@fased/fased 0.1.62 → 0.1.64

package/dist/wallet/wallet-custody.js

@@ -1,1836 +0,0 @@
-import { ensureWalletStateDir, resolveWalletRuntimeConfig } from "./wallet-runtime-config.js";
-import { readWalletProviderRegistry, resolveWalletUserRole } from "./wallet-provider-registry.js";
-import { tryResolveSatRuntimeIds } from "../config/sat-runtime-ids.js";
-import { applyWalletPolicyConfig, resolveWalletRolePolicyProfile } from "./wallet-policy.js";
-import { walletDiagnosticErrorMessage } from "./wallet-redaction.js";
-import { resolveWalletProviderId } from "./wallet-provider-resolver.js";
-import { consumeWalletApprovalGrant, resolveWalletApprovalAuthMode } from "./wallet-approval-auth.js";
-import { lockLocalSignerCustody, unlockLocalSignerCustody } from "./local-socket-signer-custody.js";
-import syncFs from "node:fs";
-import path from "node:path";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-
-//#region src/wallet/wallet-custody.ts
-const DEFAULT_UNLOCK_TTL_SECONDS = 15 * 60;
-const MAX_UNLOCK_TTL_SECONDS = 60 * 60;
-const MANUAL_UNLOCK_EXPIRES_AT = "9999-12-31T23:59:59.000Z";
-const CUSTODY_SECRET_BYTES = 32;
-const SOLANA_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-const SOLANA_TOKEN_2022_PROGRAM_ID = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
-const SOLANA_ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-const unlockMaterialBySession = new Map();
-function normalizeHost(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) {
-		return "";
-	}
-	try {
-		const withScheme = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
-		const parsed = new URL(withScheme);
-		const hostname = parsed.hostname.toLowerCase();
-		if (!parsed.port || parsed.port === "443") {
-			return hostname;
-		}
-		return `${hostname}:${parsed.port}`;
-	} catch {
-		return "";
-	}
-}
-function nowMs() {
-	return Date.now();
-}
-function isNonNull(value) {
-	return value !== null;
-}
-function sha256Hex(input) {
-	return createHash("sha256").update(input).digest("hex");
-}
-function normalizeWalletIdForState(value) {
-	const raw = String(value ?? "").trim().toLowerCase();
-	if (!raw) {
-		return "default";
-	}
-	const normalized = raw.replace(/[^a-z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-	return normalized || "default";
-}
-function normalizeChainList(value) {
-	const seen = new Set();
-	for (const entry of value) {
-		if (entry === "solana") {
-			seen.add(entry);
-		}
-	}
-	return [...seen];
-}
-function normalizeAddressList(values) {
-	const seen = new Set();
-	for (const value of values) {
-		const normalized = String(value ?? "").trim().toLowerCase();
-		if (!normalized) {
-			continue;
-		}
-		seen.add(normalized);
-	}
-	return [...seen];
-}
-function normalizeWalletCustodyRole(value) {
-	return value === "mining" || value === "agent" || value === "vault" ? value : undefined;
-}
-function normalizeDeviceLabel(value) {
-	const normalized = String(value ?? "").trim().replace(/\s+/g, " ");
-	return normalized ? normalized.slice(0, 80) : undefined;
-}
-function createCustodyDeviceId() {
-	return randomBytes(8).toString("hex");
-}
-function normalizeDeviceShareX(value) {
-	return typeof value === "number" && Number.isInteger(value) && value >= 2 && value <= 255 && value !== 3 ? value : null;
-}
-function normalizeEnrolledDevice(raw) {
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-		return null;
-	}
-	const value = raw;
-	const id = typeof value.id === "string" ? value.id.trim() : "";
-	const shareX = normalizeDeviceShareX(value.shareX);
-	const shareHash = typeof value.shareHash === "string" ? value.shareHash.trim() : "";
-	const createdAt = typeof value.createdAt === "string" ? value.createdAt : "";
-	if (!id || !shareX || !shareHash || !createdAt) {
-		return null;
-	}
-	return {
-		id,
-		label: normalizeDeviceLabel(typeof value.label === "string" ? value.label : undefined),
-		shareX,
-		shareHash,
-		createdAt,
-		revokedAt: typeof value.revokedAt === "string" ? value.revokedAt : undefined
-	};
-}
-function listActiveEnrolledDevices(shareState) {
-	if (!shareState) {
-		return [];
-	}
-	if (shareState.version === 3 && shareState.scheme === "shamir-2ofn-v1") {
-		return shareState.devices.filter((device) => !device.revokedAt);
-	}
-	if (shareState.version === 2 && shareState.scheme === "shamir-2of3-v1") {
-		return [{
-			id: "primary",
-			label: "Primary device",
-			shareX: 2,
-			shareHash: shareState.deviceShareHash,
-			createdAt: shareState.createdAt
-		}];
-	}
-	if (shareState.version === 1 && shareState.scheme === "xor-3of3-v1") {
-		return [{
-			id: "legacy-primary",
-			label: "Primary device",
-			shareX: 2,
-			shareHash: shareState.deviceShareHash,
-			createdAt: shareState.createdAt
-		}];
-	}
-	return [];
-}
-function allocateNextDeviceShareX(devices) {
-	const used = new Set(devices.map((device) => device.shareX));
-	for (let candidate = 2; candidate <= 255; candidate += 1) {
-		if (candidate === 3 || used.has(candidate)) {
-			continue;
-		}
-		return candidate;
-	}
-	throw new Error("no available device-share slots remain for this wallet");
-}
-function resolveLegacyCustodyStatePath(env = process.env) {
-	const walletPaths = ensureWalletStateDir(env);
-	return path.join(walletPaths.rootDir, "wallet-custody-state.json");
-}
-function resolveLegacyCustodyShareStatePath(env = process.env) {
-	const walletPaths = ensureWalletStateDir(env);
-	return path.join(walletPaths.rootDir, "wallet-custody-shares.v1.json");
-}
-function resolveCustodyWalletDir(walletId, env = process.env) {
-	const walletPaths = ensureWalletStateDir(env);
-	return path.join(walletPaths.rootDir, "custody", normalizeWalletIdForState(walletId));
-}
-function resolveCustodyStatePath(walletId, env = process.env) {
-	return path.join(resolveCustodyWalletDir(walletId, env), "state.json");
-}
-function resolveCustodyShareStatePath(walletId, env = process.env) {
-	return path.join(resolveCustodyWalletDir(walletId, env), "shares.v1.json");
-}
-function locateCustodyStatePath(walletId, env = process.env) {
-	const scopedPath = resolveCustodyStatePath(walletId, env);
-	if (syncFs.existsSync(scopedPath)) {
-		return scopedPath;
-	}
-	const legacyPath = resolveLegacyCustodyStatePath(env);
-	return syncFs.existsSync(legacyPath) ? legacyPath : scopedPath;
-}
-function locateCustodyShareStatePath(walletId, env = process.env) {
-	const scopedPath = resolveCustodyShareStatePath(walletId, env);
-	if (syncFs.existsSync(scopedPath)) {
-		return scopedPath;
-	}
-	const legacyPath = resolveLegacyCustodyShareStatePath(env);
-	return syncFs.existsSync(legacyPath) ? legacyPath : scopedPath;
-}
-function listCustodyStateTargets(env = process.env) {
-	const walletPaths = ensureWalletStateDir(env);
-	const custodyRoot = path.join(walletPaths.rootDir, "custody");
-	const targets = new Set();
-	if (syncFs.existsSync(custodyRoot)) {
-		for (const entry of syncFs.readdirSync(custodyRoot, { withFileTypes: true })) {
-			if (entry.isDirectory() && entry.name.trim()) {
-				targets.add(entry.name.trim());
-			}
-		}
-	}
-	const out = [...targets];
-	if (syncFs.existsSync(resolveLegacyCustodyStatePath(env)) || out.length === 0) {
-		out.push(undefined);
-	}
-	return out;
-}
-function readUnlockTtlSeconds(env = process.env, requestedTtlSeconds) {
