@fased/fased 0.1.61 → 0.1.64

package/dist/wallet/turnkey-reviewed-state.js

@@ -0,0 +1,370 @@
+import { withFileLock } from "../plugin-sdk/file-lock.js";
+import "../infra/file-lock.js";
+import { ensureWalletStateDir } from "./wallet-runtime-config.js";
+import { WalletProviderError } from "./wallet-provider-adapter.js";
+import { broadcastReviewedSolanaTransaction, buildReviewedSolanaTransaction, computeReviewedSolanaRequestDigest, reconcileReviewedSolanaTransaction, validateReviewedSolanaSignedTransaction } from "./solana-reviewed-transaction.js";
+import syncFs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+
+//#region src/wallet/turnkey-reviewed-state.ts
+const STATE_FILE_NAME = "turnkey-reviews.v1.json";
+const REVIEW_TTL_MS = 2 * 60 * 1e3;
+const STATE_FILE_MODE = 384;
+const MAX_REVIEW_RECORDS = 1e4;
+const MAX_RETAINED_TERMINAL_REVIEWS = 5e3;
+const TERMINAL_REVIEW_RETENTION_MS = 30 * 24 * 60 * 6e4;
+const REVIEW_LOCK_OPTIONS = {
+	retries: {
+		retries: 80,
+		factor: 1.15,
+		minTimeout: 20,
+		maxTimeout: 200,
+		randomize: true
+	},
+	stale: 3e4
+};
+let reviewStateLock = Promise.resolve();
+function statePath(env) {
+	return path.join(ensureWalletStateDir(env).rootDir, STATE_FILE_NAME);
+}
+function readFile(env) {
+	const filePath = statePath(env);
+	if (!syncFs.existsSync(filePath)) {
+		return {
+			version: 1,
+			reviews: []
+		};
+	}
+	try {
+		const parsed = JSON.parse(syncFs.readFileSync(filePath, "utf8"));
+		if (parsed.version === 1 && Array.isArray(parsed.reviews)) {
+			return parsed;
+		}
+	} catch {}
+	throw new WalletProviderError({
+		code: "wallet_provider_unavailable",
+		message: "Turnkey reviewed transaction state is invalid; repair it before signing",
+		retryable: false
+	});
+}
+function saveFile(file, env) {
+	const filePath = statePath(env);
+	const temporary = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	let descriptor;
+	try {
+		descriptor = syncFs.openSync(temporary, "wx", STATE_FILE_MODE);
+		syncFs.writeFileSync(descriptor, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+		syncFs.fsyncSync(descriptor);
+		syncFs.closeSync(descriptor);
+		descriptor = undefined;
+		syncFs.renameSync(temporary, filePath);
+		try {
+			syncFs.chmodSync(filePath, STATE_FILE_MODE);
+		} catch {}
+		try {
+			const directory = syncFs.openSync(path.dirname(filePath), "r");
+			try {
+				syncFs.fsyncSync(directory);
+			} finally {
+				syncFs.closeSync(directory);
+			}
+		} catch {}
+	} catch (error) {
+		if (descriptor !== undefined) {
+			syncFs.closeSync(descriptor);
+		}
+		try {
+			syncFs.unlinkSync(temporary);
+		} catch {}
+		throw error;
+	}
+}
+function secureEqual(left, right) {
+	const leftBytes = Buffer.from(left, "utf8");
+	const rightBytes = Buffer.from(right, "utf8");
+	return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function compactReviewState(file, nowMs = Date.now()) {
+	const terminal = file.reviews.filter((review) => review.status === "broadcast" || review.status === "failed").toSorted((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt));
+	const removable = new Set(terminal.filter((review, index) => nowMs - Date.parse(review.createdAt) > TERMINAL_REVIEW_RETENTION_MS || terminal.length - index > MAX_RETAINED_TERMINAL_REVIEWS).map((review) => review.preparedId));
+	return {
+		version: 1,
+		reviews: file.reviews.filter((review) => !removable.has(review.preparedId))
+	};
+}
+function requireReviewCapacity(file) {
+	if (file.reviews.length >= MAX_REVIEW_RECORDS) {
+		throw new WalletProviderError({
+			code: "wallet_provider_unavailable",
+			message: "Turnkey review state reached its durable safety limit; reconcile unresolved reviews",
+			retryable: false
+		});
+	}
+}
+function digest(value) {
+	return createHash("sha256").update(value, "utf8").digest("base64url");
+}
+function normalizedRpcUrlDigest(rpcUrl) {
+	let normalized;
+	try {
+		const parsed = new URL(rpcUrl.trim());
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+			throw new Error("unsupported protocol");
+		}
+		normalized = parsed.toString();
+	} catch {
+		throw new WalletProviderError({
+			code: "wallet_provider_invalid_config",
+			message: "Turnkey review requires a valid HTTP(S) Solana RPC URL"
+		});
+	}
+	return digest(normalized);
+}
+function preparedIdentity(params) {
+	return digest([
+		"fased-turnkey-reviewed-v1",
+		params.approvalRequestId,
+		params.requestDigest,
+		params.rpcUrlDigest,
+		params.authorizationContextDigest
+	].join("\0"));
+}
+function toPrepareResult(record) {
+	return {
+		preparedId: record.preparedId,
+		signer: record.signer,
