@fased/fased 0.1.62 → 0.1.64

package/dist/auto-reply/reply/get-reply-directives-apply.js

@@ -15,6 +15,7 @@ async function applyInlineDirectiveOverrides(params) {
 	let { provider, model } = params;
 	let { contextTokens } = params;
 	const directiveModelState = {
+		allowAnyModel: modelState.allowAnyModel,
 		allowedModelKeys: modelState.allowedModelKeys,
 		allowedModelCatalog: modelState.allowedModelCatalog,
 		resetModelOverride: modelState.resetModelOverride
@@ -155,6 +156,7 @@ async function applyInlineDirectiveOverrides(params) {
 		defaultProvider,
 		defaultModel,
 		aliasIndex,
+		allowAnyModel: modelState.allowAnyModel,
 		allowedModelKeys: modelState.allowedModelKeys,
 		provider,
 		model,

package/dist/auto-reply/reply/get-reply-inline-actions.js

@@ -5,6 +5,8 @@ import { applyOwnerOnlyToolPolicy } from "../../agents/tool-policy.js";
 import { generateSecureToken } from "../../infra/secure-random.js";
 import { clearAbortCutoffInSession, readAbortCutoffFromSessionEntry, resolveAbortCutoffFromContext, shouldSkipMessageByAbortCutoff } from "./abort-cutoff.js";
 import { getAbortMemory, isAbortRequestText } from "./abort.js";
+import { readClawHubSkillOrigin } from "../../agents/skills-clawhub.js";
+import { isMarketplaceSkillDir, marketplaceSkillProvenanceMatchesContent } from "../../agents/skills/trust.js";
 import { createFasedAgentTools } from "../../agents/fased-tools.js";
 import { collectTextContentBlocks } from "../../agents/content-blocks.js";
 import { listReservedChatSlashCommandNames, listSkillCommandsForWorkspace, resolveSkillCommandInvocation } from "../skill-commands.js";
@@ -14,6 +16,7 @@ import { isDirectiveOnly } from "./directive-handling.parse.js";
 import "./directive-handling.js";
 import "./commands.js";
 import { extractInlineSimpleCommand } from "./reply-inline.js";
+import path from "node:path";
 
 //#region src/auto-reply/reply/get-reply-inline-actions.ts
 const builtinSlashCommands = (() => {
@@ -77,6 +80,24 @@ async function handleInlineActions(params) {
 		}
 		const dispatch = skillInvocation.command.dispatch;
 		if (dispatch?.kind === "tool") {
+			const sourceFile = skillInvocation.command.sourceFilePath?.trim();
+			const skillDir = sourceFile ? path.dirname(sourceFile) : "";
+			const marketplaceSkill = Boolean(skillDir && isMarketplaceSkillDir(skillDir));
+			const marketplaceOrigin = skillDir ? await readClawHubSkillOrigin(skillDir) : null;
+			if (marketplaceSkill && (!marketplaceOrigin || !marketplaceSkillProvenanceMatchesContent(skillDir))) {
+				typing.cleanup();
+				return {
+					kind: "reply",
+					reply: { text: `❌ Marketplace skill ${skillInvocation.command.skillName} failed its installed-content integrity check. Reinstall the reviewed archive before using direct tool commands.` }
+				};
+			}
+			if (marketplaceOrigin && !(marketplaceOrigin.permissions?.toolAccess ?? []).includes(dispatch.toolName)) {
+				typing.cleanup();
+				return {
+					kind: "reply",
+					reply: { text: `❌ Marketplace skill ${marketplaceOrigin.slug} is not authorized for tool ${dispatch.toolName}. Reinstall a reviewed version whose manifest explicitly requests that tool.` }
+				};
+			}
 			const rawArgs = (skillInvocation.args ?? "").trim();
 			const channel = resolveGatewayMessageChannel(ctx.Surface) ?? resolveGatewayMessageChannel(ctx.Provider) ?? undefined;
 			const tools = createFasedAgentTools({
@@ -122,7 +143,10 @@ async function handleInlineActions(params) {
 				};
 			}
 		}
-		const promptParts = [`Use the "${skillInvocation.command.skillName}" skill for this request.`, skillInvocation.args ? `User input:\n${skillInvocation.args}` : null].filter((entry) => Boolean(entry));
+		const commandTemplate = skillInvocation.command.promptTemplate?.trim();
+		const commandArgs = skillInvocation.args?.trim();
+		const renderedTemplate = commandTemplate ? commandTemplate.includes("$ARGUMENTS") ? commandTemplate.replaceAll("$ARGUMENTS", commandArgs ?? "") : commandTemplate : null;
+		const promptParts = [renderedTemplate ?? `Use the "${skillInvocation.command.skillName}" skill for this request.`, commandArgs && (!renderedTemplate || !commandTemplate?.includes("$ARGUMENTS")) ? `User input:\n${commandArgs}` : null].filter((entry) => Boolean(entry));
 		const rewrittenBody = promptParts.join("\n\n");
 		ctx.Body = rewrittenBody;
 		ctx.BodyForAgent = rewrittenBody;

