@canton-network/wallet-gateway-remote 1.1.0 → 1.2.0

package/README.md

@@ -44,6 +44,19 @@ wallet-gateway --config-schema
 
 The JSON-RPC API specs from `api-specs/` are generated into strongly-typed method builders for the remote RPC server. To update the codegen, run `yarn generate:dapp`.
 
+## Dfns
+
+1. Create a service account in the Dfns dashboard with permissions to create and sign with Canton wallets, then download its credentials.
+
+2. Set the following environment variables before starting the Gateway:
+    - `DFNS_ORG_ID` — your Dfns organization ID (required; the driver is skipped if unset)
+    - `DFNS_BASE_URL` — Dfns API base URL (defaults to `https://api.dfns.io`)
+    - `DFNS_CRED_ID` — service account credential ID
+    - `DFNS_PRIVATE_KEY` — service account private key (PEM)
+    - `DFNS_AUTH_TOKEN` — service account auth token
+
+Dfns provisions and activates Canton wallets through its validator integration, so no additional Gateway configuration is required. Only `Canton` and `CantonTestnet` network wallets are supported. See [`@canton-network/core-signing-dfns`](../../core/signing-dfns/README.md) for full driver details.
+
 ## Fireblocks
 
 1. Complete steps 1–3 from the instructions at https://github.com/hyperledger-labs/splice-wallet-kernel/tree/main/core/signing-fireblocks

package/dist/auth/jwt-auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WA+H5D,CAAA"}
+{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WA8H5D,CAAA"}

package/dist/auth/jwt-auth-service.js

@@ -33,9 +33,8 @@ export const jwtAuthService = (store, logger) => ({
                 logger.warn(`No identity provider found for issuer: ${iss}`);
                 return undefined;
             }
-            const scope = decoded.scope;
-            if (!scope) {
-                logger.warn('JWT does not contain a scope');
+            if (!decoded.scope && !decoded.scp) {
+                logger.warn('JWT does not contain a scope claim');
                 return undefined;
             }
             if (idp.type == 'self_signed') {

package/dist/env.d.ts

@@ -4,6 +4,11 @@ export declare class Env {
     static BLOCKDAEMON_API_URL: (fallback: string) => string;
     static BLOCKDAEMON_API_KEY: (fallback: string) => string;
     static BLOCKDAEMON_CAIP2: (fallback: string) => string;
+    static DFNS_ORG_ID: () => string | undefined;
+    static DFNS_BASE_URL: (fallback: string) => string;
+    static DFNS_CRED_ID: () => string | undefined;
+    static DFNS_PRIVATE_KEY: () => string | undefined;
+    static DFNS_AUTH_TOKEN: () => string | undefined;
     static get(key: string, options: {
         required?: boolean;
         fallback: string;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAGA,qBAAa,GAAG;IACZ,MAAM,CAAC,kBAAkB,2BAAsC;IAC/D,MAAM,CAAC,iBAAiB,2BAAqC;IAC7D,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,iBAAiB,GAAI,UAAU,MAAM,YACE;IAE9C,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAClD,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,GAChE,MAAM,GAAG,SAAS;CAcxB"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAGA,qBAAa,GAAG;IACZ,MAAM,CAAC,kBAAkB,2BAAsC;IAC/D,MAAM,CAAC,iBAAiB,2BAAqC;IAC7D,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,iBAAiB,GAAI,UAAU,MAAM,YACE;IAC9C,MAAM,CAAC,WAAW,2BAA+B;IACjD,MAAM,CAAC,aAAa,GAAI,UAAU,MAAM,YACE;IAC1C,MAAM,CAAC,YAAY,2BAAgC;IACnD,MAAM,CAAC,gBAAgB,2BAAoC;IAC3D,MAAM,CAAC,eAAe,2BAAmC;IAEzD,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAClD,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,GAChE,MAAM,GAAG,SAAS;CAcxB"}

package/dist/env.js

@@ -6,6 +6,11 @@ export class Env {
     static { this.BLOCKDAEMON_API_URL = (fallback) => Env.get('BLOCKDAEMON_API_URL', { fallback }); }
     static { this.BLOCKDAEMON_API_KEY = (fallback) => Env.get('BLOCKDAEMON_API_KEY', { fallback }); }
     static { this.BLOCKDAEMON_CAIP2 = (fallback) => Env.get('BLOCKDAEMON_CAIP2', { fallback }); }
+    static { this.DFNS_ORG_ID = () => Env.get('DFNS_ORG_ID'); }
+    static { this.DFNS_BASE_URL = (fallback) => Env.get('DFNS_BASE_URL', { fallback }); }
+    static { this.DFNS_CRED_ID = () => Env.get('DFNS_CRED_ID'); }
+    static { this.DFNS_PRIVATE_KEY = () => Env.get('DFNS_PRIVATE_KEY'); }
+    static { this.DFNS_AUTH_TOKEN = () => Env.get('DFNS_AUTH_TOKEN'); }
     static get(key, options) {
         const { fallback, required } = options || {};
         const value = process.env[key]?.trim() || fallback?.trim();

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAuB7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AA6IvC,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBA4IhE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AA2B7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AA6IvC,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAiKhE"}

