@fased/fased 0.1.45 → 0.1.47

package/dist/commands/wallet.js

@@ -2,19 +2,20 @@ import { defaultRuntime } from "../runtime.js";
 import { loadConfig, writeConfigFile } from "../config/io.js";
 import "../config/config.js";
 import { ensureWalletStateDir, resolveLocalSignerBackendSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerSidecarPaths, resolveLocalSignerSocketPath, resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
-import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
 import { normalizeWalletUserRole, readWalletProviderRegistry, resolveWalletUserRole, setDefaultWallet, setNamedWalletRole, upsertNamedWallet } from "../wallet/wallet-provider-registry.js";
 import { applyWalletPolicyConfig, resolveWalletRoleForId } from "../wallet/wallet-policy.js";
+import { buildWalletProviderCapabilityMatrix } from "../wallet/wallet-provider-capabilities.js";
+import { redactWalletDiagnosticText } from "../wallet/wallet-redaction.js";
 import { readWalletProviderSecretStatus, saveWalletProviderSecret } from "../wallet/wallet-secrets-store.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "../wallet/wallet-provider-resolver.js";
+import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
 import { deleteWalletCustodyCeremony, initializeWalletCustodyCeremony, listSplitKeyWalletCustodyStatuses, lockWalletCustodyUnlockSessions, readWalletCustodyStatus, recoverWalletCustodyPassphrase } from "../wallet/wallet-custody.js";
-import { buildWalletProviderCapabilityMatrix } from "../wallet/wallet-provider-capabilities.js";
 import { readWalletStatusSnapshot, resolveWalletConfigForRuntime } from "../wallet/wallet-status.js";
 import { startLocalSocketSignerBroker } from "../wallet/local-socket-signer-broker.js";
 import { listWalletInboundEvents, pollWalletInboundEvents, reconcileWalletInboundEvents } from "../wallet/wallet-inbound-events.js";
 import { buildWalletCanaryReport, runWalletProviderCanaryReport } from "../wallet/wallet-canary.js";
 import { resolveSignerdBinaryPath, restartLocalSocketSigner } from "../wizard/onboarding.wallet.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { createCipheriv, createDecipheriv, createPrivateKey, createPublicKey, randomBytes, scryptSync } from "node:crypto";
 import { createInterface } from "node:readline/promises";
@@ -675,12 +676,12 @@ function resolveKeystorePassphrase(optionsPassphrase, env) {
 		return optionsPassphrase.trim();
 	}
 	const file = String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim();
-	if (file && fs.existsSync(file)) {
-		return fs.readFileSync(file, "utf8").trim();
+	if (file && syncFs.existsSync(file)) {
+		return syncFs.readFileSync(file, "utf8").trim();
 	}
 	const managedFile = path.join(resolveLocalSignerMaterialRootDir(env), "passphrase");
-	if (fs.existsSync(managedFile)) {
-		return fs.readFileSync(managedFile, "utf8").trim();
+	if (syncFs.existsSync(managedFile)) {
+		return syncFs.readFileSync(managedFile, "utf8").trim();
 	}
 	return String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
 }
@@ -696,7 +697,7 @@ function resolveLocalSignerPassphraseSource(env) {
 	const candidates = [configuredFile ? path.resolve(configuredFile) : "", path.join(resolveLocalSignerMaterialRootDir(env), "passphrase")].filter(Boolean);
 	for (const candidate of candidates) {
 		try {
-			const value = fs.readFileSync(candidate, "utf8").trim();
