@fased/fased 0.1.61 → 0.1.64

package/dist/cli/program/register.onboard.js

@@ -60,11 +60,11 @@ const AUTH_CHOICE_HELP = formatAuthChoiceChoicesForCli({
 });
 function registerOnboardCommand(program) {
 	const providerAuthFlags = resolveOnboardProviderAuthFlags();
-	const command = program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.fased.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.fased/workspace)").option("--reset", "Repair auth/session state before running wizard").option("--reset-scope <scope>", "Repair scope: sessions|auth|auth+sessions").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--host-profile <profile>", "Host security profile: local|hosting").option("--host-security-capable", "Internal: host security was prepared by a root-started installer session").option("--host-maintenance-session", "Internal: post-bootstrap hosted rerun from the app user over Tailscale").option("--ts-authkey <key>", "Tailscale auth key for hosting setup").option("--allow-insecure", "Allow continuing when hosting security setup fails").option("--swap-gb <n>", "Override automatic swap size in GB for hosting setup").option("--auth-choice <choice>", `Auth: ${AUTH_CHOICE_HELP}`).option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID");
+	const command = program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.fased.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.fased/workspace)").option("--reset", "Repair auth/session state before running wizard").option("--reset-scope <scope>", "Repair scope: sessions|auth|auth+sessions").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--host-profile <profile>", "Host security profile: local|hosting").option("--host-security-capable", "Internal: host security was prepared by a root-started installer session").option("--host-maintenance-session", "Internal: post-bootstrap hosted rerun from the app user over Tailscale").option("--allow-insecure", "Allow continuing when hosting security setup fails").option("--swap-gb <n>", "Override automatic swap size in GB for hosting setup").option("--auth-choice <choice>", `Auth: ${AUTH_CHOICE_HELP}`).option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID");
 	for (const providerFlag of providerAuthFlags) {
 		command.option(providerFlag.cliOption, providerFlag.description);
 	}
-	command.option("--custom-base-url <url>", "Custom provider base URL").option("--custom-api-key <key>", "Custom provider API key (optional)").option("--custom-model-id <id>", "Custom provider model ID").option("--custom-provider-id <id>", "Custom provider ID (optional; auto-derived by default)").option("--custom-compatibility <mode>", "Custom provider API compatibility: openai|anthropic (default: openai)").option("--allow-private-network", "Allow a custom local/private model provider endpoint in non-interactive onboarding").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--wallet-enabled", "Enable wallet integration").option("--wallet-disabled", "Disable wallet integration").option("--wallet-mode <mode>", "Wallet mode: managed|external").option("--wallet-runtime <runtime>", "Wallet runtime: external-docker|external-custom").option("--wallet-providers <ids>", "Enabled wallet providers CSV (embedded-keystore,local-socket-signer,alchemy,turnkey,privy)").option("--wallet-default-provider <id>", "Default wallet provider id (embedded-keystore|local-socket-signer|alchemy|turnkey|privy)").option("--wallet-chains <chains>", "Wallet chains CSV (solana)").option("--wallet-host <host>", "External self-hosted signer host (advanced/deprecated)").option("--wallet-port <port>", "External self-hosted signer port (advanced/deprecated)").option("--wallet-install-enabled", "Enable wallet runtime auto-install").option("--wallet-install-disabled", "Disable wallet runtime auto-install").option("--wallet-install-version <version>", "Legacy self-host signer runtime version").option("--wallet-direct-signing", "Enable automated wallet execution for approved Agent tools").option("--wallet-no-direct-signing", "Disable automated wallet execution for approved Agent tools").option("--wallet-solana-allow-programs <programs>", "CSV allowlist of Solana programs").option("--wallet-solana-max-per-tx <amount>", "Solana per-transaction cap (lamports)").option("--wallet-solana-max-daily <amount>", "Solana daily cap (lamports)").option("--wallet-tool-access-mode <mode>", "Wallet tool access: owner-only|allowlist|all").option("--wallet-tool-access-allow-agents <agents>", "CSV allowlist agent IDs for wallet tool").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--fast-health", "Use fast health mode (skip long probe waits and non-critical startup gating)", true).option("--no-fast-health", "Disable fast health mode").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false);
