@canton-network/wallet-gateway-remote 1.1.0 → 1.2.1

package/README.md

@@ -44,9 +44,22 @@ wallet-gateway --config-schema
 
 The JSON-RPC API specs from `api-specs/` are generated into strongly-typed method builders for the remote RPC server. To update the codegen, run `yarn generate:dapp`.
 
+## Dfns
+
+1. Create a service account in the Dfns dashboard with permissions to create and sign with Canton wallets, then download its credentials.
+
+2. Set the following environment variables before starting the Gateway:
+    - `DFNS_ORG_ID` — your Dfns organization ID (required; the driver is skipped if unset)
+    - `DFNS_BASE_URL` — Dfns API base URL (defaults to `https://api.dfns.io`)
+    - `DFNS_CRED_ID` — service account credential ID
+    - `DFNS_PRIVATE_KEY` — service account private key (PEM)
+    - `DFNS_AUTH_TOKEN` — service account auth token
+
+Dfns provisions and activates Canton wallets through its validator integration, so no additional Gateway configuration is required. Only `Canton` and `CantonTestnet` network wallets are supported. See [`@canton-network/core-signing-dfns`](../../core/signing-dfns/README.md) for full driver details.
+
 ## Fireblocks
 
-1. Complete steps 1–3 from the instructions at https://github.com/hyperledger-labs/splice-wallet-kernel/tree/main/core/signing-fireblocks
+1. Complete steps 1–3 from the instructions at https://github.com/canton-network/wallet-gateway/tree/main/core/signing-fireblocks
 
 2. set the environment variable `FIREBLOCKS_API_KEY` (get it from `API User (ID)` column in fireblocks api users table).
 

package/dist/auth/jwt-auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WA+H5D,CAAA"}
+{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WA8H5D,CAAA"}

package/dist/auth/jwt-auth-service.js

@@ -33,9 +33,8 @@ export const jwtAuthService = (store, logger) => ({
                 logger.warn(`No identity provider found for issuer: ${iss}`);
                 return undefined;
             }
-            const scope = decoded.scope;
-            if (!scope) {
-                logger.warn('JWT does not contain a scope');
+            if (!decoded.scope && !decoded.scp) {
+                logger.warn('JWT does not contain a scope claim');
                 return undefined;
             }
             if (idp.type == 'self_signed') {

package/dist/env.d.ts

@@ -4,6 +4,11 @@ export declare class Env {
     static BLOCKDAEMON_API_URL: (fallback: string) => string;
     static BLOCKDAEMON_API_KEY: (fallback: string) => string;
     static BLOCKDAEMON_CAIP2: (fallback: string) => string;
+    static DFNS_ORG_ID: () => string | undefined;
+    static DFNS_BASE_URL: (fallback: string) => string;
+    static DFNS_CRED_ID: () => string | undefined;
+    static DFNS_PRIVATE_KEY: () => string | undefined;
+    static DFNS_AUTH_TOKEN: () => string | undefined;
     static get(key: string, options: {
         required?: boolean;
         fallback: string;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAGA,qBAAa,GAAG;IACZ,MAAM,CAAC,kBAAkB,2BAAsC;IAC/D,MAAM,CAAC,iBAAiB,2BAAqC;IAC7D,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,iBAAiB,GAAI,UAAU,MAAM,YACE;IAE9C,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAClD,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,GAChE,MAAM,GAAG,SAAS;CAcxB"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAGA,qBAAa,GAAG;IACZ,MAAM,CAAC,kBAAkB,2BAAsC;IAC/D,MAAM,CAAC,iBAAiB,2BAAqC;IAC7D,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,mBAAmB,GAAI,UAAU,MAAM,YACE;IAChD,MAAM,CAAC,iBAAiB,GAAI,UAAU,MAAM,YACE;IAC9C,MAAM,CAAC,WAAW,2BAA+B;IACjD,MAAM,CAAC,aAAa,GAAI,UAAU,MAAM,YACE;IAC1C,MAAM,CAAC,YAAY,2BAAgC;IACnD,MAAM,CAAC,gBAAgB,2BAAoC;IAC3D,MAAM,CAAC,eAAe,2BAAmC;IAEzD,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAClD,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,MAAM;IACT,MAAM,CAAC,GAAG,CACN,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,GAChE,MAAM,GAAG,SAAS;CAcxB"}