-	const raw = typeof requestedTtlSeconds === "number" && Number.isFinite(requestedTtlSeconds) ? requestedTtlSeconds : Number.parseInt(String(env.FASED_WALLET_CUSTODY_UNLOCK_TTL_SECONDS ?? ""), 10);
-	if (!Number.isFinite(raw) || raw <= 0) {
-		return DEFAULT_UNLOCK_TTL_SECONDS;
-	}
-	return Math.min(MAX_UNLOCK_TTL_SECONDS, Math.max(30, Math.floor(raw)));
-}
-function resolveUnlockExpiresAt(env = process.env, requestedTtlSeconds) {
-	if (requestedTtlSeconds === 0) {
-		return MANUAL_UNLOCK_EXPIRES_AT;
-	}
-	return new Date(nowMs() + readUnlockTtlSeconds(env, requestedTtlSeconds) * 1e3).toISOString();
-}
-function readBooleanFlag(env, key) {
-	const value = String(env[key] ?? "").trim().toLowerCase();
-	return value === "1" || value === "true" || value === "yes" || value === "on";
-}
-function normalizeWalletIdForCustodyEnv(value) {
-	const raw = String(value ?? "").trim().toLowerCase();
-	if (!raw) {
-		return "default";
-	}
-	return raw.replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "") || "default";
-}
-function readCustodyWalletSet(env) {
-	const out = new Set();
-	for (const part of String(env.FASED_WALLET_CUSTODY_WALLETS ?? "").split(",")) {
-		if (!part.trim()) {
-			continue;
-		}
-		const normalized = normalizeWalletIdForCustodyEnv(part);
-		if (normalized) {
-			out.add(normalized);
-		}
-	}
-	return out;
-}
-function decodeBase64Share(raw) {
-	const value = raw.trim();
-	if (!value) {
-		return null;
-	}
-	for (const encoding of ["base64url", "base64"]) {
-		try {
-			const decoded = Buffer.from(value, encoding);
-			if (decoded.length > 0) {
-				return decoded;
-			}
-		} catch {}
-	}
-	return null;
-}
-function buffersEqualHex(leftHex, rightHex) {
-	try {
-		const left = Buffer.from(leftHex, "hex");
-		const right = Buffer.from(rightHex, "hex");
-		if (left.length === 0 || right.length === 0 || left.length !== right.length) {
-			return false;
-		}
-		return timingSafeEqual(left, right);
-	} catch {
-		return false;
-	}
-}
-function xorBuffers(buffers) {
-	if (buffers.length === 0) {
-		return Buffer.alloc(0);
-	}
-	const length = buffers[0].length;
-	const out = Buffer.alloc(length, 0);
-	for (const buffer of buffers) {
-		if (buffer.length !== length) {
-			throw new Error("buffer length mismatch");
-		}
-		for (let i = 0; i < length; i += 1) {
-			out[i] ^= buffer[i];
-		}
-	}
-	return out;
-}
-function gf256Multiply(left, right) {
-	let a = left & 255;
-	let b = right & 255;
-	let out = 0;
-	while (b > 0) {
-		if (b & 1) {
-			out ^= a;
-		}
-		const hiBit = a & 128;
-		a = a << 1 & 255;
-		if (hiBit) {
-			a ^= 27;
-		}
-		b >>= 1;
-	}
-	return out & 255;
-}
-function gf256Pow(value, exponent) {
-	let result = 1;
-	let base = value & 255;
-	let power = Math.max(0, Math.floor(exponent));
-	while (power > 0) {
-		if (power & 1) {
-			result = gf256Multiply(result, base);
-		}
-		base = gf256Multiply(base, base);
-		power >>= 1;
-	}
-	return result & 255;
-}
-function gf256Inverse(value) {
-	if (value === 0) {
-		throw new Error("cannot invert zero in GF(256)");
-	}
-	return gf256Pow(value, 254);
-}
-function gf256Divide(left, right) {
-	if (left === 0) {
-		return 0;
-	}
-	return gf256Multiply(left, gf256Inverse(right));
-}
-function encodeTypedCustodyShare(type, share) {
-	return `${type === "device" ? "d" : "r"}.${share.toString("base64url")}`;
-}
-function decodeTypedCustodyShare(raw) {
-	const value = raw.trim();
-	if (!value) {
-		return {
-			type: "unknown",
-			bytes: null
-		};
-	}
-	const match = /^([dr])\.(.+)$/i.exec(value);
-	if (!match) {
-		return {
-			type: "unknown",
-			bytes: decodeBase64Share(value)
-		};
-	}
-	return {
-		type: match[1]?.toLowerCase() === "r" ? "recovery" : "device",
-		bytes: decodeBase64Share(match[2] ?? "")
-	};
-}
-function splitSecretShamir2of3(secret) {
-	const slope = randomBytes(secret.length);
-	const hostShare = deriveSecretShamirShare(secret, slope, 1);
-	const deviceShare = deriveSecretShamirShare(secret, slope, 2);
-	const recoveryShare = deriveSecretShamirShare(secret, slope, 3);
-	slope.fill(0);
-	return {
-		hostShare,
-		deviceShare,
-		recoveryShare
-	};
-}
-function deriveSecretShamirShare(secret, slope, x) {
-	if (secret.length !== slope.length) {
-		throw new Error("share length mismatch");
-	}
-	const share = Buffer.alloc(secret.length, 0);
-	for (let i = 0; i < secret.length; i += 1) {
-		const s = secret[i] ?? 0;
-		const m = slope[i] ?? 0;
-		share[i] = s ^ gf256Multiply(m, x);
-	}
-	return share;
-}
-function splitSecretShamir2of3WithDeviceShare(secret, deviceShare) {
-	if (secret.length !== deviceShare.length) {
-		throw new Error("share length mismatch");
-	}
-	const slope = Buffer.alloc(secret.length, 0);
-	for (let i = 0; i < secret.length; i += 1) {
-		const s = secret[i] ?? 0;
-		const d = deviceShare[i] ?? 0;
-		slope[i] = gf256Divide(s ^ d, 2);
-	}
-	const hostShare = deriveSecretShamirShare(secret, slope, 1);
-	const recoveryShare = deriveSecretShamirShare(secret, slope, 3);
-	slope.fill(0);
-	return {
-		hostShare,
-		recoveryShare
-	};
-}
-function reconstructSecretShamir2ofN(params) {
-	const { hostShare, otherShare, otherX } = params;
-	if (hostShare.length !== otherShare.length) {
-		throw new Error("share length mismatch");
-	}
-	const out = Buffer.alloc(hostShare.length, 0);
-	const denominator = 1 ^ otherX;
-	const weightHost = gf256Divide(otherX, denominator);
-	const weightOther = gf256Divide(1, denominator);
-	for (let i = 0; i < hostShare.length; i += 1) {
-		const left = gf256Multiply(hostShare[i] ?? 0, weightHost);
-		const right = gf256Multiply(otherShare[i] ?? 0, weightOther);
-		out[i] = left ^ right;
-	}
-	return out;
-}
-function zeroizeBuffers(buffers) {
-	for (const buffer of buffers) {
-		if (!buffer || buffer.length === 0) {
-			continue;
-		}
-		buffer.fill(0);
-	}
-}
-function removeUnlockMaterial(sessionId) {
-	const existing = unlockMaterialBySession.get(sessionId);
-	if (!existing) {
-		return;
-	}
-	unlockMaterialBySession.delete(sessionId);
-}
-function pruneUnlockMaterialStore(now = nowMs()) {
-	for (const [sessionId, entry] of unlockMaterialBySession.entries()) {
-		if (entry.expiresAtMs <= now) {
-			removeUnlockMaterial(sessionId);
-		}
-	}
-}
-function setUnlockMaterial(params) {
-	removeUnlockMaterial(params.sessionId);
-	const expiresAtMs = Date.parse(params.expiresAt);
-	unlockMaterialBySession.set(params.sessionId, {
-		sessionId: params.sessionId,
-		host: params.host,
-		expiresAtMs: Number.isFinite(expiresAtMs) ? expiresAtMs : nowMs() + 3e4
-	});
-}
-function hasActiveUnlockMaterial(params) {
-	pruneUnlockMaterialStore();
-	const entry = unlockMaterialBySession.get(params.sessionId);
-	if (!entry) {
-		return false;
-	}
-	if (entry.host !== params.host || entry.expiresAtMs <= nowMs()) {
-		removeUnlockMaterial(params.sessionId);
-		return false;
-	}
-	return true;
-}
-async function withWalletCustodySigningMaterial(params) {
-	pruneUnlockMaterialStore();
-	const entry = unlockMaterialBySession.get(params.sessionId);
-	if (!entry || entry.host !== params.host || entry.expiresAtMs <= nowMs()) {
-		removeUnlockMaterial(params.sessionId);
-		return {
-			ok: false,
-			code: "custody_unlock_required",
-			message: "custody unlock signing material is unavailable; re-run passkey unlock"
-		};
-	}
-	try {
-		const value = await params.handler({
-			sessionId: entry.sessionId,
-			host: entry.host
-		});
-		return {
-			ok: true,
-			value
-		};
-	} finally {}
-}
-function inferWalletChains(params) {
