@fased/fased 0.1.68 → 0.1.69

package/dist/wallet/local-socket-signer-lifecycle.js

@@ -10,7 +10,7 @@ function lockedLocalSignerPolicy(role) {
 		assets: []
 	};
 }
-async function requireSignerOwnedProtocolV2(socketPath) {
+async function requireSignerOwnedProtocolV2(socketPath, requiredFeatures = []) {
 	const result = await callLocalSocketSigner(socketPath, { op: "v2.capabilities" });
 	const capabilities = result.capabilities;
 	const required = [
@@ -19,13 +19,89 @@ async function requireSignerOwnedProtocolV2(socketPath) {
 		"signerOwnedKeys",
 		"applicationNetworkBootstrap",
 		"atomicMultiAssetCaps",
-		"signerControlledNativeFeeCaps"
+		"signerControlledNativeFeeCaps",
+		...requiredFeatures
 	];
 	const missing = required.filter((feature) => !capabilities?.features.includes(feature));
 	if (result.ready !== true || capabilities?.protocol.current !== 2 || capabilities.protocol.min > 2 || capabilities.protocol.max < 2 || capabilities.nativeFeeReservationLamports !== LOCAL_SIGNER_NATIVE_FEE_RESERVATION_LAMPORTS_V2 || missing.length > 0) {
 		throw new Error(`fased-signerd does not provide the required signer-owned protocol-v2 capabilities${missing.length > 0 ? `: ${missing.join(", ")}` : ""}`);
 	}
 }
+function assertRoleBaselineRecord(record, role) {
+	if (record.policy.role !== role) {
+		throw new Error(`signer-owned wallet ${record.wallet.walletId} has role=${record.policy.role}, not ${role}`);
+	}
+	if (record.policy.baselineVersion !== 1 || record.policy.operations.length === 0 || record.policy.programs.length === 0 || record.policy.assets.length === 0) {
+		throw new Error(`signer-owned wallet ${record.wallet.walletId} is not role-ready; select Activate role baseline before using it`);
+	}
+	return record;
+}
+async function createRoleReadySignerOwnedWallet(params) {
+	const walletId = params.walletId.trim();
+	if (!/^[a-zA-Z0-9_-]+$/.test(walletId)) {
+		throw new Error("walletId must contain only letters, numbers, hyphens, or underscores");
+	}
+	await requireSignerOwnedProtocolV2(params.socketPath, ["signerOwnedRoleBaselines"]);
+	try {
+		const existing = await readSignerOwnedWallet({
+			socketPath: params.socketPath,
+			walletId
+		});
+		if (!params.allowExisting) {
+			throw new Error(`signer-owned wallet already exists: ${walletId}`);
+		}
+		return assertRoleBaselineRecord(existing, params.role);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		if (message.startsWith("signer-owned wallet")) {
+			throw error;
+		}
+	}
+	try {
+		const created = await callLocalSocketSigner(params.socketPath, {
+			op: "v2.wallet.create",
+			walletId,
+			request: {
+				expectedPolicyVersion: 0,
+				baseline: {
+					version: 1,
+					role: params.role
+				}
+			}
+		});
+		return assertRoleBaselineRecord(created, params.role);
+	} catch (error) {
+		if (!params.allowExisting) {
+			throw error;
+		}
+		const existing = await readSignerOwnedWallet({
+			socketPath: params.socketPath,
+			walletId
+		});
+		return assertRoleBaselineRecord(existing, params.role);
+	}
+}
+async function activateSignerOwnedRoleBaseline(params) {
+	await requireSignerOwnedProtocolV2(params.socketPath, ["signerOwnedRoleBaselines"]);
+	return await callLocalSocketSigner(params.socketPath, {
+		op: "v2.policy.activateBaseline",
+		walletId: params.walletId,
+		request: {
+			expectedPolicyVersion: params.expectedPolicyVersion,
+			baseline: {
+				version: 1,
+				role: params.role
+			}
+		}
+	});
+}
+async function readSignerOwnedWalletReadiness(params) {
+	await requireSignerOwnedProtocolV2(params.socketPath, ["liveWalletReadiness"]);
+	return await callLocalSocketSigner(params.socketPath, {
+		op: "v2.wallet.readiness",
+		walletId: params.walletId
+	});
+}
 async function readSignerOwnedWallet(params) {
 	const [wallet, policy] = await Promise.all([callLocalSocketSigner(params.socketPath, {
 		op: "v2.wallet.get",
@@ -122,4 +198,4 @@ async function configureSignerOwnedWalletPrimaryRpc(params) {
 }
 
