@fased/fased 0.1.61 → 0.1.64

package/dist/wallet/wallet-observability.js

@@ -1,5 +1,5 @@
 import { ensureWalletStateDir } from "./wallet-runtime-config.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/wallet/wallet-observability.ts
 const OBSERVABILITY_FILENAME = "observability.v1.json";
@@ -37,11 +37,11 @@ function sanitizeBucket(input) {
 }
 function readSnapshot(env) {
 	const file = observabilityPath(env);
-	if (!fs.existsSync(file)) {
+	if (!syncFs.existsSync(file)) {
 		return makeDefaultSnapshot();
 	}
 	try {
-		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+		const parsed = JSON.parse(syncFs.readFileSync(file, "utf8"));
 		if (parsed?.version !== 1) {
 			return makeDefaultSnapshot();
 		}
@@ -60,12 +60,12 @@ function readSnapshot(env) {
 }
 function writeSnapshot(env, snapshot) {
 	const file = observabilityPath(env);
-	fs.writeFileSync(file, `${JSON.stringify(snapshot, null, 2)}\n`, {
+	syncFs.writeFileSync(file, `${JSON.stringify(snapshot, null, 2)}\n`, {
 		mode: 384,
 		encoding: "utf8"
 	});
 	try {
-		fs.chmodSync(file, 384);
+		syncFs.chmodSync(file, 384);
 	} catch {}
 }
 function incrementWalletObservabilityCounter(params) {

package/dist/wallet/wallet-policy-simulation.js

@@ -128,7 +128,7 @@ function simulateWalletPolicy(params) {
 			diff
 		};
 	}
-	checks.push(pass("wallet.approval", "Approval", "Autonomous mode may sign after custody and approval gates."));
+	checks.push(pass("wallet.approval", "Approval", "Autonomous mode may sign only after typed signer policy and cap checks."));
 	return {
 		ok: true,
 		decision: "pass",

package/dist/wallet/wallet-policy.js

@@ -2,7 +2,8 @@ import { ensureWalletStateDir, resolveWalletRuntimeConfig } from "./wallet-runti
 import { readWalletProviderRegistry, resolveWalletUserRole } from "./wallet-provider-registry.js";
 import { assertValidSolanaAddress } from "./solana-address.js";
 import { tryResolveSatRuntimeIds } from "../config/sat-runtime-ids.js";
-import fs from "node:fs";
+import { serializeWalletState, writeWalletStateFileAtomically } from "./wallet-atomic-state.js";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/wallet/wallet-policy.ts
@@ -44,26 +45,46 @@ function normalizeWalletUsageBucket(raw) {
 		return null;
 	}
 	const value = raw;
+	if (!isNonNegativeIntegerString(value.solanaSpent)) {
+		return null;
+	}
+	if (!value.solanaTokenSpent || typeof value.solanaTokenSpent !== "object" || Array.isArray(value.solanaTokenSpent)) {
+		return null;
+	}
+	const solanaTokenSpent = {};
+	for (const [mintRaw, spent] of Object.entries(value.solanaTokenSpent)) {
+		const mint = mintRaw.trim();
+		if (!mint || !isNonNegativeIntegerString(spent)) {
+			return null;
+		}
+		solanaTokenSpent[mint] = spent;
+	}
 	return {
-		solanaSpent: typeof value.solanaSpent === "string" ? value.solanaSpent : "0",
-		solanaTokenSpent: value.solanaTokenSpent && typeof value.solanaTokenSpent === "object" ? Object.fromEntries(Object.entries(value.solanaTokenSpent).map(([mint, spent]) => [mint.trim(), typeof spent === "string" ? spent : "0"]).filter(([mint]) => Boolean(mint))) : {}
+		solanaSpent: value.solanaSpent,
+		solanaTokenSpent
 	};
 }
+function isNonNegativeIntegerString(value) {
+	return typeof value === "string" && /^\d+$/.test(value);
+}
 function loadLedger(paths) {
 	const fallback = defaultWalletUsageLedger();