package/dist/auto-reply/reply/model-selection.js

@@ -207,6 +207,7 @@ async function createModelSelectionState(params) {
 	const needsModelCatalog = params.hasModelDirective || hasAllowlist || hasStoredOverride;
 	let allowedModelKeys = new Set();
 	let allowedModelCatalog = [];
+	let allowAnyModel = true;
 	let modelCatalog = null;
 	let resetModelOverride = false;
 	if (needsModelCatalog) {
@@ -228,13 +229,14 @@ async function createModelSelectionState(params) {
 		});
 		allowedModelCatalog = allowed.allowedCatalog;
 		allowedModelKeys = allowed.allowedKeys;
+		allowAnyModel = allowed.allowAny;
 	}
 	if (sessionEntry && sessionStore && sessionKey && hasStoredOverride) {
 		const overrideProvider = sessionEntry.providerOverride?.trim() || defaultProvider;
 		const overrideModel = sessionEntry.modelOverride?.trim();
 		if (overrideModel) {
 			const key = modelKey(overrideProvider, overrideModel);
-			if (allowedModelKeys.size > 0 && !allowedModelKeys.has(key)) {
+			if (!allowAnyModel && !allowedModelKeys.has(key)) {
 				const { updated } = applyModelOverrideToSessionEntry({
 					entry: sessionEntry,
 					selection: {
@@ -265,7 +267,7 @@ async function createModelSelectionState(params) {
 	if (storedOverride?.model && !skipStoredOverride) {
 		const candidateProvider = storedOverride.provider || defaultProvider;
 		const key = modelKey(candidateProvider, storedOverride.model);
-		if (allowedModelKeys.size === 0 || allowedModelKeys.has(key)) {
+		if (allowAnyModel || allowedModelKeys.has(key)) {
 			provider = candidateProvider;
 			model = storedOverride.model;
 		}
@@ -318,6 +320,7 @@ async function createModelSelectionState(params) {
 	return {
 		provider,
 		model,
+		allowAnyModel,
 		allowedModelKeys,
 		allowedModelCatalog,
 		resetModelOverride,
@@ -327,7 +330,7 @@ async function createModelSelectionState(params) {
 	};
 }
 function resolveModelDirectiveSelection(params) {
-	const { raw, defaultProvider, defaultModel, aliasIndex, allowedModelKeys } = params;
+	const { raw, defaultProvider, defaultModel, aliasIndex, allowAnyModel, allowedModelKeys } = params;
 	const rawTrimmed = raw.trim();
 	const rawLower = rawTrimmed.toLowerCase();
 	const pickAliasForKey = (provider, model) => aliasIndex.byKey.get(modelKey(provider, model))?.[0];
@@ -438,7 +441,7 @@ function resolveModelDirectiveSelection(params) {
 		return { error: `Unrecognized model "${rawTrimmed}". Use /models to list providers, or /models <provider> to list models.` };
 	}
 	const resolvedKey = modelKey(resolved.ref.provider, resolved.ref.model);
-	if (allowedModelKeys.size === 0 || allowedModelKeys.has(resolvedKey)) {
+	if (allowAnyModel || allowedModelKeys.has(resolvedKey)) {
 		return { selection: {
 			provider: resolved.ref.provider,
 			model: resolved.ref.model,

package/dist/auto-reply/reply/session-reset-model.js

@@ -29,7 +29,7 @@ function buildSelectionFromExplicit(params) {
 		return undefined;
 	}
 	const key = modelKey(resolved.ref.provider, resolved.ref.model);
-	if (params.allowedModelKeys.size > 0 && !params.allowedModelKeys.has(key)) {
+	if (!params.allowAnyModel && !params.allowedModelKeys.has(key)) {
 		return undefined;
 	}
 	const isDefault = resolved.ref.provider === params.defaultProvider && resolved.ref.model === params.defaultModel;
@@ -82,10 +82,8 @@ async function applyResetModelOverride(params) {
 			config: params.cfg
 		}) : resolveDefaultAgentId(params.cfg)), { allowKeychainPrompt: false })
 	});
+	const allowAnyModel = allowed.allowAny;
 	const allowedModelKeys = allowed.allowedKeys;
-	if (allowedModelKeys.size === 0) {
-		return {};
-	}
 	const providers = new Set();
 	for (const key of allowedModelKeys) {
 		const slash = key.indexOf("/");
@@ -99,6 +97,7 @@ async function applyResetModelOverride(params) {
 		defaultProvider: params.defaultProvider,
 		defaultModel: params.defaultModel,
 		aliasIndex: params.aliasIndex,
+		allowAnyModel,
 		allowedModelKeys
 	});
 	let selection;
@@ -117,6 +116,7 @@ async function applyResetModelOverride(params) {
 			defaultProvider: params.defaultProvider,
 			defaultModel: params.defaultModel,
 			aliasIndex: params.aliasIndex,
+			allowAnyModel,
 			allowedModelKeys
 		});
 		if (selection) {

package/dist/brand.js

@@ -2,7 +2,7 @@
 const FASED_BRAND_NAME = "Fased";
 const FASED_AGENT_NAME = "Fased Agent";
 const FASED_CONTROL_NAME = "Fased Control";
-const FASED_PRODUCT_VERSION = "0.1.62";
+const FASED_PRODUCT_VERSION = "0.1.64";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 function formatFasedDisplayLine() {
 	return `${FASED_AGENT_NAME} ${FASED_DISPLAY_VERSION}`;