package/dist/env.js

@@ -6,6 +6,11 @@ export class Env {
     static { this.BLOCKDAEMON_API_URL = (fallback) => Env.get('BLOCKDAEMON_API_URL', { fallback }); }
     static { this.BLOCKDAEMON_API_KEY = (fallback) => Env.get('BLOCKDAEMON_API_KEY', { fallback }); }
     static { this.BLOCKDAEMON_CAIP2 = (fallback) => Env.get('BLOCKDAEMON_CAIP2', { fallback }); }
+    static { this.DFNS_ORG_ID = () => Env.get('DFNS_ORG_ID'); }
+    static { this.DFNS_BASE_URL = (fallback) => Env.get('DFNS_BASE_URL', { fallback }); }
+    static { this.DFNS_CRED_ID = () => Env.get('DFNS_CRED_ID'); }
+    static { this.DFNS_PRIVATE_KEY = () => Env.get('DFNS_PRIVATE_KEY'); }
+    static { this.DFNS_AUTH_TOKEN = () => Env.get('DFNS_AUTH_TOKEN'); }
     static get(key, options) {
         const { fallback, required } = options || {};
         const value = process.env[key]?.trim() || fallback?.trim();

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAuB7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AA6IvC,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBA4IhE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AA2B7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAsMvC,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAiKhE"}

package/dist/init.js

@@ -6,9 +6,10 @@ import { web } from './web/server.js';
 import { StoreSql, bootstrap, connection, migrator, } from '@canton-network/core-wallet-store-sql';
 import { StoreSql as SigningStoreSql, bootstrap as signingBootstrap, connection as signingConnection, migrator as signingMigrator, } from '@canton-network/core-signing-store-sql';
 import { ConfigUtils } from './config/ConfigUtils.js';
-import { SigningProvider } from '@canton-network/core-signing-lib';
+import { SigningProvider, } from '@canton-network/core-signing-lib';
 import { ParticipantSigningDriver } from '@canton-network/core-signing-participant';
 import { InternalSigningDriver } from '@canton-network/core-signing-internal';
+import DfnsSigningProvider from '@canton-network/core-signing-dfns';
 import FireblocksSigningProvider from '@canton-network/core-signing-fireblocks';
 import BlockdaemonSigningProvider from '@canton-network/core-signing-blockdaemon';
 import { jwtAuthService } from './auth/jwt-auth-service.js';
@@ -46,6 +47,44 @@ async function initializeDatabase(config, logger) {
                 .catch(() => { });
             exists = false;
         }
+        else {
+            const appDb = connection(config.store);
+            try {
+                const idpsTable = await sql
+                    .raw(`select exists(select 1 from information_schema.tables where table_schema='public' and table_name='idps') as exists;`)
+                    .execute(appDb);
+                const networksTable = await sql
+                    .raw(`select exists(select 1 from information_schema.tables where table_schema='public' and table_name='networks') as exists;`)
+                    .execute(appDb);
+                const idpsExists = Boolean(idpsTable.rows[0]?.exists);
+                const networksExists = Boolean(networksTable.rows[0]?.exists);
+                let idpsHasRows = false;
+                let networksHasRows = false;
+                if (idpsExists) {
+                    const idpsCount = await sql
+                        .raw(`select count(*) as "rowCount" from idps;`)
+                        .execute(appDb);
+                    idpsHasRows = Number(idpsCount.rows[0]?.rowCount ?? 0) > 0;
+                }
+                if (networksExists) {
+                    const networksCount = await sql
+                        .raw(`select count(*) as "rowCount" from networks;`)
+                        .execute(appDb);
+                    networksHasRows =
+                        Number(networksCount.rows[0]?.rowCount ?? 0) > 0;
+                }
+                if (!idpsExists ||
+                    !networksExists ||
+                    !idpsHasRows ||
+                    !networksHasRows) {
+                    logger.warn('Database exists but required tables are missing or empty. Attempting to bootstrap...');
+                    exists = false;
+                }
+            }
+            finally {
+                await appDb.destroy();
+            }
+        }
         await db.destroy();
     }
     const db = connection(config.store);
@@ -161,6 +200,23 @@ export async function initialize(opts, logger) {
             caip2: Env.BLOCKDAEMON_CAIP2('canton:testnet'),
         }),
     };
+    if (Env.DFNS_ORG_ID() &&
+        Env.DFNS_CRED_ID() &&
+        Env.DFNS_PRIVATE_KEY() &&
+        Env.DFNS_AUTH_TOKEN()) {
+        drivers[SigningProvider.DFNS] = new DfnsSigningProvider({
+            orgId: Env.DFNS_ORG_ID(),
+            baseUrl: Env.DFNS_BASE_URL('https://api.dfns.io'),
+            credentials: {
+                credId: Env.DFNS_CRED_ID(),
+                privateKey: Env.DFNS_PRIVATE_KEY(),
+                authToken: Env.DFNS_AUTH_TOKEN(),
+            },
+        });
+    }
+    else {
+        logger.warn('Dfns env vars not fully set — Dfns signing provider will be unavailable');
+    }
     const allowedPaths = {
         [config.server.dappPath]: ['*'],
         [config.server.userPath]: [