+	command.option("--custom-base-url <url>", "Custom provider base URL").option("--custom-api-key <key>", "Custom provider API key (optional)").option("--custom-model-id <id>", "Custom provider model ID").option("--custom-provider-id <id>", "Custom provider ID (optional; auto-derived by default)").option("--custom-compatibility <mode>", "Custom provider API compatibility: openai|anthropic (default: openai)").option("--allow-private-network", "Allow a custom local/private model provider endpoint in non-interactive onboarding").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--wallet-enabled", "Enable wallet integration").option("--wallet-disabled", "Disable wallet integration").option("--wallet-mode <mode>", "Wallet mode: managed|external").option("--wallet-runtime <runtime>", "Wallet runtime: external-docker|external-custom").option("--wallet-providers <ids>", "Enabled wallet providers CSV (local-socket-signer,alchemy,turnkey,wallet-standard)").option("--wallet-default-provider <id>", "Default wallet provider id (local-socket-signer|alchemy|turnkey|wallet-standard)").option("--wallet-chains <chains>", "Wallet chains CSV (solana)").option("--wallet-host <host>", "External self-hosted signer host (advanced/deprecated)").option("--wallet-port <port>", "External self-hosted signer port (advanced/deprecated)").option("--wallet-install-enabled", "Enable wallet runtime auto-install").option("--wallet-install-disabled", "Disable wallet runtime auto-install").option("--wallet-install-version <version>", "Legacy self-host signer runtime version").option("--wallet-direct-signing", "Enable automated wallet execution for approved Agent tools").option("--wallet-no-direct-signing", "Disable automated wallet execution for approved Agent tools").option("--wallet-solana-allow-programs <programs>", "CSV allowlist of Solana programs").option("--wallet-solana-max-per-tx <amount>", "Solana per-transaction cap (lamports)").option("--wallet-solana-max-daily <amount>", "Solana daily cap (lamports)").option("--wallet-tool-access-mode <mode>", "Wallet tool access: owner-only|allowlist|all").option("--wallet-tool-access-allow-agents <agents>", "CSV allowlist agent IDs for wallet tool").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--fast-health", "Use fast health mode (skip long probe waits and non-critical startup gating)", true).option("--no-fast-health", "Disable fast health mode").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false);
 	command.action(async (opts, commandRuntime) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			const installDaemon = resolveInstallDaemonFlag(commandRuntime, { installDaemon: Boolean(opts.installDaemon) });
@@ -87,7 +87,6 @@ function registerOnboardCommand(program) {
 				hostProfile: opts.hostProfile,
 				hostSecurityCapable: Boolean(opts.hostSecurityCapable),
 				hostMaintenanceSession: Boolean(opts.hostMaintenanceSession),
-				tsAuthkey: opts.tsAuthkey,
 				allowInsecure: Boolean(opts.allowInsecure),
 				swapGb: typeof swapGbRaw === "number" && Number.isFinite(swapGbRaw) ? swapGbRaw : undefined,
 				workspace: opts.workspace,

package/dist/cli/program/register.wallet.js

@@ -1,6 +1,6 @@
 import { defaultRuntime } from "../../runtime.js";
 import { runCommandWithRuntime } from "../cli-utils.js";
-import { walletCanaryCommand, walletCustodyInitCommand, walletCustodyLockCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletKeystoreExportCommand, walletKeystoreImportCommand, walletKeystoreInitCommand, walletKeystorePassphraseInitCommand, walletKeystorePassphraseRotateCommand, walletKeystoreStatusCommand, walletKeystoreValidateCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerBrokerCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand } from "../../commands/wallet.js";
+import { walletCanaryCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletLegacyMigrationFinalizeCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand } from "../../commands/wallet.js";
 
 //#region src/cli/program/register.wallet.ts
 function resolvePublicWalletSetupChain(raw) {
@@ -14,10 +14,10 @@ function resolvePublicWalletSetupChain(raw) {
 	throw new Error("Wallet setup is Solana-only. Use --chain solana.");
 }
 function registerWalletCommands(program) {
-	const wallet = program.command("wallet").description("Wallet providers, keystore, custody, and policy status").action(() => {
+	const wallet = program.command("wallet").description("Wallet providers, native signer, and policy status").action(() => {
 		wallet.help({ error: true });
 	});
-	wallet.command("setup").description("Guided Solana wallet setup (create/import local signer wallet)").option("--mode <mode>", "embedded-create|embedded-import|local-signer|turnkey (embedded alias allowed)").option("--chain <chain>", "solana", "solana").option("--wallet-id <id>", "Named wallet id (examples: agent, mining, vault)").option("--wallet-name <value>", "Friendly wallet display name (for UI/skills/plugins)").option("--role <role>", "agent|vault. SAT mining is attached separately.").option("--private-key <value>", "Private key for import mode (prefer env)").option("--api-key <value>", "Hosted wallet provider API key (alchemy/privy mode)").option("--rpc-url <url>", "RPC URL hint for embedded create/import").option("--show-private-key-once", "For embedded-create: print generated private key once", false).option("--confirm-private-key-print <text>", "Required with --show-private-key-once; type \"SHOW PRIVATE KEY\"").option("--turnkey-api-public-key <value>", "Turnkey API public key (turnkey mode)").option("--turnkey-api-private-key <value>", "Turnkey API private key (turnkey mode)").option("--turnkey-organization-id <value>", "Turnkey organization ID (turnkey mode)").option("--turnkey-base-url <value>", "Turnkey base URL override (turnkey mode)").option("--enable-limit-orders", "Store Jupiter API key config for policy-gated wallet actions", false).option("--disable-limit-orders", "Remove stored Jupiter wallet-action config", false).option("--jupiter-api-key <value>", "Jupiter API key for policy-gated wallet actions").option("--jupiter-trigger-api-base-url <url>", "Advanced: Jupiter Trigger API base URL override").option("--non-interactive", "Do not