@fased/fased 0.1.67 → 0.1.69

package/dist/wallet/solana-assets.js

@@ -1,3 +1,4 @@
+import { fetchPinnedSolanaRpcRead } from "./solana-rpc-read-fetch.js";
 import { PublicKey } from "@solana/web3.js";
 
 //#region src/wallet/solana-assets.ts
@@ -427,10 +428,11 @@ function formatTokenAmount(raw, decimals) {
 	}
 }
 async function fetchSolanaRpc(rpcUrl, method, params) {
+	let release;
 	try {
-		const response = await fetch(rpcUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
+		const guarded = await fetchPinnedSolanaRpcRead({
+			rpcUrl,
+			timeoutMs: 1e4,
 			body: JSON.stringify({
 				jsonrpc: "2.0",
 				id: 1,
@@ -438,6 +440,8 @@ async function fetchSolanaRpc(rpcUrl, method, params) {
 				params
 			})
 		});
+		release = guarded.release;
+		const response = guarded.response;
 		if (!response.ok) {
 			recordSolanaAssetRpcMethod(method, "failure");
 			return null;
@@ -452,6 +456,8 @@ async function fetchSolanaRpc(rpcUrl, method, params) {
 	} catch {
 		recordSolanaAssetRpcMethod(method, "failure");
 		return null;
+	} finally {
+		await release?.();
 	}
 }
 async function fetchSolanaMetadataFromMintViaRpc(params) {

package/dist/wallet/solana-rpc-read-fetch.js

@@ -0,0 +1,65 @@
+import { closeDispatcher, createPinnedDispatcher, resolvePinnedHostnameWithPolicy } from "../infra/net/ssrf.js";
+
+//#region src/wallet/solana-rpc-read-fetch.ts
+function normalizeRpcHostname(hostname) {
+	const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+	return normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+}
+function isLoopbackRpcHostname(hostname) {
+	const normalized = normalizeRpcHostname(hostname);
+	return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+function isLoopbackRpcAddress(address) {
+	const normalized = normalizeRpcHostname(address);
+	return normalized === "::1" || normalized === "0:0:0:0:0:0:0:1" || /^127(?:\.\d{1,3}){3}$/.test(normalized) || /^::ffff:127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+async function resolveWithTimeout(hostname, policy, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([resolvePinnedHostnameWithPolicy(hostname, { policy }), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(new Error("stored Solana RPC hostname resolution timed out")), Math.max(250, timeoutMs));
+			timer.unref?.();
+		})]);
+	} finally {
+		if (timer) {
+			clearTimeout(timer);
+		}
+	}
+}
+async function fetchPinnedSolanaRpcRead(params) {
+	const parsed = new URL(params.rpcUrl);
+	const hostname = normalizeRpcHostname(parsed.hostname);
+	const loopback = isLoopbackRpcHostname(hostname);
+	if (!hostname || parsed.username || parsed.password || parsed.hash || parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) {
+		throw new Error("stored Solana RPC URL is not safe for Gateway reads");
+	}
+	const policy = {
+		hostnameAllowlist: [hostname],
+		...loopback ? { allowPrivateNetwork: true } : {}
+	};
+	const pinned = await resolveWithTimeout(hostname, policy, params.timeoutMs);
+	if (loopback && !pinned.addresses.every(isLoopbackRpcAddress)) {
+		throw new Error("stored Local Solana RPC hostname did not resolve only to loopback addresses");
+	}
+	const dispatcher = createPinnedDispatcher(pinned);
+	try {
+		const response = await fetch(parsed.toString(), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: params.body,
+			redirect: "error",
+			signal: AbortSignal.timeout(Math.max(250, params.timeoutMs)),
+			dispatcher
+		});
+		return {
+			response,
+			release: async () => closeDispatcher(dispatcher)
+		};
+	} catch (error) {
+		await closeDispatcher(dispatcher);
+		throw error;
+	}
+}
+
+//#endregion
+export { fetchPinnedSolanaRpcRead };