package/dist/ledger/transaction-service.d.ts

@@ -17,6 +17,19 @@ export declare class TransactionService {
     signWithWalletKernel(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResultSigned>;
     signWithBlockdaemon(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
     signWithFireblocks(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
+    /**
+     * Dfns broadcasts the prepared transaction to Canton itself, so we get back
+     * an updateId rather than a raw signature. We persist the updateId as the
+     * signature payload (the controller short-circuits Dfns execute) and surface
+     * the same SignResult shape the other external providers use.
+     */
+    signWithDfns(userId: UserId, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
+    /**
+     * Dfns has already broadcast the transaction at sign-time, so execute is a
+     * state reconciliation: mark the stored transaction as executed and return
+     * the updateId Dfns gave us. We deliberately don't post to the ledger here.
+     */
+    executeWithDfns(transaction: Transaction): Promise<ExecuteResult>;
     executeWithParticipant(userId: UserId, executeParams: ExecuteParams, transaction: Transaction, ledgerClient: LedgerClient, network: Network): Promise<ExecuteResult>;
     executeWithExternal(userId: UserId, executeParams: ExecuteParams, transaction: Transaction, ledgerClient: LedgerClient): Promise<ExecuteResult>;
 }

package/dist/ledger/transaction-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transaction-service.d.ts","sourceRoot":"","sources":["../../src/ledger/transaction-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,OAAO,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAGH,sBAAsB,EACtB,eAAe,EAElB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACH,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EACnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAYjE,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,QAAQ;gBALR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAC3B,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,YAAK,EACE,QAAQ,EAAE,QAAQ;YAGhB,iCAAiC;IAWxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAS/C,oBAAoB,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAqDf,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAwGT,kBAAkB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IA4GT,sBAAsB,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,aAAa,CAAC;IAyCZ,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,GAC3B,OAAO,CAAC,aAAa,CAAC;CAuD5B"}
+{"version":3,"file":"transaction-service.d.ts","sourceRoot":"","sources":["../../src/ledger/transaction-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,OAAO,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAGH,sBAAsB,EACtB,eAAe,EAElB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACH,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EACnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAYjE,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,QAAQ;gBALR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAC3B,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,YAAK,EACE,QAAQ,EAAE,QAAQ;YAGhB,iCAAiC;IAWxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAS/C,oBAAoB,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAqDf,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAwGT,kBAAkB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IA4GtB;;;;;OAKG;IACU,YAAY,CACrB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAkGtB;;;;OAIG;IACU,eAAe,CACxB,WAAW,EAAE,WAAW,GACzB,OAAO,CAAC,aAAa,CAAC;IA8BZ,sBAAsB,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,aAAa,CAAC;IAyCZ,mBAAmB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,GAC3B,OAAO,CAAC,aAAa,CAAC;CAuD5B"}