prompt; require mode/inputs", false).option("--no-doctor", "Skip signer doctor in local-signer mode", false).option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("setup").description("Create a signer-owned Solana wallet or configure a supported provider").option("--mode <mode>", "local-signer-create|local-signer-import|local-signer|turnkey|alchemy").option("--chain <chain>", "solana", "solana").option("--wallet-id <id>", "Named wallet id (examples: agent, mining, vault)").option("--wallet-name <value>", "Friendly wallet display name (for UI/skills/plugins)").option("--role <role>", "Permanent signer role: agent|mining|vault").option("--api-key <value>", "Alchemy API key").option("--rpc-url <url>", "Solana RPC URL").option("--turnkey-api-public-key <value>", "Turnkey API public key (turnkey mode)").option("--turnkey-api-private-key <value>", "Turnkey API private key (turnkey mode)").option("--turnkey-organization-id <value>", "Turnkey organization ID (turnkey mode)").option("--turnkey-policy-id <value>", "Turnkey policy ID (turnkey mode)").option("--turnkey-base-url <value>", "Turnkey base URL override (turnkey mode)").option("--enable-limit-orders", "Legacy alias: configure Gateway Jupiter Swap API access (Trigger is signer-owned)", false).option("--disable-limit-orders", "Remove stored Gateway Jupiter Swap API key", false).option("--jupiter-api-key <value>", "Jupiter API key for Gateway swap crafting only").option("--non-interactive", "Do not prompt; require mode/inputs", false).option("--no-doctor", "Skip signer doctor in local-signer mode", false).option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletSetupCommand(defaultRuntime, {
 				mode: typeof opts.mode === "string" ? opts.mode : undefined,
@@ -25,32 +25,28 @@ function registerWalletCommands(program) {
 				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
 				walletName: typeof opts.walletName === "string" ? opts.walletName : undefined,
 				role: typeof opts.role === "string" ? opts.role : undefined,
-				privateKey: typeof opts.privateKey === "string" ? opts.privateKey : undefined,
 				apiKey: typeof opts.apiKey === "string" ? opts.apiKey : undefined,
 				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
-				showPrivateKeyOnce: Boolean(opts.showPrivateKeyOnce),
-				confirmPrivateKeyPrint: typeof opts.confirmPrivateKeyPrint === "string" ? opts.confirmPrivateKeyPrint : undefined,
 				turnkeyApiPublicKey: typeof opts.turnkeyApiPublicKey === "string" ? opts.turnkeyApiPublicKey : undefined,
 				turnkeyApiPrivateKey: typeof opts.turnkeyApiPrivateKey === "string" ? opts.turnkeyApiPrivateKey : undefined,
 				turnkeyOrganizationId: typeof opts.turnkeyOrganizationId === "string" ? opts.turnkeyOrganizationId : undefined,
+				turnkeyPolicyId: typeof opts.turnkeyPolicyId === "string" ? opts.turnkeyPolicyId : undefined,
 				turnkeyBaseUrl: typeof opts.turnkeyBaseUrl === "string" ? opts.turnkeyBaseUrl : undefined,
 				enableLimitOrders: Boolean(opts.enableLimitOrders),
 				disableLimitOrders: Boolean(opts.disableLimitOrders),
 				jupiterApiKey: typeof opts.jupiterApiKey === "string" ? opts.jupiterApiKey : undefined,
-				jupiterTriggerApiBaseUrl: typeof opts.jupiterTriggerApiBaseUrl === "string" ? opts.jupiterTriggerApiBaseUrl : undefined,
 				nonInteractive: Boolean(opts.nonInteractive),
 				noDoctor: Boolean(opts.noDoctor),
 				json: Boolean(opts.json)
 			});
 		});
 	});
-	wallet.command("limit-orders").description("Configure Jupiter Trigger support for policy-gated Agent wallet actions").option("--enable", "Enable Jupiter wallet-action support and store API key config", false).option("--disable", "Remove stored Jupiter wallet-action config", false).option("--jupiter-api-key <value>", "Jupiter API key for policy-gated wallet actions").option("--jupiter-trigger-api-base-url <url>", "Advanced: Jupiter Trigger API base URL override").option("--non-interactive", "Do not prompt; require explicit inputs", false).option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("limit-orders").description("Configure Gateway Jupiter Swap API access; Trigger credentials remain signer-owned").option("--enable", "Store a Gateway Jupiter Swap API key", false).option("--disable", "Remove the stored Gateway Jupiter Swap API key", false).option("--jupiter-api-key <value>", "Jupiter API key for Gateway swap crafting only").option("--non-interactive", "Do not prompt; require explicit inputs", false).option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletLimitOrdersConfigureCommand(defaultRuntime, {
 				enable: Boolean(opts.enable),
 				disable: Boolean(opts.disable),
 				jupiterApiKey: typeof opts.jupiterApiKey === "string" ? opts.jupiterApiKey : undefined,
-				jupiterTriggerApiBaseUrl: typeof opts.jupiterTriggerApiBaseUrl === "string" ? opts.jupiterTriggerApiBaseUrl : undefined,
 				nonInteractive: Boolean(opts.nonInteractive),
 				json: Boolean(opts.json)
 			});
@@ -61,42 +57,17 @@ function registerWalletCommands(program) {
 			await walletStatusCommand(defaultRuntime, { json: Boolean(opts.json) });
 		});
 	});
-	wallet.command("rotate-keys").description("Rotate local wallet keys (provider-specific; deprecated command name)").option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("rotate-keys").description("Removed Gateway key rotation; prints native/provider authority guidance").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletRotateKeysCommand(defaultRuntime, { json: Boolean(opts.json) });
 		});
 	});