package/dist/init.js

@@ -6,9 +6,10 @@ import { web } from './web/server.js';
 import { StoreSql, bootstrap, connection, migrator, } from '@canton-network/core-wallet-store-sql';
 import { StoreSql as SigningStoreSql, bootstrap as signingBootstrap, connection as signingConnection, migrator as signingMigrator, } from '@canton-network/core-signing-store-sql';
 import { ConfigUtils } from './config/ConfigUtils.js';
-import { SigningProvider } from '@canton-network/core-signing-lib';
+import { SigningProvider, } from '@canton-network/core-signing-lib';
 import { ParticipantSigningDriver } from '@canton-network/core-signing-participant';
 import { InternalSigningDriver } from '@canton-network/core-signing-internal';
+import DfnsSigningProvider from '@canton-network/core-signing-dfns';
 import FireblocksSigningProvider from '@canton-network/core-signing-fireblocks';
 import BlockdaemonSigningProvider from '@canton-network/core-signing-blockdaemon';
 import { jwtAuthService } from './auth/jwt-auth-service.js';
@@ -161,6 +162,23 @@ export async function initialize(opts, logger) {
             caip2: Env.BLOCKDAEMON_CAIP2('canton:testnet'),
         }),
     };
+    if (Env.DFNS_ORG_ID() &&
+        Env.DFNS_CRED_ID() &&
+        Env.DFNS_PRIVATE_KEY() &&
+        Env.DFNS_AUTH_TOKEN()) {
+        drivers[SigningProvider.DFNS] = new DfnsSigningProvider({
+            orgId: Env.DFNS_ORG_ID(),
+            baseUrl: Env.DFNS_BASE_URL('https://api.dfns.io'),
+            credentials: {
+                credId: Env.DFNS_CRED_ID(),
+                privateKey: Env.DFNS_PRIVATE_KEY(),
+                authToken: Env.DFNS_AUTH_TOKEN(),
+            },
+        });
+    }
+    else {
+        logger.warn('Dfns env vars not fully set — Dfns signing provider will be unavailable');
+    }
     const allowedPaths = {
         [config.server.dappPath]: ['*'],
         [config.server.userPath]: [

package/dist/ledger/transaction-service.d.ts

@@ -17,6 +17,19 @@ export declare class TransactionService {
     signWithWalletKernel(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResultSigned>;
     signWithBlockdaemon(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
     signWithFireblocks(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
+    /**
+     * Dfns broadcasts the prepared transaction to Canton itself, so we get back
+     * an updateId rather than a raw signature. We persist the updateId as the
+     * signature payload (the controller short-circuits Dfns execute) and surface
+     * the same SignResult shape the other external providers use.
+     */
+    signWithDfns(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
+    /**
+     * Dfns has already broadcast the transaction at sign-time, so execute is a
+     * state reconciliation: mark the stored transaction as executed and return
+     * the updateId Dfns gave us. We deliberately don't post to the ledger here.
+     */
+    executeWithDfns(transaction: Transaction): Promise<ExecuteResult>;
     executeWithParticipant(userId: UserId, executeParams: ExecuteParams, transaction: Transaction, ledgerClient: LedgerClient, network: Network): Promise<ExecuteResult>;
     executeWithExternal(userId: UserId, executeParams: ExecuteParams, transaction: Transaction, ledgerClient: LedgerClient): Promise<ExecuteResult>;
 }

package/dist/ledger/transaction-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transaction-service.d.ts","sourceRoot":"","sources":["../../src/ledger/transaction-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,OAAO,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAGH,sBAAsB,EACtB,eAAe,EAElB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACH,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EACnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAYjE,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,QAAQ;gBALR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAC3B,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,YAAK,EACE,QAAQ,EAAE,QAAQ;YAGhB,iCAAiC;IAWxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAS/C,oBAAoB,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAqDf,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAwGT,kBAAkB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IA4GT,sBAAsB,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,aAAa,CAAC;IAyCZ,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,GAC3B,OAAO,CAAC,aAAa,CAAC;CAuD5B"}
+{"version":3,"file":"transaction-service.d.ts","sourceRoot":"","sources":["../../src/ledger/transaction-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,OAAO,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAGH,sBAAsB,EACtB,eAAe,EAElB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACH,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EACnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAYjE,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,QAAQ;gBALR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAC3B,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,YAAK,EACE,QAAQ,EAAE,QAAQ;YAGhB,iCAAiC;IAWxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAS/C,oBAAoB,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAqDf,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAwGT,kBAAkB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IA4GtB;;;;;OAKG;IACU,YAAY,CACrB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAkGtB;;;;OAIG;IACU,eAAe,CACxB,WAAW,EAAE,WAAW,GACzB,OAAO,CAAC,aAAa,CAAC;IA8BZ,sBAAsB,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,aAAa,CAAC;IAyCZ,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,GAC3B,OAAO,CAAC,aAAa,CAAC;CAuD5B"}