-	try {
-		const registry = readWalletProviderRegistry(params.env);
-		const namedWallet = registry.wallets.find((entry) => entry.id === params.walletId);
-		const inferred = normalizeChainList([namedWallet?.addresses?.solana ? "solana" : ""]);
-		if (inferred.length > 0) {
-			return inferred;
-		}
-	} catch {}
-	return params.wallet.chains.length > 0 ? params.wallet.chains : ["solana"];
-}
-function resolveWalletCustodyScope(params) {
-	const env = params.env ?? process.env;
-	const wallet = params.wallet ?? resolveWalletRuntimeConfig(params.cfg ?? {}, env);
-	const registry = readWalletProviderRegistry(env);
-	const configuredMiningWalletId = typeof params.cfg?.plugins?.entries?.["sat-mining"]?.config?.walletId === "string" ? params.cfg.plugins.entries["sat-mining"]?.config?.walletId.trim() : "";
-	const explicitWalletId = params.walletId?.trim() || "";
-	const walletId = explicitWalletId || registry.defaultWalletId?.trim() || configuredMiningWalletId || registry.wallets.find((entry) => entry.providerId === "local-socket-signer")?.id || "default";
-	const registryWallet = registry.wallets.find((entry) => entry.id === walletId);
-	const walletPurpose = resolveWalletUserRole(registryWallet);
-	const role = walletId === configuredMiningWalletId || walletPurpose === "mining" ? "mining" : walletId === registry.defaultWalletId || walletPurpose === "agent" ? "agent" : "vault";
-	const effectiveWallet = applyWalletPolicyConfig({
-		config: wallet,
-		cfg: params.cfg,
-		env,
-		walletId
-	});
-	const roleProfile = resolveWalletRolePolicyProfile(role, env);
-	const chains = role === "mining" ? ["solana"] : inferWalletChains({
-		wallet: effectiveWallet,
-		env,
-		walletId
-	});
-	const allowPrograms = new Set(normalizeAddressList(effectiveWallet.policy.solana.allowPrograms));
-	if (role === "mining") {
-		const ids = tryResolveSatRuntimeIds(env);
-		if (ids?.programId) {
-			allowPrograms.add(ids.programId.toLowerCase());
-		}
-	} else if (chains.includes("solana")) {
-		allowPrograms.add(SOLANA_TOKEN_PROGRAM_ID.toLowerCase());
-		allowPrograms.add(SOLANA_TOKEN_2022_PROGRAM_ID.toLowerCase());
-		allowPrograms.add(SOLANA_ASSOCIATED_TOKEN_PROGRAM_ID.toLowerCase());
-	}
-	for (const program of roleProfile.defaults.solana.allowPrograms) {
-		allowPrograms.add(program.toLowerCase());
-	}
-	const solanaMaxPerTx = role === "mining" ? roleProfile.defaults.solana.maxPerTx : effectiveWallet.policy.solana.caps.maxPerTx.toString();
-	const solanaMaxDaily = role === "mining" ? roleProfile.defaults.solana.maxDaily : effectiveWallet.policy.solana.caps.maxDaily.toString();
-	return {
-		walletId,
-		role,
-		chains,
-		allowPrograms: [...allowPrograms],
-		solana: {
-			maxPerTx: solanaMaxPerTx,
-			maxDaily: solanaMaxDaily
-		}
-	};
-}
-function loadShareState(walletId, env = process.env) {
-	const filePath = locateCustodyShareStatePath(walletId, env);
-	if (!syncFs.existsSync(filePath)) {
-		return null;
-	}
-	try {
-		const parsed = JSON.parse(syncFs.readFileSync(filePath, "utf8"));
-		if (parsed.version === 1 && parsed.scheme === "xor-3of3-v1" && typeof parsed.secretBytes === "number" && parsed.secretBytes > 0 && typeof parsed.hotShare === "string" && typeof parsed.coldShare === "string" && typeof parsed.deviceShareHash === "string" && typeof parsed.secretChecksum === "string" && typeof parsed.createdAt === "string" && typeof parsed.updatedAt === "string") {
-			const hot = decodeBase64Share(parsed.hotShare);
-			const cold = decodeBase64Share(parsed.coldShare);
-			if (!hot || !cold || hot.length !== parsed.secretBytes || cold.length !== parsed.secretBytes) {
-				return null;
-			}
-			return {
-				version: 1,
-				scheme: "xor-3of3-v1",
-				secretBytes: parsed.secretBytes,
-				hotShare: parsed.hotShare,
-				coldShare: parsed.coldShare,
-				deviceShareHash: parsed.deviceShareHash,
-				secretChecksum: parsed.secretChecksum,
-				walletId: typeof parsed.walletId === "string" ? parsed.walletId.trim() || undefined : undefined,
-				role: normalizeWalletCustodyRole(parsed.role),
-				createdAt: parsed.createdAt,
-				updatedAt: parsed.updatedAt
-			};
-		}
-		if (parsed.version === 2 && parsed.scheme === "shamir-2of3-v1" && typeof parsed.secretBytes === "number" && parsed.secretBytes > 0 && typeof parsed.hostShare === "string" && typeof parsed.deviceShareHash === "string" && typeof parsed.recoveryShareHash === "string" && typeof parsed.secretChecksum === "string" && typeof parsed.createdAt === "string" && typeof parsed.updatedAt === "string") {
-			const host = decodeBase64Share(parsed.hostShare);
-			if (!host || host.length !== parsed.secretBytes) {
-				return null;
-			}
-			return {
-				version: 2,
-				scheme: "shamir-2of3-v1",
-				secretBytes: parsed.secretBytes,
-				hostShare: parsed.hostShare,
-				deviceShareHash: parsed.deviceShareHash,
-				recoveryShareHash: parsed.recoveryShareHash,
-				secretChecksum: parsed.secretChecksum,
-				walletId: typeof parsed.walletId === "string" ? parsed.walletId.trim() || undefined : undefined,
-				role: normalizeWalletCustodyRole(parsed.role),
-				createdAt: parsed.createdAt,
-				updatedAt: parsed.updatedAt
-			};
-		}
-		if (parsed.version === 3 && parsed.scheme === "shamir-2ofn-v1" && typeof parsed.secretBytes === "number" && parsed.secretBytes > 0 && typeof parsed.hostShare === "string" && typeof parsed.recoveryShareHash === "string" && typeof parsed.secretChecksum === "string" && typeof parsed.createdAt === "string" && typeof parsed.updatedAt === "string" && Array.isArray(parsed.devices)) {
-			const host = decodeBase64Share(parsed.hostShare);
-			if (!host || host.length !== parsed.secretBytes) {
-				return null;
-			}
-			const devices = (parsed.devices ?? []).map(normalizeEnrolledDevice).filter(isNonNull);
-			return {
-				version: 3,
-				scheme: "shamir-2ofn-v1",
-				secretBytes: parsed.secretBytes,
-				hostShare: parsed.hostShare,
-				recoveryShareHash: parsed.recoveryShareHash,
-				secretChecksum: parsed.secretChecksum,
-				devices,
-				walletId: typeof parsed.walletId === "string" ? parsed.walletId.trim() || undefined : undefined,
-				role: normalizeWalletCustodyRole(parsed.role),
-				createdAt: parsed.createdAt,
-				updatedAt: parsed.updatedAt
-			};
-		}
-		return null;
-	} catch {
-		return null;
-	}
-}
-function saveShareState(state, walletId, env = process.env) {
-	const filePath = resolveCustodyShareStatePath(walletId, env);
-	syncFs.mkdirSync(path.dirname(filePath), {
-		recursive: true,
-		mode: 448
-	});
-	syncFs.writeFileSync(filePath, `${JSON.stringify(state, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	try {
-		syncFs.chmodSync(filePath, 384);
-	} catch {}
-}
-function deleteWalletCustodyCeremony(params) {
-	const env = params?.env ?? process.env;
-	const scope = params?.wallet && params?.cfg ? resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	}) : {
-		walletId: params?.walletId?.trim() || "default",
-		role: "vault"
-	};
-	const statePath = locateCustodyShareStatePath(scope.walletId, env);
-	const existed = syncFs.existsSync(statePath);
-	if (existed) {
-		syncFs.rmSync(statePath, { force: true });
-		try {
-			syncFs.rmdirSync(path.dirname(statePath));
-		} catch {}
-	}
-	return {
-		ok: true,
-		walletId: scope.walletId,
-		removed: existed,
-		statePath
-	};
-}
-function encodeCustodyShareStateV3(params) {
