@canton-network/wallet-gateway-remote 1.4.0 → 1.6.0

package/dist/middleware/jwtAuth.test.js

@@ -0,0 +1,93 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { jwtAuth } from './jwtAuth.js';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+describe('jwtAuth', () => {
+    const verifyToken = vi.fn();
+    const authService = { verifyToken };
+    const logger = pino({ level: 'silent' }, sink());
+    let next;
+    let status;
+    let json;
+    beforeEach(() => {
+        verifyToken.mockReset();
+        next = vi.fn();
+        status = vi.fn().mockReturnThis();
+        json = vi.fn();
+    });
+    function makeReq(partial) {
+        return {
+            headers: {},
+            query: {},
+            ...partial,
+        };
+    }
+    function makeRes() {
+        return { status, json };
+    }
+    it('sets authContext and calls next when verification succeeds', async () => {
+        const ctx = { userId: 'alice', accessToken: 'tok' };
+        verifyToken.mockResolvedValue(ctx);
+        const req = makeReq({
+            headers: { authorization: 'Bearer abc' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(verifyToken).toHaveBeenCalledWith('Bearer abc');
+        expect(req.authContext).toEqual(ctx);
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('uses Bearer token from query when Authorization header is absent', async () => {
+        const ctx = { userId: 'bob', accessToken: 'tok' };
+        verifyToken.mockResolvedValue(ctx);
+        const req = makeReq({
+            query: { token: 'query-jwt' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(verifyToken).toHaveBeenCalledWith('Bearer query-jwt');
+        expect(req.authContext).toEqual(ctx);
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('passes undefined to verifyToken when no credentials are present', async () => {
+        verifyToken.mockResolvedValue(undefined);
+        const req = makeReq({});
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(verifyToken).toHaveBeenCalledWith(undefined);
+        expect(req.authContext).toBeUndefined();
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('returns 401 JSON when verification throws', async () => {
+        verifyToken.mockRejectedValue(new Error('bad sig'));
+        const req = makeReq({
+            headers: { authorization: 'Bearer x' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(status).toHaveBeenCalledWith(401);
+        expect(json).toHaveBeenCalledWith({
+            error: 'Invalid or expired token: bad sig',
+        });
+    });
+    it('stringifies non-Error rejection values in the response', async () => {
+        verifyToken.mockRejectedValue('rejected');
+        const req = makeReq({
+            headers: { authorization: 'Bearer x' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(json).toHaveBeenCalledWith({
+            error: 'Invalid or expired token: rejected',
+        });
+    });
+});

package/dist/middleware/rateLimit.test.js

@@ -24,6 +24,18 @@ describe('ipRateLimitKeyGenerator', () => {
         };
         expect(ipRateLimitKeyGenerator(req)).toBe('ip:2001:db8:abcd::/56');
     });
+    test('falls back to socket.remoteAddress when ip is unset', () => {
+        const req = {
+            socket: { remoteAddress: '10.0.0.2' },
+        };
+        expect(ipRateLimitKeyGenerator(req)).toBe('ip:10.0.0.2');
+    });
+    test('uses unknown when neither ip nor remoteAddress is set', () => {
+        const req = {
+            socket: {},
+        };
+        expect(ipRateLimitKeyGenerator(req)).toBe('ip:unknown');
+    });
 });
 describe('rateLimitKeyGenerator', () => {
     test('uses authenticated user id when available', () => {

package/dist/middleware/sessionHandler.js

@@ -12,7 +12,7 @@ export function sessionHandler(store, allowedPaths, logger) {
         const context = req.authContext;
         const allowedMethods = allowedPaths[req.baseUrl];
         if (req.method !== 'POST') {
-            logger.debug('Skipping authentication for OPTIONS request to ' + req.baseUrl);
+            logger.debug(`Skipping authentication for ${req.method} request to ${req.baseUrl}`);
             next();
         }
         else if (allowedMethods &&

package/dist/middleware/sessionHandler.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sessionHandler.test.d.ts.map

package/dist/middleware/sessionHandler.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionHandler.test.d.ts","sourceRoot":"","sources":["../../src/middleware/sessionHandler.test.ts"],"names":[],"mappings":""}

package/dist/middleware/sessionHandler.test.js

@@ -0,0 +1,121 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { sessionHandler } from './sessionHandler.js';
+describe('sessionHandler', () => {
+    const getSession = vi.fn();
+    const withAuthContext = vi.fn(() => ({ getSession }));
+    const store = { withAuthContext };
+    const logger = pino({ level: 'silent' }, sink());
+    const allowedPaths = {
+        '/api/v0/user': ['addSession', 'listNetworks', 'getUser'],
+        '/api/v0/dapp': ['*'],
+    };
+    let next;
+    let status;
+    let json;
+    const authContext = {
+        userId: 'user-1',
+        accessToken: 'access-token',
+    };
+    beforeEach(() => {
+        getSession.mockReset();
+        withAuthContext.mockClear();
+        withAuthContext.mockReturnValue({ getSession });
+        next = vi.fn();
+        status = vi.fn().mockReturnThis();
+        json = vi.fn();
+    });
+    function makeReq(partial) {
+        return {
+            method: 'POST',
+            baseUrl: '/api/v0/user',
+            body: { method: 'listWallets' },
+            authContext,
+            ...partial,
+        };
+    }
+    function makeRes() {
+        return { status, json };
+    }
+    it('skips session check for non-POST requests', async () => {
+        const req = makeReq({ method: 'GET' });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).not.toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('allows unauthenticated POST when the RPC method is on the allow list', async () => {
+        const req = makeReq({ body: { method: 'addSession' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).not.toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('allows unauthenticated POST when the path uses a wildcard allow list', async () => {
+        const req = makeReq({
+            baseUrl: '/api/v0/dapp',
+            body: { method: 'connect' },
+        });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).not.toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('calls next when an active session exists for a protected method', async () => {
+        getSession.mockResolvedValue({
+            id: 'session-1',
+            network: 'network1',
+            accessToken: 'session-token',
+        });
+        const req = makeReq({ body: { method: 'listWallets' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(getSession).toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('returns 401 when no session exists for a protected method', async () => {
+        getSession.mockResolvedValue(undefined);
+        const req = makeReq({ body: { method: 'listWallets' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(next).not.toHaveBeenCalled();
+        expect(status).toHaveBeenCalledWith(401);
+        expect(json).toHaveBeenCalledWith({
+            error: 'No active session found',
+        });
+    });
+    it('requires a session when the path is not in the allow list config', async () => {
+        getSession.mockResolvedValue(undefined);
+        const req = makeReq({
+            baseUrl: '/api/v0/other',
+            body: { method: 'addSession' },
+        });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(status).toHaveBeenCalledWith(401);
+    });
+    it('requires a session when the RPC method is not on the path allow list', async () => {
+        getSession.mockResolvedValue(undefined);
+        const req = makeReq({ body: { method: 'removeSession' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(status).toHaveBeenCalledWith(401);
+    });
+});