package/dist/ledger/transaction-service.js

@@ -239,6 +239,122 @@ export class TransactionService {
             };
         }
     }
+    /**
+     * Dfns broadcasts the prepared transaction to Canton itself, so we get back
+     * an updateId rather than a raw signature. We persist the updateId as the
+     * signature payload (the controller short-circuits Dfns execute) and surface
+     * the same SignResult shape the other external providers use.
+     */
+    async signWithDfns(userId, wallet, signParams) {
+        const signingProvider = this.signingDrivers[SigningProvider.DFNS];
+        if (!signingProvider) {
+            throw new Error('Dfns signing driver not available');
+        }
+        const driver = signingProvider.controller(userId);
+        const tx = await this.loadPreparedTransactionForSigning(signParams.transactionId);
+        let signingResult;
+        if (tx.externalTxId) {
+            signingResult = await driver
+                .getTransaction({
+                userId,
+                txId: tx.externalTxId,
+            })
+                .then(handleSigningError);
+        }
+        else {
+            signingResult = await driver
+                .signTransaction({
+                tx: tx.preparedTransaction,
+                txHash: tx.preparedTransactionHash,
+                keyIdentifier: {
+                    publicKey: wallet.publicKey,
+                },
+            })
+                .then(handleSigningError);
+        }
+        const now = new Date();
+        if (signingResult.status === 'signed') {
+            if (!signingResult.signature) {
+                throw new Error('No updateId returned from Dfns');
+            }
+            const signedTx = {
+                id: tx.id,
+                commandId: tx.commandId,
+                status: signingResult.status,
+                preparedTransaction: tx.preparedTransaction,
+                preparedTransactionHash: tx.preparedTransactionHash,
+                origin: tx?.origin ?? null,
+                ...(tx?.createdAt && {
+                    createdAt: tx.createdAt,
+                }),
+                signedAt: now,
+                externalTxId: signingResult.txId,
+            };
+            await this.store.setTransactionSigned(tx.id, now, signingResult.txId);
+            this.notifier.emit('txChanged', signedTx);
+            return {
+                status: signingResult.status,
+                signature: signingResult.signature,
+                signedBy: wallet.namespace,
+                partyId: wallet.partyId,
+                externalTxId: signingResult.txId,
+            };
+        }
+        else {
+            const status = signingResult.status === 'pending' ? 'pending' : 'failed';
+            const pendingTx = {
+                id: tx.id,
+                commandId: tx.commandId,
+                status,
+                preparedTransaction: tx.preparedTransaction,
+                preparedTransactionHash: tx.preparedTransactionHash,
+                externalTxId: signingResult.txId,
+                origin: tx?.origin ?? null,
+                ...(tx?.createdAt && {
+                    createdAt: tx.createdAt,
+                }),
+            };
+            await this.store.setTransactionStatus(tx.id, status, {
+                externalTxId: signingResult.txId,
+            });
+            this.notifier.emit('txChanged', pendingTx);
+            return {
+                status: signingResult.status,
+                externalTxId: signingResult.txId,
+                partyId: wallet.partyId,
+            };
+        }
+    }
+    /**
+     * Dfns has already broadcast the transaction at sign-time, so execute is a
+     * state reconciliation: mark the stored transaction as executed and return
+     * the updateId Dfns gave us. We deliberately don't post to the ledger here.
+     */
+    async executeWithDfns(transaction) {
+        if (!transaction.externalTxId) {
+            throw new Error('Cannot execute Dfns transaction without externalTxId from Dfns');
+        }
+        const executedTx = {
+            id: transaction.id,
+            commandId: transaction.commandId,
+            status: 'executed',
+            preparedTransaction: transaction.preparedTransaction,
+            preparedTransactionHash: transaction.preparedTransactionHash,
+            origin: transaction.origin ?? null,
+            ...(transaction.createdAt && {
+                createdAt: transaction.createdAt,
+            }),
+            ...(transaction.signedAt && {
+                signedAt: transaction.signedAt,
+            }),
+            externalTxId: transaction.externalTxId,
+        };
+        await this.store.setTransactionStatus(transaction.id, 'executed', {
+            externalTxId: transaction.externalTxId,
+        });
+        this.notifier.emit('txChanged', executedTx);
+        return { updateId: transaction.externalTxId };
+    }
     async executeWithParticipant(userId, executeParams, transaction, ledgerClient, network) {
         const { partyId } = executeParams;
         const { commandId } = transaction;

package/dist/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.d.ts

@@ -0,0 +1,23 @@
+import { UserId } from '@canton-network/core-wallet-auth';
+import { Store, Wallet } from '@canton-network/core-wallet-store';
+import { SigningDriverInterface } from '@canton-network/core-signing-lib';
+import { Logger } from 'pino';
+import { PartyAllocationService } from '../../party-allocation-service.js';
+import { PartyHint, Primary } from '../../../user-api/rpc-gen/typings.js';
+import type { WalletAllocator } from '../wallet-allocation-service.js';
+/**
+ * Dfns sign-only allocator. The gateway runs the topology flow against its
+ * configured validator; Dfns is asked only to sign the topology hash, mirroring
+ * the bring-your-own-validator pattern used for other external providers.
+ */
+export declare class DfnsWalletAllocator implements WalletAllocator {
+    private store;
+    private logger;
+    private partyAllocator;
+    private signingDriver;
+    constructor(store: Store, logger: Logger, partyAllocator: PartyAllocationService, signingDriver: SigningDriverInterface);
+    createWallet(userId: UserId, _email: string | undefined, partyHint: PartyHint, primary?: Primary): Promise<Wallet>;
+    allocateParty(userId: UserId, _email: string | undefined, existingWallet: Wallet): Promise<void>;
+    private finalizeWallet;
+}
+//# sourceMappingURL=dfns-wallet-allocator.d.ts.map

package/dist/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dfns-wallet-allocator.d.ts","sourceRoot":"","sources":["../../../../src/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AACzD,OAAO,EAAE,KAAK,EAAgB,MAAM,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,EAEH,sBAAsB,EAEzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAYtE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IAEnD,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,aAAa;gBAHb,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,sBAAsB,EACtC,aAAa,EAAE,sBAAsB;IAG3C,YAAY,CACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE,OAAe,GACzB,OAAO,CAAC,MAAM,CAAC;IA4DZ,aAAa,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC;YA+DF,cAAc;CA+C/B"}