package/dist/ledger/transaction-service.js

@@ -33,7 +33,7 @@ export class TransactionService {
     async signWithWalletKernel(userId, wallet, signParams) {
         const signingProvider = this.signingDrivers[SigningProvider.WALLET_KERNEL];
         if (!signingProvider) {
-            throw new Error('Wallet Kernel signing driver not available');
+            throw new Error('Wallet Gateway signing driver not available');
         }
         const driver = signingProvider.controller(userId);
         const tx = await this.loadPreparedTransactionForSigning(signParams.transactionId);
@@ -239,6 +239,122 @@ export class TransactionService {
             };
         }
     }
+    /**
+     * Dfns broadcasts the prepared transaction to Canton itself, so we get back
+     * an updateId rather than a raw signature. We persist the updateId as the
+     * signature payload (the controller short-circuits Dfns execute) and surface
+     * the same SignResult shape the other external providers use.
+     */
+    async signWithDfns(userId, wallet, signParams) {
+        const signingProvider = this.signingDrivers[SigningProvider.DFNS];
+        if (!signingProvider) {
+            throw new Error('Dfns signing driver not available');
+        }
+        const driver = signingProvider.controller(userId);
+        const tx = await this.loadPreparedTransactionForSigning(signParams.transactionId);
+        let signingResult;
+        if (tx.externalTxId) {
+            signingResult = await driver
+                .getTransaction({
+                userId,
+                txId: tx.externalTxId,
+            })
+                .then(handleSigningError);
+        }
+        else {
+            signingResult = await driver
+                .signTransaction({
+                tx: tx.preparedTransaction,
+                txHash: tx.preparedTransactionHash,
+                keyIdentifier: {
+                    publicKey: wallet.publicKey,
+                },
+            })
+                .then(handleSigningError);
+        }
+        const now = new Date();
+        if (signingResult.status === 'signed') {
+            if (!signingResult.signature) {
+                throw new Error('No updateId returned from Dfns');
+            }
+            const signedTx = {
+                id: tx.id,
+                commandId: tx.commandId,
+                status: signingResult.status,
+                preparedTransaction: tx.preparedTransaction,
+                preparedTransactionHash: tx.preparedTransactionHash,
+                origin: tx?.origin ?? null,
+                ...(tx?.createdAt && {
+                    createdAt: tx.createdAt,
+                }),
+                signedAt: now,
+                externalTxId: signingResult.txId,
+            };
+            await this.store.setTransactionSigned(tx.id, now, signingResult.txId);
+            this.notifier.emit('txChanged', signedTx);
+            return {
+                status: signingResult.status,
+                signature: signingResult.signature,
+                signedBy: wallet.namespace,
+                partyId: wallet.partyId,
+                externalTxId: signingResult.txId,
+            };
+        }
+        else {
+            const status = signingResult.status === 'pending' ? 'pending' : 'failed';
+            const pendingTx = {
+                id: tx.id,
+                commandId: tx.commandId,
+                status,
+                preparedTransaction: tx.preparedTransaction,
+                preparedTransactionHash: tx.preparedTransactionHash,
+                externalTxId: signingResult.txId,
+                origin: tx?.origin ?? null,
+                ...(tx?.createdAt && {
+                    createdAt: tx.createdAt,
+                }),
+            };
+            await this.store.setTransactionStatus(tx.id, status, {
+                externalTxId: signingResult.txId,
+            });
+            this.notifier.emit('txChanged', pendingTx);
+            return {
+                status: signingResult.status,
+                externalTxId: signingResult.txId,
+                partyId: wallet.partyId,
+            };
+        }
+    }
+    /**
+     * Dfns has already broadcast the transaction at sign-time, so execute is a
+     * state reconciliation: mark the stored transaction as executed and return
+     * the updateId Dfns gave us. We deliberately don't post to the ledger here.
+     */
+    async executeWithDfns(transaction) {
+        if (!transaction.externalTxId) {
+            throw new Error('Cannot execute Dfns transaction without externalTxId from Dfns');
+        }
+        const executedTx = {
+            id: transaction.id,
+            commandId: transaction.commandId,
+            status: 'executed',
+            preparedTransaction: transaction.preparedTransaction,
+            preparedTransactionHash: transaction.preparedTransactionHash,
+            origin: transaction.origin ?? null,
+            ...(transaction.createdAt && {
+                createdAt: transaction.createdAt,
+            }),
+            ...(transaction.signedAt && {
+                signedAt: transaction.signedAt,
+            }),
+            externalTxId: transaction.externalTxId,
+        };
+        await this.store.setTransactionStatus(transaction.id, 'executed', {
+            externalTxId: transaction.externalTxId,
+        });
+        this.notifier.emit('txChanged', executedTx);
+        return { updateId: transaction.externalTxId };
+    }
     async executeWithParticipant(userId, executeParams, transaction, ledgerClient, network) {
         const { partyId } = executeParams;
         const { commandId } = transaction;