-	const keystore = wallet.command("keystore").description("Manage encrypted local Solana keystore wallets");
-	keystore.command("init").description("Create a new encrypted keystore and set provider=embedded-keystore").option("--chain <chain>", "Key type: solana", "solana").option("--wallet-id <id>", "Named wallet id (agent, mining, vault, ...)").option("--out <path>", "Output keystore path (default: <state>/wallet/keystore.v1.enc)").option("--passphrase <value>", "Keystore passphrase (prefer env/file in shell history-safe use)").option("--rpc-url <url>", "Optional RPC URL hint (still typically set via env)").option("--show-private-key-once", "Print generated private key once (dangerous)", false).option("--confirm-private-key-print <text>", "Required with --show-private-key-once; type \"SHOW PRIVATE KEY\"").option("--name <value>", "Named wallet label for UI").option("--role <role>", "agent|vault. SAT mining is attached separately.").option("--force", "Overwrite existing keystore", false).option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("finalize-legacy-migration").description("Verify a completed native signer import and retire legacy config/registry references").requiredOption("--wallet-id <id>", "Legacy wallet id imported into fased-signerd").option("--wallet-name <name>", "Name when the legacy registry row is missing").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreInitCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				chain: resolvePublicWalletSetupChain(opts.chain) ?? "solana",
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				passphrase: typeof opts.passphrase === "string" ? opts.passphrase : undefined,
-				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
-				showPrivateKeyOnce: Boolean(opts.showPrivateKeyOnce),
-				confirmPrivateKeyPrint: typeof opts.confirmPrivateKeyPrint === "string" ? opts.confirmPrivateKeyPrint : undefined,
-				name: typeof opts.name === "string" ? opts.name : undefined,
-				role: typeof opts.role === "string" ? opts.role : undefined,
-				force: Boolean(opts.force)
-			});
-		});
-	});
-	keystore.command("import").description("Import a raw Solana private key into an encrypted keystore and set provider").option("--chain <chain>", "Key type: solana", "solana").option("--wallet-id <id>", "Named wallet id (agent, mining, vault, ...)").option("--private-key <value>", "Solana private key (prefer env FASED_WALLET_PRIVATE_KEY)").option("--out <path>", "Output keystore path (default: <state>/wallet/keystore.v1.enc)").option("--passphrase <value>", "Keystore passphrase (prefer env/file in shell history-safe use)").option("--rpc-url <url>", "Optional RPC URL hint (still typically set via env)").option("--name <value>", "Named wallet label for UI").option("--role <role>", "agent|vault. SAT mining is attached separately.").option("--force", "Overwrite existing keystore", false).option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreImportCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				passphrase: typeof opts.passphrase === "string" ? opts.passphrase : undefined,
-				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
-				privateKey: typeof opts.privateKey === "string" ? opts.privateKey : undefined,
-				chain: resolvePublicWalletSetupChain(opts.chain) ?? "solana",
-				name: typeof opts.name === "string" ? opts.name : undefined,
-				role: typeof opts.role === "string" ? opts.role : undefined,
-				force: Boolean(opts.force)
+			await walletLegacyMigrationFinalizeCommand(defaultRuntime, {
+				walletId: String(opts.walletId),
+				walletName: typeof opts.walletName === "string" ? opts.walletName : undefined,
+				json: Boolean(opts.json)
 			});
 		});
 	});
@@ -110,59 +81,11 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	keystore.command("passphrase-init").description("Generate keystore passphrase file (0600) and print env export hint").option("--out <path>", "Passphrase file path (default: <state>/wallet/passphrase)").option("--length <bytes>", "Random bytes length", (v) => Number.parseInt(v, 10)).option("--force", "Overwrite existing file", false).option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystorePassphraseInitCommand(defaultRuntime, {
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				length: typeof opts.length === "number" && Number.isFinite(opts.length) ? opts.length : undefined,
-				force: Boolean(opts.force),
-				json: Boolean(opts.json)
-			});
-		});
-	});
-	keystore.command("rotate-passphrase").description("Re-encrypt embedded keystore with a new passphrase and update passphrase file").option("--file <path>", "Passphrase file path (default: env or <state>/wallet/passphrase)").option("--old-passphrase <value>", "Old passphrase (avoid shell history; prefer file/env)").option("--new-passphrase <value>", "New passphrase (omit to auto-generate)").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystorePassphraseRotateCommand(defaultRuntime, {
-				file: typeof opts.file === "string" ? opts.file : undefined,
-				oldPassphrase: typeof opts.oldPassphrase === "string" ? opts.oldPassphrase : undefined,
-				newPassphrase: typeof opts.newPassphrase === "string" ? opts.newPassphrase : undefined,
-				json: Boolean(opts.json)
-			});
-		});
-	});
-	keystore.command("export").description("Export encrypted keystore backup (dangerous if printing)").option("--out <path>", "Write backup copy to path").option("--include-secret", "Include encrypted keystore content in JSON output", false).option("--confirm-include-secret <text>", "Required with --include-secret; type \"EXPORT KEYSTORE\"").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreExportCommand(defaultRuntime, {