-	const secretBytes = params.shareState?.secretBytes && params.shareState.secretBytes > 0 ? params.shareState.secretBytes : params.hostShare.length;
-	return {
-		version: 3,
-		scheme: "shamir-2ofn-v1",
-		secretBytes,
-		hostShare: params.hostShare.toString("base64url"),
-		recoveryShareHash: params.recoveryShareHash,
-		secretChecksum: params.secretChecksum,
-		devices: params.devices.map((device) => ({
-			id: device.id,
-			label: normalizeDeviceLabel(device.label),
-			shareX: device.shareX,
-			shareHash: device.shareHash,
-			createdAt: device.createdAt,
-			revokedAt: device.revokedAt
-		})),
-		walletId: params.walletId,
-		role: params.role,
-		createdAt: params.createdAt,
-		updatedAt: params.updatedAt
-	};
-}
-function initializeWalletCustodyCeremony(params) {
-	const env = params?.env ?? process.env;
-	const scope = params?.wallet && params?.cfg ? resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	}) : {
-		walletId: params?.walletId?.trim() || "default",
-		role: "vault"
-	};
-	const existing = loadShareState(scope.walletId, env);
-	if (existing && !params?.force) {
-		return {
-			ok: false,
-			code: "ceremony_exists",
-			message: "wallet custody ceremony is already initialized",
-			statePath: locateCustodyShareStatePath(scope.walletId, env)
-		};
-	}
-	const secret = randomBytes(CUSTODY_SECRET_BYTES);
-	let hostShare = null;
-	let deviceShare = null;
-	let recoveryShare = null;
-	try {
-		const requested = decodeTypedCustodyShare(params?.deviceShare ?? "");
-		const requestedDeviceShare = requested.bytes;
-		if (requestedDeviceShare && requestedDeviceShare.length !== CUSTODY_SECRET_BYTES) {
-			return {
-				ok: false,
-				code: "invalid_device_share",
-				message: `device share must be ${CUSTODY_SECRET_BYTES} bytes (base64/base64url)`
-			};
-		}
-		if (requestedDeviceShare) {
-			deviceShare = Buffer.from(requestedDeviceShare);
-			const split = splitSecretShamir2of3WithDeviceShare(secret, deviceShare);
-			hostShare = split.hostShare;
-			recoveryShare = split.recoveryShare;
-		} else {
-			const split = splitSecretShamir2of3(secret);
-			hostShare = split.hostShare;
-			deviceShare = split.deviceShare;
-			recoveryShare = split.recoveryShare;
-		}
-		const nowIso = new Date().toISOString();
-		const record = encodeCustodyShareStateV3({
-			shareState: existing,
-			walletId: scope.walletId,
-			role: scope.role,
-			hostShare,
-			recoveryShareHash: sha256Hex(recoveryShare),
-			secretChecksum: sha256Hex(secret),
-			createdAt: existing?.createdAt ?? nowIso,
-			updatedAt: nowIso,
-			devices: [{
-				id: createCustodyDeviceId(),
-				label: normalizeDeviceLabel(params?.deviceLabel) ?? "Primary device",
-				shareX: 2,
-				shareHash: sha256Hex(deviceShare),
-				createdAt: nowIso
-			}]
-		});
-		saveShareState(record, scope.walletId, env);
-		return {
-			ok: true,
-			statePath: resolveCustodyShareStatePath(scope.walletId, env),
-			scheme: record.scheme,
-			walletId: scope.walletId,
-			role: scope.role,
-			deviceShare: encodeTypedCustodyShare("device", deviceShare),
-			recoveryShare: encodeTypedCustodyShare("recovery", recoveryShare),
-			secretBytes: CUSTODY_SECRET_BYTES,
-			updatedAt: record.updatedAt
-		};
-	} finally {
-		zeroizeBuffers([
-			secret,
-			hostShare,
-			deviceShare,
-			recoveryShare
-		]);
-	}
-}
-function recoverWalletCustodyCeremony(params) {
-	const env = params?.env ?? process.env;
-	const scope = params?.wallet && params?.cfg ? resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	}) : {
-		walletId: params?.walletId?.trim() || "default",
-		role: "vault"
-	};
-	const existing = loadShareState(scope.walletId, env);
-	if (!existing) {
-		return {
-			ok: false,
-			code: "custody_ceremony_required",
-			message: "split-key custody ceremony is not initialized",
-			statePath: locateCustodyShareStatePath(scope.walletId, env)
-		};
-	}
-	const reconstructed = reconstructCustodySigningKey({
-		env,
-		recoveryShare: params?.recoveryShare,
-		walletId: scope.walletId
-	});
-	if (!reconstructed.ok) {
-		return reconstructed;
-	}
-	let deviceShare = null;
-	let hostShare = null;
-	let recoveryShare = null;
-	try {
-		const requested = decodeTypedCustodyShare(params?.deviceShare ?? "");
-		const requestedDeviceShare = requested.bytes;
-		if (requestedDeviceShare && requestedDeviceShare.length !== CUSTODY_SECRET_BYTES) {
-			return {
-				ok: false,
-				code: "invalid_device_share",
-				message: `device share must be ${CUSTODY_SECRET_BYTES} bytes (base64/base64url)`
-			};
-		}
-		if (requestedDeviceShare) {
-			deviceShare = Buffer.from(requestedDeviceShare);
-			const split = splitSecretShamir2of3WithDeviceShare(reconstructed.signingKey, deviceShare);
-			hostShare = split.hostShare;
-			recoveryShare = split.recoveryShare;
-		} else {
-			const split = splitSecretShamir2of3(reconstructed.signingKey);
-			hostShare = split.hostShare;
-			deviceShare = split.deviceShare;
-			recoveryShare = split.recoveryShare;
-		}
-		const updatedAt = new Date().toISOString();
-		const record = encodeCustodyShareStateV3({
-			shareState: existing,
-			walletId: scope.walletId,
-			role: scope.role,
-			hostShare,
-			recoveryShareHash: sha256Hex(recoveryShare),
-			secretChecksum: sha256Hex(reconstructed.signingKey),
-			createdAt: existing.createdAt,
-			updatedAt,
-			devices: [{
-				id: createCustodyDeviceId(),
-				label: normalizeDeviceLabel(params?.deviceLabel) ?? "Recovered device",
-				shareX: 2,
-				shareHash: sha256Hex(deviceShare),
-				createdAt: updatedAt
-			}]
-		});
-		saveShareState(record, scope.walletId, env);
-		return {
-			ok: true,
-			statePath: resolveCustodyShareStatePath(scope.walletId, env),
-			scheme: record.scheme,
-			walletId: scope.walletId,
-			role: scope.role,
-			deviceShare: encodeTypedCustodyShare("device", deviceShare),
-			recoveryShare: encodeTypedCustodyShare("recovery", recoveryShare),
-			secretBytes: CUSTODY_SECRET_BYTES,
-			updatedAt
-		};
-	} finally {
-		zeroizeBuffers([
-			reconstructed.signingKey,
-			deviceShare,
-			hostShare,
-			recoveryShare
-		]);
-	}
-}
-function enrollWalletCustodyDevice(params) {
-	const env = params?.env ?? process.env;
-	const scope = resolveWalletCustodyScope({
-		wallet: params?.wallet,
-		cfg: params?.cfg,
-		env,
-		walletId: params?.walletId
-	});
-	const shareState = loadShareState(scope.walletId, env);
-	if (!shareState) {
-		return {
-			ok: false,
-			code: "custody_ceremony_required",
-			message: "split-key custody ceremony is not initialized"
-		};
-	}
-	if (shareState.scheme === "xor-3of3-v1") {
-		return {
-			ok: false,
-			code: "custody_scheme_unsupported",
-			message: "legacy custody scheme does not support second-device enrollment; recover the wallet first"
-		};
-	}
-	const reconstructed = reconstructCustodySigningKey({
-		env,
-		walletId: scope.walletId,
-		deviceShare: params?.deviceShare,
-		recoveryShare: params?.recoveryShare
-	});
-	if (!reconstructed.ok) {
-		return reconstructed;
-	}
-	let hostShare = null;
-	let slope = null;
-	let newDeviceShare = null;
-	try {
-		hostShare = decodeBase64Share(shareState.hostShare);
-		if (!hostShare || hostShare.length !== CUSTODY_SECRET_BYTES) {
-			return {
-				ok: false,
-				code: "custody_shares_invalid",
-				message: "stored split-key share payload is invalid"
-			};
-		}
-		const activeDevices = listActiveEnrolledDevices(shareState);
