@fased/fased 0.1.62 → 0.1.64

package/dist/cli/sat-cli.js

@@ -1,12 +1,16 @@
+import { resolveStateDir } from "../config/paths.js";
 import { theme } from "../terminal/theme.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatCliCommand } from "./command-format.js";
+import { withFileLock } from "../plugin-sdk/file-lock.js";
+import { serializeWalletState, writeWalletStateFileAtomically } from "../wallet/wallet-atomic-state.js";
 import { runCommandWithRuntime } from "./cli-utils.js";
 import { formatHelpExamples } from "./help-format.js";
 import { addGatewayClientOptions, callGatewayFromCli } from "./gateway-rpc.js";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { appendFile, mkdir, open, readFile, rm, stat } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
 
 //#region src/cli/sat-cli.ts
@@ -14,6 +18,18 @@ const LAMPORTS_PER_SOL = 1000000000n;
 const DEFAULT_MAINTAIN_INTERVAL_SECONDS = 300;
 const DEFAULT_MAINTAIN_JITTER_SECONDS = 30;
 const DEFAULT_STALE_LOCK_SECONDS = 900;
+const SAT_MAINTENANCE_IDEMPOTENCY_VERSION = 1;
+const SAT_MAINTENANCE_IDEMPOTENCY_LIMIT = 64;
+const SAT_MAINTENANCE_IDEMPOTENCY_LOCK_OPTIONS = {
+	retries: {
+		retries: 120,
+		factor: 1.15,
+		minTimeout: 10,
+		maxTimeout: 100,
+		randomize: true
+	},
+	stale: 12e4
+};
 function runSatCommand(action, label) {
 	return runCommandWithRuntime(defaultRuntime, action, (err) => {
 		const message = err instanceof Error ? err.message : String(err);
@@ -113,6 +129,107 @@ function parseOptionalPositiveInteger(raw, label) {
 	}
 	return value;
 }
+function normalizeMaintenanceIdempotencyKey(raw) {
+	const value = raw.trim();
+	if (!value || value.length > 160 || /[^\x20-\x7e]/u.test(value)) {
+		throw new Error("--idempotency-key must contain 1-160 printable characters");
+	}
+	return value;
+}
+function maintenanceParamsDigest(params) {
+	const canonical = Object.fromEntries(Object.entries(params).toSorted(([left], [right]) => left.localeCompare(right)));
+	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+function maintenanceIdempotencyPath() {
+	return join(resolveStateDir(process.env), "sat-mining", "maintenance-cli-idempotency.json");
+}
+async function readMaintenanceIdempotencyFile(filePath) {
+	try {
+		const parsed = JSON.parse(await readFile(filePath, "utf8"));
+		if (parsed.version !== SAT_MAINTENANCE_IDEMPOTENCY_VERSION || !parsed.pending || typeof parsed.pending !== "object" || Array.isArray(parsed.pending)) {
+			throw new Error(`invalid SAT maintenance idempotency state at ${filePath}`);
+		}
+		const pending = {};
+		for (const [digest, value] of Object.entries(parsed.pending)) {
+			if (!/^[0-9a-f]{64}$/u.test(digest) || !value || typeof value.idempotencyKey !== "string" || value.paramsDigest !== digest || typeof value.createdAt !== "string") {
+				throw new Error(`invalid SAT maintenance idempotency record ${digest}`);
+			}
+			pending[digest] = {
+				idempotencyKey: normalizeMaintenanceIdempotencyKey(value.idempotencyKey),
+				paramsDigest: digest,
+				createdAt: value.createdAt
+			};
+		}
+		return {
+			version: SAT_MAINTENANCE_IDEMPOTENCY_VERSION,
+			pending
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") {
+			return {
+				version: SAT_MAINTENANCE_IDEMPOTENCY_VERSION,
+				pending: {}
+			};
+		}
+		throw error;
+	}
+}
+function trimMaintenanceIdempotencyEntries(pending) {
+	return Object.fromEntries(Object.entries(pending).toSorted(([, left], [, right]) => left.createdAt.localeCompare(right.createdAt)).slice(-SAT_MAINTENANCE_IDEMPOTENCY_LIMIT));
+}
+async function claimMaintenanceIdempotency(params, explicitKey) {
