@fased/fased 0.1.61 → 0.1.64

package/dist/wallet/wallet-provider-resolver.js

@@ -1,10 +1,9 @@
-import { resolveLocalSignerBackendSocketPath } from "./wallet-runtime-config.js";
+import { hasLegacyEmbeddedKeystoreConfig, hasLegacyEmbeddedKeystoreMaterialHint, throwLegacyEmbeddedKeystoreMigrationRequired } from "./legacy-embedded-keystore.js";
 import { readWalletProviderRegistry } from "./wallet-provider-registry.js";
 import { AlchemyAdapter } from "./providers/alchemy-adapter.js";
-import { EmbeddedKeystoreAdapter } from "./providers/embedded-keystore-adapter.js";
 import { LocalSocketSignerAdapter, requireLocalSocketSignerPath } from "./providers/local-socket-signer-adapter.js";
-import { PrivyAdapter } from "./providers/privy-adapter.js";
 import { TurnkeyAdapter } from "./providers/turnkey-adapter.js";
+import { WalletStandardAdapter } from "./providers/wallet-standard-adapter.js";
 import { loadWalletProviderSecret } from "./wallet-secrets-store.js";
 
 //#region src/wallet/wallet-provider-resolver.ts
@@ -14,10 +13,14 @@ function parseProviderId(input) {
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
+		case "wallet-standard":
 		case "privy": return input;
 		default: return null;
 	}
 }
+function throwPrivyProviderUnavailable() {
+	throw new Error("Privy wallet creation and signing are unavailable; no Privy provider selection or credentials are accepted.");
+}
 function pickCredentialValue(source, keys) {
 	for (const key of keys) {
 		const value = source[key];
@@ -57,7 +60,7 @@ function resolveWalletRpcUrlFromEnv(env, chain, walletId) {
 	const perWalletKey = suffix ? `FASED_WALLET_SOLANA_RPC_URL__${suffix}` : "";
 	const perChainKey = "FASED_WALLET_SOLANA_RPC_URL";
 	const scopedOrChain = (perWalletKey ? String(env[perWalletKey] ?? "").trim() : "") || String(env[perChainKey] ?? "").trim();
-	return scopedOrChain || String(env.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim();
+	return scopedOrChain || String(env.FASED_WALLET_RPC_URL ?? "").trim();
 }
 function resolveScopedRpcUrlForWallet(params) {
 	const preferred = inferWalletChainFromRegistry(params.env, params.walletId);
@@ -79,14 +82,6 @@ function inferSelfHostedProviderId(env) {
 	if (String(env.FASED_WALLET_LOCAL_SIGNER_SOCKET ?? "").trim()) {
 		return "local-socket-signer";
 	}
-	for (const [key, rawValue] of Object.entries(env)) {
-		if (typeof rawValue !== "string" || rawValue.trim().length === 0) {
-			continue;
-		}
-		if (key === "FASED_WALLET_SOLANA_KEYSTORE_PATH" || key === "FASED_WALLET_PASSPHRASE_FILE" || key.startsWith("FASED_WALLET_SOLANA_KEYSTORE_PATH__")) {
-			return "local-socket-signer";
-		}
-	}
 	return null;
 }
 function resolveWalletProviderId(cfg, env = process.env) {
@@ -95,14 +90,19 @@ function resolveWalletProviderId(cfg, env = process.env) {
 		...cfg.env?.vars
 	};
 	const envProvider = parseProviderId(effectiveEnv.FASED_WALLET_PROVIDER);
-	if (envProvider) {
-		return envProvider;
+	if (hasLegacyEmbeddedKeystoreConfig(cfg, effectiveEnv)) {
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet provider selection detected");
+	}
+	if (hasLegacyEmbeddedKeystoreMaterialHint(effectiveEnv)) {
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet material configuration detected");
 	}
 	const configProvider = parseProviderId(cfg.wallet?.provider?.id);
 	const inferredSelfHostedProvider = inferSelfHostedProviderId(effectiveEnv);
 	let registryProvider = null;
+	let registryHasLegacyEmbeddedWallet = false;
 	try {
