@fased/fased 0.1.62 → 0.1.64

package/dist/wallet/providers/turnkey-adapter.js

@@ -1,19 +1,55 @@
+import { fetchSolanaRpc } from "../solana-assets.js";
 import { WalletProviderError } from "../wallet-provider-adapter.js";
+import { walletDiagnosticErrorMessage } from "../wallet-redaction.js";
+import { executeTurnkeyReviewedTransaction, prepareTurnkeyReviewedTransaction } from "../turnkey-reviewed-state.js";
+import { Transaction } from "@solana/web3.js";
+import { Turnkey, defaultSolanaAccountAtIndex } from "@turnkey/sdk-server";
 
 //#region src/wallet/providers/turnkey-adapter.ts
+const DEFAULT_TURNKEY_API_BASE_URL = "https://api.turnkey.com";
+function clean(value) {
+	return String(value ?? "").trim();
+}
+function asProviderError(error, action) {
+	if (error instanceof WalletProviderError) {
+		return error;
+	}
+	return new WalletProviderError({
+		code: "wallet_provider_unavailable",
+		message: `Turnkey ${action} failed: ${walletDiagnosticErrorMessage(error)}`,
+		retryable: false,
+		cause: error
+	});
+}
 var TurnkeyAdapter = class {
 	constructor(options) {
 		this.id = "turnkey";
 		this.displayName = "Turnkey Wallet";
-		this.credentials = options.credentials;
+		this.clientPromise = null;
+		this.credentials = {
+			apiPublicKey: clean(options.credentials.apiPublicKey),
+			apiPrivateKey: clean(options.credentials.apiPrivateKey),
+			organizationId: clean(options.credentials.organizationId) || undefined,
+			policyId: clean(options.credentials.policyId) || undefined,
+			baseUrl: clean(options.credentials.baseUrl) || undefined,
+			rpcUrl: clean(options.credentials.rpcUrl) || undefined,
+			defaultSolanaAddress: clean(options.credentials.defaultSolanaAddress) || undefined,
+			providerWalletId: clean(options.credentials.providerWalletId) || undefined
+		};
+		this.walletName = clean(options.walletName) || `FasedAgent Solana ${Date.now()}`;
+		this.stateEnv = options.stateEnv ?? process.env;
+		this.dependencies = options.dependencies ?? {};
 		this.capabilities = {
 			custodyModel: "provider-managed",
 			supportsCreateWallet: true,
-			supportsPrepare: false,
-			supportsSend: false,
+			supportsPrepare: true,
+			supportsSend: true,
 			supportsRotateKeys: false,
 			supportsResetKeys: false,
 			supportsPasskeyGate: false,
+			signingLocation: "server",
+			supportsSignTransaction: true,
+			supportsSignMessage: false,
 			supportedExecutionModes: ["manual"],
 			supportedChains: ["solana"]
 		};
@@ -22,57 +58,279 @@ var TurnkeyAdapter = class {
 		return chain === "solana";
 	}
 	async health() {
-		const configured = Boolean(this.credentials.apiPublicKey && this.credentials.apiPrivateKey);
-		return {
-			ok: configured,
-			provider: this.id,
-			configured,
-			checkedAt: new Date().toISOString(),
-			details: configured ? "Turnkey adapter configured for Solana wallet discovery." : "Turnkey adapter is missing API credentials."
-		};
+		const checkedAt = new Date().toISOString();
+		const missing = this.missingConfiguration({ requireAddress: false });
+		if (missing.length > 0) {
+			return {
+				ok: false,
+				provider: this.id,
+				configured: false,
+				checkedAt,
+				details: `Turnkey requires ${missing.join(", ")}. Use a dedicated API user/sub-organization covered by one restrictive Turnkey policy; the Gateway-held API key must not be authorized by another permissive policy.`
+			};
+		}
+		try {
+			const client = await this.getClient();
+			const policyResponse = await client.getPolicy({
+				organizationId: this.requireOrganizationId(),
+				policyId: this.requirePolicyId()
+			});
+			const policy = policyResponse.policy;
+			if (clean(policy?.policyId) !== this.requirePolicyId() || policy?.effect !== "EFFECT_ALLOW" || !clean(policy?.condition)) {
+				throw new Error("configured policy reference must resolve to an EFFECT_ALLOW policy with a non-empty condition");
+			}
+			if (this.credentials.defaultSolanaAddress) {
+				await this.getBalance("solana");
+			}
+			return {
+				ok: true,
+				provider: this.id,
+				configured: true,
+				checkedAt,
+				details: this.credentials.defaultSolanaAddress ? "Turnkey API, an ALLOW policy reference with a condition, Solana account, and RPC are reachable. Fased requires this policy to be the exclusive OUTCOME_ALLOW for every reviewed signature; this read-only check cannot prove the policy is safe against direct use of the Gateway-held API key." : "Turnkey API and an ALLOW policy reference with a condition are reachable. Create or register a Solana account next; exclusive policy evaluation is verified on every reviewed signature."