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				includeSecret: Boolean(opts.includeSecret),
-				confirmIncludeSecret: typeof opts.confirmIncludeSecret === "string" ? opts.confirmIncludeSecret : undefined,
-				json: Boolean(opts.json)
-			});
-		});
-	});
-	keystore.command("status").description("Show embedded keystore presence/unlock status").option("--chain <chain>", "Target chain: solana", "solana").option("--wallet-id <id>", "Named wallet id (uses chain-specific signer env fallback paths)").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreStatusCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				chain: resolvePublicWalletSetupChain(opts.chain) ?? "solana"
-			});
-		});
-	});
-	keystore.command("validate").description("Validate embedded keystore unlock + RPC connectivity + chain + balance").option("--chain <chain>", "Keystore chain override: solana").option("--wallet-id <id>", "Named wallet id (agent, mining, vault, ...)").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreValidateCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				chain: resolvePublicWalletSetupChain(opts.chain)
-			});
-		});
-	});
 	const provider = wallet.command("provider").description("Configure hosted wallet provider credentials (stored encrypted locally)");
 	provider.command("configure <providerId>").description("Configure hosted provider credentials and set wallet.provider.id").option("--set <key=value>", "Credential field (repeatable)", (v, acc) => [...acc, v], []).option("--rpc-url <url>", "Optional RPC URL hint to store with provider credentials").option("--json", "Print JSON output", false).action(async (providerArg, opts) => {
-		const providerId = providerArg === "turnkey" || providerArg === "privy" || providerArg === "alchemy" ? providerArg : null;
+		const providerId = providerArg === "turnkey" || providerArg === "alchemy" ? providerArg : null;
 		if (!providerId) {
-			throw new Error("provider must be one of: turnkey, privy, alchemy");
+			throw new Error("provider must be one of: turnkey, alchemy; Privy is unavailable");
 		}
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletProviderConfigureCommand(defaultRuntime, {
@@ -198,17 +121,6 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	signer.command("broker").description("Run the app-facing local signer broker daemon").option("--socket <path>", "App-facing Unix socket path").option("--backend-socket <path>", "Private backend signer socket path").option("--read-only", "Read-only mode", false).option("--pid-file <path>", "PID file path").option("--audit-log <path>", "Audit log path").action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletSignerBrokerCommand(defaultRuntime, {
-				socketPath: typeof opts.socket === "string" ? opts.socket : undefined,
-				backendSocketPath: typeof opts.backendSocket === "string" ? opts.backendSocket : undefined,
-				readOnly: Boolean(opts.readOnly),
-				pidFile: typeof opts.pidFile === "string" ? opts.pidFile : undefined,
-				auditLog: typeof opts.auditLog === "string" ? opts.auditLog : undefined
-			});
-		});
-	});
 	signer.command("doctor").description("Validate native/local signer socket, pid, audit log, rpc, and keystore readiness").option("--socket <path>", "Unix socket path").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletSignerDoctorCommand(defaultRuntime, {
@@ -217,25 +129,6 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	wallet.command("custody-init").description("Initialize split-key custody ceremony (device/hot/cold share state)").option("--json", "Print JSON output", false).option("--force", "Overwrite existing custody ceremony state", false).option("--wallet <walletId>", "Target wallet id for per-wallet custody state").option("--device-share <base64>", "Optional pre-generated device share (base64/base64url, 32 bytes)").action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletCustodyInitCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				force: Boolean(opts.force),
-				walletId: typeof opts.wallet === "string" ? opts.wallet : undefined,
-				deviceShare: typeof opts.deviceShare === "string" ? opts.deviceShare : undefined
-			});
-		});
-	});
-	wallet.command("custody-lock").description("Immediately end active custody unlock sessions (clears ephemeral signing material)").option("--host <host>", "Only lock unlock sessions for this host").option("--wallet <walletId>", "Only lock unlock sessions for this wallet").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletCustodyLockCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				host: typeof opts.host === "string" ? opts.host : undefined,
-				walletId: typeof opts.wallet === "string" ? opts.wallet : undefined
-			});
-		});
-	});
 	wallet.command("migrate").description("Migrate wallet runtime source").requiredOption("--from <runtime>", "Current runtime: external-docker|external-custom").requiredOption("--to <runtime>", "Target runtime: external-docker|external-custom").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletMigrateCommand(defaultRuntime, {