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.62",
-  "commit": "1363215001390a35a7338616392a7f9d36ae910b",
-  "builtAt": "2026-07-16T14:59:30.808Z"
+  "version": "0.1.64",
+  "commit": "3b1f5fc2be332eabd2055a752e96f9e8e1c84f3d",
+  "builtAt": "2026-07-18T13:15:58.022Z"
 }

package/dist/canvas-host/a2ui/.bundle.hash

@@ -1 +1 @@
-1125727177e49cfcaf2e551412ded002525b5d9e61227f5f1b13522c2a73a5e1
+991ad74433070833894e32b9ce584814bd21790717ff793eadb8f705787184d2

package/dist/channel-web.js

@@ -2,9 +2,9 @@ import { WA_WEB_AUTH_DIR, logWebSelfId, logoutWeb, pickWebChannel, webAuthExists
 import { HEARTBEAT_TOKEN } from "./auto-reply/tokens.js";
 import { HEARTBEAT_PROMPT } from "./auto-reply/heartbeat.js";
 import { loadWebMedia, optimizeImageToJpeg } from "./web/media.js";
-import { DEFAULT_WEB_MEDIA_BYTES } from "./web/auto-reply/constants.js";
 import { createWaSocket, formatError, getStatusCode, waitForWaConnection } from "./web/session.js";
 import { sendMessageWhatsApp } from "./web/outbound.js";
+import { DEFAULT_WEB_MEDIA_BYTES } from "./web/auto-reply/constants.js";
 import { extractMediaPlaceholder, extractText } from "./web/inbound/extract.js";
 import { monitorWebInbox } from "./web/inbound/monitor.js";
 import "./web/inbound.js";
@@ -12,4 +12,4 @@ import { monitorWebChannel } from "./web/auto-reply/monitor.js";
 import "./web/auto-reply.js";
 import { loginWeb } from "./web/login.js";
 
-export {  };
+export { monitorWebChannel };

package/dist/cli/gateway-cli/run.js

@@ -18,6 +18,7 @@ import { describeUnknownError, extractGatewayMiskeys, maybeExplainGatewayService
 import { GatewayLockError } from "../../infra/gateway-lock.js";
 import { startGatewayServer } from "../../gateway/server.impl.js";
 import "../../gateway/server.js";
+import { assertLocalSourcePairedGatewayStartAllowed } from "../../infra/local-source-paired-update.js";
 import { ensureDevGatewayConfig } from "./dev.js";
 import { runGatewayLoop } from "./run-loop.js";
 import syncFs from "node:fs";
@@ -55,6 +56,13 @@ function inheritGatewayRunOptions(opts, command) {
 	return merged;
 }
 async function runGatewayCommand(opts) {
+	try {
+		await assertLocalSourcePairedGatewayStartAllowed({ runtimeRoot: path.resolve(process.cwd()) });
+	} catch (error) {
+		defaultRuntime.error(String(error));
+		defaultRuntime.exit(1);
+		return;
+	}
 	const isDevProfile = process.env.FASED_PROFILE?.trim().toLowerCase() === "dev";
 	const devMode = Boolean(opts.dev) || isDevProfile;
 	if (opts.reset && !devMode) {

package/dist/cli/program/command-registry.js

@@ -163,7 +163,7 @@ const coreEntries = [
 	{
 		commands: [{
 			name: "wallet",
-			description: "Wallet providers, keystore, custody, and policy status",
+			description: "Wallet providers, signer keys, and policy status",
 			hasSubcommands: true
 		}],
 		register: ({ program }) => {