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				provider: this.id,
+				configured: true,
+				checkedAt,
+				details: `Turnkey readiness check failed: ${walletDiagnosticErrorMessage(error)}`
+			};
+		}
 	}
 	async createWallet() {
-		throw new WalletProviderError({
-			code: "wallet_provider_not_implemented",
-			message: "Turnkey wallet creation is not implemented in the Solana-only wallet runtime"
-		});
+		this.assertConfigured({ requireAddress: false });
+		try {
+			const created = await (await this.getClient()).createWallet({
+				organizationId: this.requireOrganizationId(),
+				walletName: this.walletName,
+				accounts: [defaultSolanaAccountAtIndex(0)]
+			});
+			const address = clean(created.addresses[0]);
+			if (!address) {
+				throw new Error("Turnkey returned no Solana address");
+			}
+			return {
+				ok: true,
+				walletId: created.walletId,
+				addresses: { solana: address },
+				metadata: {
+					turnkeyWalletId: created.walletId,
+					turnkeyPolicyId: this.requirePolicyId(),
+					providerManaged: true
+				}
+			};
+		} catch (error) {
+			throw asProviderError(error, "wallet creation");
+		}
 	}
 	async getAddresses() {
 		return this.credentials.defaultSolanaAddress ? { solana: this.credentials.defaultSolanaAddress } : {};
 	}
 	async getBalance(chain) {
-		if (!this.supportsChain(chain)) {
-			throw new WalletProviderError({
-				code: "wallet_provider_unsupported_chain",
-				message: "Turnkey adapter supports Solana only"
-			});
-		}
-		const address = this.credentials.defaultSolanaAddress?.trim();
-		if (!address) {
+		this.ensureSolana(chain);
+		this.assertConfigured({ requireAddress: true });
+		const address = this.requireAddress();
+		const result = await fetchSolanaRpc(this.requireRpcUrl(), "getBalance", [address, { commitment: "confirmed" }]);
+		if (typeof result?.value !== "number" && typeof result?.value !== "string") {
 			throw new WalletProviderError({
-				code: "wallet_provider_invalid_config",
-				message: "Turnkey wallet has no Solana address configured"
+				code: "wallet_provider_unavailable",
+				message: "Solana RPC did not return the Turnkey wallet balance",
+				retryable: false
 			});
 		}
 		return {
 			ok: true,
 			chain: "solana",
 			address,
-			balance: "0",
+			balance: String(result.value),
 			unit: "lamports"
 		};
 	}
-	async prepareTx(_request) {
-		throw new WalletProviderError({
-			code: "wallet_provider_not_implemented",
-			message: "Turnkey transaction preparation is not implemented in the Solana-only wallet runtime"
+	async prepareTx(request) {
+		this.ensureSolana(request.chain);
+		this.assertConfigured({ requireAddress: true });
+		try {
+			const prepared = await prepareTurnkeyReviewedTransaction({
+				request,
+				signerAddress: this.requireAddress(),
+				rpcUrl: this.requireRpcUrl(),
+				authorizationContext: this.authorizationContext(),
+				env: this.stateEnv
+			});
+			return {
+				ok: true,
+				chain: "solana",
+				preparedId: prepared.preparedId,
+				signer: prepared.signer,
+				unsignedTxBase64: prepared.unsignedTxBase64,
+				messageBase64: prepared.messageBase64,
+				intentDigest: prepared.intentDigest,
+				expiresAt: prepared.expiresAt,
+				metadata: {
+					simulation: prepared.simulation,
+					recentBlockhash: prepared.recentBlockhash,
+					lastValidBlockHeight: prepared.lastValidBlockHeight,
+					expiresAt: prepared.expiresAt,
+					turnkeyPolicyId: this.requirePolicyId()
+				}
+			};
+		} catch (error) {
+			throw asProviderError(error, "transaction preparation");
+		}
+	}
+	async sendTx(request) {
+		this.ensureSolana(request.chain);
+		this.assertConfigured({ requireAddress: true });
+		try {
+			const preparedId = clean(request.preparedId);
+			if (!preparedId) {
+				throw new WalletProviderError({
