueprint-lib" version = "0.1.0" -source = "git+https://github.com/tangle-network/ai-agent-sandbox-blueprint.git?rev=8ae2d24ea69e8581f25d4d2ab923ace49f3179ea#8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" +source = "git+https://github.com/tangle-network/ai-agent-sandbox-blueprint.git?rev=4a2e0f9652c61f26f253a957ed05ad49e9239710#4a2e0f9652c61f26f253a957ed05ad49e9239710" dependencies = [ "blueprint-sdk", "chrono", @@ -210,7 +210,7 @@ checksum = "84e0378e959aa6a885897522080a990e80eb317f1e9a222a604492ea50e13096" dependencies = [ "alloy-primitives", "num_enum", - "strum 0.27.2", + "strum", ] [[package]] @@ -762,7 +762,7 @@ dependencies = [ "derive_more 2.1.1", "rand 0.8.6", "serde", - "strum 0.27.2", + "strum", ] [[package]] @@ -868,8 +868,8 @@ dependencies = [ "alloy-primitives", "alloy-signer", "async-trait", - "coins-bip32 0.12.0", - "coins-bip39 0.12.0", + "coins-bip32", + "coins-bip39", "k256", "rand 0.8.6", "thiserror 2.0.18", @@ -1052,7 +1052,7 @@ dependencies = [ "alloy-transport 1.8.3", "futures", "http 1.4.2", - "rustls 0.23.40", + "rustls", "serde_json", "tokio", "tokio-tungstenite 0.28.0", @@ -1166,7 +1166,7 @@ dependencies = [ "pin-project-lite", "quinn-udp", "rustc-hash 2.1.2", - "rustls 0.23.40", + "rustls", "socket2 0.6.4", "thiserror 2.0.18", "tokio", @@ -1185,9 +1185,9 @@ dependencies = [ "getrandom 0.3.4", "lru-slab", "rand 0.9.4", - "ring 0.17.14", + "ring", "rustc-hash 2.1.2", - "rustls 0.23.40", + "rustls", "rustls-pki-types", "rustls-platform-verifier 0.6.2", "slab", @@ -1215,7 +1215,7 @@ dependencies = [ "base64ct", "blake2", "cpufeatures 0.2.17", - "password-hash 0.5.0", + "password-hash", ] [[package]] @@ -1693,15 +1693,6 @@ version = "0.9.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "eab1c04a571841102f5345a8fc0f6bb3d31c315dec879b5c6e42e40ce7ffa34e" -[[package]] -name = "ascii-canvas" -version = "3.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8824ecca2e851cec16968d54a01dd372ef8f95b244fb84b84e70128be347c3c6" -dependencies = [ - "term", -] - [[package]] name = "asn1-rs" version = "0.5.2" @@ -2222,23 +2213,17 @@ dependencies = [ "aws-smithy-async", "aws-smithy-runtime-api", "aws-smithy-types", - "h2 0.3.27", "h2 0.4.15", - "http 0.2.12", "http 1.4.2", - "http-body 0.4.6", - "hyper 0.14.32", "hyper 1.10.1", - "hyper-rustls 0.24.2", - "hyper-rustls 0.27.9", + "hyper-rustls", "hyper-util", "pin-project-lite", - "rustls 0.21.12", - "rustls 0.23.40", + "rustls", "rustls-native-certs", "rustls-pki-types", "tokio", - "tokio-rustls 0.26.4", + "tokio-rustls", "tower", "tracing", ] @@ -2577,15 +2562,6 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "bit-set" -version = "0.5.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1" -dependencies = [ - "bit-vec 0.6.3", -] - [[package]] name = "bit-set" version = "0.8.0" @@ -2595,12 +2571,6 @@ dependencies = [ "bit-vec 0.8.0", ] -[[package]] -name = "bit-vec" -version = "0.6.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb" - [[package]] name = "bit-vec" version = "0.8.0" @@ -2718,7 +2688,7 @@ dependencies = [ "arrayvec", "cc", "cfg-if", - "constant_time_eq 0.4.2", + "constant_time_eq", "cpufeatures 0.3.0", "digest 0.11.3", ] @@ -2796,7 +2766,7 @@ dependencies = [ "thiserror 2.0.18", "tokio", "tokio-stream", - "tonic 0.13.1", + "tonic", "url", ] @@ -2815,9 +2785,9 @@ dependencies = [ "hashbrown 0.16.1", "hex", "hyper 1.10.1", - "hyper-rustls 0.27.9", + "hyper-rustls", "hyper-util", - "jsonwebtoken 10.4.0", + "jsonwebtoken", "k256", "once_cell", "pasetors 0.7.8", @@ -2826,7 +2796,7 @@ dependencies = [ "protobuf-src", "rcgen 0.14.8", "rocksdb", - "rustls 0.23.40", + "rustls", "rustls-pemfile 2.2.0", "schnorrkel", "serde", @@ -2836,7 +2806,7 @@ dependencies = [ "time", "tiny-keccak", "tokio", - "tokio-rustls 0.26.4", + "tokio-rustls", "tonic-build", "tower", "tower-http", @@ -2960,7 +2930,7 @@ dependencies = [ "serde", "serde_json", "thiserror 2.0.18", - "tnt-core-bindings 0.19.1", + "tnt-core-bindings", "tokio", "tracing", "url", @@ -3026,7 +2996,7 @@ dependencies = [ "blueprint-core", "blueprint-keystore", "blueprint-manager-bridge", - "blueprint-qos 0.2.0-alpha.11 (git+https://github.com/tangle-network/blueprint.git?rev=9462282a9f72c98a3746b816478b4b889761a537)", + "blueprint-qos", "blueprint-router", "blueprint-runner", "cargo_toml", @@ -3179,7 +3149,7 @@ dependencies = [ "blueprint-runner", "chrono", "color-eyre", - "dirs 6.0.0", + "dirs", "eigensdk", "futures-core", "futures-util", @@ -3280,7 +3250,7 @@ dependencies = [ "thiserror 2.0.18", "tokio", "tokio-vsock", - "tonic 0.13.1", + "tonic", "tonic-build", "tower", "zerocopy", @@ -3332,55 +3302,6 @@ dependencies = [ "tokio-cron-scheduler", ] -[[package]] -name = "blueprint-qos" -version = "0.2.0-alpha.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "517ac86d4ffb910573fe4ebf54e28ad82f6482a7874bdfc9f6747418debfe136" -dependencies = [ - "alloy-network", - "alloy-primitives", - "alloy-provider", - "alloy-rpc-types", - "alloy-signer-local", - "alloy-sol-types", - "alloy-transport 1.8.3", - "async-trait", - "axum", - "blueprint-core", - "blueprint-crypto", - "blueprint-keystore", - "blueprint-std", - "bollard", - "futures", - "k256", - "opentelemetry 0.29.1", - "opentelemetry 0.31.0", - "opentelemetry-otlp 0.31.1", - "opentelemetry-prometheus 0.29.1", - "opentelemetry-semantic-conventions 0.29.0", - "opentelemetry_sdk 0.29.0", - "opentelemetry_sdk 0.31.0", - "prometheus", - "prost 0.13.5", - "rand 0.8.6", - "reqwest 0.12.28", - "serde", - "serde_json", - "sysinfo 0.38.4", - "tempfile", - "thiserror 2.0.18", - "tnt-core-bindings 0.18.0", - "tokio", - "tonic 0.13.1", - "tonic-build", - "tracing", - "tracing-loki", - "tracing-opentelemetry 0.32.1", - "tracing-subscriber 0.3.23", - "uuid 1.23.3", -] - [[package]] name = "blueprint-qos" version = "0.2.0-alpha.11" @@ -3402,11 +3323,11 @@ dependencies = [ "bollard", "futures", "k256", - "opentelemetry 0.32.0", - "opentelemetry-otlp 0.32.0", - "opentelemetry-prometheus 0.32.0", - "opentelemetry-semantic-conventions 0.32.1", - "opentelemetry_sdk 0.32.1", + "opentelemetry", + "opentelemetry-otlp", + "opentelemetry-prometheus", + "opentelemetry-semantic-conventions", + "opentelemetry_sdk", "prometheus", "prost 0.13.5", "rand 0.8.6", @@ -3416,13 +3337,13 @@ dependencies = [ "sysinfo 0.38.4", "tempfile", "thiserror 2.0.18", - "tnt-core-bindings 0.19.1", + "tnt-core-bindings", "tokio", - "tonic 0.13.1", + "tonic", "tonic-build", "tracing", "tracing-loki", - "tracing-opentelemetry 0.33.0", + "tracing-opentelemetry", "tracing-subscriber 0.3.23", "uuid 1.23.3", ] @@ -3458,7 +3379,7 @@ dependencies = [ "blueprint-evm-extra", "blueprint-keystore", "blueprint-manager-bridge", - "blueprint-qos 0.2.0-alpha.11 (git+https://github.com/tangle-network/blueprint.git?rev=9462282a9f72c98a3746b816478b4b889761a537)", + "blueprint-qos", "blueprint-router", "blueprint-std", "clap", @@ -3497,7 +3418,7 @@ dependencies = [ "blueprint-macros", "blueprint-manager-bridge", "blueprint-producers-extra", - "blueprint-qos 0.2.0-alpha.11 (git+https://github.com/tangle-network/blueprint.git?rev=9462282a9f72c98a3746b816478b4b889761a537)", + "blueprint-qos", "blueprint-router", "blueprint-runner", "blueprint-std", @@ -3621,7 +3542,7 @@ dependencies = [ "serde_json", "thiserror 2.0.18", "time", - "tnt-core-bindings 0.19.1", + "tnt-core-bindings", "tokio", "toml 1.1.2+spec-1.1.0", "tower", @@ -3650,12 +3571,12 @@ dependencies = [ "http-body-util", "hyper 1.10.1", "hyper-named-pipe", - "hyper-rustls 0.27.9", + "hyper-rustls", "hyper-util", "hyperlocal", "log", "pin-project-lite", - "rustls 0.23.40", + "rustls", "rustls-native-certs", "rustls-pemfile 2.2.0", "rustls-pki-types", @@ -3852,16 +3773,6 @@ dependencies = [ "either", ] -[[package]] -name = "bzip2" -version = "0.4.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8" -dependencies = [ - "bzip2-sys", - "libc", -] - [[package]] name = "bzip2-sys" version = "0.1.13+1.0.8" @@ -3887,15 +3798,6 @@ dependencies = [ "serde", ] -[[package]] -name = "camino" -version = "1.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48" -dependencies = [ - "serde_core", -] - [[package]] name = "caps" version = "0.5.6" @@ -3905,29 +3807,6 @@ dependencies = [ "libc", ] -[[package]] -name = "cargo-platform" -version = "0.1.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e35af189006b9c0f00a064685c727031e3ed2d8020f7ba284d78cc2671bd36ea" -dependencies = [ - "serde", -] - -[[package]] -name = "cargo_metadata" -version = "0.18.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037" -dependencies = [ - "camino", - "cargo-platform", - "semver 1.0.28", - "serde", - "serde_json", - "thiserror 1.0.69", -] - [[package]] name = "cargo_toml" version = "0.21.0" @@ -4150,22 +4029,6 @@ version = "0.5.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" -[[package]] -name = "coins-bip32" -version = "0.8.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b6be4a5df2098cd811f3194f64ddb96c267606bffd9689ac7b0160097b01ad3" -dependencies = [ - "bs58", - "coins-core 0.8.7", - "digest 0.10.7", - "hmac 0.12.1", - "k256", - "serde", - "sha2 0.10.9", - "thiserror 1.0.69", -] - [[package]] name = "coins-bip32" version = "0.12.0" @@ -4173,7 +4036,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2073678591747aed4000dd468b97b14d7007f7936851d3f2f01846899f5ebf08" dependencies = [ "bs58", - "coins-core 0.12.0", + "coins-core", "digest 0.10.7", "hmac 0.12.1", "k256", @@ -4182,22 +4045,6 @@ dependencies = [ "thiserror 1.0.69", ] -[[package]] -name = "coins-bip39" -version = "0.8.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3db8fba409ce3dc04f7d804074039eb68b960b0829161f8e06c95fea3f122528" -dependencies = [ - "bitvec", - "coins-bip32 0.8.7", - "hmac 0.12.1", - "once_cell", - "pbkdf2 0.12.2", - "rand 0.8.6", - "sha2 0.10.9", - "thiserror 1.0.69", -] - [[package]] name = "coins-bip39" version = "0.12.0" @@ -4205,7 +4052,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "74b169b26623ff17e9db37a539fe4f15342080df39f129ef7631df7683d6d9d4" dependencies = [ "bitvec", - "coins-bip32 0.12.0", + "coins-bip32", "hmac 0.12.1", "once_cell", "pbkdf2 0.12.2", @@ -4214,26 +4061,6 @@ dependencies = [ "thiserror 1.0.69", ] -[[package]] -name = "coins-core" -version = "0.8.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5286a0843c21f8367f7be734f89df9b822e0321d8bcce8d6e735aadff7d74979" -dependencies = [ - "base64 0.21.7", - "bech32", - "bs58", - "digest 0.10.7", - "generic-array", - "hex", - "ripemd 0.1.3", - "serde", - "serde_derive", - "sha2 0.10.9", - "sha3 0.10.9", - "thiserror 1.0.69", -] - [[package]] name = "coins-core" version = "0.12.0" @@ -4394,12 +4221,6 @@ dependencies = [ "unicode-xid", ] -[[package]] -name = "constant_time_eq" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc" - [[package]] name = "constant_time_eq" version = "0.4.2" @@ -4781,7 +4602,7 @@ dependencies = [ "ed25519-dalek", "p256", "p384", - "ring 0.17.14", + "ring", "rsa", "rustls-pki-types", "sha2 0.10.9", @@ -4807,6 +4628,37 @@ version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b" +[[package]] +name = "defmt" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1" +dependencies = [ + "bitflags 1.3.2", + "defmt-macros", +] + +[[package]] +name = "defmt-macros" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8" +dependencies = [ + "defmt-parser", + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "defmt-parser" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e" +dependencies = [ + "thiserror 2.0.18", +] + [[package]] name = "der" version = "0.7.10" @@ -4961,44 +4813,13 @@ dependencies = [ "ctutils", ] -[[package]] -name = "dirs" -version = "5.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225" -dependencies = [ - "dirs-sys 0.4.1", -] - [[package]] name = "dirs" version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e" dependencies = [ - "dirs-sys 0.5.0", -] - -[[package]] -name = "dirs-next" -version = "2.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1" -dependencies = [ - "cfg-if", - "dirs-sys-next", -] - -[[package]] -name = "dirs-sys" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c" -dependencies = [ - "libc", - "option-ext", - "redox_users 0.4.6", - "windows-sys 0.48.0", + "dirs-sys", ] [[package]] @@ -5009,21 +4830,10 @@ checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab" dependencies = [ "libc", "option-ext", - "redox_users 0.5.2", + "redox_users", "windows-sys 0.61.2", ] -[[package]] -name = "dirs-sys-next" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d" -dependencies = [ - "libc", - "redox_users 0.4.6", - "winapi", -] - [[package]] name = "displaydoc" version = "0.2.6" @@ -5392,8 +5202,7 @@ dependencies = [ [[package]] name = "eigen-signer" version = "2.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "80e1d80e96c0019ac1619fbe38897d09fcb57259f3918da3fc7e40ab72080156" +source = "git+https://github.com/drewstone/eigensdk-rs.git?rev=efcc7f926f21bd159cfa847186538a360064eacc#efcc7f926f21bd159cfa847186538a360064eacc" dependencies = [ "alloy", "async-trait", @@ -5485,15 +5294,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "ena" -version = "0.14.