-	if (!fs.existsSync(paths.dailyUsagePath)) {
+	if (!syncFs.existsSync(paths.dailyUsagePath)) {
 		return fallback;
 	}
 	try {
-		const raw = fs.readFileSync(paths.dailyUsagePath, "utf8");
+		const raw = syncFs.readFileSync(paths.dailyUsagePath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (parsed && parsed.version === 2 && typeof parsed.date === "string") {
-			const walletsRaw = parsed.wallets && typeof parsed.wallets === "object" && !Array.isArray(parsed.wallets) ? parsed.wallets : {};
+			if (!parsed.wallets || typeof parsed.wallets !== "object" || Array.isArray(parsed.wallets)) {
+				throw new Error("wallet usage ledger wallets must be an object");
+			}
+			const walletsRaw = parsed.wallets;
 			const wallets = {};
 			for (const [walletId, bucketRaw] of Object.entries(walletsRaw)) {
 				const bucket = normalizeWalletUsageBucket(bucketRaw);
 				if (!walletId.trim() || !bucket) {
-					continue;
+					throw new Error(`wallet usage ledger contains an invalid bucket for ${walletId || "?"}`);
 				}
 				wallets[walletId.trim()] = bucket;
 			}
@@ -73,24 +94,23 @@ function loadLedger(paths) {
 				wallets
 			};
 		}
-		if (parsed && parsed.version === 1) {
+		if (parsed && parsed.version === 1 && typeof parsed.date === "string" && isNonNegativeIntegerString(parsed.solanaSpent)) {
 			return {
 				version: 2,
-				date: typeof parsed.date === "string" ? parsed.date : fallback.date,
+				date: parsed.date,
 				wallets: { [LEDGER_LEGACY_GLOBAL_BUCKET_ID]: {
-					solanaSpent: typeof parsed.solanaSpent === "string" ? parsed.solanaSpent : "0",
+					solanaSpent: parsed.solanaSpent,
 					solanaTokenSpent: {}
 				} }
 			};
 		}
-	} catch {}
-	return fallback;
+		throw new Error("wallet usage ledger has an unsupported shape");
+	} catch (error) {
+		throw new Error("wallet usage ledger is unreadable; refusing to reset spend counters", { cause: error });
+	}
 }
 function writeLedger(paths, ledger) {
-	fs.writeFileSync(paths.dailyUsagePath, `${JSON.stringify(ledger, null, 2)}\n`, { mode: 384 });
-	try {
-		fs.chmodSync(paths.dailyUsagePath, 384);
-	} catch {}
+	writeWalletStateFileAtomically(paths.dailyUsagePath, serializeWalletState(ledger));
 }
 function resolveWalletUsageBucket(ledger, walletId) {
 	const normalizedWalletId = walletId?.trim() || DEFAULT_EFFECTIVE_WALLET_ID;
@@ -294,7 +314,13 @@ function resolveWalletRoleForId(params) {
 	if (walletId && storedPurpose === "mining") {
 		return "mining";
 	}
-	if (walletId && (registry.defaultWalletId && walletId === registry.defaultWalletId || storedPurpose === "agent")) {
+	if (walletId && storedPurpose === "vault") {
+		return "vault";
+	}
+	if (walletId && storedPurpose === "agent") {
+		return "agent";
+	}
+	if (walletId && registry.defaultWalletId && walletId === registry.defaultWalletId) {
 		return "agent";
 	}
 	return "vault";
@@ -344,21 +370,24 @@ function readWalletPolicyState(env = process.env) {
 		updatedAt: nowIso(),
 		wallets: {}
 	};
-	if (!fs.existsSync(statePath)) {
+	if (!syncFs.existsSync(statePath)) {
 		return fallback;
 	}
 	try {
-		const raw = fs.readFileSync(statePath, "utf8");
+		const raw = syncFs.readFileSync(statePath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (parsed.version !== 1) {
-			return fallback;
+			throw new Error("wallet policy state version is unsupported");
 		}