+			const value = syncFs.readFileSync(candidate, "utf8").trim();
 			if (value) {
 				return {
 					kind: "file",
@@ -774,16 +775,16 @@ function ensureLocalSignerPassphraseFileForCustodyDisable(params) {
 	};
 }
 function writePassphraseFile(filePath, passphrase) {
-	fs.mkdirSync(path.dirname(filePath), {
+	syncFs.mkdirSync(path.dirname(filePath), {
 		recursive: true,
 		mode: 448
 	});
-	fs.writeFileSync(filePath, `${passphrase}\n`, {
+	syncFs.writeFileSync(filePath, `${passphrase}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
 	try {
-		fs.chmodSync(filePath, 384);
+		syncFs.chmodSync(filePath, 384);
 	} catch {}
 }
 function walletIdsMatchForEnvSuffix(left, right) {
@@ -823,7 +824,7 @@ function collectLocalSignerKeystoreTargets(cfg, env) {
 			return;
 		}
 		const resolved = path.resolve(candidate);
-		if (!fs.existsSync(resolved)) {
+		if (!syncFs.existsSync(resolved)) {
 			return;
 		}
 		const existing = targets.get(resolved);
@@ -850,8 +851,8 @@ function collectLocalSignerKeystoreTargets(cfg, env) {
 			addTarget("solana", value, key.slice("FASED_WALLET_SOLANA_KEYSTORE_PATH__".length).toLowerCase());
 		}
 	}
-	if (fs.existsSync(materialRoot)) {
-		for (const entry of fs.readdirSync(materialRoot, { withFileTypes: true })) {
+	if (syncFs.existsSync(materialRoot)) {
+		for (const entry of syncFs.readdirSync(materialRoot, { withFileTypes: true })) {
 			if (!entry.isFile()) {
 				continue;
 			}
@@ -871,7 +872,7 @@ function collectLocalSignerKeystoreTargets(cfg, env) {
 	return [...targets.values()].toSorted((left, right) => left.label.localeCompare(right.label));
 }
 async function reencryptLocalSignerKeystore(params) {
-	const raw = fs.readFileSync(params.target.path, "utf8");
+	const raw = syncFs.readFileSync(params.target.path, "utf8");
 	const detected = detectEmbeddedKeystoreType(raw);
 	if (detected === "solana-envelope") {
 		const envelope = parseSolanaKeystoreEnvelope(raw);
@@ -884,7 +885,7 @@ async function reencryptLocalSignerKeystore(params) {
 			passphrase: params.newPassphrase,
 			publicKey: envelope.publicKey
 		});
-		fs.writeFileSync(params.target.path, `${JSON.stringify(nextEnvelope, null, 2)}\n`, {
+		syncFs.writeFileSync(params.target.path, `${JSON.stringify(nextEnvelope, null, 2)}\n`, {
 			encoding: "utf8",
 			mode: 384
 		});
@@ -905,13 +906,13 @@ function removeLocalSignerPassphraseFileIfManaged(env) {
 	const resolved = path.resolve(configured);
 	const materialRoot = resolveLocalSignerMaterialRootDir(env);
 	const withinMaterialRoot = resolved === materialRoot || resolved.startsWith(`${materialRoot}${path.sep}`);
-	if (!withinMaterialRoot || !fs.existsSync(resolved)) {
+	if (!withinMaterialRoot || !syncFs.existsSync(resolved)) {
 		return {
 			removed: false,
 			path: resolved
 		};
 	}
-	fs.rmSync(resolved, { force: true });
+	syncFs.rmSync(resolved, { force: true });
 	return {
 		removed: true,
 		path: resolved
@@ -949,11 +950,11 @@ function writeLocalSignerEnvFile(cfg, env) {
 		"",
 		`"${signerBinPath}" --socket "\${FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET:-$FASED_WALLET_LOCAL_SIGNER_SOCKET}"`
 	];
-	fs.mkdirSync(path.dirname(signerEnvPath), {
+	syncFs.mkdirSync(path.dirname(signerEnvPath), {
 		recursive: true,
 		mode: 448
 	});
-	fs.writeFileSync(signerEnvPath, `${signerEnvLines.join("\n")}\n`, {
+	syncFs.writeFileSync(signerEnvPath, `${signerEnvLines.join("\n")}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