package/dist/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.js

@@ -0,0 +1,135 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { SigningProvider, } from '@canton-network/core-signing-lib';
+import { WALLET_DISABLED_REASON } from '@canton-network/core-types';
+function handleSigningError(result) {
+    if ('error' in result) {
+        throw new Error(`Error from signing driver: ${result.error_description}`);
+    }
+    return result;
+}
+/**
+ * Dfns sign-only allocator. The gateway runs the topology flow against its
+ * configured validator; Dfns is asked only to sign the topology hash, mirroring
+ * the bring-your-own-validator pattern used for other external providers.
+ */
+export class DfnsWalletAllocator {
+    constructor(store, logger, partyAllocator, signingDriver) {
+        this.store = store;
+        this.logger = logger;
+        this.partyAllocator = partyAllocator;
+        this.signingDriver = signingDriver;
+    }
+    async createWallet(userId, _email, partyHint, primary = false) {
+        const driver = this.signingDriver.controller(userId);
+        const key = await driver
+            .createKey({ name: partyHint })
+            .then(handleSigningError);
+        const namespace = this.partyAllocator.createFingerprintFromKey(key.publicKey);
+        const transactions = await this.partyAllocator.generateTopologyTransactions(partyHint, key.publicKey);
+        const topologyTransactions = transactions.topologyTransactions ?? [];
+        const internalTxId = crypto
+            .randomUUID()
+            .replace(/-/g, '')
+            .substring(0, 16);
+        const txPayload = JSON.stringify(topologyTransactions);
+        const { status, txId } = await driver
+            .signTransaction({
+            tx: Buffer.from(txPayload).toString('base64'),
+            txHash: transactions.multiHash,
+            keyIdentifier: { id: key.id, publicKey: key.publicKey },
+            internalTxId,
+        })
+            .then(handleSigningError);
+        const network = await this.store.getCurrentNetwork();
+        const walletBase = {
+            partyId: `${partyHint}::${namespace}`,
+            hint: partyHint,
+            namespace,
+            signingProviderId: SigningProvider.DFNS,
+            networkId: network.id,
+            primary,
+            publicKey: key.publicKey,
+            externalTxId: txId,
+            topologyTransactions: topologyTransactions.join(', '),
+            rights: [],
+        };
+        const wallet = await this.finalizeWallet(walletBase, userId, status, txId, topologyTransactions, namespace, driver);
+        await this.store.addWallet(wallet);
+        return wallet;
+    }
+    async allocateParty(userId, _email, existingWallet) {
+        if (!existingWallet.externalTxId ||
+            !existingWallet.topologyTransactions) {
+            throw new Error('Existing wallet is missing field externalTxId or topologyTransactions');
+        }
+        const driver = this.signingDriver.controller(userId);
+        const { signature, status, metadata } = await driver
+            .getTransaction({ txId: existingWallet.externalTxId })
+            .then(handleSigningError);
+        let walletUpdate = {
+            partyId: existingWallet.partyId,
+            networkId: existingWallet.networkId,
+        };
+        if (status === 'signed') {
+            if (!signature) {
+                throw new Error('Transaction signed but no signature found in result');
+            }
+            const partyId = await this.partyAllocator.allocatePartyWithExistingWallet(existingWallet.namespace, existingWallet.topologyTransactions.split(', '), signature, userId);
+            walletUpdate = {
+                ...walletUpdate,
+                partyId,
+                status: 'allocated',
+                reason: '',
+            };
+        }
+        else if (status === 'pending') {
+            walletUpdate = {
+                ...walletUpdate,
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            };
+        }
+        else {
+            this.logger.warn(`Topology transaction for wallet ${existingWallet.partyId} was ${status} with ${JSON.stringify(metadata)}`);
+            const reason = status === 'rejected'
+                ? WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED
+                : WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED;
+            walletUpdate = {
+                ...walletUpdate,
+                status: 'removed',
+                disabled: true,
+                reason,
+            };
+        }
+        return this.store.updateWallet(walletUpdate);
+    }
+    async finalizeWallet(walletBase, userId, status, txId, topologyTransactions, namespace, driver) {
+        if (status === 'signed') {
+            const { signature } = await driver
+                .getTransaction({ txId })
+                .then(handleSigningError);
+            if (!signature) {
+                throw new Error('Transaction signed but no signature found in result');
+            }
+            const partyId = await this.partyAllocator.allocatePartyWithExistingWallet(namespace, topologyTransactions, signature, userId);
+            return { ...walletBase, partyId, status: 'allocated' };
+        }
+        if (status === 'pending') {
+            return {
+                ...walletBase,
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            };
+        }
+        const reason = status === 'rejected'
+            ? WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED
+            : WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED;
+        return {
+            ...walletBase,
+            status: 'removed',
+            disabled: true,
+            reason,
+        };
+    }
+}

package/dist/ledger/wallet-allocation/wallet-allocation-service.d.ts

@@ -13,6 +13,7 @@ export declare class WalletAllocationService {
     private readonly kernelAllocator?;
     private readonly fireblocksAllocator?;
     private readonly blockdaemonAllocator?;
+    private readonly dfnsAllocator?;
     constructor(store: Store, logger: Logger, partyAllocator: PartyAllocationService, signingDrivers?: Partial<Record<SigningProvider, SigningDriverInterface>>);
     createWallet(userId: UserId, email: string | undefined, partyHint: PartyHint, primary: Primary, signingProviderId: SigningProvider): Promise<Wallet>;
     allocateParty(userId: UserId, email: string | undefined, existingWallet: Wallet, signingProviderId: SigningProvider): Promise<void>;

package/dist/ledger/wallet-allocation/wallet-allocation-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-allocation-service.d.ts","sourceRoot":"","sources":["../../../src/ledger/wallet-allocation/wallet-allocation-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAMtE,MAAM,WAAW,eAAe;IAC5B,YAAY,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,aAAa,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB;AAED,qBAAa,uBAAuB;IAChC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAuB;IACxD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAA4B;gBAG9D,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,sBAAsB,EACtC,cAAc,GAAE,OAAO,CACnB,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAC7C;IAuCG,YAAY,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,MAAM,CAAC;IAqDL,aAAa,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,IAAI,CAAC;CAgDnB"}
+{"version":3,"file":"wallet-allocation-service.d.ts","sourceRoot":"","sources":["../../../src/ledger/wallet-allocation/wallet-allocation-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAOtE,MAAM,WAAW,eAAe;IAC5B,YAAY,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,aAAa,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB;AAED,qBAAa,uBAAuB;IAChC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAuB;IACxD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAA4B;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqB;gBAGhD,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,sBAAsB,EACtC,cAAc,GAAE,OAAO,CACnB,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAC7C;IAiDG,YAAY,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,MAAM,CAAC;IA+DL,aAAa,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,IAAI,CAAC;CAyDnB"}

