@fased/fased 0.1.62 → 0.1.64

package/dist/commands/wallet.js

@@ -1,41 +1,26 @@
 import { defaultRuntime } from "../runtime.js";
 import { loadConfig, writeConfigFile } from "../config/io.js";
 import "../config/config.js";
-import { ensureWalletStateDir, resolveLocalSignerBackendSocketPath, resolveLocalSignerMaterialRootDir, resolveLocalSignerSidecarPaths, resolveLocalSignerSocketPath, resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
-import { normalizeWalletUserRole, readWalletProviderRegistry, resolveWalletUserRole, setDefaultWallet, setNamedWalletRole, upsertNamedWallet } from "../wallet/wallet-provider-registry.js";
-import { applyWalletPolicyConfig, resolveWalletRoleForId } from "../wallet/wallet-policy.js";
+import { hasLegacyEmbeddedKeystoreConfig, hasLegacyEmbeddedKeystoreMaterialHint, throwLegacyEmbeddedKeystoreMigrationRequired } from "../wallet/legacy-embedded-keystore.js";
+import { ensureWalletStateDir, isLocalSignerExternallyManaged, resolveLocalSignerControlSocketPath, resolveLocalSignerMasterKeyPath, resolveLocalSignerSidecarPaths, resolveLocalSignerSocketPath, resolveLocalSignerStateDbPath } from "../wallet/wallet-runtime-config.js";
+import { normalizeWalletUserRole, readWalletProviderRegistry, resolveWalletUserRole, setDefaultWallet, setNamedWalletRole, setWalletProviderEnabled, upsertNamedWallet } from "../wallet/wallet-provider-registry.js";
 import { buildWalletProviderCapabilityMatrix } from "../wallet/wallet-provider-capabilities.js";
 import { redactWalletDiagnosticText } from "../wallet/wallet-redaction.js";
+import { callLocalSocketSigner, probeLocalSocketSignerHealth, requireLocalSocketSignerPath } from "../wallet/providers/local-socket-signer-adapter.js";
 import { readWalletProviderSecretStatus, saveWalletProviderSecret } from "../wallet/wallet-secrets-store.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "../wallet/wallet-provider-resolver.js";
-import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
-import { deleteWalletCustodyCeremony, initializeWalletCustodyCeremony, listSplitKeyWalletCustodyStatuses, lockWalletCustodyUnlockSessions, readWalletCustodyStatus, recoverWalletCustodyPassphrase } from "../wallet/wallet-custody.js";
 import { readWalletStatusSnapshot, resolveWalletConfigForRuntime } from "../wallet/wallet-status.js";
-import { startLocalSocketSignerBroker } from "../wallet/local-socket-signer-broker.js";
+import { createLockedSignerOwnedWallet } from "../wallet/local-socket-signer-lifecycle.js";
+import { normalizeNativeSignerWalletId } from "../wallet/native-signer-wallet-id.js";
+import { configureSignerOwnedWalletNetwork } from "../wallet/signer-network-admin.js";
 import { listWalletInboundEvents, pollWalletInboundEvents, reconcileWalletInboundEvents } from "../wallet/wallet-inbound-events.js";
 import { buildWalletCanaryReport, runWalletProviderCanaryReport } from "../wallet/wallet-canary.js";
-import { resolveSignerdBinaryPath, restartLocalSocketSigner } from "../wizard/onboarding.wallet.js";
+import { installSignerdBinary, resolveSignerdBinaryPath, restartLocalSocketSigner, writeLocalSignerEnvFile } from "../wizard/onboarding.wallet.js";
 import syncFs from "node:fs";
 import path from "node:path";
-import { createCipheriv, createDecipheriv, createPrivateKey, createPublicKey, randomBytes, scryptSync } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 
 //#region src/commands/wallet.ts
-const PRIVATE_KEY_PRINT_CONFIRMATION = "SHOW PRIVATE KEY";
-const KEYSTORE_EXPORT_CONFIRMATION = "EXPORT KEYSTORE";
-function normalizeDangerousConfirmation(value) {
-	return String(value ?? "").trim();
-}
-function requirePrivateKeyPrintConfirmation(value) {
-	if (normalizeDangerousConfirmation(value) !== PRIVATE_KEY_PRINT_CONFIRMATION) {
-		throw new Error(`Printing a private key requires explicit confirmation. Re-run with confirmation text "${PRIVATE_KEY_PRINT_CONFIRMATION}".`);
-	}
-}
-function requireKeystoreSecretExportConfirmation(value) {
-	if (normalizeDangerousConfirmation(value) !== KEYSTORE_EXPORT_CONFIRMATION) {
-		throw new Error(`Including encrypted keystore material requires explicit confirmation. Re-run with confirmation text "${KEYSTORE_EXPORT_CONFIRMATION}".`);
-	}
-}
 function resolveConfiguredMiningWalletId(cfg) {
 	const config = cfg.plugins?.entries?.["sat-mining"]?.config;
 	if (!config || typeof config !== "object" || Array.isArray(config)) {
@@ -48,55 +33,16 @@ function normalizeWalletRoleForCli(value) {
 	const role = normalizeWalletUserRole(value);
 	return role === "agent" || role === "vault" ? role : undefined;
 }
-function resolveLegacyLocalSignerEmbeddedScope(params) {
-	const effectiveEnv = {
-		...params.env,
-		...params.cfg.env?.vars
-	};
-	const walletId = params.walletId?.trim() || undefined;
-	const keystorePath = resolveEmbeddedKeystorePathForChain(effectiveEnv, params.chain, undefined, walletId);
-	const rpcUrl = resolveRpcUrlForChain(effectiveEnv, params.chain, walletId);
-	return {
-		effectiveEnv,
-		keystorePath,
-		rpcUrl
-	};
-}
-function createLegacyLocalSignerEmbeddedAdapter(params) {
-	const { effectiveEnv, keystorePath, rpcUrl } = resolveLegacyLocalSignerEmbeddedScope(params);
-	const scopedEnv = {
-		...effectiveEnv,
-		FASED_WALLET_KEYSTORE_PATH: keystorePath,
-		FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL: rpcUrl,
-		FASED_WALLET_RPC_URL: rpcUrl
-	};
-	const scopedCfg = {
-		...params.cfg,
-		wallet: {
-			...params.cfg.wallet,
-			keystore: {
-				...params.cfg.wallet?.keystore,
-				path: keystorePath
-			}
-		}
-	};
-	return createWalletProviderAdapter({
-		cfg: scopedCfg,
-		wallet: {
-			...resolveWalletConfigForRuntime(scopedCfg, scopedEnv),
-			chains: [params.chain]
-		},
-		env: scopedEnv,
-		providerIdOverride: "embedded-keystore"
-	});
+function createLegacyLocalSignerEmbeddedAdapter() {
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy embedded adapter construction requested");
 }
 function parseWalletProviderId(input) {
 	switch ((input ?? "").trim()) {
-		case "embedded-keystore":
+		case "embedded-keystore": throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet provider requested");
 		case "local-socket-signer":
 		case "alchemy":
-		case "turnkey":
-		case "privy": return input;
+		case "turnkey": return input;
+		case "privy": throw new Error("Privy wallet creation and signing are unavailable.");
 		default: return undefined;
 	}
 }
@@ -127,22 +73,7 @@ function isWalletRuntime(value) {
 	return value === "external-docker" || value === "external-custom";
 }
 function throwLegacyDockerSignerRemoved(command) {
-	throw new Error(`${command} is no longer supported. Use \`fased wallet keystore ...\` or hosted providers (turnkey/privy/alchemy).`);
-}
-function resolveEmbeddedKeystorePath(env, explicit) {
-	const custom = explicit?.trim() || String(env.FASED_WALLET_KEYSTORE_PATH ?? "").trim();
-	if (custom) {
-		return path.resolve(custom);
-	}
-	const paths = ensureWalletStateDir(env);
-	return path.join(paths.rootDir, "keystore.v1.enc");
-}
-function normalizeWalletIdForFilename(walletId) {
-	const raw = String(walletId ?? "").trim().toLowerCase();
-	if (!raw) {
-		return undefined;
-	}
-	return raw.replace(/[^a-z0-9_-]+/g, "-");
+	throw new Error(`${command} is no longer supported. Use the native fased-signerd, Wallet Standard hardware custody, or Turnkey.`);
 }
 function normalizeWalletIdForEnvSuffix(walletId) {
 	const raw = String(walletId ?? "").trim().toLowerCase();
@@ -172,7 +103,7 @@ function setConfigEnvVar(cfg, key, value) {
 	};
 }
 const JUPITER_API_KEY_ENV = "FASED_JUPITER_API_KEY";
-const JUPITER_TRIGGER_API_BASE_URL_ENV = "FASED_JUPITER_TRIGGER_API_BASE_URL";
+const LEGACY_JUPITER_TRIGGER_API_BASE_URL_ENV = "FASED_JUPITER_TRIGGER_API_BASE_URL";
 function resolveConfiguredJupiterApiKey(cfg, env) {
 	return String(env[JUPITER_API_KEY_ENV] ?? cfg.env?.vars?.[JUPITER_API_KEY_ENV] ?? env.JUPITER_API_KEY ?? cfg.env?.vars?.JUPITER_API_KEY ?? "").trim();
 }
@@ -236,31 +167,30 @@ async function promptCliSecret(question, fallback = "") {
 }
 async function walletLimitOrdersConfigureCommand(runtime = defaultRuntime, options = {}) {
 	if (options.enable && options.disable) {
-		throw new Error("Use either --enable or --disable for Jupiter wallet-action support, not both.");
+		throw new Error("Use either --enable or --disable for Jupiter Swap API access, not both.");
 	}
 	const env = process.env;
 	let cfg = loadConfig();
 	if (options.disable) {
 		cfg = setConfigEnvVar(cfg, JUPITER_API_KEY_ENV, undefined);
-		cfg = setConfigEnvVar(cfg, JUPITER_TRIGGER_API_BASE_URL_ENV, undefined);
+		cfg = setConfigEnvVar(cfg, LEGACY_JUPITER_TRIGGER_API_BASE_URL_ENV, undefined);
 		await writeConfigFile(cfg, { envSnapshotForRestore: process.env });
 		delete env[JUPITER_API_KEY_ENV];
-		delete env[JUPITER_TRIGGER_API_BASE_URL_ENV];
+		delete env[LEGACY_JUPITER_TRIGGER_API_BASE_URL_ENV];
 		if (options.json) {
 			runtime.log(JSON.stringify({
 				ok: true,
 				enabled: false
 			}, null, 2));
 		} else {
-			runtime.log("Jupiter wallet-action support disabled. Other approved wallet actions can still use the normal wallet flow.");
+			runtime.log("Gateway Jupiter Swap API access disabled. Signer-owned Trigger configuration is unchanged.");
 		}
 		return;
 	}
 	const existingKey = resolveConfiguredJupiterApiKey(cfg, env);
-	const existingBaseUrl = String(env[JUPITER_TRIGGER_API_BASE_URL_ENV] ?? cfg.env?.vars?.[JUPITER_TRIGGER_API_BASE_URL_ENV] ?? "").trim();
-	let shouldEnable = options.enable === true || Boolean(options.jupiterApiKey?.trim()) || Boolean(options.jupiterTriggerApiBaseUrl?.trim());
+	let shouldEnable = options.enable === true || Boolean(options.jupiterApiKey?.trim());
 	if (!shouldEnable && !options.nonInteractive) {
-		const answer = await promptCliText("Enable Jupiter support for policy-gated Agent wallet actions? [y/N]", existingKey ? "y" : "n");
+		const answer = await promptCliText("Enable Gateway Jupiter Swap API access? Trigger credentials remain signer-owned. [y/N]", existingKey ? "y" : "n");
 		shouldEnable = answer.trim().toLowerCase().startsWith("y");
 	}
 	if (!shouldEnable) {
@@ -271,36 +201,35 @@ async function walletLimitOrdersConfigureCommand(runtime = defaultRuntime, optio
 				configured: Boolean(existingKey)
 			}, null, 2));
 		} else {
-			runtime.log(existingKey ? "Jupiter wallet-action support already configured." : "Jupiter wallet-action support not configured.");
+			runtime.log(existingKey ? "Gateway Jupiter Swap API access already configured." : "Gateway Jupiter Swap API access not configured.");
 		}
 		return;
 	}
 	let apiKey = String(options.jupiterApiKey ?? "").trim() || existingKey;
 	if (!apiKey && !options.nonInteractive) {
-		apiKey = await promptCliSecret("Jupiter API key");
+		apiKey = await promptCliSecret("Jupiter Swap API key");
 	}
 	if (!apiKey) {
-		throw new Error("Jupiter wallet-action support requires a Jupiter API key. Pass --jupiter-api-key or set FASED_JUPITER_API_KEY.");
+		throw new Error("Jupiter swap crafting requires an API key. Pass --jupiter-api-key or set FASED_JUPITER_API_KEY.");
 	}
-	const triggerApiBaseUrl = String(options.jupiterTriggerApiBaseUrl ?? "").trim() || existingBaseUrl;
 	cfg = setConfigEnvVar(cfg, JUPITER_API_KEY_ENV, apiKey);
-	if (triggerApiBaseUrl) {
-		cfg = setConfigEnvVar(cfg, JUPITER_TRIGGER_API_BASE_URL_ENV, triggerApiBaseUrl);
-		env[JUPITER_TRIGGER_API_BASE_URL_ENV] = triggerApiBaseUrl;
-	}
+	cfg = setConfigEnvVar(cfg, LEGACY_JUPITER_TRIGGER_API_BASE_URL_ENV, undefined);
 	await writeConfigFile(cfg, { envSnapshotForRestore: process.env });
 	env[JUPITER_API_KEY_ENV] = apiKey;
+	delete env[LEGACY_JUPITER_TRIGGER_API_BASE_URL_ENV];
 	if (options.json) {
 		runtime.log(JSON.stringify({
 			ok: true,
 			enabled: true,
 			jupiterApiKeyConfigured: true,
-			triggerApiBaseUrl: triggerApiBaseUrl || undefined
+			scope: "gateway-jupiter-swap-only",
+			triggerCredentials: "signer-owned"
 		}, null, 2));
 		return;
 	}
-	runtime.log("Jupiter wallet-action support enabled for Agent wallet actions.");
-	runtime.log(`Stored ${JUPITER_API_KEY_ENV} in local config env vars.`);
+	runtime.log("Gateway Jupiter Swap API access enabled for Agent wallet swap crafting.");
+	runtime.log(`Stored ${JUPITER_API_KEY_ENV} in local config env vars for swaps only.`);
+	runtime.log("Jupiter Trigger credentials and production API routing are owned by fased-signerd and are not configured in Gateway.");
 }
 function normalizeWalletChainsForSigner(chains) {
 	const out = new Set();
@@ -324,91 +253,6 @@ function resolveLocalSignerChainsEnvValue(cfg, env) {
 	}
 	return normalizeWalletChainsForSigner(cfg.wallet?.runtime?.chains).join(",");
 }
-function collectLocalSignerExportEnv(cfg, env) {
-	const effectiveEnv = {
-		...env,
-		...cfg.env?.vars
-	};
-	const exportablePrefixes = [
-		"FASED_WALLET_SOLANA_KEYSTORE_PATH",
-		"FASED_WALLET_SOLANA_RPC_URL",
-		"FASED_WALLET_RPC_URL",
-		"FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL"
-	];
-	const out = {};
-	for (const [key, rawValue] of Object.entries(effectiveEnv)) {
-		if (!exportablePrefixes.some((prefix) => key === prefix || key.startsWith(`${prefix}__`))) {
-			continue;
-		}
-		const value = String(rawValue ?? "").trim();
-		if (!value) {
-			continue;
-		}
-		out[key] = value;
-	}
-	return out;
-}
-function walletPolicyEnvSuffix(walletId) {
-	return walletId.trim().toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-}
-function addLocalSignerPolicyEnv(out, params) {
-	const key = (name) => `${name}${params.prefix}`;
-	out[key("FASED_WALLET_LOCAL_SIGNER_ROLE")] = params.role;
-	out[key("FASED_WALLET_LOCAL_SIGNER_DIRECT_SIGNING")] = params.policy.directSigning ? "1" : "0";
-	out[key("FASED_WALLET_LOCAL_SIGNER_CAPS_ENABLED")] = params.policy.capsEnabled ? "1" : "0";
-	out[key("FASED_WALLET_LOCAL_SIGNER_SOLANA_MAX_PER_TX")] = params.policy.solana.caps.maxPerTx.toString();
-	out[key("FASED_WALLET_LOCAL_SIGNER_SOLANA_MAX_DAILY")] = params.policy.solana.caps.maxDaily.toString();
-	if (params.policy.solana.allowPrograms.length > 0) {
-		out[key("FASED_WALLET_LOCAL_SIGNER_SOLANA_ALLOW_PROGRAMS")] = params.policy.solana.allowPrograms.join(",");
-	}
-}
-function collectLocalSignerPolicyExportEnv(cfg, env) {
-	const out = {};
-	const registry = readWalletProviderRegistry(env);
-	const localSignerWallets = registry.wallets.filter((wallet) => wallet.providerId === "local-socket-signer" && wallet.id.trim());
-	if (localSignerWallets.length === 0) {
-		return out;
-	}
-	const baseRuntime = resolveWalletRuntimeConfig(cfg, env);
-	for (const wallet of localSignerWallets) {
-		const role = resolveWalletRoleForId({
-			walletId: wallet.id,
-			cfg,
-			env
-		});
-		const runtime = applyWalletPolicyConfig({
-			config: baseRuntime,
-			cfg,
-			env,
-			walletId: wallet.id
-		});
-		const suffix = walletPolicyEnvSuffix(wallet.id);
-		if (!suffix) {
-			continue;
-		}
-		addLocalSignerPolicyEnv(out, {
-			prefix: `__${suffix}`,
-			role,
-			policy: runtime.policy
-		});
-		if (registry.defaultWalletId === wallet.id || localSignerWallets.length === 1) {
-			addLocalSignerPolicyEnv(out, {
-				prefix: "",
-				role,
-				policy: runtime.policy
-			});
-		}
-	}
-	return out;
-}
-function keystoreEnvKeyFor(chain, walletId) {
-	void chain;
-	const suffix = walletIdEnvSuffix(walletId);
-	if (suffix) {
-		return `FASED_WALLET_SOLANA_KEYSTORE_PATH__${suffix}`;
-	}
-	return "FASED_WALLET_SOLANA_KEYSTORE_PATH";
-}