 		const registry = readWalletProviderRegistry(effectiveEnv);
+		registryHasLegacyEmbeddedWallet = Boolean(registry.providers["embedded-keystore"]?.enabled) || registry.wallets.some((entry) => entry.providerId === "embedded-keystore");
 		const satWalletId = typeof cfg.plugins?.entries?.["sat-mining"]?.config?.walletId === "string" ? cfg.plugins.entries["sat-mining"]?.config?.walletId.trim() : "";
 		const satWallet = satWalletId ? registry.wallets.find((entry) => entry.id === satWalletId) : undefined;
 		if (satWallet?.providerId) {
@@ -123,13 +123,28 @@ function resolveWalletProviderId(cfg, env = process.env) {
 	} catch {
 		registryProvider = null;
 	}
-	if (registryProvider && (!configProvider || configProvider === "embedded-keystore")) {
+	if (registryHasLegacyEmbeddedWallet || registryProvider === "embedded-keystore") {
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet registry selection detected");
+	}
+	if (envProvider === "privy") {
+		throwPrivyProviderUnavailable();
+	}
+	if (envProvider) {
+		return envProvider;
+	}
+	if (registryProvider === "privy") {
+		throwPrivyProviderUnavailable();
+	}
+	if (registryProvider && !configProvider) {
 		return registryProvider;
 	}
-	if (inferredSelfHostedProvider && (!configProvider || configProvider === "embedded-keystore")) {
+	if (inferredSelfHostedProvider && !configProvider) {
 		return inferredSelfHostedProvider;
 	}
 	if (configProvider) {
+		if (configProvider === "privy") {
+			throwPrivyProviderUnavailable();
+		}
 		return configProvider;
 	}
 	return inferredSelfHostedProvider ?? "local-socket-signer";
@@ -141,25 +156,10 @@ function createWalletProviderAdapter(params) {
 	};
 	const providerId = params.providerIdOverride ?? resolveWalletProviderId(params.cfg, env);
 	if (providerId === "embedded-keystore") {
-		const secret = loadWalletProviderSecret(providerId, env);
-		const secretCredentials = secret?.credentials ?? {};
-		return new EmbeddedKeystoreAdapter({
-			chains: params.wallet.chains,
-			credentials: {
-				keystorePath: pickCredentialValue(secretCredentials, ["keystorePath", "path"]) || params.cfg.wallet?.keystore?.path?.trim() || String(env.FASED_WALLET_KEYSTORE_PATH ?? "").trim() || undefined,
-				passphrase: pickCredentialValue(secretCredentials, ["passphrase"]) || String(env.FASED_WALLET_PASSPHRASE ?? "").trim() || undefined,
-				rpcUrl: pickCredentialValue(secretCredentials, ["rpcUrl", "rpc_url"]) || resolveScopedRpcUrlForWallet({
-					env,
-					chains: params.wallet.chains,
-					walletId: params.walletId
-				}) || undefined
-			},
-			env
-		});
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet adapter selection detected");
 	}
 	if (providerId === "local-socket-signer") {
 		return new LocalSocketSignerAdapter(requireLocalSocketSignerPath(env), {
-			backendSocketPath: resolveLocalSignerBackendSocketPath(env),
 			rpcUrl: resolveScopedRpcUrlForWallet({
 				env,
 				chains: params.wallet.chains,
@@ -187,9 +187,19 @@ function createWalletProviderAdapter(params) {
 	if (providerId === "turnkey") {
 		const secret = loadWalletProviderSecret(providerId, env);
 		const secretCredentials = secret?.credentials ?? {};
+		const registeredWallet = params.walletId ? readWalletProviderRegistry(env).wallets.find((entry) => entry.id === params.walletId) : undefined;
+		const registeredProviderWalletId = typeof registeredWallet?.metadata?.turnkeyWalletId === "string" ? registeredWallet.metadata.turnkeyWalletId.trim() : "";
+		const registeredSolanaAddress = registeredWallet?.addresses?.solana?.trim() ?? "";