package/dist/ledger/wallet-allocation/wallet-allocation-service.js

@@ -5,6 +5,7 @@ import { ParticipantWalletAllocator } from './signing-providers/participant-wall
 import { KernelWalletAllocator } from './signing-providers/kernel-wallet-allocator.js';
 import { FireblocksWalletAllocator } from './signing-providers/fireblocks-wallet-allocator.js';
 import { BlockdaemonWalletAllocator } from './signing-providers/blockdaemon-wallet-allocator.js';
+import { DfnsWalletAllocator } from './signing-providers/dfns-wallet-allocator.js';
 export class WalletAllocationService {
     constructor(store, logger, partyAllocator, signingDrivers = {}) {
         this.participantAllocator = new ParticipantWalletAllocator(store, logger, partyAllocator);
@@ -20,6 +21,10 @@ export class WalletAllocationService {
         if (blockdaemonDriver) {
             this.blockdaemonAllocator = new BlockdaemonWalletAllocator(store, logger, partyAllocator, blockdaemonDriver);
         }
+        const dfnsDriver = signingDrivers[SigningProvider.DFNS];
+        if (dfnsDriver) {
+            this.dfnsAllocator = new DfnsWalletAllocator(store, logger, partyAllocator, dfnsDriver);
+        }
     }
     async createWallet(userId, email, partyHint, primary, signingProviderId) {
         switch (signingProviderId) {
@@ -43,6 +48,11 @@ export class WalletAllocationService {
                     throw new Error('Email is required for Blockdaemon wallet allocation');
                 }
                 return this.blockdaemonAllocator.createWallet(userId, email, partyHint, primary);
+            case SigningProvider.DFNS:
+                if (!this.dfnsAllocator) {
+                    throw new Error('Dfns signing driver not available');
+                }
+                return this.dfnsAllocator.createWallet(userId, email, partyHint, primary);
             default:
                 throw new Error(`Unsupported signing provider: ${signingProviderId}`);
         }
@@ -69,6 +79,11 @@ export class WalletAllocationService {
                     throw new Error('Email is required for Blockdaemon wallet allocation');
                 }
                 return this.blockdaemonAllocator.allocateParty(userId, email, existingWallet);
+            case SigningProvider.DFNS:
+                if (!this.dfnsAllocator) {
+                    throw new Error('Dfns signing driver not available');
+                }
+                return this.dfnsAllocator.allocateParty(userId, email, existingWallet);
             default:
                 throw new Error(`Unsupported signing provider: ${signingProviderId}`);
         }

package/dist/user-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AASzC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAwyBvB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AASzC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAkzBvB,CAAA"}

package/dist/user-api/controller.js

@@ -259,6 +259,9 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
                 case SigningProvider.FIREBLOCKS: {
                     return transactionService.signWithFireblocks(userId, wallet, signParams);
                 }
+                case SigningProvider.DFNS: {
+                    return transactionService.signWithDfns(userId, wallet, signParams);
+                }
                 default:
                     throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
             }
@@ -302,6 +305,9 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
                 case SigningProvider.FIREBLOCKS: {
                     return transactionService.executeWithExternal(userId, executeParams, transaction, ledgerClient);
                 }
+                case SigningProvider.DFNS: {
+                    return transactionService.executeWithDfns(transaction);
+                }
                 default:
                     throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
             }

package/dist/web/frontend/404/index.html

@@ -4,8 +4,8 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Not found</title>
-      <script type="module" crossorigin src="../assets/404-BCjBS7OU.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-lfC4c213.js">
+      <script type="module" crossorigin src="../assets/404-B-o9ppJB.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-_pMHlJoE.js">
     </head>
 
     <body>

package/dist/web/frontend/activities/index.html

@@ -4,9 +4,9 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Activities</title>
-      <script type="module" crossorigin src="../assets/activities-4fnnetzm.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-lfC4c213.js">
-      <link rel="modulepreload" crossorigin href="../assets/state-BpQr_22x.js">
+      <script type="module" crossorigin src="../assets/activities-CGjCIjUH.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-_pMHlJoE.js">
+      <link rel="modulepreload" crossorigin href="../assets/state-B2k3ak7d.js">
       <link rel="modulepreload" crossorigin href="../assets/index-CiMGhYb1.js">
     </head>
     <body>

package/dist/web/frontend/approve/index.html

@@ -4,12 +4,12 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Activity detail</title>
-      <script type="module" crossorigin src="../assets/approve-DUxX18Xm.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-lfC4c213.js">
-      <link rel="modulepreload" crossorigin href="../assets/state-BpQr_22x.js">
+      <script type="module" crossorigin src="../assets/approve-B2w66l0J.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-_pMHlJoE.js">
+      <link rel="modulepreload" crossorigin href="../assets/state-B2k3ak7d.js">
       <link rel="modulepreload" crossorigin href="../assets/index-CiMGhYb1.js">
-      <link rel="modulepreload" crossorigin href="../assets/utils-BNCwV3PT.js">
-      <link rel="modulepreload" crossorigin href="../assets/index-DvQio60y.js">
+      <link rel="modulepreload" crossorigin href="../assets/utils-CT9Hzi7v.js">
+      <link rel="modulepreload" crossorigin href="../assets/index-DWz_3f3y.js">
     </head>
 
     <body>

package/dist/web/frontend/assets/404-B-o9ppJB.js

@@ -0,0 +1,5 @@
+import{f as h,i as z,T as E,b as I,t as T}from"./index-_pMHlJoE.js";var j=Object.create,s=Object.defineProperty,k=Object.getOwnPropertyDescriptor,y=(r,e)=>(e=Symbol[r])?e:Symbol.for("Symbol."+r),x=r=>{throw TypeError(r)},D=(r,e,o)=>e in r?s(r,e,{enumerable:!0,configurable:!0,writable:!0,value:o}):r[e]=o,F=(r,e)=>s(r,"name",{value:e,configurable:!0}),g=r=>[,,,j(r?.[y("metadata")]??null)],A=["class","method","getter","setter","accessor","field","value","get","set"],S=r=>r!==void 0&&typeof r!="function"?x("Function expected"):r,C=(r,e,o,_,t)=>({kind:A[r],name:e,metadata:_,addInitializer:a=>o._?x("Already initialized"):t.push(S(a||null))}),M=(r,e)=>D(e,y("metadata"),r[3]),N=(r,e,o,_)=>{for(var t=0,a=r[e>>1],n=a&&a.length;t<n;t++)a[t].call(o);return _},$=(r,e,o,_,t,a)=>{var n,p,f,i=e&7,b=!1,m=0,P=r[m]||(r[m]=[]),c=i&&(t=t.prototype,i<5&&(i>3||!b)&&k(t,o));F(t,o);for(var d=_.length-1;d>=0;d--)f=C(i,o,p={},r[3],P),n=(0,_[d])(t,f),p._=1,S(n)&&(t=n);return M(r,t),c&&s(t,o,c),b?i^4?a:c:t},w,v,O;w=[T("user-ui-404")];const u=class u extends(O=h){render(){return I`<not-found href=${E("/")}></not-found>`}};u.styles=[h.styles,z`
+            :host {
+                display: block;
+            }
+        `];let l=u;v=g(O);l=$(v,0,"NotFoundUi",w,l);N(v,1,l);

package/dist/web/frontend/assets/{activities-4fnnetzm.js → activities-CGjCIjUH.js}