-		const shareX = allocateNextDeviceShareX(activeDevices);
-		slope = Buffer.alloc(reconstructed.signingKey.length, 0);
-		for (let i = 0; i < reconstructed.signingKey.length; i += 1) {
-			slope[i] = (reconstructed.signingKey[i] ?? 0) ^ (hostShare[i] ?? 0);
-		}
-		newDeviceShare = deriveSecretShamirShare(reconstructed.signingKey, slope, shareX);
-		const updatedAt = new Date().toISOString();
-		const newDevice = {
-			id: createCustodyDeviceId(),
-			label: normalizeDeviceLabel(params?.label) ?? `Device ${activeDevices.length + 1}`,
-			shareX,
-			shareHash: sha256Hex(newDeviceShare),
-			createdAt: updatedAt
-		};
-		const record = encodeCustodyShareStateV3({
-			shareState,
-			walletId: scope.walletId,
-			role: scope.role,
-			hostShare,
-			recoveryShareHash: shareState.recoveryShareHash,
-			secretChecksum: shareState.secretChecksum,
-			createdAt: shareState.createdAt,
-			updatedAt,
-			devices: [...activeDevices, newDevice]
-		});
-		saveShareState(record, scope.walletId, env);
-		return {
-			ok: true,
-			walletId: scope.walletId,
-			role: scope.role,
-			deviceId: newDevice.id,
-			label: newDevice.label,
-			deviceShare: encodeTypedCustodyShare("device", newDeviceShare),
-			statePath: resolveCustodyShareStatePath(scope.walletId, env),
-			updatedAt
-		};
-	} finally {
-		zeroizeBuffers([
-			reconstructed.signingKey,
-			hostShare,
-			slope,
-			newDeviceShare
-		]);
-	}
-}
-function revokeWalletCustodyDevice(params) {
-	const env = params?.env ?? process.env;
-	const scope = resolveWalletCustodyScope({
-		wallet: params?.wallet,
-		cfg: params?.cfg,
-		env,
-		walletId: params?.walletId
-	});
-	const shareState = loadShareState(scope.walletId, env);
-	if (!shareState) {
-		return {
-			ok: false,
-			code: "custody_ceremony_required",
-			message: "split-key custody ceremony is not initialized"
-		};
-	}
-	if (shareState.scheme === "xor-3of3-v1") {
-		return {
-			ok: false,
-			code: "custody_scheme_unsupported",
-			message: "legacy custody scheme does not support per-device revocation; recover the wallet first"
-		};
-	}
-	const targetDeviceId = String(params?.deviceId ?? "").trim();
-	if (!targetDeviceId) {
-		return {
-			ok: false,
-			code: "custody_device_id_required",
-			message: "device id is required"
-		};
-	}
-	const reconstructed = reconstructCustodySigningKey({
-		env,
-		walletId: scope.walletId,
-		deviceShare: params?.deviceShare,
-		recoveryShare: params?.recoveryShare
-	});
-	if (!reconstructed.ok) {
-		return reconstructed;
-	}
-	let hostShare = null;
-	try {
-		hostShare = decodeBase64Share(shareState.hostShare);
-		if (!hostShare || hostShare.length !== CUSTODY_SECRET_BYTES) {
-			return {
-				ok: false,
-				code: "custody_shares_invalid",
-				message: "stored split-key share payload is invalid"
-			};
-		}
-		const activeDevices = listActiveEnrolledDevices(shareState);
-		const target = activeDevices.find((device) => device.id === targetDeviceId) ?? null;
-		if (!target) {
-			return {
-				ok: false,
-				code: "custody_device_not_found",
-				message: "device is not enrolled for this wallet"
-			};
-		}
-		if (activeDevices.length <= 1) {
-			return {
-				ok: false,
-				code: "custody_last_device_forbidden",
-				message: "cannot revoke the last enrolled device; recover the wallet instead"
-			};
-		}
-		const updatedAt = new Date().toISOString();
-		const record = encodeCustodyShareStateV3({
-			shareState,
-			walletId: scope.walletId,
-			role: scope.role,
-			hostShare,
-			recoveryShareHash: shareState.recoveryShareHash,
-			secretChecksum: shareState.secretChecksum,
-			createdAt: shareState.createdAt,
-			updatedAt,
-			devices: activeDevices.filter((device) => device.id !== targetDeviceId)
-		});
-		saveShareState(record, scope.walletId, env);
-		return {
-			ok: true,
-			walletId: scope.walletId,
-			role: scope.role,
-			removedDeviceId: target.id,
-			removedDeviceLabel: target.label,
-			updatedAt
-		};
-	} finally {
-		zeroizeBuffers([reconstructed.signingKey, hostShare]);
-	}
-}
-function loadState(walletId, env = process.env) {
-	const filePath = locateCustodyStatePath(walletId, env);
-	if (!syncFs.existsSync(filePath)) {
-		return {
-			version: 1,
-			unlockSessions: []
-		};
-	}
-	try {
-		const parsed = JSON.parse(syncFs.readFileSync(filePath, "utf8"));
-		if (parsed.version !== 1 || !Array.isArray(parsed.unlockSessions)) {
-			return {
-				version: 1,
-				unlockSessions: []
-			};
-		}
-		return {
-			version: 1,
-			unlockSessions: parsed.unlockSessions.map((entry) => {
-				if (!entry || typeof entry !== "object") {
-					return null;
-				}
-				const value = entry;
-				if (typeof value.id !== "string" || typeof value.host !== "string" || typeof value.walletId !== "string" || typeof value.createdAt !== "string" || typeof value.expiresAt !== "string") {
-					return null;
-				}
-				const chains = normalizeChainList(Array.isArray(value.chains) ? (value.chains ?? []).map((entry) => String(entry)) : []);
-				const allowPrograms = normalizeAddressList(Array.isArray(value.allowPrograms) ? (value.allowPrograms ?? []).map((entry) => String(entry)) : []);
-				return {
-					id: value.id,
-					host: normalizeHost(value.host),
-					walletId: value.walletId.trim() || "default",
-					role: normalizeWalletCustodyRole(value.role) ?? "vault",
-					chains,
-					allowPrograms,
-					solanaMaxPerTx: typeof value.solanaMaxPerTx === "string" ? value.solanaMaxPerTx : "0",
-					solanaMaxDaily: typeof value.solanaMaxDaily === "string" ? value.solanaMaxDaily : "0",
-					createdAt: value.createdAt,
-					expiresAt: value.expiresAt,
-					lastUsedAt: typeof value.lastUsedAt === "string" ? value.lastUsedAt : undefined
-				};
-			}).filter(isNonNull)
-		};
-	} catch {
-		return {
-			version: 1,
-			unlockSessions: []
-		};
-	}
-}
-function saveState(state, walletId, env = process.env) {
-	const filePath = resolveCustodyStatePath(walletId, env);
-	syncFs.mkdirSync(path.dirname(filePath), {
-		recursive: true,
-		mode: 448
-	});
-	syncFs.writeFileSync(filePath, `${JSON.stringify(state, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	try {
-		syncFs.chmodSync(filePath, 384);
-	} catch {}
-}
-function pruneState(state) {
-	const now = nowMs();
-	const active = [];
-	let changed = false;
-	for (const entry of state.unlockSessions) {
-		const expiresAt = Date.parse(entry.expiresAt);
-		if (Number.isFinite(expiresAt) && expiresAt > now) {
-			active.push(entry);
-			continue;
-		}
-		removeUnlockMaterial(entry.id);
-		changed = true;
-	}
-	if (changed) {
-		state.unlockSessions = active;
-	}
-	return changed;
-}
-function getActiveUnlockSession(params) {
-	const env = params.env ?? process.env;
-	const host = normalizeHost(params.host);
-	if (!host) {
-		return null;
-	}
-	const state = loadState(params.walletId, env);
-	const changed = pruneState(state);
-	const active = state.unlockSessions.find((entry) => entry.host === host && entry.walletId === params.walletId) ?? null;
-	if (changed) {
-		saveState(state, params.walletId, env);
-	}
-	return active;
-}
-function touchUnlockSession(params) {
-	const env = params.env ?? process.env;
-	const state = loadState(params.walletId, env);
-	const changed = pruneState(state);
-	const session = state.unlockSessions.find((entry) => entry.id === params.sessionId) ?? null;
-	if (!session) {
-		if (changed) {
-			saveState(state, params.walletId, env);