package/dist/wallet/wallet-agent-selection.js

@@ -42,16 +42,12 @@ function resolveWalletActionSelection(params) {
 				providerId: params.providerId,
 				env
 			});
-		} else if (registry.defaultWalletId) {
-			const fallback = registry.wallets.find((entry) => entry.id === registry.defaultWalletId);
-			selection = fallback ? {
-				walletId: fallback.id,
-				walletName: fallback.name,
-				providerId: fallback.providerId,
-				source: "fallback"
-			} : { source: "none" };
 		} else {
-			selection = { source: "none" };
+			selection = resolveWalletSelection({
+				agentId: params.agentId,
+				skillWalletId: params.skillWalletId,
+				env
+			});
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "wallet selection failed";
@@ -61,7 +57,7 @@ function resolveWalletActionSelection(params) {
 		throw new WalletActionSelectionError("wallet_not_found", message);
 	}
 	if (!selection.walletId) {
-		throw new WalletActionSelectionError("wallet_handle_required", "Agent wallet handle, walletId, or default Agent wallet required");
+		throw new WalletActionSelectionError("wallet_handle_required", "Select an Agent wallet: use an explicit wallet, skill override, Agent assignment, or Default Agent wallet fallback");
 	}
 	const wallet = registry.wallets.find((entry) => entry.id === selection.walletId);
 	if (!wallet) {