@@ -1,4 +1,4 @@
-import{b as v,D as V,c as X,e as Y,g as Z,f as R,i as j,t as tt}from"./index-lfC4c213.js";import{r as y}from"./state-BpQr_22x.js";import{p as et}from"./index-CiMGhYb1.js";var at=Object.create,b=Object.defineProperty,it=Object.getOwnPropertyDescriptor,q=(e,t)=>(t=Symbol[e])?t:Symbol.for("Symbol."+e),u=e=>{throw TypeError(e)},st=(e,t,a)=>t in e?b(e,t,{enumerable:!0,configurable:!0,writable:!0,value:a}):e[t]=a,E=(e,t)=>b(e,"name",{value:t,configurable:!0}),rt=e=>[,,,at(e?.[q("metadata")]??null)],G=["class","method","getter","setter","accessor","field","value","get","set"],w=e=>e!==void 0&&typeof e!="function"?u("Function expected"):e,nt=(e,t,a,c,s)=>({kind:G[e],name:t,metadata:c,addInitializer:r=>a._?u("Already initialized"):s.push(w(r||null))}),ct=(e,t)=>st(t,q("metadata"),e[3]),h=(e,t,a,c)=>{for(var s=0,r=e[t>>1],g=r&&r.length;s<g;s++)t&1?r[s].call(a):c=r[s].call(a,c);return c},m=(e,t,a,c,s,r)=>{var g,d,x,f,P,i=t&7,T=!!(t&8),p=!!(t&16),S=i>3?e.length+1:i?T?1:2:0,W=G[i+5],D=i>3&&(e[S-1]=[]),Q=e[S]||(e[S]=[]),l=i&&(!p&&!T&&(s=s.prototype),i<5&&(i>3||!p)&&it(i<4?s:{get[a](){return F(this,r)},set[a](o){return N(this,r,o)}},a));i?p&&i<4&&E(r,(i>2?"set ":i>1?"get ":"")+a):E(s,a);for(var k=c.length-1;k>=0;k--)f=nt(i,a,x={},e[3],Q),i&&(f.static=T,f.private=p,P=f.access={has:p?o=>ot(s,o):o=>a in o},i^3&&(P.get=p?o=>(i^1?F:dt)(o,s,i^4?r:l.get):o=>o[a]),i>2&&(P.set=p?(o,z)=>N(o,s,z,i^4?r:l.set):(o,z)=>o[a]=z)),d=(0,c[k])(i?i<4?p?r:l[W]:i>4?void 0:{get:l.get,set:l.set}:s,f),x._=1,i^4||d===void 0?w(d)&&(i>4?D.unshift(d):i?p?r=d:l[W]=d:s=d):typeof d!="object"||d===null?u("Object expected"):(w(g=d.get)&&(l.get=g),w(g=d.set)&&(l.set=g),w(g=d.init)&&D.unshift(g));return i||ct(e,s),l&&b(s,a,l),p?i^4?r:l:s},I=(e,t,a)=>t.has(e)||u("Cannot "+a),ot=(e,t)=>Object(t)!==t?u('Cannot use the "in" operator on this value'):e.has(t),F=(e,t,a)=>(I(e,t,"read from private field"),a?a.call(e):t.get(e)),$=(e,t,a)=>t.has(e)?u("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,a),N=(e,t,a,c)=>(I(e,t,"write to private field"),c?c.call(e,a):t.set(e,a),a),dt=(e,t,a)=>(I(e,t,"access private method"),a),H,L,B,J,C,K,n,M,A,O,U;K=[tt("user-ui-activities")];class _ extends(C=R,J=[y()],B=[y()],L=[y()],H=[y()],C){constructor(){super(...arguments),$(this,M,h(n,8,this,[])),h(n,11,this),$(this,A,h(n,12,this,new Map)),h(n,15,this),$(this,O,h(n,16,this,!1)),h(n,19,this),$(this,U,h(n,20,this,1)),h(n,23,this),this.pageSize=4}get pagedTransactions(){const t=(this.currentPage-1)*this.pageSize;return this.transactions.slice(t,t+this.pageSize)}render(){return v`
+import{b as v,T as V,c as X,e as Y,g as Z,f as R,i as j,t as tt}from"./index-_pMHlJoE.js";import{r as y}from"./state-B2k3ak7d.js";import{p as et}from"./index-CiMGhYb1.js";var at=Object.create,b=Object.defineProperty,it=Object.getOwnPropertyDescriptor,q=(e,t)=>(t=Symbol[e])?t:Symbol.for("Symbol."+e),u=e=>{throw TypeError(e)},st=(e,t,a)=>t in e?b(e,t,{enumerable:!0,configurable:!0,writable:!0,value:a}):e[t]=a,D=(e,t)=>b(e,"name",{value:t,configurable:!0}),rt=e=>[,,,at(e?.[q("metadata")]??null)],G=["class","method","getter","setter","accessor","field","value","get","set"],w=e=>e!==void 0&&typeof e!="function"?u("Function expected"):e,nt=(e,t,a,c,s)=>({kind:G[e],name:t,metadata:c,addInitializer:r=>a._?u("Already initialized"):s.push(w(r||null))}),ct=(e,t)=>st(t,q("metadata"),e[3]),h=(e,t,a,c)=>{for(var s=0,r=e[t>>1],g=r&&r.length;s<g;s++)t&1?r[s].call(a):c=r[s].call(a,c);return c},m=(e,t,a,c,s,r)=>{var g,d,x,f,T,i=t&7,P=!!(t&8),p=!!(t&16),S=i>3?e.length+1:i?P?1:2:0,W=G[i+5],E=i>3&&(e[S-1]=[]),Q=e[S]||(e[S]=[]),l=i&&(!p&&!P&&(s=s.prototype),i<5&&(i>3||!p)&&it(i<4?s:{get[a](){return F(this,r)},set[a](o){return N(this,r,o)}},a));i?p&&i<4&&D(r,(i>2?"set ":i>1?"get ":"")+a):D(s,a);for(var k=c.length-1;k>=0;k--)f=nt(i,a,x={},e[3],Q),i&&(f.static=P,f.private=p,T=f.access={has:p?o=>ot(s,o):o=>a in o},i^3&&(T.get=p?o=>(i^1?F:dt)(o,s,i^4?r:l.get):o=>o[a]),i>2&&(T.set=p?(o,z)=>N(o,s,z,i^4?r:l.set):(o,z)=>o[a]=z)),d=(0,c[k])(i?i<4?p?r:l[W]:i>4?void 0:{get:l.get,set:l.set}:s,f),x._=1,i^4||d===void 0?w(d)&&(i>4?E.unshift(d):i?p?r=d:l[W]=d:s=d):typeof d!="object"||d===null?u("Object expected"):(w(g=d.get)&&(l.get=g),w(g=d.set)&&(l.set=g),w(g=d.init)&&E.unshift(g));return i||ct(e,s),l&&b(s,a,l),p?i^4?r:l:s},I=(e,t,a)=>t.has(e)||u("Cannot "+a),ot=(e,t)=>Object(t)!==t?u('Cannot use the "in" operator on this value'):e.has(t),F=(e,t,a)=>(I(e,t,"read from private field"),a?a.call(e):t.get(e)),$=(e,t,a)=>t.has(e)?u("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,a),N=(e,t,a,c)=>(I(e,t,"write to private field"),c?c.call(e,a):t.set(e,a),a),dt=(e,t,a)=>(I(e,t,"access private method"),a),H,L,B,J,C,K,n,M,A,O,U;K=[tt("user-ui-activities")];class _ extends(C=R,J=[y()],B=[y()],L=[y()],H=[y()],C){constructor(){super(...arguments),$(this,M,h(n,8,this,[])),h(n,11,this),$(this,A,h(n,12,this,new Map)),h(n,15,this),$(this,O,h(n,16,this,!1)),h(n,19,this),$(this,U,h(n,20,this,1)),h(n,23,this),this.pageSize=4}get pagedTransactions(){const t=(this.currentPage-1)*this.pageSize;return this.transactions.slice(t,t+this.pageSize)}render(){return v`
             <div class="page-header">
                 <h1 class="h4 fw-semibold mb-0 text-body">Activities</h1>
             </div>