+		unsignedTxBase64: record.unsignedTxBase64,
+		messageBase64: record.messageBase64,
+		intentDigest: record.intentDigest,
+		expiresAt: record.expiresAt,
+		recentBlockhash: record.recentBlockhash,
+		lastValidBlockHeight: record.lastValidBlockHeight,
+		simulation: {
+			ok: true,
+			...typeof record.simulationUnitsConsumed === "number" && Number.isFinite(record.simulationUnitsConsumed) ? { unitsConsumed: record.simulationUnitsConsumed } : {}
+		}
+	};
+}
+async function withReviewLock(env, task) {
+	const run = async () => await withFileLock(statePath(env), REVIEW_LOCK_OPTIONS, async () => await task());
+	const current = reviewStateLock.then(run, run);
+	reviewStateLock = current.then(() => undefined, () => undefined);
+	return await current;
+}
+async function prepareTurnkeyReviewedTransaction(params) {
+	const env = params.env ?? process.env;
+	const approvalRequestId = params.request.requestId?.trim();
+	if (!approvalRequestId) {
+		throw new WalletProviderError({
+			code: "wallet_provider_invalid_config",
+			message: "Turnkey preparation requires a stable approval request ID"
+		});
+	}
+	const requestDigest = computeReviewedSolanaRequestDigest({
+		request: params.request,
+		signer: params.signerAddress.trim()
+	});
+	const expectedRpcUrlDigest = normalizedRpcUrlDigest(params.rpcUrl);
+	const expectedAuthorizationContextDigest = digest(params.authorizationContext);
+	const preparedId = preparedIdentity({
+		approvalRequestId,
+		requestDigest,
+		rpcUrlDigest: expectedRpcUrlDigest,
+		authorizationContextDigest: expectedAuthorizationContextDigest
+	});
+	return await withReviewLock(env, async () => {
+		const file = compactReviewState(readFile(env));
+		const existing = file.reviews.find((review) => review.approvalRequestId === approvalRequestId || review.preparedId === preparedId);
+		if (existing) {
+			const sameImmutableRequest = existing.approvalRequestId === approvalRequestId && secureEqual(existing.preparedId, preparedId) && secureEqual(existing.signer, params.signerAddress.trim()) && secureEqual(existing.requestDigest, requestDigest) && secureEqual(existing.rpcUrlDigest, expectedRpcUrlDigest) && secureEqual(existing.authorizationContextDigest, expectedAuthorizationContextDigest);
+			if (!sameImmutableRequest) {
+				throw new WalletProviderError({
+					code: "wallet_provider_invalid_config",
+					message: "Turnkey approval request ID is already bound to a different immutable transaction",
+					retryable: false
+				});
+			}
+			if (existing.status === "failed") {
+				throw new WalletProviderError({
+					code: "wallet_provider_unavailable",
+					message: `${existing.failureReason ?? "Turnkey reviewed transaction failed"}; create a new approval request`,
+					retryable: false
+				});
+			}
+			if (existing.status === "prepared" && Date.parse(existing.expiresAt) <= Date.now()) {
+				throw new WalletProviderError({
+					code: "wallet_provider_invalid_config",
+					message: "Turnkey prepared review expired; create a new approval request",
+					retryable: false
+				});
+			}
+			return toPrepareResult(existing);
+		}
+		requireReviewCapacity(file);
+		const prepared = await buildReviewedSolanaTransaction({
+			request: params.request,
+			signerAddress: params.signerAddress,
+			rpcUrl: params.rpcUrl
+		});
+		if (!secureEqual(prepared.signer, params.signerAddress.trim())) {
+			throw new WalletProviderError({
+				code: "wallet_provider_unavailable",
+				message: "Turnkey transaction builder returned a different signer"
+			});
+		}
+		const now = Date.now();
+		const record = {
+			approvalRequestId,
+			preparedId,
+			createdAt: new Date(now).toISOString(),
+			expiresAt: new Date(now + REVIEW_TTL_MS).toISOString(),
+			status: "prepared",
+			signer: prepared.signer,
+			requestDigest,
+			intentDigest: prepared.intentDigest,
+			unsignedTxBase64: prepared.unsignedTxBase64,
+			messageBase64: prepared.messageBase64,
+			recentBlockhash: prepared.recentBlockhash,
+			lastValidBlockHeight: prepared.lastValidBlockHeight,
+			rpcUrlDigest: expectedRpcUrlDigest,
+			authorizationContextDigest: expectedAuthorizationContextDigest,
+			simulationUnitsConsumed: prepared.simulation.unitsConsumed
+		};
+		file.reviews.push(record);
+		saveFile(file, env);
+		return toPrepareResult(record);
+	});
+}
+async function executeTurnkeyReviewedTransaction(params) {
+	const env = params.env ?? process.env;
+	const preparedId = params.preparedId.trim();
+	if (!preparedId) {
+		throw new WalletProviderError({
+			code: "wallet_provider_invalid_config",