@@ -245,7 +138,7 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	wallet.command("canary").description("Run real-chain canary checks (and optional recovery drill)").option("--json", "Print JSON output", false).option("--no-require-real-chain", "Allow non-real-chain readiness failures in checks").option("--execute-provider-e2e", "Run provider-level E2E checks (create/address/balance/reject/audit; send when enabled)", false).option("--execute-live-send", "Allow real on-chain send execution in provider E2E (requires canary target env vars)", false).option("--providers <ids>", "Comma-separated provider ids (embedded-keystore,alchemy,turnkey,privy)").option("--execute-recovery-drill", "Run stack down/up recovery drill (external-docker runtime only)", false).action(async (opts) => {
+	wallet.command("canary").description("Run real-chain canary checks (and optional recovery drill)").option("--json", "Print JSON output", false).option("--no-require-real-chain", "Allow non-real-chain readiness failures in checks").option("--execute-provider-e2e", "Run provider-level E2E checks (create/address/balance/reject/audit; send when enabled)", false).option("--execute-live-send", "Allow real on-chain send execution in provider E2E (requires canary target env vars)", false).option("--providers <ids>", "Comma-separated provider ids (alchemy,turnkey)").option("--execute-recovery-drill", "Run stack down/up recovery drill (external-docker runtime only)", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletCanaryCommand(defaultRuntime, {
 				json: Boolean(opts.json),
@@ -258,7 +151,7 @@ function registerWalletCommands(program) {
 		});
 	});
 	const inbound = wallet.command("inbound").description("Inbound receive/deposit monitoring");
-	inbound.command("poll").description("Poll balances and detect inbound/outbound delta events").option("--provider <id>", "Provider id (embedded-keystore|alchemy|turnkey|privy)").option("--wallet-id <id>", "Named wallet id scope").option("--wallet-name <name>", "Named wallet name scope").option("--chain <chain>", "solana|all", "all").option("--json", "Print JSON output", false).action(async (opts) => {
+	inbound.command("poll").description("Poll balances and detect inbound/outbound delta events").option("--provider <id>", "Provider id (local-socket-signer|alchemy|turnkey|wallet-standard)").option("--wallet-id <id>", "Named wallet id scope").option("--wallet-name <name>", "Named wallet name scope").option("--chain <chain>", "solana|all", "all").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletInboundPollCommand(defaultRuntime, {
 				json: Boolean(opts.json),
@@ -269,7 +162,7 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	inbound.command("list").description("List inbound/deposit events from local wallet ledger").option("--provider <id>", "Provider id (embedded-keystore|alchemy|turnkey|privy)").option("--wallet-id <id>", "Named wallet id filter").option("--chain <chain>", "solana").option("--status <status>", "all|detected|confirmed|reconciled|ignored", "all").option("--limit <count>", "Result limit", "100").option("--json", "Print JSON output", false).action(async (opts) => {
+	inbound.command("list").description("List inbound/deposit events from local wallet ledger").option("--provider <id>", "Provider id (local-socket-signer|alchemy|turnkey|wallet-standard)").option("--wallet-id <id>", "Named wallet id filter").option("--chain <chain>", "solana").option("--status <status>", "all|detected|confirmed|reconciled|ignored", "all").option("--limit <count>", "Result limit", "100").option("--json", "Print JSON output", false).action(async (opts) => {
 		const limit = typeof opts.limit === "string" && opts.limit.trim() ? Number.parseInt(opts.limit, 10) : undefined;
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletInboundListCommand(defaultRuntime, {

package/dist/cli/providers-cli.js

@@ -1,11 +1,11 @@
 import { theme } from "../terminal/theme.js";
 import { defaultRuntime } from "../runtime.js";
 import { listAgentIds, resolveAgentDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
-import { getProviderBrandManifestForRoute } from "../providers/registry.js";
 import { ensureAuthProfileStore, loadAuthProfileStoreForRuntime } from "../agents/auth-profiles/store.js";
 import { loadConfig, writeConfigFile } from "../config/io.js";
 import "../config/config.js";
 import "../agents/auth-profiles.js";
+import { getProviderBrandManifestForRoute } from "../providers/registry.js";
 import { ensureFasedModelsJson } from "../agents/models-config.js";
 import { applyProviderRefreshToRegistrySource, buildProviderCapabilityOverridesSource, buildProviderRefreshEnvFromCredentials, buildProviderRefreshReport, buildProviderRegistryReviewPatch, fetchOfficialProviderRefreshSnapshot, loadProviderRefreshSnapshotFromFile } from "../providers/refresh.js";
 import { buildAuthChoiceGroups } from "../commands/auth-choice-options.js";

package/dist/cli/sat-cli.js

@@ -1,12 +1,16 @@
+import { resolveStateDir } from "../config/paths.js";
 import { theme } from "../terminal/theme.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatCliCommand } from "./command-format.js";
+import { withFileLock } from "../plugin-sdk/file-lock.js";
+import { serializeWalletState, writeWalletStateFileAtomically } from "../wallet/wallet-atomic-state.js";
 import { runCommandWithRuntime } from "./cli-utils.js";
 import { formatHelpExamples } from "./help-format.js";
 import { addGatewayClientOptions, callGatewayFromCli } from "./gateway-rpc.js";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { appendFile, mkdir, open, readFile, rm, stat } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
 
 //#region src/cli/sat-cli.ts
@@ -14,6 +18,18 @@ const LAMPORTS_PER_SOL = 1000000000n;
 const DEFAULT_MAINTAIN_INTERVAL_SECONDS = 300;