+	const paramsDigest = maintenanceParamsDigest(params);
+	if (explicitKey?.trim()) {
+		return {
+			idempotencyKey: normalizeMaintenanceIdempotencyKey(explicitKey),
+			paramsDigest,
+			managed: false
+		};
+	}
+	const filePath = maintenanceIdempotencyPath();
+	return await withFileLock(filePath, SAT_MAINTENANCE_IDEMPOTENCY_LOCK_OPTIONS, async () => {
+		const state = await readMaintenanceIdempotencyFile(filePath);
+		const existing = state.pending[paramsDigest];
+		if (existing) {
+			return {
+				...existing,
+				managed: true
+			};
+		}
+		const pending = {
+			idempotencyKey: `sat-maintain-${randomUUID()}`,
+			paramsDigest,
+			createdAt: new Date().toISOString()
+		};
+		state.pending[paramsDigest] = pending;
+		await mkdir(dirname(filePath), {
+			recursive: true,
+			mode: 448
+		});
+		writeWalletStateFileAtomically(filePath, serializeWalletState({
+			version: SAT_MAINTENANCE_IDEMPOTENCY_VERSION,
+			pending: trimMaintenanceIdempotencyEntries(state.pending)
+		}));
+		return {
+			...pending,
+			managed: true
+		};
+	});
+}
+async function completeMaintenanceIdempotency(claim) {
+	if (!claim.managed) {
+		return;
+	}
+	const filePath = maintenanceIdempotencyPath();
+	await withFileLock(filePath, SAT_MAINTENANCE_IDEMPOTENCY_LOCK_OPTIONS, async () => {
+		const state = await readMaintenanceIdempotencyFile(filePath);
+		if (state.pending[claim.paramsDigest]?.idempotencyKey !== claim.idempotencyKey) {
+			return;
+		}
+		delete state.pending[claim.paramsDigest];
+		writeWalletStateFileAtomically(filePath, serializeWalletState(state));
+	});
+}
 function renderSatResult(result, opts, successText) {
 	if (opts.json || successText === undefined) {
 		defaultRuntime.log(JSON.stringify(result, null, 2));
@@ -260,7 +377,14 @@ async function withMaintenanceLock(opts, action) {
 	}
 }
 async function callMaintenancePass(opts) {
-	return callGatewayFromCli("sat.runProtocolMaintenanceOnce", opts, buildMaintenanceParams(opts));
+	const params = buildMaintenanceParams(opts);
+	const claim = await claimMaintenanceIdempotency(params, opts.idempotencyKey);
+	const result = await callGatewayFromCli("sat.runProtocolMaintenanceOnce", opts, {
+		...params,
+		idempotencyKey: claim.idempotencyKey
+	});
+	await completeMaintenanceIdempotency(claim);
+	return result;
 }
 function summarizeMaintenanceResult(result) {
 	if (!result || typeof result !== "object") {
@@ -291,6 +415,9 @@ function maintenanceDelayMs(intervalSeconds, jitterSeconds) {
 	return baseMs + Math.floor(Math.random() * (jitterSeconds * 1e3 + 1));
 }
 async function runMaintenanceLoop(opts) {
+	if (opts.idempotencyKey?.trim()) {
+		throw new Error("--idempotency-key is for one maintenance pass; loop mode manages a durable key per pass");
+	}
 	const intervalSeconds = parseNonNegativeIntegerNumber(opts.intervalSeconds, "--interval-seconds", DEFAULT_MAINTAIN_INTERVAL_SECONDS);
 	const jitterSeconds = parseNonNegativeIntegerNumber(opts.jitterSeconds, "--jitter-seconds", DEFAULT_MAINTAIN_JITTER_SECONDS);
 	const maxIterations = parseOptionalPositiveInteger(opts.maxIterations, "--max-iterations");
@@ -351,7 +478,7 @@ function registerSatCli(program) {
 			renderSatMainnetSyncResult(result, opts);
 		}, "SAT mainnet sync failed");
 	});