 //#endregion
-export { configureSignerOwnedWalletPrimaryRpc, createLockedSignerOwnedWallet };
+export { activateSignerOwnedRoleBaseline, configureSignerOwnedWalletPrimaryRpc, createRoleReadySignerOwnedWallet, readSignerOwnedWallet, readSignerOwnedWalletReadiness };

package/dist/wallet/local-socket-signer-protocol.js

@@ -36,14 +36,18 @@ const SignerPolicyAssetV2Schema = Type.Object({
 	asset: Type.String(),
 	destinations: Type.Array(Type.String()),
 	maxPerTx: Type.String(),
-	maxDaily: Type.String()
+	maxDaily: Type.String(),
+	reviewedDestinations: Type.Optional(Type.Boolean()),
+	typedSatDestinations: Type.Optional(Type.Boolean())
 }, { additionalProperties: false });
 const SignerPolicyInputV2Schema = Type.Object({
 	walletId: Type.Optional(Type.String()),
 	role: SignerWalletRoleSchema,
 	version: Type.Optional(Type.Integer({ minimum: 0 })),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.Optional(Type.String())
 }, { additionalProperties: false });
@@ -51,8 +55,10 @@ const LocalSocketSignerPolicyV2Schema = Type.Object({
 	walletId: Type.String(),
 	role: SignerWalletRoleSchema,
 	version: Type.Integer({ minimum: 1 }),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" })
 }, { additionalProperties: false });
@@ -238,10 +244,13 @@ const SignerSolanaTransactionEnvelopeV2Schema = Type.Object({
 	}),
 	submission: Type.Literal("rpc")
 }, { additionalProperties: false });
-const SignerReviewAuthorizationV2Schema = Type.Object({
+const SignerReviewAuthorizationV2Schema = Type.Union([Type.Object({
 	type: Type.Literal("webauthn"),
 	proof: Type.Object({ proofId: Type.String({ minLength: 1 }) }, { additionalProperties: false })
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	type: Type.Literal("control-ui"),
+	proof: Type.Object({ proofId: Type.String({ pattern: "^[0-9a-f]{64}$" }) }, { additionalProperties: false })
+}, { additionalProperties: false })]);
 const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Type.Array(Type.Object({
 	orderId: Type.String({ minLength: 1 }),
 	orderState: Type.String({ minLength: 1 }),
@@ -266,10 +275,17 @@ const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Typ
 		program: Type.String({ minLength: 1 })
 	}, { additionalProperties: false }))
 }, { additionalProperties: false })) }, { additionalProperties: false });
-const SignerWalletPolicyCreateV2Schema = Type.Object({
+const SignerRoleBaselineV1Schema = Type.Object({
+	version: Type.Literal(1),
+	role: SignerWalletRoleSchema
+}, { additionalProperties: false });
+const SignerWalletPolicyCreateV2Schema = Type.Union([Type.Object({
 	expectedPolicyVersion: Type.Literal(0),
 	policy: SignerPolicyInputV2Schema
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	expectedPolicyVersion: Type.Literal(0),
+	baseline: SignerRoleBaselineV1Schema
+}, { additionalProperties: false })]);
 const SignerOperationLookupV2Schema = Type.Object({ requestId: Type.String() }, { additionalProperties: false });
 const SignerSatLookupBindingRequestV2Schema = Type.Object({
 	cycleId: Type.String({ pattern: "^(0|[1-9][0-9]*)$" }),
@@ -348,6 +364,18 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.wallet.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.wallet.readiness"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.policy.activateBaseline"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedPolicyVersion: Type.Integer({ minimum: 1 }),
+			baseline: SignerRoleBaselineV1Schema
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.create"),
 		walletId: Type.String(),
@@ -356,21 +384,30 @@ const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({
 		op: Type.Literal("v2.wallet.import"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.importLegacy"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String(),
 			passphrasePath: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String(),
+			passphrasePath: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.reencrypt"),
@@ -650,6 +687,27 @@ const LocalSocketSignerWalletPolicyResultV2Schema = Type.Object({
 	wallet: LocalSocketSignerWalletV2Schema,
 	policy: LocalSocketSignerPolicyV2Schema
 }, { additionalProperties: false });
+const LocalSocketSignerWalletReadinessV2Schema = Type.Object({
+	walletId: Type.String({ minLength: 1 }),
+	publicKey: Type.String({ minLength: 1 }),
+	walletVersion: Type.Optional(Type.Integer({ minimum: 1 })),
+	role: SignerWalletRoleSchema,
+	baselineVersion: Type.Integer({ minimum: 0 }),
+	policyVersion: Type.Integer({ minimum: 1 }),
+	policyHash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" }),
+	networkVersion: Type.Integer({ minimum: 0 }),
+	networkHash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	keyReady: Type.Boolean(),
+	policyReady: Type.Boolean(),
+	networkReady: Type.Boolean(),
+	operationLane: Type.Union([
+		Type.Literal("blocked"),
+		Type.Literal("agent-reviewed-and-autonomous"),
+		Type.Literal("mining-typed-sat"),
+		Type.Literal("vault-reviewed-only")
+	]),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 function isPositiveUnsignedInteger(value) {
 	return typeof value === "string" && /^[1-9][0-9]*$/.test(value);
 }
@@ -694,9 +752,11 @@ function validateLocalSocketSignerResult(op, result) {
 		case "v2.network.bootstrap": return Value.Check(LocalSocketSignerNetworkSummaryV2Schema, result);
 		case "v2.policy.get":
 		case "v2.policy.put":
-		case "v2.policy.tighten": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
+		case "v2.policy.tighten":
+		case "v2.policy.activateBaseline": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
 		case "v2.wallet.get":
 		case "v2.wallet.reencrypt": return Value.Check(LocalSocketSignerWalletV2Schema, result);
+		case "v2.wallet.readiness": return Value.Check(LocalSocketSignerWalletReadinessV2Schema, result);
 		case "v2.wallet.create":
 		case "v2.wallet.import":
 		case "v2.wallet.importLegacy": return Value.Check(LocalSocketSignerWalletPolicyResultV2Schema, result);