package/dist/web/frontend/assets/{addIdentityProvider-uy13wDEx.js → addIdentityProvider-CR4Wm9Tl.js}

@@ -1,4 +1,4 @@
-import{D as $,c as q,e as G,Y as N,g as H,b as J,f as x,i as K,t as L}from"./index-lfC4c213.js";import{r as Q}from"./state-BpQr_22x.js";var R=Object.create,I=Object.defineProperty,V=Object.getOwnPropertyDescriptor,E=(e,t)=>(t=Symbol[e])?t:Symbol.for("Symbol."+e),_=e=>{throw TypeError(e)},X=(e,t,a)=>t in e?I(e,t,{enumerable:!0,configurable:!0,writable:!0,value:a}):e[t]=a,P=(e,t)=>I(e,"name",{value:t,configurable:!0}),Z=e=>[,,,R(e?.[E("metadata")]??null)],B=["class","method","getter","setter","accessor","field","value","get","set"],f=e=>e!==void 0&&typeof e!="function"?_("Function expected"):e,j=(e,t,a,n,r)=>({kind:B[e],name:t,metadata:n,addInitializer:s=>a._?_("Already initialized"):r.push(f(s||null))}),ee=(e,t)=>X(t,E("metadata"),e[3]),S=(e,t,a,n)=>{for(var r=0,s=e[t>>1],l=s&&s.length;r<l;r++)t&1?s[r].call(a):n=s[r].call(a,n);return n},F=(e,t,a,n,r,s)=>{var l,o,U,h,g,i=t&7,w=!!(t&8),p=!!(t&16),m=i>3?e.length+1:i?w?1:2:0,A=B[i+5],z=i>3&&(e[m-1]=[]),Y=e[m]||(e[m]=[]),c=i&&(!p&&!w&&(r=r.prototype),i<5&&(i>3||!p)&&V(i<4?r:{get[a](){return D(this,s)},set[a](d){return M(this,s,d)}},a));i?p&&i<4&&P(s,(i>2?"set ":i>1?"get ":"")+a):P(r,a);for(var y=n.length-1;y>=0;y--)h=j(i,a,U={},e[3],Y),i&&(h.static=w,h.private=p,g=h.access={has:p?d=>te(r,d):d=>a in d},i^3&&(g.get=p?d=>(i^1?D:ie)(d,r,i^4?s:c.get):d=>d[a]),i>2&&(g.set=p?(d,k)=>M(d,r,k,i^4?s:c.set):(d,k)=>d[a]=k)),o=(0,n[y])(i?i<4?p?s:c[A]:i>4?void 0:{get:c.get,set:c.set}:r,h),U._=1,i^4||o===void 0?f(o)&&(i>4?z.unshift(o):i?p?s=o:c[A]=o:r=o):typeof o!="object"||o===null?_("Object expected"):(f(l=o.get)&&(c.get=l),f(l=o.set)&&(c.set=l),f(l=o.init)&&z.unshift(l));return i||ee(e,r),c&&I(r,a,c),p?i^4?s:c:r},b=(e,t,a)=>t.has(e)||_("Cannot "+a),te=(e,t)=>Object(t)!==t?_('Cannot use the "in" operator on this value'):e.has(t),D=(e,t,a)=>(b(e,t,"read from private field"),a?a.call(e):t.get(e)),ae=(e,t,a)=>t.has(e)?_("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,a),M=(e,t,a,n)=>(b(e,t,"write to private field"),n?n.call(e,a):t.set(e,a),a),ie=(e,t,a)=>(b(e,t,"access private method"),a),T,C,W,v,O;W=[L("user-ui-add-idp")];class u extends(C=x,T=[Q()],C){constructor(){super(...arguments),ae(this,O,S(v,8,this,!1)),S(v,11,this)}navigateBack(){window.location.href=$("/identity-providers")}async onSave(t){this.loading=!0;try{await(await q(G.accessToken.get())).request({method:"addIdp",params:{idp:t.idp}}),window.location.href=N("/identity-providers/")}catch(a){this.loading=!1,H(a)}}render(){return J`