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eabffdaee24bd1bf95c5ef7cec31260444317e72ea56c4c91750e8b7ee58d5f1" -dependencies = [ - "log", -] - [[package]] name = "encode_unicode" version = "1.0.0" @@ -5509,24 +5309,6 @@ dependencies = [ "cfg-if", ] -[[package]] -name = "enr" -version = "0.10.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a3d8dc56e02f954cac8eb489772c552c473346fc34f67412bb6244fd647f7e4" -dependencies = [ - "base64 0.21.7", - "bytes", - "hex", - "k256", - "log", - "rand 0.8.6", - "rlp", - "serde", - "sha3 0.10.9", - "zeroize", -] - [[package]] name = "enum-as-inner" version = "0.6.1" @@ -5559,6 +5341,29 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "env_filter" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217" +dependencies = [ + "log", + "regex", +] + +[[package]] +name = "env_logger" +version = "0.11.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6" +dependencies = [ + "anstream", + "anstyle", + "env_filter", + "jiff", + "log", +] + [[package]] name = "equivalent" version = "1.0.2" @@ -5609,315 +5414,19 @@ dependencies = [ ] [[package]] -name = "ethabi" -version = "18.0.0" +name = "event-listener" +version = "5.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7413c5f74cc903ea37386a8965a936cbeb334bd270862fdece542c1b2dcbc898" +checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" dependencies = [ - "ethereum-types", - "hex", - "once_cell", - "regex", - "serde", - "serde_json", - "sha3 0.10.9", - "thiserror 1.0.69", - "uint 0.9.5", + "concurrent-queue", + "parking", + "pin-project-lite", ] [[package]] -name = "ethbloom" -version = "0.13.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c22d4b5885b6aa2fe5e8b9329fb8d232bf739e434e6b87347c63bdd00c120f60" -dependencies = [ - "crunchy", - "fixed-hash", - "impl-codec", - "impl-rlp", - "impl-serde", - "scale-info", - "tiny-keccak", -] - -[[package]] -name = "ethereum-types" -version = "0.14.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "02d215cbf040552efcbe99a38372fe80ab9d00268e20012b79fcd0f073edd8ee" -dependencies = [ - "ethbloom", - "fixed-hash", - "impl-codec", - "impl-rlp", - "impl-serde", - "primitive-types", - "scale-info", - "uint 0.9.5", -] - -[[package]] -name = "ethers" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "816841ea989f0c69e459af1cf23a6b0033b19a55424a1ea3a30099becdb8dec0" -dependencies = [ - "ethers-addressbook", - "ethers-contract", - "ethers-core", - "ethers-etherscan", - "ethers-middleware", - "ethers-providers", - "ethers-signers", - "ethers-solc", -] - -[[package]] -name = "ethers-addressbook" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5495afd16b4faa556c3bba1f21b98b4983e53c1755022377051a975c3b021759" -dependencies = [ - "ethers-core", - "once_cell", - "serde", - "serde_json", -] - -[[package]] -name = "ethers-contract" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6fceafa3578c836eeb874af87abacfb041f92b4da0a78a5edd042564b8ecdaaa" -dependencies = [ - "const-hex", - "ethers-contract-abigen", - "ethers-contract-derive", - "ethers-core", - "ethers-providers", - "futures-util", - "once_cell", - "pin-project", - "serde", - "serde_json", - "thiserror 1.0.69", -] - -[[package]] -name = "ethers-contract-abigen" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04ba01fbc2331a38c429eb95d4a570166781f14290ef9fdb144278a90b5a739b" -dependencies = [ - "Inflector", - "const-hex", - "dunce", - "ethers-core", - "ethers-etherscan", - "eyre", - "prettyplease", - "proc-macro2", - "quote", - "regex", - "reqwest 0.11.27", - "serde", - "serde_json", - "syn 2.0.117", - "toml 0.8.23", - "walkdir", -] - -[[package]] -name = "ethers-contract-derive" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "87689dcabc0051cde10caaade298f9e9093d65f6125c14575db3fd8c669a168f" -dependencies = [ - "Inflector", - "const-hex", - "ethers-contract-abigen", - "ethers-core", - "proc-macro2", - "quote", - "serde_json", - "syn 2.0.117", -] - -[[package]] -name = "ethers-core" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "82d80cc6ad30b14a48ab786523af33b37f28a8623fc06afd55324816ef18fb1f" -dependencies = [ - "arrayvec", - "bytes", - "cargo_metadata", - "chrono", - "const-hex", - "elliptic-curve", - "ethabi", - "generic-array", - "k256", - "num_enum", - "once_cell", - "open-fastrlp", - "rand 0.8.6", - "rlp", - "serde", - "serde_json", - "strum 0.26.3", - "syn 2.0.117", - "tempfile", - "thiserror 1.0.69", - "tiny-keccak", - "unicode-xid", -] - -[[package]] -name = "ethers-etherscan" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e79e5973c26d4baf0ce55520bd732314328cabe53193286671b47144145b9649" -dependencies = [ - "chrono", - "ethers-core", - "reqwest 0.11.27", - "semver 1.0.28", - "serde", - "serde_json", - "thiserror 1.0.69", - "tracing", -] - -[[package]] -name = "ethers-middleware" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48f9fdf09aec667c099909d91908d5eaf9be1bd0e2500ba4172c1d28bfaa43de" -dependencies = [ - "async-trait", - "auto_impl", - "ethers-contract", - "ethers-core", - "ethers-etherscan", - "ethers-providers", - "ethers-signers", - "futures-channel", - "futures-locks", - "futures-util", - "instant", - "reqwest 0.11.27", - "serde", - "serde_json", - "thiserror 1.0.69", - "tokio", - "tracing", - "tracing-futures", - "url", -] - -[[package]] -name = "ethers-providers" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6434c9a33891f1effc9c75472e12666db2fa5a0fec4b29af6221680a6fe83ab2" -dependencies = [ - "async-trait", - "auto_impl", - "base64 0.21.7", - "bytes", - "const-hex", - "enr", - "ethers-core", - "futures-core", - "futures-timer", - "futures-util", - "hashers", - "http 0.2.12", - "instant", - "jsonwebtoken 8.3.0", - "once_cell", - "pin-project", - "reqwest 0.11.27", - "serde", - "serde_json", - "thiserror 1.0.69", - "tokio", - "tokio-tungstenite 0.20.1", - "tracing", - "tracing-futures", - "url", - "wasm-bindgen", - "wasm-bindgen-futures", - "web-sys", - "ws_stream_wasm", -] - -[[package]] -name = "ethers-signers" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "228875491c782ad851773b652dd8ecac62cda8571d3bc32a5853644dd26766c2" -dependencies = [ - "async-trait", - "coins-bip32 0.8.7", - "coins-bip39 0.8.7", - "const-hex", - "elliptic-curve", - "eth-keystore", - "ethers-core", - "rand 0.8.6", - "sha2 0.10.9", - "thiserror 1.0.69", - "tracing", -] - -[[package]] -name = "ethers-solc" -version = "2.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "66244a771d9163282646dbeffe0e6eca4dda4146b6498644e678ac6089b11edd" -dependencies = [ - "cfg-if", - "const-hex", - "dirs 5.0.1", - "dunce", - "ethers-core", - "glob", - "home", - "md-5", - "num_cpus", - "once_cell", - "path-slash", - "rayon", - "regex", - "semver 1.0.28", - "serde", - "serde_json", - "solang-parser", - "svm-rs", - "thiserror 1.0.69", - "tiny-keccak", - "tokio", - "tracing", - "walkdir", - "yansi", -] - -[[package]] -name = "event-listener" -version = "5.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" -dependencies = [ - "concurrent-queue", - "parking", - "pin-project-lite", -] - -[[package]] -name = "event-listener-strategy" -version = "0.5.4" +name = "event-listener-strategy" +version = "0.5.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93" dependencies = [ @@ -6079,12 +5588,6 @@ dependencies = [ "static_assertions", ] -[[package]] -name = "fixedbitset" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80" - [[package]] name = "fixedbitset" version = "0.5.7" @@ -6149,16 +5652,6 @@ dependencies = [ "percent-encoding", ] -[[package]] -name = "fs2" -version = "0.4.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213" -dependencies = [ - "libc", - "winapi", -] - [[package]] name = "fs_extra" version = "1.3.0" @@ -6239,16 +5732,6 @@ dependencies = [ "pin-project-lite", ] -[[package]] -name = "futures-locks" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45ec6fe3675af967e67c5536c0b9d44e34e6c52f86bedc4ea49c5317b8e94d06" -dependencies = [ - "futures-channel", - "futures-task", -] - [[package]] name = "futures-macro" version = "0.3.32" @@ -6267,7 +5750,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a8f2f12607f92c69b12ed746fabf9ca4f5c482cba46679c1a75b874ed7c26adb" dependencies = [ "futures-io", - "rustls 0.23.40", + "rustls", "rustls-pki-types", ] @@ -6288,10 +5771,6 @@ name = "futures-timer" version = "3.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968" -dependencies = [ - "gloo-timers", - "send_wrapper", -] [[package]] name = "futures-util" @@ -6316,15 +5795,6 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "42012b0f064e01aa58b545fe3727f90f7dd4020f4a3ea735b50344965f5a57e9" -[[package]] -name = "fxhash" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c" -dependencies = [ - "byteorder", -] - [[package]] name = "gcp_auth" version = "0.12.6" @@ -6338,9 +5808,9 @@ dependencies = [ "http 1.4.2", "http-body-util", "hyper 1.10.1", - "hyper-rustls 0.27.9", + "hyper-rustls", "hyper-util", - "ring 0.17.14", + "ring", "rustls-pki-types", "serde", "serde_json", @@ -6447,18 +5917,6 @@ version = "0.3.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280" -[[package]] -name = "gloo-timers" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "482ce8a491a501da4cd806bd190275363d674f2845005c6ddbd5d3e1dd54495d" -dependencies = [ - "futures-channel", - "futures-core", - "js-sys", - "wasm-bindgen", -] - [[package]] name = "governor" version = "0.6.3" @@ -6599,15 +6057,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "hashers" -version = "1.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b2bca93b15ea5a746f220e56587f71e73c6165eab783df9e26590069953e3c30" -dependencies = [ - "fxhash", -] - [[package]] name = "hashlink" version = "0.9.1" @@ -6688,7 +6137,7 @@ dependencies = [ "ipnet", "once_cell", "rand 0.9.4", - "ring 0.17.14", + "ring", "socket2 0.5.10", "thiserror 2.0.18", "tinyvec", @@ -6897,21 +6346,6 @@ dependencies = [ "winapi", ] -[[package]] -name = "hyper-rustls" -version = "0.24.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590" -dependencies = [ - "futures-util", - "http 0.2.12", - "hyper 0.14.32", - "log", - "rustls 0.21.12", - "tokio", - "tokio-rustls 0.24.1", -] - [[package]] name = "hyper-rustls" version = "0.27.9" @@ -6921,10 +6355,10 @@ dependencies = [ "http 1.4.2", "hyper 1.10.1", "hyper-util", - "rustls 0.23.40", + "rustls", "rustls-native-certs", "tokio", - "tokio-rustls 0.26.4", + "tokio-rustls", "tower-service", "webpki-roots 1.0.7", ] @@ -6997,20 +6431,23 @@ dependencies = [ ] [[package]] -name = "hyperliquid" -version = "0.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c1b9c087410dfd7d3b41978c666e29915559a9f3885095b3b207ba48acd573a" +name = "hyperliquid_rust_sdk" +version = "0.6.0" +source = "git+https://github.com/tangle-network/hyperliquid-rust-sdk.git?rev=9dc8b253ebae65d8e6a07b074ea6806d7cf91189#9dc8b253ebae65d8e6a07b074ea6806d7cf91189" dependencies = [ - "ethers", + "alloy", + "chrono", + "env_logger", "futures-util", + "lazy_static", + "log", "reqwest 0.12.28", "rmp-serde", "serde", "serde_json", - "thiserror 1.0.69", + "thiserror 2.0.18", "tokio", - "tokio-tungstenite 0.23.1", + "tokio-tungstenite 0.20.1", "uuid 1.23.3", ] @@ -7223,30 +6660,12 @@ dependencies = [ ] [[package]] -name = "impl-codec" -version = "0.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba6a270039626615617f3f36d15fc827041df3b78c439da2cadfa47455a77f2f" -dependencies = [ - "parity-scale-codec", -] - -[[package]] -name = "impl-rlp" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f28220f89297a075ddc7245cd538076ee98b01f2a9c23a53a4f1105d5a322808" -dependencies = [ - "rlp", -] - -[[package]] -name = "impl-serde" -version = "0.4.0" +name = "impl-codec" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc88fc67028ae3db0c853baa36269d398d5f45b6982f95549ff5def78c935cd" +checksum = "ba6a270039626615617f3f36d15fc827041df3b78c439da2cadfa47455a77f2f" dependencies = [ - "serde", + "parity-scale-codec", ] [[package]] @@ -7311,15 +6730,6 @@ dependencies = [ "generic-array", ] -[[package]] -name = "instant" -version = "0.1.13" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222" -dependencies = [ - "cfg-if", -] - [[package]] name = "interprocess" version = "2.4.2" @@ -7375,15 +6785,6 @@ dependencies = [ "either", ] -[[package]] -name = "itertools" -version = "0.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57" -dependencies = [ - "either", -] - [[package]] name = "itertools" version = "0.12.1" @@ -7417,6 +6818,42 @@ version = "1.0.18" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" +[[package]] +name = "jiff" +version = "0.2.35" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc" +dependencies = [ + "defmt", + "jiff-core", + "jiff-static", + "log", + "portable-atomic", + "portable-atomic-util", + "serde_core", +] + +[[package]] +name = "jiff-core" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09" +dependencies = [ + "defmt", +] + +[[package]] +name = "jiff-static" +version = "0.2.35" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204" +dependencies = [ + "jiff-core", + "proc-macro2", + "quote", + "syn 2.0.117", +] + [[package]] name = "jni" version = "0.21.1" @@ -7527,20 +6964,6 @@ dependencies = [ "serde_json", ] -[[package]] -name = "jsonwebtoken" -version = "8.