@fased/fased 0.1.67 → 0.1.69

package/dist/plugin-sdk/{config-schema--vl89M7d.js → config-schema-BiBOUW89.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { $ as mergeSessionEntry, A as deliveryContextKey, An as GATEWAY_CLIENT_IDS, B as INPUT_PROVENANCE_KIND_VALUES, Bn as CLI_DEFAULT_OPERATOR_SCOPES, C as recordSessionMetaFromInbound, Cn as isGatewayMessageChannel, D as isCacheEnabled, Dn as normalizeMessageChannel, Dt as getChannelDock, E as updateSessionStoreEntry, En as listDeliverableMessageChannels, F as archiveSessionTranscripts, Fn as normalizeAnyChannelId, Ft as trimMessagingTarget, G as resolveSessionLockMaxHoldFromTimeout, Gn as getPluginCommandSpecs, H as hasInterSessionUserProvenance, Hn as resolveLeastPrivilegeOperatorScopesForMethod, I as capArrayByJsonBytes, In as normalizeChannelId$2, It as isWhatsAppGroupJid, J as resolveChannelResetConfig, Jn as createInternalHookEvent, K as resolveSessionKey$1, Kn as listPluginCommands, L as countToolResults, Ln as logMutatingAdminRpcAudit, Lt as normalizeWhatsAppTarget, M as normalizeDeliveryContext, Mn as GATEWAY_CLIENT_NAMES, N as normalizeSessionDeliveryFields, Nn as getChatChannelMeta, O as resolveCacheTtlMs$1, On as resolveGatewayMessageChannel, Ot as listChannelDocks, P as normalizeAccountId$1, Pn as listChatChannels, Pt as looksLikeHandleOrPhoneTarget, Q as DEFAULT_RESET_TRIGGERS, R as extractToolCallNames, Rn as consumeMutatingAdminRpcBudget, S as readSessionUpdatedAt, Sn as isDeliverableMessageChannel, T as updateSessionStore, Tn as isMarkdownCapableMessageChannel, U as normalizeInputProvenance, Un as clearPluginCommands, V as applyInputProvenanceToUserMessage, Vn as authorizeOperatorScopesForMethod, W as acquireSessionWriteLock, Wn as executePluginCommand, X as resolveSessionResetType, Xn as normalizePluginHttpPath, Y as resolveSessionResetPolicy, Yn as triggerInternalHook, Z as resolveThreadFlag, _ as appendAssistantMessageToSessionTranscript, _n as resolveChannelGroupRequireMention, a as createPluginRegistry, an as resolveTelegramToken, at as resolveMainSessionKey, b as resolveAndPersistSessionFile, bn as resolveGroupSessionKey, bt as parseSlackTarget, c as listAgentsForGateway, ct as listChannelPlugins, d as lookupContextTokens, dn as resolveDefaultSignalAccountId, en as createTelegramActionGate, et as resolveFreshSessionTotalTokens, f as resolveContextTokensForModel, fn as resolveSignalAccount, g as parseSessionThreadInfo, gn as resolveChannelGroupPolicy, h as extractDeliveryInfo, hn as resolveIMessageAccount, i as setActivePluginRegistry, in as resolveTelegramAccount, it as resolveExplicitAgentSessionKey, j as mergeDeliveryContext, jn as GATEWAY_CLIENT_MODES, k as deliveryContextFromSession, kn as resolveMessageChannel, l as loadCombinedSessionStoreForGateway, ln as listEnabledSignalAccounts, lt as normalizeChannelId$1, mn as resolveDefaultIMessageAccountId, n as getActivePluginRegistryKey, nn as listTelegramAccountIds, nt as canonicalizeMainSessionAlias, o as createRuntimeHelpers, on as buildChannelAccountBindings, ot as deriveSessionMetaPatch, p as ensureFasedAgentModelsJson, pn as listIMessageAccountIds, q as evaluateSessionFreshness, qn as matchPluginCommand, r as requireActivePluginRegistry, rt as resolveAgentMainSessionKey, s as classifySessionKey, st as getChannelPlugin, t as getActivePluginRegistry, tn as listEnabledTelegramAccounts, tt as setSessionRuntimeModel, u as resolveSessionModelRef, un as listSignalAccountIds, v as resolveMirroredTranscriptText, vn as resolveChannelGroupToolsPolicy, w as updateLastRoute, wn as isInternalMessageChannel, x as loadSessionStore, xn as INTERNAL_MESSAGE_CHANNEL, y as resolveSessionTranscriptFile, z as parseInlineDirectives$1, zn as ADMIN_SCOPE, zt as normalizeSignalMessagingTarget } from "./runtime-2B9_WKoI.js";
+import { $ as mergeSessionEntry, A as deliveryContextKey, An as GATEWAY_CLIENT_IDS, B as INPUT_PROVENANCE_KIND_VALUES, Bn as CLI_DEFAULT_OPERATOR_SCOPES, C as recordSessionMetaFromInbound, Cn as isGatewayMessageChannel, D as isCacheEnabled, Dn as normalizeMessageChannel, Dt as getChannelDock, E as updateSessionStoreEntry, En as listDeliverableMessageChannels, F as archiveSessionTranscripts, Fn as normalizeAnyChannelId, Ft as trimMessagingTarget, G as resolveSessionLockMaxHoldFromTimeout, Gn as getPluginCommandSpecs, H as hasInterSessionUserProvenance, Hn as resolveLeastPrivilegeOperatorScopesForMethod, I as capArrayByJsonBytes, In as normalizeChannelId$2, It as isWhatsAppGroupJid, J as resolveChannelResetConfig, Jn as createInternalHookEvent, K as resolveSessionKey$1, Kn as listPluginCommands, L as countToolResults, Ln as logMutatingAdminRpcAudit, Lt as normalizeWhatsAppTarget, M as normalizeDeliveryContext, Mn as GATEWAY_CLIENT_NAMES, N as normalizeSessionDeliveryFields, Nn as getChatChannelMeta, O as resolveCacheTtlMs$1, On as resolveGatewayMessageChannel, Ot as listChannelDocks, P as normalizeAccountId$1, Pn as listChatChannels, Pt as looksLikeHandleOrPhoneTarget, Q as DEFAULT_RESET_TRIGGERS, R as extractToolCallNames, Rn as consumeMutatingAdminRpcBudget, S as readSessionUpdatedAt, Sn as isDeliverableMessageChannel, T as updateSessionStore, Tn as isMarkdownCapableMessageChannel, U as normalizeInputProvenance, Un as clearPluginCommands, V as applyInputProvenanceToUserMessage, Vn as authorizeOperatorScopesForMethod, W as acquireSessionWriteLock, Wn as executePluginCommand, X as resolveSessionResetType, Xn as normalizePluginHttpPath, Y as resolveSessionResetPolicy, Yn as triggerInternalHook, Z as resolveThreadFlag, _ as appendAssistantMessageToSessionTranscript, _n as resolveChannelGroupRequireMention, a as createPluginRegistry, an as resolveTelegramToken, at as resolveMainSessionKey, b as resolveAndPersistSessionFile, bn as resolveGroupSessionKey, bt as parseSlackTarget, c as listAgentsForGateway, ct as listChannelPlugins, d as lookupContextTokens, dn as resolveDefaultSignalAccountId, en as createTelegramActionGate, et as resolveFreshSessionTotalTokens, f as resolveContextTokensForModel, fn as resolveSignalAccount, g as parseSessionThreadInfo, gn as resolveChannelGroupPolicy, h as extractDeliveryInfo, hn as resolveIMessageAccount, i as setActivePluginRegistry, in as resolveTelegramAccount, it as resolveExplicitAgentSessionKey, j as mergeDeliveryContext, jn as GATEWAY_CLIENT_MODES, k as deliveryContextFromSession, kn as resolveMessageChannel, l as loadCombinedSessionStoreForGateway, ln as listEnabledSignalAccounts, lt as normalizeChannelId$1, mn as resolveDefaultIMessageAccountId, n as getActivePluginRegistryKey, nn as listTelegramAccountIds, nt as canonicalizeMainSessionAlias, o as createRuntimeHelpers, on as buildChannelAccountBindings, ot as deriveSessionMetaPatch, p as ensureFasedAgentModelsJson, pn as listIMessageAccountIds, q as evaluateSessionFreshness, qn as matchPluginCommand, r as requireActivePluginRegistry, rt as resolveAgentMainSessionKey, s as classifySessionKey, st as getChannelPlugin, t as getActivePluginRegistry, tn as listEnabledTelegramAccounts, tt as setSessionRuntimeModel, u as resolveSessionModelRef, un as listSignalAccountIds, v as resolveMirroredTranscriptText, vn as resolveChannelGroupToolsPolicy, w as updateLastRoute, wn as isInternalMessageChannel, x as loadSessionStore, xn as INTERNAL_MESSAGE_CHANNEL, y as resolveSessionTranscriptFile, z as parseInlineDirectives$1, zn as ADMIN_SCOPE, zt as normalizeSignalMessagingTarget } from "./runtime-CXSQwMaR.js";
 import { a as clearActiveProgressLine, c as CHANNEL_IDS, f as normalizeChatChannelId, i as defaultRuntime, l as CHAT_CHANNEL_ORDER, o as registerActiveProgressLine, r as createNonExitingRuntime, s as unregisterActiveProgressLine, t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { S as normalizeLogLevel, d as isRich, f as theme, i as logVerbose, l as warn, o as setVerbose, p as getChildLogger, s as shouldLogVerbose, t as danger, u as colorize, w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
 import { c as expandHomePrefix, i as resolveGatewayPort, n as resolveConfigPath, s as resolveStateDir, t as STATE_DIR, u as resolveRequiredHomeDir } from "./paths-BEmvSyOV.js";
@@ -14,7 +14,7 @@ import { i as resolveSlackAccount } from "./accounts-CuqIKU8X.js";
 import { i as logWarn, n as logError, r as logInfo, t as logDebug } from "./logger-BbFvCoKk.js";
 import { n as runExec, r as spawnWithFallback, t as runCommandWithTimeout } from "./exec-DQ8j4Fm3.js";
 import { _ as webAuthExists, c as logWebSelfId, i as resolveWhatsAppAccount, l as logoutWeb, p as readWebSelfId, s as getWebAuthAgeMs, t as hasAnyWhatsAppAuth } from "./accounts-Brn3-uWN.js";
-import { S as resolveChannelEntryMatchWithFallback, b as normalizeChannelSlug, y as buildChannelKeyCandidates } from "./allow-list-DyAxs4yw.js";
+import { S as resolveChannelEntryMatchWithFallback, b as normalizeChannelSlug, y as buildChannelKeyCandidates } from "./allow-list-Bf45HfoP.js";
 import { n as redactSensitiveText, r as redactToolDetail, t as getDefaultRedactPatterns } from "./redact-Bm8vu_ju.js";
 import { a as saveJsonFile, i as loadJsonFile, r as resolveCopilotApiToken } from "./github-copilot-token-CUK__1s1.js";
 import { t as runTasksWithConcurrency } from "./run-with-concurrency-BsDJWzgM.js";
@@ -24,20 +24,20 @@ import { t as emitSessionTranscriptUpdate } from "./transcript-events-BJQWUdmU.j
 import { l as resolveChannelDefaultAccountId } from "./pairing-message-D0CoLHRJ.js";