@@ -1051,11 +1052,11 @@ async function configureLocalSignerMode(runtime, options, env) {
 		"",
 		`"${signerBinPath}" --socket "\${FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET:-$FASED_WALLET_LOCAL_SIGNER_SOCKET}"`
 	];
-	fs.mkdirSync(path.dirname(signerEnvPath), {
+	syncFs.mkdirSync(path.dirname(signerEnvPath), {
 		recursive: true,
 		mode: 448
 	});
-	fs.writeFileSync(signerEnvPath, `${signerEnvLines.join("\n")}\n`, {
+	syncFs.writeFileSync(signerEnvPath, `${signerEnvLines.join("\n")}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
@@ -1499,10 +1500,10 @@ async function walletKeystoreInitCommand(runtime = defaultRuntime, options = {})
 	}
 	const chain = options.chain ?? "solana";
 	const outPath = resolveEmbeddedKeystorePathForChain(env, chain, options.out, options.walletId);
-	if (fs.existsSync(outPath) && !options.force) {
+	if (syncFs.existsSync(outPath) && !options.force) {
 		throw new Error(`Keystore already exists: ${outPath}`);
 	}
-	fs.mkdirSync(path.dirname(outPath), {
+	syncFs.mkdirSync(path.dirname(outPath), {
 		recursive: true,
 		mode: 448
 	});
@@ -1517,14 +1518,14 @@ async function walletKeystoreInitCommand(runtime = defaultRuntime, options = {})
 		passphrase,
 		publicKey
 	});
-	fs.writeFileSync(outPath, `${JSON.stringify(envelope, null, 2)}\n`, {
+	syncFs.writeFileSync(outPath, `${JSON.stringify(envelope, null, 2)}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
 	addressOut = publicKey;
 	privateKeyOut = Buffer.from(secretKey).toString("base64");
 	try {
-		fs.chmodSync(outPath, 384);
+		syncFs.chmodSync(outPath, 384);
 	} catch {}
 	const cfg = options.skipProviderConfig ? ensureWalletMaterialConfig(loadConfig(), {
 		keystorePath: outPath,
@@ -1599,10 +1600,10 @@ async function walletKeystoreImportCommand(runtime = defaultRuntime, options = {
 		throw new Error("Missing private key. Pass --private-key or set FASED_WALLET_PRIVATE_KEY.");
 	}
 	const outPath = resolveEmbeddedKeystorePathForChain(env, chain, options.out, options.walletId);
-	if (fs.existsSync(outPath) && !options.force) {
+	if (syncFs.existsSync(outPath) && !options.force) {
 		throw new Error(`Keystore already exists: ${outPath}`);
 	}
-	fs.mkdirSync(path.dirname(outPath), {
+	syncFs.mkdirSync(path.dirname(outPath), {
 		recursive: true,
 		mode: 448
 	});
@@ -1614,13 +1615,13 @@ async function walletKeystoreImportCommand(runtime = defaultRuntime, options = {
 		passphrase,
 		publicKey
 	});
-	fs.writeFileSync(outPath, `${JSON.stringify(envelope, null, 2)}\n`, {
+	syncFs.writeFileSync(outPath, `${JSON.stringify(envelope, null, 2)}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
 	addressOut = publicKey;
 	try {
-		fs.chmodSync(outPath, 384);
+		syncFs.chmodSync(outPath, 384);
 	} catch {}
 	const cfg = options.skipProviderConfig ? ensureWalletMaterialConfig(loadConfig(), {
 		keystorePath: outPath,
@@ -1682,7 +1683,7 @@ async function walletKeystoreStatusCommand(runtime = defaultRuntime, options = {
 	const cfg = loadConfig();
 	const chain = options.chain ?? "solana";
 	const keystorePath = resolveEmbeddedKeystorePathForChain(env, chain, cfg.wallet?.keystore?.path, options.walletId);
-	const exists = fs.existsSync(keystorePath);
+	const exists = syncFs.existsSync(keystorePath);
 	const providerId = cfg.wallet?.provider?.id;
 	let address;
 	let unlocked = false;