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6971da4d9c3aa03c3d8f3ff0f4155b534aad021292003895a469716b2a230378" -dependencies = [ - "base64 0.21.7", - "pem 1.1.1", - "ring 0.16.20", - "serde", - "serde_json", - "simple_asn1", -] - [[package]] name = "jsonwebtoken" version = "10.4.0" @@ -7624,43 +7047,13 @@ version = "0.2.19" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37" -[[package]] -name = "lalrpop" -version = "0.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "55cb077ad656299f160924eb2912aa147d7339ea7d69e1b5517326fdcec3c1ca" -dependencies = [ - "ascii-canvas", - "bit-set 0.5.3", - "ena", - "itertools 0.11.0", - "lalrpop-util", - "petgraph 0.6.5", - "regex", - "regex-syntax", - "string_cache", - "term", - "tiny-keccak", - "unicode-xid", - "walkdir", -] - -[[package]] -name = "lalrpop-util" -version = "0.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "507460a910eb7b32ee961886ff48539633b788a36b65692b95f225b844c82553" -dependencies = [ - "regex-automata", -] - [[package]] name = "lazy_static" version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" dependencies = [ - "spin 0.9.9", + "spin", ] [[package]] @@ -8038,8 +7431,8 @@ dependencies = [ "quinn", "quinn-proto", "rand 0.8.6", - "ring 0.17.14", - "rustls 0.23.40", + "ring", + "rustls", "socket2 0.5.10", "thiserror 2.0.18", "tokio", @@ -8149,9 +7542,9 @@ dependencies = [ "libp2p-core", "libp2p-identity", "rcgen 0.13.2", - "ring 0.17.14", - "rustls 0.23.40", - "rustls-webpki 0.103.13", + "ring", + "rustls", + "rustls-webpki", "thiserror 2.0.18", "x509-parser 0.17.0", "yasna 0.5.2", @@ -8379,16 +7772,6 @@ version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3" -[[package]] -name = "md-5" -version = "0.10.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf" -dependencies = [ - "cfg-if", - "digest 0.10.7", -] - [[package]] name = "memchr" version = "2.8.2" @@ -8658,12 +8041,6 @@ dependencies = [ "tokio", ] -[[package]] -name = "new_debug_unreachable" -version = "1.0.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" - [[package]] name = "nix" version = "0.27.1" @@ -8982,31 +8359,6 @@ version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" -[[package]] -name = "open-fastrlp" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "786393f80485445794f6043fd3138854dd109cc6c4bd1a6383db304c9ce9b9ce" -dependencies = [ - "arrayvec", - "auto_impl", - "bytes", - "ethereum-types", - "open-fastrlp-derive", -] - -[[package]] -name = "open-fastrlp-derive" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "003b2be5c6c53c1cfeb0a238b8a1c3915cd410feb684457a36c10038f764bb1c" -dependencies = [ - "bytes", - "proc-macro2", - "quote", - "syn 1.0.109", -] - [[package]] name = "openssl" version = "0.10.81" @@ -9060,34 +8412,6 @@ dependencies = [ "vcpkg", ] -[[package]] -name = "opentelemetry" -version = "0.29.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e87237e2775f74896f9ad219d26a2081751187eb7c9f5c58dde20a23b95d16c" -dependencies = [ - "futures-core", - "futures-sink", - "js-sys", - "pin-project-lite", - "thiserror 2.0.18", - "tracing", -] - -[[package]] -name = "opentelemetry" -version = "0.31.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b84bcd6ae87133e903af7ef497404dda70c60d0ea14895fc8a5e6722754fc2a0" -dependencies = [ - "futures-core", - "futures-sink", - "js-sys", - "pin-project-lite", - "thiserror 2.0.18", - "tracing", -] - [[package]] name = "opentelemetry" version = "0.32.0" @@ -9102,19 +8426,6 @@ dependencies = [ "tracing", ] -[[package]] -name = "opentelemetry-http" -version = "0.31.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7a6d09a73194e6b66df7c8f1b680f156d916a1a942abf2de06823dd02b7855d" -dependencies = [ - "async-trait", - "bytes", - "http 1.4.2", - "opentelemetry 0.31.0", - "reqwest 0.12.28", -] - [[package]] name = "opentelemetry-http" version = "0.32.0" @@ -9124,27 +8435,10 @@ dependencies = [ "async-trait", "bytes", "http 1.4.2", - "opentelemetry 0.32.0", + "opentelemetry", "reqwest 0.13.4", ] -[[package]] -name = "opentelemetry-otlp" -version = "0.31.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f69cd6acbb9af919df949cd1ec9e5e7fdc2ef15d234b6b795aaa525cc02f71f" -dependencies = [ - "http 1.4.2", - "opentelemetry 0.31.0", - "opentelemetry-http 0.31.0", - "opentelemetry-proto 0.31.0", - "opentelemetry_sdk 0.31.0", - "prost 0.14.4", - "reqwest 0.12.28", - "serde_json", - "thiserror 2.0.18", -] - [[package]] name = "opentelemetry-otlp" version = "0.32.0" @@ -9152,28 +8446,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35" dependencies = [ "http 1.4.2", - "opentelemetry 0.32.0", - "opentelemetry-http 0.32.0", - "opentelemetry-proto 0.32.0", - "opentelemetry_sdk 0.32.1", + "opentelemetry", + "opentelemetry-http", + "opentelemetry-proto", + "opentelemetry_sdk", "prost 0.14.4", "reqwest 0.13.4", "serde_json", "thiserror 2.0.18", ] -[[package]] -name = "opentelemetry-prometheus" -version = "0.29.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "098a71a4430bb712be6130ed777335d2e5b19bc8566de5f2edddfce906def6ab" -dependencies = [ - "once_cell", - "opentelemetry 0.29.1", - "opentelemetry_sdk 0.29.0", - "prometheus", -] - [[package]] name = "opentelemetry-prometheus" version = "0.32.0" @@ -9181,28 +8463,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2c0359983e7f79cf33c9abd89e5d7ddf67c46c419d0148598022d70e70c01aba" dependencies = [ "once_cell", - "opentelemetry 0.32.0", - "opentelemetry_sdk 0.32.1", + "opentelemetry", + "opentelemetry_sdk", "prometheus", ] -[[package]] -name = "opentelemetry-proto" -version = "0.31.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7175df06de5eaee9909d4805a3d07e28bb752c34cab57fa9cff549da596b30f" -dependencies = [ - "base64 0.22.1", - "const-hex", - "opentelemetry 0.31.0", - "opentelemetry_sdk 0.31.0", - "prost 0.14.4", - "serde", - "serde_json", - "tonic 0.14.6", - "tonic-prost", -] - [[package]] name = "opentelemetry-proto" version = "0.32.0" @@ -9211,59 +8476,18 @@ checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638" dependencies = [ "base64 0.22.1", "const-hex", - "opentelemetry 0.32.0", - "opentelemetry_sdk 0.32.1", + "opentelemetry", + "opentelemetry_sdk", "prost 0.14.4", "serde", ] -[[package]] -name = "opentelemetry-semantic-conventions" -version = "0.29.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84b29a9f89f1a954936d5aa92f19b2feec3c8f3971d3e96206640db7f9706ae3" - [[package]] name = "opentelemetry-semantic-conventions" version = "0.32.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c913ac17a6c451661ee255f4625d143e51647ae78ebd969b75e41c4442f4fe47" -[[package]] -name = "opentelemetry_sdk" -version = "0.29.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "afdefb21d1d47394abc1ba6c57363ab141be19e27cc70d0e422b7f303e4d290b" -dependencies = [ - "futures-channel", - "futures-executor", - "futures-util", - "glob", - "opentelemetry 0.29.1", - "percent-encoding", - "rand 0.9.4", - "thiserror 2.0.18", - "tokio", - "tokio-stream", -] - -[[package]] -name = "opentelemetry_sdk" -version = "0.31.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e14ae4f5991976fd48df6d843de219ca6d31b01daaab2dad5af2badeded372bd" -dependencies = [ - "futures-channel", - "futures-executor", - "futures-util", - "opentelemetry 0.31.0", - "percent-encoding", - "rand 0.9.4", - "thiserror 2.0.18", - "tokio", - "tokio-stream", -] - [[package]] name = "opentelemetry_sdk" version = "0.32.1" @@ -9273,7 +8497,7 @@ dependencies = [ "futures-channel", "futures-executor", "futures-util", - "opentelemetry 0.32.0", + "opentelemetry", "percent-encoding", "portable-atomic", "rand 0.9.4", @@ -9450,17 +8674,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "password-hash" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700" -dependencies = [ - "base64ct", - "rand_core 0.6.4", - "subtle", -] - [[package]] name = "password-hash" version = "0.5.0" @@ -9484,12 +8697,6 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4" -[[package]] -name = "path-slash" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e91099d4268b0e11973f036e885d652fb0b21fedcf69738c627f94db6a44f42" - [[package]] name = "pbkdf2" version = "0.11.0" @@ -9497,9 +8704,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917" dependencies = [ "digest 0.10.7", - "hmac 0.12.1", - "password-hash 0.4.2", - "sha2 0.10.9", ] [[package]] @@ -9571,23 +8775,13 @@ dependencies = [ "ucd-trie", ] -[[package]] -name = "petgraph" -version = "0.6.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db" -dependencies = [ - "fixedbitset 0.4.2", - "indexmap 2.14.0", -] - [[package]] name = "petgraph" version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772" dependencies = [ - "fixedbitset 0.5.7", + "fixedbitset", "indexmap 2.14.0", ] @@ -9621,37 +8815,17 @@ dependencies = [ "rustc_version 0.4.1", ] -[[package]] -name = "phf" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078" -dependencies = [ - "phf_macros 0.11.3", - "phf_shared 0.11.3", -] - [[package]] name = "phf" version = "0.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf" dependencies = [ - "phf_macros 0.13.1", - "phf_shared 0.13.1", + "phf_macros", + "phf_shared", "serde", ] -[[package]] -name = "phf_generator" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" -dependencies = [ - "phf_shared 0.11.3", - "rand 0.8.6", -] - [[package]] name = "phf_generator" version = "0.13.1" @@ -9659,20 +8833,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737" dependencies = [ "fastrand", - "phf_shared 0.13.1", -] - -[[package]] -name = "phf_macros" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216" -dependencies = [ - "phf_generator 0.11.3", - "phf_shared 0.11.3", - "proc-macro2", - "quote", - "syn 2.0.117", + "phf_shared", ] [[package]] @@ -9681,22 +8842,13 @@ version = "0.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef" dependencies = [ - "phf_generator 0.13.1", - "phf_shared 0.13.1", + "phf_generator", + "phf_shared", "proc-macro2", "quote", "syn 2.0.117", ] -[[package]] -name = "phf_shared" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" -dependencies = [ - "siphasher 1.0.3", -] - [[package]] name = "phf_shared" version = "0.13.1" @@ -9805,7 +8957,7 @@ dependencies = [ "dashmap 6.2.1", "futures", "hmac 0.12.1", - "phf 0.13.1", + "phf", "rand 0.10.1", "reqwest 0.13.4", "rust_decimal", @@ -9843,6 +8995,15 @@ version = "1.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49" +[[package]] +name = "portable-atomic-util" +version = "0.2.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618" +dependencies = [ + "portable-atomic", +] + [[package]] name = "potential_utf" version = "0.1.5" @@ -9867,12 +9028,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "precomputed-hash" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c" - [[package]] name = "prettyplease" version = "0.2.37" @@ -9900,9 +9055,6 @@ checksum = "0b34d9fd68ae0b74a41b21c03c2f62847aa0ffea044eee893b4c140b37e244e2" dependencies = [ "fixed-hash", "impl-codec", - "impl-rlp", - "impl-serde", - "scale-info", "uint 0.9.5", ] @@ -10014,7 +9166,7 @@ version = "1.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744" dependencies = [ - "bit-set 0.8.0", + "bit-set", "bit-vec 0.8.0", "bitflags 2.13.0", "num-traits", @@ -10058,7 +9210,7 @@ dependencies = [ "log", "multimap", "once_cell", - "petgraph 0.7.1", + "petgraph", "prettyplease", "prost 0.13.5", "prost-types", @@ -10216,7 +9368,7 @@ dependencies = [ "quinn-proto", "quinn-udp", "rustc-hash 2.1.2", - "rustls 0.23.40", + "rustls", "socket2 0.6.4", "thiserror 2.0.18", "tokio", @@ -10236,9 +9388,9 @@ dependencies = [ "getrandom 0.3.4", "lru-slab", "rand 0.9.4", - "ring 0.17.14", + "ring", "rustc-hash 2.1.2", - "rustls 0.23.40", + "rustls", "rustls-pki-types", "slab", "thiserror 2.0.18", @@ -10421,7 +9573,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2" dependencies = [ "pem 3.0.6", - "ring 0.17.14", + "ring", "rustls-pki-types", "time", "yasna 0.5.2", @@ -10434,7 +9586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055" dependencies = [ "pem 3.0.6", - "ring 0.17.14", + "ring", "rustls-pki-types", "time", "x509-parser 0.18.1", @@ -10465,17 +9617,6 @@ dependencies = [ "bitflags 2.13.0", ] -[[package]] -name = "redox_users" -version = "0.4.