package/dist/wallet/mining-wallet-retirement.js

@@ -0,0 +1,256 @@
+import { resolveStateDir } from "../config/paths.js";
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+
+//#region src/wallet/mining-wallet-retirement.ts
+function record(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function decimal(value, field) {
+	const normalized = typeof value === "string" ? value.trim() : "";
+	if (!/^\d+$/u.test(normalized)) {
+		throw new Error(`Mining retirement cannot verify ${field}`);
+	}
+	return normalized;
+}
+function nonNegativeCount(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function sha256(raw) {
+	return `sha256:${createHash("sha256").update(raw).digest("hex")}`;
+}
+function base64UrlByteLength(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/u.test(value)) {
+		return -1;
+	}
+	try {
+		return Buffer.from(value, "base64url").byteLength;
+	} catch {
+		return -1;
+	}
+}
+function normalizedWalletStateKey(walletId) {
+	return walletId.replace(/[^a-zA-Z0-9._-]+/gu, "_") || "unattached";
+}
+function readStrictJSONFile(filePath, maxBytes) {
+	const info = fs.lstatSync(filePath);
+	if (!info.isFile() || info.isSymbolicLink() || info.size <= 0 || info.size > maxBytes) {
+		throw new Error(`Mining retirement evidence file is invalid: ${filePath}`);
+	}
+	const raw = fs.readFileSync(filePath);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw.toString("utf8"));
+	} catch {
+		throw new Error(`Mining retirement evidence file is not valid JSON: ${filePath}`);
+	}
+	const value = record(parsed);
+	if (!value) {
+		throw new Error(`Mining retirement evidence file must contain one JSON object: ${filePath}`);
+	}
+	return {
+		raw,
+		value
+	};
+}
+function unwrapMiningGatewayPayload(value) {
+	let current = value;
+	for (let index = 0; index < 4; index += 1) {
+		const currentRecord = record(current);
+		if (!currentRecord) {
+			break;
+		}
+		if (record(currentRecord.status)) {
+			return record(currentRecord.status);
+		}
+		if (!("payload" in currentRecord)) {
+			return currentRecord;
+		}
+		current = currentRecord.payload;
+	}
+	return record(current) ?? {};
+}
+function verifyMiningRecoveryPackage(params) {
+	const recoveryFile = params.recoveryFile.trim();
+	if (!path.isAbsolute(recoveryFile) || path.resolve(recoveryFile) !== recoveryFile) {
+		throw new Error("--recovery-file must be an absolute clean path");
+	}
+	const info = fs.lstatSync(recoveryFile);
+	if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.mode & 63) {
+		throw new Error("Mining recovery package must be one owner-only regular non-symlink file");
+	}
+	if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
+		throw new Error("Mining recovery package must be owned by the current terminal user");
+	}
+	const { raw, value } = readStrictJSONFile(recoveryFile, 16 * 1024);
+	const kdf = record(value.kdf);
+	const encryption = record(value.encryption);
+	if (value.kind !== "fased-signer-wallet-recovery" || value.version !== 1 || value.walletId !== params.walletId || value.role !== "mining" || value.publicKey !== params.publicKey || typeof value.createdAt !== "string" || !Number.isFinite(Date.parse(value.createdAt)) || kdf?.name !== "argon2id" || kdf.memoryKiB !== 64 * 1024 || kdf.iterations !== 3 || kdf.parallelism !== 1 || base64UrlByteLength(kdf.salt) !== 16 || encryption?.name !== "aes-256-gcm" || base64UrlByteLength(encryption.nonce) !== 12 || base64UrlByteLength(encryption.ciphertext) !== 80) {
+		throw new Error("Encrypted recovery package does not match the source Mining wallet");
+	}
+	return {
+		packageHash: sha256(raw),
+		walletId: params.walletId,
+		publicKey: params.publicKey,
+		role: "mining"