@@ -1690,7 +1691,7 @@ async function walletKeystoreStatusCommand(runtime = defaultRuntime, options = {
 	let detectedType = "missing";
 	if (exists) {
 		const passphrase = resolveKeystorePassphrase(undefined, env);
-		const raw = fs.readFileSync(keystorePath, "utf8");
+		const raw = syncFs.readFileSync(keystorePath, "utf8");
 		detectedType = detectEmbeddedKeystoreType(raw);
 		if (passphrase) {
 			try {
@@ -1755,14 +1756,14 @@ async function walletKeystoreValidateCommand(runtime = defaultRuntime, options =
 	};
 	let raw = "";
 	let detectedType = "missing";
-	if (!fs.existsSync(keystorePath)) {
+	if (!syncFs.existsSync(keystorePath)) {
 		result.checks.push({
 			id: "keystore.exists",
 			ok: false,
 			message: `missing: ${keystorePath}`
 		});
 	} else {
-		raw = fs.readFileSync(keystorePath, "utf8");
+		raw = syncFs.readFileSync(keystorePath, "utf8");
 		detectedType = detectEmbeddedKeystoreType(raw);
 		result.checks.push({
 			id: "keystore.exists",
@@ -1864,7 +1865,7 @@ async function walletKeystoreValidateCommand(runtime = defaultRuntime, options =
 async function walletKeystorePassphraseInitCommand(runtime = defaultRuntime, options = {}) {
 	const env = process.env ?? process.env;
 	const outPath = resolvePassphraseFilePath(env, options.out);
-	if (fs.existsSync(outPath) && !options.force) {
+	if (syncFs.existsSync(outPath) && !options.force) {
 		throw new Error(`Passphrase file already exists: ${outPath} (use --force to overwrite)`);
 	}
 	const bytes = typeof options.length === "number" && Number.isFinite(options.length) && options.length >= 16 ? Math.floor(options.length) : 24;
@@ -1886,15 +1887,15 @@ async function walletKeystorePassphraseRotateCommand(runtime = defaultRuntime, o
 	const cfg = loadConfig();
 	const keystorePath = resolveEmbeddedKeystorePath(env, cfg.wallet?.keystore?.path);
 	const passphraseFile = resolvePassphraseFilePath(env, options.file);
-	if (!fs.existsSync(keystorePath)) {
+	if (!syncFs.existsSync(keystorePath)) {
 		throw new Error(`Keystore missing: ${keystorePath}`);
 	}
-	const oldPassphrase = (options.oldPassphrase ?? (fs.existsSync(passphraseFile) ? fs.readFileSync(passphraseFile, "utf8") : "")).trim() || String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
+	const oldPassphrase = (options.oldPassphrase ?? (syncFs.existsSync(passphraseFile) ? syncFs.readFileSync(passphraseFile, "utf8") : "")).trim() || String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
 	if (!oldPassphrase) {
 		throw new Error("Missing old passphrase. Provide --old-passphrase or configure passphrase file/env.");
 	}
 	const newPassphrase = (options.newPassphrase ?? "").trim() || randomBytes(24).toString("base64url");
-	const raw = fs.readFileSync(keystorePath, "utf8");
+	const raw = syncFs.readFileSync(keystorePath, "utf8");
 	const detected = detectEmbeddedKeystoreType(raw);
 	if (detected === "solana-envelope") {
 		const envelope = parseSolanaKeystoreEnvelope(raw);
@@ -1907,7 +1908,7 @@ async function walletKeystorePassphraseRotateCommand(runtime = defaultRuntime, o
 			passphrase: newPassphrase,
 			publicKey: envelope.publicKey
 		});
-		fs.writeFileSync(keystorePath, `${JSON.stringify(nextEnvelope, null, 2)}\n`, {
+		syncFs.writeFileSync(keystorePath, `${JSON.stringify(nextEnvelope, null, 2)}\n`, {
 			encoding: "utf8",
 			mode: 384
 		});
@@ -1932,10 +1933,10 @@ async function walletKeystoreExportCommand(runtime = defaultRuntime, options = {
