npm - @fased/fased - Versions diffs - 0.1.68 → 0.1.69 - Mend

@fased/fased 0.1.68 → 0.1.69

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (103) hide show

package/dist/control-ui/index.html CHANGED Viewed

@@ -14,7 +14,7 @@
     <link rel="icon" type="image/png" sizes="32x32" href="./favicon-32.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="./apple-touch-icon.png" />
     <script data-fased-boot-watchdog src="./boot-watchdog.js" defer></script>
-    <script type="module" crossorigin src="./assets/index-Cu13yYHr.js"></script>
+    <script type="module" crossorigin src="./assets/index-S88kp5ZQ.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-RwVraC3c.css">
   </head>
   <body>

package/dist/control-ui/version.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":"0.1.68"}
1	+ {"version":"0.1.69"}

package/dist/gateway/server-http.js CHANGED Viewed

@@ -29,13 +29,13 @@ import { normalizeCanvasScopedUrl } from "./canvas-capability.js";
 import { A2UI_PATH, CANVAS_HOST_PATH, CANVAS_WS_PATH, handleA2uiHttpRequest } from "../canvas-host/a2ui.js";
 import { resolveFederationBondWallet } from "../wallet/solana-bond-signing.js";
 import { createAndSubmitFederationBondProof, loadPersistedFederationBondProof, submitFederationBondProof } from "../federation/auto-connect.js";
+import { resolveNativeSignerWalletId } from "../wallet/native-signer-wallet-id.js";
 import { beginWalletApprovalAssertion, beginWalletPasskeyRegistration, consumeWalletApprovalGrant, createWalletApprovalChallenge, finishWalletApprovalAssertion, finishWalletPasskeyRegistration, listWalletPasskeys, readWalletApprovalAuthSnapshot, removeWalletPasskey, resolveWalletApprovalAuthMode, resolveWalletApprovalChallengeTtlSeconds, resolveWalletApprovalGrantTtlSeconds } from "../wallet/wallet-approval-auth.js";
 import { readWalletStatusSnapshot } from "../wallet/wallet-status.js";
 import { inspectSatBondPosition, inspectSatBondStakingDistributor, inspectSatBondStakingPosition, inspectSatChainSlot, invalidateSatReadCaches } from "../extensions/sat-mining/src/rpc-read.js";
 import { digestSatSubmissionIntent } from "../extensions/sat-mining/src/submission-ledger.js";
 import { runWithSatSubmissionWorkflow, submitSatCancelBondUnlock, submitSatClaimBondStakingRewards, submitSatFinalizeBondUnlock, submitSatIncreaseBondPosition, submitSatOpenBondPosition, submitSatRequestBondUnlock, submitSatSyncBondStakingPosition, submitSatSyncBondStakingRewards } from "../extensions/sat-mining/src/solana-submit.js";
 import { resolveAgentAvatar } from "../agents/identity-avatar.js";
-import { resolveNativeSignerWalletId } from "../wallet/native-signer-wallet-id.js";
 import { configureSignerOwnedWalletNetwork } from "../wallet/signer-network-admin.js";
 import { listWalletInboundEvents, pollWalletInboundEvents, reconcileWalletInboundEvents, recordWalletInboundWebhookEvent } from "../wallet/wallet-inbound-events.js";
 import { walletSetupCommand } from "../commands/wallet.js";
@@ -681,7 +681,7 @@ async function readWalletSettingsSignerPolicy(params) {
 				...asset,
 				destinations: [...asset.destinations]
 			})),
-			...state === "locked" ? { guidance: "Signer policy is deny-all. Install an owner-reviewed policy through the native signer control socket; the Gateway can only tighten it." } : {}
+			...state === "locked" ? { guidance: `This existing wallet is deny-all. Review its immutable role, then run: fased wallet policy activate-role-baseline --wallet-id ${walletId} --role ${policy.role} --confirm` } : {}
 		};
 	} catch {
 		return {
@@ -5078,6 +5078,16 @@ function createGatewayHttpServer(opts) {
 						});
 						return;
 					}
+					if (resolveWalletUserRole(existing) === "mining") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "mining_retirement_required",