 const DEFAULT_MAINTAIN_JITTER_SECONDS = 30;
 const DEFAULT_STALE_LOCK_SECONDS = 900;
+const SAT_MAINTENANCE_IDEMPOTENCY_VERSION = 1;
+const SAT_MAINTENANCE_IDEMPOTENCY_LIMIT = 64;
+const SAT_MAINTENANCE_IDEMPOTENCY_LOCK_OPTIONS = {
+	retries: {
+		retries: 120,
+		factor: 1.15,
+		minTimeout: 10,
+		maxTimeout: 100,
+		randomize: true
+	},
+	stale: 12e4
+};
 function runSatCommand(action, label) {
 	return runCommandWithRuntime(defaultRuntime, action, (err) => {
 		const message = err instanceof Error ? err.message : String(err);
@@ -113,6 +129,107 @@ function parseOptionalPositiveInteger(raw, label) {
 	}
 	return value;
 }
+function normalizeMaintenanceIdempotencyKey(raw) {
+	const value = raw.trim();
+	if (!value || value.length > 160 || /[^\x20-\x7e]/u.test(value)) {
+		throw new Error("--idempotency-key must contain 1-160 printable characters");
+	}
+	return value;
+}
+function maintenanceParamsDigest(params) {
+	const canonical = Object.fromEntries(Object.entries(params).toSorted(([left], [right]) => left.localeCompare(right)));
+	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+function maintenanceIdempotencyPath() {
+	return join(resolveStateDir(process.env), "sat-mining", "maintenance-cli-idempotency.json");
+}
+async function readMaintenanceIdempotencyFile(filePath) {
+	try {
+		const parsed = JSON.parse(await readFile(filePath, "utf8"));
+		if (parsed.version !== SAT_MAINTENANCE_IDEMPOTENCY_VERSION || !parsed.pending || typeof parsed.pending !== "object" || Array.isArray(parsed.pending)) {
+			throw new Error(`invalid SAT maintenance idempotency state at ${filePath}`);
+		}
+		const pending = {};
+		for (const [digest, value] of Object.entries(parsed.pending)) {
+			if (!/^[0-9a-f]{64}$/u.test(digest) || !value || typeof value.idempotencyKey !== "string" || value.paramsDigest !== digest || typeof value.createdAt !== "string") {
+				throw new Error(`invalid SAT maintenance idempotency record ${digest}`);
+			}
+			pending[digest] = {
+				idempotencyKey: normalizeMaintenanceIdempotencyKey(value.idempotencyKey),
+				paramsDigest: digest,
+				createdAt: value.createdAt
+			};
+		}
+		return {
+			version: SAT_MAINTENANCE_IDEMPOTENCY_VERSION,
+			pending
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") {
+			return {
+				version: SAT_MAINTENANCE_IDEMPOTENCY_VERSION,
+				pending: {}
+			};
+		}
+		throw error;
+	}
+}
+function trimMaintenanceIdempotencyEntries(pending) {
+	return Object.fromEntries(Object.entries(pending).toSorted(([, left], [, right]) => left.createdAt.localeCompare(right.createdAt)).slice(-SAT_MAINTENANCE_IDEMPOTENCY_LIMIT));
+}
+async function claimMaintenanceIdempotency(params, explicitKey) {
+	const paramsDigest = maintenanceParamsDigest(params);
+	if (explicitKey?.trim()) {
+		return {
+			idempotencyKey: normalizeMaintenanceIdempotencyKey(explicitKey),
+			paramsDigest,
+			managed: false
+		};
+	}
+	const filePath = maintenanceIdempotencyPath();
+	return await withFileLock(filePath, SAT_MAINTENANCE_IDEMPOTENCY_LOCK_OPTIONS, async () => {
+		const state = await readMaintenanceIdempotencyFile(filePath);
+		const existing = state.pending[paramsDigest];
+		if (existing) {
+			return {
+				...existing,
+				managed: true
+			};
+		}
+		const pending = {
+			idempotencyKey: `sat-maintain-${randomUUID()}`,
+			paramsDigest,
+			createdAt: new Date().toISOString()
+		};
+		state.pending[paramsDigest] = pending;
+		await mkdir(dirname(filePath), {
+			recursive: true,
+			mode: 448
+		});
+		writeWalletStateFileAtomically(filePath, serializeWalletState({
+			version: SAT_MAINTENANCE_IDEMPOTENCY_VERSION,
+			pending: trimMaintenanceIdempotencyEntries(state.pending)
+		}));
+		return {
+			...pending,
+			managed: true
+		};
+	});
+}
+async function completeMaintenanceIdempotency(claim) {
+	if (!claim.managed) {
+		return;
+	}
+	const filePath = maintenanceIdempotencyPath();
+	await withFileLock(filePath, SAT_MAINTENANCE_IDEMPOTENCY_LOCK_OPTIONS, async () => {
+		const state = await readMaintenanceIdempotencyFile(filePath);
+		if (state.pending[claim.paramsDigest]?.idempotencyKey !== claim.idempotencyKey) {
+			return;
+		}
+		delete state.pending[claim.paramsDigest];
+		writeWalletStateFileAtomically(filePath, serializeWalletState(state));
+	});
+}
 function renderSatResult(result, opts, successText) {
 	if (opts.json || successText === undefined) {
 		defaultRuntime.log(JSON.stringify(result, null, 2));
@@ -260,7 +377,14 @@ async function withMaintenanceLock(opts, action) {
 	}
 }
 async function callMaintenancePass(opts) {
-	return callGatewayFromCli("sat.runProtocolMaintenanceOnce", opts, buildMaintenanceParams(opts));
+	const params = buildMaintenanceParams(opts);
+	const claim = await claimMaintenanceIdempotency(params, opts.idempotencyKey);
+	const result = await callGatewayFromCli("sat.runProtocolMaintenanceOnce", opts, {
+		...params,
+		idempotencyKey: claim.idempotencyKey
+	});
+	await completeMaintenanceIdempotency(claim);
+	return result;
 }
 function summarizeMaintenanceResult(result) {
 	if (!result || typeof result !== "object") {
@@ -291,6 +415,9 @@ function maintenanceDelayMs(intervalSeconds, jitterSeconds) {
 	return baseMs + Math.floor(Math.random() * (jitterSeconds * 1e3 + 1));
 }
 async function runMaintenanceLoop(opts) {
+	if (opts.idempotencyKey?.trim()) {
+		throw new Error("--idempotency-key is for one maintenance pass; loop mode manages a durable key per pass");
+	}
 	const intervalSeconds = parseNonNegativeIntegerNumber(opts.intervalSeconds, "--interval-seconds", DEFAULT_MAINTAIN_INTERVAL_SECONDS);