+import{T as q,c as G,e as N,M as H,g as J,b as K,f as x,i as L,t as Q}from"./index-_pMHlJoE.js";import{r as R}from"./state-B2k3ak7d.js";var V=Object.create,I=Object.defineProperty,X=Object.getOwnPropertyDescriptor,E=(e,t)=>(t=Symbol[e])?t:Symbol.for("Symbol."+e),_=e=>{throw TypeError(e)},Y=(e,t,a)=>t in e?I(e,t,{enumerable:!0,configurable:!0,writable:!0,value:a}):e[t]=a,z=(e,t)=>I(e,"name",{value:t,configurable:!0}),Z=e=>[,,,V(e?.[E("metadata")]??null)],B=["class","method","getter","setter","accessor","field","value","get","set"],f=e=>e!==void 0&&typeof e!="function"?_("Function expected"):e,j=(e,t,a,n,r)=>({kind:B[e],name:t,metadata:n,addInitializer:s=>a._?_("Already initialized"):r.push(f(s||null))}),ee=(e,t)=>Y(t,E("metadata"),e[3]),S=(e,t,a,n)=>{for(var r=0,s=e[t>>1],l=s&&s.length;r<l;r++)t&1?s[r].call(a):n=s[r].call(a,n);return n},D=(e,t,a,n,r,s)=>{var l,o,U,h,g,i=t&7,w=!!(t&8),p=!!(t&16),m=i>3?e.length+1:i?w?1:2:0,A=B[i+5],M=i>3&&(e[m-1]=[]),$=e[m]||(e[m]=[]),c=i&&(!p&&!w&&(r=r.prototype),i<5&&(i>3||!p)&&X(i<4?r:{get[a](){return P(this,s)},set[a](d){return T(this,s,d)}},a));i?p&&i<4&&z(s,(i>2?"set ":i>1?"get ":"")+a):z(r,a);for(var y=n.length-1;y>=0;y--)h=j(i,a,U={},e[3],$),i&&(h.static=w,h.private=p,g=h.access={has:p?d=>te(r,d):d=>a in d},i^3&&(g.get=p?d=>(i^1?P:ie)(d,r,i^4?s:c.get):d=>d[a]),i>2&&(g.set=p?(d,k)=>T(d,r,k,i^4?s:c.set):(d,k)=>d[a]=k)),o=(0,n[y])(i?i<4?p?s:c[A]:i>4?void 0:{get:c.get,set:c.set}:r,h),U._=1,i^4||o===void 0?f(o)&&(i>4?M.unshift(o):i?p?s=o:c[A]=o:r=o):typeof o!="object"||o===null?_("Object expected"):(f(l=o.get)&&(c.get=l),f(l=o.set)&&(c.set=l),f(l=o.init)&&M.unshift(l));return i||ee(e,r),c&&I(r,a,c),p?i^4?s:c:r},b=(e,t,a)=>t.has(e)||_("Cannot "+a),te=(e,t)=>Object(t)!==t?_('Cannot use the "in" operator on this value'):e.has(t),P=(e,t,a)=>(b(e,t,"read from private field"),a?a.call(e):t.get(e)),ae=(e,t,a)=>t.has(e)?_("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,a),T=(e,t,a,n)=>(b(e,t,"write to private field"),n?n.call(e,a):t.set(e,a),a),ie=(e,t,a)=>(b(e,t,"access private method"),a),F,C,W,v,O;W=[Q("user-ui-add-idp")];class u extends(C=x,F=[R()],C){constructor(){super(...arguments),ae(this,O,S(v,8,this,!1)),S(v,11,this)}navigateBack(){window.location.href=q("/identity-providers")}async onSave(t){this.loading=!0;try{await(await G(N.accessToken.get())).request({method:"addIdp",params:{idp:t.idp}}),window.location.href=H("/identity-providers/")}catch(a){this.loading=!1,J(a)}}render(){return K`
             <div class="page-header">
                 <h1 class="h4 fw-semibold mb-0">Add a new identity provider</h1>
                 <wg-back-link @click=${this.navigateBack}></wg-back-link>
@@ -7,7 +7,7 @@ import{D as $,c as q,e as G,Y as N,g as H,b as J,f as x,i as K,t as L}from"./ind
             <div class="form-wrap">
                 <idp-form mode="add" @idp-form-save=${this.onSave}></idp-form>
             </div>
-        `}}v=Z(C);O=new WeakMap;F(v,4,"loading",T,u,O);u=F(v,0,"UserUiAddIdp",W,u);u.styles=[x.styles,K`
+        `}}v=Z(C);O=new WeakMap;D(v,4,"loading",F,u,O);u=D(v,0,"UserUiAddIdp",W,u);u.styles=[x.styles,L`
             :host {
                 display: block;
                 max-width: 900px;