-	addGatewayClientOptions(sat.command("maintain").description("Run one safe SAT protocol maintenance pass: reserve refill, fixed-recipient protocol claims, and bounded cleanup").option("--target-reserve-sol <amount>", "Reserve target in SOL").option("--target-reserve-lamports <amount>", "Reserve target in lamports").option("--min-sol <amount>", "Minimum pending SOL lane to submit").option("--min-sol-lamports <amount>", "Minimum pending SOL lane in lamports").option("--min-sat-raw <amount>", "Minimum pending SAT raw units to submit").option("--loop", "Run continuously with interval, jitter, and a local lock", false).option("--interval-seconds <seconds>", "Loop interval before jitter", `${DEFAULT_MAINTAIN_INTERVAL_SECONDS}`).option("--jitter-seconds <seconds>", "Random extra loop delay", `${DEFAULT_MAINTAIN_JITTER_SECONDS}`).option("--max-iterations <count>", "Stop after N loop passes; useful for tests and smoke runs").option("--cleanup-max-cycles <count>", "Maximum settled cycles to cleanup per maintenance pass").option("--cleanup-budget-ms <ms>", "Cleanup time budget per maintenance pass; remaining cleanup is deferred").option("--cleanup-max-transactions <count>", "Maximum cleanup transactions to submit per maintenance pass").option("--cleanup-batch-mode <mode>", "Cleanup batching mode: off or auto").option("--cleanup-max-batch-instructions <count>", "Maximum cleanup close instructions per batch transaction").option("--cleanup-scan-mode <mode>", "Cleanup discovery mode: recent, scan, or auto").option("--status-mode <mode>", "Response status mode: compact, ui, debug, or none").option("--log-file <path>", "Append JSONL audit records").option("--lock-file <path>", "Local lock file for the loop").option("--stale-lock-seconds <seconds>", "Remove a stale loop lock after this age", `${DEFAULT_STALE_LOCK_SECONDS}`).option("--json", "Output JSON", false)).action(async (opts) => {
+	addGatewayClientOptions(sat.command("maintain").description("Run one safe SAT protocol maintenance pass: reserve refill, fixed-recipient protocol claims, and bounded cleanup").option("--target-reserve-sol <amount>", "Reserve target in SOL").option("--target-reserve-lamports <amount>", "Reserve target in lamports").option("--min-sol <amount>", "Minimum pending SOL lane to submit").option("--min-sol-lamports <amount>", "Minimum pending SOL lane in lamports").option("--min-sat-raw <amount>", "Minimum pending SAT raw units to submit").option("--loop", "Run continuously with interval, jitter, and a local lock", false).option("--interval-seconds <seconds>", "Loop interval before jitter", `${DEFAULT_MAINTAIN_INTERVAL_SECONDS}`).option("--jitter-seconds <seconds>", "Random extra loop delay", `${DEFAULT_MAINTAIN_JITTER_SECONDS}`).option("--max-iterations <count>", "Stop after N loop passes; useful for tests and smoke runs").option("--cleanup-max-cycles <count>", "Maximum settled cycles to cleanup per maintenance pass").option("--cleanup-budget-ms <ms>", "Cleanup time budget per maintenance pass; remaining cleanup is deferred").option("--cleanup-max-transactions <count>", "Maximum cleanup transactions to submit per maintenance pass").option("--cleanup-batch-mode <mode>", "Cleanup batching mode: off or auto").option("--cleanup-max-batch-instructions <count>", "Maximum cleanup close instructions per batch transaction").option("--cleanup-scan-mode <mode>", "Cleanup discovery mode: recent, scan, or auto").option("--status-mode <mode>", "Response status mode: compact, ui, debug, or none").option("--idempotency-key <key>", "Retry key for one pass; reuse the same key after an ambiguous result").option("--log-file <path>", "Append JSONL audit records").option("--lock-file <path>", "Local lock file for the loop").option("--stale-lock-seconds <seconds>", "Remove a stale loop lock after this age", `${DEFAULT_STALE_LOCK_SECONDS}`).option("--json", "Output JSON", false)).action(async (opts) => {
 		await runSatCommand(async () => {
 			if (opts.loop) {
 				await runMaintenanceLoop(opts);