 	const env = process.env ?? process.env;
 	const cfg = loadConfig();
 	const keystorePath = resolveEmbeddedKeystorePath(env, cfg.wallet?.keystore?.path);
-	if (!fs.existsSync(keystorePath)) {
+	if (!syncFs.existsSync(keystorePath)) {
 		throw new Error(`Keystore missing: ${keystorePath}`);
 	}
-	const raw = fs.readFileSync(keystorePath, "utf8");
+	const raw = syncFs.readFileSync(keystorePath, "utf8");
 	const detected = detectEmbeddedKeystoreType(raw);
 	const outPath = options.out?.trim() ? path.resolve(options.out.trim()) : undefined;
 	const payload = {
@@ -1948,11 +1949,11 @@ async function walletKeystoreExportCommand(runtime = defaultRuntime, options = {
 		payload.keystore = raw;
 	}
 	if (outPath) {
-		fs.mkdirSync(path.dirname(outPath), {
+		syncFs.mkdirSync(path.dirname(outPath), {
 			recursive: true,
 			mode: 448
 		});
-		fs.writeFileSync(outPath, raw, {
+		syncFs.writeFileSync(outPath, raw, {
 			encoding: "utf8",
 			mode: 384
 		});
@@ -2128,7 +2129,7 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 	const push = (check, ok, detail) => checks.push({
 		check,
 		ok,
-		detail
+		detail: detail ? redactWalletDiagnosticText(detail) : undefined
 	});
 	const providerId = resolveWalletProviderId(cfg, effectiveEnv);
 	const isLocalSigner = providerId === "local-socket-signer";
@@ -2138,7 +2139,7 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 	const isNotFoundError = (err) => err?.code === "ENOENT";
 	if (isLocalSigner) {
 		try {
-			const st = fs.statSync(socketPath);
+			const st = syncFs.statSync(socketPath);
 			push("socket.exists", st.isSocket?.() ?? true, socketPath);
 			try {
 				const mode = st.mode & 511;
@@ -2148,7 +2149,7 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 			push("socket.exists", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
 		}
 		try {
-			const pidRaw = fs.readFileSync(pidPath, "utf8").trim();
+			const pidRaw = syncFs.readFileSync(pidPath, "utf8").trim();
 			const pid = Number.parseInt(pidRaw, 10);
 			if (Number.isFinite(pid) && pid > 1) {
 				try {
@@ -2164,7 +2165,7 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 			push("pid.alive", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
 		}
 		try {
-			const st = fs.statSync(auditPath);
+			const st = syncFs.statSync(auditPath);
 			push("audit.exists", true, `bytes=${st.size}`);
 		} catch (err) {
 			push("audit.exists", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
@@ -2192,14 +2193,14 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 			return "";
 		}
 		try {
-			return fs.readFileSync(p, "utf8").trim();
+			return syncFs.readFileSync(p, "utf8").trim();
 		} catch {
 			return "";
 		}
 	})();
 	const inspectKeystore = (label, keystorePath) => {
 		try {
-			const raw = fs.readFileSync(keystorePath, "utf8");
+			const raw = syncFs.readFileSync(keystorePath, "utf8");
 			const kind = detectEmbeddedKeystoreType(raw);
 			if (kind === "unknown") {
 				push(`keystore.file.${label}`, false, `${keystorePath} type=unknown (expected fased-solana-keypair envelope)`);
@@ -2256,7 +2257,7 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 			return true;
 		}
 		const defaultPath = resolveEmbeddedKeystorePathForChain(effectiveEnv, "solana");
-		if (fs.existsSync(defaultPath)) {
+		if (syncFs.existsSync(defaultPath)) {
 			return true;
 		}
 		if (providerDefaultWallet?.addresses?.solana) {