+	};
+}
+function buildMiningRetirementEvidence(params) {
+	const env = params.env ?? process.env;
+	const status = unwrapMiningGatewayPayload(params.liveStatus);
+	if (typeof status.retirementGatewayError === "string") {
+		throw new Error(`Could not stop and inspect Mining: ${status.retirementGatewayError}`);
+	}
+	if (status.walletId !== params.walletId && status.walletId !== params.signerWalletId) {
+		throw new Error("Live Mining status is not bound to the source wallet");
+	}
+	if (status.statusFresh === false || status.degraded === true) {
+		throw new Error("Live Mining status is degraded; normal retirement refuses unverifiable state");
+	}
+	if (status.running === true || status.drainOnly === true || status.enabledWanted === true) {
+		throw new Error("Mining is still running or draining; retry retirement after Clearing finishes");
+	}
+	const workers = record(status.workers) ?? {};
+	if (Object.values(workers).some((worker) => record(worker)?.running === true)) {
+		throw new Error("A Mining worker is still running");
+	}
+	const solBalanceLamports = decimal(status.currentSolBalanceLamports, "live SOL balance");
+	const signerBalance = decimal(params.signerSolBalanceLamports, "signer SOL balance");
+	if (solBalanceLamports !== signerBalance) {
+		throw new Error("Live Mining and signer SOL balance observations disagree");
+	}
+	const satBalanceRaw = decimal(status.currentSatBalanceRaw, "live SAT balance");
+	for (const [field, value] of [
+		["funded Mining capital", status.currentCapitalFundedLamports],
+		["locked Mining capital", status.currentCapitalLockedLamports],
+		["free Mining capital", status.currentCapitalFreeLamports]
+	]) {
+		if (decimal(value, field) !== "0") {
+			throw new Error(`${field} must be zero before normal Mining retirement`);
+		}
+	}
+	if (nonNegativeCount(status.currentCapitalPendingCycleCount) !== 0 || nonNegativeCount(record(status.claimBacklog)?.total) !== 0 || nonNegativeCount(status.missingCycleCount) !== 0 || Array.isArray(status.pendingCycleIds) && status.pendingCycleIds.length > 0 || status.exactPendingCycleId != null) {
+		throw new Error("Mining still has pending cycles, claims, or reconciliation gaps");
+	}
+	const walletStateDir = path.join(resolveStateDir(env), "sat-mining", "wallets", normalizedWalletStateKey(params.walletId));
+	const runtime = readStrictJSONFile(path.join(walletStateDir, "runtime-store.json"), 16 * 1024 * 1024);
+	if (runtime.value.enabledWanted === true) {
+		throw new Error("Durable Mining state still permits new jobs");
+	}
+	const durableWorkers = record(runtime.value.workers) ?? {};
+	if (Object.values(durableWorkers).some((worker) => record(worker)?.running === true)) {
+		throw new Error("Durable Mining state still records a running worker");
+	}
+	if (Array.isArray(runtime.value.pendingPlannerCycles) && runtime.value.pendingPlannerCycles.length) {
+		throw new Error("Durable Mining planner work remains pending");
+	}
+	if (Array.isArray(runtime.value.claimBacklog) && runtime.value.claimBacklog.length) {
+		throw new Error("Durable Mining claim backlog remains pending");
+	}
+	const lastKnown = record(runtime.value.lastKnownStatus);
+	if (!lastKnown || lastKnown.walletId !== params.walletId && lastKnown.walletId !== params.signerWalletId) {
+		throw new Error("Durable Mining balance state is missing or belongs to another wallet");
+	}
+	if (decimal(lastKnown.currentCapitalFundedLamports, "durable funded capital") !== "0" || decimal(lastKnown.currentCapitalLockedLamports, "durable locked capital") !== "0" || decimal(lastKnown.currentCapitalFreeLamports, "durable free capital") !== "0" || nonNegativeCount(lastKnown.currentCapitalPendingCycleCount) !== 0 || lastKnown.exactPendingCycleId != null) {