+		const configuredSolanaAddress = pickCredentialValue(secretCredentials, ["defaultSolanaAddress", "solanaAddress"]) || String(env.FASED_WALLET_TURNKEY_DEFAULT_SOLANA_ADDRESS ?? "").trim();
+		const configuredProviderWalletId = pickCredentialValue(secretCredentials, ["providerWalletId", "turnkeyWalletId"]) || "";
+		if (registeredWallet && (registeredSolanaAddress && configuredSolanaAddress && registeredSolanaAddress !== configuredSolanaAddress || registeredProviderWalletId && configuredProviderWalletId && registeredProviderWalletId !== configuredProviderWalletId)) {
+			throw new Error(`Turnkey wallet ${registeredWallet.name} does not match the configured provider wallet identity`);
+		}
 		return new TurnkeyAdapter({
 			chains: params.wallet.chains,
 			service: params.wallet.service,
+			walletName: registeredWallet?.name,
+			stateEnv: env,
 			credentials: {
 				apiPublicKey: pickCredentialValue(secretCredentials, [
 					"apiPublicKey",
@@ -206,47 +216,36 @@ function createWalletProviderAdapter(params) {
 					"organizationID",
 					"orgId"
 				]) || String(env.FASED_WALLET_TURNKEY_ORGANIZATION_ID ?? "").trim() || undefined,
-				stamp: pickCredentialValue(secretCredentials, [
-					"stamp",
-					"xStamp",
-					"x_stamp",
-					"apiStamp"
-				]) || String(env.FASED_WALLET_TURNKEY_STAMP ?? "").trim() || undefined,
+				policyId: pickCredentialValue(secretCredentials, ["policyId", "policyID"]) || String(env.FASED_WALLET_TURNKEY_POLICY_ID ?? "").trim() || undefined,
 				baseUrl: pickCredentialValue(secretCredentials, [
 					"baseUrl",
 					"url",
 					"endpoint"
 				]) || String(env.FASED_WALLET_TURNKEY_BASE_URL ?? "").trim() || undefined,
-				defaultSolanaAddress: pickCredentialValue(secretCredentials, ["defaultSolanaAddress", "solanaAddress"]) || String(env.FASED_WALLET_TURNKEY_DEFAULT_SOLANA_ADDRESS ?? "").trim() || undefined
+				rpcUrl: pickCredentialValue(secretCredentials, ["rpcUrl", "rpc_url"]) || resolveScopedRpcUrlForWallet({
+					env,
+					chains: params.wallet.chains,
+					walletId: params.walletId
+				}) || undefined,
+				defaultSolanaAddress: registeredSolanaAddress || configuredSolanaAddress || undefined,
+				providerWalletId: registeredProviderWalletId || configuredProviderWalletId || undefined
 			}
 		});
 	}
-	if (providerId === "privy") {
-		const secret = loadWalletProviderSecret(providerId, env);
-		const secretCredentials = secret?.credentials ?? {};
-		return new PrivyAdapter({
-			chains: params.wallet.chains,
-			service: params.wallet.service,
-			credentials: {
-				appId: pickCredentialValue(secretCredentials, [
-					"appId",
-					"app_id",
-					"applicationId"
-				]) || String(env.FASED_WALLET_PRIVY_APP_ID ?? "").trim(),
-				appSecret: pickCredentialValue(secretCredentials, [
-					"appSecret",
-					"app_secret",
-					"secret"
-				]) || String(env.FASED_WALLET_PRIVY_APP_SECRET ?? "").trim(),
-				baseUrl: pickCredentialValue(secretCredentials, [
-					"baseUrl",
-					"url",
-					"endpoint"
-				]) || String(env.FASED_WALLET_PRIVY_BASE_URL ?? "").trim() || undefined,
-				defaultSolanaAddress: pickCredentialValue(secretCredentials, ["defaultSolanaAddress", "solanaAddress"]) || String(env.FASED_WALLET_PRIVY_DEFAULT_SOLANA_ADDRESS ?? "").trim() || undefined
-			}
+	if (providerId === "wallet-standard") {
+		const registeredWallet = params.walletId ? readWalletProviderRegistry(env).wallets.find((entry) => entry.id === params.walletId) : undefined;
+		return new WalletStandardAdapter({