+			message: "Turnkey send requires a prepared review ID"
+		});
+	}
+	return await withReviewLock(env, async () => {
+		const file = readFile(env);
+		const review = file.reviews.find((record) => record.preparedId === preparedId);
+		if (!review) {
+			throw new WalletProviderError({
+				code: "wallet_provider_invalid_config",
+				message: "Turnkey prepared review is unknown; prepare and review the transaction again"
+			});
+		}
+		if (review.status === "broadcast" && review.txHash) {
+			return {
+				txHash: review.txHash,
+				signer: review.signer,
+				intentDigest: review.intentDigest,
+				idempotent: true
+			};
+		}
+		if (review.status === "broadcasting" || review.status === "unknown") {
+			if (!review.txHash) {
+				throw new WalletProviderError({
+					code: "wallet_provider_ambiguous",
+					message: "Turnkey broadcast is in progress or unknown; do not submit it again",
+					retryable: false
+				});
+			}
+			let reconciled;
+			try {
+				reconciled = await reconcileReviewedSolanaTransaction({
+					rpcUrl: params.rpcUrl,
+					expectedTxHash: review.txHash,
+					lastValidBlockHeight: review.lastValidBlockHeight
+				});
+			} catch {
+				throw new WalletProviderError({
+					code: "wallet_provider_ambiguous",
+					message: `Turnkey broadcast remains unknown; reconcile signature ${review.txHash} before any new send`,
+					retryable: false
+				});
+			}
+			if (reconciled.state === "landed") {
+				review.status = "broadcast";
+				saveFile(file, env);
+				return {
+					txHash: review.txHash,
+					signer: review.signer,
+					intentDigest: review.intentDigest,
+					idempotent: true
+				};
+			}
+			if (reconciled.state === "failed" || reconciled.state === "expired") {
+				review.status = "failed";
+				review.failureReason = reconciled.state === "failed" ? reconciled.reason : `reviewed transaction expired at block height ${review.lastValidBlockHeight} without landing`;
+				saveFile(file, env);
+				throw new WalletProviderError({
+					code: "wallet_provider_unavailable",
+					message: `${review.failureReason}; prepare and review a new transaction`,
+					retryable: false
+				});
+			}
+			throw new WalletProviderError({
+				code: "wallet_provider_ambiguous",
+				message: `Turnkey broadcast remains pending; reconcile signature ${review.txHash} before any new send`,
+				retryable: false
+			});
+		}
+		if (review.status === "failed") {
+			throw new WalletProviderError({
+				code: "wallet_provider_unavailable",
+				message: `${review.failureReason ?? "Turnkey reviewed transaction failed"}; prepare and review a new transaction`,
+				retryable: false
+			});
+		}
+		if (Date.parse(review.expiresAt) <= Date.now()) {
+			throw new WalletProviderError({
+				code: "wallet_provider_invalid_config",
+				message: "Turnkey prepared review expired; prepare and review a new transaction"
+			});
+		}
+		const expectedRequestDigest = computeReviewedSolanaRequestDigest({
+			request: params.request,
+			signer: params.signerAddress
+		});
+		if (review.approvalRequestId !== undefined && !secureEqual(review.approvalRequestId, params.request.requestId?.trim() ?? "") || !secureEqual(review.signer, params.signerAddress) || !secureEqual(review.requestDigest, expectedRequestDigest) || !secureEqual(review.rpcUrlDigest, normalizedRpcUrlDigest(params.rpcUrl)) || !secureEqual(review.authorizationContextDigest, digest(params.authorizationContext))) {
+			throw new WalletProviderError({
+				code: "wallet_provider_invalid_config",
+				message: "Turnkey execution context does not match the immutable prepared review"
+			});
+		}
+		const signedTxBase64 = await params.sign(review.unsignedTxBase64);
+		const verified = validateReviewedSolanaSignedTransaction({
+			unsignedTxBase64: review.unsignedTxBase64,
+			signedTxBase64,
+			signerAddress: review.signer
+		});
+		review.status = "broadcasting";
+		review.txHash = verified.txHash;
+		review.signedTxBase64 = verified.signedBytes.toString("base64");
+		saveFile(file, env);
+		try {
+			const txHash = await broadcastReviewedSolanaTransaction({
+				rpcUrl: params.rpcUrl,
+				signedTxBase64: review.signedTxBase64,
+				expectedTxHash: verified.txHash
+			});
+			review.status = "broadcast";
+			review.txHash = txHash;
+			saveFile(file, env);
+			return {
+				txHash,
+				signer: review.signer,
+				intentDigest: review.intentDigest,
+				idempotent: false
+			};
+		} catch (error) {
+			review.status = "unknown";
+			saveFile(file, env);
+			throw error;
+		}
+	});
+}
+
+//#endregion
+export { executeTurnkeyReviewedTransaction, prepareTurnkeyReviewedTransaction };