-		const walletsRaw = parsed.wallets && typeof parsed.wallets === "object" && !Array.isArray(parsed.wallets) ? parsed.wallets : {};
+		if (!parsed.wallets || typeof parsed.wallets !== "object" || Array.isArray(parsed.wallets)) {
+			throw new Error("wallet policy wallets must be an object");
+		}
+		const walletsRaw = parsed.wallets;
 		const wallets = {};
 		for (const [walletId, recordRaw] of Object.entries(walletsRaw)) {
 			const record = normalizeStoredWalletPolicyRecord(recordRaw);
-			if (!walletId.trim() || !record) {
-				continue;
+			if (!walletId.trim() || !record || record.walletId !== walletId.trim()) {
+				throw new Error(`wallet policy contains an invalid record for ${walletId || "?"}`);
 			}
 			wallets[walletId.trim()] = record;
 		}
@@ -367,17 +396,14 @@ function readWalletPolicyState(env = process.env) {
 			updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : fallback.updatedAt,
 			wallets
 		};
-	} catch {
-		return fallback;
+	} catch (error) {
+		throw new Error("wallet policy state is unreadable; refusing to replace persisted policy", { cause: error });
 	}
 }
 function writeWalletPolicyState(state, env = process.env) {
 	const paths = ensureWalletStateDir(env);
 	const statePath = resolveWalletPolicyStatePath(paths);
-	fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, { mode: 384 });
-	try {
-		fs.chmodSync(statePath, 384);
-	} catch {}
+	writeWalletStateFileAtomically(statePath, serializeWalletState(state));
 }
 function buildResolvedPolicyFromDefaults(defaults) {
 	return {
@@ -573,7 +599,7 @@ function applyWalletPolicyConfig(params) {
 	const profile = resolveWalletRolePolicyProfile(role, env);
 	return cloneWalletConfigWithPolicy(params.config, buildResolvedPolicyFromDefaults(profile.defaults));
 }
-function upsertWalletPolicyConfig(params) {
+function prepareWalletPolicyConfigUpdate(params) {
 	const env = params.env ?? process.env;
 	const walletId = params.walletId.trim();
 	if (!walletId) {
@@ -623,20 +649,41 @@ function upsertWalletPolicyConfig(params) {
 		patch: params.patch.recurringTransfer,
 		role
 	}) : existingRecord?.recurringTransfer;
-	state.wallets[walletId] = buildStoredPolicyRecord({
+	const preparedAt = nowIso();
+	const nextRecord = buildStoredPolicyRecord({
 		walletId,
 		role,
 		policy: nextPolicy,
-		recurringTransfer
+		recurringTransfer,
+		updatedAt: preparedAt
 	});
-	state.updatedAt = nowIso();
-	writeWalletPolicyState(state, env);
 	return {
 		walletId,
 		role,
-		config: cloneWalletConfigWithPolicy(base, nextPolicy)
+		config: cloneWalletConfigWithPolicy(base, nextPolicy),
+		expectedRecordJson: JSON.stringify(existingRecord ?? null),
+		nextRecord,
+		preparedAt
+	};
+}
+function commitWalletPolicyConfigUpdate(prepared, env = process.env) {
+	const state = readWalletPolicyState(env);
+	if (JSON.stringify(state.wallets[prepared.walletId] ?? null) !== prepared.expectedRecordJson) {
+		throw new Error("wallet policy changed concurrently; reload the acknowledged signer policy");
+	}
+	state.wallets[prepared.walletId] = prepared.nextRecord;
+	state.updatedAt = prepared.preparedAt;
+	writeWalletPolicyState(state, env);
+	return {
+		walletId: prepared.walletId,
+		role: prepared.role,
+		config: prepared.config
 	};
 }
+function upsertWalletPolicyConfig(params) {
+	const env = params.env ?? process.env;