+			address: registeredWallet?.addresses?.solana,
+			rpcUrl: resolveScopedRpcUrlForWallet({
+				env,
+				chains: params.wallet.chains,
+				walletId: params.walletId
+			})
 		});
 	}
+	if (providerId === "privy") {
+		throwPrivyProviderUnavailable();
+	}
 	throw new Error("unsupported wallet provider");
 }
 

package/dist/wallet/wallet-runtime-config.js

@@ -1,5 +1,5 @@
 import { resolveStateDir } from "../config/paths.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/wallet/wallet-runtime-config.ts
@@ -7,6 +7,9 @@ const DEFAULT_WALLET_RUNTIME_PORT = 19444;
 const DEFAULT_WALLET_RUNTIME_HOST = "127.0.0.1";
 const DEFAULT_WALLET_RUNTIME_VERSION = "0.1.1";
 const DEFAULT_WALLET_RUNTIME_SOURCE_REF = "v0.2.30";
+function isLocalSignerExternallyManaged(env = process.env) {
+	return String(env.FASED_WALLET_LOCAL_SIGNER_LIFECYCLE ?? "").trim().toLowerCase() === "external";
+}
 const DEFAULT_POLICY_CAPS = { solana: {
 	maxPerTx: "1000000000",
 	maxDaily: "5000000000"
@@ -50,31 +53,6 @@ function normalizeSolanaTokenCaps(raw) {
 	}
 	return out;
 }
-function isPositivePolicyAmount(raw) {
-	if (typeof raw !== "string") {
-		return false;
-	}
-	try {
-		return BigInt(raw.trim() || "0") > 0n;
-	} catch {
-		return false;
-	}
-}
-function hasExplicitPositiveCaps(policy) {
-	if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
-		return false;
-	}
-	const value = policy;
-	const solana = value.solana && typeof value.solana === "object" ? value.solana : {};
-	if (isPositivePolicyAmount(solana.maxPerTx) || isPositivePolicyAmount(solana.maxDaily)) {
-		return true;
-	}
-	const tokenCaps = solana.tokenCaps && typeof solana.tokenCaps === "object" && !Array.isArray(solana.tokenCaps) ? solana.tokenCaps : {};
-	return Object.values(tokenCaps).some((capRaw) => {
-		const cap = capRaw && typeof capRaw === "object" ? capRaw : {};
-		return isPositivePolicyAmount(cap.maxPerTx) || isPositivePolicyAmount(cap.maxDaily);
-	});
-}
 function resolveWalletStatePaths(env = process.env) {
 	const rootDir = path.join(resolveStateDir(env), "wallet");
 	const stackRootDir = path.join(rootDir, "wallet-stack");
@@ -94,12 +72,12 @@ function resolveWalletStatePaths(env = process.env) {
 }
 function ensureWalletStateDir(env = process.env) {
 	const paths = resolveWalletStatePaths(env);
-	fs.mkdirSync(paths.rootDir, {
+	syncFs.mkdirSync(paths.rootDir, {
 		recursive: true,
 		mode: 448
 	});
 	try {
-		fs.chmodSync(paths.rootDir, 448);
+		syncFs.chmodSync(paths.rootDir, 448);
 	} catch {}
 	return paths;
 }
@@ -128,15 +106,31 @@ function resolveLocalSignerMaterialRootDir(env = process.env) {
 	return ensureWalletStateDir(env).rootDir;
 }
 function resolveLocalSignerBackendSocketPath(env = process.env) {
-	const explicit = String(env.FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET ?? "").trim();
+	return resolveLocalSignerSocketPath(env);
+}
+function resolveLocalSignerControlSocketPath(env = process.env) {
+	const explicit = String(env.FASED_WALLET_LOCAL_SIGNER_CONTROL_SOCKET ?? "").trim();
 	if (explicit) {
 		return path.resolve(explicit);
 	}
-	return resolveLocalSignerSocketPath(env);
+	return path.join(resolveLocalSignerMaterialRootDir(env), "local-signer-control.sock");
+}
+function resolveLocalSignerStateDbPath(env = process.env) {
+	const explicit = String(env.FASED_WALLET_LOCAL_SIGNER_STATE_DB ?? "").trim();
+	if (explicit) {
+		return path.resolve(explicit);
+	}
+	return path.join(resolveLocalSignerMaterialRootDir(env), "signerd-v2.db");
+}