package/dist/wallet/wallet-approval-auth.js

@@ -1,5 +1,6 @@
 import { ensureWalletStateDir } from "./wallet-runtime-config.js";
-import fs from "node:fs";
+import { serializeWalletState, writeWalletStateFileAtomically } from "./wallet-atomic-state.js";
+import syncFs from "node:fs";
 import path from "node:path";
 import { createHash, createPublicKey, randomBytes, timingSafeEqual, verify } from "node:crypto";
 
@@ -73,22 +74,12 @@ function rpIdFromHost(host) {
 	}
 }
 function normalizeState(input) {
-	if (!input || typeof input !== "object") {
-		return {
-			version: 2,
-			passkeys: [],
-			challenges: [],
-			grants: []
-		};
+	if (!input || typeof input !== "object" || Array.isArray(input)) {
+		throw new Error("wallet approval auth state must be an object");
 	}
 	const parsed = input;
-	if (parsed.version !== 2) {
-		return {
-			version: 2,
-			passkeys: [],
-			challenges: [],
-			grants: []
-		};
+	if (parsed.version !== 2 || !Array.isArray(parsed.passkeys) || !Array.isArray(parsed.challenges) || !Array.isArray(parsed.grants)) {
+		throw new Error("wallet approval auth state has an unsupported shape");
 	}
 	const passkeys = Array.isArray(parsed.passkeys) ? parsed.passkeys.map((entry) => {
 		if (!entry || typeof entry !== "object") {
@@ -109,6 +100,9 @@ function normalizeState(input) {
 			transports: Array.isArray(value.transports) ? value.transports.map((v) => String(v)) : undefined
 		};
 	}).filter((entry) => entry !== null) : [];
+	if (passkeys.length !== parsed.passkeys.length) {
+		throw new Error("wallet approval auth state contains an invalid passkey");
+	}
 	const challenges = Array.isArray(parsed.challenges) ? parsed.challenges.map((entry) => {
 		if (!entry || typeof entry !== "object") {
 			return null;
@@ -137,6 +131,9 @@ function normalizeState(input) {
 			status: value.status
 		};
 	}).filter((entry) => entry !== null) : [];
+	if (challenges.length !== parsed.challenges.length || challenges.some((entry) => !entry.id || !entry.challenge || !entry.host || !entry.rpId)) {
+		throw new Error("wallet approval auth state contains an invalid challenge");
+	}
 	const grants = Array.isArray(parsed.grants) ? parsed.grants.map((entry) => {
 		if (!entry || typeof entry !== "object") {
 			return null;
@@ -154,6 +151,9 @@ function normalizeState(input) {
 			expiresAt: value.expiresAt
 		};
 	}).filter((entry) => entry !== null) : [];
+	if (grants.length !== parsed.grants.length || grants.some((entry) => !entry.host)) {
+		throw new Error("wallet approval auth state contains an invalid grant");
+	}
 	return {
 		version: 2,
 		passkeys,
@@ -163,7 +163,7 @@ function normalizeState(input) {
 }
 function loadState(env = process.env) {
 	const statePath = resolveStatePath(env);
-	if (!fs.existsSync(statePath)) {
+	if (!syncFs.existsSync(statePath)) {
 		return {
 			version: 2,
 			passkeys: [],
@@ -172,26 +172,15 @@ function loadState(env = process.env) {
 		};
 	}
 	try {
-		const raw = fs.readFileSync(statePath, "utf8");
+		const raw = syncFs.readFileSync(statePath, "utf8");
 		return normalizeState(JSON.parse(raw));
-	} catch {
-		return {
-			version: 2,
-			passkeys: [],
-			challenges: [],
-			grants: []
-		};
+	} catch (error) {
+		throw new Error("wallet approval auth state is unreadable; refusing to reset credentials", { cause: error });
 	}
 }
 function saveState(state, env = process.env) {
 	const statePath = resolveStatePath(env);
-	fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	try {
-		fs.chmodSync(statePath, 384);
-	} catch {}
+	writeWalletStateFileAtomically(statePath, serializeWalletState(state));
 }
 function pruneState(state) {
 	const now = nowMs();