+	return commitWalletPolicyConfigUpdate(prepareWalletPolicyConfigUpdate(params), env);
+}
 function resolveWalletRolePolicyProfile(role, env = process.env) {
 	switch (role) {
 		case "mining": return {
@@ -659,8 +706,8 @@ function resolveWalletRolePolicyProfile(role, env = process.env) {
 			label: "Agent",
 			summary: "Hot Agent wallet for reviewed payments, Fased Network payment evidence, and approved skill actions. Keep explicit caps and narrow token / contract routes.",
 			defaults: {
-				capsEnabled: false,
-				directSigning: true,
+				capsEnabled: true,
+				directSigning: false,
 				skillsEnabled: false,
 				solana: {
 					maxPerTx: DEFAULT_POLICY_CAPS.solana.maxPerTx,
@@ -673,9 +720,9 @@ function resolveWalletRolePolicyProfile(role, env = process.env) {
 		default: return {
 			role: "vault",
 			label: "Vault",
-			summary: "Manual-first Vault wallet for storage and federation bond assignment. No background agent execution by default; use split-key/passkey lock for custody.",
+			summary: "Manual-first Vault wallet for storage and federation bond assignment. No background agent execution by default; reviewed sends require signer-owned WebAuthn authorization.",
 			defaults: {
-				capsEnabled: false,
+				capsEnabled: true,
 				directSigning: false,
 				skillsEnabled: false,
 				solana: {
@@ -769,7 +816,14 @@ function validateWalletTxPolicy(params) {
 	}
 	const capsEnabled = params.config.policy.capsEnabled;
 	const allowPrograms = params.config.policy.solana.allowPrograms;
-	if (params.program && allowPrograms.length > 0) {
+	if (params.program) {
+		if (allowPrograms.length === 0) {
+			return {
+				ok: false,
+				code: "wallet_program_allowlist_required",
+				message: "program execution requires an explicit non-empty allowlist"
+			};
+		}
 		const normalized = params.program.trim();
 		const allowed = allowPrograms.includes(normalized);
 		if (!allowed) {
@@ -962,4 +1016,4 @@ function resolveWalletRecurringTransferPolicy(params) {
 }
 
 //#endregion
-export { applyWalletPolicyConfig, checkWalletDailyCap, enforceWalletDailyCap, isWalletToolAllowed, resolveWalletPolicyConfig, resolveWalletRecurringTransferPolicy, resolveWalletRoleForId, resolveWalletRolePolicyProfile, upsertWalletPolicyConfig, validateWalletTxPolicy };
+export { applyWalletPolicyConfig, checkWalletDailyCap, commitWalletPolicyConfigUpdate, enforceWalletDailyCap, isWalletToolAllowed, prepareWalletPolicyConfigUpdate, resolveWalletPolicyConfig, resolveWalletRecurringTransferPolicy, resolveWalletRoleForId, resolveWalletRolePolicyProfile, upsertWalletPolicyConfig, validateWalletTxPolicy };

package/dist/wallet/wallet-provider-capabilities.js

@@ -6,7 +6,12 @@ const FULL_CHAIN_OPS = {
 	send: true
 };
 const PROVIDER_CHAIN_OPERATION_PROFILES = {
-	"embedded-keystore": { solana: { ...FULL_CHAIN_OPS } },
+	"embedded-keystore": { solana: {
+		receiveAddress: false,
+		getBalance: false,
+		prepare: false,
+		send: false
+	} },
 	"local-socket-signer": { solana: { ...FULL_CHAIN_OPS } },
 	alchemy: { solana: {
 		receiveAddress: true,
@@ -15,7 +20,18 @@ const PROVIDER_CHAIN_OPERATION_PROFILES = {
 		send: false
 	} },
 	turnkey: { solana: { ...FULL_CHAIN_OPS } },
-	privy: { solana: { ...FULL_CHAIN_OPS } }
+	privy: { solana: {
+		receiveAddress: true,
+		getBalance: false,
+		prepare: false,
+		send: false
+	} },
+	"wallet-standard": { solana: {