+		throw new Error("Durable Mining state still contains pending capital or protocol work");
+	}
+	const ledgerPath = path.join(walletStateDir, "submission-ledger.json");
+	let ledgerRaw = Buffer.from("{\"version\":1,\"records\":{}}\n", "utf8");
+	let ledger = {
+		version: 1,
+		records: {}
+	};
+	if (fs.existsSync(ledgerPath)) {
+		const loaded = readStrictJSONFile(ledgerPath, 16 * 1024 * 1024);
+		ledgerRaw = loaded.raw;
+		ledger = loaded.value;
+	}
+	if (ledger.version !== 1 || !record(ledger.records)) {
+		throw new Error("Durable Mining submission ledger is invalid");
+	}
+	const pendingByKind = {
+		commit: 0,
+		reveal: 0,
+		settlement: 0,
+		claim: 0,
+		cleanup: 0,
+		alt: 0
+	};
+	for (const rawEntry of Object.values(record(ledger.records))) {
+		const entry = record(rawEntry);
+		if (!entry) {
+			throw new Error("Durable Mining submission ledger contains an invalid record");
+		}
+		const state = typeof entry.state === "string" ? entry.state : "";
+		if (![
+			"prepared",
+			"reserved",
+			"broadcast",
+			"unknown"
+		].includes(state)) {
+			continue;
+		}
+		const action = typeof entry.action === "string" ? entry.action.toLowerCase() : "";
+		if (action.includes("commit")) {
+			pendingByKind.commit += 1;
+		} else if (action.includes("reveal") || action.includes("submit")) {
+			pendingByKind.reveal += 1;
+		} else if (action.includes("settle") || action.includes("score") || action.includes("distribute") || action.includes("finalize")) {
+			pendingByKind.settlement += 1;
+		} else if (action.includes("claim")) {
+			pendingByKind.claim += 1;
+		} else if (action.includes("lookup") || action.includes("alt")) {
+			pendingByKind.alt += 1;
+		} else {
+			pendingByKind.cleanup += 1;
+		}
+	}
+	if (Object.values(pendingByKind).some((count) => count > 0)) {
+		throw new Error("Reserved, broadcast, or unknown Mining submissions must be reconciled first");
+	}
+	const observedAt = typeof status.updatedAt === "string" ? status.updatedAt : typeof status.snapshotAt === "string" ? status.snapshotAt : typeof lastKnown.updatedAt === "string" ? lastKnown.updatedAt : "";
+	if (!observedAt || !Number.isFinite(Date.parse(observedAt))) {
+		throw new Error("Live Mining balance observation has no verifiable timestamp");
+	}
+	return {
+		version: 1,
+		walletId: params.signerWalletId,
+		publicKey: params.publicKey,
+		observedAt: new Date(observedAt).toISOString(),
+		newJobsStopped: true,
+		workersDrained: true,
+		clearingDrained: true,
+		submissionsReconciled: true,
+		pendingCommits: pendingByKind.commit,
+		pendingReveals: pendingByKind.reveal,
+		pendingSettlements: pendingByKind.settlement,
+		pendingClaims: pendingByKind.claim,
+		pendingCleanup: pendingByKind.cleanup,
+		pendingAltMutations: pendingByKind.alt,
+		solBalanceLamports,
+		satBalanceRaw,
+		runtimeStateHash: sha256(runtime.raw),
+		submissionLedgerHash: sha256(ledgerRaw)
+	};
+}
+function writeMiningRetirementReceipt(params) {
+	const root = path.join(resolveStateDir(params.env ?? process.env), "wallet-retirements");
+	fs.mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	const filePath = path.join(root, `${normalizedWalletStateKey(params.sourceWalletId)}.json`);
+	const tempPath = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	fs.writeFileSync(tempPath, `${JSON.stringify(params.receipt, null, 2)}\n`, {
+		encoding: "utf8",
+		flag: "wx",
+		mode: 384
+	});
+	fs.renameSync(tempPath, filePath);
+	fs.chmodSync(filePath, 384);
+	return filePath;
+}
+
+//#endregion
+export { buildMiningRetirementEvidence, verifyMiningRecoveryPackage, writeMiningRetirementReceipt };