package/dist/cli/update-cli/update-command.js

@@ -23,6 +23,7 @@ import "../../daemon-cli.js";
 import { installCompletion } from "../completion-cli.js";
 import { readPackageName, readPackageVersion } from "../../infra/package-json.js";
 import { finalizeUpdateTransaction, rollbackUpdateTransaction, runGatewayUpdate } from "../../infra/update-runner.js";
+import { activateLocalSourceSigner, commitLocalSourcePairedUpdate, isLocalSourceSignerConfigured, markLocalSourceAppActive, markLocalSourceGatewayVerified, prepareLocalSourcePairedUpdate, readLocalSourcePairedUpdateJournal, recoverLocalSourcePairedUpdate, rollbackLocalSourcePairedUpdate, verifyLocalSourceSigner } from "../../infra/local-source-paired-update.js";
 import { checkShellCompletionStatus, ensureCompletionCacheExists } from "../../commands/doctor-completion.js";
 import { runPostUpdateDoctorRepair } from "../../commands/doctor-update.js";
 import { doctorCommand } from "../../commands/doctor.js";
@@ -755,6 +756,7 @@ async function updateCommand(opts) {
 	const updateInstallKind = switchToGit ? "git" : switchToPackage ? "package" : installKind;
 	const defaultChannel = updateInstallKind === "git" ? DEFAULT_GIT_CHANNEL : DEFAULT_PACKAGE_CHANNEL;
 	const channel = requestedChannel ?? storedChannel ?? defaultChannel;
+	const sourceSignerConfigured = installKind === "git" && await isLocalSourceSignerConfigured(process.env);
 	const explicitTag = normalizeTag(opts.tag);
 	let tag = explicitTag ?? channelToNpmTag(channel);
 	let installTag = tag;
@@ -808,6 +810,9 @@ async function updateCommand(opts) {
 		actions.push("Run plugin update sync after core update");
 		actions.push("Refresh shell completion cache (if needed)");
 		actions.push(shouldRestart ? "Restart gateway service and run doctor checks" : "Skip restart (because --no-restart is set)");
+		if (sourceSignerConfigured) {
+			actions.push("Snapshot the built source runtime, activate the exact version-matched native signer, and commit both only after Gateway and signer health");
+		}
 		const notes = [];
 		if (opts.tag && updateInstallKind === "git") {
 			notes.push("--tag applies to npm installs only; git updates ignore it.");
@@ -836,6 +841,21 @@ async function updateCommand(opts) {
 		}, Boolean(opts.json));
 		return;
 	}
+	if (sourceSignerConfigured && switchToPackage) {
+		defaultRuntime.error("A source checkout with a Local signer cannot switch install modes inside one update transaction. Omit --channel to perform a tagged source update, or use the verified installer migration procedure.");
+		defaultRuntime.exit(1);
+		return;
+	}
+	if (sourceSignerConfigured && channel === "dev") {
+		defaultRuntime.error("A Local signer can pair only with an exact tagged stable/beta source release; untagged dev commits fail closed.");
+		defaultRuntime.exit(1);
+		return;
+	}
+	if (sourceSignerConfigured && !shouldRestart) {
+		defaultRuntime.error("A source checkout with a Local signer requires Gateway restart and exact health verification; --no-restart is not allowed.");
+		defaultRuntime.exit(1);
+		return;
+	}
 	if (downgradeRisk && !opts.yes) {
 		if (!process.stdin.isTTY || opts.json) {
 			defaultRuntime.error(["Downgrade confirmation required.", "Downgrading can break configuration. Re-run in a TTY to confirm."].join("\n"));
@@ -1010,6 +1030,136 @@ async function updateCommand(opts) {
 			}
 		} catch {}
 	}
+	if (sourceSignerConfigured && !serviceLoaded) {
+		try {
+			await refreshGatewayServiceEnv({
+				root,
+				jsonMode: Boolean(opts.json)
+			});
+			serviceLoaded = await serviceTarget.service.isLoaded({ env: process.env });
+			if (!serviceLoaded) {
+				throw new Error("the Local Gateway service is still not loaded");
+			}
+			if (serviceTarget.scope === "platform") {
+				restartScriptPath = await prepareRestartScript(process.env);
+			}
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`A paired source app/signer update requires a managed Local Gateway service: ${String(error)}. Run ${formatCliCommand("fased gateway install --force")}, then retry.`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
+	const gatewayPort = resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : undefined);