 function rpcEnvKeyFor(chain, walletId) {
 	void chain;
 	const suffix = walletIdEnvSuffix(walletId);
@@ -417,6 +261,10 @@ function rpcEnvKeyFor(chain, walletId) {
 	}
 	return "FASED_WALLET_SOLANA_RPC_URL";
 }
+function fallbackRpcEnvKeyFor(walletId) {
+	const suffix = walletIdEnvSuffix(walletId);
+	return suffix ? `FASED_WALLET_SOLANA_WRITE_RPC_FALLBACK_URL__${suffix}` : "FASED_WALLET_SOLANA_WRITE_RPC_FALLBACK_URL";
+}
 function resolveRpcUrlForChain(env, chain, walletId, explicit) {
 	const explicitValue = explicit?.trim();
 	if (explicitValue) {
@@ -427,579 +275,34 @@ function resolveRpcUrlForChain(env, chain, walletId, explicit) {
 	const perChainKey = "FASED_WALLET_SOLANA_RPC_URL";
 	const scopedOrChain = (perWalletKey ? String(env[perWalletKey] ?? "").trim() : "") || String(env[perChainKey] ?? "").trim();
 	void chain;
-	return scopedOrChain || String(env.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim();
-}
-function defaultKeystoreFilenameFor(chain, walletId) {
-	void chain;
-	const normalized = normalizeWalletIdForFilename(walletId);
-	if (!normalized || normalized === "default") {
-		return "keystore-solana.v1.enc";
-	}
-	return `keystore-solana-${normalized}.v1.enc`;
-}
-function resolveEmbeddedKeystorePathForChain(env, chain, explicit, walletId) {
-	const explicitPath = explicit?.trim();
-	if (explicitPath) {
-		return path.resolve(explicitPath);
-	}
-	const suffix = walletIdEnvSuffix(walletId);
-	const perChainEnvKey = "FASED_WALLET_SOLANA_KEYSTORE_PATH";
-	const perWalletEnvKey = suffix ? `FASED_WALLET_SOLANA_KEYSTORE_PATH__${suffix}` : undefined;
-	const scopedPath = perWalletEnvKey ? String(env[perWalletEnvKey] ?? "").trim() : "";
-	if (scopedPath) {
-		return path.resolve(scopedPath);
-	}
-	const normalizedWalletId = normalizeWalletIdForFilename(walletId);
-	if (normalizedWalletId && normalizedWalletId !== "default") {
-		return path.join(resolveLocalSignerMaterialRootDir(env), defaultKeystoreFilenameFor(chain, walletId));
-	}
-	const genericPath = String(env[perChainEnvKey] ?? "").trim() || String(env.FASED_WALLET_KEYSTORE_PATH ?? "").trim();
-	if (genericPath) {
-		return path.resolve(genericPath);
-	}
-	return path.join(resolveLocalSignerMaterialRootDir(env), defaultKeystoreFilenameFor(chain, walletId));
-}
-const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
-const ED25519_PKCS8_SEED_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
-const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
-function decodeBase58(input) {
-	const text = input.trim();
-	if (!text) {
-		return new Uint8Array();
-	}
-	let num = 0n;
-	for (const ch of text) {
-		const idx = BASE58_ALPHABET.indexOf(ch);
-		if (idx < 0) {
-			throw new Error(`invalid base58 character: ${ch}`);
-		}
-		num = num * 58n + BigInt(idx);
-	}
-	const bytes = [];
-	while (num > 0n) {
-		bytes.push(Number(num % 256n));
-		num /= 256n;
-	}
-	bytes.reverse();
-	let leadingZeros = 0;
-	for (const ch of text) {
-		if (ch === "1") {
-			leadingZeros += 1;
-		} else {
-			break;
-		}
-	}
-	return Uint8Array.from([...Array.from({ length: leadingZeros }, () => 0), ...bytes]);
-}
-function encodeBase58(input) {
-	if (input.length === 0) {
-		return "";
-	}
-	let num = 0n;
-	for (const b of input) {
-		num = (num << 8n) + BigInt(b);
-	}
-	let encoded = "";
-	while (num > 0n) {
-		const idx = Number(num % 58n);
-		encoded = BASE58_ALPHABET[idx] + encoded;
-		num /= 58n;
-	}
-	let leadingZeros = 0;
-	for (const b of input) {
-		if (b === 0) {
-			leadingZeros += 1;
-		} else {
-			break;
-		}
-	}
-	return `${"1".repeat(leadingZeros)}${encoded}`;
-}
-function deriveEd25519PublicKeyFromSeed(seed) {
-	if (seed.length !== 32) {
-		throw new Error(`invalid Ed25519 seed length: ${seed.length} (expected 32)`);
-	}
-	const privateKey = createPrivateKey({
-		key: Buffer.concat([ED25519_PKCS8_SEED_PREFIX, Buffer.from(seed)]),
-		format: "der",
-		type: "pkcs8"
-	});
-	const spki = Buffer.from(createPublicKey(privateKey).export({
-		format: "der",
-		type: "spki"
-	}));
-	if (spki.length !== ED25519_SPKI_PREFIX.length + 32 || !spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) {
-		throw new Error("failed to derive Ed25519 public key");
-	}
-	return Uint8Array.from(spki.subarray(ED25519_SPKI_PREFIX.length));
-}
-function normalizeSolanaSecretKey(secret) {
-	if (secret.length === 64) {
-		return secret;
-	}
-	if (secret.length === 32) {
-		const publicKey = deriveEd25519PublicKeyFromSeed(secret);
-		return Uint8Array.from([...secret, ...publicKey]);
-	}
-	throw new Error(`invalid Solana secret key length: ${secret.length} (expected 32 or 64)`);
-}
-function solanaAddressFromSecretKey(secretKey) {
-	if (secretKey.length !== 64) {
-		throw new Error(`invalid Solana secret key length: ${secretKey.length} (expected 64)`);
-	}
-	return encodeBase58(secretKey.slice(32));
-}
-async function callRpcMethod(rpcUrl, method, params) {
-	const response = await fetch(rpcUrl, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({
-			jsonrpc: "2.0",
-			id: `${method}-${Date.now()}`,
-			method,
-			params
-		})
-	});
-	if (!response.ok) {
-		throw new Error(`rpc ${method} http ${response.status}`);
-	}
-	const payload = await response.json();
-	if (payload.error) {
-		throw new Error(payload.error.message || `rpc ${method} error`);
-	}
-	if (!payload.result || typeof payload.result !== "object") {
-		throw new Error(`rpc ${method} missing result`);
-	}
-	return payload.result;
-}
-function parseSolanaSecretKey(raw) {
-	const text = raw.trim();
-	if (!text) {
-		throw new Error("missing Solana private key");
-	}
-	if (text.startsWith("[")) {
-		const parsed = JSON.parse(text);
-		if (!Array.isArray(parsed)) {
-			throw new Error("invalid Solana key JSON");
-		}
-		const bytes = Uint8Array.from(parsed.map((v) => {
-			const n = Number(v);
-			if (!Number.isInteger(n) || n < 0 || n > 255) {
-				throw new Error("invalid Solana secret key byte");
-			}
-			return n;
-		}));
-		return normalizeSolanaSecretKey(bytes);
-	}
-	const normalized = text.replace(/^0x/i, "");
-	if (/^[0-9a-fA-F]+$/.test(normalized) && normalized.length % 2 === 0) {
-		const bytes = Uint8Array.from(Buffer.from(normalized, "hex"));
-		if (bytes.length === 32 || bytes.length === 64) {
-			return normalizeSolanaSecretKey(bytes);
-		}
-	}
-	try {
-		const bytes = Uint8Array.from(Buffer.from(text, "base64"));
-		if (bytes.length === 32 || bytes.length === 64) {
-			return normalizeSolanaSecretKey(bytes);
-		}
-	} catch {}
-	try {
-		const bytes = Uint8Array.from(Buffer.from(text, "base64url"));
-		if (bytes.length === 32 || bytes.length === 64) {
-			return normalizeSolanaSecretKey(bytes);
-		}
-	} catch {}
-	try {
-		const bytes = decodeBase58(text);
-		if (bytes.length === 64) {
-			return normalizeSolanaSecretKey(bytes);
-		}
-	} catch {}
-	throw new Error("Unsupported Solana secret key format. Use JSON byte array [32/64 bytes], base64/base64url, base58 (64-byte secret), or hex.");
-}
-function encryptSolanaKeypairEnvelope(params) {
-	const salt = randomBytes(16);
-	const iv = randomBytes(12);
-	const key = scryptSync(params.passphrase, salt, 32);
-	const cipher = createCipheriv("aes-256-gcm", key, iv);
-	const ciphertext = Buffer.concat([cipher.update(Buffer.from(params.secretKey)), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		kind: "fased-solana-keypair",
-		version: 1,
-		kdf: "scrypt",
-		cipher: "aes-256-gcm",
-		salt: salt.toString("base64url"),
-		iv: iv.toString("base64url"),
-		authTag: authTag.toString("base64url"),
-		ciphertext: ciphertext.toString("base64url"),
-		publicKey: params.publicKey
-	};
-}
-function parseSolanaKeystoreEnvelope(raw) {
-	try {
-		const parsed = JSON.parse(raw);
-		if (parsed.kind !== "fased-solana-keypair" || parsed.version !== 1 || parsed.kdf !== "scrypt" || parsed.cipher !== "aes-256-gcm") {
-			return null;
-		}
-		if (typeof parsed.salt !== "string" || typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string" || typeof parsed.publicKey !== "string") {
-			return null;
-		}
-		return parsed;
-	} catch {
-		return null;
-	}
-}
-function decryptSolanaKeypairEnvelope(envelope, passphrase) {
-	const salt = Buffer.from(envelope.salt, "base64url");
-	const iv = Buffer.from(envelope.iv, "base64url");
-	const authTag = Buffer.from(envelope.authTag, "base64url");
-	const ciphertext = Buffer.from(envelope.ciphertext, "base64url");
-	const key = scryptSync(passphrase, salt, 32);
-	const decipher = createDecipheriv("aes-256-gcm", key, iv);
-	decipher.setAuthTag(authTag);
-	const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-	if (plaintext.length !== 64) {
-		throw new Error(`invalid decrypted Solana secret key length: ${plaintext.length}`);
-	}
-	return Uint8Array.from(plaintext);
-}
-function detectEmbeddedKeystoreType(raw) {
-	if (parseSolanaKeystoreEnvelope(raw)) {
-		return "solana-envelope";
-	}
-	return "unknown";
-}
-function resolveKeystorePassphrase(optionsPassphrase, env) {
-	if (optionsPassphrase?.trim()) {
-		return optionsPassphrase.trim();
-	}
-	const file = String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim();
-	if (file && syncFs.existsSync(file)) {
-		return syncFs.readFileSync(file, "utf8").trim();
-	}
-	const managedFile = path.join(resolveLocalSignerMaterialRootDir(env), "passphrase");
-	if (syncFs.existsSync(managedFile)) {
-		return syncFs.readFileSync(managedFile, "utf8").trim();
-	}
-	return String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
-}
-function resolvePassphraseFilePath(env, explicit) {
-	const provided = explicit?.trim() || String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim();
-	if (provided) {
-		return path.resolve(provided);
-	}
-	return path.join(resolveLocalSignerMaterialRootDir(env), "passphrase");
-}
-function resolveLocalSignerPassphraseSource(env) {
-	const configuredFile = String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim();
-	const candidates = [configuredFile ? path.resolve(configuredFile) : "", path.join(resolveLocalSignerMaterialRootDir(env), "passphrase")].filter(Boolean);
-	for (const candidate of candidates) {
-		try {
-			const value = syncFs.readFileSync(candidate, "utf8").trim();
-			if (value) {
-				return {
-					kind: "file",
-					path: candidate,
-					value
-				};
-			}
-		} catch {}
-	}
-	const explicit = String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
-	if (explicit) {
-		return {
-			kind: "value",
-			value: explicit
-		};
-	}
-	return { kind: "none" };
-}
-function renderLocalSignerPassphraseEnvLines(env) {
-	if (String(env.FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER ?? "").trim()) {
-		const file = String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim() || path.join(resolveLocalSignerMaterialRootDir(env), "passphrase");
-		return [`export FASED_WALLET_PASSPHRASE_FILE="${file.replaceAll("\"", "\\\"")}"`];
-	}
-	const source = resolveLocalSignerPassphraseSource(env);
-	if (source.kind === "file") {
-		return [`export FASED_WALLET_PASSPHRASE_FILE="${source.path.replaceAll("\"", "\\\"")}"`];
-	}
-	if (source.kind === "value") {
-		return [`export FASED_WALLET_PASSPHRASE="${source.value.replaceAll("\"", "\\\"")}"`];
-	}
-	return [];
-}
-function ensureLocalSignerPassphraseForSetup(runtime, env) {
-	const existing = resolveLocalSignerPassphraseSource(env);
-	if (existing.kind === "file") {
-		env.FASED_WALLET_PASSPHRASE_FILE = existing.path;
-		delete env.FASED_WALLET_PASSPHRASE;
-		return existing.value;
-	}
-	if (existing.kind === "value") {
-		env.FASED_WALLET_PASSPHRASE = existing.value;
-		delete env.FASED_WALLET_PASSPHRASE_FILE;
-		return existing.value;
-	}
-	const generated = randomBytes(24).toString("base64url");
-	const passphraseFile = path.join(resolveLocalSignerMaterialRootDir(env), "passphrase");
-	writePassphraseFile(passphraseFile, generated);
-	env.FASED_WALLET_PASSPHRASE_FILE = passphraseFile;
-	delete env.FASED_WALLET_PASSPHRASE;
-	runtime.log("No wallet passphrase configured. Creating a managed signer passphrase file (0600).");
-	return generated;
-}
-function ensureLocalSignerPassphraseFileForCustodyDisable(params) {
-	const effectiveEnv = {
-		...params.env,
-		...params.cfg.env?.vars
-	};
-	const existing = resolveLocalSignerPassphraseSource(effectiveEnv);
-	let passphrase = "";
-	let passphraseFile = "";
-	if (existing.kind === "file") {
-		passphrase = existing.value;
-		passphraseFile = existing.path;
-	} else {
-		passphrase = existing.kind === "value" && existing.value.trim() ? existing.value.trim() : randomBytes(24).toString("base64url");
-		passphraseFile = resolvePassphraseFilePath(effectiveEnv);
-		writePassphraseFile(passphraseFile, passphrase);
-	}
-	let nextCfg = setConfigEnvVar(params.cfg, "FASED_WALLET_PASSPHRASE_FILE", passphraseFile);
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_PASSPHRASE", undefined);
-	return {
-		passphrase,
-		passphraseFile,
-		cfg: nextCfg
-	};
-}
-function writePassphraseFile(filePath, passphrase) {
-	syncFs.mkdirSync(path.dirname(filePath), {
-		recursive: true,
-		mode: 448
-	});
-	syncFs.writeFileSync(filePath, `${passphrase}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	try {
-		syncFs.chmodSync(filePath, 384);
-	} catch {}
-}
-function walletIdsMatchForEnvSuffix(left, right) {
-	const normalizedLeft = (left?.trim() || "default").toLowerCase();
-	const normalizedRight = (right?.trim() || "default").toLowerCase();
-	return normalizedLeft === normalizedRight || normalizeWalletIdForEnvSuffix(normalizedLeft) === normalizeWalletIdForEnvSuffix(normalizedRight);
-}
-function normalizeCustodyWalletId(walletId) {
-	return normalizeWalletIdForEnvSuffix(walletId?.trim() || "default") || "default";
-}
-function parseCustodyWalletSet(env) {
-	const out = new Set();
-	for (const part of String(env.FASED_WALLET_CUSTODY_WALLETS ?? "").split(",")) {
-		if (!part.trim()) {
-			continue;
-		}
-		const normalized = normalizeCustodyWalletId(part);
-		if (normalized) {
-			out.add(normalized);
-		}
-	}
-	return out;
-}
-function formatCustodyWalletSet(values) {
-	return [...values].filter(Boolean).toSorted().join(",");
-}
-function collectLocalSignerKeystoreTargets(cfg, env) {
-	const effectiveEnv = {
-		...env,
-		...cfg.env?.vars
-	};
-	const targets = new Map();
-	const materialRoot = resolveLocalSignerMaterialRootDir(effectiveEnv);
-	const addTarget = (chain, rawPath, walletId) => {
-		const candidate = rawPath?.trim();
-		if (!candidate) {
-			return;
-		}
-		const resolved = path.resolve(candidate);
-		if (!syncFs.existsSync(resolved)) {
-			return;
-		}
-		const existing = targets.get(resolved);
-		if (existing) {
-			return;
-		}
-		targets.set(resolved, {
-			chain,
-			walletId,
-			path: resolved,
-			label: walletId ? `${chain}.${walletId}` : `${chain}.default`
-		});
-	};
-	const addDefaultChainTarget = (chain) => {
-		addTarget(chain, resolveEmbeddedKeystorePathForChain(effectiveEnv, chain), "default");
-	};
-	addDefaultChainTarget("solana");
-	for (const [key, rawValue] of Object.entries(effectiveEnv)) {
-		const value = String(rawValue ?? "").trim();
-		if (!value) {
-			continue;
-		}
-		if (key.startsWith("FASED_WALLET_SOLANA_KEYSTORE_PATH__")) {
-			addTarget("solana", value, key.slice("FASED_WALLET_SOLANA_KEYSTORE_PATH__".length).toLowerCase());
-		}
-	}
-	if (syncFs.existsSync(materialRoot)) {
-		for (const entry of syncFs.readdirSync(materialRoot, { withFileTypes: true })) {
-			if (!entry.isFile()) {
-				continue;
-			}
-			const name = entry.name;