package/dist/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.d.ts

@@ -0,0 +1,23 @@
+import { UserId } from '@canton-network/core-wallet-auth';
+import { Store, Wallet } from '@canton-network/core-wallet-store';
+import { SigningDriverInterface } from '@canton-network/core-signing-lib';
+import { Logger } from 'pino';
+import { PartyAllocationService } from '../../party-allocation-service.js';
+import { PartyHint, Primary } from '../../../user-api/rpc-gen/typings.js';
+import type { WalletAllocator } from '../wallet-allocation-service.js';
+/**
+ * Dfns sign-only allocator. The gateway runs the topology flow against its
+ * configured validator; Dfns is asked only to sign the topology hash, mirroring
+ * the bring-your-own-validator pattern used for other external providers.
+ */
+export declare class DfnsWalletAllocator implements WalletAllocator {
+    private store;
+    private logger;
+    private partyAllocator;
+    private signingDriver;
+    constructor(store: Store, logger: Logger, partyAllocator: PartyAllocationService, signingDriver: SigningDriverInterface);
+    createWallet(userId: UserId, _email: string | undefined, partyHint: PartyHint, primary?: Primary): Promise<Wallet>;
+    allocateParty(userId: UserId, _email: string | undefined, existingWallet: Wallet): Promise<void>;
+    private finalizeWallet;
+}
+//# sourceMappingURL=dfns-wallet-allocator.d.ts.map

package/dist/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dfns-wallet-allocator.d.ts","sourceRoot":"","sources":["../../../../src/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AACzD,OAAO,EAAE,KAAK,EAAgB,MAAM,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,EAEH,sBAAsB,EAEzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAYtE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IAEnD,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,aAAa;gBAHb,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,sBAAsB,EACtC,aAAa,EAAE,sBAAsB;IAG3C,YAAY,CACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE,OAAe,GACzB,OAAO,CAAC,MAAM,CAAC;IA4DZ,aAAa,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC;YA+DF,cAAc;CA+C/B"}