+	const gatewayConfig = configSnapshot.valid ? configSnapshot.config.gateway : undefined;
+	const tlsRuntime = await loadGatewayTlsRuntime(gatewayConfig?.tls);
+	const restartRpc = {
+		url: `${tlsRuntime.enabled ? "wss" : "ws"}://127.0.0.1:${gatewayPort}`,
+		token: gatewayConfig?.auth?.token,
+		password: gatewayConfig?.auth?.password,
+		tlsFingerprint: tlsRuntime.enabled ? tlsRuntime.fingerprintSha256 : undefined,
+		timeoutMs: 1500
+	};
+	const restoreSourcePairAfterFailure = async (journal) => {
+		await rollbackLocalSourcePairedUpdate({
+			journal,
+			timeoutMs: timeoutMs ?? 20 * 6e4,
+			env: process.env
+		});
+		if (!serviceLoaded) {
+			return true;
+		}
+		const rollbackRestartScript = serviceTarget.scope === "platform" ? await prepareRestartScript(process.env) : null;
+		const restored = await maybeRestartService({
+			shouldRestart: true,
+			result: {
+				status: "ok",
+				mode: "git",
+				root: journal.sourceRoot,
+				after: { version: journal.previous.version },
+				steps: [],
+				durationMs: 0
+			},
+			opts,
+			refreshServiceEnv: true,
+			gatewayPort,
+			restartScriptPath: rollbackRestartScript,
+			serviceTarget,
+			serviceLoaded,
+			expectedVersion: journal.previous.version,
+			rpc: restartRpc
+		});
+		return restored.healthy;
+	};
+	let interruptedSourcePair = null;
+	if (installKind === "git") {
+		try {
+			interruptedSourcePair = await readLocalSourcePairedUpdateJournal(process.env);
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Local source transaction journal is invalid: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
+	if (interruptedSourcePair) {
+		try {
+			const recovery = await recoverLocalSourcePairedUpdate({
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+			if (recovery === "rolled-back" && serviceLoaded) {
+				const restored = await maybeRestartService({
+					shouldRestart: true,
+					result: {
+						status: "ok",
+						mode: "git",
+						root: interruptedSourcePair.sourceRoot,
+						after: { version: interruptedSourcePair.previous.version },
+						steps: [],
+						durationMs: 0
+					},
+					opts,
+					refreshServiceEnv: true,
+					gatewayPort,
+					restartScriptPath,
+					serviceTarget,
+					serviceLoaded,
+					expectedVersion: interruptedSourcePair.previous.version,
+					rpc: restartRpc
+				});
+				if (!restored.healthy) {
+					throw new Error("the previous Gateway did not become healthy after source recovery");
+				}
+				if (serviceTarget.scope === "platform") {
+					restartScriptPath = await prepareRestartScript(process.env);
+				}
+			}
+			if (!opts.json) {
+				defaultRuntime.log(theme.muted(recovery === "committed" ? "Completed the previously verified Local source app/signer commit." : "Recovered the interrupted Local source app/signer transaction."));
+			}
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Local source app/signer recovery failed: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
+	let sourcePair = null;
+	if (sourceSignerConfigured) {
+		try {
+			sourcePair = await prepareLocalSourcePairedUpdate({
+				sourceRoot: root,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Could not prepare Local source rollback: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
 	const result = switchToPackage ? await runPackageInstallUpdate({
 		root,
 		installKind,
@@ -1030,6 +1180,55 @@ async function updateCommand(opts) {
 		opts,
 		stop
 	});
+	if (sourcePair && result.status === "ok") {
+		try {
+			if (!result.after?.sha || !result.after.version) {
+				throw new Error("source update did not report an exact target Git SHA and version");
+			}
+			sourcePair = await markLocalSourceAppActive({
+				journal: sourcePair,
+				targetSha: result.after.sha,
+				targetVersion: result.after.version,
+				env: process.env
+			});
+			sourcePair = await activateLocalSourceSigner({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			try {
+				await rollbackLocalSourcePairedUpdate({
+					journal: sourcePair,
+					timeoutMs: timeoutMs ?? 20 * 6e4,
+					env: process.env
+				});
+			} catch (rollbackError) {
+				stop();