 import { n as fetchWithTimeout, t as bindAbortRelay } from "./fetch-timeout-l_6RdoMw.js";
 import { t as normalizeRequestInitHeadersForFetch } from "./fetch-headers-my7hgV2G.js";
-import { a as isBlockedHostnameOrIp, t as SsrFBlockedError } from "./ssrf-fG4UHKBw.js";
+import { a as isBlockedHostnameOrIp, n as closeDispatcher, r as createPinnedDispatcher, s as resolvePinnedHostnameWithPolicy, t as SsrFBlockedError } from "./ssrf-fG4UHKBw.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-CeG6u6ld.js";
 import { n as redactSensitiveUrlLikeString, t as redactSensitiveUrl } from "./redact-sensitive-url-g-ukZjwA.js";
-import { a as formatIMessageChatTarget, c as normalizeIMessageHandle, i as DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS, l as parseIMessageTarget, o as formatIMessageTargetForLog, r as createIMessageRpcClient, s as isAllowedIMessageSender, t as sendMessageIMessage } from "./send-CFzGKJXo.js";
+import { a as formatIMessageChatTarget, c as normalizeIMessageHandle, i as DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS, l as parseIMessageTarget, o as formatIMessageTargetForLog, r as createIMessageRpcClient, s as isAllowedIMessageSender, t as sendMessageIMessage } from "./send-D-HfKQZm.js";
 import { A as resolveDefaultGroupPolicy, D as formatDocsLink, M as warnMissingProviderGroupPolicyFallbackOnce, b as setOnboardingChannelEnabled, c as parseOnboardingEntriesAllowingWildcard, f as promptParsedAllowFromForScopedChannel, h as resolveAccountIdForConfigure, j as resolveOpenProviderRuntimeGroupPolicy, k as resolveAllowlistProviderRuntimeGroupPolicy, l as patchChannelConfigForAccount, v as setChannelDmPolicyWithAllowFrom } from "./helpers-DMBU4oTo.js";
-import { A as formatLocationText, F as isSenderIdAllowed, I as mergeDmAllowFromSources, L as resolveGroupAllowFromSources, N as isVoiceCompatibleAudio, P as firstDefined$1, a as resolveCronStorePath, d as buildTelegramGroupPeerId, i as loadCronStore, j as toLocationContext, o as saveCronStore } from "./wsl-J-HscWxS.js";
-import { a as upsertChannelPairingRequest, c as getPairingAdapter, i as removeChannelAllowFromStoreEntry, l as listPairingChannels, n as readChannelAllowFromStore, o as readJsonFileWithFallback, s as writeJsonFileAtomically, t as addChannelAllowFromStoreEntry } from "./pairing-store-BChahgI2.js";
-import { a as chunkText, c as resolveChunkMode, d as isSafeFenceBreak, f as parseFenceSpans, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit, n as chunkByParagraph, o as chunkTextWithMode, p as chunkTextByBreakResolver, r as chunkMarkdownText, t as chunkByNewline, u as findFenceSpanAt } from "./chunk-CyoyqpbG.js";
+import { A as formatLocationText, F as isSenderIdAllowed, I as mergeDmAllowFromSources, L as resolveGroupAllowFromSources, N as isVoiceCompatibleAudio, P as firstDefined$1, a as resolveCronStorePath, d as buildTelegramGroupPeerId, i as loadCronStore, j as toLocationContext, o as saveCronStore } from "./wsl-CTvIWvZz.js";
+import { a as upsertChannelPairingRequest, c as getPairingAdapter, i as removeChannelAllowFromStoreEntry, l as listPairingChannels, n as readChannelAllowFromStore, o as readJsonFileWithFallback, s as writeJsonFileAtomically, t as addChannelAllowFromStoreEntry } from "./pairing-store-B6J2C0vP.js";
+import { a as chunkText, c as resolveChunkMode, d as isSafeFenceBreak, f as parseFenceSpans, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit, n as chunkByParagraph, o as chunkTextWithMode, p as chunkTextByBreakResolver, r as chunkMarkdownText, t as chunkByNewline, u as findFenceSpanAt } from "./chunk-CBpl-AiQ.js";
 import { c as normalizeDeviceAuthScopes, i as clearDevicePairing, s as normalizeDeviceAuthRole } from "./tailscale-status-DwpNdO3Z.js";
 import { c as resolveHumanDelayConfig, i as resolveResponsePrefixTemplate, n as createReplyPrefixOptions, o as resolveAgentIdentity, s as resolveEffectiveMessagesConfig } from "./reply-prefix-CeVw7Mn2.js";
 import { i as isSilentReplyText, n as SILENT_REPLY_TOKEN, r as isSilentReplyPrefixText, t as HEARTBEAT_TOKEN } from "./tokens-BbnqfVuu.js";
 import { n as safeEqualSecret, o as createAsyncLock, s as readJsonFile$1 } from "./pairing-token-Cs3BRKc0.js";
 import { n as generateSecureUuid, t as generateSecureToken } from "./secure-random-BIkG-k4s.js";
-import { a as logMessageProcessed, i as logLaneEnqueue, m as isDiagnosticsEnabled, o as logMessageQueued, p as emitDiagnosticEvent, r as logLaneDequeue, s as logSessionStateChange, t as diag } from "./diagnostic-DLL_zekv.js";
+import { a as logMessageProcessed, i as logLaneEnqueue, m as isDiagnosticsEnabled, o as logMessageQueued, p as emitDiagnosticEvent, r as logLaneDequeue, s as logSessionStateChange, t as diag } from "./diagnostic-sYs6Agr-.js";
 import { r as getDiagnosticSessionState } from "./diagnostic-session-state-DqgfGYqZ.js";
 import { t as redactIdentifier } from "./redact-identifier-Lt7t3l7S.js";
 import { i as resolveTelegramTargetChatType, r as parseTelegramTarget } from "./targets-CoMJ1ry1.js";
@@ -48,31 +48,31 @@ import { i as executeWithApiKeyRotation, n as parseGeminiAuth, r as collectProvi
 import { c as normalizeExtraMemoryPaths, s as listMemoryFiles } from "./internal-CG_nHo-2.js";
 import { i as resolveQmdScopeDenial } from "./qmd-scope-CdX34VCV.js";
 import { _ as estimateBase64DecodedBytes, a as jsonResult, d as readStringParam, f as sanitizeContentBlocksImages, g as canonicalizeBase64, h as resolveImageSanitizationLimits, i as imageResultFromFile, l as readStringArrayParam, m as sanitizeToolResultImages, n as createActionGate, p as sanitizeImageBlocks, r as imageResult, s as readNumberParam, u as readStringOrNumberParam } from "./common-HCcXU-NR.js";
-import { S as isCommandFlagEnabled, _ as normalizeElevatedLevel, a as listChatCommands, b as normalizeVerboseLevel, g as shouldHandleTextCommands, i as isCommandEnabled, l as maybeResolveTextAlias, m as resolveNativeCommandName, o as listChatCommandsForConfig, u as normalizeCommandBody, v as normalizeReasoningLevel, w as isRestartEnabled, x as resolveResponseUsageMode, y as normalizeUsageDisplay } from "./commands-registry-BfqdEWdF.js";
-import { A as fetchJson$1, B as DEFAULT_BROWSER_EVALUATE_ENABLED, C as normalizeCdpWsUrl, D as assertBrowserNavigationResultAllowed, E as assertBrowserNavigationAllowed, F as stopChromeExtensionRelayServer, G as isLoopbackHost, H as DEFAULT_FASED_BROWSER_ENABLED, I as DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH, J as resolveClientIp, K as isSecureWebSocketUrl, L as DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS, O as withBrowserNavigationPolicy, P as ensureChromeExtensionRelayServer, R as DEFAULT_AI_SNAPSHOT_MAX_CHARS, T as InvalidBrowserNavigationUrlError, U as DEFAULT_FASED_BROWSER_PROFILE_NAME, V as DEFAULT_FASED_BROWSER_COLOR, W as isLoopbackAddress, X as rawDataToString, Y as resolveForwardedClientIp, _ as stopFasedAgentChrome, a as DEFAULT_TRACE_DIR, b as captureScreenshot, d as normalizeBrowserFormField, g as resolveFasedAgentUserDataDir, h as launchFasedAgentChrome, i as DEFAULT_DOWNLOAD_DIR, j as fetchOk, k as appendCdpPath, l as resolveWritablePathWithinRoot, m as isChromeReachable, o as DEFAULT_UPLOAD_DIR, p as isChromeCdpReady, q as isTrustedProxyAddress, r as loadReadability, s as resolveExistingPathsWithinRoot, t as loadLinkedom, v as resolveBrowserExecutableForPlatform, w as snapshotAria, x as createTargetViaCdp, y as resolveLsofCommandSync, z as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME } from "./runtime-dependency-nup8niQL.js";
+import { S as isCommandFlagEnabled, _ as normalizeElevatedLevel, a as listChatCommands, b as normalizeVerboseLevel, g as shouldHandleTextCommands, i as isCommandEnabled, l as maybeResolveTextAlias, m as resolveNativeCommandName, o as listChatCommandsForConfig, u as normalizeCommandBody, v as normalizeReasoningLevel, w as isRestartEnabled, x as resolveResponseUsageMode, y as normalizeUsageDisplay } from "./commands-registry-G5KXSi_y.js";
+import { A as fetchJson$1, B as DEFAULT_BROWSER_EVALUATE_ENABLED, C as normalizeCdpWsUrl, D as assertBrowserNavigationResultAllowed, E as assertBrowserNavigationAllowed, F as stopChromeExtensionRelayServer, G as isLoopbackHost, H as DEFAULT_FASED_BROWSER_ENABLED, I as DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH, J as resolveClientIp, K as isSecureWebSocketUrl, L as DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS, O as withBrowserNavigationPolicy, P as ensureChromeExtensionRelayServer, R as DEFAULT_AI_SNAPSHOT_MAX_CHARS, T as InvalidBrowserNavigationUrlError, U as DEFAULT_FASED_BROWSER_PROFILE_NAME, V as DEFAULT_FASED_BROWSER_COLOR, W as isLoopbackAddress, X as rawDataToString, Y as resolveForwardedClientIp, _ as stopFasedAgentChrome, a as DEFAULT_TRACE_DIR, b as captureScreenshot, d as normalizeBrowserFormField, g as resolveFasedAgentUserDataDir, h as launchFasedAgentChrome, i as DEFAULT_DOWNLOAD_DIR, j as fetchOk, k as appendCdpPath, l as resolveWritablePathWithinRoot, m as isChromeReachable, o as DEFAULT_UPLOAD_DIR, p as isChromeCdpReady, q as isTrustedProxyAddress, r as loadReadability, s as resolveExistingPathsWithinRoot, t as loadLinkedom, v as resolveBrowserExecutableForPlatform, w as snapshotAria, x as createTargetViaCdp, y as resolveLsofCommandSync, z as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME } from "./runtime-dependency-DczkvPxn.js";
 import { t as PATH_ALIAS_POLICIES } from "./path-alias-guards-DjgDArrp.js";