+								message: "Mining wallets cannot be deleted directly; use Retire and replace Mining wallet so signer acknowledgement precedes registry detachment"
+							}
+						});
+						return;
+					}
 					const deletionSafety = checkNamedWalletDeletionSafety({
 						walletId,
 						env: process.env
@@ -5289,7 +5299,7 @@ function createGatewayHttpServer(opts) {
 								ok: false,
 								error: {
 									code: "wallet_in_use",
-									message: "walletId is the singleton SAT Mining wallet; Archive/Replace Mining with an Agent wallet before making it the primary Agent wallet"
+									message: "walletId is the singleton SAT Mining wallet; Archive/Replace Mining with an Agent wallet before making it the Default Agent wallet fallback"
 								}
 							});
 							return;
@@ -5298,12 +5308,12 @@ function createGatewayHttpServer(opts) {
 							const registry = readWalletProviderRegistry(process.env);
 							const wallet = registry.wallets.find((entry) => entry.id === nextDefaultWalletId);
 							const role = resolveWalletUserRole(wallet) ?? (registry.defaultWalletId === nextDefaultWalletId ? "agent" : undefined);
-							if (role && role !== "agent") {
+							if (role !== "agent") {
 								sendLoginResponse(409, {
 									ok: false,
 									error: {
 										code: "wallet_purpose_locked",
-										message: "only Agent wallets can become the primary Agent fallback; create a new Agent wallet instead"
+										message: "only an explicit Agent wallet can become the Default Agent wallet fallback; create or select an Agent wallet instead"
 									}
 								});
 								return;
@@ -5316,9 +5326,34 @@ function createGatewayHttpServer(opts) {
 					}
 					const agentId = typeof payload.agentId === "string" ? payload.agentId.trim() : "";
 					if (agentId) {
+						const assignedWalletId = typeof payload.walletId === "string" ? payload.walletId.trim() : "";
+						if (assignedWalletId) {
+							const registry = readWalletProviderRegistry(process.env);
+							const wallet = registry.wallets.find((entry) => entry.id === assignedWalletId);
+							if (!wallet) {
+								sendLoginResponse(404, {
+									ok: false,
+									error: {
+										code: "wallet_not_found",
+										message: "walletId does not exist"
+									}
+								});
+								return;
+							}
+							if (resolveWalletUserRole(wallet) !== "agent") {
+								sendLoginResponse(409, {
+									ok: false,
+									error: {
+										code: "wallet_purpose_locked",
+										message: "only an explicit Agent wallet can be assigned to an Agent"
+									}
+								});
+								return;
+							}
+						}
 						setAgentWalletAssignment({
 							agentId,
-							walletId: typeof payload.walletId === "string" ? payload.walletId.trim() : undefined,
+							walletId: assignedWalletId || undefined,
 							env: process.env
 						});
 					}
@@ -5835,10 +5870,12 @@ function createGatewayHttpServer(opts) {
 					}
 				} };
 				statusPayload.wallets = registry.wallets.map((wallet) => {
+					const liveWallet = snapshot.wallets?.find((entry) => entry.id === wallet.id);
 					const solana = findWalletChainEntry(snapshotAny.chainWallets?.solana, wallet.id);
-					const readiness = {
+					const readiness = liveWallet?.readiness ?? {
 						keystore: Boolean(solana?.decryptReady ?? false),
-						rpc: Boolean(solana?.rpcConfigured)
+						rpc: Boolean(solana?.rpcConfigured),
+						ready: false
 					};
 					return {
 						id: wallet.id,
@@ -5850,7 +5887,7 @@ function createGatewayHttpServer(opts) {
 						readiness,
 						chains: wallet.addresses?.solana ? ["solana"] : [],
 						rpcConfigured: readiness.rpc,
-						health: readiness.keystore ? "ok" : "degraded"
+						health: readiness.ready ? "ok" : "degraded"
 					};
 				});
 				if (configuredProviderId === "local-socket-signer") {