-		}
-		removeUnlockMaterial(params.sessionId);
-		return null;
-	}
-	session.lastUsedAt = new Date().toISOString();
-	saveState(state, params.walletId, env);
-	return session;
-}
-function openUnlockSession(params) {
-	const env = params.env ?? process.env;
-	const state = loadState(params.scope.walletId, env);
-	pruneState(state);
-	const createdAt = new Date().toISOString();
-	const expiresAt = resolveUnlockExpiresAt(env, params.ttlSeconds);
-	const session = {
-		id: randomBytes(12).toString("hex"),
-		host: normalizeHost(params.host),
-		walletId: params.scope.walletId,
-		role: params.scope.role,
-		chains: params.scope.chains,
-		allowPrograms: params.scope.allowPrograms,
-		solanaMaxPerTx: params.scope.solana.maxPerTx,
-		solanaMaxDaily: params.scope.solana.maxDaily,
-		createdAt,
-		expiresAt,
-		lastUsedAt: createdAt
-	};
-	for (const existing of state.unlockSessions) {
-		if (existing.walletId === session.walletId) {
-			removeUnlockMaterial(existing.id);
-		}
-	}
-	state.unlockSessions = state.unlockSessions.filter((entry) => entry.walletId !== session.walletId);
-	state.unlockSessions.push(session);
-	saveState(state, params.scope.walletId, env);
-	return session;
-}
-function clearLocalUnlockSessions(params) {
-	const env = params?.env ?? process.env;
-	const requestedHost = params?.host?.trim() ? normalizeHost(params.host) : "";
-	const requestedWalletId = params?.walletId?.trim() || "";
-	if (params?.host?.trim() && !requestedHost) {
-		return {
-			ok: false,
-			code: "invalid_host",
-			message: "host is invalid for custody lock"
-		};
-	}
-	let removed = 0;
-	let remaining = 0;
-	const targets = requestedWalletId ? [requestedWalletId] : listCustodyStateTargets(env);
-	for (const target of targets) {
-		const state = loadState(target, env);
-		const changedByPrune = pruneState(state);
-		const before = state.unlockSessions.length;
-		if (!requestedHost && !requestedWalletId) {
-			for (const session of state.unlockSessions) {
-				removeUnlockMaterial(session.id);
-			}
-			state.unlockSessions = [];
-		} else {
-			state.unlockSessions = state.unlockSessions.filter((session) => {
-				if (requestedHost && session.host !== requestedHost) {
-					return true;
-				}
-				if (requestedWalletId && session.walletId !== requestedWalletId) {
-					return true;
-				}
-				removeUnlockMaterial(session.id);
-				return false;
-			});
-		}
-		removed += before - state.unlockSessions.length;
-		remaining += state.unlockSessions.length;
-		if (changedByPrune || before !== state.unlockSessions.length) {
-			saveState(state, target, env);
-		}
-	}
-	return {
-		ok: true,
-		host: requestedHost || undefined,
-		walletId: requestedWalletId || undefined,
-		removed,
-		remaining
-	};
-}
-function recoverWalletCustodyPassphrase(params) {
-	const reconstructed = reconstructCustodySigningKey({
-		env: params?.env ?? process.env,
-		deviceShare: params?.deviceShare,
-		recoveryShare: params?.recoveryShare,
-		walletId: params?.walletId
-	});
-	if (!reconstructed.ok) {
-		return reconstructed;
-	}
-	try {
-		return {
-			ok: true,
-			passphrase: Buffer.from(reconstructed.signingKey).toString("base64url")
-		};
-	} finally {
-		zeroizeBuffers([reconstructed.signingKey]);
-	}
-}
-async function lockWalletCustodyUnlockSessions(params) {
-	const env = params?.env ?? process.env;
-	const localResult = clearLocalUnlockSessions({
-		host: params?.host,
-		walletId: params?.walletId,
-		env
-	});
-	if (!localResult.ok) {
-		return localResult;
-	}
-	const splitKeyActive = String(env.FASED_WALLET_CUSTODY_MODE ?? "").trim().toLowerCase() === "split-key" && readBooleanFlag(env, "FASED_WALLET_CUSTODY_PASSKEY_CEREMONY") && readBooleanFlag(env, "FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION") && readBooleanFlag(env, "FASED_WALLET_CUSTODY_PHASE2_COMPLETE");
-	if (!splitKeyActive) {
-		return localResult;
-	}
-	try {
-		await lockLocalSignerCustody({
-			host: localResult.host,
-			walletId: localResult.walletId,
-			env
-		});
-		return localResult;
-	} catch (err) {
-		return {
-			ok: false,
-			code: "custody_signer_lock_failed",
-			message: walletDiagnosticErrorMessage(err),
-			host: localResult.host,
-			walletId: localResult.walletId,
-			removed: localResult.removed,
-			remaining: localResult.remaining
-		};
-	}
-}
-function reconstructCustodySigningKey(params) {
-	const env = params.env ?? process.env;
-	const shareState = loadShareState(params.walletId, env);
-	if (!shareState) {
-		return {
-			ok: false,
-			code: "custody_ceremony_required",
-			message: "split-key custody ceremony is not initialized"
-		};
-	}
-	let hot = null;
-	let cold = null;
-	let host = null;
-	let providedShare = null;
-	let secret = null;
-	try {
-		if (shareState.scheme === "xor-3of3-v1") {
-			hot = decodeBase64Share(shareState.hotShare);
-			cold = decodeBase64Share(shareState.coldShare);
-			providedShare = decodeTypedCustodyShare(params.deviceShare?.trim() || String(env.FASED_WALLET_CUSTODY_DEVICE_SHARE ?? "").trim()).bytes;
-			if (!hot || !cold || hot.length !== shareState.secretBytes || cold.length !== shareState.secretBytes) {
-				return {
-					ok: false,
-					code: "custody_shares_invalid",
-					message: "stored split-key share payload is invalid"
-				};
-			}
-			if (!providedShare || providedShare.length !== shareState.secretBytes) {
-				return {
-					ok: false,
-					code: "custody_device_share_required",
-					message: "device share is required to unlock split-key custody"
-				};
-			}
-			const deviceHash = sha256Hex(providedShare);
-			if (!buffersEqualHex(deviceHash, shareState.deviceShareHash)) {
-				return {
-					ok: false,
-					code: "custody_device_share_mismatch",
-					message: "device share does not match split-key ceremony state"
-				};
-			}
-			secret = xorBuffers([
-				hot,
-				cold,
-				providedShare
-			]);
-		} else {
-			host = decodeBase64Share(shareState.hostShare);
-			const provided = decodeTypedCustodyShare(params.deviceShare?.trim() || params.recoveryShare?.trim() || String(env.FASED_WALLET_CUSTODY_DEVICE_SHARE ?? "").trim());
-			providedShare = provided.bytes;
-			if (!host || host.length !== shareState.secretBytes) {
-				return {
-					ok: false,
-					code: "custody_shares_invalid",
-					message: "stored split-key share payload is invalid"
-				};
-			}
-			if (!providedShare || providedShare.length !== shareState.secretBytes) {
-				return {
-					ok: false,
-					code: "custody_device_share_required",
-					message: "device share or recovery share is required to unlock split-key custody"
-				};
-			}
-			const providedHash = sha256Hex(providedShare);
-			const activeDevices = listActiveEnrolledDevices(shareState);
-			const matchingDevice = shareState.version === 3 ? activeDevices.find((device) => buffersEqualHex(providedHash, device.shareHash)) ?? null : buffersEqualHex(providedHash, shareState.deviceShareHash) ? activeDevices[0] ?? null : null;
-			const matchesRecoveryShare = buffersEqualHex(providedHash, shareState.recoveryShareHash);
-			const shareType = matchesRecoveryShare ? "recovery" : matchingDevice ? "device" : null;
-			if (!shareType) {
-				return {
-					ok: false,
-					code: "custody_device_share_mismatch",
-					message: "provided custody share does not match device or recovery share state"
-				};
-			}
-			if (provided.type !== "unknown" && provided.type !== shareType) {