 import { a as writeFileWithinRoot, n as openFileWithinRoot, r as readFileWithinRoot, t as SafeOpenError } from "./fs-safe-g4g7GT02.js";
-import { a as fetchRemoteMedia, d as readResponseWithLimit, i as MediaFetchError, l as getAgentScopedMediaLocalRoots, n as loadWebMedia, t as getDefaultLocalRoots, u as getDefaultMediaLocalRoots } from "./media-CAdQF5TG.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-DCOXEUfZ.js";
-import { a as resolveSignalRpcContext, c as streamSignalEvents, l as markdownToSignalTextChunks, n as sendReadReceiptSignal, o as signalCheck, r as sendTypingSignal, s as signalRpcRequest, t as sendMessageSignal } from "./send-B6KkGKZD.js";
-import { a as saveMediaBuffer, i as getMediaDir, n as ensureMediaDir } from "./outbound-attachment-QqTnIhZL.js";
-import { t as resolveFetch } from "./fetch-BtmoPIlf.js";
-import { B as isSessionBindingError, C as resolveThreadBindingMaxAgeMs$1, F as resolveThreadBindingIntroText, G as resolveSessionStorePathForAcp, I as resolveThreadBindingThreadName, K as upsertAcpSessionMeta, L as SYSTEM_MARK, N as formatThreadBindingDurationLabel, R as prefixSystemMessage, S as resolveThreadBindingMaxAgeExpiresAt, U as listAcpSessionEntries, W as readAcpSessionEntry, b as resolveThreadBindingIdleTimeoutMs$1, c as getThreadBindingManager, x as resolveThreadBindingInactivityExpiresAt, z as getSessionBindingService } from "./thread-bindings.state-D9hg_M1c.js";
-import { _ as marketplaceSkillIdsFromEntries, b as sanitizeEnvVars, c as getSkillsSnapshotVersion, d as resolveSkillsPromptForRun, f as syncSkillsToWorkspace, g as isMarketplaceSkillDir, h as getActiveSkillEnvOverrides, i as resolveSkillCommandInvocation, l as buildWorkspaceSkillSnapshot, m as applySkillEnvOverridesFromSnapshot, n as listSkillCommandsForAgents, o as getRemoteSkillEligibility, p as applySkillEnvOverrides, r as listSkillCommandsForWorkspace, s as ensureSkillsWatcher, t as listReservedChatSlashCommandNames, u as loadWorkspaceSkillEntries, v as marketplaceSkillIdsFromSnapshot, y as marketplaceSkillProvenanceMatchesContent } from "./skill-commands-FKEPLS7T.js";
-import { a as resolveSandboxedMediaSource, i as resolveSandboxPath, n as assertSandboxPath, r as resolveSandboxInputPath, t as assertMediaNotDataUrl } from "./sandbox-paths-Dx2lUqCu.js";
-import { n as resolveUserTimeFormat, r as resolveUserTimezone, t as formatUserTime } from "./date-time-uUevHscU.js";
-import { t as parseDiscordTarget } from "./targets-CtSbTxYX.js";
-import { n as missingTargetError, r as unknownTargetError, t as ambiguousTargetError } from "./target-errors-Ckufe179.js";
-import { i as discoverModels, r as discoverAuthStorage } from "./pi-model-discovery-BX_JLcEJ.js";
-import { n as normalizePollInput } from "./polls-DKQXVfJp.js";
-import { n as resolveAgentRoute, t as buildAgentSessionKey } from "./resolve-route-C8tvQm8Z.js";
-import { r as normalizeInboundTextNewlines, t as finalizeInboundContext } from "./inbound-context-DrAcXE0y.js";
-import { n as recordCommandPoll, r as resetCommandPollCount } from "./command-poll-backoff-yJU83wEq.js";
-import { t as convertMarkdownTables } from "./tables-B3jr0Pvq.js";
-import { n as recordChannelActivity, t as getChannelActivity } from "./channel-activity-DBDMQ3yI.js";
-import { t as withTimeout$3 } from "./with-timeout-ckWB8rTo.js";
-import { t as getActiveWebListener } from "./active-listener-B_NMtgPL.js";
-import { n as asString$4, r as collectIssuesForEnabledAccounts } from "./shared-CBgp_GBw.js";
+import { a as fetchRemoteMedia, d as readResponseWithLimit, i as MediaFetchError, l as getAgentScopedMediaLocalRoots, n as loadWebMedia, t as getDefaultLocalRoots, u as getDefaultMediaLocalRoots } from "./media-BAoaxCrt.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-d7GlUs5R.js";
+import { a as resolveSignalRpcContext, c as streamSignalEvents, l as markdownToSignalTextChunks, n as sendReadReceiptSignal, o as signalCheck, r as sendTypingSignal, s as signalRpcRequest, t as sendMessageSignal } from "./send-D1j12ZgX.js";
+import { a as saveMediaBuffer, i as getMediaDir, n as ensureMediaDir } from "./outbound-attachment-CyXM3cAv.js";
+import { t as resolveFetch } from "./fetch-B0v6OTUZ.js";
+import { B as isSessionBindingError, C as resolveThreadBindingMaxAgeMs$1, F as resolveThreadBindingIntroText, G as resolveSessionStorePathForAcp, I as resolveThreadBindingThreadName, K as upsertAcpSessionMeta, L as SYSTEM_MARK, N as formatThreadBindingDurationLabel, R as prefixSystemMessage, S as resolveThreadBindingMaxAgeExpiresAt, U as listAcpSessionEntries, W as readAcpSessionEntry, b as resolveThreadBindingIdleTimeoutMs$1, c as getThreadBindingManager, x as resolveThreadBindingInactivityExpiresAt, z as getSessionBindingService } from "./thread-bindings.state-D2oOWDpv.js";
+import { _ as marketplaceSkillIdsFromEntries, b as sanitizeEnvVars, c as getSkillsSnapshotVersion, d as resolveSkillsPromptForRun, f as syncSkillsToWorkspace, g as isMarketplaceSkillDir, h as getActiveSkillEnvOverrides, i as resolveSkillCommandInvocation, l as buildWorkspaceSkillSnapshot, m as applySkillEnvOverridesFromSnapshot, n as listSkillCommandsForAgents, o as getRemoteSkillEligibility, p as applySkillEnvOverrides, r as listSkillCommandsForWorkspace, s as ensureSkillsWatcher, t as listReservedChatSlashCommandNames, u as loadWorkspaceSkillEntries, v as marketplaceSkillIdsFromSnapshot, y as marketplaceSkillProvenanceMatchesContent } from "./skill-commands-iJtvpqgb.js";
+import { a as resolveSandboxedMediaSource, i as resolveSandboxPath, n as assertSandboxPath, r as resolveSandboxInputPath, t as assertMediaNotDataUrl } from "./sandbox-paths-Bzh1CuZc.js";
+import { n as resolveUserTimeFormat, r as resolveUserTimezone, t as formatUserTime } from "./date-time-ChY_tHoG.js";
+import { t as parseDiscordTarget } from "./targets-DDbNnLnB.js";
+import { n as missingTargetError, r as unknownTargetError, t as ambiguousTargetError } from "./target-errors-DfS1sLR9.js";
+import { i as discoverModels, r as discoverAuthStorage } from "./pi-model-discovery-BHNVyRny.js";
+import { n as normalizePollInput } from "./polls-DXd67TD8.js";
+import { n as resolveAgentRoute, t as buildAgentSessionKey } from "./resolve-route-Dufnu2cT.js";
+import { r as normalizeInboundTextNewlines, t as finalizeInboundContext } from "./inbound-context-CQnfFFQ9.js";
+import { n as recordCommandPoll, r as resetCommandPollCount } from "./command-poll-backoff-NAePk3eL.js";
+import { t as convertMarkdownTables } from "./tables-_1W36GII.js";
+import { n as recordChannelActivity, t as getChannelActivity } from "./channel-activity-F07DjroV.js";
+import { t as withTimeout$3 } from "./with-timeout-CVV8tytk.js";
+import { t as getActiveWebListener } from "./active-listener-p9Ooc1qj.js";
+import { n as asString$4, r as collectIssuesForEnabledAccounts } from "./shared-D1AD2Ejn.js";
 import { createRequire } from "node:module";
 import * as path$1 from "node:path";
 import path, { isAbsolute, posix } from "node:path";
@@ -97,7 +97,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import readline from "node:readline";
 import { createJiti } from "jiti";
 import { Type } from "@sinclair/typebox";
-import WebSocket$1, { WebSocket } from "ws";
+import WebSocket, { WebSocket as WebSocket$1 } from "ws";
 import { Buffer as Buffer$1 } from "node:buffer";
 import net from "node:net";
 import { request } from "node:https";
@@ -8186,7 +8186,7 @@ async function getMemorySearchManager(params) {
 			if (cached) return { manager: cached };
 		}
 		try {
-			const { QmdMemoryManager } = await import("./qmd-manager-CgRaTxUq.js");
+			const { QmdMemoryManager } = await import("./qmd-manager-B8Vnu0ND.js");
 			const primary = await QmdMemoryManager.create({
 				cfg: params.cfg,
 				agentId: params.agentId,
@@ -8216,7 +8216,7 @@ async function getMemorySearchManager(params) {
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (isNodeSqliteUnavailable(message)) {
-			const { FilesystemMemorySearchManager } = await import("./filesystem-manager-DoI8IBNF.js");
+			const { FilesystemMemorySearchManager } = await import("./filesystem-manager-BzuIJ9K9.js");
 			const manager = await FilesystemMemorySearchManager.create({
 				cfg: params.cfg,
 				agentId: params.agentId,
@@ -12570,7 +12570,7 @@ var GatewayClient = class {
 				if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
 			});
 		}
-		this.ws = new WebSocket(url, wsOptions);
+		this.ws = new WebSocket$1(url, wsOptions);
 		this.ws.on("open", () => {
 			if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
 				const tlsError = this.validateTlsFingerprint();
@@ -12766,7 +12766,7 @@ var GatewayClient = class {
 		const connectChallengeTimeoutMs = typeof rawConnectDelayMs === "number" && Number.isFinite(rawConnectDelayMs) ? Math.max(250, Math.min(1e4, rawConnectDelayMs)) : 2e3;
 		if (this.connectTimer) clearTimeout(this.connectTimer);
 		this.connectTimer = setTimeout(() => {
-			if (this.connectSent || this.ws?.readyState !== WebSocket.OPEN) return;
+			if (this.connectSent || this.ws?.readyState !== WebSocket$1.OPEN) return;
 			this.opts.onConnectError?.(/* @__PURE__ */ new Error("gateway connect challenge timeout"));
 			this.ws?.close(1008, "connect challenge timeout");
 		}, connectChallengeTimeoutMs);
@@ -12808,7 +12808,7 @@ var GatewayClient = class {
 		return null;
 	}
 	async request(method, params, opts) {