package/dist/wallet/providers/local-socket-signer-adapter.js

@@ -20,7 +20,9 @@ const SIGNER_SOCKET_TIMEOUT_MS = {
 	"v2.policy.get": 5e3,
 	"v2.policy.put": 5e3,
 	"v2.policy.tighten": 5e3,
+	"v2.policy.activateBaseline": 1e4,
 	"v2.wallet.get": 5e3,
+	"v2.wallet.readiness": 5e3,
 	"v2.wallet.create": 1e4,
 	"v2.wallet.import": 2e4,
 	"v2.wallet.importLegacy": 3e4,

package/dist/wallet/signer-protocol-v2.generated.js

@@ -35,12 +35,16 @@ const SIGNER_PROTOCOL_V2 = {
 		"atomicIdempotency",
 		"ambiguousBroadcastReconciliation",
 		"signerOwnedKeys",
+		"signerOwnedRoleBaselines",
+		"liveWalletReadiness",
 		"signerOwnedSuccessorRotation",
+		"signerOwnedMiningRetirementEvidence",
 		"permanentRetiredWalletPolicies",
 		"signerOwnedRPC",
 		"applicationNetworkBootstrap",
 		"signerOwnedEncryptedRecovery",
 		"signerOwnedRawExport",
+		"restrictedOperatorLifecycle",
 		"typedSolanaTransactions",
 		"typedA2aPaymentMemos",
 		"typedA2aRefundMemos",
@@ -77,6 +81,8 @@ const SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES = [
 	"atomicIdempotency",
 	"ambiguousBroadcastReconciliation",
 	"signerOwnedKeys",
+	"signerOwnedRoleBaselines",
+	"liveWalletReadiness",
 	"signerOwnedRPC",
 	"applicationNetworkBootstrap",
 	"typedSolanaTransactions",

package/dist/wallet/wallet-agent-selection.js

@@ -42,16 +42,12 @@ function resolveWalletActionSelection(params) {
 				providerId: params.providerId,
 				env
 			});
-		} else if (registry.defaultWalletId) {
-			const fallback = registry.wallets.find((entry) => entry.id === registry.defaultWalletId);
-			selection = fallback ? {
-				walletId: fallback.id,
-				walletName: fallback.name,
-				providerId: fallback.providerId,
-				source: "fallback"
-			} : { source: "none" };
 		} else {
-			selection = { source: "none" };
+			selection = resolveWalletSelection({
+				agentId: params.agentId,
+				skillWalletId: params.skillWalletId,
+				env
+			});
 		}
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "wallet selection failed";
@@ -61,7 +57,7 @@ function resolveWalletActionSelection(params) {
 		throw new WalletActionSelectionError("wallet_not_found", message);
 	}
 	if (!selection.walletId) {
-		throw new WalletActionSelectionError("wallet_handle_required", "Agent wallet handle, walletId, or default Agent wallet required");
+		throw new WalletActionSelectionError("wallet_handle_required", "Select an Agent wallet: use an explicit wallet, skill override, Agent assignment, or Default Agent wallet fallback");
 	}
 	const wallet = registry.wallets.find((entry) => entry.id === selection.walletId);
 	if (!wallet) {