+		receiveAddress: true,
+		getBalance: true,
+		prepare: false,
+		send: false
+	} }
 };
 const KNOWN_RPC_PROVIDER_PROFILES = {
 	alchemy: {
@@ -76,10 +92,12 @@ function resolveIntegrationMode(providerId) {
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
+		case "wallet-standard":
 		case "privy": return "native";
 	}
 }
 function buildWalletProviderCapabilityMatrix(adapter) {
+	const signingLocation = adapter.capabilities.signingLocation ?? "unavailable";
 	const chains = { solana: emptyChainOps() };
 	const defaultChainFlags = {
 		receiveAddress: true,
@@ -105,8 +123,14 @@ function buildWalletProviderCapabilityMatrix(adapter) {
 		providerId: adapter.id,
 		supportedChains: [...adapter.capabilities.supportedChains],
 		integrationMode: resolveIntegrationMode(adapter.id),
+		signingLocation,
+		signing: {
+			transaction: adapter.capabilities.supportsSignTransaction === true,
+			message: adapter.capabilities.supportsSignMessage === true,
+			interactiveSend: signingLocation === "browser" && adapter.capabilities.supportsSignTransaction === true
+		},
 		operations: {
-			createWallet: adapter.capabilities.supportsCreateWallet,
+			createWallet: adapter.capabilities.supportsCreateWallet || adapter.id === "local-socket-signer",
 			receiveAddress: receiveAny,
 			getBalance: balanceAny,
 			prepare: prepareAny,
@@ -117,7 +141,7 @@ function buildWalletProviderCapabilityMatrix(adapter) {
 			resetKeys: adapter.capabilities.supportsResetKeys
 		},
 		chains,
-		requiresCredentials: adapter.id !== "embedded-keystore" && adapter.id !== "local-socket-signer",
+		requiresCredentials: adapter.id !== "local-socket-signer" && adapter.id !== "wallet-standard",
 		requiresRpcSecret: false
 	};
 }

package/dist/wallet/wallet-provider-registry.js

@@ -1,6 +1,7 @@
 import { resolveStateDir } from "../config/paths.js";
+import { throwLegacyEmbeddedKeystoreMigrationRequired } from "./legacy-embedded-keystore.js";
 import { ensureWalletStateDir } from "./wallet-runtime-config.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 
@@ -8,10 +9,14 @@ import { randomBytes } from "node:crypto";
 const REGISTRY_FILE_MODE = 384;
 const PROVIDER_REGISTRY_FILENAME = "provider-registry.v1.json";
 const WALLET_PROVIDER_IDS = [
-	"embedded-keystore",
 	"local-socket-signer",
 	"alchemy",
 	"turnkey",
+	"wallet-standard"
+];
+const WALLET_PROVIDER_REGISTRY_IDS = [
+	"embedded-keystore",
+	...WALLET_PROVIDER_IDS,
 	"privy"
 ];
 function normalizeWalletUserRole(value) {
@@ -54,6 +59,7 @@ function normalizeProviderId(value) {
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
+		case "wallet-standard":
 		case "privy": return raw;
 		default: return null;
 	}
@@ -159,12 +165,12 @@ function buildMiningDeleteBlockedMessage(details) {
 }
 function readSatMiningRuntimeDeletionDetails(walletId, env) {
 	const runtimeStorePath = path.join(resolveStateDir(env), "sat-mining", "wallets", normalizeSatWalletStateKey(walletId), "runtime-store.json");
-	if (!fs.existsSync(runtimeStorePath)) {
+	if (!syncFs.existsSync(runtimeStorePath)) {
 		return null;
 	}
 	let parsed;
 	try {
-		parsed = JSON.parse(fs.readFileSync(runtimeStorePath, "utf8"));
+		parsed = JSON.parse(syncFs.readFileSync(runtimeStorePath, "utf8"));
 	} catch {
 		return null;
 	}
@@ -238,34 +244,18 @@ function normalizeWalletEntry(raw) {
 		updatedAt