+function resolveLocalSignerMasterKeyPath(env = process.env) {
+	const explicit = String(env.FASED_WALLET_LOCAL_SIGNER_MASTER_KEY ?? "").trim();
+	if (explicit) {
+		return path.resolve(explicit);
+	}
+	return path.join(resolveLocalSignerMaterialRootDir(env), "signerd-v2.master.key");
 }
-function resolveLocalSignerRunAsUser(env = process.env) {
-	const explicit = String(env.FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER ?? "").trim();
-	return explicit || undefined;
+function resolveLocalSignerRunAsUser(_env = process.env) {
+	return undefined;
 }
 function parseRuntime(value) {
 	switch (value) {
@@ -159,13 +153,6 @@ function inferDefaultWalletProviderId(env) {
 	if (String(env.FASED_WALLET_LOCAL_SIGNER_SOCKET ?? "").trim()) {
 		return "local-socket-signer";
 	}
-	for (const key of Object.keys(env)) {
-		if (key === "FASED_WALLET_SOLANA_KEYSTORE_PATH" || key === "FASED_WALLET_PASSPHRASE_FILE" || key.startsWith("FASED_WALLET_SOLANA_KEYSTORE_PATH__")) {
-			if (String(env[key] ?? "").trim()) {
-				return "local-socket-signer";
-			}
-		}
-	}
 	return null;
 }
 function resolveWalletRuntimeConfig(cfg, env = process.env) {
@@ -203,7 +190,7 @@ function resolveWalletRuntimeConfig(cfg, env = process.env) {
 		enabled,
 		mode,
 		runtime,
-		execution: { mode: cfg.wallet?.execution?.mode === "autonomous" || cfg.wallet?.execution?.mode !== "manual" && (walletRuntime?.policy?.directSigning ?? true) ? "autonomous" : "manual" },
+		execution: { mode: cfg.wallet?.execution?.mode === "autonomous" || cfg.wallet?.execution?.mode !== "manual" && (walletRuntime?.policy?.directSigning ?? false) ? "autonomous" : "manual" },
 		chains,
 		service: {
 			host,
@@ -226,8 +213,8 @@ function resolveWalletRuntimeConfig(cfg, env = process.env) {
 			projectName: "fased-wallet"
 		},
 		policy: {
-			capsEnabled: typeof walletRuntime?.policy?.capsEnabled === "boolean" ? walletRuntime.policy.capsEnabled : hasExplicitPositiveCaps(walletRuntime?.policy),
-			directSigning: walletRuntime?.policy?.directSigning ?? true,
+			capsEnabled: typeof walletRuntime?.policy?.capsEnabled === "boolean" ? walletRuntime.policy.capsEnabled : true,
+			directSigning: walletRuntime?.policy?.directSigning ?? false,
 			skillsEnabled: walletRuntime?.policy?.skillsEnabled === true,
 			solana: {
 				allowPrograms: (walletRuntime?.policy?.solana?.allowPrograms ?? []).map((value) => String(value).trim()).filter(Boolean),
@@ -252,4 +239,4 @@ function resolveWalletRuntimeProviderId(cfg, env = process.env) {
 }
 
 //#endregion
-export { ensureWalletStateDir, resolveLocalSignerBackendSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerRunAsUser, resolveLocalSignerSidecarPaths, resolveLocalSignerSocketPath, resolveWalletRuntimeConfig, resolveWalletStatePaths };
+export { ensureWalletStateDir, isLocalSignerExternallyManaged, resolveLocalSignerControlSocketPath, resolveLocalSignerMasterKeyPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerSidecarPaths, resolveLocalSignerSocketPath, resolveLocalSignerStateDbPath, resolveWalletRuntimeConfig, resolveWalletStatePaths };

package/dist/wallet/wallet-secrets-store.js

@@ -1,5 +1,6 @@
 import { resolveStateDir } from "../config/paths.js";
-import fs from "node:fs";
+import { throwLegacyEmbeddedKeystoreMigrationRequired } from "./legacy-embedded-keystore.js";
+import syncFs from "node:fs";
 import path from "node:path";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 
@@ -12,12 +13,12 @@ const WALLET_RPC_SECRET_FILENAME = "wallet-rpc.v1.enc.json";