-			let chain = null;
-			let walletId;
-			if (/^keystore-solana(?:-(.+))?\.v1\.enc$/i.test(name)) {
-				chain = "solana";
-				walletId = /^keystore-solana-(.+)\.v1\.enc$/i.exec(name)?.[1];
-			}
-			if (!chain) {
-				continue;
-			}
-			addTarget(chain, path.join(materialRoot, name), walletId);
-		}
-	}
-	return [...targets.values()].toSorted((left, right) => left.label.localeCompare(right.label));
-}
-async function reencryptLocalSignerKeystore(params) {
-	const raw = syncFs.readFileSync(params.target.path, "utf8");
-	const detected = detectEmbeddedKeystoreType(raw);
-	if (detected === "solana-envelope") {
-		const envelope = parseSolanaKeystoreEnvelope(raw);
-		if (!envelope) {
-			throw new Error(`invalid Solana keystore envelope: ${params.target.path}`);
-		}
-		const secretKey = decryptSolanaKeypairEnvelope(envelope, params.oldPassphrase);
-		const nextEnvelope = encryptSolanaKeypairEnvelope({
-			secretKey,
-			passphrase: params.newPassphrase,
-			publicKey: envelope.publicKey
-		});
-		syncFs.writeFileSync(params.target.path, `${JSON.stringify(nextEnvelope, null, 2)}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-		return;
-	}
-	throw new Error(`unsupported keystore format for ${params.target.path}`);
-}
-function clearConfiguredSignerPassphrase(cfg) {
-	let nextCfg = setConfigEnvVar(cfg, "FASED_WALLET_PASSPHRASE", undefined);
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_PASSPHRASE_FILE", undefined);
-	return nextCfg;
-}
-function removeLocalSignerPassphraseFileIfManaged(env) {
-	const configured = String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim();
-	if (!configured) {
-		return { removed: false };
-	}
-	const resolved = path.resolve(configured);
-	const materialRoot = resolveLocalSignerMaterialRootDir(env);
-	const withinMaterialRoot = resolved === materialRoot || resolved.startsWith(`${materialRoot}${path.sep}`);
-	if (!withinMaterialRoot || !syncFs.existsSync(resolved)) {
-		return {
-			removed: false,
-			path: resolved
-		};
-	}
-	syncFs.rmSync(resolved, { force: true });
-	return {
-		removed: true,
-		path: resolved
-	};
-}
-function writeLocalSignerEnvFile(cfg, env) {
-	const effectiveEnv = {
-		...env,
-		...cfg.env?.vars
-	};
-	const socketPath = resolveLocalSignerSocketPath(effectiveEnv);
-	const backendSocketPath = resolveLocalSignerBackendSocketPath(effectiveEnv);
-	const materialRoot = resolveLocalSignerMaterialRootDir(effectiveEnv);
-	const signerBinPath = resolveSignerdBinaryPath(effectiveEnv);
-	const signerEnvPath = path.resolve(ensureWalletStateDir(env).rootDir, "signer.env");
-	const custodyKeys = [
-		"FASED_WALLET_CUSTODY_MODE",
-		"FASED_WALLET_CUSTODY_WALLETS",
-		"FASED_WALLET_CUSTODY_PASSKEY_CEREMONY",
-		"FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION",
-		"FASED_WALLET_CUSTODY_PHASE2_COMPLETE"
-	];
-	const custodyEnvLines = custodyKeys.map((key) => [key, String(effectiveEnv[key] ?? "").trim()]).filter(([, value]) => Boolean(value)).map(([key, value]) => `export ${key}="${value}"`);
-	const signerEnvLines = [
-		`export FASED_WALLET_LOCAL_SIGNER_SOCKET="${socketPath}"`,
-		...backendSocketPath !== socketPath ? [`export FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET="${backendSocketPath}"`] : [],
-		...materialRoot !== ensureWalletStateDir(env).rootDir ? [`export FASED_WALLET_SIGNER_STATE_DIR="${materialRoot}"`] : [],
-		`export FASED_WALLET_CHAINS="${resolveLocalSignerChainsEnvValue(cfg, effectiveEnv)}"`,
-		...renderLocalSignerPassphraseEnvLines(effectiveEnv),
-		...Object.entries({
-			...collectLocalSignerExportEnv(cfg, effectiveEnv),
-			...collectLocalSignerPolicyExportEnv(cfg, effectiveEnv)
-		}).toSorted(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `export ${key}="${value.replaceAll("\"", "\\\"")}"`),
-		...custodyEnvLines,
-		"",
-		`"${signerBinPath}" --socket "\${FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET:-$FASED_WALLET_LOCAL_SIGNER_SOCKET}"`
-	];
-	syncFs.mkdirSync(path.dirname(signerEnvPath), {
-		recursive: true,
-		mode: 448
-	});
-	syncFs.writeFileSync(signerEnvPath, `${signerEnvLines.join("\n")}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-}
-function ensureEmbeddedProviderConfig(cfg, params) {
-	let nextCfg = ensureWalletMaterialConfig(cfg, params);
-	const chain = params.chain ?? "solana";
-	const nextChains = new Set(nextCfg.wallet?.keystore?.chainSupport ?? []);
-	nextChains.add(chain);
-	nextCfg = {
-		...nextCfg,
-		wallet: {
-			...nextCfg.wallet,
-			provider: {
-				...nextCfg.wallet?.provider,
-				id: "embedded-keystore"
-			},
-			keystore: {
-				...nextCfg.wallet?.keystore,
-				enabled: true,
-				path: params.keystorePath,
-				chainSupport: nextChains.size > 0 ? [...nextChains] : ["solana"]
-			},
-			runtime: {
-				...cfg.wallet?.runtime,
-				enabled: false
-			}
-		}
-	};
-	return nextCfg;
-}
-function ensureWalletMaterialConfig(cfg, params) {
-	const chain = params.chain ?? "solana";
-	let nextCfg = setConfigEnvVar(cfg, keystoreEnvKeyFor(chain, params.walletId), params.keystorePath);
-	if (params.rpcUrl?.trim()) {
-		nextCfg = setConfigEnvVar(nextCfg, rpcEnvKeyFor(chain, params.walletId), params.rpcUrl);
-	}
-	return nextCfg;
+	return scopedOrChain || String(env.FASED_WALLET_RPC_URL ?? "").trim();
 }
 function ensureLocalSignerProviderConfig(cfg, env, socketPath) {
 	const effectiveSocketPath = socketPath?.trim() || resolveLocalSignerSocketPath(env);
 	let nextCfg = setConfigEnvVar(cfg, "FASED_WALLET_LOCAL_SIGNER_SOCKET", effectiveSocketPath);
-	const backendSocketPath = resolveLocalSignerBackendSocketPath(env);
-	if (backendSocketPath !== effectiveSocketPath) {
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET", backendSocketPath);
+	const hosted = String(env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
+	if (hosted) {
+		for (const key of [
+			"FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET",
+			"FASED_WALLET_LOCAL_SIGNER_CONTROL_SOCKET",
+			"FASED_WALLET_LOCAL_SIGNER_STATE_DB",
+			"FASED_WALLET_LOCAL_SIGNER_MASTER_KEY",
+			"FASED_WALLET_LOCAL_SIGNER_RUN_AS_USER",
+			"FASED_WALLET_LOCAL_SIGNER_BIN",
+			"FASED_WALLET_SIGNER_STATE_DIR",
+			"FASED_WALLET_PASSPHRASE_FILE"
+		]) {
+			nextCfg = setConfigEnvVar(nextCfg, key, undefined);
+		}
+	}
+	const controlSocketPath = resolveLocalSignerControlSocketPath(env);
+	const stateDbPath = resolveLocalSignerStateDbPath(env);
+	const masterKeyPath = resolveLocalSignerMasterKeyPath(env);
+	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET", undefined);
+	if (!hosted) {
+		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_LOCAL_SIGNER_CONTROL_SOCKET", controlSocketPath);
+		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_LOCAL_SIGNER_STATE_DB", stateDbPath);
+		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_LOCAL_SIGNER_MASTER_KEY", masterKeyPath);
 	}
 	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CHAINS", resolveLocalSignerChainsEnvValue(nextCfg, env));
 	return {
@@ -1022,7 +325,6 @@ function ensureLocalSignerProviderConfig(cfg, env, socketPath) {
 async function configureLocalSignerMode(runtime, options, env) {
 	const cfg = loadConfig();
 	const socketPath = resolveLocalSignerSocketPath(env);
-	const backendSocketPath = resolveLocalSignerBackendSocketPath(env);
 	const nextCfg = ensureLocalSignerProviderConfig(cfg, env, socketPath);
 	if (!options.noProviderIdUpdate) {
 		await writeConfigFile(nextCfg);
@@ -1032,43 +334,21 @@ async function configureLocalSignerMode(runtime, options, env) {
 	}
 	runtime.log("Signer mode: local native signer");
 	runtime.log(`Signer socket: ${socketPath}`);
-	const signerEnvPath = path.resolve(ensureWalletStateDir(process.env).rootDir, "signer.env");
-	const materialRoot = resolveLocalSignerMaterialRootDir(env);
 	const effectiveEnv = {
 		...env,
 		...nextCfg.env?.vars
 	};
-	const signerBinPath = resolveSignerdBinaryPath(effectiveEnv);
-	const signerEnvLines = [
-		`export FASED_WALLET_LOCAL_SIGNER_SOCKET="${socketPath}"`,
-		...backendSocketPath !== socketPath ? [`export FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET="${backendSocketPath}"`] : [],
-		...materialRoot !== ensureWalletStateDir(env).rootDir ? [`export FASED_WALLET_SIGNER_STATE_DIR="${materialRoot}"`] : [],
-		`export FASED_WALLET_CHAINS="${resolveLocalSignerChainsEnvValue(nextCfg, env)}"`,
-		...renderLocalSignerPassphraseEnvLines(effectiveEnv),
-		...Object.entries({
-			...collectLocalSignerExportEnv(nextCfg, env),
-			...collectLocalSignerPolicyExportEnv(nextCfg, env)
-		}).toSorted(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `export ${key}="${value.replaceAll("\"", "\\\"")}"`),
-		"",
-		`"${signerBinPath}" --socket "\${FASED_WALLET_LOCAL_SIGNER_BACKEND_SOCKET:-$FASED_WALLET_LOCAL_SIGNER_SOCKET}"`
-	];
-	syncFs.mkdirSync(path.dirname(signerEnvPath), {
-		recursive: true,
-		mode: 448
-	});
-	syncFs.writeFileSync(signerEnvPath, `${signerEnvLines.join("\n")}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	runtime.log("Recommended environment exports (set before starting fased-signerd):");
-	for (const line of signerEnvLines.slice(0, Math.min(8, signerEnvLines.length - 2))) {
-		runtime.log(`  ${line}`);
+	const hosted = String(env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
+	if (!hosted) {
+		const signerEnvPath = writeLocalSignerEnvFile({
+			config: nextCfg,
+			env: effectiveEnv
+		});
+		runtime.log(`Signer environment written: ${signerEnvPath} (mode 600)`);
+		runtime.log(`Start signer with the generated same-user signer environment.`);
+	} else {
+		runtime.log("Signer lifecycle is owned by the root-managed fased-signerd service.");
 	}
-	runtime.log(`Env file written: ${signerEnvPath} (mode 600)`);
-	runtime.log(`  source "${signerEnvPath}"`);
-	runtime.log("");
-	runtime.log("Start signer:");
-	runtime.log(`  "${signerBinPath}" --socket "$FASED_WALLET_LOCAL_SIGNER_SOCKET"`);
 	runtime.log("");
 	runtime.log("Then verify:");
 	runtime.log("  fased wallet signer doctor --json");
@@ -1084,21 +364,161 @@ async function configureLocalSignerMode(runtime, options, env) {
 		}
 	}
 }
+function findNativeSignerWalletIdCollision(wallets, friendlyWalletId, signerWalletId) {
+	return wallets.find((entry) => {
+		if (entry.id === friendlyWalletId || entry.providerId !== "local-socket-signer") {
+			return false;
+		}
+		const signerWalletIdMetadata = entry.metadata?.signerWalletId;
+		const registeredSignerWalletId = typeof signerWalletIdMetadata === "string" ? signerWalletIdMetadata.trim() : "";
+		return (registeredSignerWalletId || normalizeNativeSignerWalletId(entry.id)) === signerWalletId;
+	});
+}
+async function createSignerOwnedWalletForSetup(params) {
+	if (params.chain !== "solana") {
+		throw new Error("fased-signerd protocol v2 currently supports Solana wallet creation only");
+	}
+	const walletId = params.walletId?.trim() || params.role;
+	const hosted = String(params.env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
+	let cfg = ensureLocalSignerProviderConfig(loadConfig(), params.env);
+	if (!hosted) {
+		cfg = setConfigEnvVar(cfg, rpcEnvKeyFor(params.chain, walletId), params.rpcUrl);
+	}
+	await writeConfigFile(cfg);
+	const mergedEnv = {
+		...params.env,
+		...cfg.env?.vars
+	};
+	const socketPath = resolveLocalSignerSocketPath(mergedEnv);
+	const expectedSignerWalletId = normalizeNativeSignerWalletId(walletId);
+	const existingSignerIdCollision = findNativeSignerWalletIdCollision(readWalletProviderRegistry(params.env).wallets, walletId, expectedSignerWalletId);
+	if (existingSignerIdCollision) {
+		throw new Error(`native signer wallet ID ${expectedSignerWalletId} is already registered as ${existingSignerIdCollision.id}; choose a distinct wallet ID`);
+	}
+	if (!hosted) {
+		writeLocalSignerEnvFile({
+			config: cfg,
+			env: mergedEnv
+		});
+		const signerBinPath = resolveSignerdBinaryPath(mergedEnv);
+		if (!syncFs.existsSync(signerBinPath)) {
+			installSignerdBinary(signerBinPath);
+		}
+		await restartLocalSocketSigner(undefined, mergedEnv);
+	}
+	let result;
+	try {
+		result = await createLockedSignerOwnedWallet({
+			socketPath,
+			walletId,
+			role: params.role,
+			allowExisting: Boolean(params.options.force)
+		});
+	} catch (error) {
+		if (hosted) {
+			throw new Error(`root-managed hosted signer wallet creation failed: ${error instanceof Error ? error.message : String(error)}. Repair only from the provider root console with the exact tagged, attested Hosting release; never run the app checkout with sudo.`, { cause: error });
+		}
+		throw error;
+	}
+	const signerWalletId = String(result.wallet.walletId ?? "").trim();
+	if (!signerWalletId || signerWalletId !== expectedSignerWalletId || result.policy.walletId && result.policy.walletId !== signerWalletId) {
+		throw new Error(`native signer returned an unexpected wallet ID; requested=${walletId} expected=${expectedSignerWalletId} returned=${signerWalletId || "missing"}`);
+	}
+	const signerIdCollision = findNativeSignerWalletIdCollision(readWalletProviderRegistry(params.env).wallets, walletId, signerWalletId);
+	if (signerIdCollision) {
+		throw new Error(`native signer wallet ID ${signerWalletId} is already registered as ${signerIdCollision.id}; choose a distinct wallet ID`);
+	}
+	const fallbackRpcUrl = hosted ? "" : String(mergedEnv[fallbackRpcEnvKeyFor(walletId)] ?? mergedEnv.FASED_WALLET_SOLANA_RPC_FALLBACK_URL ?? "").trim();
+	const network = configureSignerOwnedWalletNetwork({
+		walletId: signerWalletId,
+		primaryRpcUrl: params.rpcUrl,
+		fallbackRpcUrl: fallbackRpcUrl || undefined,
+		env: mergedEnv,
+		signerBinPath: hosted ? undefined : resolveSignerdBinaryPath(mergedEnv),
+		controlSocketPath: hosted ? undefined : resolveLocalSignerControlSocketPath(mergedEnv)
+	});
+	await writeConfigFile(cfg);
+	const wallet = upsertNamedWallet({
+		walletId,
+		name: params.options.walletName || "Wallet",
+		providerId: "local-socket-signer",
+		addresses: { solana: result.wallet.publicKey },
+		metadata: {
+			role: params.role,
+			purpose: params.role,
+			keyAuthority: "signer-owned-v2",
+			signerWalletId,
+			policyHash: result.policy.hash,
+			policyVersion: result.policy.version,
+			policyState: "locked",
+			networkHash: network.hash,
+			networkVersion: network.version,
+			networkReady: network.ready
+		},
+		env: params.env
+	});
+	if (params.role === "agent") {
+		setDefaultWallet({
+			walletId: wallet.id,
+			env: params.env
+		});
+	}
+	if (params.options.json) {
+		params.runtime.log(JSON.stringify({
+			ok: true,
+			provider: "local-socket-signer",
+			chain: params.chain,
+			walletId: wallet.id,
+			signerWalletId,
+			address: result.wallet.publicKey,
+			policyHash: result.policy.hash,
+			policyVersion: result.policy.version,
+			policyState: "locked",
+			networkVersion: network.version,
+			networkReady: network.ready,
+			...network.rootAdminRequired ? {
+				networkActivation: "root-admin-required",
+				rootCommand: network.rootCommand
+			} : {}
+		}, null, 2));
+	} else {
+		params.runtime.log(`Signer wallet ID: ${signerWalletId}`);
+		params.runtime.log(`${params.chain.toUpperCase()} address: ${result.wallet.publicKey}`);
+		if (!params.options.noSignerHints) {
+			params.runtime.log("Signer-owned wallet created with a deny-all policy. Configure explicit operations, destinations, assets, and positive caps before sending.");
+			if (network.rootAdminRequired && network.rootCommand) {