package/dist/config/cache-utils.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/config/cache-utils.ts
 function resolveCacheTtlMs(params) {
@@ -16,7 +16,7 @@ function isCacheEnabled(ttlMs) {
 }
 function getFileMtimeMs(filePath) {
 	try {
-		return fs.statSync(filePath).mtimeMs;
+		return syncFs.statSync(filePath).mtimeMs;
 	} catch {
 		return undefined;
 	}

package/dist/config/includes.js

@@ -4,7 +4,7 @@ import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 import { canUseBoundaryFileOpen, openBoundaryFileSync } from "../infra/boundary-file-read.js";
 import { isPathInside } from "../security/scan-paths.js";
 import "./prototype-keys.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import JSON5 from "json5";
 
@@ -130,7 +130,7 @@ var IncludeProcessor = class IncludeProcessor {
 			throw new ConfigIncludeError(`Include path escapes config directory: ${includePath} (root: ${this.rootDir})`, includePath);
 		}
 		try {
-			const real = fs.realpathSync(normalized);
+			const real = syncFs.realpathSync(normalized);
 			if (!isPathInside(this.rootRealDir, real)) {
 				throw new ConfigIncludeError(`Include path resolves outside config directory (symlink): ${includePath} (root: ${this.rootDir})`, includePath);
 			}
@@ -184,13 +184,13 @@ var IncludeProcessor = class IncludeProcessor {
 };
 function safeRealpath(target) {
 	try {
-		return fs.realpathSync(target);
+		return syncFs.realpathSync(target);
 	} catch {
 		return target;
 	}
 }
 function readConfigIncludeFileWithGuards(params) {
-	const ioFs = params.ioFs ?? fs;
+	const ioFs = params.ioFs ?? syncFs;
 	const maxBytes = params.maxBytes ?? MAX_INCLUDE_FILE_BYTES;
 	if (!canUseBoundaryFileOpen(ioFs)) {
 		return ioFs.readFileSync(params.resolvedPath, "utf-8");
@@ -217,7 +217,7 @@ function readConfigIncludeFileWithGuards(params) {
 	}
 }
 const defaultResolver = {
-	readFile: (p) => fs.readFileSync(p, "utf-8"),
+	readFile: (p) => syncFs.readFileSync(p, "utf-8"),
 	readFileWithGuards: ({ includePath, resolvedPath, rootRealDir }) => readConfigIncludeFileWithGuards({
 		includePath,
 		resolvedPath,

package/dist/config/io.js

@@ -22,7 +22,7 @@ import { repairInstalledPluginAllowlist } from "./plugins-allowlist.js";
 import { applyConfigOverrides } from "./runtime-overrides.js";
 import { validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins } from "./validation.js";
 import { compareFasedAgentVersions } from "./version.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import JSON5 from "json5";
@@ -477,7 +477,7 @@ function resolveConfigPathForDeps(deps) {
 }
 function normalizeDeps(overrides = {}) {
 	return {
-		fs: overrides.fs ?? fs,
+		fs: overrides.fs ?? syncFs,
 		json5: overrides.json5 ?? JSON5,
 		env: overrides.env ?? process.env,
 		homedir: overrides.homedir ?? (() => resolveRequiredHomeDir(overrides.env ?? process.env, os.homedir)),

package/dist/config/paths.js

@@ -1,5 +1,5 @@
 import { expandHomePrefix, resolveRequiredHomeDir } from "../infra/home-dir.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -86,7 +86,7 @@ function resolveConfigPathCandidate(env = process.env, homedir = envHomedir(env)
 	const candidates = resolveDefaultConfigCandidates(env, homedir);
 	const existing = candidates.find((candidate) => {
 		try {
-			return fs.existsSync(candidate);
+			return syncFs.existsSync(candidate);
 		} catch {
 			return false;
 		}
@@ -108,7 +108,7 @@ function resolveConfigPath(env = process.env, stateDir = resolveStateDir(env, en
 	const candidates = [path.join(stateDir, CONFIG_FILENAME)];
 	const existing = candidates.find((candidate) => {
 		try {
-			return fs.existsSync(candidate);
+			return syncFs.existsSync(candidate);
 		} catch {
 			return false;
 		}

package/dist/config/sat-runtime-ids.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/config/sat-runtime-ids.ts
@@ -63,7 +63,7 @@ function resolveSatRuntimeDefaultsFile(env = process.env) {
 		path.resolve(import.meta.dirname, "..", "..", "..", "config", "sat-runtime.env")
 	];
 	for (const candidate of candidates) {
-		if (candidate && fs.existsSync(candidate)) {
+		if (candidate && syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	}
@@ -82,7 +82,7 @@ function loadSatRuntimeDefaults(env = process.env) {
 	if (!file) {
 		return null;
 	}
-	const parsed = parseEnvFile(fs.readFileSync(file, "utf8"));
+	const parsed = parseEnvFile(syncFs.readFileSync(file, "utf8"));
 	if (!parsed.programId || !parsed.bondProgramId || !parsed.mintAddress || !parsed.mintProgramId) {
 		return null;
 	}