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43" -dependencies = [ - "getrandom 0.2.17", - "libredox", - "thiserror 1.0.69", -] - [[package]] name = "redox_users" version = "0.5.2" @@ -10566,7 +9707,6 @@ dependencies = [ "http 0.2.12", "http-body 0.4.6", "hyper 0.14.32", - "hyper-rustls 0.24.2", "hyper-tls 0.5.0", "ipnet", "js-sys", @@ -10576,7 +9716,6 @@ dependencies = [ "once_cell", "percent-encoding", "pin-project-lite", - "rustls 0.21.12", "rustls-pemfile 1.0.4", "serde", "serde_json", @@ -10585,13 +9724,11 @@ dependencies = [ "system-configuration 0.5.1", "tokio", "tokio-native-tls", - "tokio-rustls 0.24.1", "tower-service", "url", "wasm-bindgen", "wasm-bindgen-futures", "web-sys", - "webpki-roots 0.25.4", "winreg", ] @@ -10612,7 +9749,7 @@ dependencies = [ "http-body 1.0.1", "http-body-util", "hyper 1.10.1", - "hyper-rustls 0.27.9", + "hyper-rustls", "hyper-tls 0.6.0", "hyper-util", "js-sys", @@ -10622,8 +9759,7 @@ dependencies = [ "percent-encoding", "pin-project-lite", "quinn", - "rustls 0.23.40", - "rustls-native-certs", + "rustls", "rustls-pki-types", "serde", "serde_json", @@ -10631,7 +9767,7 @@ dependencies = [ "sync_wrapper 1.0.2", "tokio", "tokio-native-tls", - "tokio-rustls 0.26.4", + "tokio-rustls", "tokio-util", "tower", "tower-http", @@ -10661,7 +9797,7 @@ dependencies = [ "http-body 1.0.1", "http-body-util", "hyper 1.10.1", - "hyper-rustls 0.27.9", + "hyper-rustls", "hyper-util", "js-sys", "log", @@ -10669,7 +9805,7 @@ dependencies = [ "percent-encoding", "pin-project-lite", "quinn", - "rustls 0.23.40", + "rustls", "rustls-pki-types", "rustls-platform-verifier 0.7.0", "serde", @@ -10677,7 +9813,7 @@ dependencies = [ "serde_urlencoded", "sync_wrapper 1.0.2", "tokio", - "tokio-rustls 0.26.4", + "tokio-rustls", "tower", "tower-http", "tower-service", @@ -10718,21 +9854,6 @@ dependencies = [ "subtle", ] -[[package]] -name = "ring" -version = "0.16.20" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc" -dependencies = [ - "cc", - "libc", - "once_cell", - "spin 0.5.2", - "untrusted 0.7.1", - "web-sys", - "winapi", -] - [[package]] name = "ring" version = "0.17.14" @@ -10801,21 +9922,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bb919243f34364b6bd2fc10ef797edbfa75f33c252e7998527479c6d6b47e1ec" dependencies = [ "bytes", - "rlp-derive", "rustc-hex", ] -[[package]] -name = "rlp-derive" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e33d7b2abe0c340d8797fe2907d3f20d3b5ea5908683618bfe80df7f621f672a" -dependencies = [ - "proc-macro2", - "quote", - "syn 1.0.109", -] - [[package]] name = "rmp" version = "0.8.15" @@ -11050,18 +10159,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "rustls" -version = "0.21.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e" -dependencies = [ - "log", - "ring 0.17.14", - "rustls-webpki 0.101.7", - "sct", -] - [[package]] name = "rustls" version = "0.23.40" @@ -11071,9 +10168,9 @@ dependencies = [ "aws-lc-rs", "log", "once_cell", - "ring 0.17.14", + "ring", "rustls-pki-types", - "rustls-webpki 0.103.13", + "rustls-webpki", "subtle", "zeroize", ] @@ -11129,10 +10226,10 @@ dependencies = [ "jni 0.21.1", "log", "once_cell", - "rustls 0.23.40", + "rustls", "rustls-native-certs", "rustls-platform-verifier-android", - "rustls-webpki 0.103.13", + "rustls-webpki", "security-framework", "security-framework-sys", "webpki-root-certs", @@ -11150,10 +10247,10 @@ dependencies = [ "jni 0.22.4", "log", "once_cell", - "rustls 0.23.40", + "rustls", "rustls-native-certs", "rustls-platform-verifier-android", - "rustls-webpki 0.103.13", + "rustls-webpki", "security-framework", "security-framework-sys", "webpki-root-certs", @@ -11166,16 +10263,6 @@ version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" -[[package]] -name = "rustls-webpki" -version = "0.101.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765" -dependencies = [ - "ring 0.17.14", - "untrusted 0.9.0", -] - [[package]] name = "rustls-webpki" version = "0.103.13" @@ -11183,7 +10270,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ "aws-lc-rs", - "ring 0.17.14", + "ring", "rustls-pki-types", "untrusted 0.9.0", ] @@ -11250,7 +10337,7 @@ dependencies = [ [[package]] name = "sandbox-runtime" version = "0.1.0" -source = "git+https://github.com/tangle-network/ai-agent-sandbox-blueprint.git?rev=8ae2d24ea69e8581f25d4d2ab923ace49f3179ea#8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" +source = "git+https://github.com/tangle-network/ai-agent-sandbox-blueprint.git?rev=4a2e0f9652c61f26f253a957ed05ad49e9239710#4a2e0f9652c61f26f253a957ed05ad49e9239710" dependencies = [ "alloy", "anyhow", @@ -11400,22 +10487,12 @@ version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f" dependencies = [ - "password-hash 0.5.0", + "password-hash", "pbkdf2 0.12.2", "salsa20", "sha2 0.10.9", ] -[[package]] -name = "sct" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414" -dependencies = [ - "ring 0.17.14", - "untrusted 0.9.0", -] - [[package]] name = "seahash" version = "4.1.0" @@ -11525,10 +10602,6 @@ name = "semver" version = "1.0.28" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" -dependencies = [ - "serde", - "serde_core", -] [[package]] name = "semver-parser" @@ -11770,7 +10843,7 @@ dependencies = [ "bitfield", "bitflags 2.13.0", "byteorder", - "dirs 6.0.0", + "dirs", "hex", "iocuddle", "lazy_static", @@ -11990,7 +11063,7 @@ dependencies = [ "chacha20poly1305", "curve25519-dalek", "rand_core 0.6.4", - "ring 0.17.14", + "ring", "rustc_version 0.4.1", "sha2 0.10.9", "subtle", @@ -12073,7 +11146,7 @@ dependencies = [ "spl-token-interface", "spl-token-metadata-interface", "thiserror 2.0.18", - "zstd 0.13.3", + "zstd", ] [[package]] @@ -12088,7 +11161,7 @@ dependencies = [ "serde_json", "solana-account", "solana-pubkey 3.0.0", - "zstd 0.13.3", + "zstd", ] [[package]] @@ -13249,7 +12322,7 @@ dependencies = [ "futures", "itertools 0.12.1", "log", - "rustls 0.23.40", + "rustls", "solana-connection-cache", "solana-keypair", "solana-measure", @@ -13807,7 +12880,7 @@ dependencies = [ "pem 1.1.1", "percentage", "rand 0.8.6", - "rustls 0.23.40", + "rustls", "smallvec", "socket2 0.6.4", "solana-keypair", @@ -13992,7 +13065,7 @@ version = "3.1.14" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c8e195a1cd2dbb54fb234abb1fd5c92021152669f0d8853075a52b67bc9e7095" dependencies = [ - "rustls 0.23.40", + "rustls", "solana-keypair", "solana-pubkey 3.0.0", "solana-signer", @@ -14271,26 +13344,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "solang-parser" -version = "0.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c425ce1c59f4b154717592f0bdf4715c3a1d55058883622d3157e1f0908a5b26" -dependencies = [ - "itertools 0.11.0", - "lalrpop", - "lalrpop-util", - "phf 0.11.3", - "thiserror 1.0.69", - "unicode-xid", -] - -[[package]] -name = "spin" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d" - [[package]] name = "spin" version = "0.9.9" @@ -14603,18 +13656,6 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" -[[package]] -name = "string_cache" -version = "0.8.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f" -dependencies = [ - "new_debug_unreachable", - "parking_lot", - "phf_shared 0.11.3", - "precomputed-hash", -] - [[package]] name = "strsim" version = "0.11.1" @@ -14644,15 +13685,6 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "strum" -version = "0.26.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06" -dependencies = [ - "strum_macros 0.26.4", -] - [[package]] name = "strum" version = "0.27.2" @@ -14662,19 +13694,6 @@ dependencies = [ "strum_macros 0.27.2", ] -[[package]] -name = "strum_macros" -version = "0.26.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "rustversion", - "syn 2.0.117", -] - [[package]] name = "strum_macros" version = "0.27.2" @@ -14705,26 +13724,6 @@ version = "2.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" -[[package]] -name = "svm-rs" -version = "0.3.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11297baafe5fa0c99d5722458eac6a5e25c01eb1b8e5cd137f54079093daa7a4" -dependencies = [ - "dirs 5.0.1", - "fs2", - "hex", - "once_cell", - "reqwest 0.11.27", - "semver 1.0.28", - "serde", - "serde_json", - "sha2 0.10.9", - "thiserror 1.0.69", - "url", - "zip", -] - [[package]] name = "syn" version = "1.0.109" @@ -14903,17 +13902,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "term" -version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c59df8ac95d96ff9bede18eb7300b0fda5e5d8d90960e76f8e14ae765eedbf1f" -dependencies = [ - "dirs-next", - "rustversion", - "winapi", -] - [[package]] name = "testcontainers" version = "0.23.3" @@ -15110,18 +14098,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "tnt-core-bindings" -version = "0.18.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c697c2729569879158d02242e573339e7bb6f031ba9688a801ca3cefd27c511a" -dependencies = [ - "alloy", - "alloy-contract", - "alloy-sol-types", - "serde", -] - [[package]] name = "tnt-core-bindings" version = "0.19.1" @@ -15187,23 +14163,13 @@ dependencies = [ "tokio", ] -[[package]] -name = "tokio-rustls" -version = "0.24.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081" -dependencies = [ - "rustls 0.21.12", - "tokio", -] - [[package]] name = "tokio-rustls" version = "0.26.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" dependencies = [ - "rustls 0.23.40", + "rustls", "tokio", ] @@ -15239,28 +14205,13 @@ name = "tokio-tungstenite" version = "0.20.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "212d5dcb2a1ce06d81107c3d0ffa3121fe974b73f068c8282cb1c32328113b6c" -dependencies = [ - "futures-util", - "log", - "rustls 0.21.12", - "tokio", - "tokio-rustls 0.24.1", - "tungstenite 0.20.1", - "webpki-roots 0.25.4", -] - -[[package]] -name = "tokio-tungstenite" -version = "0.23.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c6989540ced10490aaf14e6bad2e3d33728a2813310a0c71d1574304c49631cd" dependencies = [ "futures-util", "log", "native-tls", "tokio", "tokio-native-tls", - "tungstenite 0.23.0", + "tungstenite 0.20.1", ] [[package]] @@ -15285,10 +14236,10 @@ checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857" dependencies = [ "futures-util", "log", - "rustls 0.23.40", + "rustls", "rustls-pki-types", "tokio", - "tokio-rustls 0.26.4", + "tokio-rustls", "tungstenite 0.28.0", "webpki-roots 0.26.11", ] @@ -15445,7 +14396,7 @@ dependencies = [ "prost 0.13.5", "socket2 0.5.10", "tokio", - "tokio-rustls 0.26.4", + "tokio-rustls", "tokio-stream", "tower", "tower-layer", @@ -15454,27 +14405,6 @@ dependencies = [ "webpki-roots 0.26.11", ] -[[package]] -name = "tonic" -version = "0.14.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef" -dependencies = [ - "async-trait", - "base64 0.22.1", - "bytes", - "http 1.4.2", - "http-body 1.0.1", - "http-body-util", - "percent-encoding", - "pin-project", - "sync_wrapper 1.0.2", - "tokio-stream", - "tower-layer", - "tower-service", - "tracing", -] - [[package]] name = "tonic-build" version = "0.13.1" @@ -15489,17 +14419,6 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "tonic-prost" -version = "0.14.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0" -dependencies = [ - "bytes", - "prost 0.14.4", - "tonic 0.14.6", -] - [[package]] name = "tower" version = "0.5.3" @@ -15630,22 +14549,6 @@ dependencies = [ "url", ] -[[package]] -name = "tracing-opentelemetry" -version = "0.32.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ac28f2d093c6c477eaa76b23525478f38de514fa9aeb1285738d4b97a9552fc" -dependencies = [ - "js-sys", - "opentelemetry 0.31.0", - "smallvec", - "tracing", - "tracing-core", - "tracing-log", - "tracing-subscriber 0.3.23", - "web-time", -] - [[package]] name = "tracing-opentelemetry" version = "0.33.0" @@ -15653,9 +14556,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "adbc64cba7137545b8044cb1fe9814f7aacf3c6b5f9b45be8bb5db538befdb26" dependencies = [ "js-sys", - "opentelemetry 0.32.0", + "opentelemetry", + "smallvec", "tracing", "tracing-core", + "tracing-log", "tracing-subscriber 0.3.23", "web-time", ] @@ -15708,7 +14613,7 @@ dependencies = [ "alloy-primitives", "axum", "blueprint-producers-extra", - "blueprint-qos 0.2.0-alpha.11 (registry+https://github.com/rust-lang/crates.io-index)", + "blueprint-qos", "blueprint-sdk", "blueprint-webhooks", "chrono", @@ -15752,9 +14657,9 @@ dependencies = [ "futures-util", "hex", "once_cell", - "opentelemetry 0.31.0", - "opentelemetry-otlp 0.31.1", - "opentelemetry_sdk 0.31.0", + "opentelemetry", + "opentelemetry-otlp", + "opentelemetry_sdk", "reqwest 0.12.28", "rust_decimal", "sandbox-runtime", @@ -15765,7 +14670,7 @@ dependencies = [ "tokio-tungstenite 0.26.2", "tower", "tracing", - "tracing-opentelemetry 0.32.1", + "tracing-opentelemetry", "tracing-subscriber 0.3.23", "trading-http-api", "trading-runtime", @@ -15877,13 +14782,12 @@ dependencies = [ "chrono", "dotenv", "ed25519-dalek", - "ethers-signers", "futures", "getrandom 0.2.17", "hex", "hmac 0.12.1", - "hyperliquid", - "jsonwebtoken 10.4.0", + "hyperliquid_rust_sdk", + "jsonwebtoken", "polymarket-client-sdk", "proptest", "reqwest 0.12.28", @@ -15942,7 +14846,7 @@ name = "trading-validator-bin" version = "0.1.0" dependencies = [ "axum", - "blueprint-qos 0.2.0-alpha.11 (registry+https://github.com/rust-lang/crates.io-index)", + "blueprint-qos", "blueprint-sdk", "tokio", "tracing", @@ -16000,30 +14904,11 @@ dependencies = [ "http 0.2.12", "httparse", "log", - "rand 0.8.6", - "rustls 0.21.12", - "sha1", - "thiserror 1.0.69", - "url", - "utf-8", -] - -[[package]] -name = "tungstenite" -version = "0.23.