 	};
 }
-function isLegacySelfHostedWallet(wallet) {
-	if (wallet.providerId !== "embedded-keystore") {
-		return false;
-	}
-	const metadata = wallet.metadata && typeof wallet.metadata === "object" && !Array.isArray(wallet.metadata) ? wallet.metadata : undefined;
-	if (metadata?.selfHosted === true) {
-		return true;
-	}
-	if (/^solana-\d+$/i.test(wallet.id)) {
-		return true;
-	}
-	if (/^solana\s+\d+$/i.test(wallet.name)) {
-		return true;
-	}
-	return false;
-}
 function makeDefaultRegistry() {
 	const ts = nowIso();
 	return {
 		version: 1,
 		providers: {
 			"embedded-keystore": {
-				enabled: true,
+				enabled: false,
 				updatedAt: ts,
-				label: "Self-hosted"
+				label: "Legacy embedded keystore (migration required)"
 			},
 			"local-socket-signer": {
-				enabled: false,
+				enabled: true,
 				updatedAt: ts,
 				label: "Local signer"
 			},
@@ -274,13 +264,19 @@ function makeDefaultRegistry() {
 				updatedAt: ts
 			},
 			turnkey: {
+				enabled: false,
+				updatedAt: ts,
+				label: "Turnkey (policy-managed)"
+			},
+			"wallet-standard": {
 				enabled: true,
 				updatedAt: ts,
-				label: "Turnkey (recommended hosted)"
+				label: "Wallet Standard (verify hardware on device)"
 			},
 			privy: {
-				enabled: true,
-				updatedAt: ts
+				enabled: false,
+				updatedAt: ts,
+				label: "Privy (integration unavailable)"
 			}
 		},
 		wallets: [],
@@ -299,8 +295,15 @@ function normalizeRegistry(raw) {
 	let changed = false;
 	const value = raw;
 	const providersRaw = value.providers && typeof value.providers === "object" && !Array.isArray(value.providers) ? value.providers : {};
-	const providers = { ...defaults.providers };
-	for (const providerId of WALLET_PROVIDER_IDS) {
+	const providers = {
+		"embedded-keystore": defaults.providers["embedded-keystore"],
+		"local-socket-signer": defaults.providers["local-socket-signer"],
+		alchemy: defaults.providers.alchemy,
+		turnkey: defaults.providers.turnkey,
+		"wallet-standard": defaults.providers["wallet-standard"],
+		privy: defaults.providers.privy
+	};
+	for (const providerId of WALLET_PROVIDER_REGISTRY_IDS) {
 		const entryRaw = providersRaw[providerId];
 		if (!entryRaw || typeof entryRaw !== "object" || Array.isArray(entryRaw)) {
 			continue;
@@ -309,8 +312,8 @@ function normalizeRegistry(raw) {
 		const enabled = Boolean(entry.enabled);
 		let label = typeof entry.label === "string" ? entry.label.trim() || undefined : undefined;
 		if (providerId === "embedded-keystore") {
-			if (!label || label === "Embedded keystore (default)" || label === "Self-hosted wallet") {
-				label = "Self-hosted";
+			if (!label || label === "Embedded keystore (default)" || label === "Self-hosted wallet" || label === "Self-hosted") {
+				label = "Legacy embedded keystore (migration required)";
 			}
 		}
 		if (providerId === "local-socket-signer") {
@@ -325,23 +328,7 @@ function normalizeRegistry(raw) {
 			updatedAt
 		};
 	}
-	const wallets = (Array.isArray(value.wallets) ? value.wallets.map(normalizeWalletEntry).filter((entry) => Boolean(entry)) : []).map((wallet) => {
-		if (!isLegacySelfHostedWallet(wallet)) {
-			return wallet;
-		}
-		changed = true;
-		const metadata = wallet.metadata && typeof wallet.metadata === "object" && !Array.isArray(wallet.metadata) ? wallet.metadata : undefined;
-		return {
-			...wallet,