+					code: "wallet_provider_invalid_config",
+					message: "Turnkey manual send requires prepareTx and its reviewed preparedId"
+				});
+			}
+			const executed = await executeTurnkeyReviewedTransaction({
+				preparedId,
+				request,
+				signerAddress: this.requireAddress(),
+				rpcUrl: this.requireRpcUrl(),
+				authorizationContext: this.authorizationContext(),
+				env: this.stateEnv,
+				sign: async (unsignedTxBase64) => {
+					const unsignedTransaction = Transaction.from(Buffer.from(unsignedTxBase64, "base64"));
+					const client = await this.getClient();
+					const signedTransaction = this.dependencies.signTransaction ? await this.dependencies.signTransaction({
+						client,
+						organizationId: this.requireOrganizationId(),
+						transaction: unsignedTransaction,
+						signerAddress: this.requireAddress()
+					}) : await this.signWithTurnkey({
+						client,
+						transaction: unsignedTransaction
+					});
+					return Buffer.from(signedTransaction.serialize({
+						requireAllSignatures: true,
+						verifySignatures: true
+					})).toString("base64");
+				}
+			});
+			return {
+				ok: true,
+				chain: "solana",
+				txHash: executed.txHash,
+				signer: executed.signer,
+				metadata: {
+					intentDigest: executed.intentDigest,
+					turnkeyPolicyId: this.requirePolicyId(),
+					sendAttempts: executed.idempotent ? 0 : 1,
+					idempotent: executed.idempotent
+				}
+			};
+		} catch (error) {
+			throw asProviderError(error, "transaction signing or broadcast");
+		}
+	}
+	missingConfiguration(options) {
+		return [
+			!this.credentials.apiPublicKey ? "API public key" : "",
+			!this.credentials.apiPrivateKey ? "API private key" : "",
+			!this.credentials.organizationId ? "organization ID" : "",
+			!this.credentials.policyId ? "policy ID" : "",
+			!this.credentials.rpcUrl ? "Solana RPC URL" : "",
+			options.requireAddress && !this.credentials.defaultSolanaAddress ? "Solana address" : ""
+		].filter(Boolean);
+	}
+	assertConfigured(options) {
+		const missing = this.missingConfiguration(options);
+		if (missing.length > 0) {
+			throw new WalletProviderError({
+				code: "wallet_provider_invalid_config",
+				message: `Turnkey requires ${missing.join(", ")}`
+			});
+		}
+	}
+	ensureSolana(chain) {
+		if (chain !== "solana") {
+			throw new WalletProviderError({
+				code: "wallet_provider_unsupported_chain",
+				message: "Turnkey adapter supports Solana only"
+			});
+		}
+	}
+	requireOrganizationId() {
+		return this.credentials.organizationId;
+	}
+	requirePolicyId() {
+		return this.credentials.policyId;
+	}
+	requireAddress() {
+		return this.credentials.defaultSolanaAddress;
+	}
+	requireRpcUrl() {
+		return this.credentials.rpcUrl;
+	}
+	authorizationContext() {
+		return JSON.stringify({
+			organizationId: this.requireOrganizationId(),
+			policyId: this.requirePolicyId(),
+			providerWalletId: this.credentials.providerWalletId ?? null
 		});
 	}
-	async sendTx(_request) {
-		throw new WalletProviderError({
-			code: "wallet_provider_not_implemented",
-			message: "Turnkey transaction sending is not implemented in the Solana-only wallet runtime"
+	async getClient() {
+		this.clientPromise ??= Promise.resolve(this.dependencies.createClient ? this.dependencies.createClient() : new Turnkey({
+			apiBaseUrl: this.credentials.baseUrl ?? DEFAULT_TURNKEY_API_BASE_URL,
+			apiPublicKey: this.credentials.apiPublicKey,
+			apiPrivateKey: this.credentials.apiPrivateKey,
+			defaultOrganizationId: this.requireOrganizationId()
+		}).apiClient());
+		return await this.clientPromise;
+	}
+	async signWithTurnkey(params) {
+		const organizationId = this.requireOrganizationId();
+		const policyId = this.requirePolicyId();
+		const response = await params.client.signTransaction({