package/dist/wallet/wallet-atomic-state.js

@@ -0,0 +1,53 @@
+import syncFs from "node:fs";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+
+//#region src/wallet/wallet-atomic-state.ts
+const WALLET_STATE_FILE_MODE = 384;
+/**
+* Replace a wallet state file durably without ever exposing a partially-written
+* destination. Callers remain responsible for validating the full document
+* before trusting it and for serializing read/modify/write operations.
+*/
+function writeWalletStateFileAtomically(filePath, contents) {
+	const directoryPath = path.dirname(filePath);
+	const temporaryPath = path.join(directoryPath, `.${path.basename(filePath)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+	let descriptor;
+	let renamed = false;
+	try {
+		descriptor = syncFs.openSync(temporaryPath, "wx", WALLET_STATE_FILE_MODE);
+		syncFs.writeFileSync(descriptor, contents, { encoding: "utf8" });
+		syncFs.fsyncSync(descriptor);
+		syncFs.closeSync(descriptor);
+		descriptor = undefined;
+		syncFs.renameSync(temporaryPath, filePath);
+		renamed = true;
+		try {
+			syncFs.chmodSync(filePath, WALLET_STATE_FILE_MODE);
+		} catch {}
+		const directoryDescriptor = syncFs.openSync(directoryPath, "r");
+		try {
+			syncFs.fsyncSync(directoryDescriptor);
+		} finally {
+			syncFs.closeSync(directoryDescriptor);
+		}
+	} catch (error) {
+		if (descriptor !== undefined) {
+			try {
+				syncFs.closeSync(descriptor);
+			} catch {}
+		}
+		if (!renamed) {
+			try {
+				syncFs.unlinkSync(temporaryPath);
+			} catch {}
+		}
+		throw error;
+	}
+}
+function serializeWalletState(value) {
+	return `${JSON.stringify(value, null, 2)}\n`;
+}
+
+//#endregion
+export { serializeWalletState, writeWalletStateFileAtomically };

package/dist/wallet/wallet-audit-log.js

@@ -1,5 +1,5 @@
 import { ensureWalletStateDir } from "./wallet-runtime-config.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import { randomBytes } from "node:crypto";
 
 //#region src/wallet/wallet-audit-log.ts
@@ -15,22 +15,22 @@ function appendWalletAuditEntry(params) {
 		actor: params.actor?.trim() || "system",
 		details: params.details ?? {}
 	};
-	fs.appendFileSync(paths.auditLogPath, `${JSON.stringify(entry)}\n`, {
+	syncFs.appendFileSync(paths.auditLogPath, `${JSON.stringify(entry)}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
 	try {
-		fs.chmodSync(paths.auditLogPath, 384);
+		syncFs.chmodSync(paths.auditLogPath, 384);
 	} catch {}
 	return entry;
 }
 function readWalletAuditEntries(params) {
 	const paths = ensureWalletStateDir(params?.env ?? process.env);
-	if (!fs.existsSync(paths.auditLogPath)) {
+	if (!syncFs.existsSync(paths.auditLogPath)) {
 		return [];
 	}
 	const limit = Math.max(1, Math.min(500, params?.limit ?? 100));
-	const raw = fs.readFileSync(paths.auditLogPath, "utf8");
+	const raw = syncFs.readFileSync(paths.auditLogPath, "utf8");
 	const lines = raw.split("\n").map((line) => line.trim()).filter(Boolean);
 	const out = [];
 	for (let i = lines.length - 1; i >= 0; i -= 1) {