 	const jitterSeconds = parseNonNegativeIntegerNumber(opts.jitterSeconds, "--jitter-seconds", DEFAULT_MAINTAIN_JITTER_SECONDS);
 	const maxIterations = parseOptionalPositiveInteger(opts.maxIterations, "--max-iterations");
@@ -351,7 +478,7 @@ function registerSatCli(program) {
 			renderSatMainnetSyncResult(result, opts);
 		}, "SAT mainnet sync failed");
 	});
-	addGatewayClientOptions(sat.command("maintain").description("Run one safe SAT protocol maintenance pass: reserve refill, fixed-recipient protocol claims, and bounded cleanup").option("--target-reserve-sol <amount>", "Reserve target in SOL").option("--target-reserve-lamports <amount>", "Reserve target in lamports").option("--min-sol <amount>", "Minimum pending SOL lane to submit").option("--min-sol-lamports <amount>", "Minimum pending SOL lane in lamports").option("--min-sat-raw <amount>", "Minimum pending SAT raw units to submit").option("--loop", "Run continuously with interval, jitter, and a local lock", false).option("--interval-seconds <seconds>", "Loop interval before jitter", `${DEFAULT_MAINTAIN_INTERVAL_SECONDS}`).option("--jitter-seconds <seconds>", "Random extra loop delay", `${DEFAULT_MAINTAIN_JITTER_SECONDS}`).option("--max-iterations <count>", "Stop after N loop passes; useful for tests and smoke runs").option("--cleanup-max-cycles <count>", "Maximum settled cycles to cleanup per maintenance pass").option("--cleanup-budget-ms <ms>", "Cleanup time budget per maintenance pass; remaining cleanup is deferred").option("--cleanup-max-transactions <count>", "Maximum cleanup transactions to submit per maintenance pass").option("--cleanup-batch-mode <mode>", "Cleanup batching mode: off or auto").option("--cleanup-max-batch-instructions <count>", "Maximum cleanup close instructions per batch transaction").option("--cleanup-scan-mode <mode>", "Cleanup discovery mode: recent, scan, or auto").option("--status-mode <mode>", "Response status mode: compact, ui, debug, or none").option("--log-file <path>", "Append JSONL audit records").option("--lock-file <path>", "Local lock file for the loop").option("--stale-lock-seconds <seconds>", "Remove a stale loop lock after this age", `${DEFAULT_STALE_LOCK_SECONDS}`).option("--json", "Output JSON", false)).action(async (opts) => {
+	addGatewayClientOptions(sat.command("maintain").description("Run one safe SAT protocol maintenance pass: reserve refill, fixed-recipient protocol claims, and bounded cleanup").option("--target-reserve-sol <amount>", "Reserve target in SOL").option("--target-reserve-lamports <amount>", "Reserve target in lamports").option("--min-sol <amount>", "Minimum pending SOL lane to submit").option("--min-sol-lamports <amount>", "Minimum pending SOL lane in lamports").option("--min-sat-raw <amount>", "Minimum pending SAT raw units to submit").option("--loop", "Run continuously with interval, jitter, and a local lock", false).option("--interval-seconds <seconds>", "Loop interval before jitter", `${DEFAULT_MAINTAIN_INTERVAL_SECONDS}`).option("--jitter-seconds <seconds>", "Random extra loop delay", `${DEFAULT_MAINTAIN_JITTER_SECONDS}`).option("--max-iterations <count>", "Stop after N loop passes; useful for tests and smoke runs").option("--cleanup-max-cycles <count>", "Maximum settled cycles to cleanup per maintenance pass").option("--cleanup-budget-ms <ms>", "Cleanup time budget per maintenance pass; remaining cleanup is deferred").option("--cleanup-max-transactions <count>", "Maximum cleanup transactions to submit per maintenance pass").option("--cleanup-batch-mode <mode>", "Cleanup batching mode: off or auto").option("--cleanup-max-batch-instructions <count>", "Maximum cleanup close instructions per batch transaction").option("--cleanup-scan-mode <mode>", "Cleanup discovery mode: recent, scan, or auto").option("--status-mode <mode>", "Response status mode: compact, ui, debug, or none").option("--idempotency-key <key>", "Retry key for one pass; reuse the same key after an ambiguous result").option("--log-file <path>", "Append JSONL audit records").option("--lock-file <path>", "Local lock file for the loop").option("--stale-lock-seconds <seconds>", "Remove a stale loop lock after this age", `${DEFAULT_STALE_LOCK_SECONDS}`).option("--json", "Output JSON", false)).action(async (opts) => {
 		await runSatCommand(async () => {
 			if (opts.loop) {
 				await runMaintenanceLoop(opts);

package/dist/cli/secrets-cli.js

@@ -7,12 +7,12 @@ import { isSecretsApplyPlan } from "../secrets/plan.js";
 import { runSecretsApply } from "../secrets/apply.js";
 import { resolveSecretsAuditExitCode, runSecretsAudit } from "../secrets/audit.js";
 import { runSecretsConfigureInteractive } from "../secrets/configure.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import { confirm } from "@clack/prompts";
 
 //#region src/cli/secrets-cli.ts
 function readPlanFile(pathname) {
-	const raw = fs.readFileSync(pathname, "utf8");
+	const raw = syncFs.readFileSync(pathname, "utf8");
 	const parsed = JSON.parse(raw);
 	if (!isSecretsApplyPlan(parsed)) {
 		throw new Error(`Invalid secrets plan file: ${pathname}`);
@@ -71,7 +71,7 @@ function registerSecretsCli(program) {
 				skipProviderSetup: Boolean(opts.skipProviderSetup)
 			});
 			if (opts.planOut) {
-				fs.writeFileSync(opts.planOut, `${JSON.stringify(configured.plan, null, 2)}\n`, "utf8");
+				syncFs.writeFileSync(opts.planOut, `${JSON.stringify(configured.plan, null, 2)}\n`, "utf8");
 			}
 			if (opts.json) {
 				defaultRuntime.log(JSON.stringify({