+				params.runtime.log("Hosted wallet remains fail-closed until a root administrator activates its RPC network from a root-owned file:");
+				params.runtime.log(network.rootCommand);
+			}
+		}
+	}
+	return result;
+}
 async function walletSetupCommand(runtime = defaultRuntime, options = {}) {
 	const env = process.env;
 	const interactive = !options.nonInteractive;
-	if (options.role && !normalizeWalletRoleForCli(options.role)) {
-		throw new Error("wallet role must be agent or vault. Use the Mining page/command for SAT mining.");
+	const currentConfig = loadConfig();
+	const currentRegistry = readWalletProviderRegistry(env);
+	if (hasLegacyEmbeddedKeystoreConfig(currentConfig, {
+		...env,
+		...currentConfig.env?.vars
+	}) || hasLegacyEmbeddedKeystoreMaterialHint({
+		...env,
+		...currentConfig.env?.vars
+	}) || currentRegistry.providers["embedded-keystore"]?.enabled || currentRegistry.wallets.some((wallet) => wallet.providerId === "embedded-keystore")) {
+		throwLegacyEmbeddedKeystoreMigrationRequired("legacy wallet setup state detected");
+	}
+	if (options.role && !normalizeWalletUserRole(options.role)) {
+		throw new Error("wallet role must be agent, mining, or vault");
 	}
 	const configureLimitOrdersIfRequested = async () => {
-		if (!options.enableLimitOrders && !options.disableLimitOrders && !options.jupiterApiKey && !options.jupiterTriggerApiBaseUrl) {
+		if (!options.enableLimitOrders && !options.disableLimitOrders && !options.jupiterApiKey) {
 			return;
 		}
 		await walletLimitOrdersConfigureCommand(runtime, {
 			enable: Boolean(options.enableLimitOrders || options.jupiterApiKey),
 			disable: Boolean(options.disableLimitOrders),
 			jupiterApiKey: options.jupiterApiKey,
-			jupiterTriggerApiBaseUrl: options.jupiterTriggerApiBaseUrl,
 			nonInteractive: options.nonInteractive,
 			json: options.json
 		});
@@ -1170,90 +590,18 @@ async function walletSetupCommand(runtime = defaultRuntime, options = {}) {
 	let mode = options.mode;
 	if (!mode) {
 		runtime.log("Wallet setup modes:");
-		runtime.log("  embedded-create  Create a new self-hosted wallet (default)");
-		runtime.log("  embedded-import  Import an existing Solana key (advanced)");
+		runtime.log("  local-signer-create  Create a signer-owned Solana wallet (default)");
+		runtime.log("  local-signer-import  Show the native signer-only import command");
 		runtime.log("  turnkey          Configure hosted provider (Turnkey)");
 		runtime.log("  alchemy          Configure hosted provider (Alchemy)");
-		runtime.log("  privy            Configure hosted provider (Privy)");
-		const picked = await prompt("Choose wallet setup mode", "embedded-create");
-		mode = picked === "embedded" || picked === "embedded-create" || picked === "embedded-import" || picked === "local-signer-create" || picked === "local-signer-import" || picked === "local-signer" || picked === "turnkey" || picked === "alchemy" || picked === "privy" ? picked : "embedded-create";
+		const picked = await prompt("Choose wallet setup mode", "local-signer-create");
+		mode = picked === "local-signer-create" || picked === "local-signer-import" || picked === "local-signer" || picked === "turnkey" || picked === "alchemy" ? picked : "local-signer-create";
 	}
-	if (mode === "embedded") {
-		mode = "embedded-create";
+	if (mode === "embedded" || mode === "embedded-create" || mode === "embedded-import") {
+		throwLegacyEmbeddedKeystoreMigrationRequired(`wallet setup mode ${mode} is unavailable`);
 	}
-	if (mode !== "embedded-create" && mode !== "embedded-import" && mode !== "local-signer-create" && mode !== "local-signer-import" && mode !== "local-signer" && mode !== "turnkey" && mode !== "alchemy" && mode !== "privy") {
-		throw new Error(`Unsupported wallet setup mode: ${String(mode)}. ` + "Use one of: embedded-create, embedded-import, local-signer-create, local-signer-import, local-signer, turnkey, alchemy, privy.");
-	}
-	if (mode === "embedded-create") {
-		const chain = options.chain ?? "solana";
-		const walletId = options.walletId ?? ((await prompt("Wallet id (optional, e.g. agent/mining/vault)", "")).trim() || undefined);
-		const rpcUrlFallback = resolveRpcUrlForChain(env, chain, walletId, options.rpcUrl);
-		const rpcUrl = (await prompt(`${chain.toUpperCase()} RPC URL (required for balances/readiness/send)`, rpcUrlFallback)).trim();
-		if (!rpcUrl) {
-			throw new Error(`${chain.toUpperCase()} RPC URL is required for self-hosted wallet setup. ` + "Pass --rpc-url or set FASED_WALLET_<CHAIN>_RPC_URL.");
-		}
-		const showPrivateKeyOnce = typeof options.showPrivateKeyOnce === "boolean" ? options.showPrivateKeyOnce : !options.nonInteractive && (await prompt("Show private key once for backup now? (dangerous, shoulder-surf risk) [y/N]", "n")).trim().toLowerCase().startsWith("y");
-		if (showPrivateKeyOnce && typeof options.showPrivateKeyOnce === "boolean") {
-			requirePrivateKeyPrintConfirmation(options.confirmPrivateKeyPrint);
-		}
-		const privateKeyPrintConfirmation = showPrivateKeyOnce ? options.confirmPrivateKeyPrint ?? (typeof options.showPrivateKeyOnce === "boolean" ? undefined : PRIVATE_KEY_PRINT_CONFIRMATION) : undefined;
-		if (!String(env.FASED_WALLET_PASSPHRASE_FILE ?? env.FASED_WALLET_PASSPHRASE ?? "").trim()) {
-			runtime.log("No wallet passphrase configured. Creating a local passphrase file (0600)...");
-			await walletKeystorePassphraseInitCommand(runtime, {
-				force: false,
-				json: false
-			});
-		}
-		await walletKeystoreInitCommand(runtime, {
-			chain,
-			walletId,
-			name: options.walletName,
-			rpcUrl,
-			showPrivateKeyOnce,
-			confirmPrivateKeyPrint: privateKeyPrintConfirmation,
-			force: Boolean(options.force),
-			json: Boolean(options.json),
-			role: options.role
-		});
-		if (!options.noSignerHints) {
-			runtime.log("Embedded wallet created.");
-		}
-		await configureLimitOrdersIfRequested();
-		return;
-	}
-	if (mode === "embedded-import") {
-		const chain = options.chain ?? "solana";
-		const walletId = options.walletId ?? ((await prompt("Wallet id (optional, e.g. agent/mining/vault)", "")).trim() || undefined);
-		const rpcUrlFallback = resolveRpcUrlForChain(env, chain, walletId, options.rpcUrl);
-		const rpcUrl = (await prompt(`${chain.toUpperCase()} RPC URL (required for balances/readiness/send)`, rpcUrlFallback)).trim();
-		if (!rpcUrl) {
-			throw new Error(`${chain.toUpperCase()} RPC URL is required for self-hosted wallet setup. ` + "Pass --rpc-url or set FASED_WALLET_<CHAIN>_RPC_URL.");
-		}
-		const privateKey = options.privateKey ?? await prompt("Paste Solana private key (base58/json/base64/hex)");
-		if (!privateKey) {
-			throw new Error("Import mode requires a private key. " + "Pass --private-key (and optional --wallet-id) or set FASED_WALLET_PRIVATE_KEY for non-interactive runs.");
-		}
-		if (!String(env.FASED_WALLET_PASSPHRASE_FILE ?? env.FASED_WALLET_PASSPHRASE ?? "").trim()) {
-			runtime.log("No wallet passphrase configured. Creating a local passphrase file (0600)...");
-			await walletKeystorePassphraseInitCommand(runtime, {
-				force: false,
-				json: false
-			});
-		}
-		await walletKeystoreImportCommand(runtime, {
-			chain,
-			walletId,
-			name: options.walletName,
-			privateKey,
-			rpcUrl,
-			json: Boolean(options.json),
-			role: options.role
-		});
-		if (!options.noSignerHints) {
-			runtime.log("Embedded wallet imported.");
-		}
-		await configureLimitOrdersIfRequested();
-		return;
+	if (mode !== "local-signer-create" && mode !== "local-signer-import" && mode !== "local-signer" && mode !== "turnkey" && mode !== "alchemy" && mode !== "privy") {
+		throw new Error(`Unsupported wallet setup mode: ${String(mode)}. ` + "Use one of: local-signer-create, local-signer-import, local-signer, turnkey, alchemy. Privy is unavailable.");
 	}
 	if (mode === "local-signer-create") {
 		const chain = options.chain ?? "solana";
@@ -1263,64 +611,51 @@ async function walletSetupCommand(runtime = defaultRuntime, options = {}) {
 		if (!rpcUrl) {
 			throw new Error(`${chain.toUpperCase()} RPC URL is required for self-hosted wallet setup. ` + "Pass --rpc-url or set FASED_WALLET_<CHAIN>_RPC_URL.");
 		}
-		const showPrivateKeyOnce = typeof options.showPrivateKeyOnce === "boolean" ? options.showPrivateKeyOnce : !options.nonInteractive && (await prompt("Show private key once for backup now? (dangerous, shoulder-surf risk) [y/N]", "n")).trim().toLowerCase().startsWith("y");
-		if (showPrivateKeyOnce && typeof options.showPrivateKeyOnce === "boolean") {
-			requirePrivateKeyPrintConfirmation(options.confirmPrivateKeyPrint);
-		}
-		const privateKeyPrintConfirmation = showPrivateKeyOnce ? options.confirmPrivateKeyPrint ?? (typeof options.showPrivateKeyOnce === "boolean" ? undefined : PRIVATE_KEY_PRINT_CONFIRMATION) : undefined;
-		ensureLocalSignerPassphraseForSetup(runtime, env);
-		await walletKeystoreInitCommand(runtime, {
+		const role = normalizeWalletUserRole(options.role) ?? (walletId?.trim().toLowerCase() === "mining" ? "mining" : walletId?.trim().toLowerCase() === "vault" ? "vault" : "agent");
+		await createSignerOwnedWalletForSetup({
+			runtime,
+			options,
+			env,
 			chain,
 			walletId,
-			name: options.walletName,
 			rpcUrl,
-			showPrivateKeyOnce,
-			confirmPrivateKeyPrint: privateKeyPrintConfirmation,
-			force: Boolean(options.force),
-			json: Boolean(options.json),
-			skipProviderConfig: true,
-			providerIdForRegistry: "local-socket-signer",
-			suppressExtraLogs: Boolean(options.noSignerHints),
-			role: options.role
+			role
 		});
-		await configureLocalSignerMode(runtime, options, env);
-		if (!options.noSignerHints) {
-			runtime.log("Self-hosted wallet created for local native signer.");
+		if (!options.noSignerHints && !options.json) {
+			runtime.log("Signer-owned wallet created in fased-signerd.");
 		}
 		await configureLimitOrdersIfRequested();
 		return;
 	}
 	if (mode === "local-signer-import") {
-		const chain = options.chain ?? "solana";
-		const walletId = options.walletId ?? ((await prompt("Wallet id (optional, e.g. agent/mining/vault)", "")).trim() || undefined);
-		const rpcUrlFallback = resolveRpcUrlForChain(env, chain, walletId, options.rpcUrl);
-		const rpcUrl = (await prompt(`${chain.toUpperCase()} RPC URL (required for balances/readiness/send)`, rpcUrlFallback)).trim();
-		if (!rpcUrl) {
-			throw new Error(`${chain.toUpperCase()} RPC URL is required for self-hosted wallet setup. ` + "Pass --rpc-url or set FASED_WALLET_<CHAIN>_RPC_URL.");
-		}
-		const privateKey = options.privateKey ?? await prompt("Paste Solana private key (base58/json/base64/hex)");
-		if (!privateKey) {
-			throw new Error("Import mode requires a private key. " + "Pass --private-key (and optional --wallet-id) or set FASED_WALLET_PRIVATE_KEY for non-interactive runs.");
-		}
-		ensureLocalSignerPassphraseForSetup(runtime, env);
-		await walletKeystoreImportCommand(runtime, {
-			chain,
-			walletId,
-			name: options.walletName,
-			privateKey,
-			rpcUrl,
-			json: Boolean(options.json),
-			force: Boolean(options.force),
-			skipProviderConfig: true,
-			providerIdForRegistry: "local-socket-signer",
-			suppressExtraLogs: Boolean(options.noSignerHints),
-			role: options.role
-		});
-		await configureLocalSignerMode(runtime, options, env);
-		if (!options.noSignerHints) {
-			runtime.log("Self-hosted wallet imported for local native signer.");
-		}
-		await configureLimitOrdersIfRequested();
+		const walletId = normalizeNativeSignerWalletId(options.walletId ?? "agent");
+		const role = normalizeWalletUserRole(options.role) ?? (walletId === "mining" ? "mining" : walletId === "vault" ? "vault" : "agent");
+		const hosted = String(env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
+		const config = loadConfig();
+		const effectiveEnv = {
+			...env,
+			...config.env?.vars
+		};
+		if (!hosted) {
+			writeLocalSignerEnvFile({
+				config,
+				env: effectiveEnv
+			});
+			const signerBinPath = resolveSignerdBinaryPath(effectiveEnv);
+			if (!syncFs.existsSync(signerBinPath)) {
+				installSignerdBinary(signerBinPath);
+			}
+			await restartLocalSocketSigner(undefined, effectiveEnv);
+		}
+		const signerBinary = hosted ? "/opt/fased/signer/fased-signerd" : resolveSignerdBinaryPath(effectiveEnv);
+		const controlSocket = hosted ? "/run/fased-signerd/control.sock" : resolveLocalSignerControlSocketPath(effectiveEnv);
+		runtime.log("Wallet import is native-signer-only; Fased Node will not read the key or passphrase.");
+		runtime.log("Solana CLI keypair import:");
+		runtime.log(`chmod 600 /absolute/path/to/solana-keypair.json && ${signerBinary} admin wallet import --control-socket ${controlSocket} --wallet-id ${walletId} --locked-role ${role} < /absolute/path/to/solana-keypair.json`);
+		runtime.log("Legacy encrypted Fased keystore migration:");
+		runtime.log(`chmod 600 /absolute/path/to/keystore-solana.v1.enc /absolute/path/to/passphrase && ${signerBinary} admin wallet import-legacy --control-socket ${controlSocket} --wallet-id ${walletId} --locked-role ${role} --keystore-path /absolute/path/to/keystore-solana.v1.enc --passphrase-path /absolute/path/to/passphrase`);
+		runtime.log(`After verifying the returned public address, run: fased wallet finalize-legacy-migration --wallet-id ${options.walletId ?? walletId}`);
+		runtime.log("Never put a private key or passphrase in the dashboard, Gateway, chat, argv, or an environment variable.");
 		return;
 	}
 	if (mode === "local-signer") {
@@ -1335,8 +670,11 @@ async function walletSetupCommand(runtime = defaultRuntime, options = {}) {
 		if (providerId === "turnkey") {
 			runtime.log("Turnkey readiness validation will run after save.");
 		}
-		if (providerId === "alchemy" || providerId === "privy") {
-			const apiKey = (options.apiKey ?? options.privateKey ?? env[providerId === "alchemy" ? "ALCHEMY_API_KEY" : "PRIVY_API_KEY"] ?? await prompt(`${providerId} API key`, "")).trim();
+		if (providerId === "privy") {
+			throw new Error("Privy wallet creation and signing are not implemented. Fased will not save credentials for an unavailable provider.");
+		}
+		if (providerId === "alchemy") {
+			const apiKey = (options.apiKey ?? env.ALCHEMY_API_KEY ?? await prompt(`${providerId} API key`, "")).trim();
 			if (!apiKey) {
 				throw new Error(`${providerId} setup requires API key.`);
 			}
@@ -1348,24 +686,25 @@ async function walletSetupCommand(runtime = defaultRuntime, options = {}) {
 			runtime.log("See docs: docs/plugins/crypto/wallet-production-flow.md");
 			return;
 		}
-		const apiPublicKey = (options.turnkeyApiPublicKey ?? env.TURNKEY_API_PUBLIC_KEY ?? await prompt("Turnkey API public key", "")).trim();
-		const apiPrivateKey = (options.turnkeyApiPrivateKey ?? env.TURNKEY_API_PRIVATE_KEY ?? await promptSecret("Turnkey API private key", "")).trim();
-		const organizationId = (options.turnkeyOrganizationId ?? env.TURNKEY_ORGANIZATION_ID ?? await prompt("Turnkey organization ID (optional)", "")).trim();
-		const baseUrl = (options.turnkeyBaseUrl ?? env.TURNKEY_BASE_URL ?? await prompt("Turnkey base URL (optional)", "")).trim();
-		const stamp = (options.turnkeyStamp ?? env.TURNKEY_STAMP ?? env.FASED_WALLET_TURNKEY_STAMP ?? await prompt("Turnkey signing stamp (optional, required for live send)", "")).trim();
-		if (!apiPublicKey || !apiPrivateKey) {
-			throw new Error("Turnkey setup requires API public key and API private key. " + "Set TURNKEY_API_PUBLIC_KEY and TURNKEY_API_PRIVATE_KEY " + "or pass --turnkey-api-public-key/--turnkey-api-private-key for non-interactive use.");