package/dist/mining/mainnet-sync.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { SAT_RUNTIME_ENV_KEYS, resolveSatRuntimeIds, resolveWritableSatRuntimeDefaultsFile } from "../config/sat-runtime-ids.js";
+import { SAT_RUNTIME_ENV_KEYS, SAT_RUNTIME_TRUST_ENV_KEYS, resolveSatRuntimeIds, resolveWritableSatRuntimeDefaultsFile } from "../config/sat-runtime-ids.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { createHash, createPublicKey, verify } from "node:crypto";
@@ -180,24 +180,43 @@ function readLocalIds(env) {
 function idsEqual(left, right) {
 	return Boolean(left && right && left.programId === right.programId && left.bondProgramId === right.bondProgramId && left.mintAddress === right.mintAddress && left.mintProgramId === right.mintProgramId);
 }
-function buildEnvFile(ids) {
+function buildEnvFile(ids, trust) {
 	return [
 		"# Managed by Fased Agent official SAT mainnet sync.",
 		`${SAT_RUNTIME_ENV_KEYS.programId}=${ids.programId}`,
 		`${SAT_RUNTIME_ENV_KEYS.bondProgramId}=${ids.bondProgramId}`,
 		`${SAT_RUNTIME_ENV_KEYS.mintAddress}=${ids.mintAddress}`,
 		`${SAT_RUNTIME_ENV_KEYS.mintProgramId}=${ids.mintProgramId}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestPath}=${trust.manifestPath}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestSha256}=${trust.manifestSha256}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestSignaturePath}=${trust.manifestSignaturePath}`,
 		""
 	].join("\n");
 }
-async function writeRuntimeIds(ids, env) {
+async function writeRuntimeIds(ids, env, trust) {
 	const runtimeFile = resolveWritableSatRuntimeDefaultsFile(env);
+	const manifestPath = `${runtimeFile}.manifest.json`;
+	const manifestSignaturePath = `${runtimeFile}.manifest.sig`;
 	await fs.mkdir(path.dirname(runtimeFile), { recursive: true });
-	await fs.writeFile(runtimeFile, buildEnvFile(ids), { mode: 384 });
+	await fs.writeFile(manifestPath, trust.rawManifest, { mode: 384 });
+	await fs.writeFile(manifestSignaturePath, `${trust.signature.trim()}\n`, { mode: 384 });
+	await fs.writeFile(runtimeFile, buildEnvFile(ids, {
+		manifestPath,
+		manifestSha256: trust.manifestSha256,
+		manifestSignaturePath
+	}), { mode: 384 });
+	await Promise.all([
+		fs.chmod(manifestPath, 384),
+		fs.chmod(manifestSignaturePath, 384),
+		fs.chmod(runtimeFile, 384)
+	]);
 	env[SAT_RUNTIME_ENV_KEYS.programId] = ids.programId;
 	env[SAT_RUNTIME_ENV_KEYS.bondProgramId] = ids.bondProgramId;
 	env[SAT_RUNTIME_ENV_KEYS.mintAddress] = ids.mintAddress;
 	env[SAT_RUNTIME_ENV_KEYS.mintProgramId] = ids.mintProgramId;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestPath] = manifestPath;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestSha256] = trust.manifestSha256;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestSignaturePath] = manifestSignaturePath;
 	return runtimeFile;
 }
 async function getSatMainnetSyncStatus(opts) {
@@ -312,7 +331,50 @@ async function syncSatMainnetRuntimeIds(opts) {
 			message: before.state === "not_live" ? "Satcoin mainnet is not live yet." : before.message || "SAT mainnet manifest is not ready to apply."
 		};
 	}
-	const runtimeFile = await writeRuntimeIds(before.officialIds, env);
+	const manifestUrl = opts?.manifestUrl?.trim() || resolveManifestUrl(env);
+	const rawManifest = await fetchText(manifestUrl, { required: true });
+	const manifestSha256 = parseSha256(await fetchText(`${manifestUrl}.sha256`, { required: true }));
+	const signature = await fetchText(`${manifestUrl}.sig`, { required: true });
+	if (!rawManifest || !manifestSha256 || !signature?.trim()) {
+		return {
+			...before,
+			ok: false,
+			state: "failed",
+			message: "Verified SAT manifest artifacts could not be persisted for the native signer.",
+			error: "signed SAT runtime manifest, hash, or detached signature is missing"
+		};
+	}
+	const finalVerification = await verifyLiveManifest({
+		manifestUrl,
+		raw: rawManifest,
+		env
+	});
+	if (finalVerification.verification.hash !== "valid" || finalVerification.verification.signature !== "valid" || sha256Hex(rawManifest) !== manifestSha256) {
+		return {
+			...before,
+			ok: false,
+			state: "failed",
+			message: "SAT manifest changed before signer runtime persistence.",
+			verification: finalVerification.verification,
+			trustKeySource: finalVerification.trustKeySource,
+			error: "signed SAT runtime manifest verification raced or failed"
+		};
+	}
+	const persistedManifest = JSON.parse(rawManifest);
+	if (!idsEqual(readOfficialIds(persistedManifest), before.officialIds)) {
+		return {
+			...before,
+			ok: false,
+			state: "failed",
+			message: "SAT manifest IDs changed before signer runtime persistence.",
+			error: "signed SAT runtime ID tuple changed during sync"
+		};
+	}
+	const runtimeFile = await writeRuntimeIds(before.officialIds, env, {
+		rawManifest,
+		manifestSha256,
+		signature
+	});
 	const after = await getSatMainnetSyncStatus({
 		env,
 		manifestUrl: opts?.manifestUrl