-			providerId: "local-socket-signer",
-			metadata: {
-				...metadata,
-				selfHosted: true,
-				migratedFromProviderId: metadata?.migratedFromProviderId ?? "embedded-keystore"
-			},
-			updatedAt: nowIso()
-		};
-	});
+	const wallets = Array.isArray(value.wallets) ? value.wallets.map(normalizeWalletEntry).filter((entry) => Boolean(entry)) : [];
 	if (wallets.some((wallet) => wallet.providerId === "local-socket-signer")) {
 		const current = providers["local-socket-signer"];
 		if (!current.enabled) {
@@ -383,11 +370,11 @@ function normalizeRegistry(raw) {
 }
 function readWalletProviderRegistry(env = process.env) {
 	const file = registryPath(env);
-	if (!fs.existsSync(file)) {
+	if (!syncFs.existsSync(file)) {
 		return makeDefaultRegistry();
 	}
 	try {
-		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+		const parsed = JSON.parse(syncFs.readFileSync(file, "utf8"));
 		const normalized = normalizeRegistry(parsed);
 		if (normalized.changed) {
 			writeWalletProviderRegistry(normalized.registry, env);
@@ -404,15 +391,21 @@ function writeWalletProviderRegistry(registry, env = process.env) {
 		version: 1,
 		updatedAt: nowIso()
 	};
-	fs.writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`, {
+	syncFs.writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`, {
 		encoding: "utf8",
 		mode: REGISTRY_FILE_MODE
 	});
 	try {
-		fs.chmodSync(file, REGISTRY_FILE_MODE);
+		syncFs.chmodSync(file, REGISTRY_FILE_MODE);
 	} catch {}
 }
 function setWalletProviderEnabled(params) {
+	if (params.providerId === "embedded-keystore" && params.enabled) {
+		throwLegacyEmbeddedKeystoreMigrationRequired("cannot enable retired wallet provider");
+	}
+	if (params.providerId === "privy" && params.enabled) {
+		throw new Error("Privy wallet creation and signing are unavailable; the provider stays disabled.");
+	}
 	const env = params.env ?? process.env;
 	const registry = readWalletProviderRegistry(env);
 	registry.providers[params.providerId] = {
@@ -428,6 +421,20 @@ function setWalletProvidersEnabled(params) {
 	const registry = readWalletProviderRegistry(env);
 	const enabledSet = new Set(params.enabledProviders);
 	const now = nowIso();
+	const legacy = registry.providers["embedded-keystore"];
+	registry.providers["embedded-keystore"] = {
+		...legacy,
+		enabled: false,
+		label: "Legacy embedded keystore (migration required)",
+		updatedAt: legacy.enabled ? now : legacy.updatedAt
+	};
+	const unavailablePrivy = registry.providers.privy;
+	registry.providers.privy = {
+		...unavailablePrivy,
+		enabled: false,
+		label: "Privy (integration unavailable)",
+		updatedAt: unavailablePrivy.enabled ? now : unavailablePrivy.updatedAt
+	};
 	for (const providerId of WALLET_PROVIDER_IDS) {
 		const current = registry.providers[providerId] ?? {
 			enabled: false,
@@ -444,6 +451,12 @@ function setWalletProvidersEnabled(params) {
 	return registry;
 }
 function upsertNamedWallet(params) {
+	if (params.providerId === "embedded-keystore") {
+		throwLegacyEmbeddedKeystoreMigrationRequired("cannot register a new legacy wallet");
+	}
+	if (params.providerId === "privy") {
+		throw new Error("Privy wallet creation and signing are unavailable; no wallet was registered.");
+	}
 	const env = params.env ?? process.env;
 	const registry = readWalletProviderRegistry(env);
 	const name = params.name.trim();