-		}
-		const values = [`apiPublicKey=${apiPublicKey}`, `apiPrivateKey=${apiPrivateKey}`];
-		if (organizationId) {
-			values.push(`organizationId=${organizationId}`);
-		}
+		const apiPublicKey = (options.turnkeyApiPublicKey ?? env.TURNKEY_API_PUBLIC_KEY ?? env.FASED_WALLET_TURNKEY_API_PUBLIC_KEY ?? await prompt("Turnkey API public key", "")).trim();
+		const apiPrivateKey = (options.turnkeyApiPrivateKey ?? env.TURNKEY_API_PRIVATE_KEY ?? env.FASED_WALLET_TURNKEY_API_PRIVATE_KEY ?? await promptSecret("Turnkey API private key", "")).trim();
+		const organizationId = (options.turnkeyOrganizationId ?? env.TURNKEY_ORGANIZATION_ID ?? env.FASED_WALLET_TURNKEY_ORGANIZATION_ID ?? await prompt("Turnkey organization ID", "")).trim();
+		const policyId = (options.turnkeyPolicyId ?? env.TURNKEY_POLICY_ID ?? env.FASED_WALLET_TURNKEY_POLICY_ID ?? await prompt("Turnkey policy ID for this dedicated API user", "")).trim();
+		const baseUrl = (options.turnkeyBaseUrl ?? env.TURNKEY_BASE_URL ?? env.FASED_WALLET_TURNKEY_BASE_URL ?? await prompt("Turnkey base URL (optional)", "")).trim();
+		const turnkeyRpcUrl = (options.rpcUrl ?? env.FASED_WALLET_TURNKEY_RPC_URL ?? env.FASED_WALLET_SOLANA_RPC_URL ?? await prompt("Solana RPC URL", "")).trim();
+		if (!apiPublicKey || !apiPrivateKey || !organizationId || !policyId || !turnkeyRpcUrl) {
+			throw new Error("Turnkey setup requires a dedicated API public/private key, organization ID, policy ID, and Solana RPC URL. " + "Pass --turnkey-api-public-key, --turnkey-api-private-key, --turnkey-organization-id, " + "--turnkey-policy-id, and --rpc-url for non-interactive use.");
+		}
+		const values = [
+			`apiPublicKey=${apiPublicKey}`,
+			`apiPrivateKey=${apiPrivateKey}`,
+			`organizationId=${organizationId}`,
+			`policyId=${policyId}`,
+			`rpcUrl=${turnkeyRpcUrl}`
+		];
 		if (baseUrl) {
 			values.push(`baseUrl=${baseUrl}`);
 		}
-		if (stamp) {
-			values.push(`stamp=${stamp}`);
-		}
 		await walletProviderConfigureCommand(runtime, {
 			providerId: "turnkey",
 			values,
@@ -1387,8 +726,8 @@ async function walletSetupCommand(runtime = defaultRuntime, options = {}) {
 			runtime.log(`  Health: ${health.ok ? "ok" : "fail"}${health.details ? ` — ${health.details}` : ""}`);
 			runtime.log(`  Chains: ${caps.supportedChains.join(", ") || "(none)"} · prepare=${String(caps.operations.prepare)} send=${String(caps.operations.send)}`);
 			runtime.log(`  Ready: ${health.ok && caps.operations.prepare && caps.operations.send ? "yes" : "needs fixes"}`);
-			if (!caps.operations.prepare || !caps.operations.send) {
-				runtime.log("  Turnkey signing is not ready. Add signing stamp: `fased wallet provider configure turnkey stamp=<STAMP>`");
+			if (!health.ok || !caps.operations.prepare || !caps.operations.send) {
+				runtime.log("  Turnkey is not ready. Verify the dedicated API user's policy scope, organization/policy IDs, RPC URL, and connectivity.");
 			}
 			if (options.nonInteractive && !(health.ok && caps.operations.prepare && caps.operations.send)) {
 				throw new Error("Turnkey provider is not ready after configuration.");
@@ -1434,545 +773,129 @@ async function walletRoleSetCommand(runtime = defaultRuntime, options) {
 	});
 	const wallet = registry.wallets.find((entry) => entry.id === walletId);
 	if (role === "agent" && options.primary) {
-		setDefaultWallet({
-			walletId,
-			env: process.env
-		});
-	}
-	const updatedRegistry = readWalletProviderRegistry(process.env);
-	const primary = updatedRegistry.defaultWalletId === walletId;
-	if (options.json) {
-		runtime.log(JSON.stringify({
-			ok: true,
-			walletId,
-			walletName: wallet?.name,
-			role,
-			primary
-		}, null, 2));
-		return;
-	}
-	runtime.log(`${wallet?.name ?? walletId} (${walletId}) set to ${role === "agent" ? "Agent wallet" : "Vault wallet"}${primary ? " and primary Agent fallback" : ""}.`);
-}
-async function walletStatusCommand(runtime = defaultRuntime, options = {}) {
-	const status = await readWalletStatusSnapshot();
-	if (options.json) {
-		runtime.log(JSON.stringify({
-			ok: true,
-			status
-		}, null, 2));
-		return;
-	}
-	runtime.log(`Wallet: ${status.enabled ? "enabled" : "disabled"} (${status.mode})`);
-	runtime.log(`Runtime source: ${status.runtime}`);
-	runtime.log(`Service: ${status.service.host}:${status.service.port} healthy=${String(status.service.healthy)}`);
-	runtime.log(`Startup state: ${status.startupState}`);
-	runtime.log(`Auth state: ${status.authState}`);
-	runtime.log(`Auth mode: ${status.authMode}`);
-	runtime.log(`Auth source: ${status.authSource}`);
-	runtime.log(`Settlement: ${status.settlement.class} realChainReady=${String(status.settlement.realChainReady)}`);
-	runtime.log(`Execution mode: ${status.policy.executionMode}`);
-	runtime.log(`Chains: ${status.chains.join(", ")}`);
-	runtime.log(`Tool access: ${status.policy.toolAccessMode}`);
-	runtime.log(`Automated execution: ${status.policy.directSigning ? "enabled" : "disabled"}`);
-	runtime.log(`Approval auth: ${status.approvalAuth.mode} ready=${String(status.approvalAuth.ready)} passkeys=${status.approvalAuth.passkeyCount}`);
-	runtime.log(`State path: ${status.paths.rootDir}`);
-	if (status.stack) {
-		runtime.log(`Docker stack: configured=${String(status.stack.configured)} healthy=${String(status.stack.healthy)} runningServices=${status.stack.runningServices}`);
-	}
-	if (status.addresses?.solana) {
-		runtime.log(`Address: ${status.addresses.solana}`);
-	}
-	if (status.error) {
-		runtime.log(`Status warning: ${status.error}`);
-	}
-}
-async function walletKeystoreInitCommand(runtime = defaultRuntime, options = {}) {
-	const env = process.env;
-	if (options.role && !normalizeWalletRoleForCli(options.role)) {
-		throw new Error("wallet role must be agent or vault. Use the Mining page/command for SAT mining.");
-	}
-	const passphrase = resolveKeystorePassphrase(options.passphrase, env);
-	if (!passphrase) {
-		throw new Error("Missing keystore passphrase. Set FASED_WALLET_PASSPHRASE(_FILE) or pass --passphrase.");
-	}
-	if (options.showPrivateKeyOnce) {
-		requirePrivateKeyPrintConfirmation(options.confirmPrivateKeyPrint);
-	}
-	const chain = options.chain ?? "solana";
-	const outPath = resolveEmbeddedKeystorePathForChain(env, chain, options.out, options.walletId);
-	if (syncFs.existsSync(outPath) && !options.force) {
-		throw new Error(`Keystore already exists: ${outPath}`);
-	}
-	syncFs.mkdirSync(path.dirname(outPath), {
-		recursive: true,
-		mode: 448
-	});
-	let addressOut = "";
-	let privateKeyOut = "";
-	const seed = randomBytes(32);
-	const publicKeyBytes = deriveEd25519PublicKeyFromSeed(seed);
-	const secretKey = Uint8Array.from([...seed, ...publicKeyBytes]);
-	const publicKey = encodeBase58(publicKeyBytes);
-	const envelope = encryptSolanaKeypairEnvelope({
-		secretKey,
-		passphrase,
-		publicKey
-	});
-	syncFs.writeFileSync(outPath, `${JSON.stringify(envelope, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	addressOut = publicKey;
-	privateKeyOut = Buffer.from(secretKey).toString("base64");
-	try {
-		syncFs.chmodSync(outPath, 384);
-	} catch {}
-	const cfg = options.skipProviderConfig ? ensureWalletMaterialConfig(loadConfig(), {
-		keystorePath: outPath,
-		rpcUrl: options.rpcUrl,
-		chain,
-		walletId: options.walletId
-	}) : ensureEmbeddedProviderConfig(loadConfig(), {
-		keystorePath: outPath,
-		rpcUrl: options.rpcUrl,
-		chain,
-		walletId: options.walletId
-	});
-	await writeConfigFile(cfg);
-	if (options.json) {
-		const payload = {
-			ok: true,
-			provider: options.providerIdForRegistry ?? "embedded-keystore",
-			chain,
-			keystorePath: outPath,
-			address: addressOut,
-			warning: "Store the passphrase securely; it is not stored in fased config."
-		};
-		if (options.showPrivateKeyOnce) {
-			payload.privateKey = privateKeyOut;
-			payload.warning = "Private key shown once in JSON output; move to offline backup immediately.";
-		}
-		runtime.log(JSON.stringify(payload, null, 2));
-		return;
-	}
-	runtime.log(`${chain.toUpperCase()} address: ${addressOut}`);
-	if (options.showPrivateKeyOnce) {
-		runtime.log(`PRIVATE KEY (shown once): ${privateKeyOut}`);
-	}
-	if (options.skipProviderConfig && !options.suppressExtraLogs) {
-		runtime.log(`Self-hosted signer keystore created: ${outPath}`);
-	}
-	try {
-		const role = normalizeWalletRoleForCli(options.role);
-		const wallet = upsertNamedWallet({
-			walletId: options.walletId?.trim() || undefined,
-			name: options.name || "Wallet",
-			providerId: options.providerIdForRegistry ?? "embedded-keystore",
-			addresses: { solana: addressOut },
-			metadata: role ? {
-				role,
-				purpose: role
-			} : undefined,
-			env
-		});
-		if (role === "agent") {
-			setDefaultWallet({
-				walletId: wallet.id,
-				env
-			});
-		}
-	} catch (err) {
-		runtime.log(`Warning: failed to register wallet in UI registry: ${err instanceof Error ? err.message : String(err)}`);
-	}
-}
-async function walletKeystoreImportCommand(runtime = defaultRuntime, options = {}) {
-	const env = process.env;
-	if (options.role && !normalizeWalletRoleForCli(options.role)) {
-		throw new Error("wallet role must be agent or vault. Use the Mining page/command for SAT mining.");
-	}
-	const passphrase = resolveKeystorePassphrase(options.passphrase, env);
-	if (!passphrase) {
-		throw new Error("Missing keystore passphrase. Set FASED_WALLET_PASSPHRASE(_FILE) or pass --passphrase.");
-	}
-	const chain = options.chain ?? "solana";
-	const privateKey = (options.privateKey ?? String(env.FASED_WALLET_PRIVATE_KEY ?? "")).trim();
-	if (!privateKey) {
-		throw new Error("Missing private key. Pass --private-key or set FASED_WALLET_PRIVATE_KEY.");
-	}
-	const outPath = resolveEmbeddedKeystorePathForChain(env, chain, options.out, options.walletId);
-	if (syncFs.existsSync(outPath) && !options.force) {
-		throw new Error(`Keystore already exists: ${outPath}`);
-	}
-	syncFs.mkdirSync(path.dirname(outPath), {
-		recursive: true,
-		mode: 448
-	});
-	let addressOut = "";
-	const secretKey = parseSolanaSecretKey(privateKey);
-	const publicKey = solanaAddressFromSecretKey(secretKey);
-	const envelope = encryptSolanaKeypairEnvelope({
-		secretKey,
-		passphrase,
-		publicKey
-	});
-	syncFs.writeFileSync(outPath, `${JSON.stringify(envelope, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	addressOut = publicKey;
-	try {
-		syncFs.chmodSync(outPath, 384);
-	} catch {}
-	const cfg = options.skipProviderConfig ? ensureWalletMaterialConfig(loadConfig(), {
-		keystorePath: outPath,
-		rpcUrl: options.rpcUrl,
-		chain,
-		walletId: options.walletId
-	}) : ensureEmbeddedProviderConfig(loadConfig(), {
-		keystorePath: outPath,
-		rpcUrl: options.rpcUrl,
-		chain,
-		walletId: options.walletId
-	});
-	await writeConfigFile(cfg);
-	if (options.json) {
-		runtime.log(JSON.stringify({
-			ok: true,
-			provider: options.providerIdForRegistry ?? "embedded-keystore",
-			chain,
-			keystorePath: outPath,
-			address: addressOut
-		}, null, 2));
-		return;
-	}
-	if (!options.skipProviderConfig || !options.suppressExtraLogs) {
-		runtime.log(options.skipProviderConfig ? `Self-hosted signer keystore imported: ${outPath}` : `Embedded keystore imported: ${outPath}`);
-	}
-	runtime.log(`${chain.toUpperCase()} address: ${addressOut}`);
-	if (options.walletId) {
-		runtime.log(`Signer env hint: export FASED_WALLET_SOLANA_KEYSTORE_PATH__${walletIdEnvSuffix(options.walletId)}="${outPath}"`);
-	}
-	if (!options.skipProviderConfig) {
-		runtime.log("Configured wallet.provider.id=embedded-keystore and disabled wallet.runtime.");
-	}
-	try {
-		const role = normalizeWalletRoleForCli(options.role);
-		const wallet = upsertNamedWallet({
-			walletId: options.walletId?.trim() || undefined,
-			name: options.name || "Wallet",
-			providerId: options.providerIdForRegistry ?? "embedded-keystore",
-			addresses: { solana: addressOut },
-			metadata: role ? {
-				role,
-				purpose: role
-			} : undefined,
-			env
-		});
-		if (role === "agent") {
-			setDefaultWallet({
-				walletId: wallet.id,
-				env
-			});
-		}
-	} catch (err) {
-		runtime.log(`Warning: failed to register wallet in UI registry: ${err instanceof Error ? err.message : String(err)}`);
-	}
-}
-async function walletKeystoreStatusCommand(runtime = defaultRuntime, options = {}) {
-	const env = process.env;
-	const cfg = loadConfig();
-	const chain = options.chain ?? "solana";
-	const keystorePath = resolveEmbeddedKeystorePathForChain(env, chain, cfg.wallet?.keystore?.path, options.walletId);
-	const exists = syncFs.existsSync(keystorePath);
-	const providerId = cfg.wallet?.provider?.id;
-	let address;
-	let unlocked = false;
-	let error;
-	let detectedType = "missing";
-	if (exists) {
-		const passphrase = resolveKeystorePassphrase(undefined, env);
-		const raw = syncFs.readFileSync(keystorePath, "utf8");
-		detectedType = detectEmbeddedKeystoreType(raw);
-		if (passphrase) {
-			try {
-				if (detectedType === "solana-envelope") {
-					const envelope = parseSolanaKeystoreEnvelope(raw);
-					if (!envelope) {
-						throw new Error("invalid Solana keystore envelope");
-					}
-					decryptSolanaKeypairEnvelope(envelope, passphrase);
-					address = envelope.publicKey;
-					unlocked = true;
-				} else {
-					throw new Error("unsupported Solana keystore envelope");
-				}
-			} catch (err) {
-				error = String(err);
-			}
-		}
-	}
-	const payload = {
-		ok: true,
-		provider: providerId,
-		keystore: {
-			path: keystorePath,
-			exists,
-			type: detectedType,
-			unlocked,
-			address,
-			passphraseConfigured: Boolean(String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim() || String(env.FASED_WALLET_PASSPHRASE ?? "").trim()),
-			rpcUrlConfigured: Boolean(String(env.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim() || String(env.FASED_WALLET_RPC_URL ?? "").trim()),
-			providerReady: Boolean(providerId === "embedded-keystore") && exists && Boolean(String(env.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim() || String(env.FASED_WALLET_RPC_URL ?? "").trim()),
-			error
-		}
-	};
-	if (options.json) {
-		runtime.log(JSON.stringify(payload, null, 2));
-		return;
-	}
-	runtime.log(`Provider: ${String(providerId ?? "unset")}`);
-	runtime.log(`Keystore: ${keystorePath} (${exists ? "exists" : "missing"})`);
-	runtime.log(`Type: ${detectedType}`);
-	runtime.log(`Unlocked: ${unlocked ? "yes" : "no"}`);
-	runtime.log(`RPC URL configured: ${payload.keystore.rpcUrlConfigured ? "yes" : "no (set FASED_WALLET_[EMBEDDED_KEYSTORE_]RPC_URL)"}`);
-	if (address) {
-		runtime.log(`Address: ${address}`);
-	}
-	if (error) {
-		runtime.log(`Error: ${error}`);
-	}
-}
-async function walletKeystoreValidateCommand(runtime = defaultRuntime, options = {}) {
-	const env = process.env;
-	const cfg = loadConfig();
-	const chainForPath = options.chain ?? "solana";
-	const keystorePath = resolveEmbeddedKeystorePathForChain(env, chainForPath, cfg.wallet?.keystore?.path, options.walletId);
-	const passphrase = resolveKeystorePassphrase(undefined, env);
-	const rpcUrl = String(env.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim() || String(env.FASED_WALLET_RPC_URL ?? "").trim();
-	const result = {
-		ok: false,
-		provider: "embedded-keystore",
-		checks: []
-	};
-	let raw = "";
-	let detectedType = "missing";
-	if (!syncFs.existsSync(keystorePath)) {
-		result.checks.push({
-			id: "keystore.exists",
-			ok: false,
-			message: `missing: ${keystorePath}`
-		});
-	} else {