-		if (!this.ws || this.ws.readyState !== WebSocket.OPEN) throw new Error("gateway not connected");
+		if (!this.ws || this.ws.readyState !== WebSocket$1.OPEN) throw new Error("gateway not connected");
 		const id = randomUUID();
 		const frame = {
 			type: "req",
@@ -14972,6 +14972,11 @@ const SAT_RUNTIME_ENV_KEYS = {
 	mintAddress: "FASED_SAT_MINT_ADDRESS",
 	mintProgramId: "FASED_SAT_MINT_PROGRAM_ID"
 };
+const SAT_RUNTIME_TRUST_ENV_KEYS = {
+	manifestPath: "FASED_SAT_RUNTIME_MANIFEST_PATH",
+	manifestSha256: "FASED_SAT_RUNTIME_MANIFEST_SHA256",
+	manifestSignaturePath: "FASED_SAT_RUNTIME_MANIFEST_SIGNATURE_PATH"
+};
 const MISSING_SAT_RUNTIME_IDS_MESSAGE = "SAT runtime IDs are not configured. Use Mining Sync after mainnet launch or set the complete SAT runtime env tuple for an explicit test network.";
 function readExplicitSatRuntimeIds(env) {
 	const programId = String(env[SAT_RUNTIME_ENV_KEYS.programId] ?? "").trim();
@@ -15233,24 +15238,43 @@ function readLocalIds(env) {
 function idsEqual(left, right) {
 	return Boolean(left && right && left.programId === right.programId && left.bondProgramId === right.bondProgramId && left.mintAddress === right.mintAddress && left.mintProgramId === right.mintProgramId);
 }
-function buildEnvFile(ids) {
+function buildEnvFile(ids, trust) {
 	return [
 		"# Managed by Fased Agent official SAT mainnet sync.",
 		`${SAT_RUNTIME_ENV_KEYS.programId}=${ids.programId}`,
 		`${SAT_RUNTIME_ENV_KEYS.bondProgramId}=${ids.bondProgramId}`,
 		`${SAT_RUNTIME_ENV_KEYS.mintAddress}=${ids.mintAddress}`,
 		`${SAT_RUNTIME_ENV_KEYS.mintProgramId}=${ids.mintProgramId}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestPath}=${trust.manifestPath}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestSha256}=${trust.manifestSha256}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestSignaturePath}=${trust.manifestSignaturePath}`,
 		""
 	].join("\n");
 }
-async function writeRuntimeIds(ids, env) {
+async function writeRuntimeIds(ids, env, trust) {
 	const runtimeFile = resolveWritableSatRuntimeDefaultsFile(env);
+	const manifestPath = `${runtimeFile}.manifest.json`;
+	const manifestSignaturePath = `${runtimeFile}.manifest.sig`;
 	await fs$1.mkdir(path.dirname(runtimeFile), { recursive: true });
-	await fs$1.writeFile(runtimeFile, buildEnvFile(ids), { mode: 384 });
+	await fs$1.writeFile(manifestPath, trust.rawManifest, { mode: 384 });
+	await fs$1.writeFile(manifestSignaturePath, `${trust.signature.trim()}\n`, { mode: 384 });
+	await fs$1.writeFile(runtimeFile, buildEnvFile(ids, {
+		manifestPath,
+		manifestSha256: trust.manifestSha256,
+		manifestSignaturePath
+	}), { mode: 384 });
+	await Promise.all([
+		fs$1.chmod(manifestPath, 384),
+		fs$1.chmod(manifestSignaturePath, 384),
+		fs$1.chmod(runtimeFile, 384)
+	]);
 	env[SAT_RUNTIME_ENV_KEYS.programId] = ids.programId;
 	env[SAT_RUNTIME_ENV_KEYS.bondProgramId] = ids.bondProgramId;
 	env[SAT_RUNTIME_ENV_KEYS.mintAddress] = ids.mintAddress;
 	env[SAT_RUNTIME_ENV_KEYS.mintProgramId] = ids.mintProgramId;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestPath] = manifestPath;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestSha256] = trust.manifestSha256;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestSignaturePath] = manifestSignaturePath;
 	return runtimeFile;
 }
 async function getSatMainnetSyncStatus(opts) {
@@ -15350,7 +15374,43 @@ async function syncSatMainnetRuntimeIds(opts) {
 		ok: false,
 		message: before.state === "not_live" ? "Satcoin mainnet is not live yet." : before.message || "SAT mainnet manifest is not ready to apply."
 	};
-	const runtimeFile = await writeRuntimeIds(before.officialIds, env);
+	const manifestUrl = opts?.manifestUrl?.trim() || resolveManifestUrl(env);
+	const rawManifest = await fetchText(manifestUrl, { required: true });
+	const manifestSha256 = parseSha256(await fetchText(`${manifestUrl}.sha256`, { required: true }));
+	const signature = await fetchText(`${manifestUrl}.sig`, { required: true });
+	if (!rawManifest || !manifestSha256 || !signature?.trim()) return {
+		...before,
+		ok: false,
+		state: "failed",
+		message: "Verified SAT manifest artifacts could not be persisted for the native signer.",
+		error: "signed SAT runtime manifest, hash, or detached signature is missing"
+	};
+	const finalVerification = await verifyLiveManifest({
+		manifestUrl,
+		raw: rawManifest,
+		env
+	});
+	if (finalVerification.verification.hash !== "valid" || finalVerification.verification.signature !== "valid" || sha256Hex(rawManifest) !== manifestSha256) return {
+		...before,
+		ok: false,
+		state: "failed",
+		message: "SAT manifest changed before signer runtime persistence.",
+		verification: finalVerification.verification,
+		trustKeySource: finalVerification.trustKeySource,
+		error: "signed SAT runtime manifest verification raced or failed"
+	};
+	if (!idsEqual(readOfficialIds(JSON.parse(rawManifest)), before.officialIds)) return {
+		...before,
+		ok: false,
+		state: "failed",
+		message: "SAT manifest IDs changed before signer runtime persistence.",
+		error: "signed SAT runtime ID tuple changed during sync"
+	};
+	const runtimeFile = await writeRuntimeIds(before.officialIds, env, {
+		rawManifest,
+		manifestSha256,
+		signature
+	});
 	const after = await getSatMainnetSyncStatus({
 		env,
 		manifestUrl: opts?.manifestUrl
@@ -15593,6 +15653,60 @@ function buildAttestation(options) {
 	};
 }
 
+//#endregion
+//#region src/wallet/solana-rpc-read-fetch.ts
+function normalizeRpcHostname(hostname) {
+	const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+	return normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+}
+function isLoopbackRpcHostname(hostname) {
+	const normalized = normalizeRpcHostname(hostname);
+	return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+function isLoopbackRpcAddress(address) {
+	const normalized = normalizeRpcHostname(address);
+	return normalized === "::1" || normalized === "0:0:0:0:0:0:0:1" || /^127(?:\.\d{1,3}){3}$/.test(normalized) || /^::ffff:127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+async function resolveWithTimeout(hostname, policy, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([resolvePinnedHostnameWithPolicy(hostname, { policy }), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("stored Solana RPC hostname resolution timed out")), Math.max(250, timeoutMs));
+			timer.unref?.();
+		})]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+async function fetchPinnedSolanaRpcRead(params) {
+	const parsed = new URL(params.rpcUrl);
+	const hostname = normalizeRpcHostname(parsed.hostname);
+	const loopback = isLoopbackRpcHostname(hostname);
+	if (!hostname || parsed.username || parsed.password || parsed.hash || parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) throw new Error("stored Solana RPC URL is not safe for Gateway reads");
+	const pinned = await resolveWithTimeout(hostname, {
+		hostnameAllowlist: [hostname],
+		...loopback ? { allowPrivateNetwork: true } : {}
+	}, params.timeoutMs);
+	if (loopback && !pinned.addresses.every(isLoopbackRpcAddress)) throw new Error("stored Local Solana RPC hostname did not resolve only to loopback addresses");
+	const dispatcher = createPinnedDispatcher(pinned);
+	try {
+		return {
+			response: await fetch(parsed.toString(), {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: params.body,
+				redirect: "error",
+				signal: AbortSignal.timeout(Math.max(250, params.timeoutMs)),
+				dispatcher
+			}),
+			release: async () => closeDispatcher(dispatcher)
+		};
+	} catch (error) {
+		await closeDispatcher(dispatcher);
+		throw error;
+	}
+}
+
 //#endregion
 //#region src/wallet/solana-assets.ts
 const SOLANA_NATIVE_MINT$1 = "So11111111111111111111111111111111111111112";
@@ -15941,10 +16055,11 @@ function formatTokenAmount(raw, decimals) {
 	}
 }
 async function fetchSolanaRpc(rpcUrl, method, params) {
+	let release;
 	try {
-		const response = await fetch(rpcUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
+		const guarded = await fetchPinnedSolanaRpcRead({
+			rpcUrl,
+			timeoutMs: 1e4,
 			body: JSON.stringify({
 				jsonrpc: "2.0",
 				id: 1,
@@ -15952,6 +16067,8 @@ async function fetchSolanaRpc(rpcUrl, method, params) {
 				params
 			})
 		});
+		release = guarded.release;
+		const response = guarded.response;
 		if (!response.ok) {
 			recordSolanaAssetRpcMethod(method, "failure");
 			return null;
@@ -15966,6 +16083,8 @@ async function fetchSolanaRpc(rpcUrl, method, params) {
 	} catch {
 		recordSolanaAssetRpcMethod(method, "failure");
 		return null;
+	} finally {
+		await release?.();
 	}
 }
 async function fetchSolanaMetadataFromMintViaRpc(params) {
@@ -16253,14 +16372,18 @@ const SignerPolicyAssetV2Schema = Type.Object({
 	asset: Type.String(),
 	destinations: Type.Array(Type.String()),
 	maxPerTx: Type.String(),
-	maxDaily: Type.String()
+	maxDaily: Type.String(),
+	reviewedDestinations: Type.Optional(Type.Boolean()),
+	typedSatDestinations: Type.Optional(Type.Boolean())
 }, { additionalProperties: false });
 const SignerPolicyInputV2Schema = Type.Object({
 	walletId: Type.Optional(Type.String()),
 	role: SignerWalletRoleSchema,
 	version: Type.Optional(Type.Integer({ minimum: 0 })),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.Optional(Type.String())
 }, { additionalProperties: false });
@@ -16268,8 +16391,10 @@ const LocalSocketSignerPolicyV2Schema = Type.Object({