package/dist/config/sessions/disk-budget.js

@@ -1,6 +1,6 @@
 import { isPrimarySessionTranscriptFileName, isSessionArchiveArtifactName } from "./artifacts.js";
 import { resolveSessionFilePath } from "./paths.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/config/sessions/disk-budget.ts
@@ -11,7 +11,7 @@ const NOOP_LOGGER = {
 function canonicalizePathForComparison(filePath) {
 	const resolved = path.resolve(filePath);
 	try {
-		return fs.realpathSync(resolved);
+		return syncFs.realpathSync(resolved);
 	} catch {
 		return resolved;
 	}
@@ -83,14 +83,14 @@ function resolveReferencedSessionTranscriptPaths(params) {
 	return referenced;
 }
 async function readSessionsDirFiles(sessionsDir) {
-	const dirEntries = await fs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
+	const dirEntries = await syncFs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
 	const files = [];
 	for (const dirent of dirEntries) {
 		if (!dirent.isFile()) {
 			continue;
 		}
 		const filePath = path.join(sessionsDir, dirent.name);
-		const stat = await fs.promises.stat(filePath).catch(() => null);
+		const stat = await syncFs.promises.stat(filePath).catch(() => null);
 		if (!stat?.isFile()) {
 			continue;
 		}
@@ -105,11 +105,11 @@ async function readSessionsDirFiles(sessionsDir) {
 	return files;
 }
 async function removeFileIfExists(filePath) {
-	const stat = await fs.promises.stat(filePath).catch(() => null);
+	const stat = await syncFs.promises.stat(filePath).catch(() => null);
 	if (!stat?.isFile()) {
 		return 0;
 	}
-	await fs.promises.rm(filePath, { force: true }).catch(() => undefined);
+	await syncFs.promises.rm(filePath, { force: true }).catch(() => undefined);
 	return stat.size;
 }
 async function removeFileForBudget(params) {

package/dist/config/sessions/paths.js

@@ -1,7 +1,7 @@
 import { expandHomePrefix, resolveRequiredHomeDir } from "../../infra/home-dir.js";
 import { resolveStateDir } from "../paths.js";
 import { DEFAULT_AGENT_ID, normalizeAgentId } from "../../routing/session-key.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -112,7 +112,7 @@ function resolveStructuralSessionFallbackPath(candidateAbsPath, expectedAgentId)
 }
 function safeRealpathSync(filePath) {
 	try {
-		return fs.realpathSync(filePath);
+		return syncFs.realpathSync(filePath);
 	} catch {
 		return undefined;
 	}