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e2e2ce1e47ed2994fd43b04c8f618008d4cabdd5ee34027cf14f9d918edd9c8" -dependencies = [ - "byteorder", - "bytes", - "data-encoding", - "http 1.4.2", - "httparse", - "log", "native-tls", "rand 0.8.6", "sha1", "thiserror 1.0.69", + "url", "utf-8", ] @@ -16057,7 +14942,7 @@ dependencies = [ "httparse", "log", "rand 0.9.4", - "rustls 0.23.40", + "rustls", "rustls-pki-types", "sha1", "thiserror 2.0.18", @@ -16543,12 +15428,6 @@ dependencies = [ "rustls-pki-types", ] -[[package]] -name = "webpki-roots" -version = "0.25.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1" - [[package]] name = "webpki-roots" version = "0.26.11" @@ -17445,7 +16324,7 @@ dependencies = [ "lazy_static", "nom", "oid-registry 0.8.1", - "ring 0.17.14", + "ring", "rusticata-macros", "thiserror 2.0.18", "time", @@ -17513,12 +16392,6 @@ dependencies = [ "web-time", ] -[[package]] -name = "yansi" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec" - [[package]] name = "yasna" version = "0.5.2" @@ -17655,58 +16528,19 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "zip" -version = "0.6.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261" -dependencies = [ - "aes", - "byteorder", - "bzip2", - "constant_time_eq 0.1.5", - "crc32fast", - "crossbeam-utils", - "flate2", - "hmac 0.12.1", - "pbkdf2 0.11.0", - "sha1", - "time", - "zstd 0.11.2+zstd.1.5.2", -] - [[package]] name = "zmij" version = "1.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" -[[package]] -name = "zstd" -version = "0.11.2+zstd.1.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "20cc960326ece64f010d2d2107537f26dc589a6573a316bd5b1dba685fa5fde4" -dependencies = [ - "zstd-safe 5.0.2+zstd.1.5.2", -] - [[package]] name = "zstd" version = "0.13.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" dependencies = [ - "zstd-safe 7.2.4", -] - -[[package]] -name = "zstd-safe" -version = "5.0.2+zstd.1.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d2a5585e04f9eea4b2a3d1eca508c4dee9592a89ef6f450c11719da0726f4db" -dependencies = [ - "libc", - "zstd-sys", + "zstd-safe", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index afaf867b..270c58db 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -52,6 +52,7 @@ blueprint-manager-bridge = { git = "https://github.com/tangle-network/blueprint. blueprint-metrics-rpc-calls = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-networking = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-producers-extra = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } +blueprint-qos = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-router = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-runner = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-sdk = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } @@ -60,3 +61,4 @@ blueprint-store-local-database = { git = "https://github.com/tangle-network/blue blueprint-stores = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-tangle-extra = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } blueprint-testing-utils = { git = "https://github.com/tangle-network/blueprint.git", rev = "9462282a9f72c98a3746b816478b4b889761a537" } +eigen-signer = { git = "https://github.com/drewstone/eigensdk-rs.git", rev = "efcc7f926f21bd159cfa847186538a360064eacc" } diff --git a/audit.toml b/audit.toml deleted file mode 100644 index 243e16ee..00000000 --- a/audit.toml +++ /dev/null @@ -1,40 +0,0 @@ -# Known advisories in transitive dependencies from the Blueprint SDK, -# Sandbox runtime, and the ethers-v2 stack used by Hyperliquid. -# These are not direct deps of ai-trading-blueprint. -# -# Each ID is matched 1:1 with deny.toml's [advisories].ignore list and -# documented in audits/static-analysis-triage.md. Re-evaluate quarterly -# (first Monday of each quarter) or when a fix lands upstream. - -[advisories] -ignore = [ - # ── substrate / blueprint-sdk transitive ──────────────────────────────── - "RUSTSEC-2021-0141", # ansi_term unmaintained (via substrate) - "RUSTSEC-2024-0384", # instant unmaintained (via substrate) - "RUSTSEC-2024-0388", # derivative unmaintained (via Alloy/ruint) - "RUSTSEC-2024-0436", # paste unmaintained (via substrate) - "RUSTSEC-2025-0009", # ring < 0.17.12 panic (via substrate) - "RUSTSEC-2025-0010", # ring < 0.17 unmaintained (via substrate) - "RUSTSEC-2025-0012", # ring transitive (via substrate) - "RUSTSEC-2025-0055", # tracing-subscriber 0.2 ANSI escape (via substrate) - "RUSTSEC-2025-0111", # tokio-tar PAX header (testcontainers, dev-only) - "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (via substrate) - "RUSTSEC-2025-0141", # bincode 1.x unmaintained (via substrate / solana) - "RUSTSEC-2025-0161", # libsecp256k1 unmaintained (via blueprint-networking) - "RUSTSEC-2026-0002", # lru IterMut Stacked Borrows (via substrate) - "RUSTSEC-2026-0044", # aws-lc-sys < 0.39.0 (via substrate) - "RUSTSEC-2026-0048", # aws-lc-sys < 0.39.0 (via substrate) - "RUSTSEC-2026-0049", # substrate transitive - "RUSTSEC-2026-0067", # substrate transitive - "RUSTSEC-2026-0068", # substrate transitive - "RUSTSEC-2026-0097", # rand 0.7 unsoundness (via substrate) - "RUSTSEC-2026-0098", # rustls-webpki name constraints (via substrate) - "RUSTSEC-2026-0099", # rustls-webpki wildcard names (via substrate) - "RUSTSEC-2026-0104", # rustls-webpki CRL parser panic (via substrate) - "RUSTSEC-2026-0118", # transitive (via substrate) - "RUSTSEC-2026-0119", # hickory-proto O(n²) (via substrate) - "RUSTSEC-2026-0173", # proc-macro-error2 unmaintained (compile-time, via alloy-sol-macro) - # ── ethers-v2 and remaining upstream transitive dependencies ───────────── - "RUSTSEC-2025-0057", # fxhash unmaintained (via ethers-providers v2) - "RUSTSEC-2021-0145", # atty unaligned read (via solana-logger) -] diff --git a/audits/static-analysis-summary.md b/audits/static-analysis-summary.md deleted file mode 100644 index 04dbbfba..00000000 --- a/audits/static-analysis-summary.md +++ /dev/null @@ -1,107 +0,0 @@ -# Static-Analysis Summary — drew/q1-roadmap-compressed - -**Date:** 2026-05-07 -**Scope:** Rust workspace + Solidity contracts in `contracts/src`. -**Sister docs:** `audits/static-analysis-triage.md` (per-finding verdicts). - -## Tool versions - -| Tool | Version | Source | -|------------------|----------|-----------------------------------------| -| cargo-audit | 0.22.1 | `cargo install cargo-audit --locked` | -| cargo-deny | 0.19.4 | `cargo install cargo-deny --locked` | -| slither-analyzer | 0.11.5 | `pipx install slither-analyzer` | -| mythril | 0.24.8 | `pipx install mythril` | -| solc | 0.8.20 | `pipx install solc-select && solc-select install 0.8.20` | -| forge | 1.5.1 | foundry-rs/foundry-toolchain | - -Mythril note: pipx-installed mythril 0.24.8 imports `eth.__init__` which -calls `pkg_resources`, deprecated and removed in setuptools 81+. -Workaround: `pipx inject mythril 'setuptools<81'`. -Mythril also pings `solc-bin.ethereum.org` on every run; set -`SOLC_BINARY=$HOME/.solc-select/artifacts/solc-0.8.20/solc-0.8.20` to -short-circuit and run fully offline. - -## Findings by severity - -### cargo-audit (RustSec advisory DB) - -| Class | Count | Action | -|--------------|------:|------------------------------------------------| -| Vulnerability| 10 | All transitive (substrate / solana / ethers); ignored via `.cargo/audit.toml` with rationale; tracked in triage doc. | -| Unsound | 3 | All transitive; ignored with rationale. | -| Unmaintained | 13 | All transitive; ignored with rationale. | -| **Direct dep advisories** | **0** | — clean. | - -Run state with `.cargo/audit.toml` loaded: **PASS** (`cargo audit -D warnings` → exit 0). - -### cargo-deny (licenses + bans + sources + advisories) - -| Section | Result | Notes | -|------------|--------|-------------------------------------------------------------| -| advisories | PASS | mirrors audit.toml ignore list. | -| licenses | PASS | permissive-only allow-list; per-crate clarifications for eigen-* SDK + ring + workspace-hack + solana-config-program-client. | -| bans | PASS | multi-version + wildcards downgraded to `warn`; in-workspace path-deps allowed. | -| sources | PASS | git-source allow-list pinned to `tangle-network/*`. | - -### slither (Solidity static analysis) - -Production contracts (`contracts/src/*.sol`). Test/script/dependencies filtered. - -| Severity | Count | -|---------------|------:| -| High | 38 (12 each across TradingVault/VaultDeployer/VaultFactory + 1 each in FeeDistributor/TradeValidator + factory delta) | -| Medium | 106 | -| Low | 196 | -| Informational | 47 | -| Optimization | 30 | - -**Code fixes (1):** - -- `80b5264 — harden(static): low — explicit init of _hashApprovalSigners packed buffer` - -**Inline suppressions with rationale (2):** - -- `d453b34 — harden(static): suppress slither false-positives with audit-traceable rationale` - - TradeValidator `unused-return` on `EnumerableSet.remove(old)` — element membership guaranteed by preceding `at()` call. - - FeeDistributor `arbitrary-send-erc20` on `safeTransferFrom(vault,...)` — bounded by `onlyOwner` registration + per-vault approval. - -**By-design findings retained without suppression (DOC):** -- ~36 `arbitrary-send-eth` / `reentrancy-balance` instances across TradingVault routing functions: bounded by `onlyRole(OPERATOR_ROLE)` + `nonReentrant` + `whenNotPaused` + envelope L-4 enforcement-hash binding. Slither's reentrancy-balance "stale variable" is a model limitation (nonReentrant blocks the only re-entry vector). -- `incorrect-equality` on `lastSettled[vault] == 0` first-settlement sentinel. -- `incorrect-exp` HIGH in OpenZeppelin `Math.mulDiv` — confirmed slither false positive on OZ Newton's-method modular inverse. - -See `audits/static-analysis-triage.md` for the full table and per-finding rationale. - -### mythril (symbolic execution) - -| Contract | Severity | Finding | Action | -|-----------------|----------|----------------------------------------|--------| -| TradeValidator | LOW | SWC-116 `block.timestamp` in deadline | Accepted; deadline tolerance documented in TradeValidator.sol commit `a6cc227 — harden(validator): require chainId == block.chainid and issuedAt <= block.timestamp`. | -| TradingVault | — | Completed to depth-12 baseline | No issues. Full-depth symbolic exec exceeds practical CI bounds for the 2119-line vault; slither + forge fuzz are the primary gates. | - -## CI gates added / extended - -- `.github/workflows/static-analysis.yml` - - **Existing job kept:** `cargo-deny` via `EmbarkStudios/cargo-deny-action@v2`. - - **Added job:** `cargo-audit` running `cargo audit -D warnings`. - - **Added job:** `slither` running per-contract with `slither.config.json` and `--fail-pedantic`. - -- `.cargo/audit.toml` — cargo-audit auto-loaded ignore list (33 IDs, all transitive). -- `slither.config.json` — detector tuning, soldeer remappings, dependency filters. - -The pre-existing `audit.toml` at the repo root (separate from `.cargo/audit.toml`) is kept as a documentation copy for diffing convenience; only `.cargo/audit.toml` is consumed by the tooling. - -## Recommendations for the team - -1. **Bump `prometheus` to 0.14 in a follow-up PR** — drops `protobuf 2.x` (RUSTSEC-2024-0437). The 0.13→0.14 API change requires updating `with_label_values(&[&str; N])` call sites to `with_label_values::<&[&str]>(&[...])