package/dist/cli/program/register.onboard.js

@@ -60,11 +60,11 @@ const AUTH_CHOICE_HELP = formatAuthChoiceChoicesForCli({
 });
 function registerOnboardCommand(program) {
 	const providerAuthFlags = resolveOnboardProviderAuthFlags();
-	const command = program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.fased.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.fased/workspace)").option("--reset", "Repair auth/session state before running wizard").option("--reset-scope <scope>", "Repair scope: sessions|auth|auth+sessions").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--host-profile <profile>", "Host security profile: local|hosting").option("--host-security-capable", "Internal: host security was prepared by a root-started installer session").option("--host-maintenance-session", "Internal: post-bootstrap hosted rerun from the app user over Tailscale").option("--ts-authkey <key>", "Tailscale auth key for hosting setup").option("--allow-insecure", "Allow continuing when hosting security setup fails").option("--swap-gb <n>", "Override automatic swap size in GB for hosting setup").option("--auth-choice <choice>", `Auth: ${AUTH_CHOICE_HELP}`).option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID");
+	const command = program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.fased.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.fased/workspace)").option("--reset", "Repair auth/session state before running wizard").option("--reset-scope <scope>", "Repair scope: sessions|auth|auth+sessions").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--host-profile <profile>", "Host security profile: local|hosting").option("--host-security-capable", "Internal: host security was prepared by a root-started installer session").option("--host-maintenance-session", "Internal: post-bootstrap hosted rerun from the app user over Tailscale").option("--allow-insecure", "Allow continuing when hosting security setup fails").option("--swap-gb <n>", "Override automatic swap size in GB for hosting setup").option("--auth-choice <choice>", `Auth: ${AUTH_CHOICE_HELP}`).option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID");
 	for (const providerFlag of providerAuthFlags) {
 		command.option(providerFlag.cliOption, providerFlag.description);
 	}
-	command.option("--custom-base-url <url>", "Custom provider base URL").option("--custom-api-key <key>", "Custom provider API key (optional)").option("--custom-model-id <id>", "Custom provider model ID").option("--custom-provider-id <id>", "Custom provider ID (optional; auto-derived by default)").option("--custom-compatibility <mode>", "Custom provider API compatibility: openai|anthropic (default: openai)").option("--allow-private-network", "Allow a custom local/private model provider endpoint in non-interactive onboarding").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--wallet-enabled", "Enable wallet integration").option("--wallet-disabled", "Disable wallet integration").option("--wallet-mode <mode>", "Wallet mode: managed|external").option("--wallet-runtime <runtime>", "Wallet runtime: external-docker|external-custom").option("--wallet-providers <ids>", "Enabled wallet providers CSV (embedded-keystore,local-socket-signer,alchemy,turnkey,privy)").option("--wallet-default-provider <id>", "Default wallet provider id (embedded-keystore|local-socket-signer|alchemy|turnkey|privy)").option("--wallet-chains <chains>", "Wallet chains CSV (solana)").option("--wallet-host <host>", "External self-hosted signer host (advanced/deprecated)").option("--wallet-port <port>", "External self-hosted signer port (advanced/deprecated)").option("--wallet-install-enabled", "Enable wallet runtime auto-install").option("--wallet-install-disabled", "Disable wallet runtime auto-install").option("--wallet-install-version <version>", "Legacy self-host signer runtime version").option("--wallet-direct-signing", "Enable automated wallet execution for approved Agent tools").option("--wallet-no-direct-signing", "Disable automated wallet execution for approved Agent tools").option("--wallet-solana-allow-programs <programs>", "CSV allowlist of Solana programs").option("--wallet-solana-max-per-tx <amount>", "Solana per-transaction cap (lamports)").option("--wallet-solana-max-daily <amount>", "Solana daily cap (lamports)").option("--wallet-tool-access-mode <mode>", "Wallet tool access: owner-only|allowlist|all").option("--wallet-tool-access-allow-agents <agents>", "CSV allowlist agent IDs for wallet tool").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--fast-health", "Use fast health mode (skip long probe waits and non-critical startup gating)", true).option("--no-fast-health", "Disable fast health mode").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false);
+	command.option("--custom-base-url <url>", "Custom provider base URL").option("--custom-api-key <key>", "Custom provider API key (optional)").option("--custom-model-id <id>", "Custom provider model ID").option("--custom-provider-id <id>", "Custom provider ID (optional; auto-derived by default)").option("--custom-compatibility <mode>", "Custom provider API compatibility: openai|anthropic (default: openai)").option("--allow-private-network", "Allow a custom local/private model provider endpoint in non-interactive onboarding").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--wallet-enabled", "Enable wallet integration").option("--wallet-disabled", "Disable wallet integration").option("--wallet-mode <mode>", "Wallet mode: managed|external").option("--wallet-runtime <runtime>", "Wallet runtime: external-docker|external-custom").option("--wallet-providers <ids>", "Enabled wallet providers CSV (local-socket-signer,alchemy,turnkey,wallet-standard)").option("--wallet-default-provider <id>", "Default wallet provider id (local-socket-signer|alchemy|turnkey|wallet-standard)").option("--wallet-chains <chains>", "Wallet chains CSV (solana)").option("--wallet-host <host>", "External self-hosted signer host (advanced/deprecated)").option("--wallet-port <port>", "External self-hosted signer port (advanced/deprecated)").option("--wallet-install-enabled", "Enable wallet runtime auto-install").option("--wallet-install-disabled", "Disable wallet runtime auto-install").option("--wallet-install-version <version>", "Legacy self-host signer runtime version").option("--wallet-direct-signing", "Enable automated wallet execution for approved Agent tools").option("--wallet-no-direct-signing", "Disable automated wallet execution for approved Agent tools").option("--wallet-solana-allow-programs <programs>", "CSV allowlist of Solana programs").option("--wallet-solana-max-per-tx <amount>", "Solana per-transaction cap (lamports)").option("--wallet-solana-max-daily <amount>", "Solana daily cap (lamports)").option("--wallet-tool-access-mode <mode>", "Wallet tool access: owner-only|allowlist|all").option("--wallet-tool-access-allow-agents <agents>", "CSV allowlist agent IDs for wallet tool").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--fast-health", "Use fast health mode (skip long probe waits and non-critical startup gating)", true).option("--no-fast-health", "Disable fast health mode").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false);
 	command.action(async (opts, commandRuntime) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			const installDaemon = resolveInstallDaemonFlag(commandRuntime, { installDaemon: Boolean(opts.installDaemon) });
@@ -87,7 +87,6 @@ function registerOnboardCommand(program) {
 				hostProfile: opts.hostProfile,
 				hostSecurityCapable: Boolean(opts.hostSecurityCapable),
 				hostMaintenanceSession: Boolean(opts.hostMaintenanceSession),
-				tsAuthkey: opts.tsAuthkey,
 				allowInsecure: Boolean(opts.allowInsecure),
 				swapGb: typeof swapGbRaw === "number" && Number.isFinite(swapGbRaw) ? swapGbRaw : undefined,
 				workspace: opts.workspace,

package/dist/cli/program/register.wallet.js

@@ -1,6 +1,6 @@
 import { defaultRuntime } from "../../runtime.js";
 import { runCommandWithRuntime } from "../cli-utils.js";
-import { walletCanaryCommand, walletCustodyInitCommand, walletCustodyLockCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletKeystoreExportCommand, walletKeystoreImportCommand, walletKeystoreInitCommand, walletKeystorePassphraseInitCommand, walletKeystorePassphraseRotateCommand, walletKeystoreStatusCommand, walletKeystoreValidateCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerBrokerCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand } from "../../commands/wallet.js";
+import { walletCanaryCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletLegacyMigrationFinalizeCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand } from "../../commands/wallet.js";
 