package/dist/ledger/wallet-allocation/signing-providers/dfns-wallet-allocator.js

@@ -0,0 +1,135 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { SigningProvider, } from '@canton-network/core-signing-lib';
+import { WALLET_DISABLED_REASON } from '@canton-network/core-types';
+function handleSigningError(result) {
+    if ('error' in result) {
+        throw new Error(`Error from signing driver: ${result.error_description}`);
+    }
+    return result;
+}
+/**
+ * Dfns sign-only allocator. The gateway runs the topology flow against its
+ * configured validator; Dfns is asked only to sign the topology hash, mirroring
+ * the bring-your-own-validator pattern used for other external providers.
+ */
+export class DfnsWalletAllocator {
+    constructor(store, logger, partyAllocator, signingDriver) {
+        this.store = store;
+        this.logger = logger;
+        this.partyAllocator = partyAllocator;
+        this.signingDriver = signingDriver;
+    }
+    async createWallet(userId, _email, partyHint, primary = false) {
+        const driver = this.signingDriver.controller(userId);
+        const key = await driver
+            .createKey({ name: partyHint })
+            .then(handleSigningError);
+        const namespace = this.partyAllocator.createFingerprintFromKey(key.publicKey);
+        const transactions = await this.partyAllocator.generateTopologyTransactions(partyHint, key.publicKey);
+        const topologyTransactions = transactions.topologyTransactions ?? [];
+        const internalTxId = crypto
+            .randomUUID()
+            .replace(/-/g, '')
+            .substring(0, 16);
+        const txPayload = JSON.stringify(topologyTransactions);
+        const { status, txId } = await driver
+            .signTransaction({
+            tx: Buffer.from(txPayload).toString('base64'),
+            txHash: transactions.multiHash,
+            keyIdentifier: { id: key.id, publicKey: key.publicKey },
+            internalTxId,
+        })
+            .then(handleSigningError);
+        const network = await this.store.getCurrentNetwork();
+        const walletBase = {
+            partyId: `${partyHint}::${namespace}`,
+            hint: partyHint,
+            namespace,
+            signingProviderId: SigningProvider.DFNS,
+            networkId: network.id,
+            primary,
+            publicKey: key.publicKey,
+            externalTxId: txId,
+            topologyTransactions: topologyTransactions.join(', '),
+            rights: [],
+        };
+        const wallet = await this.finalizeWallet(walletBase, userId, status, txId, topologyTransactions, namespace, driver);
+        await this.store.addWallet(wallet);
+        return wallet;
+    }
+    async allocateParty(userId, _email, existingWallet) {
+        if (!existingWallet.externalTxId ||
+            !existingWallet.topologyTransactions) {
+            throw new Error('Existing wallet is missing field externalTxId or topologyTransactions');
+        }
+        const driver = this.signingDriver.controller(userId);
+        const { signature, status, metadata } = await driver
+            .getTransaction({ txId: existingWallet.externalTxId })
+            .then(handleSigningError);
+        let walletUpdate = {
+            partyId: existingWallet.partyId,
+            networkId: existingWallet.networkId,
+        };
+        if (status === 'signed') {
+            if (!signature) {
+                throw new Error('Transaction signed but no signature found in result');
+            }
+            const partyId = await this.partyAllocator.allocatePartyWithExistingWallet(existingWallet.namespace, existingWallet.topologyTransactions.split(', '), signature, userId);
+            walletUpdate = {
+                ...walletUpdate,
+                partyId,
+                status: 'allocated',
+                reason: '',
+            };
+        }
+        else if (status === 'pending') {
+            walletUpdate = {
+                ...walletUpdate,
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            };
+        }
+        else {
+            this.logger.warn(`Topology transaction for wallet ${existingWallet.partyId} was ${status} with ${JSON.stringify(metadata)}`);
+            const reason = status === 'rejected'
+                ? WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED
+                : WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED;
+            walletUpdate = {
+                ...walletUpdate,
+                status: 'removed',
+                disabled: true,
+                reason,
+            };
+        }
+        return this.store.updateWallet(walletUpdate);
+    }
+    async finalizeWallet(walletBase, userId, status, txId, topologyTransactions, namespace, driver) {
+        if (status === 'signed') {
+            const { signature } = await driver
+                .getTransaction({ txId })
+                .then(handleSigningError);
+            if (!signature) {
+                throw new Error('Transaction signed but no signature found in result');
+            }
+            const partyId = await this.partyAllocator.allocatePartyWithExistingWallet(namespace, topologyTransactions, signature, userId);
+            return { ...walletBase, partyId, status: 'allocated' };
+        }
+        if (status === 'pending') {
+            return {
+                ...walletBase,
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            };
+        }
+        const reason = status === 'rejected'
+            ? WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED
+            : WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED;
+        return {
+            ...walletBase,
+            status: 'removed',
+            disabled: true,
+            reason,
+        };
+    }
+}