package/dist/wallet/wallet-provider-registry.js

@@ -479,9 +479,6 @@ function upsertNamedWallet(params) {
 		updatedAt: now
 	};
 	registry.wallets = [...registry.wallets.filter((entry) => entry.id !== next.id), next].toSorted((a, b) => a.createdAt.localeCompare(b.createdAt));
-	if (!registry.defaultWalletId || !registry.wallets.some((wallet) => wallet.id === registry.defaultWalletId)) {
-		registry.defaultWalletId = resolveWalletUserRole(next) === "agent" ? next.id : undefined;
-	}
 	writeWalletProviderRegistry(registry, env);
 	return next;
 }
@@ -497,6 +494,10 @@ function deleteNamedWallet(params) {
 		walletId,
 		env
 	});
+	const targetWallet = registry.wallets.find((wallet) => wallet.id === walletId);
+	if (resolveWalletUserRole(targetWallet) === "mining") {
+		throw new Error("Mining wallets cannot be deleted directly; use Retire and replace Mining wallet so signer acknowledgement precedes registry detachment");
+	}
 	const before = registry.wallets.length;
 	registry.wallets = registry.wallets.filter((entry) => entry.id !== walletId);
 	for (const [agentId, assignedWalletId] of Object.entries(registry.assignments)) {
@@ -514,6 +515,50 @@ function deleteNamedWallet(params) {
 		registry
 	};
 }
+function replaceRetiredMiningWallet(params) {
+	const env = params.env ?? process.env;
+	const registry = readWalletProviderRegistry(env);
+	const sourceWalletId = params.sourceWalletId.trim();
+	if (!/^sha256:[0-9a-f]{64}$/u.test(params.signerAcknowledgement.rotationId) || !/^sha256:[0-9a-f]{64}$/u.test(params.signerAcknowledgement.sourceRetiredPolicyHash) || !/^sha256:[0-9a-f]{64}$/u.test(params.signerAcknowledgement.successorPolicyHash) || params.signerAcknowledgement.successorPublicKey !== params.successor.addresses?.solana || params.successor.metadata?.rotationId !== params.signerAcknowledgement.rotationId || params.successor.metadata?.policyHash !== params.signerAcknowledgement.successorPolicyHash) {
+		throw new Error("signer retirement acknowledgement is missing or does not match the successor");
+	}
+	const sourceIndex = registry.wallets.findIndex((wallet) => wallet.id === sourceWalletId);
+	if (sourceIndex < 0) {
+		const existing = registry.wallets.find((wallet) => wallet.id === params.successor.id);
+		if (existing?.providerId === "local-socket-signer" && existing.addresses?.solana === params.successor.addresses?.solana && resolveWalletUserRole(existing) === "mining") {
+			return existing;
+		}
+		throw new Error("retired Mining source registration is missing");
+	}
+	const source = registry.wallets[sourceIndex];
+	if (resolveWalletUserRole(source) !== "mining") {
+		throw new Error("source registration is not the active Mining wallet");
+	}
+	if (params.successor.id === sourceWalletId || registry.wallets.some((wallet) => wallet.id === params.successor.id)) {
+		throw new Error("Mining successor registration must use a new wallet id");
+	}
+	assertNamedWalletDeletionSafe({
+		walletId: sourceWalletId,
+		env
+	});
+	const now = nowIso();
+	const successor = {
+		...params.successor,
+		createdAt: now,
+		updatedAt: now
+	};
+	registry.wallets.splice(sourceIndex, 1, successor);
+	for (const [agentId, assignedWalletId] of Object.entries(registry.assignments)) {
+		if (assignedWalletId === sourceWalletId) {
+			delete registry.assignments[agentId];
+		}
+	}
+	if (registry.defaultWalletId === sourceWalletId) {
+		registry.defaultWalletId = undefined;
+	}
+	writeWalletProviderRegistry(registry, env);
+	return successor;
+}
 function setAgentWalletAssignment(params) {
 	const env = params.env ?? process.env;
 	const registry = readWalletProviderRegistry(env);
@@ -527,9 +572,13 @@ function setAgentWalletAssignment(params) {
 		writeWalletProviderRegistry(registry, env);
 		return registry;
 	}
-	if (!registry.wallets.some((wallet) => wallet.id === walletId)) {
+	const wallet = registry.wallets.find((entry) => entry.id === walletId);
+	if (!wallet) {
 		throw new Error("walletId does not exist");
 	}
+	if (resolveWalletUserRole(wallet) !== "agent") {
+		throw new Error("only Agent wallets can be assigned to an Agent");
+	}
 	registry.assignments[agentId] = walletId;
 	writeWalletProviderRegistry(registry, env);
 	return registry;
@@ -548,23 +597,9 @@ function setDefaultWallet(params) {
 		throw new Error("walletId does not exist");
 	}
 	const purpose = resolveWalletUserRole(targetWallet);
-	if (purpose && purpose !== "agent") {
-		throw new Error("only Agent wallets can become the primary Agent fallback");
+	if (purpose !== "agent") {
+		throw new Error("only an explicit Agent wallet can become the Default Agent wallet fallback");
 	}
-	registry.wallets = registry.wallets.map((wallet) => {
-		if (wallet.id !== walletId) {
-			return wallet;
-		}
-		return {
-			...wallet,
-			metadata: {
-				...wallet.metadata,
-				role: "agent",
-				purpose: "agent"
-			},
-			updatedAt: nowIso()
-		};
-	});
 	registry.defaultWalletId = walletId;
 	writeWalletProviderRegistry(registry, env);
 	return registry;
@@ -588,12 +623,15 @@ function setNamedWalletRole(params) {
 		},
 		updatedAt: nowIso()
 	} : wallet);
-	if (params.role === "agent" && !registry.defaultWalletId) {
-		registry.defaultWalletId = walletId;
+	if (params.role !== "agent" && registry.defaultWalletId === walletId) {
+		registry.defaultWalletId = undefined;
 	}
-	if (params.role === "vault" && registry.defaultWalletId === walletId) {
-		const nextDefault = registry.wallets.find((wallet) => wallet.id !== walletId && resolveWalletUserRole(wallet) === "agent");
-		registry.defaultWalletId = nextDefault?.id;
+	if (params.role !== "agent") {
+		for (const [agentId, assignedWalletId] of Object.entries(registry.assignments)) {
+			if (assignedWalletId === walletId) {
+				delete registry.assignments[agentId];
+			}
+		}
 	}
 	writeWalletProviderRegistry(registry, env);
 	return registry;
@@ -603,7 +641,8 @@ function resolveWalletSelectionForAgent(params) {
 	const registry = readWalletProviderRegistry(env);
 	const directAgent = params.agentId?.trim();
 	const directWalletId = directAgent ? registry.assignments[directAgent] : undefined;
-	const walletId = directWalletId ?? registry.defaultWalletId;
+	const skillWalletId = params.skillWalletId?.trim();
+	const walletId = skillWalletId ?? directWalletId ?? registry.defaultWalletId;
 	if (!walletId) {
 		return {};
 	}
@@ -614,7 +653,8 @@ function resolveWalletSelectionForAgent(params) {
 	return {
 		walletId: wallet.id,
 		walletName: wallet.name,
-		providerId: wallet.providerId
+		providerId: wallet.providerId,
+		source: skillWalletId ? "skill" : directWalletId ? "agent" : "default"
 	};
 }
 function resolveWalletSelection(params) {
@@ -676,16 +716,17 @@ function resolveWalletSelection(params) {
 	}
 	const fallback = resolveWalletSelectionForAgent({
 		agentId: params.agentId,
+		skillWalletId: params.skillWalletId,
 		env
 	});
 	if (fallback.walletId || fallback.providerId) {
 		return {
 			...fallback,
-			source: "fallback"
+			source: fallback.source ?? "fallback"
 		};
 	}
 	return { source: "none" };
 }
 