-				return {
-					ok: false,
-					code: "custody_device_share_mismatch",
-					message: "provided custody share type does not match stored ceremony state"
-				};
-			}
-			secret = reconstructSecretShamir2ofN({
-				hostShare: host,
-				otherShare: providedShare,
-				otherX: shareType === "recovery" ? 3 : matchingDevice?.shareX ?? 2
-			});
-		}
-		if (!buffersEqualHex(sha256Hex(secret), shareState.secretChecksum)) {
-			return {
-				ok: false,
-				code: "custody_share_integrity_failed",
-				message: "split-key reconstruction failed integrity check"
-			};
-		}
-		return {
-			ok: true,
-			signingKey: Buffer.from(secret)
-		};
-	} finally {
-		zeroizeBuffers([
-			hot,
-			cold,
-			host,
-			providedShare,
-			secret
-		]);
-	}
-}
-async function activateWalletCustodyUnlockSession(params) {
-	const env = params.env ?? process.env;
-	const host = normalizeHost(params.host);
-	if (!host) {
-		return {
-			ok: false,
-			code: "invalid_host",
-			message: "host is required for custody unlock"
-		};
-	}
-	const consumed = consumeWalletApprovalGrant({
-		host,
-		operation: "wallet.custody-unlock",
-		token: params.approvalToken,
-		env,
-		cfg: params.cfg
-	});
-	if (!consumed.ok) {
-		return consumed;
-	}
-	const scope = params.wallet && params.cfg ? resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	}) : {
-		walletId: params.walletId?.trim() || "default",
-		role: "vault",
-		chains: ["solana"],
-		allowPrograms: [],
-		solana: {
-			maxPerTx: "0",
-			maxDaily: "0"
-		}
-	};
-	const status = params.wallet ? readWalletCustodyStatus({
-		wallet: params.wallet,
-		env,
-		cfg: params.cfg,
-		walletId: scope.walletId
-	}) : null;
-	let custodyPassphrase = "";
-	if (status?.mode === "split-key-active") {
-		const reconstructed = recoverWalletCustodyPassphrase({
-			env,
-			deviceShare: params.deviceShare,
-			walletId: scope.walletId
-		});
-		if (!reconstructed.ok) {
-			return reconstructed;
-		}
-		custodyPassphrase = reconstructed.passphrase;
-	}
-	const session = openUnlockSession({
-		host,
-		env,
-		scope,
-		ttlSeconds: params.ttlSeconds
-	});
-	if (custodyPassphrase) {
-		try {
-			await unlockLocalSignerCustody({
-				sessionId: session.id,
-				host: session.host,
-				walletId: session.walletId,
-				role: session.role,
-				chains: session.chains,
-				allowPrograms: session.allowPrograms,
-				expiresAt: session.expiresAt,
-				passphrase: custodyPassphrase,
-				solanaMaxPerTx: session.solanaMaxPerTx,
-				solanaMaxDaily: session.solanaMaxDaily,
-				env
-			});
-		} catch (err) {
-			clearLocalUnlockSessions({
-				host: session.host,
-				walletId: session.walletId,
-				env
-			});
-			return {
-				ok: false,
-				code: "custody_signer_unlock_failed",
-				message: walletDiagnosticErrorMessage(err)
-			};
-		}
-	}
-	setUnlockMaterial({
-		sessionId: session.id,
-		host: session.host,
-		expiresAt: session.expiresAt
-	});
-	return {
-		ok: true,
-		session
-	};
-}
-async function refreshWalletCustodyUnlockSession(params) {
-	const env = params.env ?? process.env;
-	const host = normalizeHost(params.host);
-	if (!host) {
-		return {
-			ok: false,
-			code: "invalid_host",
-			message: "host is required for custody refresh"
-		};
-	}
-	const scope = params.wallet && params.cfg ? resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	}) : {
-		walletId: params.walletId?.trim() || "default",
-		role: "vault",
-		chains: ["solana"],
-		allowPrograms: [],
-		solana: {
-			maxPerTx: "0",
-			maxDaily: "0"
-		}
-	};
-	const active = getActiveUnlockSession({
-		host,
-		walletId: scope.walletId,
-		env
-	});
-	if (!active) {
-		return {
-			ok: false,
-			code: "custody_unlock_required",
-			message: `split-key custody for wallet ${scope.walletId} is locked`
-		};
-	}
-	const status = params.wallet ? readWalletCustodyStatus({
-		wallet: params.wallet,
-		env,
-		cfg: params.cfg,
-		walletId: scope.walletId
-	}) : null;
-	let custodyPassphrase = "";
-	if (status?.mode === "split-key-active") {
-		const reconstructed = recoverWalletCustodyPassphrase({
-			env,
-			deviceShare: params.deviceShare,
-			walletId: scope.walletId
-		});
-		if (!reconstructed.ok) {
-			return reconstructed;
-		}
-		custodyPassphrase = reconstructed.passphrase;
-	}
-	const session = openUnlockSession({
-		host,
-		env,
-		scope,
-		ttlSeconds: params.ttlSeconds
-	});
-	if (custodyPassphrase) {
-		try {
-			await unlockLocalSignerCustody({
-				sessionId: session.id,
-				host: session.host,
-				walletId: session.walletId,
-				role: session.role,
-				chains: session.chains,
-				allowPrograms: session.allowPrograms,
-				expiresAt: session.expiresAt,
-				passphrase: custodyPassphrase,
-				solanaMaxPerTx: session.solanaMaxPerTx,
-				solanaMaxDaily: session.solanaMaxDaily,
-				env
-			});
-		} catch (err) {
-			clearLocalUnlockSessions({
-				host: session.host,
-				walletId: session.walletId,
-				env
-			});
-			return {
-				ok: false,
-				code: "custody_signer_unlock_failed",
-				message: walletDiagnosticErrorMessage(err)
-			};
-		}
-	}
-	setUnlockMaterial({
-		sessionId: session.id,
-		host: session.host,
-		expiresAt: session.expiresAt
-	});
-	return {
-		ok: true,
-		session
-	};
-}
-async function enforceWalletCustodyForAutonomousSend(params) {
-	const env = params.env ?? process.env;
-	const scope = resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	});
-	const status = readWalletCustodyStatus({
-		wallet: params.wallet,
-		env,
-		cfg: params.cfg,
-		walletId: scope.walletId
-	});
-	if (status.mode === "single-key") {
-		return {
-			ok: true,
-			custodyMode: status.mode
-		};
-	}
-	if (status.mode !== "split-key-active") {
-		return {
-			ok: false,
-			code: "custody_phase2_incomplete",
-			message: "split-key custody is configured but phase-2 controls are incomplete; autonomous signing is blocked"
-		};
-	}
-	const runtimeGuard = enforceSplitKeyRuntimeGuard({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env
-	});
-	if (!runtimeGuard.ok) {
-		return runtimeGuard;
-	}
-	if (resolveWalletApprovalAuthMode(env, params.cfg) !== "webauthn") {
-		return {
-			ok: false,
-			code: "custody_webauthn_required",
-			message: "split-key custody requires wallet approval auth mode=webauthn"
-		};
-	}
-	const host = normalizeHost(params.approvalHost?.trim() || "127.0.0.1");
-	const active = getActiveUnlockSession({
-		host,
-		walletId: scope.walletId,
-		env
-	});
-	if (active) {
-		touchUnlockSession({
-			sessionId: active.id,
-			walletId: scope.walletId,
-			env
-		});
-		if (!hasActiveUnlockMaterial({
-			sessionId: active.id,
-			host
-		})) {
-			return {
-				ok: false,
-				code: "custody_unlock_required",
-				message: "split-key unlock session exists without ephemeral signing material; unlock custody again"
-			};
-		}
-		return {
-			ok: true,
-			custodyMode: status.mode,
-			session: active
-		};
-	}
-	const token = params.approvalToken?.trim() ?? "";
-	if (!token) {
-		return {
-			ok: false,
-			code: "custody_unlock_required",
-			message: "split-key custody requires an active unlock session; provide a passkey approval token for operation wallet.custody-unlock"
-		};
-	}
-	const activated = await activateWalletCustodyUnlockSession({
-		host,
-		approvalToken: token,
-		env,
-		cfg: params.cfg,
-		wallet: params.wallet,
-		walletId: scope.walletId,