 const MASTER_KEY_FILENAME = "master.key";
 function ensureSecretsDir(env = process.env) {
 	const dir = path.join(resolveStateDir(env), "secrets");
-	fs.mkdirSync(dir, {
+	syncFs.mkdirSync(dir, {
 		recursive: true,
 		mode: SECRETS_DIR_MODE
 	});
 	try {
-		fs.chmodSync(dir, SECRETS_DIR_MODE);
+		syncFs.chmodSync(dir, SECRETS_DIR_MODE);
 	} catch {}
 	return dir;
 }
@@ -37,20 +38,20 @@ function resolveWalletProviderSecretPath(providerId, env = process.env) {
 }
 function readOrCreateMasterKey(env = process.env) {
 	const keyPath = resolveMasterKeyPath(env);
-	if (fs.existsSync(keyPath)) {
-		const raw = fs.readFileSync(keyPath, "utf8").trim();
+	if (syncFs.existsSync(keyPath)) {
+		const raw = syncFs.readFileSync(keyPath, "utf8").trim();
 		const parsed = Buffer.from(raw, "hex");
 		if (parsed.length === MASTER_KEY_BYTES) {
 			return parsed;
 		}
 	}
 	const key = randomBytes(MASTER_KEY_BYTES);
-	fs.writeFileSync(keyPath, `${key.toString("hex")}\n`, {
+	syncFs.writeFileSync(keyPath, `${key.toString("hex")}\n`, {
 		mode: SECRET_FILE_MODE,
 		encoding: "utf8"
 	});
 	try {
-		fs.chmodSync(keyPath, SECRET_FILE_MODE);
+		syncFs.chmodSync(keyPath, SECRET_FILE_MODE);
 	} catch {}
 	return key;
 }
@@ -124,6 +125,7 @@ function decryptProviderPayload(encrypted, env = process.env) {
 				case "local-socket-signer":
 				case "alchemy":
 				case "turnkey":
+				case "wallet-standard":
 				case "privy": return parsed.providerId;
 				default: return null;
 			}
@@ -197,17 +199,23 @@ function saveWalletRpcSecret(input, env = process.env) {
 	};
 	const encrypted = encryptPayload(record, env);
 	const secretPath = resolveWalletRpcSecretPath(env, input.providerId);
-	fs.writeFileSync(secretPath, `${JSON.stringify(encrypted, null, 2)}\n`, {
+	syncFs.writeFileSync(secretPath, `${JSON.stringify(encrypted, null, 2)}\n`, {
 		mode: SECRET_FILE_MODE,
 		encoding: "utf8"
 	});
 	try {
-		fs.chmodSync(secretPath, SECRET_FILE_MODE);
+		syncFs.chmodSync(secretPath, SECRET_FILE_MODE);
 	} catch {}
 	return record;
 }
 function saveWalletProviderSecret(input, env = process.env) {
 	const providerId = input.providerId;
+	if (providerId === "embedded-keystore") {
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet secret storage is unavailable");
+	}
+	if (providerId !== "alchemy" && providerId !== "turnkey") {
+		throw new Error(`${providerId} does not accept Gateway-held provider credentials; use its signer or wallet authority surface.`);
+	}
 	const credentials = {};
 	for (const [keyName, value] of Object.entries(input.credentials ?? {})) {
 		const normalizedKey = keyName.trim();
@@ -230,23 +238,23 @@ function saveWalletProviderSecret(input, env = process.env) {
 	};
 	const encrypted = encryptProviderPayload(record, env);
 	const secretPath = resolveWalletProviderSecretPath(providerId, env);
-	fs.writeFileSync(secretPath, `${JSON.stringify(encrypted, null, 2)}\n`, {
+	syncFs.writeFileSync(secretPath, `${JSON.stringify(encrypted, null, 2)}\n`, {
 		mode: SECRET_FILE_MODE,
 		encoding: "utf8"
 	});
 	try {
-		fs.chmodSync(secretPath, SECRET_FILE_MODE);
+		syncFs.chmodSync(secretPath, SECRET_FILE_MODE);
 	} catch {}
 	return record;
 }
 function loadWalletRpcSecret(env = process.env, options) {
 	const candidatePaths = options?.providerId ? [resolveWalletRpcSecretPath(env, options.providerId), resolveWalletRpcSecretPath(env)] : [resolveWalletRpcSecretPath(env)];
 	for (const secretPath of candidatePaths) {
-		if (!fs.existsSync(secretPath)) {
+		if (!syncFs.existsSync(secretPath)) {