 //#endregion
-export { WALLET_PROVIDER_IDS, checkNamedWalletDeletionSafety, deleteNamedWallet, normalizeWalletUserRole, readWalletProviderRegistry, resolveWalletSelection, resolveWalletUserRole, setAgentWalletAssignment, setDefaultWallet, setNamedWalletRole, setWalletProviderEnabled, setWalletProvidersEnabled, upsertNamedWallet };
+export { WALLET_PROVIDER_IDS, checkNamedWalletDeletionSafety, deleteNamedWallet, normalizeWalletUserRole, readWalletProviderRegistry, replaceRetiredMiningWallet, resolveWalletSelection, resolveWalletUserRole, setAgentWalletAssignment, setDefaultWallet, setNamedWalletRole, setWalletProviderEnabled, setWalletProvidersEnabled, upsertNamedWallet, writeWalletProviderRegistry };

package/dist/wallet/wallet-send-approvals.js

@@ -2126,7 +2126,11 @@ async function approveWalletSendRequest(params) {
 					request
 				};
 			}
-			if (storedReview.state === "prepared" && !params.reviewAuthorization) {
+			const controlUIAuthorization = storedReview.state === "prepared" && !params.reviewAuthorization && (storedReview.intentType === "solana.nativeTransfer" || storedReview.intentType === "solana.splTransferChecked") ? {
+				type: "control-ui",
+				proof: { proofId: storedReview.nonce }
+			} : undefined;
+			if (storedReview.state === "prepared" && !params.reviewAuthorization && !controlUIAuthorization) {
 				if (claim.recovered && request.status === "executing") {
 					await withApprovalMutationLock(env, () => {
 						file = loadFile(env);
@@ -2151,7 +2155,7 @@ async function approveWalletSendRequest(params) {
 					request
 				};
 			}
-			const executionAuthorization = storedReview.state === "prepared" ? params.reviewAuthorization : undefined;
+			const executionAuthorization = storedReview.state === "prepared" ? params.reviewAuthorization ?? controlUIAuthorization : undefined;
 			let executed;
 			try {
 				executed = await provider.executeSignerReview({

package/dist/wallet/wallet-status.js

@@ -1,10 +1,12 @@
 import { loadConfig } from "../config/io.js";
 import "../config/config.js";
-import { ensureWalletStateDir, resolveWalletRuntimeConfig, resolveWalletStatePaths } from "./wallet-runtime-config.js";
+import { ensureWalletStateDir, resolveLocalSignerSocketPath, resolveWalletRuntimeConfig, resolveWalletStatePaths } from "./wallet-runtime-config.js";
 import { readWalletProviderRegistry } from "./wallet-provider-registry.js";
 import { resolveWalletPolicyConfig } from "./wallet-policy.js";
 import { redactWalletDiagnosticText, walletDiagnosticErrorMessage, walletDiagnosticErrorString } from "./wallet-redaction.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "./wallet-provider-resolver.js";
+import { readSignerOwnedWalletReadiness } from "./local-socket-signer-lifecycle.js";
+import { normalizeNativeSignerWalletId } from "./native-signer-wallet-id.js";
 import { readWalletApprovalAuthSnapshot } from "./wallet-approval-auth.js";
 