-		deviceShare: params.deviceShare
-	});
-	if (!activated.ok) {
-		return activated;
-	}
-	return {
-		ok: true,
-		custodyMode: status.mode,
-		session: activated.session
-	};
-}
-function enforceSplitKeyRuntimeGuard(params) {
-	const env = params.env ?? process.env;
-	if (!params.cfg) {
-		return {
-			ok: false,
-			code: "custody_config_required",
-			message: "split-key custody requires runtime config to verify signer backend"
-		};
-	}
-	const providerId = resolveWalletProviderId(params.cfg, env);
-	if (providerId !== "local-socket-signer") {
-		return {
-			ok: false,
-			code: "custody_provider_unsupported",
-			message: "split-key custody requires local-socket-signer"
-		};
-	}
-	if (!params.wallet.enabled) {
-		return {
-			ok: false,
-			code: "custody_stack_unconfigured",
-			message: "split-key custody requires wallet runtime to be enabled"
-		};
-	}
-	return { ok: true };
-}
-function readWalletCustodyStatus(params) {
-	const env = params.env ?? process.env;
-	const scope = resolveWalletCustodyScope({
-		wallet: params.wallet,
-		cfg: params.cfg,
-		env,
-		walletId: params.walletId
-	});
-	const requestedSplitKey = String(env.FASED_WALLET_CUSTODY_MODE ?? "").trim().toLowerCase() === "split-key";
-	const passkeyCeremonyEnabled = readBooleanFlag(env, "FASED_WALLET_CUSTODY_PASSKEY_CEREMONY");
-	const ephemeralReconstructionEnabled = readBooleanFlag(env, "FASED_WALLET_CUSTODY_EPHEMERAL_RECONSTRUCTION");
-	const phase2CompleteFlag = readBooleanFlag(env, "FASED_WALLET_CUSTODY_PHASE2_COMPLETE");
-	const shareState = loadShareState(scope.walletId, env);
-	const ceremonyInitialized = Boolean(shareState);
-	const custodyWallets = readCustodyWalletSet(env);
-	const roleAllowsSplitKey = scope.role === "vault";
-	const splitKeyEnabled = requestedSplitKey && roleAllowsSplitKey && (custodyWallets.size === 0 ? ceremonyInitialized : custodyWallets.has(normalizeWalletIdForCustodyEnv(scope.walletId)));
-	const splitKeyActive = splitKeyEnabled && phase2CompleteFlag && passkeyCeremonyEnabled && ephemeralReconstructionEnabled && ceremonyInitialized;
-	const complete = splitKeyActive;
-	const activeUnlock = getActiveUnlockSession({
-		host: String(params.approvalHost ?? env.FASED_WALLET_CUSTODY_ACTIVE_HOST ?? env.FASED_A2A_ORIGIN ?? "127.0.0.1"),
-		walletId: scope.walletId,
-		env
-	});
-	const notes = [];
-	if (splitKeyEnabled && !splitKeyActive) {
-		notes.push("split-key custody is configured but full runtime prerequisites are not complete.");
-	}
-	if (!splitKeyEnabled) {
-		notes.push("single-key custody active (phase-2 split-key disabled).");
-	}
-	if (splitKeyEnabled && !passkeyCeremonyEnabled) {
-		notes.push("split-key mode enabled without passkey ceremony flag.");
-	}
-	if (splitKeyEnabled && !ephemeralReconstructionEnabled) {
-		notes.push("split-key mode enabled without ephemeral reconstruction flag.");
-	}
-	if (splitKeyEnabled && !phase2CompleteFlag) {
-		notes.push("split-key mode enabled without phase-2 completion flag.");
-	}
-	if (splitKeyEnabled && !ceremonyInitialized) {
-		notes.push(`split-key ceremony is not initialized for wallet ${scope.walletId}; run \`fased wallet custody-init --wallet ${scope.walletId}\` to generate host/device/recovery shares.`);
-	}
-	if (splitKeyActive && activeUnlock) {
-		notes.push(`split-key custody unlock session is active for wallet ${scope.walletId}.`);
-		if (!hasActiveUnlockMaterial({
-			sessionId: activeUnlock.id,
-			host: activeUnlock.host
-		})) {
-			notes.push("unlock session exists but ephemeral signing material is missing; unlock again.");
-		}
-	}
-	return {
-		mode: splitKeyActive ? "split-key-active" : splitKeyEnabled ? "split-key-scaffold" : "single-key",
-		target: {
-			walletId: scope.walletId,
-			role: scope.role
-		},
-		scope: {
-			chains: scope.chains,
-			allowPrograms: scope.allowPrograms,
-			solana: scope.solana
-		},
-		unlock: {
-			active: Boolean(activeUnlock),
-			sessionId: activeUnlock?.id,
-			host: activeUnlock?.host,
-			expiresAt: activeUnlock?.expiresAt
-		},
-		phase2: {
-			complete,
-			splitKeyEnabled,
-			passkeyCeremonyEnabled,
-			ephemeralReconstructionEnabled,
-			notes
-		},
-		ceremony: {
-			initialized: ceremonyInitialized,
-			scheme: shareState?.scheme,
-			secretBytes: shareState?.secretBytes,
-			devices: listActiveEnrolledDevices(shareState).map((device) => ({
-				id: device.id,
-				label: device.label,
-				createdAt: device.createdAt,
-				revokedAt: device.revokedAt
-			})),
-			updatedAt: shareState?.updatedAt,
-			path: locateCustodyShareStatePath(scope.walletId, env)
-		}
-	};
-}
-function listSplitKeyWalletCustodyStatuses(params) {
-	const env = params.env ?? process.env;
-	const walletIds = new Set();
-	const registry = readWalletProviderRegistry(env);
-	const registryWalletIds = new Set(registry.wallets.map((wallet) => wallet.id.trim()).filter(Boolean));
-	const normalizedRegistryWalletIds = new Set([...registryWalletIds].map((walletId) => normalizeWalletIdForCustodyEnv(walletId)));
-	const hasNamedWalletRegistry = registry.wallets.length > 0;
-	const configuredMiningWalletId = typeof params.cfg?.plugins?.entries?.["sat-mining"]?.config?.walletId === "string" ? params.cfg.plugins.entries["sat-mining"]?.config?.walletId.trim() : "";
-	const custodyWallets = readCustodyWalletSet(env);
-	for (const wallet of registry.wallets) {
-		if (wallet.id.trim()) {
-			walletIds.add(wallet.id.trim());
-		}
-	}
-	if (registry.defaultWalletId?.trim()) {
-		walletIds.add(registry.defaultWalletId.trim());
-	}
-	for (const raw of String(env.FASED_WALLET_CUSTODY_WALLETS ?? "").split(",")) {
-		if (raw.trim()) {
-			walletIds.add(raw.trim());
-		}
-	}
-	for (const target of listCustodyStateTargets(env)) {
-		walletIds.add(target);
-	}
-	if (walletIds.size === 0) {
-		walletIds.add(undefined);
-	}
-	const seen = new Set();
-	const out = [];
-	for (const walletId of walletIds) {
-		const walletIdValue = walletId?.trim() ?? "";
-		const normalizedTarget = normalizeWalletIdForCustodyEnv(walletId);
-		const shareState = loadShareState(walletId, env);
-		const isCurrentWallet = walletId === undefined || registryWalletIds.has(walletIdValue) || normalizedRegistryWalletIds.has(normalizedTarget) || registry.defaultWalletId?.trim() === walletIdValue || configuredMiningWalletId === walletIdValue || normalizeWalletIdForCustodyEnv(configuredMiningWalletId) === normalizedTarget || normalizedTarget === "default" || normalizedTarget === "vault" || !hasNamedWalletRegistry && (custodyWallets.has(normalizedTarget) || shareState?.role !== undefined);
-		if (!isCurrentWallet) {
-			continue;
-		}
-		const status = readWalletCustodyStatus({
-			wallet: params.wallet,
-			cfg: params.cfg,
-			env,
-			walletId
-		});
-		if (status.mode === "single-key") {
-			continue;
-		}
-		const key = normalizeWalletIdForState(status.target.walletId);
-		if (seen.has(key)) {
-			continue;
-		}
-		seen.add(key);
-		out.push(status);
-	}
-	return out;
-}
-
-//#endregion
-export { activateWalletCustodyUnlockSession, deleteWalletCustodyCeremony, enforceWalletCustodyForAutonomousSend, enrollWalletCustodyDevice, initializeWalletCustodyCeremony, listSplitKeyWalletCustodyStatuses, lockWalletCustodyUnlockSessions, readWalletCustodyStatus, recoverWalletCustodyCeremony, recoverWalletCustodyPassphrase, refreshWalletCustodyUnlockSession, revokeWalletCustodyDevice, withWalletCustodySigningMaterial };