package/dist/wallet/wallet-canary.js

@@ -341,7 +341,6 @@ async function runWalletProviderCanaryReport(params) {
 				actor: "wallet-canary",
 				config: params.wallet,
 				providerIdOverride: providerId,
-				approvalHost: "127.0.0.1",
 				env
 			});
 			pushStep(steps, {

package/dist/wallet/wallet-inbound-events.js

@@ -1,10 +1,11 @@
 import { ensureWalletStateDir } from "./wallet-runtime-config.js";
 import { readWalletProviderRegistry, resolveWalletSelection } from "./wallet-provider-registry.js";
+import { serializeWalletState, writeWalletStateFileAtomically } from "./wallet-atomic-state.js";
 import { buildWalletProviderCapabilityMatrix, providerSupportsChainOperation } from "./wallet-provider-capabilities.js";
 import { walletDiagnosticErrorString } from "./wallet-redaction.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "./wallet-provider-resolver.js";
 import { appendWalletAuditEntry, readWalletAuditEntries } from "./wallet-audit-log.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 
@@ -26,6 +27,7 @@ function normalizeProviderId(value) {
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
+		case "wallet-standard":
 		case "privy": return value;
 		default: return null;
 	}
@@ -115,9 +117,12 @@ function defaultLedger() {
 }
 function normalizeLedger(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-		return defaultLedger();
+		throw new Error("wallet inbound ledger must be an object");
 	}
 	const value = raw;
+	if (value.version !== 1 || !Array.isArray(value.snapshots) || !Array.isArray(value.events) || typeof value.updatedAt !== "string") {
+		throw new Error("wallet inbound ledger has an unsupported shape");
+	}
 	const snapshots = Array.isArray(value.snapshots) ? value.snapshots.filter((entry) => {
 		if (!entry || typeof entry !== "object") {
 			return false;
@@ -134,6 +139,9 @@ function normalizeLedger(raw) {
 		unit: entry.unit,
 		updatedAt: entry.updatedAt
 	})) : [];
+	if (snapshots.length !== value.snapshots.length) {
+		throw new Error("wallet inbound ledger contains an invalid balance snapshot");
+	}
 	const events = Array.isArray(value.events) ? value.events.filter((entry) => {
 		if (!entry || typeof entry !== "object") {
 			return false;
@@ -164,24 +172,27 @@ function normalizeLedger(raw) {
 		} : undefined,
 		metadata: entry.metadata && typeof entry.metadata === "object" ? entry.metadata : undefined
 	})) : [];
+	if (events.length !== value.events.length) {
+		throw new Error("wallet inbound ledger contains an invalid event");
+	}
 	return {
 		version: 1,
 		snapshots,
 		events,
-		updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : nowIso(),
+		updatedAt: value.updatedAt,
 		lastReconciledAt: typeof value.lastReconciledAt === "string" ? value.lastReconciledAt : undefined
 	};
 }
 function readLedger(env = process.env) {
 	const filePath = inboundLedgerPath(env);
-	if (!fs.existsSync(filePath)) {
+	if (!syncFs.existsSync(filePath)) {
 		return defaultLedger();
 	}
 	try {
-		const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+		const parsed = JSON.parse(syncFs.readFileSync(filePath, "utf8"));
 		return normalizeLedger(parsed);
-	} catch {
-		return defaultLedger();
+	} catch (error) {
+		throw new Error("wallet inbound ledger is unreadable; refusing to reset event history", { cause: error });
 	}
 }
 function writeLedger(ledger, env = process.env) {
@@ -191,13 +202,7 @@ function writeLedger(ledger, env = process.env) {
 		version: 1,
 		updatedAt: nowIso()
 	};
-	fs.writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	try {
-		fs.chmodSync(filePath, 384);
-	} catch {}
+	writeWalletStateFileAtomically(filePath, serializeWalletState(payload));
 }
 function findWalletById(env, walletId) {
 	if (!walletId) {