` or migrating to `&[&String]`. Out of scope here because it touches `routes/prometheus.rs` instrumentation across ~10 metric handles. - -2. **Track Solana 3.x cadence** — most ed25519/curve25519/atty/bincode/derivative/libsecp256k1 advisories all stem from Solana 2.x's pinned 1.x crypto stack. Solana 3.x is expected to migrate; lock-step bump removes the bulk of `[advisories].ignore`. - -3. **Drop `ethers v2` once `hyperliquid` migrates to alloy** — fxhash + ws-stream-wasm advisories disappear. Worth opening an issue upstream. - -4. **Re-run mythril on TradingVault at higher depth in nightly CI**, not PR CI — depth-12 baseline is fast enough for a smoke check, but a 4-hour overnight run at depth-22 occasionally surfaces issues slither misses. - -5. **Triage cadence:** quarterly (first Monday). Owner: trading-runtime maintainers. Re-evaluate every entry in `[advisories].ignore` and prune anything that's been fixed upstream. - -6. **Direct-dep advisory bar:** any future advisory whose dep tree terminates at a workspace member crate (no `└──` chain through substrate / solana / ethers) must be **fixed**, not suppressed. diff --git a/audits/static-analysis-triage.md b/audits/static-analysis-triage.md index 105420e5..aa2f8cfe 100644 --- a/audits/static-analysis-triage.md +++ b/audits/static-analysis-triage.md @@ -1,17 +1,13 @@ -# Static-Analysis Triage — ai-trading-blueprints +# Static-Analysis Triage: ai-trading-blueprints -**Branch:** `drew/q1-roadmap-compressed` -**Date:** 2026-05-07 **Last updated:** 2026-07-28 -**Tools:** cargo-audit 0.22.1, cargo-deny 0.19.4, slither-analyzer 0.11.5, -mythril 0.24.8 (with solc 0.8.20 via solc-select). This doc maps every static-analysis finding to a verdict: - **FIX** → code change committed; commit hash + summary - **SUPP** → false positive or bounded by access-control; suppressed inline with `slither-disable-next-line ` (Solidity) or via - `audit.toml` / `deny.toml` (Rust). Rationale below. + `.cargo/audit.toml` / `deny.toml` (Rust). Rationale below. - **DOC** → low-severity informational; no change, no suppression — kept as a tracking note. @@ -20,61 +16,39 @@ number where the suppression lives. Re-run quarterly. --- -## 1. cargo-audit — RustSec advisory DB - -All currently flagged advisories are **transitive** through dependency -chains we do not control directly: - -1. **substrate / blueprint-sdk** — Tangle-network/blueprint upstream owns - the rustls / ring / libp2p / paste / lru / bincode etc. version graph. -2. **sandbox-runtime** — TEE attestation verification pins its RSA stack. -3. **ethers v2 and upstream Blueprint dependencies** — fxhash and older - utility crates remain until those projects upgrade. - -The 2026-07-28 Solana 3 and Prometheus 0.14 upgrades removed six prior -exceptions: RUSTSEC-2022-0093, RUSTSEC-2024-0344, RUSTSEC-2024-0375, -RUSTSEC-2024-0437, RUSTSEC-2025-0119, and RUSTSEC-2026-0186. - -Direct workspace deps are advisory-clean. Triage cadence: re-evaluate -quarterly (first Monday) or when an upstream fix lands. Owner: trading -runtime maintainers. - -| Class | RustSec ID | Crate / Version | Vector | Verdict | Rationale | -|-------------|--------------------|---------------------------|----------------------------------------------|---------|-----------| -| vuln | RUSTSEC-2025-0009 | ring 0.16.20 | AES panic on overflow check | SUPP | Transitive via rustls 0.21 (substrate / solana). Production binaries ship with overflow checks off. | -| vuln | RUSTSEC-2026-0098 | rustls-webpki 0.101.7 | name constraints (URI) | SUPP | Transitive via solana-sdk rustls. Client-only TLS, no CA-issuance role. | -| vuln | RUSTSEC-2026-0099 | rustls-webpki 0.101.7 | wildcard names accepted | SUPP | Same chain as 0098; bump pending solana-sdk rustls 0.23 refresh. | -| vuln | RUSTSEC-2026-0104 | rustls-webpki 0.101.7 | CRL parser panic | SUPP | Same chain; client TLS does not parse attacker CRLs. | -| vuln | RUSTSEC-2025-0111 | tokio-tar 0.3.1 | PAX header file smuggling | SUPP | Dev-only via testcontainers (anvil setup). Not in runtime call graph. | -| vuln | RUSTSEC-2025-0055 | tracing-subscriber 0.2 | ANSI escape via user input | SUPP | Transitive via substrate. Direct deps use tracing-subscriber 0.3.x. | -| vuln | RUSTSEC-2026-0119 | hickory-proto 0.24.4 | O(n²) name compression CPU exhaustion | SUPP | Transitive (substrate libp2p). No DNS server role; client-only resolves. | -| unsound | RUSTSEC-2021-0145 | atty 0.2.14 | unaligned read on Windows | SUPP | Solana telemetry; Linux-only deployment. | -| unsound | RUSTSEC-2026-0002 | lru 0.12.5 | IterMut UB | SUPP | We use `LruCache::get_or_insert` / `iter()`; never `iter_mut()`. | -| unsound | RUSTSEC-2026-0097 | rand 0.7.3 | unsound when custom logger calls rand::rng()| SUPP | Direct `rand` usage threads explicit `ChaCha20Rng` / `OsRng`; never the global. | -| unmaintained| RUSTSEC-2021-0141 | dotenv 0.15.0 | unmaintained | SUPP | Dev-deps + tests fixture loading. | -| unmaintained| RUSTSEC-2024-0384 | instant 0.1.13 | unmaintained | SUPP | wasm-bindgen tree (substrate); not exercised at runtime. | -| unmaintained| RUSTSEC-2024-0388 | derivative 2.2.0 | unmaintained | SUPP | Alloy's ruint dependency still pins it; no workspace code imports it. | -| unmaintained| RUSTSEC-2024-0436 | paste 1.0.15 | unmaintained | SUPP | Pervasive in Solana proc-macros. | -| unmaintained| RUSTSEC-2025-0010 | ring 0.16.20 | unmaintained | SUPP | Same chain as 2025-0009. | -| unmaintained| RUSTSEC-2025-0057 | fxhash 0.2.1 | unmaintained | SUPP | ethers-providers v2 + Solana ProgramTest transitive. | -| unmaintained| RUSTSEC-2025-0134 | rustls-pemfile 1/2 | unmaintained | SUPP | Reqwest + webpki transitive. | -| unmaintained| RUSTSEC-2025-0141 | bincode 1.3.3 | unmaintained | SUPP | Solana 2.x family; bincode 2 migration is part of Solana 3.x. | -| unmaintained| RUSTSEC-2025-0161 | libsecp256k1 0.7.2 | unmaintained | SUPP | Blueprint networking pins it; workspace signing uses ed25519. | - -**Direct-dep advisory bar:** any future advisory whose dep tree terminates -at a workspace member crate (no `└──` chain through substrate / solana / ethers) -must be **fixed**, not suppressed. +## 1. cargo-audit: RustSec advisory DB + +The 2026-07-28 dependency update removed the archived Ethers Hyperliquid client, OpenTelemetry 0.29 and 0.31, `ring` 0.16, and `rustls-webpki` 0.101.7. +The exception lists now contain only advisories present in the current lockfile. + +| Class | RustSec ID | Crate / Version | Current evidence | +|-------|------------|-----------------|------------------| +| vuln | RUSTSEC-2023-0071 | rsa 0.9.10 | Used only for TEE signature verification; no fixed release. | +| vuln | RUSTSEC-2025-0055 | tracing-subscriber 0.2.25 | Lock-only through ark-relations; no active path from `cargo tree --target all`; direct tracing uses 0.3.23. | +| vuln | RUSTSEC-2025-0111 | tokio-tar 0.3.1 | Dev-only through Blueprint anvil testcontainers; no fixed release. | +| vuln | RUSTSEC-2026-0118 | hickory-proto 0.25.2 | Lock-only through libp2p; no active workspace path and no fixed release. | +| vuln | RUSTSEC-2026-0119 | hickory-proto 0.25.2 | Lock-only through libp2p; current libp2p does not accept the fixed 0.26 line. | +| unmaintained | RUSTSEC-2021-0141 | dotenv 0.15.0 | Upstream Phala dependency and test fixtures. | +| unmaintained | RUSTSEC-2024-0388 | derivative 2.2.0 | Upstream cryptography and numeric crates. | +| unmaintained | RUSTSEC-2024-0436 | paste 1.0.15 | Compile-time upstream macros. | +| unmaintained | RUSTSEC-2025-0134 | rustls-pemfile 1.0.4 / 2.2.0 | Upstream TLS clients. | +| unmaintained | RUSTSEC-2025-0141 | bincode 1.3.3 | Solana transaction serde compatibility. | +| unmaintained | RUSTSEC-2025-0161 | libsecp256k1 0.7.2 | Blueprint networking. | +| unmaintained | RUSTSEC-2026-0173 | proc-macro-error2 2.0.1 | Compile-time upstream macros. | + +Re-evaluate this list whenever `Cargo.lock` changes. +Fix any advisory with a consumable upstream release rather than adding an exception. --- -## 2. cargo-deny — license + bans + sources +## 2. cargo-deny: license + bans + sources Run state on this branch: **PASS** (`cargo deny check` → `advisories ok, bans ok, licenses ok, sources ok`). The pre-existing `deny.toml` at the repo root carries: -- `[advisories]` ignore list (mirrors `.cargo/audit.toml`). +- `[advisories]` ignore list for packages in cargo-deny's active graph. - `[licenses]` permissive allow-list (MIT, Apache-2.0, ISC, BSD-2/3, Unicode-3.0, Zlib, MPL-2.0, CC0-1.0, 0BSD, Unlicense, CDLA-Permissive-2.0, Apache-2.0 WITH LLVM-exception, MIT-0, OpenSSL). @@ -84,7 +58,7 @@ The pre-existing `deny.toml` at the repo root carries: - `[bans]` `multiple-versions = "warn"` (Solana / Alloy stacks legitimately double up); `wildcards = "warn"` with `allow-wildcard-paths = true` for in-workspace path deps. -- `[sources]` `allow-git` restricted to tangle-network repos. +- `[sources]` `allow-git` restricted to pinned Tangle dependencies and the EigenSDK patch submitted upstream as Layr-Labs/eigensdk-rs#591. Multi-version warnings are tolerated (transitive duplicates from the Solana / Alloy stacks). Quarterly review. diff --git a/deny.toml b/deny.toml index f7d76dd6..381f0b18 100644 --- a/deny.toml +++ b/deny.toml @@ -40,48 +40,16 @@ yanked = "deny" # the affected crate becomes consumable upstream — whichever comes # first. Owner: trading-runtime maintainers. ignore = [ - # ── Vulnerabilities (RUSTSEC vuln class) ──────────────────────────────── - # rsa "Marvin Attack" timing sidechannel. Pulled transitively via - # sandbox-runtime's TEE attestation verification (tee-verify/tee-all - # features), where rsa is used ONLY as rsa::pss::VerifyingKey to verify - # SEV-SNP / TDX attestation signatures against pinned keys — no private - # key, no decryption. The attack targets RSA private-key decryption timing - # oracles, which this code never performs, and no fixed rsa release exists - # upstream. Mirrors the ignore in ai-agent-sandbox-blueprint. - { id = "RUSTSEC-2023-0071", reason = "rsa verify-only in sandbox-runtime TEE attestation; Marvin targets private-key decryption — not applicable; no upstream fix; tracked in dep-policy.md" }, - - # ring panic on AES overflow check — only triggers when overflow - # checks are enabled (debug builds). Production binaries ship with - # release profile (overflow checks off). Awaiting ring 0.18.x via - # rustls-webpki refresh. - { id = "RUSTSEC-2025-0009", reason = "release builds disable overflow checks; not a prod issue; tracked in dep-policy.md" }, - - # rustls-webpki name-constraints / CRL parser — pulled transitively - # via reqwest's TLS stack. Mitigated upstream in rustls 0.23.x - # which is pinned by the Solana 2.x family; bump deferred to next - # solana-sdk minor. - { id = "RUSTSEC-2026-0098", reason = "transitive via solana-sdk rustls; client-only TLS; tracked in dep-policy.md" }, - { id = "RUSTSEC-2026-0099", reason = "transitive via solana-sdk rustls; client-only TLS; tracked in dep-policy.md" }, - { id = "RUSTSEC-2026-0104", reason = "transitive via solana-sdk rustls; client-only TLS; tracked in dep-policy.md" }, - - # tokio-tar PAX header smuggling — only used by cargo build tooling, - # not at runtime. - { id = "RUSTSEC-2025-0111", reason = "build-time only; not in runtime call graph; tracked in dep-policy.md" }, - - # ── Unmaintained (RUSTSEC informational class) ────────────────────────── - # All of the below are deep transitive deps via Solana / Alloy / - # Tangle blueprint stacks. Replacing them requires upstream PRs; - # tracked in dep-policy.md "Unmaintained crate triage". - { id = "RUSTSEC-2021-0141", reason = "dotenv unmaintained — dev-dep only; tests use it for fixture loading" }, - { id = "RUSTSEC-2025-0141", reason = "bincode 1.x unmaintained — Solana 2.x family pins 1.x; bincode 2 migration is part of solana-sdk 3.x" }, - { id = "RUSTSEC-2024-0388", reason = "derivative unmaintained — transitive via Alloy ruint; awaiting upstream replacement" }, - { id = "RUSTSEC-2025-0057", reason = "fxhash unmaintained — transitive via Solana ProgramTest; awaiting upstream replacement" }, - { id = "RUSTSEC-2024-0384", reason = "instant unmaintained — transitive via wasm-bindgen tree; not exercised at runtime" }, - { id = "RUSTSEC-2025-0161", reason = "libsecp256k1 unmaintained — transitive via blueprint-networking; workspace signing uses ed25519" }, - { id = "RUSTSEC-2024-0436", reason = "paste unmaintained — pervasive transitive in Solana proc-macros; no exploitable runtime path" }, - { id = "RUSTSEC-2025-0010", reason = "ring 0.16 unmaintained — transitive via rustls 0.21 in Solana stack; covered by RUSTSEC-2025-0009 mitigation note" }, - { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via webpki / reqwest; covered by rustls migration plan" }, - { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained — proc-macro transitive via alloy-sol-macro (blueprint-sdk); compile-time only, no runtime path" }, + # Vulnerabilities without a consumable fixed path. + { id = "RUSTSEC-2023-0071", reason = "rsa is used only to verify TEE attestation signatures; Marvin targets private-key operations; no fixed rsa release" }, + { id = "RUSTSEC-2025-0111", reason = "tokio-tar 0.3.1 is dev-only through blueprint anvil testcontainers; no fixed tokio-tar release" }, + + # Unmaintained upstream packages that remain in the resolved graph. + { id = "RUSTSEC-2021-0141", reason = "dotenv remains through phala-tee-deploy-rs and test fixtures; no maintained release on the same API" }, + { id = "RUSTSEC-2024-0436", reason = "paste is a compile-time transitive dependency; no workspace code imports it" }, + { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile 1 and 2 remain transitive through upstream TLS clients; no workspace code imports them" }, + { id = "RUSTSEC-2025-0141", reason = "bincode 1 is required by Solana transaction serde compatibility; bincode 2 uses a different wire API" }, + { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 is compile-time only through upstream macros; no workspace runtime path" }, ] # ── Licences ──────────────────────────────────────────────────────────────── @@ -104,7 +72,6 @@ allow = [ "MPL-2.0", "CC0-1.0", "0BSD", - "OpenSSL", "CDLA-Permissive-2.0", # `Unlicense` is OSI-equivalent public-domain dedication. Three # transitive deps of `ws_stream_wasm` (Polymarket WS client) ship @@ -126,12 +93,6 @@ exceptions = [] # lossy 32-bit fold but we keep the long hash in this comment for # audit). Re-validate any clarify on each version