-		raw = syncFs.readFileSync(keystorePath, "utf8");
-		detectedType = detectEmbeddedKeystoreType(raw);
-		result.checks.push({
-			id: "keystore.exists",
-			ok: true,
-			message: `${keystorePath} (${detectedType})`
-		});
-	}
-	if (!passphrase) {
-		result.checks.push({
-			id: "keystore.passphrase",
-			ok: false,
-			message: "missing passphrase (set FASED_WALLET_PASSPHRASE or FASED_WALLET_PASSPHRASE_FILE)"
-		});
-	} else {
-		result.checks.push({
-			id: "keystore.passphrase",
-			ok: true,
-			message: "configured"
+		setDefaultWallet({
+			walletId,
+			env: process.env
 		});
 	}
-	if (!rpcUrl) {
-		result.checks.push({
-			id: "rpc.url",
-			ok: false,
-			message: "missing RPC URL (set FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL or FASED_WALLET_RPC_URL)"
-		});
-	} else {
-		result.checks.push({
-			id: "rpc.url",
+	const updatedRegistry = readWalletProviderRegistry(process.env);
+	const primary = updatedRegistry.defaultWalletId === walletId;
+	if (options.json) {
+		runtime.log(JSON.stringify({
 			ok: true,
-			message: "configured"
-		});
-	}
-	if (result.checks.some((check) => !check.ok)) {
-		if (options.json) {
-			runtime.log(JSON.stringify(result, null, 2));
-			return;
-		}
-		for (const check of result.checks) {
-			runtime.log(`${check.ok ? "✓" : "✗"} ${check.id}: ${check.message}`);
-		}
-		throw new Error("embedded keystore validation failed");
-	}
-	try {
-		if (detectedType === "solana-envelope") {
-			const envelope = parseSolanaKeystoreEnvelope(raw);
-			if (!envelope) {
-				throw new Error("invalid Solana keystore envelope");
-			}
-			const secretKey = decryptSolanaKeypairEnvelope(envelope, passphrase);
-			const address = solanaAddressFromSecretKey(secretKey);
-			result.chain = "solana";
-			result.address = address;
-			result.checks.push({
-				id: "keystore.decrypt",
-				ok: true,
-				message: `unlocked (${address})`
-			});
-			const latest = await callRpcMethod(rpcUrl, "getLatestBlockhash", [{ commitment: "finalized" }]);
-			const latestValue = latest.value;
-			const blockhash = latestValue && typeof latestValue === "object" && typeof latestValue.blockhash === "string" ? latestValue.blockhash : "unknown";
-			result.checks.push({
-				id: "rpc.connect",
-				ok: true,
-				message: `latestBlockhash=${String(blockhash).slice(0, 12)}…`
-			});
-			const balance = await callRpcMethod(rpcUrl, "getBalance", [address, { commitment: "finalized" }]);
-			const balanceValue = balance.value;
-			const lamports = typeof balanceValue === "number" || typeof balanceValue === "string" ? String(balanceValue) : "unknown";
-			result.checks.push({
-				id: "rpc.balance",
-				ok: true,
-				message: `lamports=${lamports}`
-			});
-			result.ok = result.checks.every((check) => check.ok);
-		} else {
-			throw new Error("unsupported Solana keystore envelope");
-		}
-	} catch (err) {
-		result.error = String(err);
-		result.checks.push({
-			id: "validate.error",
-			ok: false,
-			message: String(err)
-		});
-		result.ok = false;
+			walletId,
+			walletName: wallet?.name,
+			role,
+			primary
+		}, null, 2));
+		return;
 	}
+	runtime.log(`${wallet?.name ?? walletId} (${walletId}) set to ${role === "agent" ? "Agent wallet" : "Vault wallet"}${primary ? " and primary Agent fallback" : ""}.`);
+}
+async function walletStatusCommand(runtime = defaultRuntime, options = {}) {
+	const status = await readWalletStatusSnapshot();
 	if (options.json) {
-		runtime.log(JSON.stringify(result, null, 2));
+		runtime.log(JSON.stringify({
+			ok: true,
+			status
+		}, null, 2));
 		return;
 	}
-	for (const check of result.checks) {
-		runtime.log(`${check.ok ? "✓" : "✗"} ${check.id}: ${check.message}`);
+	runtime.log(`Wallet: ${status.enabled ? "enabled" : "disabled"} (${status.mode})`);
+	runtime.log(`Runtime source: ${status.runtime}`);
+	runtime.log(`Service: ${status.service.host}:${status.service.port} healthy=${String(status.service.healthy)}`);
+	runtime.log(`Startup state: ${status.startupState}`);
+	runtime.log(`Auth state: ${status.authState}`);
+	runtime.log(`Auth mode: ${status.authMode}`);
+	runtime.log(`Auth source: ${status.authSource}`);
+	runtime.log(`Settlement: ${status.settlement.class} realChainReady=${String(status.settlement.realChainReady)}`);
+	runtime.log(`Execution mode: ${status.policy.executionMode}`);
+	runtime.log(`Chains: ${status.chains.join(", ")}`);
+	runtime.log(`Tool access: ${status.policy.toolAccessMode}`);
+	runtime.log(`Automated execution: ${status.policy.directSigning ? "enabled" : "disabled"}`);
+	runtime.log(`Approval auth: ${status.approvalAuth.mode} ready=${String(status.approvalAuth.ready)} passkeys=${status.approvalAuth.passkeyCount}`);
+	runtime.log(`State path: ${status.paths.rootDir}`);
+	if (status.stack) {
+		runtime.log(`Docker stack: configured=${String(status.stack.configured)} healthy=${String(status.stack.healthy)} runningServices=${status.stack.runningServices}`);
+	}
+	if (status.addresses?.solana) {
+		runtime.log(`Address: ${status.addresses.solana}`);
 	}
-	if (!result.ok) {
-		throw new Error("embedded keystore validation failed");
+	if (status.error) {
+		runtime.log(`Status warning: ${status.error}`);
 	}
 }
+async function walletKeystoreInitCommand(runtime = defaultRuntime, options = {}) {
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
+}
+async function walletKeystoreImportCommand(runtime = defaultRuntime, options = {}) {
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
+}
+async function walletKeystoreStatusCommand(runtime = defaultRuntime, options = {}) {
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
+}
+async function walletKeystoreValidateCommand(runtime = defaultRuntime, options = {}) {
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
+}
 async function walletKeystorePassphraseInitCommand(runtime = defaultRuntime, options = {}) {
-	const env = process.env ?? process.env;
-	const outPath = resolvePassphraseFilePath(env, options.out);
-	if (syncFs.existsSync(outPath) && !options.force) {
-		throw new Error(`Passphrase file already exists: ${outPath} (use --force to overwrite)`);
-	}
-	const bytes = typeof options.length === "number" && Number.isFinite(options.length) && options.length >= 16 ? Math.floor(options.length) : 24;
-	const passphrase = randomBytes(bytes).toString("base64url");
-	writePassphraseFile(outPath, passphrase);
-	const payload = {
-		ok: true,
-		path: outPath,
-		bytes,
-		envExport: `export FASED_WALLET_PASSPHRASE_FILE=${outPath}`
-	};
-	runtime.log(options.json ? JSON.stringify(payload, null, 2) : `Passphrase file written: ${outPath} (mode 600)`);
-	if (!options.json) {
-		runtime.log(`Set env: export FASED_WALLET_PASSPHRASE_FILE=${outPath}`);
-	}
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
 }
 async function walletKeystorePassphraseRotateCommand(runtime = defaultRuntime, options = {}) {
-	const env = process.env ?? process.env;
-	const cfg = loadConfig();
-	const keystorePath = resolveEmbeddedKeystorePath(env, cfg.wallet?.keystore?.path);
-	const passphraseFile = resolvePassphraseFilePath(env, options.file);
-	if (!syncFs.existsSync(keystorePath)) {
-		throw new Error(`Keystore missing: ${keystorePath}`);
-	}
-	const oldPassphrase = (options.oldPassphrase ?? (syncFs.existsSync(passphraseFile) ? syncFs.readFileSync(passphraseFile, "utf8") : "")).trim() || String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
-	if (!oldPassphrase) {
-		throw new Error("Missing old passphrase. Provide --old-passphrase or configure passphrase file/env.");
-	}
-	const newPassphrase = (options.newPassphrase ?? "").trim() || randomBytes(24).toString("base64url");
-	const raw = syncFs.readFileSync(keystorePath, "utf8");
-	const detected = detectEmbeddedKeystoreType(raw);
-	if (detected === "solana-envelope") {
-		const envelope = parseSolanaKeystoreEnvelope(raw);
-		if (!envelope) {
-			throw new Error("Invalid Solana keystore envelope");
-		}
-		const secretKey = decryptSolanaKeypairEnvelope(envelope, oldPassphrase);
-		const nextEnvelope = encryptSolanaKeypairEnvelope({
-			secretKey,
-			passphrase: newPassphrase,
-			publicKey: envelope.publicKey
-		});
-		syncFs.writeFileSync(keystorePath, `${JSON.stringify(nextEnvelope, null, 2)}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-	} else {
-		throw new Error("unsupported Solana keystore envelope");
-	}
-	writePassphraseFile(passphraseFile, newPassphrase);
-	const payload = {
-		ok: true,
-		keystorePath,
-		passphraseFile
-	};
-	runtime.log(options.json ? JSON.stringify(payload, null, 2) : `Rotated keystore passphrase and updated ${passphraseFile}`);
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
 }
 async function walletKeystoreExportCommand(runtime = defaultRuntime, options = {}) {
-	if (options.includeSecret) {
-		if (!options.json) {
-			throw new Error("Including encrypted keystore material requires --json.");
-		}
-		requireKeystoreSecretExportConfirmation(options.confirmIncludeSecret);
-	}
-	const env = process.env ?? process.env;
-	const cfg = loadConfig();
-	const keystorePath = resolveEmbeddedKeystorePath(env, cfg.wallet?.keystore?.path);
-	if (!syncFs.existsSync(keystorePath)) {
-		throw new Error(`Keystore missing: ${keystorePath}`);
-	}
-	const raw = syncFs.readFileSync(keystorePath, "utf8");
-	const detected = detectEmbeddedKeystoreType(raw);
-	const outPath = options.out?.trim() ? path.resolve(options.out.trim()) : undefined;
-	const payload = {
-		ok: true,
-		keystorePath,
-		type: detected,
-		exportedAt: new Date().toISOString()
-	};
-	if (options.includeSecret) {
-		payload.keystore = raw;
-	}
-	if (outPath) {
-		syncFs.mkdirSync(path.dirname(outPath), {
-			recursive: true,
-			mode: 448
-		});
-		syncFs.writeFileSync(outPath, raw, {
-			encoding: "utf8",
-			mode: 384
-		});
-		payload.outputPath = outPath;
-	}
-	if (!options.json && !outPath && !options.includeSecret) {
-		runtime.log(`Keystore export info: type=${detected} path=${keystorePath}`);
-		runtime.log("Use --out <path> to write a backup copy, or --include-secret --json to print (dangerous).");
-		return;
-	}
-	runtime.log(JSON.stringify(payload, null, 2));
+	void runtime;
+	void options;
+	throwLegacyEmbeddedKeystoreMigrationRequired("legacy keystore CLI command is unavailable");
 }
 async function walletProviderConfigureCommand(runtime, options) {
 	const providerId = options.providerId;
+	if (providerId === "privy") {
+		throw new Error("Privy wallet creation and signing are unavailable. No Privy credentials or provider selection were saved.");
+	}
 	const cfg = loadConfig();
 	const credentials = parseCredentialPairs(options.values);
 	if (Object.keys(credentials).length === 0) {
 		throw new Error("no credentials supplied; pass one or more --set key=value");
 	}
+	if (providerId === "turnkey") {
+		const allowed = new Set([
+			"apiPublicKey",
+			"apiPrivateKey",
+			"organizationId",
+			"policyId",
+			"baseUrl",
+			"rpcUrl",
+			"defaultSolanaAddress",
+			"providerWalletId"
+		]);
+		const unsupported = Object.keys(credentials).find((field) => !allowed.has(field));
+		if (unsupported) {
+			throw new Error(`unsupported Turnkey credential field: ${unsupported}`);
+		}
+		const missing = [
+			"apiPublicKey",
+			"apiPrivateKey",
+			"organizationId",
+			"policyId",
+			"rpcUrl"
+		].filter((field) => !credentials[field]?.trim());
+		if (missing.length > 0) {
+			throw new Error(`Turnkey credentials are incomplete; missing ${missing.join(", ")}`);
+		}
+	}
 	const saved = saveWalletProviderSecret({
 		providerId,
 		credentials
@@ -2009,6 +932,11 @@ async function walletProviderConfigureCommand(runtime, options) {
 		}, process.env);
 	}
 	await writeConfigFile(nextCfg, { envSnapshotForRestore: process.env });
+	setWalletProviderEnabled({
+		providerId,
+		enabled: true,
+		env: process.env
+	});
 	const status = readWalletProviderSecretStatus(providerId, process.env);
 	if (options.json) {
 		console.log(JSON.stringify({
@@ -2093,29 +1021,6 @@ async function walletSignerServeCommand(runtime = defaultRuntime, options = {})
 	void runtime;
 	throw new Error(`legacy Node signer has been removed; run native Go signer instead: ${suggested} --socket "${socketPath}"${options.readOnly ? " --read-only" : ""}`);
 }
-async function walletSignerBrokerCommand(runtime = defaultRuntime, options = {}) {
-	void runtime;
-	const env = process.env ?? process.env;
-	const socketPath = options.socketPath?.trim() || resolveLocalSignerSocketPath(env);
-	const backendSocketPath = options.backendSocketPath?.trim() || resolveLocalSignerBackendSocketPath(env);
-	const sidecarPaths = resolveLocalSignerSidecarPaths(socketPath);
-	const pidFile = options.pidFile?.trim() || sidecarPaths.pidPath;
-	const auditLog = options.auditLog?.trim() || sidecarPaths.auditPath;
-	const broker = await startLocalSocketSignerBroker({
-		socketPath,
-		backendSocketPath,
-		pidFile,
-		auditLog,
-		readOnly: Boolean(options.readOnly)
-	});
-	await new Promise((resolve, reject) => {
-		process.once("SIGINT", resolve);
-		process.once("SIGTERM", resolve);
-		process.once("uncaughtException", reject);
-	}).finally(async () => {
-		await broker.close();
-	});
-}
 async function collectWalletSignerDoctorReport(env = process.env, options = {}) {
 	const cfg = options.config ?? loadConfig();
 	const effectiveEnv = {
@@ -2123,8 +1028,9 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 		...cfg.env?.vars
 	};
 	const socketPath = options.socketPath?.trim() || String(effectiveEnv.FASED_WALLET_LOCAL_SIGNER_SOCKET ?? "").trim() || path.join(ensureWalletStateDir(effectiveEnv).rootDir, "local-signer.sock");
+	const hostingSigner = String(effectiveEnv.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting" || socketPath === "/run/fased-signerd/app.sock";
+	const expectedSocketMode = hostingSigner ? 432 : 384;
 	const { pidPath, auditPath } = resolveLocalSignerSidecarPaths(socketPath);
-	const wallet = resolveWalletConfigForRuntime(cfg, effectiveEnv);
 	const checks = [];
 	const push = (check, ok, detail) => checks.push({
 		check,
@@ -2136,161 +1042,93 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 	const providerRegistry = readWalletProviderRegistry(effectiveEnv);
 	const providerWallets = providerRegistry.wallets.filter((entry) => entry.providerId === providerId);
 	const localSignerSetupPending = isLocalSigner && providerWallets.length === 0;
+	let localSignerHealth;
 	const isNotFoundError = (err) => err?.code === "ENOENT";
 	if (isLocalSigner) {
+		const externallyManaged = isLocalSignerExternallyManaged(effectiveEnv);
 		try {
 			const st = syncFs.statSync(socketPath);
 			push("socket.exists", st.isSocket?.() ?? true, socketPath);
 			try {
 				const mode = st.mode & 511;
-				push("socket.mode", mode === 384, `mode=${mode.toString(8)}`);
+				push("socket.mode", mode === expectedSocketMode, `mode=${mode.toString(8)} expected=${expectedSocketMode.toString(8)}`);
 			} catch {}
 		} catch (err) {
 			push("socket.exists", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
 		}
-		try {
-			const pidRaw = syncFs.readFileSync(pidPath, "utf8").trim();
-			const pid = Number.parseInt(pidRaw, 10);
-			if (Number.isFinite(pid) && pid > 1) {
-				try {
-					process.kill(pid, 0);
-					push("pid.alive", true, `pid=${pid}`);
-				} catch (err) {
-					push("pid.alive", false, `pid=${pid} ${String(err)}`);
+		if (externallyManaged) {
+			push("pid.alive", true, "lifecycle=external; process health is verified over the socket");