package/dist/ledger/wallet-allocation/wallet-allocation-service.d.ts

@@ -13,6 +13,7 @@ export declare class WalletAllocationService {
     private readonly kernelAllocator?;
     private readonly fireblocksAllocator?;
     private readonly blockdaemonAllocator?;
+    private readonly dfnsAllocator?;
     constructor(store: Store, logger: Logger, partyAllocator: PartyAllocationService, signingDrivers?: Partial<Record<SigningProvider, SigningDriverInterface>>);
     createWallet(userId: UserId, email: string | undefined, partyHint: PartyHint, primary: Primary, signingProviderId: SigningProvider): Promise<Wallet>;
     allocateParty(userId: UserId, email: string | undefined, existingWallet: Wallet, signingProviderId: SigningProvider): Promise<void>;

package/dist/ledger/wallet-allocation/wallet-allocation-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-allocation-service.d.ts","sourceRoot":"","sources":["../../../src/ledger/wallet-allocation/wallet-allocation-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAMtE,MAAM,WAAW,eAAe;IAC5B,YAAY,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,aAAa,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB;AAED,qBAAa,uBAAuB;IAChC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAuB;IACxD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAA4B;gBAG9D,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,sBAAsB,EACtC,cAAc,GAAE,OAAO,CACnB,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAC7C;IAuCG,YAAY,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,MAAM,CAAC;IAqDL,aAAa,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,IAAI,CAAC;CAgDnB"}
+{"version":3,"file":"wallet-allocation-service.d.ts","sourceRoot":"","sources":["../../../src/ledger/wallet-allocation/wallet-allocation-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAOtE,MAAM,WAAW,eAAe;IAC5B,YAAY,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,GACjB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,aAAa,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB;AAED,qBAAa,uBAAuB;IAChC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAuB;IACxD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAA4B;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqB;gBAGhD,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,sBAAsB,EACtC,cAAc,GAAE,OAAO,CACnB,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAC7C;IAiDG,YAAY,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,MAAM,CAAC;IA+DL,aAAa,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,eAAe,GACnC,OAAO,CAAC,IAAI,CAAC;CAyDnB"}

package/dist/ledger/wallet-allocation/wallet-allocation-service.js

@@ -5,6 +5,7 @@ import { ParticipantWalletAllocator } from './signing-providers/participant-wall
 import { KernelWalletAllocator } from './signing-providers/kernel-wallet-allocator.js';
 import { FireblocksWalletAllocator } from './signing-providers/fireblocks-wallet-allocator.js';
 import { BlockdaemonWalletAllocator } from './signing-providers/blockdaemon-wallet-allocator.js';
+import { DfnsWalletAllocator } from './signing-providers/dfns-wallet-allocator.js';
 export class WalletAllocationService {
     constructor(store, logger, partyAllocator, signingDrivers = {}) {
         this.participantAllocator = new ParticipantWalletAllocator(store, logger, partyAllocator);
@@ -20,6 +21,10 @@ export class WalletAllocationService {
         if (blockdaemonDriver) {
             this.blockdaemonAllocator = new BlockdaemonWalletAllocator(store, logger, partyAllocator, blockdaemonDriver);
         }
+        const dfnsDriver = signingDrivers[SigningProvider.DFNS];
+        if (dfnsDriver) {
+            this.dfnsAllocator = new DfnsWalletAllocator(store, logger, partyAllocator, dfnsDriver);
+        }
     }
     async createWallet(userId, email, partyHint, primary, signingProviderId) {
         switch (signingProviderId) {
@@ -27,7 +32,7 @@ export class WalletAllocationService {
                 return this.participantAllocator.createWallet(userId, email, partyHint, primary);
             case SigningProvider.WALLET_KERNEL:
                 if (!this.kernelAllocator) {
-                    throw new Error('Wallet Kernel signing driver not available');
+                    throw new Error('Wallet Gateway signing driver not available');
                 }
                 return this.kernelAllocator.createWallet(userId, email, partyHint, primary);
             case SigningProvider.FIREBLOCKS:
@@ -43,6 +48,11 @@ export class WalletAllocationService {
                     throw new Error('Email is required for Blockdaemon wallet allocation');
                 }
                 return this.blockdaemonAllocator.createWallet(userId, email, partyHint, primary);
+            case SigningProvider.DFNS:
+                if (!this.dfnsAllocator) {
+                    throw new Error('Dfns signing driver not available');
+                }
+                return this.dfnsAllocator.createWallet(userId, email, partyHint, primary);
             default:
                 throw new Error(`Unsupported signing provider: ${signingProviderId}`);
         }
@@ -53,7 +63,7 @@ export class WalletAllocationService {
                 return this.participantAllocator.allocateParty(userId, email, existingWallet);
             case SigningProvider.WALLET_KERNEL:
                 if (!this.kernelAllocator) {
-                    throw new Error('Wallet Kernel signing driver not available');
+                    throw new Error('Wallet Gateway signing driver not available');
                 }
                 return this.kernelAllocator.allocateParty(userId, email, existingWallet);
             case SigningProvider.FIREBLOCKS:
@@ -69,6 +79,11 @@ export class WalletAllocationService {
                     throw new Error('Email is required for Blockdaemon wallet allocation');
                 }
                 return this.blockdaemonAllocator.allocateParty(userId, email, existingWallet);
+            case SigningProvider.DFNS:
+                if (!this.dfnsAllocator) {
+                    throw new Error('Dfns signing driver not available');
+                }
+                return this.dfnsAllocator.allocateParty(userId, email, existingWallet);
             default:
                 throw new Error(`Unsupported signing provider: ${signingProviderId}`);
         }