package/dist/operator/operator-readiness.js CHANGED Viewed

@@ -56,7 +56,7 @@ function describeOperatorReadinessChecklist(input) {
 		agentWallet ? {
 			title: "Agent wallet set",
 			summary: defaultWallet && firstAgentWallet && defaultWallet.id !== firstAgentWallet.id ? `${defaultWallet.name} · ${firstAgentWallet.name}` : agentWallet.name,
-			detail: defaultWallet ? "This primary Agent wallet handles paid A2A sends, payment evidence publication, skill/plugin wallet actions, and routine transfers when no explicit @wallet handle is supplied." : "This Agent wallet can be selected by explicit @wallet handle. Set it as primary if it should be the fallback when no handle is supplied.",
+			detail: defaultWallet ? "This Default Agent wallet is the final fallback for paid A2A sends, payment evidence publication, skill/plugin wallet actions, and routine transfers after explicit, skill, and Agent assignment routing." : "This Agent wallet can be selected explicitly or assigned to an Agent or skill. Set it as the optional fallback only when global fallback behavior is wanted.",
 			tone: "success"
 		} : defaultWalletId ? {
 			title: "Agent wallet set",

package/dist/plugin-sdk/{audio-preflight-_FVQjR1r.js → audio-preflight-CS7Q_7-R.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { Et as isAudioAttachment, St as normalizeMediaAttachments, Tt as runCapability, bt as buildProviderRegistry, wt as resolveMediaAttachmentLocalRoots, xt as createMediaAttachmentCache } from "./config-schema-DjU_uD-6.js";
+import { Et as isAudioAttachment, St as normalizeMediaAttachments, Tt as runCapability, bt as buildProviderRegistry, wt as resolveMediaAttachmentLocalRoots, xt as createMediaAttachmentCache } from "./config-schema-BiBOUW89.js";
 import "./runtime-CXSQwMaR.js";
 import "./subsystem-DBPNbQDQ.js";
 import { i as logVerbose, s as shouldLogVerbose } from "./globals-B_jjtAje.js";
@@ -36,7 +36,7 @@ import "./manager-BegWxNYX.js";
 import "./query-expansion-BG3FgzF7.js";
 import "./common-HCcXU-NR.js";
 import "./commands-registry-G5KXSi_y.js";
-import "./runtime-dependency-nup8niQL.js";
+import "./runtime-dependency-DczkvPxn.js";
 import "./path-alias-guards-DjgDArrp.js";
 import "./fs-safe-g4g7GT02.js";
 import "./qr-image-B4MlMG4N.js";