+		} else {
+			try {
+				const pidRaw = syncFs.readFileSync(pidPath, "utf8").trim();
+				const pid = Number.parseInt(pidRaw, 10);
+				if (Number.isFinite(pid) && pid > 1) {
+					try {
+						process.kill(pid, 0);
+						push("pid.alive", true, `pid=${pid}`);
+					} catch (err) {
+						push("pid.alive", false, `pid=${pid} ${String(err)}`);
+					}
+				} else {
+					push("pid.alive", false, "invalid pid file");
 				}
-			} else {
-				push("pid.alive", false, "invalid pid file");
+			} catch (err) {
+				push("pid.alive", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
 			}
-		} catch (err) {
-			push("pid.alive", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
 		}
-		try {
-			const st = syncFs.statSync(auditPath);
-			push("audit.exists", true, `bytes=${st.size}`);
-		} catch (err) {
-			push("audit.exists", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
+		if (externallyManaged) {
+			push("audit.exists", true, "lifecycle=external; audit state is signer-owned");
+		} else {
+			try {
+				const st = syncFs.statSync(auditPath);
+				push("audit.exists", true, `bytes=${st.size}`);
+			} catch (err) {
+				push("audit.exists", localSignerSetupPending && isNotFoundError(err), localSignerSetupPending && isNotFoundError(err) ? "Configure" : String(err));
+			}
 		}
 		if (localSignerSetupPending) {
 			push("socket.health", true, "Configure");
 		} else {
 			try {
-				const signerHealth = await createWalletProviderAdapter({
-					cfg,
-					wallet,
-					env: effectiveEnv,
-					providerIdOverride: "local-socket-signer"
-				}).health();
-				push("socket.health", signerHealth.ok, signerHealth.details);
+				localSignerHealth = await probeLocalSocketSignerHealth(socketPath);
+				push("socket.health", localSignerHealth.ok, localSignerHealth.details);
 			} catch (err) {
 				push("socket.health", false, String(err));
 			}
 		}
 	}
-	const providerDefaultWallet = providerRegistry.defaultWalletId ? providerWallets.find((entry) => entry.id === providerRegistry.defaultWalletId) : undefined;
-	const passphrase = String(effectiveEnv.FASED_WALLET_PASSPHRASE ?? "").trim() || (() => {
-		const p = String(effectiveEnv.FASED_WALLET_PASSPHRASE_FILE ?? "").trim() || path.join(resolveLocalSignerMaterialRootDir(effectiveEnv), "passphrase");
-		if (!p) {
-			return "";
-		}
-		try {
-			return syncFs.readFileSync(p, "utf8").trim();
-		} catch {
-			return "";
-		}
-	})();
-	const inspectKeystore = (label, keystorePath) => {
-		try {
-			const raw = syncFs.readFileSync(keystorePath, "utf8");
-			const kind = detectEmbeddedKeystoreType(raw);
-			if (kind === "unknown") {
-				push(`keystore.file.${label}`, false, `${keystorePath} type=unknown (expected fased-solana-keypair envelope)`);
-			} else {
-				push(`keystore.file.${label}`, true, `${keystorePath} type=${kind}`);
-			}
-			if (!passphrase) {
-				push(`keystore.passphrase.${label}`, false, "missing FASED_WALLET_PASSPHRASE(_FILE)");
-			} else if (kind === "solana-envelope") {
-				try {
-					const envv = parseSolanaKeystoreEnvelope(raw);
-					if (!envv) {
-						throw new Error("invalid solana envelope");
-					}
-					void decryptSolanaKeypairEnvelope(envv, passphrase);
-					push(`keystore.decrypt.${label}`, true, "solana envelope decrypt ok");
-				} catch (err) {
-					push(`keystore.decrypt.${label}`, false, String(err));
-				}
-			} else {
-				push(`keystore.decrypt.${label}`, false, "unsupported keystore format");
-			}
-		} catch (err) {
-			push(`keystore.file.${label}`, false, String(err));
-		}
-	};
-	const listWalletIds = (prefix) => {
-		const out = new Set();
-		for (const [key, value] of Object.entries(effectiveEnv)) {
-			if (!key.startsWith(prefix)) {
-				continue;
-			}
-			if (typeof value !== "string" || !value.trim()) {
-				continue;
-			}
-			const walletId = key.slice(prefix.length).trim().toLowerCase();
-			if (walletId) {
-				out.add(walletId);
-			}
-		}
-		return [...out].toSorted();
+	const signerHealthy = checks.find((entry) => entry.check === "socket.health")?.ok === true;
+	const registrySolanaWalletIds = providerWallets.filter((entry) => Boolean(entry.addresses?.solana)).map((entry) => entry.id.trim()).filter(Boolean).toSorted();
+	push("wallets.configured.solana", true, registrySolanaWalletIds.length > 0 ? registrySolanaWalletIds.join(",") : "none");
+	const resolveChainRpcConfigured = (walletId) => {
+		const suffix = walletIdEnvSuffix(walletId);
+		return Boolean((suffix ? String(effectiveEnv[`FASED_WALLET_SOLANA_RPC_URL__${suffix}`] ?? "").trim() : "") || String(effectiveEnv.FASED_WALLET_SOLANA_RPC_URL ?? "").trim() || String(effectiveEnv.FASED_WALLET_RPC_URL ?? "").trim());
 	};
-	const solanaWalletIds = listWalletIds("FASED_WALLET_SOLANA_KEYSTORE_PATH__");
-	const registrySolanaWalletIds = providerWallets.filter((wallet) => Boolean(wallet.addresses?.solana)).map((wallet) => wallet.id.trim().toLowerCase()).filter(Boolean);
-	const configuredSolanaWallets = new Set([...solanaWalletIds, ...registrySolanaWalletIds]);
-	push("wallets.configured.solana", true, configuredSolanaWallets.size ? [...configuredSolanaWallets].join(",") : "default-only (or fallback vars)");
-	const shouldInspectDefaultWallet = () => {
-		const perChainKey = "FASED_WALLET_SOLANA_KEYSTORE_PATH";
-		const explicitChainPath = String(effectiveEnv[perChainKey] ?? "").trim() || String(effectiveEnv.FASED_WALLET_KEYSTORE_PATH ?? "").trim();
-		if (explicitChainPath) {
-			return true;
-		}
-		if (providerId !== "local-socket-signer" && typeof cfg.wallet?.keystore?.path === "string" && cfg.wallet.keystore.path.trim()) {
-			return true;
-		}
-		const defaultPath = resolveEmbeddedKeystorePathForChain(effectiveEnv, "solana");
-		if (syncFs.existsSync(defaultPath)) {
-			return true;
-		}
-		if (providerDefaultWallet?.addresses?.solana) {
-			return true;
+	const signerNetworks = localSignerHealth?.network?.wallets ?? [];
+	const networkForWallet = (walletId) => signerNetworks.find((entry) => entry.walletId.trim().toLowerCase() === walletId.trim().toLowerCase());
+	if (isLocalSigner && registrySolanaWalletIds.length > 0) {
+		const signerNetworkReady = localSignerHealth?.network?.ready === true && registrySolanaWalletIds.every((walletId) => networkForWallet(walletId)?.ready === true);
+		push("rpc.configured.solana", signerNetworkReady, signerNetworkReady ? "signer-owned network ready" : localSignerHealth?.ok ? "signer-owned network pending" : "signer health unavailable");
+	}
+	if (isLocalSigner && localSignerHealth?.ok && localSignerHealth.jupiter) {
+		push("jupiter.trigger.configured", true, localSignerHealth.jupiter.triggerConfigured ? "configured in native signer" : "not configured (optional; swaps and transfers remain available)");
+		push("jupiter.execution.mode", localSignerHealth.jupiter.liveEnabled !== true, localSignerHealth.jupiter.liveEnabled === true ? "live execution enabled for qualification only; this release remains preview-only" : "preview-only; signer rejects Jupiter and Trigger execution");
+	}
+	if (isLocalSigner && localSignerHealth?.ok && localSignerHealth.state?.capacities) {
+		for (const [label, capacity] of Object.entries(localSignerHealth.state.capacities).toSorted(([left], [right]) => left.localeCompare(right))) {
+			push(`state.capacity.${label}`, !capacity.warning, `${capacity.used}/${capacity.maximum} records; warning=${capacity.warnAt}`);
+		}
+	}
+	for (const walletId of registrySolanaWalletIds) {
+		push(`keystore.file.solana.${walletId}`, signerHealthy, signerHealthy ? "signer-owned encrypted state; normal Fased Node key-handling path disabled (Local same-user isolation is not a hard boundary)" : "native signer is not healthy");
+		push(`keystore.decrypt.solana.${walletId}`, signerHealthy, signerHealthy ? "native signer handles decryption; normal Fased Node decryption path disabled (Local same-user isolation is not a hard boundary)" : "native signer is not healthy");
+		if (isLocalSigner) {
+			const network = networkForWallet(walletId);
+			push(`rpc.configured.solana.${walletId}`, network?.ready === true, network?.ready ? `signer-owned network ready (version=${network.version})` : network?.configured ? "signer-owned network is not ready" : "signer-owned network is not configured");
+		} else {
+			const rpcConfigured = resolveChainRpcConfigured(walletId);
+			push(`rpc.configured.solana.${walletId}`, rpcConfigured, rpcConfigured ? "configured" : "missing");
 		}
-		return false;
-	};
-	const solanaWalletSet = new Set([
-		...shouldInspectDefaultWallet() ? ["default"] : [],
-		...solanaWalletIds,
-		...registrySolanaWalletIds
-	]);
-	const resolveChainKeystorePath = (walletId) => {
-		const explicitFallback = providerId !== "local-socket-signer" && walletId === "default" ? cfg.wallet?.keystore?.path : undefined;
-		return resolveEmbeddedKeystorePathForChain(effectiveEnv, "solana", explicitFallback, walletId);
-	};
-	for (const walletId of [...solanaWalletSet].toSorted()) {
-		inspectKeystore(`solana.${walletId}`, resolveChainKeystorePath(walletId));
-	}
-	const resolveChainRpcUrl = (walletId) => {
-		const suffix = walletId.toUpperCase();
-		const perWalletKey = `FASED_WALLET_SOLANA_RPC_URL__${suffix}`;
-		const perChainKey = "FASED_WALLET_SOLANA_RPC_URL";
-		return String(effectiveEnv[perWalletKey] ?? "").trim() || String(effectiveEnv[perChainKey] ?? "").trim() || String(effectiveEnv.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim();
-	};
-	const solanaRpcChecks = [...solanaWalletSet].toSorted().map((walletId) => resolveChainRpcUrl(walletId));
-	const solanaRpcUrl = solanaRpcChecks.find(Boolean) ?? "";
-	if (solanaWalletSet.size > 0 || String(effectiveEnv.FASED_WALLET_SOLANA_RPC_URL ?? "").trim()) {
-		push("rpc.configured.solana", Boolean(solanaRpcUrl), solanaRpcUrl || "missing");
-	}
-	for (const walletId of [...solanaWalletSet].toSorted()) {
-		const u = resolveChainRpcUrl(walletId);
-		push(`rpc.configured.solana.${walletId}`, Boolean(u), u || "missing");
 	}
 	const ok = checks.every((c) => {
 		if (c.ok) {
@@ -2304,12 +1142,22 @@ async function collectWalletSignerDoctorReport(env = process.env, options = {})
 		}
 		return false;
 	});
+	const signer = localSignerHealth?.ok ? {
+		...localSignerHealth.jupiter ? { jupiter: localSignerHealth.jupiter } : {},
+		...localSignerHealth.webAuthn ? { webAuthn: {
+			configured: localSignerHealth.webAuthn.configured,
+			credentialCount: localSignerHealth.webAuthn.credentialCount,
+			credentialVersion: localSignerHealth.webAuthn.credentialVersion,
+			ready: localSignerHealth.webAuthn.ready
+		} } : {}
+	} : undefined;
 	return {
 		ok,
 		socketPath,
 		pidPath,
 		auditPath,
-		checks
+		checks,
+		...signer ? { signer } : {}
 	};
 }
 async function walletSignerDoctorCommand(runtime = defaultRuntime, options = {}) {
@@ -2325,317 +1173,131 @@ async function walletSignerDoctorCommand(runtime = defaultRuntime, options = {})
 	}
 }
 async function walletRotateKeysCommand(runtime = defaultRuntime, options = {}) {
-	const cfg = loadConfig();
-	const resolved = resolveWalletConfigForRuntime(cfg, process.env);
-	if (!resolved.enabled) {
-		throw new Error("wallet is disabled");
-	}
-	const provider = createWalletProviderAdapter({
-		cfg,
-		wallet: resolved,
-		env: process.env
-	});
-	if (!provider.capabilities.supportsRotateKeys || !provider.rotateKeys) {
-		throw new Error(`provider ${provider.id} does not support key rotation`);
-	}
-	const result = await provider.rotateKeys();
-	if (options.json) {
-		runtime.log(JSON.stringify(result, null, 2));
-	} else {
-		runtime.log("Wallet keys rotated.");
-		if (result.addresses?.solana) {
-			runtime.log(`Address: ${result.addresses.solana}`);
-		}
-	}
+	void runtime;
+	void options;
+	throw new Error("Gateway wallet key rotation was removed. For signer-owned encryption rotation, run `fased-signerd admin wallet reencrypt --control-socket <absolute-control.sock> --wallet-id <wallet-id>` as the signer/control-socket owner. Rotate Turnkey or hardware custody only in its provider/wallet authority surface.");
 }
-async function initializeWalletCustodyForWallet(params) {
-	const env = params.env ?? process.env;
-	const cfg = params.cfg ?? loadConfig();
-	const walletCfg = resolveWalletConfigForRuntime(cfg, env);
-	const providerId = resolveWalletProviderId(cfg, env);
-	if (providerId !== "local-socket-signer") {
-		throw new Error("split-key custody currently requires local-socket-signer");
-	}
-	const approvalAuth = readWalletApprovalAuthSnapshot(env, cfg);
-	if (approvalAuth.mode !== "webauthn" || approvalAuth.passkeyCount < 1) {
-		throw new Error("split-key custody requires wallet approval auth mode=webauthn with at least one enrolled passkey");
-	}
-	const oldPassphrase = resolveKeystorePassphrase(undefined, env);
-	if (!oldPassphrase) {
-		throw new Error("split-key custody migration requires the current keystore passphrase to be configured before initialization");
-	}
-	const allTargets = collectLocalSignerKeystoreTargets(cfg, env);
-	const distinctWalletIds = [...new Set(allTargets.map((target) => target.walletId || "default"))];
-	const requestedWalletId = params.walletId?.trim() || "";
-	if (!requestedWalletId && distinctWalletIds.length > 1) {
-		throw new Error(`multiple local-signer wallets found (${distinctWalletIds.join(", ")}); re-run with --wallet <walletId>`);
-	}
-	const resolvedWalletId = requestedWalletId || distinctWalletIds[0] || "default";
-	const registry = readWalletProviderRegistry(env);
-	const registryWallet = registry.wallets.find((wallet) => walletIdsMatchForEnvSuffix(wallet.id, resolvedWalletId));
-	const walletRole = resolveWalletUserRole(registryWallet) ?? (walletIdsMatchForEnvSuffix(registry.defaultWalletId, resolvedWalletId) ? "agent" : undefined);
-	if (walletRole !== "vault") {
-		throw new Error("split-key wallet security can only be enabled for Vault wallets. Agent wallets use automation, caps, and passkey-reviewed manual sends; Mining wallets use SAT mining/sweep policy. Create or select a Vault wallet before enabling wallet security.");
-	}
-	const targets = allTargets.filter((target) => walletIdsMatchForEnvSuffix(target.walletId, resolvedWalletId));
-	if (targets.length === 0) {
-		throw new Error(`no self-hosted local-signer keystores were found to migrate for ${resolvedWalletId}`);
-	}
-	const result = initializeWalletCustodyCeremony({
-		env,
-		force: Boolean(params.force),
-		deviceShare: params.deviceShare,
-		walletId: resolvedWalletId,
-		wallet: walletCfg,
-		cfg
-	});
-	if (!result.ok) {
-		throw new Error(result.message);
-	}
-	const recovered = recoverWalletCustodyPassphrase({
-		env,
-		deviceShare: result.deviceShare,
-		walletId: resolvedWalletId
-	});
-	if (!recovered.ok) {
-		throw new Error(recovered.message);
-	}
-	for (const target of targets) {
-		await reencryptLocalSignerKeystore({
-			target,
-			oldPassphrase,
-			newPassphrase: recovered.passphrase
-		});
-	}
-	const custodyWallets = parseCustodyWalletSet({
-		...env,
-		...cfg.env?.vars
-	});
-	custodyWallets.add(normalizeCustodyWalletId(resolvedWalletId));
-	const allSignerWalletsMigrated = allTargets.every((target) => custodyWallets.has(normalizeCustodyWalletId(target.walletId)));
-	let nextCfg = allSignerWalletsMigrated ? clearConfiguredSignerPassphrase(cfg) : cfg;
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_MODE", "split-key");
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_WALLETS", formatCustodyWalletSet(custodyWallets));