package/dist/ledger/wallet-allocation/wallet-allocation-service.test.js

@@ -156,7 +156,7 @@ describe('WalletAllocationService', () => {
             });
         });
     });
-    describe('Wallet Kernel', () => {
+    describe('Wallet Gateway', () => {
         it('createWallet initializes new wallet and adds to store', async () => {
             const expectedParty = createAllocatedParty('bob::fingerprint', 'bob', 'fingerprint');
             mockPartyAllocator.createFingerprintFromKey.mockReturnValue('fingerprint');
@@ -198,9 +198,9 @@ describe('WalletAllocationService', () => {
                 status: 'allocated',
             });
         });
-        it('throws when Wallet Kernel signing driver not available', async () => {
+        it('throws when Wallet Gateway signing driver not available', async () => {
             const serviceWithoutDriver = createService({});
-            await expect(serviceWithoutDriver.createWallet('user-1', undefined, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('Wallet Kernel signing driver not available');
+            await expect(serviceWithoutDriver.createWallet('user-1', undefined, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('Wallet Gateway signing driver not available');
         });
     });
     describe('Fireblocks', () => {

package/dist/user-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AASzC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAwyBvB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AASzC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAkzBvB,CAAA"}

package/dist/user-api/controller.js

@@ -259,6 +259,9 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
                 case SigningProvider.FIREBLOCKS: {
                     return transactionService.signWithFireblocks(userId, wallet, signParams);
                 }
+                case SigningProvider.DFNS: {
+                    return transactionService.signWithDfns(userId, wallet, signParams);
+                }
                 default:
                     throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
             }
@@ -302,6 +305,9 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
                 case SigningProvider.FIREBLOCKS: {
                     return transactionService.executeWithExternal(userId, executeParams, transaction, ledgerClient);
                 }
+                case SigningProvider.DFNS: {
+                    return transactionService.executeWithDfns(transaction);
+                }
                 default:
                     throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
             }

package/dist/web/frontend/404/index.html

@@ -4,8 +4,8 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Not found</title>
-      <script type="module" crossorigin src="../assets/404-BCjBS7OU.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-lfC4c213.js">
+      <script type="module" crossorigin src="../assets/404-B-o9ppJB.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-_pMHlJoE.js">
     </head>
 
     <body>

package/dist/web/frontend/activities/index.html

@@ -4,9 +4,9 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Activities</title>
-      <script type="module" crossorigin src="../assets/activities-4fnnetzm.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-lfC4c213.js">
-      <link rel="modulepreload" crossorigin href="../assets/state-BpQr_22x.js">
+      <script type="module" crossorigin src="../assets/activities-CGjCIjUH.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-_pMHlJoE.js">
+      <link rel="modulepreload" crossorigin href="../assets/state-B2k3ak7d.js">
       <link rel="modulepreload" crossorigin href="../assets/index-CiMGhYb1.js">
     </head>
     <body>