+			organizationId,
+			signWith: this.requireAddress(),
+			unsignedTransaction: Buffer.from(params.transaction.serialize({
+				requireAllSignatures: false,
+				verifySignatures: false
+			})).toString("hex"),
+			type: "TRANSACTION_TYPE_SOLANA"
 		});
+		if (response.activity.status !== "ACTIVITY_STATUS_COMPLETED" || response.activity.type !== "ACTIVITY_TYPE_SIGN_TRANSACTION_V2" || clean(response.activity.organizationId) !== organizationId || !clean(response.activity.id) || !clean(response.signedTransaction)) {
+			throw new Error("Turnkey did not complete the expected Solana signing activity");
+		}
+		let evaluatedPolicies = [];
+		for (let attempt = 0; attempt < 4; attempt += 1) {
+			const evaluations = await params.client.getPolicyEvaluations({
+				organizationId,
+				activityId: response.activity.id
+			});
+			evaluatedPolicies = evaluations.policyEvaluations.flatMap((evaluation) => evaluation.policyEvaluations.map((entry) => ({
+				policyId: clean(entry.policyId),
+				outcome: clean(entry.outcome)
+			})));
+			if (evaluatedPolicies.some((entry) => entry.policyId === policyId)) {
+				break;
+			}
+			if (attempt < 3) {
+				await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+			}
+		}
+		const matchingOutcomes = evaluatedPolicies.filter((entry) => entry.policyId === policyId).map((entry) => entry.outcome);
+		const alternateAllow = evaluatedPolicies.some((entry) => entry.policyId !== policyId && entry.outcome === "OUTCOME_ALLOW");
+		if (matchingOutcomes.length === 0 || matchingOutcomes.some((outcome) => outcome !== "OUTCOME_ALLOW") || alternateAllow) {
+			throw new Error("the configured Turnkey policy was not the exclusive OUTCOME_ALLOW for this reviewed signing activity");
+		}
+		let signed;
+		try {
+			signed = Transaction.from(Buffer.from(response.signedTransaction, "hex"));
+		} catch (error) {
+			throw new Error("Turnkey returned an invalid signed Solana transaction", { cause: error });
+		}
+		return signed;
 	}
 };
 

package/dist/wallet/providers/wallet-standard-adapter.js

@@ -0,0 +1,100 @@
+import { fetchSolanaRpc } from "../solana-assets.js";
+import { WalletProviderError } from "../wallet-provider-adapter.js";
+
+//#region src/wallet/providers/wallet-standard-adapter.ts
+/**
+* Server-side discovery half of a Wallet Standard Vault.
+*
+* Signing deliberately cannot be invoked through this adapter. The Control UI
+* uses the browser-only Wallet Standard flow and the Gateway only validates and
+* broadcasts the returned signed transaction.
+*/
+var WalletStandardAdapter = class {
+	constructor(options = {}) {
+		this.id = "wallet-standard";
+		this.displayName = "Wallet Standard";
+		this.capabilities = {
+			custodyModel: "self-hosted",
+			supportsCreateWallet: false,
+			supportsPrepare: false,
+			supportsSend: false,
+			supportsRotateKeys: false,
+			supportsResetKeys: false,
+			supportsPasskeyGate: false,
+			signingLocation: "browser",
+			supportsSignTransaction: true,
+			supportsSignMessage: false,
+			supportedExecutionModes: ["manual"],
+			supportedChains: ["solana"]
+		};
+		this.address = options.address?.trim() || undefined;
+		this.rpcUrl = options.rpcUrl?.trim() || undefined;
+	}
+	supportsChain(chain) {
+		return chain === "solana";
+	}
+	async health() {
+		const configured = Boolean(this.address && this.rpcUrl);
+		return {
+			ok: configured,
+			provider: this.id,
+			configured,
+			checkedAt: new Date().toISOString(),
+			details: configured ? "Wallet Standard account registered. Signing capability is checked in the local browser before every operation; Wallet Standard does not prove that the account is hardware-backed." : "Attach a Wallet Standard account and configure Solana RPC. For reserve funds, select and verify a hardware-backed account on its device."
+		};
+	}
+	async createWallet() {
+		throw new WalletProviderError({
+			code: "wallet_provider_browser_required",
+			message: "Attach a Solana Wallet Standard account from Fased Control. For reserve funds, use and verify a hardware-backed account on its device"
+		});
+	}
+	async getAddresses() {
+		return this.address ? { solana: this.address } : {};
+	}
+	async getBalance(chain) {
+		if (chain !== "solana") {
+			throw new WalletProviderError({
+				code: "wallet_provider_unsupported_chain",
+				message: "Wallet Standard Vault supports Solana only"
+			});
+		}
+		if (!this.address || !this.rpcUrl) {
+			throw new WalletProviderError({
+				code: "wallet_provider_invalid_config",
+				message: "Wallet Standard Vault requires a registered Solana address and RPC URL"
+			});
+		}
+		const result = await fetchSolanaRpc(this.rpcUrl, "getBalance", [this.address, { commitment: "confirmed" }]);
+		const balance = result?.value;
+		if (typeof balance !== "number" && typeof balance !== "string") {
+			throw new WalletProviderError({
+				code: "wallet_provider_unavailable",
+				message: "Solana RPC did not return a Wallet Standard Vault balance",
+				retryable: true
+			});
+		}
+		return {
+			ok: true,
+			chain: "solana",
+			address: this.address,
+			balance: String(balance),
+			unit: "lamports"
+		};
+	}
+	async prepareTx(_request) {
+		throw new WalletProviderError({
+			code: "wallet_provider_browser_required",
+			message: "Wallet Standard Vault transactions must be prepared through the reviewed browser flow"
+		});
+	}
+	async sendTx(_request) {
+		throw new WalletProviderError({
+			code: "wallet_provider_browser_required",
+			message: "Gateway cannot sign for a Wallet Standard Vault"
+		});
+	}
+};
+
+//#endregion
+export { WalletStandardAdapter };

package/dist/wallet/signer-network-admin.js

@@ -0,0 +1,184 @@
+import { resolveLocalSignerControlSocketPath } from "./wallet-runtime-config.js";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+//#region src/wallet/signer-network-admin.ts
+const NETWORK_ADMIN_TIMEOUT_MS = 3e4;
+const NETWORK_ADMIN_MAX_OUTPUT_BYTES = 256 * 1024;
+function canonicalSignerWalletId(raw) {
+	const normalized = raw.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+	return normalized || "default";
+}
+function parseSignerNetworkSummary(raw, expectedWalletId) {
+	let value;
+	try {
+		value = JSON.parse(raw);
+	} catch {
+		throw new Error("signer network administration returned invalid JSON");
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("signer network administration returned an invalid summary");
+	}
+	const record = value;
+	const keys = Object.keys(record).toSorted();
+	const allowedKeys = record.hash === undefined ? [
+		"configured",
+		"ready",
+		"version",
+		"walletId"
+	] : [
+		"configured",
+		"hash",
+		"ready",
+		"version",
+		"walletId"
+	];
+	if (keys.join(",") !== allowedKeys.join(",")) {
+		throw new Error("signer network administration returned unsupported summary fields");
+	}
+	if (record.walletId !== expectedWalletId || typeof record.configured !== "boolean" || !Number.isSafeInteger(record.version) || Number(record.version) < 0 || typeof record.ready !== "boolean" || record.hash !== undefined && (typeof record.hash !== "string" || !/^hmac-sha256:[0-9a-f]{64}$/.test(record.hash))) {
+		throw new Error("signer network administration returned an invalid summary");
+	}
+	return {
+		walletId: record.walletId,
+		configured: record.configured,
+		version: Number(record.version),
+		...typeof record.hash === "string" ? { hash: record.hash } : {},
+		ready: record.ready
+	};
+}
+function redactSignerNetworkError(raw, secrets) {
+	let value = raw;
+	for (const secret of secrets.filter(Boolean).toSorted((a, b) => b.length - a.length)) {
+		value = value.split(secret).join("[redacted-rpc-url]");
+	}
+	value = value.replace(/https?:\/\/[^\s"'<>]+/gi, "[redacted-rpc-url]");
+	value = value.replace(/\b(api[_-]?key|access[_-]?token|token|key)=([^\s&"']+)/gi, "$1=[redacted]");