package/dist/plugin-sdk/channel-plugin-common.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { n as DEFAULT_ACCOUNT_ID, r as normalizeAccountId } from "./session-key--_1zVBRB.js";
 import { Y as ChannelMessageActionContext, n as ChannelPlugin, ut as getChatChannelMeta } from "./types.plugin-BcSBq42x.js";
-import { _ as FasedAgentPluginApi, t as PluginRuntime } from "./types-DtCOO_hW.js";
-import { a as buildChannelConfigSchema, c as emptyPluginConfigSchema, i as setAccountEnabledInConfigSection, n as formatPairingApproveHint, o as applyAccountNameToChannelSection, r as deleteAccountFromConfigSection, s as migrateBaseNameToDefaultAccount, t as PAIRING_APPROVED_MESSAGE } from "./pairing-message-mKO92L-M.js";
+import { _ as FasedAgentPluginApi, t as PluginRuntime } from "./types-BakzIzGN.js";
+import { a as buildChannelConfigSchema, c as emptyPluginConfigSchema, i as setAccountEnabledInConfigSection, n as formatPairingApproveHint, o as applyAccountNameToChannelSection, r as deleteAccountFromConfigSection, s as migrateBaseNameToDefaultAccount, t as PAIRING_APPROVED_MESSAGE } from "./pairing-message-CiTcdD6m.js";
 export { type ChannelMessageActionContext, type ChannelPlugin, DEFAULT_ACCOUNT_ID, type FasedAgentPluginApi, PAIRING_APPROVED_MESSAGE, type PluginRuntime, applyAccountNameToChannelSection, buildChannelConfigSchema, deleteAccountFromConfigSection, emptyPluginConfigSchema, formatPairingApproveHint, getChatChannelMeta, migrateBaseNameToDefaultAccount, normalizeAccountId, setAccountEnabledInConfigSection };

package/dist/plugin-sdk/{chunk-items-LH4uKSnh.js → chunk-items-BLBZNORg.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { an as wrapExternalContent } from "./config-schema-DjU_uD-6.js";
+import { an as wrapExternalContent } from "./config-schema-BiBOUW89.js";
 //#region src/security/channel-metadata.ts
 const DEFAULT_MAX_CHARS = 800;

package/dist/plugin-sdk/command-status.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { Ht as buildCommandsMessage, Ut as buildCommandsMessagePaginated, Wt as buildHelpMessage } from "./config-schema-DjU_uD-6.js";
+import { Ht as buildCommandsMessage, Ut as buildCommandsMessagePaginated, Wt as buildHelpMessage } from "./config-schema-BiBOUW89.js";
 import "./runtime-CXSQwMaR.js";
 import "./subsystem-DBPNbQDQ.js";
 import "./globals-B_jjtAje.js";
@@ -36,7 +36,7 @@ import "./manager-BegWxNYX.js";
 import "./query-expansion-BG3FgzF7.js";
 import "./common-HCcXU-NR.js";
 import "./commands-registry-G5KXSi_y.js";
-import "./runtime-dependency-nup8niQL.js";
+import "./runtime-dependency-DczkvPxn.js";
 import "./path-alias-guards-DjgDArrp.js";
 import "./fs-safe-g4g7GT02.js";
 import "./qr-image-B4MlMG4N.js";