package/dist/config/sessions/store.js

@@ -10,7 +10,7 @@ import { archiveSessionTranscripts, cleanupArchivedSessionTranscripts } from "..
 import { deliveryContextFromSession, mergeDeliveryContext, normalizeDeliveryContext, normalizeSessionDeliveryFields } from "../../utils/delivery-context.js";
 import { getFileMtimeMs, isCacheEnabled, resolveCacheTtlMs } from "../cache-utils.js";
 import { enforceSessionDiskBudget } from "./disk-budget.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 
@@ -155,7 +155,7 @@ function loadSessionStore(storePath, opts = {}) {
 	const retryBuf = maxReadAttempts > 1 ? new Int32Array(new SharedArrayBuffer(4)) : undefined;
 	for (let attempt = 0; attempt < maxReadAttempts; attempt++) {
 		try {
-			const raw = fs.readFileSync(storePath, "utf-8");
+			const raw = syncFs.readFileSync(storePath, "utf-8");
 			if (raw.length === 0 && attempt < maxReadAttempts - 1) {
 				Atomics.wait(retryBuf, 0, 0, 50);
 				continue;
@@ -406,7 +406,7 @@ function capEntryCount(store, overrideMax, opts = {}) {
 }
 async function getSessionFileSize(storePath) {
 	try {
-		const stat = await fs.promises.stat(storePath);
+		const stat = await syncFs.promises.stat(storePath);
 		return stat.size;
 	} catch {
 		return null;
@@ -428,7 +428,7 @@ async function rotateSessionFile(storePath, overrideBytes) {
 	}
 	const backupPath = `${storePath}.bak.${Date.now()}`;
 	try {
-		await fs.promises.rename(storePath, backupPath);
+		await syncFs.promises.rename(storePath, backupPath);
 		log.info("rotated session store file", {
 			backupPath: path.basename(backupPath),
 			sizeBytes: fileSize
@@ -439,13 +439,13 @@ async function rotateSessionFile(storePath, overrideBytes) {
 	try {
 		const dir = path.dirname(storePath);
 		const baseName = path.basename(storePath);
-		const files = await fs.promises.readdir(dir);
+		const files = await syncFs.promises.readdir(dir);
 		const backups = files.filter((f) => f.startsWith(`${baseName}.bak.`)).toSorted().toReversed();
 		const maxBackups = 3;
 		if (backups.length > maxBackups) {
 			const toDelete = backups.slice(maxBackups);
 			for (const old of toDelete) {
-				await fs.promises.unlink(path.join(dir, old)).catch(() => undefined);
+				await syncFs.promises.unlink(path.join(dir, old)).catch(() => undefined);
 			}
 			log.info("cleaned up old session store backups", { deleted: toDelete.length });
 		}
@@ -561,15 +561,15 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
 			});
 		}
 	}
-	await fs.promises.mkdir(path.dirname(storePath), { recursive: true });
+	await syncFs.promises.mkdir(path.dirname(storePath), { recursive: true });
 	const json = JSON.stringify(store, null, 2);
 	if (process.platform === "win32") {
 		const tmp = `${storePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
 		try {
-			await fs.promises.writeFile(tmp, json, "utf-8");
+			await syncFs.promises.writeFile(tmp, json, "utf-8");
 			for (let i = 0; i < 5; i++) {
 				try {
-					await fs.promises.rename(tmp, storePath);
+					await syncFs.promises.rename(tmp, storePath);
 					break;
 				} catch {
 					if (i < 4) {
@@ -587,28 +587,28 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
 			}
 			throw err;
 		} finally {
-			await fs.promises.rm(tmp, { force: true }).catch(() => undefined);
+			await syncFs.promises.rm(tmp, { force: true }).catch(() => undefined);
 		}
 		return;
 	}
 	const tmp = `${storePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
 	try {
-		await fs.promises.writeFile(tmp, json, {
+		await syncFs.promises.writeFile(tmp, json, {
 			mode: 384,
 			encoding: "utf-8"
 		});
-		await fs.promises.rename(tmp, storePath);
-		await fs.promises.chmod(storePath, 384);
+		await syncFs.promises.rename(tmp, storePath);
+		await syncFs.promises.chmod(storePath, 384);
 	} catch (err) {
 		const code = err && typeof err === "object" && "code" in err ? String(err.code) : null;
 		if (code === "ENOENT") {
 			try {
-				await fs.promises.mkdir(path.dirname(storePath), { recursive: true });
-				await fs.promises.writeFile(storePath, json, {
+				await syncFs.promises.mkdir(path.dirname(storePath), { recursive: true });
+				await syncFs.promises.writeFile(storePath, json, {
 					mode: 384,
 					encoding: "utf-8"
 				});
-				await fs.promises.chmod(storePath, 384);
+				await syncFs.promises.chmod(storePath, 384);
 			} catch (err2) {
 				const code2 = err2 && typeof err2 === "object" && "code" in err2 ? String(err2.code) : null;
 				if (code2 === "ENOENT") {
@@ -620,7 +620,7 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
 		}
 		throw err;
 	} finally {
-		await fs.promises.rm(tmp, { force: true });
+		await syncFs.promises.rm(tmp, { force: true });
 	}
 }
 async function saveSessionStore(storePath, store, opts) {