feat(rebalance): buy cNGN back on HyperFX, and share the KMS signer

.github/workflows/services-execution.yml

@@ -1,16 +1,17 @@
 # .github/workflows/services-execution.yml
 # Depends on @numo/abis (committed generated source), so runs when the service OR
 # the abis package changes. No forge needed — @numo/abis compiles from committed .ts.
-# NOTE: @numo/abis must be BUILT before the service — its main/types resolve to dist/,
-# which is gitignored. Without the build step below, check/build/test all fail to
-# resolve '@numo/abis'.
+# NOTE: @numo/abis and @numo/kms-signer must be BUILT before the service — their main/types
+# resolve to dist/, which is gitignored. Without the build steps below, check/build/test all
+# fail to resolve them.
 name: services-execution
 on:
   push:
     branches: [main]
     paths:
       - 'services/execution/**'
       - 'packages/abis/**'
+      - 'packages/kms-signer/**'
       - 'pnpm-workspace.yaml'
       - 'package.json'
       - 'pnpm-lock.yaml'
@@ -19,6 +20,7 @@ on:
     paths:
       - 'services/execution/**'
       - 'packages/abis/**'
+      - 'packages/kms-signer/**'
       - 'pnpm-workspace.yaml'
       - 'package.json'
       - 'pnpm-lock.yaml'
@@ -38,6 +40,9 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter @numo/abis build   # compile to dist/ first — service resolves main/types there
+      - run: pnpm --filter @numo/kms-signer build
+      - run: pnpm --filter @numo/kms-signer run check
+      - run: pnpm --filter @numo/kms-signer test
       - run: pnpm --filter matching-executor run check
       - run: pnpm --filter matching-executor run build
       - run: pnpm --filter matching-executor test

.github/workflows/services-rebalance.yml

@@ -0,0 +1,39 @@
+# .github/workflows/services-rebalance.yml
+# Depends on @numo/kms-signer, whose main/types resolve to a gitignored dist/, so it must be
+# BUILT before this package can check or test.
+name: services-rebalance
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'services/rebalance/**'
+      - 'packages/kms-signer/**'
+      - 'pnpm-workspace.yaml'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - '.github/workflows/services-rebalance.yml'
+  pull_request:
+    paths:
+      - 'services/rebalance/**'
+      - 'packages/kms-signer/**'
+      - 'pnpm-workspace.yaml'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - '.github/workflows/services-rebalance.yml'
+concurrency:
+  group: services-rebalance-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @numo/kms-signer build
+      - run: pnpm --filter cngn-rebalance run check
+      - run: pnpm --filter cngn-rebalance test

packages/kms-signer/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@numo/kms-signer",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "node --import tsx --test src/**/*.test.ts"
+  },
+  "dependencies": {
+    "@aws-sdk/client-kms": "3.1133.0",
+    "viem": "^2.23.5"
+  },
+  "devDependencies": {
+    "@noble/curves": "1.9.1",
+    "@types/node": "^22.13.10",
+    "tsx": "^4.19.3",
+    "typescript": "^5.8.2"
+  }
+}

packages/kms-signer/src/index.ts

@@ -0,0 +1 @@
+export { createKmsAccount, ethereumSignatureFromDer, secp256k1PointFromSpki, type KmsApi } from './kms-signer.js';

packages/kms-signer/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "skipLibCheck": true,
+    "declaration": true,
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}