 //#region src/cli/program/register.wallet.ts
 function resolvePublicWalletSetupChain(raw) {
@@ -14,10 +14,10 @@ function resolvePublicWalletSetupChain(raw) {
 	throw new Error("Wallet setup is Solana-only. Use --chain solana.");
 }
 function registerWalletCommands(program) {
-	const wallet = program.command("wallet").description("Wallet providers, keystore, custody, and policy status").action(() => {
+	const wallet = program.command("wallet").description("Wallet providers, native signer, and policy status").action(() => {
 		wallet.help({ error: true });
 	});
-	wallet.command("setup").description("Guided Solana wallet setup (create/import local signer wallet)").option("--mode <mode>", "embedded-create|embedded-import|local-signer|turnkey (embedded alias allowed)").option("--chain <chain>", "solana", "solana").option("--wallet-id <id>", "Named wallet id (examples: agent, mining, vault)").option("--wallet-name <value>", "Friendly wallet display name (for UI/skills/plugins)").option("--role <role>", "agent|vault. SAT mining is attached separately.").option("--private-key <value>", "Private key for import mode (prefer env)").option("--api-key <value>", "Hosted wallet provider API key (alchemy/privy mode)").option("--rpc-url <url>", "RPC URL hint for embedded create/import").option("--show-private-key-once", "For embedded-create: print generated private key once", false).option("--confirm-private-key-print <text>", "Required with --show-private-key-once; type \"SHOW PRIVATE KEY\"").option("--turnkey-api-public-key <value>", "Turnkey API public key (turnkey mode)").option("--turnkey-api-private-key <value>", "Turnkey API private key (turnkey mode)").option("--turnkey-organization-id <value>", "Turnkey organization ID (turnkey mode)").option("--turnkey-base-url <value>", "Turnkey base URL override (turnkey mode)").option("--enable-limit-orders", "Store Jupiter API key config for policy-gated wallet actions", false).option("--disable-limit-orders", "Remove stored Jupiter wallet-action config", false).option("--jupiter-api-key <value>", "Jupiter API key for policy-gated wallet actions").option("--jupiter-trigger-api-base-url <url>", "Advanced: Jupiter Trigger API base URL override").option("--non-interactive", "Do not prompt; require mode/inputs", false).option("--no-doctor", "Skip signer doctor in local-signer mode", false).option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("setup").description("Create a signer-owned Solana wallet or configure a supported provider").option("--mode <mode>", "local-signer-create|local-signer-import|local-signer|turnkey|alchemy").option("--chain <chain>", "solana", "solana").option("--wallet-id <id>", "Named wallet id (examples: agent, mining, vault)").option("--wallet-name <value>", "Friendly wallet display name (for UI/skills/plugins)").option("--role <role>", "Permanent signer role: agent|mining|vault").option("--api-key <value>", "Alchemy API key").option("--rpc-url <url>", "Solana RPC URL").option("--turnkey-api-public-key <value>", "Turnkey API public key (turnkey mode)").option("--turnkey-api-private-key <value>", "Turnkey API private key (turnkey mode)").option("--turnkey-organization-id <value>", "Turnkey organization ID (turnkey mode)").option("--turnkey-policy-id <value>", "Turnkey policy ID (turnkey mode)").option("--turnkey-base-url <value>", "Turnkey base URL override (turnkey mode)").option("--enable-limit-orders", "Legacy alias: configure Gateway Jupiter Swap API access (Trigger is signer-owned)", false).option("--disable-limit-orders", "Remove stored Gateway Jupiter Swap API key", false).option("--jupiter-api-key <value>", "Jupiter API key for Gateway swap crafting only").option("--non-interactive", "Do not prompt; require mode/inputs", false).option("--no-doctor", "Skip signer doctor in local-signer mode", false).option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletSetupCommand(defaultRuntime, {
 				mode: typeof opts.mode === "string" ? opts.mode : undefined,
@@ -25,32 +25,28 @@ function registerWalletCommands(program) {
 				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
 				walletName: typeof opts.walletName === "string" ? opts.walletName : undefined,
 				role: typeof opts.role === "string" ? opts.role : undefined,
-				privateKey: typeof opts.privateKey === "string" ? opts.privateKey : undefined,
 				apiKey: typeof opts.apiKey === "string" ? opts.apiKey : undefined,
 				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
-				showPrivateKeyOnce: Boolean(opts.showPrivateKeyOnce),
-				confirmPrivateKeyPrint: typeof opts.confirmPrivateKeyPrint === "string" ? opts.confirmPrivateKeyPrint : undefined,
 				turnkeyApiPublicKey: typeof opts.turnkeyApiPublicKey === "string" ? opts.turnkeyApiPublicKey : undefined,
 				turnkeyApiPrivateKey: typeof opts.turnkeyApiPrivateKey === "string" ? opts.turnkeyApiPrivateKey : undefined,
 				turnkeyOrganizationId: typeof opts.turnkeyOrganizationId === "string" ? opts.turnkeyOrganizationId : undefined,
+				turnkeyPolicyId: typeof opts.turnkeyPolicyId === "string" ? opts.turnkeyPolicyId : undefined,
 				turnkeyBaseUrl: typeof opts.turnkeyBaseUrl === "string" ? opts.turnkeyBaseUrl : undefined,
 				enableLimitOrders: Boolean(opts.enableLimitOrders),
 				disableLimitOrders: Boolean(opts.disableLimitOrders),
 				jupiterApiKey: typeof opts.jupiterApiKey === "string" ? opts.jupiterApiKey : undefined,
-				jupiterTriggerApiBaseUrl: typeof opts.jupiterTriggerApiBaseUrl === "string" ? opts.jupiterTriggerApiBaseUrl : undefined,
 				nonInteractive: Boolean(opts.nonInteractive),
 				noDoctor: Boolean(opts.noDoctor),
 				json: Boolean(opts.json)
 			});
 		});
 	});