+				defaultRuntime.error(`Local source signer activation failed and rollback is incomplete: ${String(error)}; ${String(rollbackError)}`);
+				defaultRuntime.exit(1);
+				return;
+			}
+			stop();
+			defaultRuntime.error(`Local source update restored the previous app and signer: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	} else if (sourcePair) {
+		try {
+			await rollbackLocalSourcePairedUpdate({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			stop();
+			defaultRuntime.error(`Source update failed and exact rollback is incomplete: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+		sourcePair = null;
+	}
 	stop();
 	printResult(result, {
 		...opts,
@@ -1050,16 +1249,6 @@ async function updateCommand(opts) {
 		defaultRuntime.exit(0);
 		return;
 	}
-	const gatewayPort = resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : undefined);
-	const gatewayConfig = configSnapshot.valid ? configSnapshot.config.gateway : undefined;
-	const tlsRuntime = await loadGatewayTlsRuntime(gatewayConfig?.tls);
-	const restartRpc = {
-		url: `${tlsRuntime.enabled ? "wss" : "ws"}://127.0.0.1:${gatewayPort}`,
-		token: gatewayConfig?.auth?.token,
-		password: gatewayConfig?.auth?.password,
-		tlsFingerprint: tlsRuntime.enabled ? tlsRuntime.fingerprintSha256 : undefined,
-		timeoutMs: 1500
-	};
 	const restartResult = await maybeRestartService({
 		shouldRestart,
 		result,
@@ -1073,7 +1262,19 @@ async function updateCommand(opts) {
 		rpc: restartRpc
 	});
 	if (!restartResult.healthy) {
-		if (result.transaction) {
+		if (sourcePair) {
+			if (!opts.json) {
+				defaultRuntime.log(theme.warn("Gateway verification failed; restoring the exact source app and signer."));
+			}
+			try {
+				const restored = await restoreSourcePairAfterFailure(sourcePair);
+				if (!restored) {
+					defaultRuntime.error("Previous source Gateway was restored, but it is not healthy.");
+				}
+			} catch (error) {
+				defaultRuntime.error(`Automatic source app/signer rollback failed: ${String(error)}`);
+			}
+		} else if (result.transaction) {
 			if (!opts.json) {
 				defaultRuntime.log(theme.warn("Gateway verification failed; restoring the previous runtime."));
 			}
@@ -1098,6 +1299,54 @@ async function updateCommand(opts) {
 		defaultRuntime.exit(1);
 		return;
 	}
+	if (sourcePair) {
+		try {
+			await verifyLocalSourceSigner({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			try {
+				const restored = await restoreSourcePairAfterFailure(sourcePair);
+				if (!restored) {
+					throw new Error("the previous source Gateway did not become healthy", { cause: error });
+				}
+			} catch (rollbackError) {
+				defaultRuntime.error(`Signer verification failed and exact source rollback is incomplete: ${String(error)}; ${String(rollbackError)}`);
+				defaultRuntime.exit(1);
+				return;
+			}
+			defaultRuntime.error(`Signer verification failed; restored the previous source app and signer: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+		try {
+			sourcePair = await markLocalSourceGatewayVerified(sourcePair, process.env);
+		} catch (error) {
+			try {
+				await restoreSourcePairAfterFailure(sourcePair);
+			} catch (rollbackError) {
+				defaultRuntime.error(`Could not record paired health and rollback is incomplete: ${String(error)}; ${String(rollbackError)}`);
+				defaultRuntime.exit(1);
+				return;
+			}
+			defaultRuntime.error(`Could not durably record paired health: ${String(error)}`);
+			defaultRuntime.exit(1);
+			return;
+		}
+		try {
+			await commitLocalSourcePairedUpdate({
+				journal: sourcePair,
+				timeoutMs: timeoutMs ?? 20 * 6e4,
+				env: process.env
+			});
+		} catch (error) {
+			defaultRuntime.error(`The source Gateway and signer passed exact health, but commit cleanup is pending: ${String(error)}. Re-run fased update to finish forward recovery; do not downgrade manually.`);
+			defaultRuntime.exit(1);
+			return;
+		}
+	}
 	const lifecycleTimings = [...restartResult.timings];
 	await measureUpdateStage(lifecycleTimings, "transaction cleanup", () => finalizeUpdateTransaction(result.transaction));
 	const pluginResult = await measureUpdateStage(lifecycleTimings, "plugin updates", () => updatePluginsAfterCoreUpdate({