bump. -[[licenses.clarify]] -name = "ring" -version = "0.16" -expression = "ISC AND MIT AND OpenSSL" -license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }] - [[licenses.clarify]] name = "eigensdk" expression = "BSD-3-Clause" @@ -164,12 +125,13 @@ name = "workspace-hack" expression = "MIT OR Apache-2.0" license-files = [] -# solana-config-program-client publishes the standard Solana Apache-2.0 -# header in source but omits the manifest field upstream. +# solana-config-interface publishes the standard Apache-2.0 license file +# but omits the manifest field upstream. [[licenses.clarify]] -name = "solana-config-program-client" +name = "solana-config-interface" +version = "2.0.0" expression = "Apache-2.0" -license-files = [] +license-files = [{ path = "LICENSE", hash = 0xd0891cfa }] # ── Bans (multi-version + wildcard hygiene) ───────────────────────────────── [bans] @@ -213,9 +175,10 @@ unknown-git = "deny" allow-registry = ["https://github.com/rust-lang/crates.io-index"] -# Only Tangle-org git deps. Each MUST be pinned by tag or commit (not -# branch) — verified by `cargo tree --duplicates` + manual review. +# Reviewed git dependencies. Each must be pinned by tag or commit. allow-git = [ + "https://github.com/drewstone/eigensdk-rs.git", "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", "https://github.com/tangle-network/blueprint.git", + "https://github.com/tangle-network/hyperliquid-rust-sdk.git", ] diff --git a/trading-blueprint-bin/Cargo.toml b/trading-blueprint-bin/Cargo.toml index 6258a2d1..1513911f 100644 --- a/trading-blueprint-bin/Cargo.toml +++ b/trading-blueprint-bin/Cargo.toml @@ -22,8 +22,8 @@ x402 = ["blueprint-sdk/x402"] trading-blueprint-lib = { path = "../trading-blueprint-lib" } trading-http-api = { path = "../trading-http-api" } trading-runtime = { path = "../trading-runtime" } -ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } +ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } blueprint-producers-extra = { version = "=0.2.0-alpha.5", features = ["cron"] } blueprint-qos = { version = "=0.2.0-alpha.11", optional = true } blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tangle"] } @@ -52,7 +52,7 @@ chrono = "0.4" http-body-util = "0.1" hyper = "1" once_cell = "1" -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea", features = ["test-utils"] } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710", features = ["test-utils"] } serde_json = "1" tempfile = "3" tokio = { version = "1", features = ["macros", "rt-multi-thread"] } diff --git a/trading-blueprint-lib/Cargo.toml b/trading-blueprint-lib/Cargo.toml index afe2f01f..2a1f2c4b 100644 --- a/trading-blueprint-lib/Cargo.toml +++ b/trading-blueprint-lib/Cargo.toml @@ -9,8 +9,8 @@ license.workspace = true [dependencies] trading-runtime = { path = "../trading-runtime" } trading-http-api = { path = "../trading-http-api" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } -ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } +ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } alloy = { version = "1", default-features = false, features = ["sol-types", "contract", "providers", "provider-http", "network", "transport-http", "rpc-types", "consensus", "reqwest"] } axum = "0.8" hex = "0.4" @@ -29,21 +29,21 @@ tower = "0.5" tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter"] } # OTLP/HTTP-JSON trace export → Tangle Intelligence (intelligence.tangle.tools). -# Versions pinned to match blueprint-qos (opentelemetry 0.31 / tracing-opentelemetry -# 0.32) so the bridge layer and exporter share one opentelemetry core. JSON wire + +# Versions pinned to match blueprint-qos (opentelemetry 0.32 / tracing-opentelemetry +# 0.33) so the bridge layer and exporter share one opentelemetry core. JSON wire + # blocking reqwest client: the batch processor's worker thread drives exports # directly, no tokio-reactor-in-worker-thread footgun. TLS for the https # Intelligence endpoint comes from the workspace `reqwest` rustls-tls feature # above (Cargo unifies both onto one reqwest 0.12 instance). -opentelemetry = "0.31" -opentelemetry_sdk = { version = "0.31", features = ["rt-tokio"] } -opentelemetry-otlp = { version = "0.31", default-features = false, features = ["trace", "http-json", "reqwest-blocking-client", "reqwest-rustls"] } -tracing-opentelemetry = "0.32" +opentelemetry = "0.32" +opentelemetry_sdk = { version = "0.32", features = ["rt-tokio"] } +opentelemetry-otlp = { version = "0.32", default-features = false, features = ["trace", "http-json", "reqwest-blocking-client", "reqwest-rustls"] } +tracing-opentelemetry = "0.33" uuid = { version = "1", features = ["v4"] } [dev-dependencies] anyhow = "1" -alloy = { version = "1", features = ["node-bindings", "sol-types", "contract", "providers", "provider-http", "signer-local", "signers", "network", "transport-http", "rpc-types", "consensus", "reqwest"] } +alloy = { version = "1", features = ["node-bindings", "sol-types", "contract", "providers", "provider-http", "signer-local", "network", "transport-http", "rpc-types", "consensus", "reqwest"] } axum = "0.8" blueprint-anvil-testing-utils = { version = "=0.2.0-alpha.10" } hex = "0.4" diff --git a/trading-blueprint-lib/tests/otlp_export.rs b/trading-blueprint-lib/tests/otlp_export.rs index f8fcb129..e2c31039 100644 --- a/trading-blueprint-lib/tests/otlp_export.rs +++ b/trading-blueprint-lib/tests/otlp_export.rs @@ -77,6 +77,11 @@ fn operator_exports_spans_as_otlp_http_json() { // Point the exporter at the mock collector and give it a tenant key. // SAFETY: single-threaded test setup before any telemetry thread spawns. unsafe { + // The SDK reads these after programmatic headers and lets them override + // matching names. Keep this process-isolated test independent of the + // developer or CI environment. + std::env::remove_var("OTEL_EXPORTER_OTLP_HEADERS"); + std::env::remove_var("OTEL_EXPORTER_OTLP_TRACES_HEADERS"); std::env::set_var( "OTEL_EXPORTER_OTLP_ENDPOINT", format!("http://127.0.0.1:{port}"), @@ -110,7 +115,7 @@ fn operator_exports_spans_as_otlp_http_json() { // Auth: the Tangle tenant bearer token. assert!( head.contains("authorization: bearer sk-tan-proof-key"), - "missing/!= Authorization bearer header; headers:\n{head}" + "missing or incorrect Authorization bearer header" ); // JSON wire (the Intelligence adapter rejects protobuf). assert!( diff --git a/trading-http-api/Cargo.toml b/trading-http-api/Cargo.toml index 43f87f07..7d1d8d5e 100644 --- a/trading-http-api/Cargo.toml +++ b/trading-http-api/Cargo.toml @@ -9,7 +9,7 @@ license.workspace = true [dependencies] trading-runtime = { path = "../trading-runtime" } trading-validator-lib = { path = "../trading-validator-lib" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } axum = { version = "0.8", features = ["ws"] } chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] } once_cell = "1" @@ -22,7 +22,7 @@ tower-http = { version = "0.6", features = ["cors"] } tracing = "0.1" rust_decimal = { version = "1", features = ["serde"] } uuid = { version = "1", features = ["v4"] } -alloy = { version = "1", default-features = false, features = ["signers"] } +alloy = { version = "1", default-features = false, features = ["signer-local"] } reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] } solana-sdk = "3.0.0" solana-compute-budget-interface = "3.0.0" diff --git a/trading-instance-blueprint-bin/Cargo.toml b/trading-instance-blueprint-bin/Cargo.toml index 51c8b301..fba00683 100644 --- a/trading-instance-blueprint-bin/Cargo.toml +++ b/trading-instance-blueprint-bin/Cargo.toml @@ -15,8 +15,8 @@ trading-instance-blueprint-lib = { path = "../trading-instance-blueprint-lib" } trading-blueprint-lib = { path = "../trading-blueprint-lib" } trading-http-api = { path = "../trading-http-api" } trading-runtime = { path = "../trading-runtime" } -ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } +ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } blueprint-producers-extra = { version = "=0.2.0-alpha.5", features = ["cron"] } blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tangle"] } axum = "0.8" diff --git a/trading-instance-blueprint-lib/Cargo.toml b/trading-instance-blueprint-lib/Cargo.toml index 124c2b5f..afce2b35 100644 --- a/trading-instance-blueprint-lib/Cargo.toml +++ b/trading-instance-blueprint-lib/Cargo.toml @@ -10,8 +10,8 @@ license.workspace = true trading-blueprint-lib = { path = "../trading-blueprint-lib" } trading-http-api = { path = "../trading-http-api" } trading-runtime = { path = "../trading-runtime" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } -ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } +ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } axum = "0.8" blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tracing", "macros", "tangle", "local-store"] } chrono = { version = "0.4", default-features = false, features = ["clock"] } @@ -25,8 +25,8 @@ tracing = "0.1" uuid = { version = "1", features = ["v4"] } [dev-dependencies] -ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } -alloy = { version = "1", features = ["node-bindings", "sol-types", "contract", "providers", "provider-http", "signer-local", "signers", "network", "transport-http", "rpc-types", "consensus", "reqwest"] } +ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } +alloy = { version = "1", features = ["node-bindings", "sol-types", "contract", "providers", "provider-http", "signer-local", "network", "transport-http", "rpc-types", "consensus", "reqwest"] } anyhow = "1" blueprint-anvil-testing-utils = { version = "=0.2.0-alpha.10" } blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tracing", "macros", "tangle", "local-store"] } @@ -34,7 +34,7 @@ chrono = { version = "0.4", default-features = false, features = ["clock"] } http-body-util = "0.1" hyper = "1" once_cell = "1" -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea", features = ["test-utils"] } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710", features = ["test-utils"] } serde_json = "1" tempfile = "3" tokio = { version = "1", features = ["macros", "rt-multi-thread", "time"] } diff --git a/trading-runtime/Cargo.toml b/trading-runtime/Cargo.toml index 307798f7..edbdebed 100644 --- a/trading-runtime/Cargo.toml +++ b/trading-runtime/Cargo.toml @@ -7,15 +7,14 @@ description = "Shared trading runtime library — intents, validation, portfolio license.workspace = true [dependencies] -alloy = { version = "1", default-features = false, features = ["sol-types", "contract", "providers", "provider-http", "signer-local", "signers", "network", "transport-http", "rpc-types", "consensus", "reqwest", "node-bindings"] } +alloy = { version = "1", default-features = false, features = ["sol-types", "contract", "providers", "provider-http", "signer-local", "network", "transport-http", "rpc-types", "consensus", "reqwest", "node-bindings"] } async-trait = "0.1" axum = { version = "0.8", default-features = false, features = ["http1", "json"] } chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] } futures = "0.3" hex = "0.4" polymarket-client-sdk = { version = "0.4.4", features = ["clob", "data", "gamma", "tracing"] } -ethers-signers = "2" -hyperliquid = "0.2" +hyperliquid_rust_sdk = { git = "https://github.com/tangle-network/hyperliquid-rust-sdk.git", rev = "9dc8b253ebae65d8e6a07b074ea6806d7cf91189" } reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] } rust_decimal = { version = "1", features = ["serde"] } serde = { version = "1", features = ["derive"] } diff --git a/trading-runtime/src/hyperliquid.rs b/trading-runtime/src/hyperliquid.rs index cbaa1333..6e1e6727 100644 --- a/trading-runtime/src/hyperliquid.rs +++ b/trading-runtime/src/hyperliquid.rs @@ -1,18 +1,16 @@ //! Native Hyperliquid client for direct L1 API trading. //! -//! Wraps the `hyperliquid` crate to provide a high-level interface for the +//! Wraps the official Hyperliquid Rust SDK to provide a high-level interface for the //! trading HTTP API. All order signing, serialization, and API communication -//! is handled by the SDK — this module provides ergonomic typed wrappers. +//! is handled by the SDK. This module provides ergonomic typed wrappers. -use std::sync::Arc; +use std::{collections::HashMap, sync::Arc}; -use ethers_signers::{LocalWallet, Signer}; -use hyperliquid::types::Chain; -use hyperliquid::types::exchange::request::{ - CancelRequest, Limit, OrderRequest, OrderType, Tif, TpSl, Trigger, +use alloy::{primitives::Address, signers::local::PrivateKeySigner}; +use hyperliquid_rust_sdk::{ + BaseUrl, CancelRequest, ExchangeClient, ExchangeResponseStatus as HlResponse, InfoClient, + Limit, Order, OrderGrouping, OrderRequest, Trigger, }; -use hyperliquid::types::exchange::response::Response as HlResponse; -use hyperliquid::{Exchange, Hyperliquid, Info}; use serde::{Deserialize, Serialize}; // ── Public types ──────────────────────────────────────────────────────────── @@ -107,60 +105,34 @@ pub struct AccountInfo { // ── Client ────────────────────────────────────────────────────────────────── pub struct HyperliquidClient { - exchange: Exchange, - info: Info, - wallet: Arc, - info_api_url: &'static str, + wallet: PrivateKeySigner, + base_url: BaseUrl, + exchanges: tokio::sync::RwLock, Arc>>, + info: tokio::sync::OnceCell, asset_map: tokio::sync::RwLock>>, } -const HYPERLIQUID_INFO_URL_MAINNET: &str = "https://api.hyperliquid.xyz/info"; -const HYPERLIQUID_INFO_URL_TESTNET: &str = "https://api.hyperliquid-testnet.xyz/info"; const HYPERLIQUID_OUTCOME_ASSET_OFFSET: u32 = 100_000_000; -#[derive(Debug, Deserialize)] -struct HlMetaResponse { - universe: Vec, -} - -#[derive(Debug, Deserialize)] -struct HlAssetMeta { - name: String, -} - impl HyperliquidClient { pub fn new(private_key: &str) -> Result { - let wallet: LocalWallet = private_key - .parse() - .map_err(|e| format!