+	return value.trim().slice(0, 2e3) || "signer network administration failed";
+}
+function signerAdminEnvironment(env) {
+	const out = {};
+	for (const key of [
+		"HOME",
+		"PATH",
+		"TMPDIR",
+		"LANG",
+		"LC_ALL",
+		"TZ"
+	]) {
+		const value = String(env[key] ?? "").trim();
+		if (value) {
+			out[key] = value;
+		}
+	}
+	return out;
+}
+function runSignerAdmin(params) {
+	const child = spawnSync(params.command, params.args, {
+		input: params.input,
+		env: params.env,
+		encoding: "utf8",
+		timeout: NETWORK_ADMIN_TIMEOUT_MS,
+		maxBuffer: NETWORK_ADMIN_MAX_OUTPUT_BYTES,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (child.error || child.status !== 0) {
+		const detail = [
+			child.stderr,
+			child.stdout,
+			child.error?.message
+		].filter((part) => typeof part === "string" && part.trim().length > 0).join("\n");
+		throw new Error(redactSignerNetworkError(detail, params.secrets));
+	}
+	return child.stdout;
+}
+function assertReadyNetworkSummary(summary, previousVersion) {
+	if (!summary.configured || !summary.ready || !summary.hash || summary.version !== previousVersion + 1) {
+		throw new Error("signer network update did not acknowledge the exact next ready version");
+	}
+	return summary;
+}
+function configureSignerOwnedWalletNetwork(params) {
+	const env = params.env ?? process.env;
+	const walletId = canonicalSignerWalletId(params.walletId);
+	const primaryRpcUrl = params.primaryRpcUrl.trim();
+	const fallbackRpcUrl = params.fallbackRpcUrl?.trim() || "";
+	if (!primaryRpcUrl) {
+		throw new Error("signer-owned wallet network requires a primary RPC URL");
+	}
+	const secrets = [primaryRpcUrl, fallbackRpcUrl];
+	const hosting = String(env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
+	if (hosting) {
+		return {
+			walletId,
+			configured: false,
+			version: 0,
+			ready: false,
+			rootAdminRequired: true,
+			rootCommand: `/usr/local/sbin/fased-signer-network --wallet-id ${walletId} ` + "--network-file /root/fased-network.json"
+		};
+	}
+	const signerBinPath = params.signerBinPath ?? (String(env.FASED_WALLET_LOCAL_SIGNER_BIN ?? "").trim() || path.join(String(env.HOME ?? ""), ".fased", "bin", "fased-signerd"));
+	const controlSocketPath = params.controlSocketPath ?? resolveLocalSignerControlSocketPath(env);
+	const adminEnv = signerAdminEnvironment(env);
+	const commonArgs = [
+		"--control-socket",
+		controlSocketPath,
+		"--wallet-id",
+		walletId
+	];
+	const current = parseSignerNetworkSummary(runSignerAdmin({
+		command: signerBinPath,
+		args: [
+			"admin",
+			"network",
+			"get",
+			...commonArgs
+		],
+		env: adminEnv,
+		secrets
+	}), walletId);
+	const input = `${JSON.stringify({
+		expectedVersion: current.version,
+		primaryRpcUrl,
+		...fallbackRpcUrl ? { fallbackRpcUrl } : {}
+	})}\n`;
+	const updated = parseSignerNetworkSummary(runSignerAdmin({
+		command: signerBinPath,
+		args: [
+			"admin",
+			"network",
+			"put",
+			...commonArgs
+		],
+		input,
+		env: adminEnv,
+		secrets
+	}), walletId);
+	return assertReadyNetworkSummary(updated, current.version);
+}
+/**
+* Hosted policy changes are deliberately unavailable to the app process. New signer-owned
+* wallets are born deny-all; policy expansion requires the root-only installed policy CLI.
+*/
+function applyHostedSignerOwnedWalletPolicy(params) {
+	void (params.env ?? process.env);
+	const walletId = canonicalSignerWalletId(params.walletId);
+	if (params.policy.operations.length !== 0 || params.policy.programs.length !== 0 || params.policy.assets.length !== 0) {
+		throw new Error("Fresh hosted signer setup accepts only the signer's built-in deny-all policy");
+	}
+	throw new Error(`Hosted signer policy for ${walletId} requires the root-only ` + "/usr/local/sbin/fased-signer-policy command and a root-owned policy file.");
+}
+const __testing = {
+	canonicalSignerWalletId,
+	parseSignerNetworkSummary,
+	redactSignerNetworkError,
+	signerAdminEnvironment
+};
+
+//#endregion
+export { configureSignerOwnedWalletNetwork };