package/dist/commands/auth-choice.apply.api-providers.js

@@ -1,11 +1,11 @@
+import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
+import { resolveAuthProfileOrder } from "../agents/auth-profiles/order.js";
+import "../agents/auth-profiles.js";
 import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/cloudflare-ai-gateway-shared.js";
 import { SYNTHETIC_DEFAULT_MODEL_REF } from "../providers/synthetic-models.js";
 import { TOGETHER_DEFAULT_MODEL_REF } from "../providers/together-models.js";
 import { VENICE_DEFAULT_MODEL_REF } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
-import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
-import { resolveAuthProfileOrder } from "../agents/auth-profiles/order.js";
-import "../agents/auth-profiles.js";
 import { CHUTES_DEFAULT_MODEL_REF } from "../agents/chutes-models.js";
 import { QWEN_CODING_PLAN_DEFAULT_MODEL_REF, QWEN_DEFAULT_MODEL_REF } from "../agents/models-config.providers.js";
 import { normalizeApiKeyInput, validateApiKeyInput } from "./auth-choice.api-key.js";

package/dist/commands/doctor-config-flow.js

@@ -14,12 +14,12 @@ import "../config/config.js";
 import { listTelegramAccountIds, resolveTelegramAccount } from "../telegram/accounts.js";
 import "../channels/registry.js";
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
-import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
 import { listInterpreterLikeSafeBins, resolveMergedSafeBinProfileFixtures } from "../infra/exec-safe-bin-runtime-policy.js";
 import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js";
 import { isNumericTelegramUserId, normalizeTelegramAllowFromEntry } from "../channels/telegram/allow-from.js";
 import { collectProviderDangerousNameMatchingScopes } from "../config/dangerous-name-matching.js";
 import { isDiscordMutableAllowEntry, isGoogleChatMutableAllowEntry, isIrcMutableAllowEntry, isMSTeamsMutableAllowEntry, isMattermostMutableAllowEntry, isSlackMutableAllowEntry } from "../security/mutable-allowlist-detectors.js";
+import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
 import { fetchTelegramChatId } from "../channels/telegram/api.js";
 import { note } from "../terminal/note.js";
 import { normalizeLegacyConfigValues } from "./doctor-legacy-config.js";

package/dist/commands/doctor-legacy-config.js

@@ -329,25 +329,14 @@ function normalizeLegacyConfigValues(cfg) {
 	normalizeProvider("discord");
 	const rawWalletProviderId = String(cfg.wallet?.provider?.id ?? "").trim();
 	const allowedProviderIds = new Set([
-		"embedded-keystore",
 		"local-socket-signer",
 		"alchemy",
 		"turnkey",
+		"wallet-standard",
 		"privy"
 	]);
 	if (rawWalletProviderId && !allowedProviderIds.has(rawWalletProviderId)) {
-		const mappedProviderId = "embedded-keystore";
-		next = {
-			...next,
-			wallet: {
-				...next.wallet,
-				provider: {
-					...next.wallet?.provider,
-					id: mappedProviderId
-				}
-			}
-		};
-		changes.push("Normalized unsupported wallet.provider.id to embedded-keystore.");
+		changes.push(`Wallet provider ${rawWalletProviderId} is unsupported and was left unchanged for explicit operator repair.`);
 	}
 	const legacyAckReaction = cfg.messages?.ackReaction?.trim();
 	const hasWhatsAppConfig = cfg.channels?.whatsapp !== undefined;