-	wallet.command("limit-orders").description("Configure Jupiter Trigger support for policy-gated Agent wallet actions").option("--enable", "Enable Jupiter wallet-action support and store API key config", false).option("--disable", "Remove stored Jupiter wallet-action config", false).option("--jupiter-api-key <value>", "Jupiter API key for policy-gated wallet actions").option("--jupiter-trigger-api-base-url <url>", "Advanced: Jupiter Trigger API base URL override").option("--non-interactive", "Do not prompt; require explicit inputs", false).option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("limit-orders").description("Configure Gateway Jupiter Swap API access; Trigger credentials remain signer-owned").option("--enable", "Store a Gateway Jupiter Swap API key", false).option("--disable", "Remove the stored Gateway Jupiter Swap API key", false).option("--jupiter-api-key <value>", "Jupiter API key for Gateway swap crafting only").option("--non-interactive", "Do not prompt; require explicit inputs", false).option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletLimitOrdersConfigureCommand(defaultRuntime, {
 				enable: Boolean(opts.enable),
 				disable: Boolean(opts.disable),
 				jupiterApiKey: typeof opts.jupiterApiKey === "string" ? opts.jupiterApiKey : undefined,
-				jupiterTriggerApiBaseUrl: typeof opts.jupiterTriggerApiBaseUrl === "string" ? opts.jupiterTriggerApiBaseUrl : undefined,
 				nonInteractive: Boolean(opts.nonInteractive),
 				json: Boolean(opts.json)
 			});
@@ -61,42 +57,17 @@ function registerWalletCommands(program) {
 			await walletStatusCommand(defaultRuntime, { json: Boolean(opts.json) });
 		});
 	});
-	wallet.command("rotate-keys").description("Rotate local wallet keys (provider-specific; deprecated command name)").option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("rotate-keys").description("Removed Gateway key rotation; prints native/provider authority guidance").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletRotateKeysCommand(defaultRuntime, { json: Boolean(opts.json) });
 		});
 	});
-	const keystore = wallet.command("keystore").description("Manage encrypted local Solana keystore wallets");
-	keystore.command("init").description("Create a new encrypted keystore and set provider=embedded-keystore").option("--chain <chain>", "Key type: solana", "solana").option("--wallet-id <id>", "Named wallet id (agent, mining, vault, ...)").option("--out <path>", "Output keystore path (default: <state>/wallet/keystore.v1.enc)").option("--passphrase <value>", "Keystore passphrase (prefer env/file in shell history-safe use)").option("--rpc-url <url>", "Optional RPC URL hint (still typically set via env)").option("--show-private-key-once", "Print generated private key once (dangerous)", false).option("--confirm-private-key-print <text>", "Required with --show-private-key-once; type \"SHOW PRIVATE KEY\"").option("--name <value>", "Named wallet label for UI").option("--role <role>", "agent|vault. SAT mining is attached separately.").option("--force", "Overwrite existing keystore", false).option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("finalize-legacy-migration").description("Verify a completed native signer import and retire legacy config/registry references").requiredOption("--wallet-id <id>", "Legacy wallet id imported into fased-signerd").option("--wallet-name <name>", "Name when the legacy registry row is missing").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreInitCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				chain: resolvePublicWalletSetupChain(opts.chain) ?? "solana",
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				passphrase: typeof opts.passphrase === "string" ? opts.passphrase : undefined,
-				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
-				showPrivateKeyOnce: Boolean(opts.showPrivateKeyOnce),
-				confirmPrivateKeyPrint: typeof opts.confirmPrivateKeyPrint === "string" ? opts.confirmPrivateKeyPrint : undefined,
-				name: typeof opts.name === "string" ? opts.name : undefined,
-				role: typeof opts.role === "string" ? opts.role : undefined,
-				force: Boolean(opts.force)
-			});
-		});
-	});
-	keystore.command("import").description("Import a raw Solana private key into an encrypted keystore and set provider").option("--chain <chain>", "Key type: solana", "solana").option("--wallet-id <id>", "Named wallet id (agent, mining, vault, ...)").option("--private-key <value>", "Solana private key (prefer env FASED_WALLET_PRIVATE_KEY)").option("--out <path>", "Output keystore path (default: <state>/wallet/keystore.v1.enc)").option("--passphrase <value>", "Keystore passphrase (prefer env/file in shell history-safe use)").option("--rpc-url <url>", "Optional RPC URL hint (still typically set via env)").option("--name <value>", "Named wallet label for UI").option("--role <role>", "agent|vault. SAT mining is attached separately.").option("--force", "Overwrite existing keystore", false).option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreImportCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				passphrase: typeof opts.passphrase === "string" ? opts.passphrase : undefined,
-				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
-				privateKey: typeof opts.privateKey === "string" ? opts.privateKey : undefined,
-				chain: resolvePublicWalletSetupChain(opts.chain) ?? "solana",
-				name: typeof opts.name === "string" ? opts.name : undefined,
-				role: typeof opts.role === "string" ? opts.role : undefined,
-				force: Boolean(opts.force)
+			await walletLegacyMigrationFinalizeCommand(defaultRuntime, {
+				walletId: String(opts.walletId),
+				walletName: typeof opts.walletName === "string" ? opts.walletName : undefined,
+				json: Boolean(opts.json)
 			});
 		});
 	});
@@ -110,59 +81,11 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	keystore.command("passphrase-init").description("Generate keystore passphrase file (0600) and print env export hint").option("--out <path>", "Passphrase file path (default: <state>/wallet/passphrase)").option("--length <bytes>", "Random bytes length", (v) => Number.parseInt(v, 10)).option("--force", "Overwrite existing file", false).option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystorePassphraseInitCommand(defaultRuntime, {