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_PASSKEY_CEREMONY", "1");
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION", "1");
-	nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_PHASE2_COMPLETE", "1");
-	await writeConfigFile(nextCfg);
-	process.env.FASED_WALLET_CUSTODY_MODE = "split-key";
-	process.env.FASED_WALLET_CUSTODY_WALLETS = formatCustodyWalletSet(custodyWallets);
-	process.env.FASED_WALLET_CUSTODY_PASSKEY_CEREMONY = "1";
-	process.env.FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION = "1";
-	process.env.FASED_WALLET_CUSTODY_PHASE2_COMPLETE = "1";
-	let removedPassphraseFile = { removed: false };
-	if (allSignerWalletsMigrated) {
-		delete process.env.FASED_WALLET_PASSPHRASE;
-		removedPassphraseFile = removeLocalSignerPassphraseFileIfManaged(env);
-		delete process.env.FASED_WALLET_PASSPHRASE_FILE;
-	}
-	writeLocalSignerEnvFile(nextCfg, process.env);
-	let signerRestarted = true;
-	let signerRestartError;
-	try {
-		await restartLocalSocketSigner(undefined, process.env);
-	} catch (err) {
-		signerRestarted = false;
-		signerRestartError = err instanceof Error ? err.message : String(err);
-	}
-	return {
-		ok: true,
-		scheme: result.scheme,
-		statePath: result.statePath,
-		walletId: result.walletId,
-		role: result.role,
-		deviceShare: result.deviceShare,
-		recoveryShare: result.recoveryShare,
-		secretBytes: result.secretBytes,
-		updatedAt: result.updatedAt,
-		migratedKeystores: targets.map((target) => ({
-			chain: target.chain,
-			walletId: target.walletId,
-			path: target.path
-		})),
-		walletProvider: providerId,
-		executionMode: walletCfg.execution.mode,
-		removedManagedPassphraseFile: removedPassphraseFile.removed,
-		removedManagedPassphraseFilePath: removedPassphraseFile.path,
-		signerRestarted,
-		signerRestartError
-	};
+function isLegacyWalletMaterialEnvKey(key) {
+	return key === "FASED_WALLET_KEYSTORE_PATH" || key === "FASED_WALLET_PASSPHRASE" || key === "FASED_WALLET_PASSPHRASE_FILE" || key === "FASED_WALLET_PRIVATE_KEY" || key === "FASED_WALLET_SOLANA_KEYSTORE_PATH" || key.startsWith("FASED_WALLET_SOLANA_KEYSTORE_PATH__");
 }
-async function disableWalletCustodyForWallet(params) {
-	const env = params.env ?? process.env;
-	const cfg = params.cfg ?? loadConfig();
+async function walletLegacyMigrationFinalizeCommand(runtime = defaultRuntime, options) {
+	const walletId = options.walletId.trim();
+	if (!walletId || !/^[a-zA-Z0-9_-]+$/.test(walletId)) {
+		throw new Error("walletId must contain only letters, numbers, hyphens, or underscores");
+	}
+	const cfg = loadConfig();
 	const effectiveEnv = {
-		...env,
+		...process.env,
 		...cfg.env?.vars
 	};
-	const walletCfg = resolveWalletConfigForRuntime(cfg, env);
-	const providerId = resolveWalletProviderId(cfg, env);
-	if (providerId !== "local-socket-signer") {
-		throw new Error("wallet security disable currently requires local-socket-signer");
-	}
-	const requestedWalletId = params.walletId?.trim() || "";
-	if (!requestedWalletId) {
-		throw new Error("wallet id is required to disable wallet security");
-	}
-	const status = readWalletCustodyStatus({
-		cfg,
-		env: effectiveEnv,
-		wallet: walletCfg,
-		walletId: requestedWalletId
-	});
-	if (status.mode === "single-key") {
-		throw new Error(`wallet security is not enabled for ${requestedWalletId}`);
-	}
-	const resolvedWalletId = status.target.walletId || requestedWalletId;
-	const allTargets = collectLocalSignerKeystoreTargets(cfg, env);
-	const targets = allTargets.filter((target) => walletIdsMatchForEnvSuffix(target.walletId, resolvedWalletId));
-	if (targets.length === 0) {
-		throw new Error(`no local-signer keystore was found for ${resolvedWalletId}`);
-	}
-	const recovered = recoverWalletCustodyPassphrase({
-		env: effectiveEnv,
-		walletId: resolvedWalletId,
-		deviceShare: params.deviceShare,
-		recoveryShare: params.recoveryShare
+	const socketPath = requireLocalSocketSignerPath(effectiveEnv);
+	const capabilities = await callLocalSocketSigner(socketPath, { op: "v2.capabilities" });
+	if (capabilities.ready !== true || capabilities.capabilities?.protocol?.current !== 2 || !capabilities.capabilities?.features?.includes("signerOwnedKeys")) {
+		throw new Error("legacy migration finalization requires a ready protocol-v2 signer-owned wallet");
+	}
+	const nativeWallet = await callLocalSocketSigner(socketPath, {
+		op: "v2.wallet.get",
+		walletId
 	});
-	if (!recovered.ok) {
-		throw new Error(recovered.message);
+	const expectedSignerWalletId = normalizeNativeSignerWalletId(walletId);
+	const signerWalletId = String(nativeWallet.walletId ?? "").trim();
+	const publicKey = String(nativeWallet.publicKey ?? "").trim();
+	if (!publicKey || signerWalletId !== expectedSignerWalletId) {
+		throw new Error("protocol-v2 signer did not return the requested signer-owned wallet");
 	}
-	const passphraseSource = ensureLocalSignerPassphraseFileForCustodyDisable({
-		cfg,
-		env
-	});
-	let nextCfg = passphraseSource.cfg;
-	for (const target of targets) {
-		await reencryptLocalSignerKeystore({
-			target,
-			oldPassphrase: recovered.passphrase,
-			newPassphrase: passphraseSource.passphrase
-		});
+	const registry = readWalletProviderRegistry(effectiveEnv);
+	const legacyWallet = registry.wallets.find((wallet) => wallet.id === walletId);
+	const signerIdCollision = findNativeSignerWalletIdCollision(registry.wallets, walletId, signerWalletId);
+	if (signerIdCollision) {
+		throw new Error(`native signer wallet ID ${signerWalletId} is already registered as ${signerIdCollision.id}; refusing legacy migration finalization`);
 	}
-	const remainingCustodyWallets = new Set();
-	for (const walletStatus of listSplitKeyWalletCustodyStatuses({
-		wallet: walletCfg,
-		cfg,
-		env: effectiveEnv
-	})) {
-		if (!walletIdsMatchForEnvSuffix(walletStatus.target.walletId, resolvedWalletId)) {
-			remainingCustodyWallets.add(normalizeCustodyWalletId(walletStatus.target.walletId));
+	if (legacyWallet && legacyWallet.providerId !== "embedded-keystore") {
+		if (legacyWallet.providerId !== "local-socket-signer") {
+			throw new Error(`wallet ${walletId} is registered to ${legacyWallet.providerId}, not the legacy provider`);
+		}
+		const registeredAddress = legacyWallet.addresses?.solana?.trim();
+		if (registeredAddress && registeredAddress !== publicKey) {
+			throw new Error(`signer public key mismatch for ${walletId}; registry=${registeredAddress} signer=${publicKey}`);
+		}
+		const registeredSignerWalletId = legacyWallet.metadata?.signerWalletId;
+		if (typeof registeredSignerWalletId === "string" && registeredSignerWalletId.trim() && registeredSignerWalletId.trim() !== signerWalletId) {
+			throw new Error(`signer wallet ID mismatch for ${walletId}; registry=${registeredSignerWalletId.trim()} signer=${signerWalletId}`);
 		}
 	}
-	if (remainingCustodyWallets.size > 0) {
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_MODE", "split-key");
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_WALLETS", formatCustodyWalletSet(remainingCustodyWallets));
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_PASSKEY_CEREMONY", "1");
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION", "1");
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_PHASE2_COMPLETE", "1");
-	} else {
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_MODE", undefined);
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_WALLETS", undefined);
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_PASSKEY_CEREMONY", undefined);
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION", undefined);
-		nextCfg = setConfigEnvVar(nextCfg, "FASED_WALLET_CUSTODY_PHASE2_COMPLETE", undefined);
-	}
-	await writeConfigFile(nextCfg);
-	process.env.FASED_WALLET_PASSPHRASE_FILE = passphraseSource.passphraseFile;
-	delete process.env.FASED_WALLET_PASSPHRASE;
-	if (remainingCustodyWallets.size > 0) {
-		process.env.FASED_WALLET_CUSTODY_MODE = "split-key";
-		process.env.FASED_WALLET_CUSTODY_WALLETS = formatCustodyWalletSet(remainingCustodyWallets);
-		process.env.FASED_WALLET_CUSTODY_PASSKEY_CEREMONY = "1";
-		process.env.FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION = "1";
-		process.env.FASED_WALLET_CUSTODY_PHASE2_COMPLETE = "1";
-	} else {
-		delete process.env.FASED_WALLET_CUSTODY_MODE;
-		delete process.env.FASED_WALLET_CUSTODY_WALLETS;
-		delete process.env.FASED_WALLET_CUSTODY_PASSKEY_CEREMONY;
-		delete process.env.FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION;
-		delete process.env.FASED_WALLET_CUSTODY_PHASE2_COMPLETE;
-	}
-	const deletedCeremony = deleteWalletCustodyCeremony({
-		env: effectiveEnv,
-		cfg,
-		wallet: walletCfg,
-		walletId: resolvedWalletId
+	const legacyAddress = legacyWallet?.addresses?.solana?.trim();
+	if (legacyAddress && legacyAddress !== publicKey) {
+		throw new Error(`signer public key mismatch for ${walletId}; registry=${legacyAddress} signer=${publicKey}`);
+	}
+	upsertNamedWallet({
+		walletId,
+		name: options.walletName?.trim() || legacyWallet?.name || "Wallet",
+		providerId: "local-socket-signer",
+		addresses: { solana: publicKey },
+		metadata: {
+			...legacyWallet?.metadata,
+			keyAuthority: "signer-owned-v2",
+			signerWalletId,
+			migratedFromProviderId: "embedded-keystore",
+			migratedAt: new Date().toISOString()
+		},
+		env: effectiveEnv
 	});
-	const locked = await lockWalletCustodyUnlockSessions({
-		env: process.env,
-		walletId: resolvedWalletId
+	setWalletProviderEnabled({
+		providerId: "local-socket-signer",
+		enabled: true,
+		env: effectiveEnv
 	});
-	writeLocalSignerEnvFile(nextCfg, process.env);
-	let signerRestarted = true;
-	let signerRestartError;
-	try {
-		await restartLocalSocketSigner(undefined, process.env);
-	} catch (err) {
-		signerRestarted = false;
-		signerRestartError = err instanceof Error ? err.message : String(err);
+	const afterRegistry = readWalletProviderRegistry(effectiveEnv);
+	const remainingLegacyWallets = afterRegistry.wallets.filter((wallet) => wallet.providerId === "embedded-keystore");
+	if (remainingLegacyWallets.length === 0) {
+		setWalletProviderEnabled({
+			providerId: "embedded-keystore",
+			enabled: false,
+			env: effectiveEnv
+		});
+		const vars = { ...cfg.env?.vars };
+		for (const key of Object.keys(vars)) {
+			if (isLegacyWalletMaterialEnvKey(key)) {
+				delete vars[key];
+			}
+		}
+		for (const key of Object.keys(process.env)) {
+			if (isLegacyWalletMaterialEnvKey(key)) {
+				delete process.env[key];
+			}
+		}
+		await writeConfigFile({
+			...cfg,
+			env: {
+				...cfg.env,
+				vars
+			},
+			wallet: {
+				...cfg.wallet,
+				provider: {
+					...cfg.wallet?.provider,
+					id: "local-socket-signer"
+				},
+				keystore: undefined
+			}
+		}, { envSnapshotForRestore: process.env });
 	}
-	return {
+	const result = {
 		ok: true,
-		walletId: resolvedWalletId,
-		migratedKeystores: targets.map((target) => ({
-			chain: target.chain,
-			walletId: target.walletId,
-			path: target.path
-		})),
-		remainingCustodyWallets: formatCustodyWalletSet(remainingCustodyWallets),
-		passphraseFile: passphraseSource.passphraseFile,
-		custodyStateRemoved: deletedCeremony.removed,
-		custodyStatePath: deletedCeremony.statePath,
-		unlockSessionsCleared: locked.ok ? locked.removed : 0,
-		unlockSessionClearError: locked.ok ? undefined : locked.message,
-		signerRestarted,
-		signerRestartError
+		walletId,
+		signerWalletId,
+		publicKey,
+		alreadyFinalized: legacyWallet?.providerId === "local-socket-signer" && legacyWallet.addresses?.solana?.trim() === publicKey,
+		remainingLegacyWalletIds: remainingLegacyWallets.map((wallet) => wallet.id)
 	};
-}
-async function walletCustodyInitCommand(runtime = defaultRuntime, options = {}) {
-	const result = await initializeWalletCustodyForWallet({
-		walletId: options.walletId,
-		deviceShare: options.deviceShare,
-		force: options.force,
-		env: process.env
-	});
 	if (options.json) {
 		runtime.log(JSON.stringify(result, null, 2));
-		return;
-	}
-	runtime.log("Wallet split-key custody ceremony initialized.");
-	runtime.log(`Wallet: ${result.walletId}`);
-	runtime.log(`Scheme: ${result.scheme}`);
-	runtime.log(`State: ${result.statePath}`);
-	runtime.log(`Secret bytes: ${result.secretBytes}`);
-	runtime.log(`Migrated keystores: ${result.migratedKeystores.length}`);
-	if (result.removedManagedPassphraseFile) {
-		runtime.log(`Removed managed passphrase file: ${result.removedManagedPassphraseFilePath}`);
-	} else if (result.removedManagedPassphraseFilePath) {
-		runtime.log(`Passphrase file still exists outside signer state dir; remove it manually: ${result.removedManagedPassphraseFilePath}`);
-	}
-	runtime.log("Signer env updated and local signer restarted in split-key custody mode.");
-	runtime.log("Device share (store offline, never commit):");
-	runtime.log(result.deviceShare);
-	runtime.log("Recovery share (store offline separately; use with host share if the device is lost):");
-	runtime.log(result.recoveryShare);
-}
-async function walletCustodyLockCommand(runtime = defaultRuntime, options = {}) {
-	const result = await lockWalletCustodyUnlockSessions({
-		env: process.env,
-		host: options.host,
-		walletId: options.walletId
-	});
-	if (!result.ok) {
-		throw new Error(result.message);
-	}
-	if (options.json) {
-		runtime.log(JSON.stringify({
-			ok: true,
-			result
-		}, null, 2));
-		return;
+	} else {
+		runtime.log(`Verified and finalized signer-owned migration for ${walletId}; signer wallet ID: ${signerWalletId} (${publicKey}).`);
+		if (remainingLegacyWallets.length > 0) {
+			runtime.log(`Remaining legacy wallets: ${remainingLegacyWallets.map((wallet) => wallet.id).join(", ")}`);
+		}
 	}
-	runtime.log(`Custody unlock sessions locked: removed=${result.removed} remaining=${result.remaining}${result.host ? ` host=${result.host}` : ""}${result.walletId ? ` wallet=${result.walletId}` : ""}`);
 }
 async function walletStackInstallCommand(runtime = defaultRuntime, options = {}) {
 	throwLegacyDockerSignerRemoved("wallet stack install");
@@ -2740,12 +1402,7 @@ async function walletCanaryCommand(runtime = defaultRuntime, options = {}) {
 	};
 	if (options.executeProviderE2E) {
 		const requestedProviders = (options.providers ?? []).map((entry) => entry.trim()).filter(Boolean);
-		const allowed = new Set([
-			"embedded-keystore",
-			"alchemy",
-			"turnkey",
-			"privy"
-		]);
+		const allowed = new Set(["alchemy", "turnkey"]);
 		const providers = requestedProviders.filter((entry) => allowed.has(entry));
 		const providerE2E = await runWalletProviderCanaryReport({
 			cfg,
@@ -2852,4 +1509,4 @@ async function walletInboundReconcileCommand(runtime = defaultRuntime, options =
 }
 
 //#endregion
-export { collectWalletSignerDoctorReport, disableWalletCustodyForWallet, initializeWalletCustodyForWallet, walletCanaryCommand, walletCustodyInitCommand, walletCustodyLockCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletKeystoreExportCommand, walletKeystoreImportCommand, walletKeystoreInitCommand, walletKeystorePassphraseInitCommand, walletKeystorePassphraseRotateCommand, walletKeystoreStatusCommand, walletKeystoreValidateCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerBrokerCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand };
+export { collectWalletSignerDoctorReport, walletCanaryCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletLegacyMigrationFinalizeCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand };