@fased/fased 0.1.67 → 0.1.69

package/dist/wallet/local-socket-signer-protocol.js

@@ -36,14 +36,18 @@ const SignerPolicyAssetV2Schema = Type.Object({
 	asset: Type.String(),
 	destinations: Type.Array(Type.String()),
 	maxPerTx: Type.String(),
-	maxDaily: Type.String()
+	maxDaily: Type.String(),
+	reviewedDestinations: Type.Optional(Type.Boolean()),
+	typedSatDestinations: Type.Optional(Type.Boolean())
 }, { additionalProperties: false });
 const SignerPolicyInputV2Schema = Type.Object({
 	walletId: Type.Optional(Type.String()),
 	role: SignerWalletRoleSchema,
 	version: Type.Optional(Type.Integer({ minimum: 0 })),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.Optional(Type.String())
 }, { additionalProperties: false });
@@ -51,8 +55,10 @@ const LocalSocketSignerPolicyV2Schema = Type.Object({
 	walletId: Type.String(),
 	role: SignerWalletRoleSchema,
 	version: Type.Integer({ minimum: 1 }),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" })
 }, { additionalProperties: false });
@@ -238,10 +244,13 @@ const SignerSolanaTransactionEnvelopeV2Schema = Type.Object({
 	}),
 	submission: Type.Literal("rpc")
 }, { additionalProperties: false });
-const SignerReviewAuthorizationV2Schema = Type.Object({
+const SignerReviewAuthorizationV2Schema = Type.Union([Type.Object({
 	type: Type.Literal("webauthn"),
 	proof: Type.Object({ proofId: Type.String({ minLength: 1 }) }, { additionalProperties: false })
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	type: Type.Literal("control-ui"),
+	proof: Type.Object({ proofId: Type.String({ pattern: "^[0-9a-f]{64}$" }) }, { additionalProperties: false })
+}, { additionalProperties: false })]);
 const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Type.Array(Type.Object({
 	orderId: Type.String({ minLength: 1 }),
 	orderState: Type.String({ minLength: 1 }),
@@ -266,10 +275,17 @@ const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Typ
 		program: Type.String({ minLength: 1 })
 	}, { additionalProperties: false }))
 }, { additionalProperties: false })) }, { additionalProperties: false });
-const SignerWalletPolicyCreateV2Schema = Type.Object({
+const SignerRoleBaselineV1Schema = Type.Object({
+	version: Type.Literal(1),
+	role: SignerWalletRoleSchema
+}, { additionalProperties: false });
+const SignerWalletPolicyCreateV2Schema = Type.Union([Type.Object({
 	expectedPolicyVersion: Type.Literal(0),
 	policy: SignerPolicyInputV2Schema
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	expectedPolicyVersion: Type.Literal(0),
+	baseline: SignerRoleBaselineV1Schema
+}, { additionalProperties: false })]);
 const SignerOperationLookupV2Schema = Type.Object({ requestId: Type.String() }, { additionalProperties: false });
 const SignerSatLookupBindingRequestV2Schema = Type.Object({
 	cycleId: Type.String({ pattern: "^(0|[1-9][0-9]*)$" }),
@@ -292,6 +308,16 @@ const LocalSocketSignerSatLookupBindingV2Schema = Type.Object({
 		Type.Literal("unknown")
 	]))
 }, { additionalProperties: false });
+const LocalSocketSignerNetworkSummaryV2Schema = Type.Object({
+	walletId: Type.String({
+		minLength: 1,
+		maxLength: 64
+	}),
+	configured: Type.Boolean(),
+	version: Type.Integer({ minimum: 0 }),
+	hash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({ op: Type.Literal("health") }, { additionalProperties: false }),
 	Type.Object({ op: Type.Literal("v2.capabilities") }, { additionalProperties: false }),
@@ -303,6 +329,21 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.policy.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.network.get"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.network.bootstrap"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedVersion: Type.Integer({ minimum: 0 }),
+			primaryRpcUrl: Type.String({
+				minLength: 1,
+				maxLength: 2048
+			})
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.policy.put"),
 		walletId: Type.String(),
@@ -323,6 +364,18 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.wallet.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.wallet.readiness"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.policy.activateBaseline"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedPolicyVersion: Type.Integer({ minimum: 1 }),
+			baseline: SignerRoleBaselineV1Schema
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.create"),
 		walletId: Type.String(),
@@ -331,21 +384,30 @@ const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({
 		op: Type.Literal("v2.wallet.import"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.importLegacy"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String(),
 			passphrasePath: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String(),
+			passphrasePath: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.reencrypt"),
@@ -625,6 +687,27 @@ const LocalSocketSignerWalletPolicyResultV2Schema = Type.Object({
 	wallet: LocalSocketSignerWalletV2Schema,
 	policy: LocalSocketSignerPolicyV2Schema
 }, { additionalProperties: false });
+const LocalSocketSignerWalletReadinessV2Schema = Type.Object({
+	walletId: Type.String({ minLength: 1 }),
+	publicKey: Type.String({ minLength: 1 }),
+	walletVersion: Type.Optional(Type.Integer({ minimum: 1 })),
+	role: SignerWalletRoleSchema,
+	baselineVersion: Type.Integer({ minimum: 0 }),
+	policyVersion: Type.Integer({ minimum: 1 }),
+	policyHash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" }),
+	networkVersion: Type.Integer({ minimum: 0 }),
+	networkHash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	keyReady: Type.Boolean(),
+	policyReady: Type.Boolean(),
+	networkReady: Type.Boolean(),
+	operationLane: Type.Union([
+		Type.Literal("blocked"),
+		Type.Literal("agent-reviewed-and-autonomous"),
+		Type.Literal("mining-typed-sat"),
+		Type.Literal("vault-reviewed-only")
+	]),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 function isPositiveUnsignedInteger(value) {
 	return typeof value === "string" && /^[1-9][0-9]*$/.test(value);
 }
@@ -665,11 +748,15 @@ function validateLocalSocketSignerResult(op, result) {
 		case "health":
 		case "v2.capabilities": return Value.Check(LocalSocketSignerHealthResultSchema, result);
 		case "v2.jupiter.trigger.history": return Value.Check(LocalSocketSignerJupiterTriggerHistoryV2Schema, result);
+		case "v2.network.get":
+		case "v2.network.bootstrap": return Value.Check(LocalSocketSignerNetworkSummaryV2Schema, result);
 		case "v2.policy.get":
 		case "v2.policy.put":
-		case "v2.policy.tighten": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
+		case "v2.policy.tighten":
+		case "v2.policy.activateBaseline": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
 		case "v2.wallet.get":
 		case "v2.wallet.reencrypt": return Value.Check(LocalSocketSignerWalletV2Schema, result);
+		case "v2.wallet.readiness": return Value.Check(LocalSocketSignerWalletReadinessV2Schema, result);
 		case "v2.wallet.create":
 		case "v2.wallet.import":
 		case "v2.wallet.importLegacy": return Value.Check(LocalSocketSignerWalletPolicyResultV2Schema, result);

package/dist/wallet/mining-wallet-retirement.js

@@ -0,0 +1,256 @@
+import { resolveStateDir } from "../config/paths.js";
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+
+//#region src/wallet/mining-wallet-retirement.ts
+function record(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function decimal(value, field) {
+	const normalized = typeof value === "string" ? value.trim() : "";
+	if (!/^\d+$/u.test(normalized)) {
+		throw new Error(`Mining retirement cannot verify ${field}`);
+	}
+	return normalized;
+}
+function nonNegativeCount(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function sha256(raw) {
+	return `sha256:${createHash("sha256").update(raw).digest("hex")}`;
+}
+function base64UrlByteLength(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/u.test(value)) {
+		return -1;
+	}
+	try {
+		return Buffer.from(value, "base64url").byteLength;
+	} catch {
+		return -1;
+	}
+}
+function normalizedWalletStateKey(walletId) {
+	return walletId.replace(/[^a-zA-Z0-9._-]+/gu, "_") || "unattached";
+}
+function readStrictJSONFile(filePath, maxBytes) {
+	const info = fs.lstatSync(filePath);
+	if (!info.isFile() || info.isSymbolicLink() || info.size <= 0 || info.size > maxBytes) {
+		throw new Error(`Mining retirement evidence file is invalid: ${filePath}`);
+	}
+	const raw = fs.readFileSync(filePath);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw.toString("utf8"));
+	} catch {
+		throw new Error(`Mining retirement evidence file is not valid JSON: ${filePath}`);
+	}
+	const value = record(parsed);
+	if (!value) {
+		throw new Error(`Mining retirement evidence file must contain one JSON object: ${filePath}`);
+	}
+	return {
+		raw,
+		value
+	};
+}
+function unwrapMiningGatewayPayload(value) {
+	let current = value;
+	for (let index = 0; index < 4; index += 1) {
+		const currentRecord = record(current);
+		if (!currentRecord) {
+			break;
+		}
+		if (record(currentRecord.status)) {
+			return record(currentRecord.status);
+		}
+		if (!("payload" in currentRecord)) {
+			return currentRecord;
+		}
+		current = currentRecord.payload;
+	}
+	return record(current) ?? {};
+}
+function verifyMiningRecoveryPackage(params) {
+	const recoveryFile = params.recoveryFile.trim();
+	if (!path.isAbsolute(recoveryFile) || path.resolve(recoveryFile) !== recoveryFile) {
+		throw new Error("--recovery-file must be an absolute clean path");
+	}
+	const info = fs.lstatSync(recoveryFile);
+	if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.mode & 63) {
+		throw new Error("Mining recovery package must be one owner-only regular non-symlink file");
+	}
+	if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
+		throw new Error("Mining recovery package must be owned by the current terminal user");
+	}
+	const { raw, value } = readStrictJSONFile(recoveryFile, 16 * 1024);
+	const kdf = record(value.kdf);
+	const encryption = record(value.encryption);
+	if (value.kind !== "fased-signer-wallet-recovery" || value.version !== 1 || value.walletId !== params.walletId || value.role !== "mining" || value.publicKey !== params.publicKey || typeof value.createdAt !== "string" || !Number.isFinite(Date.parse(value.createdAt)) || kdf?.name !== "argon2id" || kdf.memoryKiB !== 64 * 1024 || kdf.iterations !== 3 || kdf.parallelism !== 1 || base64UrlByteLength(kdf.salt) !== 16 || encryption?.name !== "aes-256-gcm" || base64UrlByteLength(encryption.nonce) !== 12 || base64UrlByteLength(encryption.ciphertext) !== 80) {
+		throw new Error("Encrypted recovery package does not match the source Mining wallet");
+	}
+	return {
+		packageHash: sha256(raw),
+		walletId: params.walletId,
+		publicKey: params.publicKey,
+		role: "mining"
+	};
+}
+function buildMiningRetirementEvidence(params) {
+	const env = params.env ?? process.env;
+	const status = unwrapMiningGatewayPayload(params.liveStatus);
+	if (typeof status.retirementGatewayError === "string") {
+		throw new Error(`Could not stop and inspect Mining: ${status.retirementGatewayError}`);
+	}
+	if (status.walletId !== params.walletId && status.walletId !== params.signerWalletId) {
+		throw new Error("Live Mining status is not bound to the source wallet");
+	}
+	if (status.statusFresh === false || status.degraded === true) {
+		throw new Error("Live Mining status is degraded; normal retirement refuses unverifiable state");
+	}
+	if (status.running === true || status.drainOnly === true || status.enabledWanted === true) {
+		throw new Error("Mining is still running or draining; retry retirement after Clearing finishes");
+	}
+	const workers = record(status.workers) ?? {};
+	if (Object.values(workers).some((worker) => record(worker)?.running === true)) {
+		throw new Error("A Mining worker is still running");
+	}
+	const solBalanceLamports = decimal(status.currentSolBalanceLamports, "live SOL balance");
+	const signerBalance = decimal(params.signerSolBalanceLamports, "signer SOL balance");
+	if (solBalanceLamports !== signerBalance) {
+		throw new Error("Live Mining and signer SOL balance observations disagree");
+	}
+	const satBalanceRaw = decimal(status.currentSatBalanceRaw, "live SAT balance");
+	for (const [field, value] of [
+		["funded Mining capital", status.currentCapitalFundedLamports],
+		["locked Mining capital", status.currentCapitalLockedLamports],
+		["free Mining capital", status.currentCapitalFreeLamports]
+	]) {
+		if (decimal(value, field) !== "0") {
+			throw new Error(`${field} must be zero before normal Mining retirement`);
+		}
+	}
+	if (nonNegativeCount(status.currentCapitalPendingCycleCount) !== 0 || nonNegativeCount(record(status.claimBacklog)?.total) !== 0 || nonNegativeCount(status.missingCycleCount) !== 0 || Array.isArray(status.pendingCycleIds) && status.pendingCycleIds.length > 0 || status.exactPendingCycleId != null) {
+		throw new Error("Mining still has pending cycles, claims, or reconciliation gaps");
+	}
+	const walletStateDir = path.join(resolveStateDir(env), "sat-mining", "wallets", normalizedWalletStateKey(params.walletId));
+	const runtime = readStrictJSONFile(path.join(walletStateDir, "runtime-store.json"), 16 * 1024 * 1024);
+	if (runtime.value.enabledWanted === true) {
+		throw new Error("Durable Mining state still permits new jobs");
+	}
+	const durableWorkers = record(runtime.value.workers) ?? {};
+	if (Object.values(durableWorkers).some((worker) => record(worker)?.running === true)) {
+		throw new Error("Durable Mining state still records a running worker");
+	}
+	if (Array.isArray(runtime.value.pendingPlannerCycles) && runtime.value.pendingPlannerCycles.length) {
+		throw new Error("Durable Mining planner work remains pending");
+	}
+	if (Array.isArray(runtime.value.claimBacklog) && runtime.value.claimBacklog.length) {
+		throw new Error("Durable Mining claim backlog remains pending");
+	}
+	const lastKnown = record(runtime.value.lastKnownStatus);
+	if (!lastKnown || lastKnown.walletId !== params.walletId && lastKnown.walletId !== params.signerWalletId) {
+		throw new Error("Durable Mining balance state is missing or belongs to another wallet");
+	}
+	if (decimal(lastKnown.currentCapitalFundedLamports, "durable funded capital") !== "0" || decimal(lastKnown.currentCapitalLockedLamports, "durable locked capital") !== "0" || decimal(lastKnown.currentCapitalFreeLamports, "durable free capital") !== "0" || nonNegativeCount(lastKnown.currentCapitalPendingCycleCount) !== 0 || lastKnown.exactPendingCycleId != null) {
+		throw new Error("Durable Mining state still contains pending capital or protocol work");
+	}
+	const ledgerPath = path.join(walletStateDir, "submission-ledger.json");
+	let ledgerRaw = Buffer.from("{\"version\":1,\"records\":{}}\n", "utf8");
+	let ledger = {
+		version: 1,
+		records: {}
+	};
+	if (fs.existsSync(ledgerPath)) {
+		const loaded = readStrictJSONFile(ledgerPath, 16 * 1024 * 1024);
+		ledgerRaw = loaded.raw;
+		ledger = loaded.value;
+	}
+	if (ledger.version !== 1 || !record(ledger.records)) {
+		throw new Error("Durable Mining submission ledger is invalid");
+	}
+	const pendingByKind = {
+		commit: 0,
+		reveal: 0,
+		settlement: 0,
+		claim: 0,
+		cleanup: 0,
+		alt: 0
+	};
+	for (const rawEntry of Object.values(record(ledger.records))) {
+		const entry = record(rawEntry);
+		if (!entry) {
+			throw new Error("Durable Mining submission ledger contains an invalid record");
+		}
+		const state = typeof entry.state === "string" ? entry.state : "";
+		if (![
+			"prepared",
+			"reserved",
+			"broadcast",
+			"unknown"
+		].includes(state)) {
+			continue;
+		}
+		const action = typeof entry.action === "string" ? entry.action.toLowerCase() : "";
+		if (action.includes("commit")) {
+			pendingByKind.commit += 1;
+		} else if (action.includes("reveal") || action.includes("submit")) {
+			pendingByKind.reveal += 1;
+		} else if (action.includes("settle") || action.includes("score") || action.includes("distribute") || action.includes("finalize")) {
+			pendingByKind.settlement += 1;
+		} else if (action.includes("claim")) {
+			pendingByKind.claim += 1;
+		} else if (action.includes("lookup") || action.includes("alt")) {
+			pendingByKind.alt += 1;
+		} else {
+			pendingByKind.cleanup += 1;
+		}
+	}
+	if (Object.values(pendingByKind).some((count) => count > 0)) {
+		throw new Error("Reserved, broadcast, or unknown Mining submissions must be reconciled first");
+	}
+	const observedAt = typeof status.updatedAt === "string" ? status.updatedAt : typeof status.snapshotAt === "string" ? status.snapshotAt : typeof lastKnown.updatedAt === "string" ? lastKnown.updatedAt : "";
+	if (!observedAt || !Number.isFinite(Date.parse(observedAt))) {
+		throw new Error("Live Mining balance observation has no verifiable timestamp");
+	}
+	return {
+		version: 1,
+		walletId: params.signerWalletId,
+		publicKey: params.publicKey,
+		observedAt: new Date(observedAt).toISOString(),
+		newJobsStopped: true,
+		workersDrained: true,
+		clearingDrained: true,
+		submissionsReconciled: true,
+		pendingCommits: pendingByKind.commit,
+		pendingReveals: pendingByKind.reveal,
+		pendingSettlements: pendingByKind.settlement,
+		pendingClaims: pendingByKind.claim,
+		pendingCleanup: pendingByKind.cleanup,
+		pendingAltMutations: pendingByKind.alt,
+		solBalanceLamports,
+		satBalanceRaw,
+		runtimeStateHash: sha256(runtime.raw),
+		submissionLedgerHash: sha256(ledgerRaw)
+	};
+}
+function writeMiningRetirementReceipt(params) {
+	const root = path.join(resolveStateDir(params.env ?? process.env), "wallet-retirements");
+	fs.mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	const filePath = path.join(root, `${normalizedWalletStateKey(params.sourceWalletId)}.json`);
+	const tempPath = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	fs.writeFileSync(tempPath, `${JSON.stringify(params.receipt, null, 2)}\n`, {
+		encoding: "utf8",
+		flag: "wx",
+		mode: 384
+	});
+	fs.renameSync(tempPath, filePath);
+	fs.chmodSync(filePath, 384);
+	return filePath;
+}
+
+//#endregion
+export { buildMiningRetirementEvidence, verifyMiningRecoveryPackage, writeMiningRetirementReceipt };

package/dist/wallet/providers/local-socket-signer-adapter.js

@@ -14,11 +14,15 @@ const REQUIRED_PROTOCOL_V2_FEATURES = SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURE
 const SIGNER_SOCKET_TIMEOUT_MS = {
 	health: 2e3,
 	"v2.capabilities": 2e3,
+	"v2.network.get": 15e3,
+	"v2.network.bootstrap": 3e4,
 	"v2.jupiter.trigger.history": 3e4,
 	"v2.policy.get": 5e3,
 	"v2.policy.put": 5e3,
 	"v2.policy.tighten": 5e3,
+	"v2.policy.activateBaseline": 1e4,
 	"v2.wallet.get": 5e3,
+	"v2.wallet.readiness": 5e3,
 	"v2.wallet.create": 1e4,
 	"v2.wallet.import": 2e4,
 	"v2.wallet.importLegacy": 3e4,
@@ -227,6 +231,12 @@ var LocalSocketSignerAdapter = class {
 				provider: this.id,
 				configured: true,
 				checkedAt: new Date().toISOString(),
+				...details.webAuthn ? { nativeSignerApproval: {
+					configured: details.webAuthn.configured,
+					ready: details.webAuthn.ready,
+					credentialCount: details.webAuthn.credentialCount,
+					credentialVersion: details.webAuthn.credentialVersion
+				} } : {},
 				details: [
 					details?.details ?? "",
 					...!details?.details ? [

package/dist/wallet/signer-network-admin.js

@@ -1,10 +1,7 @@
-import { resolveLocalSignerControlSocketPath } from "./wallet-runtime-config.js";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { resolveLocalSignerSocketPath } from "./wallet-runtime-config.js";
+import { configureSignerOwnedWalletPrimaryRpc } from "./local-socket-signer-lifecycle.js";
 
 //#region src/wallet/signer-network-admin.ts
-const NETWORK_ADMIN_TIMEOUT_MS = 3e4;
-const NETWORK_ADMIN_MAX_OUTPUT_BYTES = 256 * 1024;
 function canonicalSignerWalletId(raw) {
 	const normalized = raw.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 	return normalized || "default";
@@ -47,62 +44,7 @@ function parseSignerNetworkSummary(raw, expectedWalletId) {
 		ready: record.ready
 	};
 }
-function redactSignerNetworkError(raw, secrets) {
-	let value = raw;
-	for (const secret of secrets.filter(Boolean).toSorted((a, b) => b.length - a.length)) {
-		value = value.split(secret).join("[redacted-rpc-url]");
-	}
-	value = value.replace(/https?:\/\/[^\s"'<>]+/gi, "[redacted-rpc-url]");
-	value = value.replace(/\b(api[_-]?key|access[_-]?token|token|key)=([^\s&"']+)/gi, "$1=[redacted]");
-	return value.trim().slice(0, 2e3) || "signer network administration failed";
-}
-function signerAdminEnvironment(env) {
-	const out = {};
-	for (const key of [
-		"HOME",
-		"PATH",
-		"TMPDIR",
-		"LANG",
-		"LC_ALL",
-		"TZ"
-	]) {
-		const value = String(env[key] ?? "").trim();
-		if (value) {
-			out[key] = value;
-		}
-	}
-	return out;
-}
-function runSignerAdmin(params) {
-	const child = spawnSync(params.command, params.args, {
-		input: params.input,
-		env: params.env,
-		encoding: "utf8",
-		timeout: NETWORK_ADMIN_TIMEOUT_MS,
-		maxBuffer: NETWORK_ADMIN_MAX_OUTPUT_BYTES,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	});
-	if (child.error || child.status !== 0) {
-		const detail = [
-			child.stderr,
-			child.stdout,
-			child.error?.message
-		].filter((part) => typeof part === "string" && part.trim().length > 0).join("\n");
-		throw new Error(redactSignerNetworkError(detail, params.secrets));
-	}
-	return child.stdout;
-}
-function assertReadyNetworkSummary(summary, previousVersion) {
-	if (!summary.configured || !summary.ready || !summary.hash || summary.version !== previousVersion + 1) {
-		throw new Error("signer network update did not acknowledge the exact next ready version");
-	}
-	return summary;
-}
-function configureSignerOwnedWalletNetwork(params) {
+async function configureSignerOwnedWalletNetwork(params) {
 	const env = params.env ?? process.env;
 	const walletId = canonicalSignerWalletId(params.walletId);
 	const primaryRpcUrl = params.primaryRpcUrl.trim();
@@ -111,61 +53,14 @@ function configureSignerOwnedWalletNetwork(params) {
 	if (!primaryRpcUrl) {
 		throw new Error("signer-owned wallet network requires a primary RPC URL");
 	}
-	const secrets = [
-		primaryRpcUrl,
-		executionFallbackRpcUrl,
-		verificationRpcUrl
-	];
-	const hosting = String(env.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting";
-	if (hosting) {
-		return {
-			walletId,
-			configured: false,
-			version: 0,
-			ready: false,
-			rootAdminRequired: true,
-			rootCommand: `/usr/local/sbin/fased-signer-network --wallet-id ${walletId} ` + "--network-file /root/fased-network.json"
-		};
+	if (executionFallbackRpcUrl || verificationRpcUrl) {
+		throw new Error("Normal wallet setup accepts one primary RPC. Configure an advanced execution fallback or explicit witness with the native signer admin network command.");
 	}
-	const signerBinPath = params.signerBinPath ?? (String(env.FASED_WALLET_LOCAL_SIGNER_BIN ?? "").trim() || path.join(String(env.HOME ?? ""), ".fased", "bin", "fased-signerd"));
-	const controlSocketPath = params.controlSocketPath ?? resolveLocalSignerControlSocketPath(env);
-	const adminEnv = signerAdminEnvironment(env);
-	const commonArgs = [
-		"--control-socket",
-		controlSocketPath,
-		"--wallet-id",
-		walletId
-	];
-	const current = parseSignerNetworkSummary(runSignerAdmin({
-		command: signerBinPath,
-		args: [
-			"admin",
-			"network",
-			"get",
-			...commonArgs
-		],
-		env: adminEnv,
-		secrets
-	}), walletId);
-	const input = `${JSON.stringify({
-		expectedVersion: current.version,
-		primaryRpcUrl,
-		...executionFallbackRpcUrl ? { executionFallbackRpcUrl } : {},
-		...verificationRpcUrl ? { verificationRpcUrl } : {}
-	})}\n`;
-	const updated = parseSignerNetworkSummary(runSignerAdmin({
-		command: signerBinPath,
-		args: [
-			"admin",
-			"network",
-			"put",
-			...commonArgs
-		],
-		input,
-		env: adminEnv,
-		secrets
-	}), walletId);
-	return assertReadyNetworkSummary(updated, current.version);
+	return configureSignerOwnedWalletPrimaryRpc({
+		socketPath: params.socketPath ?? resolveLocalSignerSocketPath(env),
+		walletId,
+		primaryRpcUrl
+	});
 }
 /**
 * Hosted policy changes are deliberately unavailable to the app process. New signer-owned
@@ -181,9 +76,7 @@ function applyHostedSignerOwnedWalletPolicy(params) {
 }
 const __testing = {
 	canonicalSignerWalletId,
-	parseSignerNetworkSummary,
-	redactSignerNetworkError,
-	signerAdminEnvironment
+	parseSignerNetworkSummary
 };
 
 //#endregion

package/dist/wallet/signer-protocol-v2.generated.js

@@ -35,9 +35,16 @@ const SIGNER_PROTOCOL_V2 = {
 		"atomicIdempotency",
 		"ambiguousBroadcastReconciliation",
 		"signerOwnedKeys",
+		"signerOwnedRoleBaselines",
+		"liveWalletReadiness",
 		"signerOwnedSuccessorRotation",
+		"signerOwnedMiningRetirementEvidence",
 		"permanentRetiredWalletPolicies",
 		"signerOwnedRPC",
+		"applicationNetworkBootstrap",
+		"signerOwnedEncryptedRecovery",
+		"signerOwnedRawExport",
+		"restrictedOperatorLifecycle",
 		"typedSolanaTransactions",
 		"typedA2aPaymentMemos",
 		"typedA2aRefundMemos",
@@ -74,7 +81,10 @@ const SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES = [
 	"atomicIdempotency",
 	"ambiguousBroadcastReconciliation",
 	"signerOwnedKeys",
+	"signerOwnedRoleBaselines",
+	"liveWalletReadiness",
 	"signerOwnedRPC",
+	"applicationNetworkBootstrap",
 	"typedSolanaTransactions",
 	"typedA2aPaymentMemos",
 	"typedA2aRefundMemos",