 //#region src/wallet/wallet-status.ts
@@ -26,8 +28,12 @@ async function readWalletStatusSnapshot(params) {
 	const statePaths = resolveWalletStatePaths(effectiveEnv);
 	const approvalAuth = readWalletApprovalAuthSnapshot(effectiveEnv, cfg);
 	const checkedAt = new Date().toISOString();
+	const registeredWallets = params?.walletId ? providerRegistry.wallets.filter((wallet) => wallet.id === params.walletId) : providerRegistry.wallets;
 	let providerHealth = {
 		ok: false,
+		provider: providerId,
+		configured: false,
+		checkedAt,
 		details: "provider health probe unavailable"
 	};
 	let addresses;
@@ -53,6 +59,9 @@ async function readWalletStatusSnapshot(params) {
 	} catch (err) {
 		providerHealth = {
 			ok: false,
+			provider: providerId,
+			configured: false,
+			checkedAt,
 			details: walletDiagnosticErrorString(err)
 		};
 	}
@@ -71,6 +80,58 @@ async function readWalletStatusSnapshot(params) {
 			summary: "Real-chain settlement depends on the configured wallet provider and RPC connectivity."
 		},
 		chains: resolved.chains,
+		wallets: await Promise.all(registeredWallets.map(async (wallet) => {
+			if (wallet.providerId !== "local-socket-signer") {
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: Boolean(wallet.addresses?.solana),
+						rpc: serviceHealthy,
+						ready: serviceHealthy && Boolean(wallet.addresses?.solana)
+					}
+				};
+			}
+			const metadataSignerWalletId = typeof wallet.metadata?.signerWalletId === "string" ? wallet.metadata.signerWalletId.trim() : "";
+			const signerWalletId = metadataSignerWalletId || normalizeNativeSignerWalletId(wallet.id);
+			try {
+				const signer = await readSignerOwnedWalletReadiness({
+					socketPath: resolveLocalSignerSocketPath(effectiveEnv),
+					walletId: signerWalletId
+				});
+				const addressMatches = typeof wallet.addresses?.solana === "string" && wallet.addresses.solana === signer.publicKey;
+				const roleMatches = typeof wallet.metadata?.role === "string" && wallet.metadata.role === signer.role;
+				const ready = signer.ready && addressMatches && roleMatches;
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: signer.keyReady,
+						rpc: signer.networkReady,
+						ready,
+						...!ready && signer.ready ? { error: "registry address or immutable role does not match live signer state" } : {},
+						signer
+					}
+				};
+			} catch (error) {
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: false,
+						rpc: false,
+						ready: false,
+						error: walletDiagnosticErrorMessage(error)
+					}
+				};
+			}
+		})),
 		service: {
 			host: resolved.service.host,
 			port: resolved.service.port,
@@ -90,6 +151,7 @@ async function readWalletStatusSnapshot(params) {
 			}
 		},
 		approvalAuth,
+		...providerHealth.nativeSignerApproval ? { nativeSignerApproval: providerHealth.nativeSignerApproval } : {},
 		addresses,
 		paths: {
 			rootDir: paths.rootDir,

package/dist/web/login-qr.js

@@ -5,8 +5,8 @@ import { loadConfig } from "../config/io.js";
 import "../config/config.js";
 import { logoutWeb, readWebSelfId, webAuthExists } from "./auth-store.js";
 import { resolveWhatsAppAccount } from "./accounts.js";
-import { createWaSocket, formatError, getStatusCode, waitForWaConnection } from "./session.js";
 import { renderQrPngBase64 } from "./qr-image.js";
+import { createWaSocket, formatError, getStatusCode, waitForWaConnection } from "./session.js";
 import { randomUUID } from "node:crypto";
 import { DisconnectReason } from "@whiskeysockets/baileys";