 			continue;
 		}
 		try {
-			const parsed = JSON.parse(fs.readFileSync(secretPath, "utf8"));
+			const parsed = JSON.parse(syncFs.readFileSync(secretPath, "utf8"));
 			const decrypted = decryptPayload(parsed, env);
 			if (decrypted) {
 				return decrypted;
@@ -256,12 +264,18 @@ function loadWalletRpcSecret(env = process.env, options) {
 	return null;
 }
 function loadWalletProviderSecret(providerId, env = process.env) {
+	if (providerId === "embedded-keystore") {
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet secret loading is unavailable");
+	}
+	if (providerId !== "alchemy" && providerId !== "turnkey") {
+		return null;
+	}
 	const secretPath = resolveWalletProviderSecretPath(providerId, env);
-	if (!fs.existsSync(secretPath)) {
+	if (!syncFs.existsSync(secretPath)) {
 		return null;
 	}
 	try {
-		const parsed = JSON.parse(fs.readFileSync(secretPath, "utf8"));
+		const parsed = JSON.parse(syncFs.readFileSync(secretPath, "utf8"));
 		const value = decryptProviderPayload(parsed, env);
 		if (!value || value.providerId !== providerId) {
 			return null;
@@ -274,13 +288,13 @@ function loadWalletProviderSecret(providerId, env = process.env) {
 function deleteWalletRpcSecret(env = process.env) {
 	const dir = ensureSecretsDir(env);
 	const legacyPath = resolveWalletRpcSecretPath(env);
-	const candidatePaths = [legacyPath, ...fs.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && /^wallet-rpc-[a-z0-9-]+\.v1\.enc\.json$/i.test(entry.name)).map((entry) => path.join(dir, entry.name))];
+	const candidatePaths = [legacyPath, ...syncFs.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && /^wallet-rpc-[a-z0-9-]+\.v1\.enc\.json$/i.test(entry.name)).map((entry) => path.join(dir, entry.name))];
 	const removedPaths = [];
 	for (const secretPath of candidatePaths) {
-		if (!fs.existsSync(secretPath)) {
+		if (!syncFs.existsSync(secretPath)) {
 			continue;
 		}
-		fs.rmSync(secretPath, { force: true });
+		syncFs.rmSync(secretPath, { force: true });
 		removedPaths.push(secretPath);
 	}
 	return {
@@ -291,13 +305,13 @@ function deleteWalletRpcSecret(env = process.env) {
 }
 function deleteWalletRpcSecretForProvider(providerId, env = process.env) {
 	const secretPath = resolveWalletRpcSecretPath(env, providerId);
-	if (!fs.existsSync(secretPath)) {
+	if (!syncFs.existsSync(secretPath)) {
 		return {
 			removed: false,
 			path: secretPath
 		};
 	}
-	fs.rmSync(secretPath, { force: true });
+	syncFs.rmSync(secretPath, { force: true });
 	return {
 		removed: true,
 		path: secretPath
@@ -305,13 +319,13 @@ function deleteWalletRpcSecretForProvider(providerId, env = process.env) {
 }
 function deleteWalletProviderSecret(providerId, env = process.env) {
 	const secretPath = resolveWalletProviderSecretPath(providerId, env);
-	if (!fs.existsSync(secretPath)) {
+	if (!syncFs.existsSync(secretPath)) {
 		return {
 			removed: false,
 			path: secretPath
 		};
 	}
-	fs.rmSync(secretPath, { force: true });
+	syncFs.rmSync(secretPath, { force: true });
 	return {
 		removed: true,
 		path: secretPath
@@ -339,6 +353,14 @@ function readWalletRpcSecretStatus(env = process.env, options) {
 }
 function readWalletProviderSecretStatus(providerId, env = process.env) {
 	const secretPath = resolveWalletProviderSecretPath(providerId, env);
+	if (providerId === "embedded-keystore") {
+		return {
+			configured: false,
+			providerId,
+			fields: [],
+			path: secretPath
+		};
+	}
 	const secret = loadWalletProviderSecret(providerId, env);
 	if (!secret) {
 		return {