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				length: typeof opts.length === "number" && Number.isFinite(opts.length) ? opts.length : undefined,
-				force: Boolean(opts.force),
-				json: Boolean(opts.json)
-			});
-		});
-	});
-	keystore.command("rotate-passphrase").description("Re-encrypt embedded keystore with a new passphrase and update passphrase file").option("--file <path>", "Passphrase file path (default: env or <state>/wallet/passphrase)").option("--old-passphrase <value>", "Old passphrase (avoid shell history; prefer file/env)").option("--new-passphrase <value>", "New passphrase (omit to auto-generate)").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystorePassphraseRotateCommand(defaultRuntime, {
-				file: typeof opts.file === "string" ? opts.file : undefined,
-				oldPassphrase: typeof opts.oldPassphrase === "string" ? opts.oldPassphrase : undefined,
-				newPassphrase: typeof opts.newPassphrase === "string" ? opts.newPassphrase : undefined,
-				json: Boolean(opts.json)
-			});
-		});
-	});
-	keystore.command("export").description("Export encrypted keystore backup (dangerous if printing)").option("--out <path>", "Write backup copy to path").option("--include-secret", "Include encrypted keystore content in JSON output", false).option("--confirm-include-secret <text>", "Required with --include-secret; type \"EXPORT KEYSTORE\"").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreExportCommand(defaultRuntime, {
-				out: typeof opts.out === "string" ? opts.out : undefined,
-				includeSecret: Boolean(opts.includeSecret),
-				confirmIncludeSecret: typeof opts.confirmIncludeSecret === "string" ? opts.confirmIncludeSecret : undefined,
-				json: Boolean(opts.json)
-			});
-		});
-	});
-	keystore.command("status").description("Show embedded keystore presence/unlock status").option("--chain <chain>", "Target chain: solana", "solana").option("--wallet-id <id>", "Named wallet id (uses chain-specific signer env fallback paths)").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreStatusCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				chain: resolvePublicWalletSetupChain(opts.chain) ?? "solana"
-			});
-		});
-	});
-	keystore.command("validate").description("Validate embedded keystore unlock + RPC connectivity + chain + balance").option("--chain <chain>", "Keystore chain override: solana").option("--wallet-id <id>", "Named wallet id (agent, mining, vault, ...)").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletKeystoreValidateCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
-				chain: resolvePublicWalletSetupChain(opts.chain)
-			});
-		});
-	});
 	const provider = wallet.command("provider").description("Configure hosted wallet provider credentials (stored encrypted locally)");
 	provider.command("configure <providerId>").description("Configure hosted provider credentials and set wallet.provider.id").option("--set <key=value>", "Credential field (repeatable)", (v, acc) => [...acc, v], []).option("--rpc-url <url>", "Optional RPC URL hint to store with provider credentials").option("--json", "Print JSON output", false).action(async (providerArg, opts) => {
-		const providerId = providerArg === "turnkey" || providerArg === "privy" || providerArg === "alchemy" ? providerArg : null;
+		const providerId = providerArg === "turnkey" || providerArg === "alchemy" ? providerArg : null;
 		if (!providerId) {
-			throw new Error("provider must be one of: turnkey, privy, alchemy");
+			throw new Error("provider must be one of: turnkey, alchemy; Privy is unavailable");
 		}
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletProviderConfigureCommand(defaultRuntime, {
@@ -198,17 +121,6 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	signer.command("broker").description("Run the app-facing local signer broker daemon").option("--socket <path>", "App-facing Unix socket path").option("--backend-socket <path>", "Private backend signer socket path").option("--read-only", "Read-only mode", false).option("--pid-file <path>", "PID file path").option("--audit-log <path>", "Audit log path").action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletSignerBrokerCommand(defaultRuntime, {
-				socketPath: typeof opts.socket === "string" ? opts.socket : undefined,
-				backendSocketPath: typeof opts.backendSocket === "string" ? opts.backendSocket : undefined,
-				readOnly: Boolean(opts.readOnly),
-				pidFile: typeof opts.pidFile === "string" ? opts.pidFile : undefined,
-				auditLog: typeof opts.auditLog === "string" ? opts.auditLog : undefined
-			});
-		});
-	});
 	signer.command("doctor").description("Validate native/local signer socket, pid, audit log, rpc, and keystore readiness").option("--socket <path>", "Unix socket path").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletSignerDoctorCommand(defaultRuntime, {
@@ -217,25 +129,6 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	wallet.command("custody-init").description("Initialize split-key custody ceremony (device/hot/cold share state)").option("--json", "Print JSON output", false).option("--force", "Overwrite existing custody ceremony state", false).option("--wallet <walletId>", "Target wallet id for per-wallet custody state").option("--device-share <base64>", "Optional pre-generated device share (base64/base64url, 32 bytes)").action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletCustodyInitCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				force: Boolean(opts.force),
-				walletId: typeof opts.wallet === "string" ? opts.wallet : undefined,
-				deviceShare: typeof opts.deviceShare === "string" ? opts.deviceShare : undefined
-			});
-		});
-	});