("invalid private key: {e}"))?; - - let chain = Chain::Arbitrum; - let exchange: Exchange = Hyperliquid::new(chain); - let info: Info = Hyperliquid::new(chain); - - Ok(Self { - exchange, - info, - wallet: Arc::new(wallet), - info_api_url: HYPERLIQUID_INFO_URL_MAINNET, - asset_map: tokio::sync::RwLock::new(None), - }) + Self::with_base_url(private_key, BaseUrl::Mainnet) } pub fn testnet(private_key: &str) -> Result { - let wallet: LocalWallet = private_key + Self::with_base_url(private_key, BaseUrl::Testnet) + } + + fn with_base_url(private_key: &str, base_url: BaseUrl) -> Result { + let wallet: PrivateKeySigner = private_key .parse() .map_err(|e| format!("invalid private key: {e}"))?; - let chain = Chain::ArbitrumTestnet; - let exchange: Exchange = Hyperliquid::new(chain); - let info: Info = Hyperliquid::new(chain); - Ok(Self { - exchange, - info, - wallet: Arc::new(wallet), - info_api_url: HYPERLIQUID_INFO_URL_TESTNET, + wallet, + base_url, + exchanges: tokio::sync::RwLock::new(HashMap::new()), + info: tokio::sync::OnceCell::new(), asset_map: tokio::sync::RwLock::new(None), }) } @@ -169,6 +141,40 @@ impl HyperliquidClient { format!("{:#x}", self.wallet.address()) } + async fn info(&self) -> Result<&InfoClient, String> { + self.info + .get_or_try_init(|| async { + InfoClient::new(None, Some(self.base_url)) + .await + .map_err(|e| format!("HL info client: {e}")) + }) + .await + } + + async fn exchange_for_account( + &self, + account_address: Option<&str>, + ) -> Result, String> { + let vault_address = Self::parse_account_address(account_address)?; + if let Some(exchange) = self.exchanges.read().await.get(&vault_address).cloned() { + return Ok(exchange); + } + + let exchange = Arc::new( + ExchangeClient::new( + None, + self.wallet.clone(), + Some(self.base_url), + None, + vault_address, + ) + .await + .map_err(|e| format!("HL exchange client: {e}"))?, + ); + let mut exchanges = self.exchanges.write().await; + Ok(exchanges.entry(vault_address).or_insert(exchange).clone()) + } + pub async fn resolve_asset(&self, id: &AssetId) -> Result { match id { AssetId::Index(i) => Ok(*i), @@ -198,19 +204,11 @@ impl HyperliquidClient { } async fn metadata_asset_names(&self) -> Result, String> { - let response = reqwest::Client::new() - .post(self.info_api_url) - .json(&serde_json::json!({ "type": "meta" })) - .send() + let meta = self + .info() .await - .map_err(|e| format!("HL metadata: {e}"))?; - let status = response.status(); - if !status.is_success() { - let body = response.text().await.unwrap_or_default(); - return Err(format!("HL metadata returned {status}: {body}")); - } - let meta = response - .json::() + .map_err(|e| format!("HL metadata: {e}"))? + .meta() .await .map_err(|e| format!("HL metadata: {e}"))?; Ok(meta.universe.into_iter().map(|asset| asset.name).collect()) @@ -240,8 +238,9 @@ impl HyperliquidClient { async fn market_ioc_price(&self, asset: u32, is_buy: bool) -> Result { let symbol = self.asset_name(asset).await?; let mids = self - .info - .mids() + .info() + .await? + .all_mids() .await .map_err(|e| format!("HL mids: {e}"))?; let mid = mids @@ -269,11 +268,7 @@ impl HyperliquidClient { Ok(format_hyperliquid_price(mid * multiplier.max(0.0001))) } - fn parse_account_address(account_address: Option<&str>) -> Result, String> - where - T: std::str::FromStr, - T::Err: std::fmt::Display, - { + fn parse_account_address(account_address: Option<&str>) -> Result, String> { account_address .filter(|raw| !raw.trim().is_empty()) .map(|raw| { @@ -297,14 +292,18 @@ impl HyperliquidClient { let (limit_px, order_type, reduce_only) = match &req.order_type { HlOrderType::Limit { price } => ( price.clone(), - OrderType::Limit(Limit { tif: Tif::Gtc }), + Order::Limit(Limit { + tif: "Gtc".to_string(), + }), req.reduce_only, ), HlOrderType::Market => { let price = self.market_ioc_price(asset, req.is_buy).await?; ( price, - OrderType::Limit(Limit { tif: Tif::Ioc }), + Order::Limit(Limit { + tif: "Ioc".to_string(), + }), req.reduce_only, ) } @@ -313,10 +312,10 @@ impl HyperliquidClient { is_market, } => ( trigger_price.clone(), - OrderType::Trigger(Trigger { + Order::Trigger(Trigger { is_market: *is_market, trigger_px: trigger_price.clone(), - tpsl: TpSl::Sl, + tpsl: "sl".to_string(), }), true, ), @@ -325,21 +324,16 @@ impl HyperliquidClient { is_market, } => ( trigger_price.clone(), - OrderType::Trigger(Trigger { + Order::Trigger(Trigger { is_market: *is_market, trigger_px: trigger_price.clone(), - tpsl: TpSl::Tp, + tpsl: "tp".to_string(), }), true, ), }; - let cloid = req - .cloid - .as_ref() - .map(|c| c.parse()) - .transpose() - .map_err(|e| format!("invalid cloid: {e}"))?; + let cloid = req.cloid.as_deref().map(parse_cloid).transpose()?; let order = OrderRequest { asset, @@ -351,10 +345,9 @@ impl HyperliquidClient { cloid, }; - let vault_address = Self::parse_account_address(account_address)?; - - self.exchange - .place_order(self.wallet.clone(), vec![order], vault_address) + let exchange = self.exchange_for_account(account_address).await?; + exchange + .bulk_order_raw_with_grouping(vec![order], None, OrderGrouping::Na) .await .map_err(|e| format!("HL place_order: {e}")) } @@ -382,12 +375,20 @@ impl HyperliquidClient { // Entry let (entry_px, entry_ot) = match &entry.order_type { - HlOrderType::Limit { price } => { - (price.clone(), OrderType::Limit(Limit { tif: Tif::Gtc })) - } + HlOrderType::Limit { price } => ( + price.clone(), + Order::Limit(Limit { + tif: "Gtc".to_string(), + }), + ), HlOrderType::Market => { let px = if entry.is_buy { "999999999" } else { "0.0001" }; - (px.to_string(), OrderType::Limit(Limit { tif: Tif::Ioc })) + ( + px.to_string(), + Order::Limit(Limit { + tif: "Ioc".to_string(), + }), + ) } _ => return Err("entry must be Limit or Market".into()), }; @@ -416,10 +417,10 @@ impl HyperliquidClient { limit_px: tp.0.clone(), sz: entry.size.clone(), reduce_only: true, - order_type: OrderType::Trigger(Trigger { + order_type: Order::Trigger(Trigger { is_market: tp.1, trigger_px: tp.0.clone(), - tpsl: TpSl::Sl, + tpsl: "sl".to_string(), }), cloid: None, }); @@ -440,28 +441,25 @@ impl HyperliquidClient { limit_px: tp.0.clone(), sz: entry.size.clone(), reduce_only: true, - order_type: OrderType::Trigger(Trigger { + order_type: Order::Trigger(Trigger { is_market: tp.1, trigger_px: tp.0.clone(), - tpsl: TpSl::Tp, + tpsl: "tp".to_string(), }), cloid: None, }); } - let vault_address = Self::parse_account_address(account_address)?; - - if stop_loss.is_some() || take_profit.is_some() { - self.exchange - .normal_tpsl(self.wallet.clone(), orders, vault_address) - .await - .map_err(|e| format!("HL bracket: {e}")) + let exchange = self.exchange_for_account(account_address).await?; + let grouping = if stop_loss.is_some() || take_profit.is_some() { + OrderGrouping::NormalTpsl } else { - self.exchange - .place_order(self.wallet.clone(), orders, vault_address) - .await - .map_err(|e| format!("HL order: {e}")) - } + OrderGrouping::Na + }; + exchange + .bulk_order_raw_with_grouping(orders, None, grouping) + .await + .map_err(|e| format!("HL bracket: {e}")) } pub async fn cancel_order(&self, asset: u32, order_id: u64) -> Result { @@ -474,16 +472,14 @@ impl HyperliquidClient { order_id: u64, account_address: Option<&str>, ) -> Result { - let vault_address = Self::parse_account_address(account_address)?; - - self.exchange - .cancel_order( - self.wallet.clone(), + let exchange = self.exchange_for_account(account_address).await?; + exchange + .bulk_cancel_raw( vec![CancelRequest { asset, oid: order_id, }], - vault_address, + None, ) .await .map_err(|e| format!("HL cancel: {e}")) @@ -495,8 +491,9 @@ impl HyperliquidClient { leverage: u32, is_cross: bool, ) -> Result { - self.exchange - .update_leverage(self.wallet.clone(), leverage, asset, is_cross) + self.exchange_for_account(None) + .await? + .update_leverage_by_asset_index(leverage, asset, is_cross, None) .await .map_err(|e| format!("HL leverage: {e}")) } @@ -517,13 +514,15 @@ impl HyperliquidClient { }; let state = self - .info + .info() + .await? .user_state(address) .await .map_err(|e| format!("HL user_state: {e}"))?; let orders = self - .info + .info() + .await? .open_orders(address) .await .map_err(|e| format!("HL open_orders: {e}"))?; @@ -553,7 +552,7 @@ impl HyperliquidClient { coin: o.coin, limit_px: o.limit_px, oid: o.oid, - side: format!("{:?}", o.side), + side: o.side, sz: o.sz, timestamp: o.timestamp, }) @@ -571,7 +570,11 @@ impl HyperliquidClient { } pub async fn get_mids(&self) -> Result, String> { - self.info.mids().await.map_err(|e| format!("HL mids: {e}")) + self.info() + .await? + .all_mids() + .await + .map_err(|e| format!("HL mids: {e}")) } /// Reconcile local position ledger against HL clearinghouse state. @@ -851,6 +854,11 @@ fn parse_encoded_asset_index(symbol: &str) -> Option { trimmed.parse::().ok() } +fn parse_cloid(raw: &str) -> Result { + let cloid = uuid::Uuid::parse_str(raw).map_err(|e| format!("invalid cloid: {e}"))?; + Ok(format!("0x{}", cloid.simple())) +} + #[cfg(test)] mod tests { use super::*; @@ -943,7 +951,7 @@ mod tests { ] }"#; - let meta: HlMetaResponse = serde_json::from_str(json).unwrap(); + let meta: hyperliquid_rust_sdk::Meta = serde_json::from_str(json).unwrap(); assert_eq!( meta.universe @@ -954,6 +962,15 @@ mod tests { ); } + #[test] + fn cloid_is_validated_and_encoded_as_128_bit_hex() { + assert_eq!( + parse_cloid("00112233-4455-6677-8899-aabbccddeeff").unwrap(), + "0x00112233445566778899aabbccddeeff" + ); + assert!(parse_cloid("not-a-uuid").is_err()); + } + #[test] fn position_ledger_crud() { let dir = std::env::temp_dir().join(format!("hl-ledger-test-{}", uuid::Uuid::new_v4())); diff --git a/trading-tee-instance-blueprint-bin/Cargo.toml b/trading-tee-instance-blueprint-bin/Cargo.toml index b6eb5d83..12933118 100644 --- a/trading-tee-instance-blueprint-bin/Cargo.toml +++ b/trading-tee-instance-blueprint-bin/Cargo.toml @@ -14,8 +14,8 @@ path = "src/main.rs" trading-tee-instance-blueprint-lib = { path = "../trading-tee-instance-blueprint-lib" } trading-instance-blueprint-lib = { path = "../trading-instance-blueprint-lib" } trading-blueprint-lib = { path = "../trading-blueprint-lib" } -ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea", features = ["tee-all"] } +ai-agent-sandbox-blueprint-lib = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710" } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710", features = ["tee-all"] } blueprint-producers-extra = { version = "=0.2.0-alpha.5", features = ["cron"] } blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tangle"] } axum = "0.8" diff --git a/trading-tee-instance-blueprint-lib/Cargo.toml b/trading-tee-instance-blueprint-lib/Cargo.toml index 198921c0..6df4e0c8 100644 --- a/trading-tee-instance-blueprint-lib/Cargo.toml +++ b/trading-tee-instance-blueprint-lib/Cargo.toml @@ -9,6 +9,6 @@ license.workspace = true [dependencies] trading-instance-blueprint-lib = { path = "../trading-instance-blueprint-lib" } trading-blueprint-lib = { path = "../trading-blueprint-lib" } -sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "8ae2d24ea69e8581f25d4d2ab923ace49f3179ea", features = ["tee-all"] } +sandbox-runtime = { git = "https://github.com/tangle-network/ai-agent-sandbox-blueprint.git", rev = "4a2e0f9652c61f26f253a957ed05ad49e9239710", features = ["tee-all"] } blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tracing", "macros", "tangle", "local-store"] } tracing = "0.1" diff --git a/trading-validator-lib/Cargo.toml b/trading-validator-lib/Cargo.toml index 243fdfb1..60d658c3 100644 --- a/trading-validator-lib/Cargo.toml +++ b/trading-validator-lib/Cargo.toml @@ -9,7 +9,7 @@ license.workspace = true [dependencies] trading-runtime = { path = "../trading-runtime" } blueprint-sdk = { version = "=0.2.0-alpha.10", default-features = false, features = ["std", "tracing", "macros", "tangle", "local-store"] } -alloy = { version = "1", features = ["signers", "signer-local", "sol-types"] } +alloy = { version = "1", default-features = false, features = ["signer-local", "sol-types"] } axum = "0.8" chrono = { version = "0.4", default-features = false, features = ["clock"] } hex = "0.4"