 	walletId: Type.String(),
 	role: SignerWalletRoleSchema,
 	version: Type.Integer({ minimum: 1 }),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" })
 }, { additionalProperties: false });
@@ -16455,10 +16580,13 @@ const SignerSolanaTransactionEnvelopeV2Schema = Type.Object({
 	}),
 	submission: Type.Literal("rpc")
 }, { additionalProperties: false });
-const SignerReviewAuthorizationV2Schema = Type.Object({
+const SignerReviewAuthorizationV2Schema = Type.Union([Type.Object({
 	type: Type.Literal("webauthn"),
 	proof: Type.Object({ proofId: Type.String({ minLength: 1 }) }, { additionalProperties: false })
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	type: Type.Literal("control-ui"),
+	proof: Type.Object({ proofId: Type.String({ pattern: "^[0-9a-f]{64}$" }) }, { additionalProperties: false })
+}, { additionalProperties: false })]);
 const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Type.Array(Type.Object({
 	orderId: Type.String({ minLength: 1 }),
 	orderState: Type.String({ minLength: 1 }),
@@ -16483,10 +16611,17 @@ const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Typ
 		program: Type.String({ minLength: 1 })
 	}, { additionalProperties: false }))
 }, { additionalProperties: false })) }, { additionalProperties: false });
-const SignerWalletPolicyCreateV2Schema = Type.Object({
+const SignerRoleBaselineV1Schema = Type.Object({
+	version: Type.Literal(1),
+	role: SignerWalletRoleSchema
+}, { additionalProperties: false });
+const SignerWalletPolicyCreateV2Schema = Type.Union([Type.Object({
 	expectedPolicyVersion: Type.Literal(0),
 	policy: SignerPolicyInputV2Schema
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	expectedPolicyVersion: Type.Literal(0),
+	baseline: SignerRoleBaselineV1Schema
+}, { additionalProperties: false })]);
 const SignerOperationLookupV2Schema = Type.Object({ requestId: Type.String() }, { additionalProperties: false });
 const SignerSatLookupBindingRequestV2Schema = Type.Object({
 	cycleId: Type.String({ pattern: "^(0|[1-9][0-9]*)$" }),
@@ -16509,6 +16644,16 @@ const LocalSocketSignerSatLookupBindingV2Schema = Type.Object({
 		Type.Literal("unknown")
 	]))
 }, { additionalProperties: false });
+const LocalSocketSignerNetworkSummaryV2Schema = Type.Object({
+	walletId: Type.String({
+		minLength: 1,
+		maxLength: 64
+	}),
+	configured: Type.Boolean(),
+	version: Type.Integer({ minimum: 0 }),
+	hash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({ op: Type.Literal("health") }, { additionalProperties: false }),
 	Type.Object({ op: Type.Literal("v2.capabilities") }, { additionalProperties: false }),
@@ -16520,6 +16665,21 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.policy.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.network.get"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.network.bootstrap"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedVersion: Type.Integer({ minimum: 0 }),
+			primaryRpcUrl: Type.String({
+				minLength: 1,
+				maxLength: 2048
+			})
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.policy.put"),
 		walletId: Type.String(),
@@ -16540,6 +16700,18 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.wallet.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.wallet.readiness"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.policy.activateBaseline"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedPolicyVersion: Type.Integer({ minimum: 1 }),
+			baseline: SignerRoleBaselineV1Schema
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.create"),
 		walletId: Type.String(),
@@ -16548,21 +16720,30 @@ const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({
 		op: Type.Literal("v2.wallet.import"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.importLegacy"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String(),
 			passphrasePath: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String(),
+			passphrasePath: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.reencrypt"),
@@ -16842,6 +17023,27 @@ const LocalSocketSignerWalletPolicyResultV2Schema = Type.Object({
 	wallet: LocalSocketSignerWalletV2Schema,
 	policy: LocalSocketSignerPolicyV2Schema
 }, { additionalProperties: false });
+const LocalSocketSignerWalletReadinessV2Schema = Type.Object({
+	walletId: Type.String({ minLength: 1 }),
+	publicKey: Type.String({ minLength: 1 }),
+	walletVersion: Type.Optional(Type.Integer({ minimum: 1 })),
+	role: SignerWalletRoleSchema,
+	baselineVersion: Type.Integer({ minimum: 0 }),
+	policyVersion: Type.Integer({ minimum: 1 }),
+	policyHash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" }),
+	networkVersion: Type.Integer({ minimum: 0 }),
+	networkHash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	keyReady: Type.Boolean(),
+	policyReady: Type.Boolean(),
+	networkReady: Type.Boolean(),
+	operationLane: Type.Union([
+		Type.Literal("blocked"),
+		Type.Literal("agent-reviewed-and-autonomous"),
+		Type.Literal("mining-typed-sat"),
+		Type.Literal("vault-reviewed-only")
+	]),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 function isPositiveUnsignedInteger(value) {
 	return typeof value === "string" && /^[1-9][0-9]*$/.test(value);
 }
@@ -16868,11 +17070,15 @@ function validateLocalSocketSignerResult(op, result) {
 		case "health":
 		case "v2.capabilities": return Value.Check(LocalSocketSignerHealthResultSchema, result);
 		case "v2.jupiter.trigger.history": return Value.Check(LocalSocketSignerJupiterTriggerHistoryV2Schema, result);
+		case "v2.network.get":
+		case "v2.network.bootstrap": return Value.Check(LocalSocketSignerNetworkSummaryV2Schema, result);
 		case "v2.policy.get":
 		case "v2.policy.put":
-		case "v2.policy.tighten": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
+		case "v2.policy.tighten":
+		case "v2.policy.activateBaseline": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
 		case "v2.wallet.get":
 		case "v2.wallet.reencrypt": return Value.Check(LocalSocketSignerWalletV2Schema, result);
+		case "v2.wallet.readiness": return Value.Check(LocalSocketSignerWalletReadinessV2Schema, result);
 		case "v2.wallet.create":
 		case "v2.wallet.import":
 		case "v2.wallet.importLegacy": return Value.Check(LocalSocketSignerWalletPolicyResultV2Schema, result);
@@ -16902,7 +17108,10 @@ const SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES = [
 	"atomicIdempotency",
 	"ambiguousBroadcastReconciliation",
 	"signerOwnedKeys",
+	"signerOwnedRoleBaselines",
+	"liveWalletReadiness",
 	"signerOwnedRPC",
+	"applicationNetworkBootstrap",
 	"typedSolanaTransactions",
 	"typedA2aPaymentMemos",
 	"typedA2aRefundMemos",
@@ -17115,11 +17324,15 @@ const REQUIRED_PROTOCOL_V2_FEATURES = SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURE
 const SIGNER_SOCKET_TIMEOUT_MS = {
 	health: 2e3,
 	"v2.capabilities": 2e3,
+	"v2.network.get": 15e3,
+	"v2.network.bootstrap": 3e4,
 	"v2.jupiter.trigger.history": 3e4,
 	"v2.policy.get": 5e3,
 	"v2.policy.put": 5e3,
 	"v2.policy.tighten": 5e3,
+	"v2.policy.activateBaseline": 1e4,
 	"v2.wallet.get": 5e3,
+	"v2.wallet.readiness": 5e3,
 	"v2.wallet.create": 1e4,
 	"v2.wallet.import": 2e4,
 	"v2.wallet.importLegacy": 3e4,
@@ -17306,6 +17519,12 @@ var LocalSocketSignerAdapter = class {
 				provider: this.id,
 				configured: true,
 				checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				...details.webAuthn ? { nativeSignerApproval: {
+					configured: details.webAuthn.configured,
+					ready: details.webAuthn.ready,
+					credentialCount: details.webAuthn.credentialCount,
+					credentialVersion: details.webAuthn.credentialVersion
+				} } : {},
 				details: [
 					details?.details ?? "",
 					...!details?.details ? [
@@ -17909,21 +18128,23 @@ function upsertNamedWallet(params) {
 		updatedAt: now
 	};
 	registry.wallets = [...registry.wallets.filter((entry) => entry.id !== next.id), next].toSorted((a, b) => a.createdAt.localeCompare(b.createdAt));
-	if (!registry.defaultWalletId || !registry.wallets.some((wallet) => wallet.id === registry.defaultWalletId)) registry.defaultWalletId = resolveWalletUserRole(next) === "agent" ? next.id : void 0;
 	writeWalletProviderRegistry(registry, env);
 	return next;
 }
 function resolveWalletSelectionForAgent(params) {
 	const registry = readWalletProviderRegistry(params.env ?? process.env);
 	const directAgent = params.agentId?.trim();
-	const walletId = (directAgent ? registry.assignments[directAgent] : void 0) ?? registry.defaultWalletId;
+	const directWalletId = directAgent ? registry.assignments[directAgent] : void 0;
+	const skillWalletId = params.skillWalletId?.trim();
+	const walletId = skillWalletId ?? directWalletId ?? registry.defaultWalletId;
 	if (!walletId) return {};
 	const wallet = registry.wallets.find((entry) => entry.id === walletId);
 	if (!wallet) return {};
 	return {
 		walletId: wallet.id,
 		walletName: wallet.name,
-		providerId: wallet.providerId
+		providerId: wallet.providerId,
+		source: skillWalletId ? "skill" : directWalletId ? "agent" : "default"
 	};
 }
 function resolveWalletSelection(params) {
@@ -17967,11 +18188,12 @@ function resolveWalletSelection(params) {
 	}
 	const fallback = resolveWalletSelectionForAgent({
 		agentId: params.agentId,
+		skillWalletId: params.skillWalletId,
 		env
 	});
 	if (fallback.walletId || fallback.providerId) return {
 		...fallback,
-		source: "fallback"
+		source: fallback.source ?? "fallback"
 	};
 	return { source: "none" };
 }
@@ -23797,6 +24019,36 @@ function findRequest(file, requestId) {
 	return file.requests.find((request) => request.id === requestId.trim());
 }
 
+//#endregion
+//#region src/wallet/local-socket-signer-lifecycle.ts
+async function requireSignerOwnedProtocolV2(socketPath, requiredFeatures = []) {
+	const result = await callLocalSocketSigner(socketPath, { op: "v2.capabilities" });
+	const capabilities = result.capabilities;
+	const missing = [
+		"failClosedPolicies",
+		"policyHashes",
+		"signerOwnedKeys",
+		"applicationNetworkBootstrap",
+		"atomicMultiAssetCaps",
+		"signerControlledNativeFeeCaps",
+		...requiredFeatures
+	].filter((feature) => !capabilities?.features.includes(feature));
+	if (result.ready !== true || capabilities?.protocol.current !== 2 || capabilities.protocol.min > 2 || capabilities.protocol.max < 2 || capabilities.nativeFeeReservationLamports !== LOCAL_SIGNER_NATIVE_FEE_RESERVATION_LAMPORTS_V2 || missing.length > 0) throw new Error(`fased-signerd does not provide the required signer-owned protocol-v2 capabilities${missing.length > 0 ? `: ${missing.join(", ")}` : ""}`);
+}
+async function readSignerOwnedWalletReadiness(params) {
+	await requireSignerOwnedProtocolV2(params.socketPath, ["liveWalletReadiness"]);
+	return await callLocalSocketSigner(params.socketPath, {
+		op: "v2.wallet.readiness",
+		walletId: params.walletId
+	});
+}
+
+//#endregion
+//#region src/wallet/native-signer-wallet-id.ts
+function normalizeNativeSignerWalletId(value) {
+	return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "") || "default";
+}
+
 //#endregion
 //#region src/wallet/wallet-approval-auth.ts
 function nowMs$1() {
@@ -23978,8 +24230,12 @@ async function readWalletStatusSnapshot(params) {
 	const statePaths = resolveWalletStatePaths(effectiveEnv);
 	const approvalAuth = readWalletApprovalAuthSnapshot(effectiveEnv, cfg);
 	const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const registeredWallets = params?.walletId ? providerRegistry.wallets.filter((wallet) => wallet.id === params.walletId) : providerRegistry.wallets;
 	let providerHealth = {
 		ok: false,
+		provider: providerId,
+		configured: false,
+		checkedAt,
 		details: "provider health probe unavailable"
 	};
 	let addresses;
@@ -24001,6 +24257,9 @@ async function readWalletStatusSnapshot(params) {
 	} catch (err) {
 		providerHealth = {
 			ok: false,
+			provider: providerId,
+			configured: false,
+			checkedAt,
 			details: walletDiagnosticErrorString(err)
 		};
 	}
@@ -24019,6 +24278,55 @@ async function readWalletStatusSnapshot(params) {
 			summary: "Real-chain settlement depends on the configured wallet provider and RPC connectivity."
 		},
 		chains: resolved.chains,
+		wallets: await Promise.all(registeredWallets.map(async (wallet) => {
+			if (wallet.providerId !== "local-socket-signer") return {
+				id: wallet.id,
+				name: wallet.name,
+				providerId: wallet.providerId,
+				addresses: wallet.addresses,
+				readiness: {
+					keystore: Boolean(wallet.addresses?.solana),
+					rpc: serviceHealthy,
+					ready: serviceHealthy && Boolean(wallet.addresses?.solana)
+				}
+			};
+			const signerWalletId = (typeof wallet.metadata?.signerWalletId === "string" ? wallet.metadata.signerWalletId.trim() : "") || normalizeNativeSignerWalletId(wallet.id);
+			try {
+				const signer = await readSignerOwnedWalletReadiness({
+					socketPath: resolveLocalSignerSocketPath(effectiveEnv),
+					walletId: signerWalletId
+				});
+				const addressMatches = typeof wallet.addresses?.solana === "string" && wallet.addresses.solana === signer.publicKey;
+				const roleMatches = typeof wallet.metadata?.role === "string" && wallet.metadata.role === signer.role;
+				const ready = signer.ready && addressMatches && roleMatches;
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: signer.keyReady,
+						rpc: signer.networkReady,
+						ready,
+						...!ready && signer.ready ? { error: "registry address or immutable role does not match live signer state" } : {},
+						signer
+					}
+				};
+			} catch (error) {
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: false,
+						rpc: false,
+						ready: false,
+						error: walletDiagnosticErrorMessage(error)
+					}
+				};
+			}
+		})),
 		service: {
 			host: resolved.service.host,
 			port: resolved.service.port,
@@ -24038,6 +24346,7 @@ async function readWalletStatusSnapshot(params) {
 			}
 		},
 		approvalAuth,
+		...providerHealth.nativeSignerApproval ? { nativeSignerApproval: providerHealth.nativeSignerApproval } : {},
 		addresses,
 		paths: {
 			rootDir: paths.rootDir,
@@ -24622,10 +24931,6 @@ const CANVAS_CAPABILITY_TTL_MS = 10 * 6e4;
 //#region src/canvas-host/a2ui.ts
 const CANVAS_HOST_PATH = "/__fased__/canvas";
 
-//#endregion
-//#region src/wallet/signer-network-admin.ts
-const NETWORK_ADMIN_MAX_OUTPUT_BYTES = 256 * 1024;
-
 //#endregion
 //#region src/federation/auto-connect.ts
 const DEFAULT_RENEW_INTERVAL_MS = 2700 * 1e3;
@@ -28603,27 +28908,27 @@ function createOutboundSendDepsFromCliSource(deps) {
 function createDefaultDeps() {
 	return {
 		sendMessageWhatsApp: async (...args) => {
-			const { sendMessageWhatsApp } = await import("./web-C_AH5PyB.js");
+			const { sendMessageWhatsApp } = await import("./web-DGWi7i3B.js");
 			return await sendMessageWhatsApp(...args);
 		},
 		sendMessageTelegram: async (...args) => {
-			const { sendMessageTelegram } = await import("./send-q9HXrSwK.js").then((n) => n.c);
+			const { sendMessageTelegram } = await import("./send-DWKm6yay.js").then((n) => n.c);
 			return await sendMessageTelegram(...args);
 		},
 		sendMessageDiscord: async (...args) => {
-			const { sendMessageDiscord } = await import("./send-DCO441U7.js").then((n) => n.t);
+			const { sendMessageDiscord } = await import("./send-BXBS_mRK.js").then((n) => n.t);
 			return await sendMessageDiscord(...args);
 		},
 		sendMessageSlack: async (...args) => {
-			const { sendMessageSlack } = await import("./send-gDoGA-7e.js").then((n) => n.n);
+			const { sendMessageSlack } = await import("./send-Di1Jit3L.js").then((n) => n.n);
 			return await sendMessageSlack(...args);
 		},
 		sendMessageSignal: async (...args) => {
-			const { sendMessageSignal } = await import("./send-B6KkGKZD.js").then((n) => n.i);
+			const { sendMessageSignal } = await import("./send-D1j12ZgX.js").then((n) => n.i);
 			return await sendMessageSignal(...args);
 		},
 		sendMessageIMessage: async (...args) => {
-			const { sendMessageIMessage } = await import("./send-CFzGKJXo.js").then((n) => n.n);
+			const { sendMessageIMessage } = await import("./send-D-HfKQZm.js").then((n) => n.n);
 			return await sendMessageIMessage(...args);
 		}
 	};
@@ -30770,7 +31075,7 @@ const log$17 = createSubsystemLogger("model-catalog");
 let modelCatalogPromise = null;
 let hasLoggedModelCatalogError = false;
 let hasLoggedProviderCatalogError = false;
-const defaultImportPiSdk = () => import("./pi-model-discovery-BX_JLcEJ.js").then((n) => n.a);
+const defaultImportPiSdk = () => import("./pi-model-discovery-BHNVyRny.js").then((n) => n.a);
 let importPiSdk = defaultImportPiSdk;
 const CODEX_PROVIDER = "openai-codex";
 const OPENAI_PROVIDER = "openai";
@@ -36611,7 +36916,7 @@ function isModuleNotFoundError(err) {
 }
 async function loadPwAiModule(mode) {
 	try {
-		return await import("./pw-ai-DlxqX6Es.js");
+		return await import("./pw-ai-DZYLDC-S.js");
 	} catch (err) {
 		if (mode === "soft") return null;
 		if (isModuleNotFoundError(err)) return null;
@@ -37005,11 +37310,11 @@ function createProfileContext(opts, profile) {
 		const userDataDir = resolveFasedAgentUserDataDir(profile.name);
 		const profileState = getProfileState();
 		if (await isHttpReachable(300) && !profileState.running) try {
-			await (await import("./pw-ai-DlxqX6Es.js")).closePlaywrightBrowserConnection();
+			await (await import("./pw-ai-DZYLDC-S.js")).closePlaywrightBrowserConnection();
 		} catch {}
 		if (profileState.running) await stopRunningBrowser();
 		try {
-			await (await import("./pw-ai-DlxqX6Es.js")).closePlaywrightBrowserConnection();
+			await (await import("./pw-ai-DZYLDC-S.js")).closePlaywrightBrowserConnection();
 		} catch {}
 		if (!fs.existsSync(userDataDir)) return {
 			moved: false,
@@ -46373,7 +46678,7 @@ function parseDeliveryParam(params) {
 const DEFAULT_ADAPTER = { supportsComponentsV2: false };
 async function loadChannelMessageAdapter(channel) {
 	if (channel === "discord") {
-		const { discordChannelMessageAdapter } = await import("./channel-adapters.discord-BS4S4Svh.js");
+		const { discordChannelMessageAdapter } = await import("./channel-adapters.discord-DSiR4X2Y.js");
 		return discordChannelMessageAdapter;
 	}
 	return DEFAULT_ADAPTER;
@@ -47349,7 +47654,7 @@ async function resolveSlackChannelType(params) {
 		return "unknown";
 	}
 	try {
-		const { createSlackWebClient } = await import("./client-pI228AVT.js").then((n) => n.t);
+		const { createSlackWebClient } = await import("./client-DLY-kWF_.js").then((n) => n.t);
 		const channel = (await createSlackWebClient(token).conversations.info({ channel: channelId })).channel;
 		const type = channel?.is_im ? "dm" : channel?.is_mpim ? "group" : "channel";
 		SLACK_CHANNEL_TYPE_CACHE.set(`${account.accountId}:${channelId}`, type);
@@ -49157,21 +49462,17 @@ function resolveWalletActionSelection(params) {
 			providerId: params.providerId,
 			env
 		});
-		else if (registry.defaultWalletId) {
-			const fallback = registry.wallets.find((entry) => entry.id === registry.defaultWalletId);
-			selection = fallback ? {
-				walletId: fallback.id,
-				walletName: fallback.name,
-				providerId: fallback.providerId,
-				source: "fallback"
-			} : { source: "none" };
-		} else selection = { source: "none" };
+		else selection = resolveWalletSelection({
+			agentId: params.agentId,
+			skillWalletId: params.skillWalletId,
+			env
+		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "wallet selection failed";
 		if (message.includes("ambiguous")) throw new WalletActionSelectionError("wallet_ambiguous", message);
 		throw new WalletActionSelectionError("wallet_not_found", message);
 	}
-	if (!selection.walletId) throw new WalletActionSelectionError("wallet_handle_required", "Agent wallet handle, walletId, or default Agent wallet required");
+	if (!selection.walletId) throw new WalletActionSelectionError("wallet_handle_required", "Select an Agent wallet: use an explicit wallet, skill override, Agent assignment, or Default Agent wallet fallback");
 	const wallet = registry.wallets.find((entry) => entry.id === selection.walletId);
 	if (!wallet) throw new WalletActionSelectionError("wallet_not_found", `wallet not found: ${selection.walletId}`);
 	if (params.providerId && wallet.providerId !== params.providerId) throw new WalletActionSelectionError("wallet_not_found", `wallet ${wallet.name} (${wallet.id}) belongs to provider ${wallet.providerId}, not ${params.providerId}`);
@@ -58808,11 +59109,13 @@ function createWalletActionTool(opts) {
 			const scheduled = action === "schedule_plan";
 			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
 			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
+			const skillWalletId = permissions?.walletIds?.length === 1 ? permissions.walletIds[0] : void 0;
 			const selection = resolveAgentWalletSelection({
 				config: cfg,
 				walletHandle,
 				walletId,
 				agentId: requesterAgentId ?? ownerAgentId ?? void 0,
+				skillWalletId,
 				env: process.env
 			});
 			const rpcUrl = resolveScopedRpcUrlForWallet({
@@ -59887,7 +60190,7 @@ function createWalletTool(opts) {
 	return {
 		label: "Wallet",
 		name: "wallet",
-		description: "Query wallet status/list/balance/assets/address and prepare/send policy-limited Solana transactions via configured wallet provider. If the user asks for one exact @wallet handle or one external Solana address, call only that exact read action; do not also call balances/list. Use action=\"list\" to list local wallets with handles and action=\"balances\" only when the user asks for every/all local wallet balances. Use walletHandle=\"@wallet:<walletId>\" to select exact local wallets for read-only balance/assets/status/address and risky actions. Use action=\"assets\" for all visible Solana native and SPL balances, or address=\"<solana-address>\" for read-only external Solana balance/assets. For address/balance reads, omit chain when the user does not specify it; the tool returns the available Solana address or balance set. Risky prepare/send actions require an Agent wallet via walletHandle, structured walletId, or default Agent wallet. For normal SOL amounts such as 0.1, pass amountFormat=\"human\"; decimal amounts without amountFormat are treated as human units. Destination wallet handles like @wallet:vault are resolved to receive addresses.",
+		description: "Query wallet status/list/balance/assets/address and prepare/send policy-limited Solana transactions via configured wallet provider. If the user asks for one exact @wallet handle or one external Solana address, call only that exact read action; do not also call balances/list. Use action=\"list\" to list local wallets with handles and action=\"balances\" only when the user asks for every/all local wallet balances. Use walletHandle=\"@wallet:<walletId>\" to select exact local wallets for read-only balance/assets/status/address and risky actions. Use action=\"assets\" for all visible Solana native and SPL balances, or address=\"<solana-address>\" for read-only external Solana balance/assets. For address/balance reads, omit chain when the user does not specify it; the tool returns the available Solana address or balance set. Risky prepare/send actions use explicit wallet, skill override, Agent assignment, then the optional Default Agent wallet fallback. For normal SOL amounts such as 0.1, pass amountFormat=\"human\"; decimal amounts without amountFormat are treated as human units. Destination wallet handles like @wallet:vault are resolved to receive addresses.",
 		parameters: WalletToolSchema,
 		execute: async (_toolCallId, args) => {
 			if (!access.ok) {
@@ -59911,6 +60214,9 @@ function createWalletTool(opts) {
 			const explicitWalletId = readStringParam(params, "walletId");
 			const selectedWalletId = (explicitWalletHandle ? parseWalletHandle(explicitWalletHandle) : void 0) ?? explicitWalletId;
 			const explicitWalletName = readStringParam(params, "walletName");
+			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
+			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
+			const skillWalletId = permissions?.walletIds?.length === 1 ? permissions.walletIds[0] : void 0;
 			const walletSelection = riskyWalletAction ? resolveAgentWalletSelection({
 				config: cfg,
 				providerId: explicitProviderId,
@@ -59918,6 +60224,7 @@ function createWalletTool(opts) {
 				walletId: explicitWalletId,
 				walletName: explicitWalletName,
 				agentId: requesterAgentId ?? ownerAgentId ?? void 0,
+				skillWalletId,
 				env: process.env
 			}) : resolveWalletSelection({
 				providerId: explicitProviderId,
@@ -60134,10 +60441,9 @@ function createWalletTool(opts) {
 				walletName: walletSelection.walletName
 			};
 			if (chain === "solana" && payload.program) assertValidSolanaAddress(payload.program, "SPL mint address");
-			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
 			await enforceWalletSkillPolicy({
 				cfg,
-				permissions: readSkillWalletActionPermissions(cfg, requesterSkillId),
+				permissions,
 				requesterAgentId,
 				requesterSkillId,
 				action,
@@ -73974,7 +74280,7 @@ async function resolveSlackNames(params) {
 	});
 	const token = account.config.userToken?.trim() || account.botToken?.trim();
 	if (!token) return /* @__PURE__ */ new Map();
-	const { resolveSlackUserAllowlist } = await import("./resolve-users-DN9VQBwv.js").then((n) => n.n);
+	const { resolveSlackUserAllowlist } = await import("./resolve-users-Bk_ss2vC.js").then((n) => n.n);
 	return mapResolvedAllowlistNames(await resolveSlackUserAllowlist({
 		token,
 		entries: params.entries
@@ -73986,7 +74292,7 @@ async function resolveDiscordNames(params) {
 		accountId: params.accountId
 	}).token?.trim();
 	if (!token) return /* @__PURE__ */ new Map();
-	const { resolveDiscordUserAllowlist } = await import("./resolve-users-V6dHh_2B.js").then((n) => n.n);
+	const { resolveDiscordUserAllowlist } = await import("./resolve-users-IevCOk4W.js").then((n) => n.n);
 	return mapResolvedAllowlistNames(await resolveDiscordUserAllowlist({
 		token,
 		entries: params.entries
@@ -84290,7 +84596,7 @@ async function recordLoopOutcome(args) {
 	if (!args.ctx?.sessionKey) return;
 	try {
 		const { getDiagnosticSessionState } = await import("./diagnostic-session-state-DqgfGYqZ.js").then((n) => n.n);
-		const { recordToolCallOutcome } = await import("./tool-loop-detection-Bp8bPJLs.js");
+		const { recordToolCallOutcome } = await import("./tool-loop-detection-sDZl27w7.js");
 		recordToolCallOutcome(getDiagnosticSessionState({
 			sessionKey: args.ctx.sessionKey,
 			sessionId: args.ctx?.agentId
@@ -84311,8 +84617,8 @@ async function runBeforeToolCallHook(args) {
 	const params = args.params;
 	if (args.ctx?.sessionKey) {
 		const { getDiagnosticSessionState } = await import("./diagnostic-session-state-DqgfGYqZ.js").then((n) => n.n);
-		const { logToolLoopAction } = await import("./diagnostic-DLL_zekv.js").then((n) => n.n);
-		const { detectToolCallLoop, recordToolCall } = await import("./tool-loop-detection-Bp8bPJLs.js");
+		const { logToolLoopAction } = await import("./diagnostic-sYs6Agr-.js").then((n) => n.n);
+		const { detectToolCallLoop, recordToolCall } = await import("./tool-loop-detection-sDZl27w7.js");
 		const sessionState = getDiagnosticSessionState({
 			sessionKey: args.ctx.sessionKey,
 			sessionId: args.ctx?.agentId
@@ -87706,7 +88012,7 @@ const handleSessionCommand = async (params, allowTextCommands) => {
 			reply: { text: resolveSessionCommandUsage() }
 		};
 	}
-	const { setThreadBindingIdleTimeoutBySessionKey, setThreadBindingMaxAgeBySessionKey } = await import("./thread-bindings.lifecycle-QbkNl-m6.js").then((n) => n.i);
+	const { setThreadBindingIdleTimeoutBySessionKey, setThreadBindingMaxAgeBySessionKey } = await import("./thread-bindings.lifecycle-Y9T3CQGf.js").then((n) => n.i);
 	const updatedBindings = action === SESSION_ACTION_IDLE ? setThreadBindingIdleTimeoutBySessionKey({
 		targetSessionKey: binding.targetSessionKey,
 		accountId,
@@ -97024,7 +97330,7 @@ const discordMessageActions = {
 		return null;
 	},
 	handleAction: async ({ action, params, cfg, accountId, requesterSenderId, toolContext, mediaLocalRoots }) => {
-		const { handleDiscordMessageAction } = await import("./handle-action-hvwapMKg.js");
+		const { handleDiscordMessageAction } = await import("./handle-action-CRdM6B-8.js");
 		return await handleDiscordMessageAction({
 			action,
 			params,
@@ -97261,7 +97567,7 @@ const signalMessageActions = {
 //#region src/channels/plugins/actions/telegram.ts
 const providerId = "telegram";
 async function loadTelegramActionHandler() {
-	const { handleTelegramAction } = await import("./telegram-actions-BwGBIVDE.js");
+	const { handleTelegramAction } = await import("./telegram-actions-Cewdga8H.js");
 	return handleTelegramAction;
 }
 function readTelegramSendParams(params) {
@@ -97431,7 +97737,7 @@ function createWhatsAppLoginTool() {
 			force: Type.Optional(Type.Boolean())
 		}),
 		execute: async (_toolCallId, args) => {
-			const { startWebLoginWithQr, waitForWebLogin } = await import("./login-qr-CGciBSNP.js");
+			const { startWebLoginWithQr, waitForWebLogin } = await import("./login-qr-CRueOKZK.js");
 			if ((args?.action ?? "start") === "wait") {
 				const result = await waitForWebLogin({ timeoutMs: typeof args.timeoutMs === "number" ? args.timeoutMs : void 0 });
 				return {
@@ -99671,7 +99977,7 @@ function buildPairingReply(params) {
 
 //#endregion
 //#region src/brand.ts
-const FASED_PRODUCT_VERSION = "0.1.67";
+const FASED_PRODUCT_VERSION = "0.1.69";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 
 //#endregion
@@ -103445,7 +103751,7 @@ async function auditTelegramGroupMembership(params) {
 		groups: [],
 		elapsedMs: Date.now() - started
 	};
-	const fetcher = params.proxyUrl ? (await import("./proxy-DWpYcsvR.js").then((n) => n.n)).makeProxyFetch(params.proxyUrl) : fetch;
+	const fetcher = params.proxyUrl ? (await import("./proxy-CLRUdShp.js").then((n) => n.n)).makeProxyFetch(params.proxyUrl) : fetch;
 	const { fetchWithTimeout } = await import("./fetch-timeout-l_6RdoMw.js").then((n) => n.r);
 	const base = `${TELEGRAM_API_BASE}/bot${token}`;
 	const groups = [];
@@ -103550,87 +103856,87 @@ const handleWhatsAppActionLazy = async (...args) => {
 	return handleWhatsAppAction(...args);
 };
 const auditDiscordChannelPermissionsLazy = async (...args) => {
-	const { auditDiscordChannelPermissions } = await import("./audit-C5d2z5U1.js").then((n) => n.t);
+	const { auditDiscordChannelPermissions } = await import("./audit-CUULWG22.js").then((n) => n.t);
 	return auditDiscordChannelPermissions(...args);
 };
 const listDiscordDirectoryGroupsLiveLazy = async (...args) => {
-	const { listDiscordDirectoryGroupsLive } = await import("./directory-live-CSuYxdwk.js").then((n) => n.t);
+	const { listDiscordDirectoryGroupsLive } = await import("./directory-live-BXMpuYAF.js").then((n) => n.t);
 	return listDiscordDirectoryGroupsLive(...args);
 };
 const listDiscordDirectoryPeersLiveLazy = async (...args) => {
-	const { listDiscordDirectoryPeersLive } = await import("./directory-live-CSuYxdwk.js").then((n) => n.t);
+	const { listDiscordDirectoryPeersLive } = await import("./directory-live-BXMpuYAF.js").then((n) => n.t);
 	return listDiscordDirectoryPeersLive(...args);
 };
 const probeDiscordLazy = async (...args) => {
-	const { probeDiscord } = await import("./probe-BFroeK3g.js").then((n) => n.n);
+	const { probeDiscord } = await import("./probe-oVp12D6L.js").then((n) => n.n);
 	return probeDiscord(...args);
 };
 const resolveDiscordChannelAllowlistLazy = async (...args) => {
-	const { resolveDiscordChannelAllowlist } = await import("./resolve-channels-87LZrFk_.js").then((n) => n.n);
+	const { resolveDiscordChannelAllowlist } = await import("./resolve-channels-1HtDcMqh.js").then((n) => n.n);
 	return resolveDiscordChannelAllowlist(...args);
 };
 const resolveDiscordUserAllowlistLazy = async (...args) => {
-	const { resolveDiscordUserAllowlist } = await import("./resolve-users-V6dHh_2B.js").then((n) => n.n);
+	const { resolveDiscordUserAllowlist } = await import("./resolve-users-IevCOk4W.js").then((n) => n.n);
 	return resolveDiscordUserAllowlist(...args);
 };
 const sendMessageDiscordLazy = async (...args) => {
-	const { sendMessageDiscord } = await import("./send-DCO441U7.js").then((n) => n.t);
+	const { sendMessageDiscord } = await import("./send-BXBS_mRK.js").then((n) => n.t);
 	return sendMessageDiscord(...args);
 };
 const sendPollDiscordLazy = async (...args) => {
-	const { sendPollDiscord } = await import("./send-DCO441U7.js").then((n) => n.t);
+	const { sendPollDiscord } = await import("./send-BXBS_mRK.js").then((n) => n.t);
 	return sendPollDiscord(...args);
 };
 const monitorDiscordProviderLazy = async (...args) => {
-	const { monitorDiscordProvider } = await import("./monitor-CV1sr0p2.js");
+	const { monitorDiscordProvider } = await import("./monitor-xzVAPbg2.js");
 	return monitorDiscordProvider(...args);
 };
 const listSlackDirectoryGroupsLiveLazy = async (...args) => {
-	const { listSlackDirectoryGroupsLive } = await import("./directory-live-Dw7ZgC9_.js");
+	const { listSlackDirectoryGroupsLive } = await import("./directory-live-Rn1BzPof.js");
 	return listSlackDirectoryGroupsLive(...args);
 };
 const listSlackDirectoryPeersLiveLazy = async (...args) => {
-	const { listSlackDirectoryPeersLive } = await import("./directory-live-Dw7ZgC9_.js");
+	const { listSlackDirectoryPeersLive } = await import("./directory-live-Rn1BzPof.js");
 	return listSlackDirectoryPeersLive(...args);
 };
 const probeSlackLazy = async (...args) => {
-	const { probeSlack } = await import("./probe-CJb5uR8B.js");
+	const { probeSlack } = await import("./probe-BM7Oe40M.js");
 	return probeSlack(...args);
 };
 const resolveSlackChannelAllowlistLazy = async (...args) => {
-	const { resolveSlackChannelAllowlist } = await import("./resolve-channels-_-nV-EK2.js").then((n) => n.n);
+	const { resolveSlackChannelAllowlist } = await import("./resolve-channels-CU72Qh2j.js").then((n) => n.n);
 	return resolveSlackChannelAllowlist(...args);
 };
 const resolveSlackUserAllowlistLazy = async (...args) => {
-	const { resolveSlackUserAllowlist } = await import("./resolve-users-DN9VQBwv.js").then((n) => n.n);
+	const { resolveSlackUserAllowlist } = await import("./resolve-users-Bk_ss2vC.js").then((n) => n.n);
 	return resolveSlackUserAllowlist(...args);
 };
 const sendMessageSlackLazy = async (...args) => {
-	const { sendMessageSlack } = await import("./send-gDoGA-7e.js").then((n) => n.n);
+	const { sendMessageSlack } = await import("./send-Di1Jit3L.js").then((n) => n.n);
 	return sendMessageSlack(...args);
 };
 const monitorSlackProviderLazy = async (...args) => {
-	const { monitorSlackProvider } = await import("./slack-DSC6T2KW.js");
+	const { monitorSlackProvider } = await import("./slack-CkIRVDUK.js");
 	return monitorSlackProvider(...args);
 };
 const handleSlackActionLazy = async (...args) => {
-	const { handleSlackAction } = await import("./slack-actions-DhbMcp8M.js");
+	const { handleSlackAction } = await import("./slack-actions-BzUEszJa.js");
 	return handleSlackAction(...args);
 };
 const probeTelegramLazy = async (...args) => {
-	const { probeTelegram } = await import("./probe-l_whvGLY.js");
+	const { probeTelegram } = await import("./probe-CMPksimh.js");
 	return probeTelegram(...args);
 };
 const sendMessageTelegramLazy = async (...args) => {
-	const { sendMessageTelegram } = await import("./send-q9HXrSwK.js").then((n) => n.c);
+	const { sendMessageTelegram } = await import("./send-DWKm6yay.js").then((n) => n.c);
 	return sendMessageTelegram(...args);
 };
 const sendPollTelegramLazy = async (...args) => {
-	const { sendPollTelegram } = await import("./send-q9HXrSwK.js").then((n) => n.c);
+	const { sendPollTelegram } = await import("./send-DWKm6yay.js").then((n) => n.c);
 	return sendPollTelegram(...args);
 };
 const monitorTelegramProviderLazy = async (...args) => {
-	const { monitorTelegramProvider } = await import("./monitor-DrTy_4CL.js");
+	const { monitorTelegramProvider } = await import("./monitor-WXdn4mR-.js");
 	return monitorTelegramProvider(...args);
 };
 let webOutboundPromise = null;
@@ -103639,23 +103945,23 @@ let webLoginQrPromise = null;
 let webChannelPromise = null;
 let whatsappActionsPromise = null;
 function loadWebOutbound() {
-	webOutboundPromise ??= import("./outbound-BgVDdHxx.js").then((n) => n.t);
+	webOutboundPromise ??= import("./outbound-zB6llMGW.js").then((n) => n.t);
 	return webOutboundPromise;
 }
 function loadWebLogin() {
-	webLoginPromise ??= import("./login-Ca583Okc.js").then((n) => n.n);
+	webLoginPromise ??= import("./login-D7WnK8-P.js").then((n) => n.n);
 	return webLoginPromise;
 }
 function loadWebLoginQr() {
-	webLoginQrPromise ??= import("./login-qr-CGciBSNP.js");
+	webLoginQrPromise ??= import("./login-qr-CRueOKZK.js");
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-C_AH5PyB.js");
+	webChannelPromise ??= import("./web-DGWi7i3B.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {
-	whatsappActionsPromise ??= import("./whatsapp-actions-Bj_rOncr.js");
+	whatsappActionsPromise ??= import("./whatsapp-actions-Blu9-eX-.js");
 	return whatsappActionsPromise;
 }
 function createPluginRuntime(options = {}) {
@@ -114229,7 +114535,7 @@ function createOpenAIReasoningEffortWrapper(baseStreamFn, reasoningEffort) {
 function createCodexDefaultTransportWrapper(baseStreamFn) {
 	const underlying = baseStreamFn ?? streamSimple;
 	return (model, context, options) => {
-		if (typeof process !== "undefined" && process.versions?.node) globalThis.WebSocket = WebSocket$1;
+		if (typeof process !== "undefined" && process.versions?.node) globalThis.WebSocket = WebSocket;
 		return underlying(model, context, {
 			...options,
 			transport: options?.transport ?? "auto"