-	wallet.command("custody-lock").description("Immediately end active custody unlock sessions (clears ephemeral signing material)").option("--host <host>", "Only lock unlock sessions for this host").option("--wallet <walletId>", "Only lock unlock sessions for this wallet").option("--json", "Print JSON output", false).action(async (opts) => {
-		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletCustodyLockCommand(defaultRuntime, {
-				json: Boolean(opts.json),
-				host: typeof opts.host === "string" ? opts.host : undefined,
-				walletId: typeof opts.wallet === "string" ? opts.wallet : undefined
-			});
-		});
-	});
 	wallet.command("migrate").description("Migrate wallet runtime source").requiredOption("--from <runtime>", "Current runtime: external-docker|external-custom").requiredOption("--to <runtime>", "Target runtime: external-docker|external-custom").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletMigrateCommand(defaultRuntime, {
@@ -245,7 +138,7 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	wallet.command("canary").description("Run real-chain canary checks (and optional recovery drill)").option("--json", "Print JSON output", false).option("--no-require-real-chain", "Allow non-real-chain readiness failures in checks").option("--execute-provider-e2e", "Run provider-level E2E checks (create/address/balance/reject/audit; send when enabled)", false).option("--execute-live-send", "Allow real on-chain send execution in provider E2E (requires canary target env vars)", false).option("--providers <ids>", "Comma-separated provider ids (embedded-keystore,alchemy,turnkey,privy)").option("--execute-recovery-drill", "Run stack down/up recovery drill (external-docker runtime only)", false).action(async (opts) => {
+	wallet.command("canary").description("Run real-chain canary checks (and optional recovery drill)").option("--json", "Print JSON output", false).option("--no-require-real-chain", "Allow non-real-chain readiness failures in checks").option("--execute-provider-e2e", "Run provider-level E2E checks (create/address/balance/reject/audit; send when enabled)", false).option("--execute-live-send", "Allow real on-chain send execution in provider E2E (requires canary target env vars)", false).option("--providers <ids>", "Comma-separated provider ids (alchemy,turnkey)").option("--execute-recovery-drill", "Run stack down/up recovery drill (external-docker runtime only)", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletCanaryCommand(defaultRuntime, {
 				json: Boolean(opts.json),
@@ -258,7 +151,7 @@ function registerWalletCommands(program) {
 		});
 	});
 	const inbound = wallet.command("inbound").description("Inbound receive/deposit monitoring");
-	inbound.command("poll").description("Poll balances and detect inbound/outbound delta events").option("--provider <id>", "Provider id (embedded-keystore|alchemy|turnkey|privy)").option("--wallet-id <id>", "Named wallet id scope").option("--wallet-name <name>", "Named wallet name scope").option("--chain <chain>", "solana|all", "all").option("--json", "Print JSON output", false).action(async (opts) => {
+	inbound.command("poll").description("Poll balances and detect inbound/outbound delta events").option("--provider <id>", "Provider id (local-socket-signer|alchemy|turnkey|wallet-standard)").option("--wallet-id <id>", "Named wallet id scope").option("--wallet-name <name>", "Named wallet name scope").option("--chain <chain>", "solana|all", "all").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletInboundPollCommand(defaultRuntime, {
 				json: Boolean(opts.json),
@@ -269,7 +162,7 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	inbound.command("list").description("List inbound/deposit events from local wallet ledger").option("--provider <id>", "Provider id (embedded-keystore|alchemy|turnkey|privy)").option("--wallet-id <id>", "Named wallet id filter").option("--chain <chain>", "solana").option("--status <status>", "all|detected|confirmed|reconciled|ignored", "all").option("--limit <count>", "Result limit", "100").option("--json", "Print JSON output", false).action(async (opts) => {
+	inbound.command("list").description("List inbound/deposit events from local wallet ledger").option("--provider <id>", "Provider id (local-socket-signer|alchemy|turnkey|wallet-standard)").option("--wallet-id <id>", "Named wallet id filter").option("--chain <chain>", "solana").option("--status <status>", "all|detected|confirmed|reconciled|ignored", "all").option("--limit <count>", "Result limit", "100").option("--json", "Print JSON output", false).action(async (opts) => {
 		const limit = typeof opts.limit === "string" && opts.limit.trim() ? Number.parseInt(opts.limit, 10) : undefined;
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletInboundListCommand(defaultRuntime, {

package/dist/cli/providers-cli.js

@@ -1,11 +1,11 @@
 import { theme } from "../terminal/theme.js";
 import { defaultRuntime } from "../runtime.js";
 import { listAgentIds, resolveAgentDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
-import { getProviderBrandManifestForRoute } from "../providers/registry.js";
 import { ensureAuthProfileStore, loadAuthProfileStoreForRuntime } from "../agents/auth-profiles/store.js";
 import { loadConfig, writeConfigFile } from "../config/io.js";
 import "../config/config.js";
 import "../agents/auth-profiles.js";
+import { getProviderBrandManifestForRoute } from "../providers/registry.js";
 import { ensureFasedModelsJson } from "../agents/models-config.js";
 import { applyProviderRefreshToRegistrySource, buildProviderCapabilityOverridesSource, buildProviderRefreshEnvFromCredentials, buildProviderRefreshReport, buildProviderRegistryReviewPatch, fetchOfficialProviderRefreshSnapshot, loadProviderRefreshSnapshotFromFile } from "../providers/refresh.js";
 import { buildAuthChoiceGroups } from "../commands/auth-choice-options.js";