package/dist/commands/model-picker.js

@@ -1,4 +1,8 @@
 import { resolveAgentModelPrimaryValue } from "../config/model-input.js";
+import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../agents/defaults.js";
+import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
+import { listProfilesForProvider } from "../agents/auth-profiles/profiles.js";
+import "../agents/auth-profiles.js";
 import { CLOUDFLARE_AI_GATEWAY_MODEL_REFS } from "../providers/cloudflare-ai-gateway-shared.js";
 import { HUGGINGFACE_MODEL_REFS } from "../providers/huggingface-models.js";
 import { OPENCODE_ZEN_MODEL_REFS } from "../providers/opencode-zen-shared.js";
@@ -7,10 +11,6 @@ import { VENICE_MODEL_REFS } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_MODEL_REFS } from "../providers/vercel-ai-gateway-models.js";
 import { LITELLM_MODEL_REFS } from "../providers/litellm-models.js";
 import { BYTEPLUS_CODING_MODEL_REFS, BYTEPLUS_MODEL_REFS, COPILOT_PROXY_MODEL_REFS, GITHUB_COPILOT_MODEL_REFS, GOOGLE_API_MODEL_REFS, GOOGLE_GEMINI_CLI_MODEL_REFS, MISTRAL_MODEL_REFS, OPENAI_API_MODEL_REFS, OPENAI_SIGN_IN_MODEL_REFS, OPENROUTER_MODEL_REFS, QIANFAN_MODEL_REFS, SYNTHETIC_MODEL_REFS, VOLCENGINE_CODING_MODEL_REFS, VOLCENGINE_MODEL_REFS, XAI_MODEL_REFS, XIAOMI_MODEL_REFS, ZAI_MODEL_REFS, isStandardProviderCatalogEntry, isStandardProviderModelRef } from "../providers/registry.js";
-import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../agents/defaults.js";
-import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
-import { listProfilesForProvider } from "../agents/auth-profiles/profiles.js";
-import "../agents/auth-profiles.js";
 import { getCustomProviderApiKey, resolveEnvApiKey } from "../agents/model-auth.js";
 import { buildAllowedModelSet, buildModelAliasIndex, modelKey, normalizeProviderId, resolveConfiguredModelRef } from "../agents/model-selection.js";
 import { formatModelFeatureList } from "../agents/model-metadata.js";
@@ -284,8 +284,8 @@ async function promptDefaultModel(params) {
 			defaultProvider: DEFAULT_PROVIDER,
 			store: ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false })
 		}) : null;
-		if (scoped && (scoped.allowedCatalog.length > 0 || scoped.usableCatalog.length > 0)) {
-			models = scoped.allowedCatalog.length > 0 ? scoped.allowedCatalog : scoped.usableCatalog;
+		if (scoped) {
+			models = scoped.allowAny ? scoped.usableCatalog : scoped.allowedCatalog;
 		} else {
 			const { allowedCatalog } = buildAllowedModelSet({
 				cfg,

package/dist/commands/models/auth.js

@@ -1,10 +1,10 @@
 import { resolveDefaultAgentWorkspaceDir } from "../../agents/workspace.js";
 import { resolveAgentDir, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agents/agent-scope.js";
-import { ANTHROPIC_PROVIDER_MANIFEST } from "../../providers/registry.js";
 import { formatCliCommand } from "../../cli/command-format.js";
 import { upsertAuthProfile } from "../../agents/auth-profiles/profiles.js";
 import { parseDurationMs } from "../../cli/parse-duration.js";
 import "../../agents/auth-profiles.js";
+import { ANTHROPIC_PROVIDER_MANIFEST } from "../../providers/registry.js";
 import { normalizeProviderId } from "../../agents/model-selection.js";
 import { stylePromptHint, stylePromptMessage } from "../../terminal/prompt-style.js";
 import { openUrl } from "../onboard-helpers.js";

package/dist/commands/onboard-auth.config-gateways.js

@@ -1,6 +1,6 @@
 import { CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "../providers/cloudflare-ai-gateway-shared.js";
-import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
 import "../agents/cloudflare-ai-gateway.js";
+import { VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF } from "../providers/vercel-ai-gateway-models.js";
 import { applyAgentDefaultModelPrimary, applyProviderConfigWithDefaultModels } from "./onboard-auth.config-shared.js";
 import "./onboard-auth.credentials.js";