package/dist/notification/NotificationService.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=NotificationService.test.d.ts.map

package/dist/notification/NotificationService.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NotificationService.test.d.ts","sourceRoot":"","sources":["../../src/notification/NotificationService.test.ts"],"names":[],"mappings":""}

package/dist/notification/NotificationService.test.js

@@ -0,0 +1,110 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import pino from 'pino';
+import { consecutive, once, sink } from 'pino-test';
+import { NotificationService } from './NotificationService.js';
+describe('NotificationService', () => {
+    let mockLogger;
+    let logStream;
+    beforeEach(() => {
+        logStream = sink();
+        mockLogger = pino({ level: 'debug' }, logStream);
+    });
+    it('creates a notifier for a new notifierId', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        expect(notifier).toBeDefined();
+        expect(typeof notifier.on).toBe('function');
+        expect(typeof notifier.emit).toBe('function');
+        expect(typeof notifier.removeListener).toBe('function');
+    });
+    it('returns the same notifier instance for the same notifierId', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-1');
+        expect(notifier1).toBe(notifier2);
+    });
+    it('returns different notifier instances for different notifierIds', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-2');
+        expect(notifier1).not.toBe(notifier2);
+    });
+    it('calls listeners when an event is emitted', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        const listener = vi.fn();
+        notifier.on('txChanged', listener);
+        const result = notifier.emit('txChanged', { id: 123 });
+        expect(result).toBe(true);
+        expect(listener).toHaveBeenCalledTimes(1);
+        expect(listener).toHaveBeenCalledWith({ id: 123 });
+    });
+    it('returns false when emitting an event with no listeners', async () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        const result = notifier.emit('unknown-event');
+        expect(result).toBe(false);
+        await once(logStream, {
+            level: 20,
+            event: 'unknown-event',
+            args: [],
+            msg: 'Notifier emitted event: unknown-event for user-1',
+        });
+    });
+    it('logs every emitted event', async () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        notifier.emit('txChanged', { id: 123 });
+        await once(logStream, {
+            level: 20,
+            event: 'txChanged',
+            args: [{ id: 123 }],
+            msg: 'Notifier emitted event: txChanged for user-1',
+        });
+    });
+    it('removes listeners with removeListener', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        const listener = vi.fn();
+        notifier.on('txChanged', listener);
+        notifier.removeListener('txChanged', listener);
+        const result = notifier.emit('txChanged', { id: 123 });
+        expect(result).toBe(false);
+        expect(listener).not.toHaveBeenCalled();
+    });
+    it('keeps listeners isolated between notifiers', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-2');
+        const listener1 = vi.fn();
+        const listener2 = vi.fn();
+        notifier1.on('txChanged', listener1);
+        notifier2.on('txChanged', listener2);
+        notifier1.emit('txChanged', { id: 1 });
+        expect(listener1).toHaveBeenCalledWith({ id: 1 });
+        expect(listener2).not.toHaveBeenCalled();
+    });
+    it('logs with the correct notifierId for each notifier', async () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-2');
+        notifier1.emit('txChanged');
+        notifier2.emit('statusChanged');
+        await consecutive(logStream, [
+            {
+                level: 20,
+                event: 'txChanged',
+                args: [],
+                msg: 'Notifier emitted event: txChanged for user-1',
+            },
+            {
+                level: 20,
+                event: 'statusChanged',
+                args: [],
+                msg: 'Notifier emitted event: statusChanged for user-2',
+            },
+        ]);
+    });
+});

package/dist/signing/service-account-session.d.ts

@@ -0,0 +1,16 @@
+import { Logger } from 'pino';
+import { AuthAware, AuthContext, AuthTokenProvider } from '@canton-network/core-wallet-auth';
+import { Network, Store } from '@canton-network/core-wallet-store';
+export type AccessTokenProviderFactory = (network: Network) => Promise<AuthTokenProvider>;
+export interface AutomationRunContext {
+    authContext: AuthContext;
+    scopedStore: Store;
+    network: Network;
+}
+/**
+ * Resolves auth for background completion of pending external transactions.
+ * Service-account networks can run without a pre-existing session by minting
+ * an access token. Interactive networks still require a valid stored session.
+ */
+export declare function resolveAutomationRunContext(bootstrapStore: Store & AuthAware<Store>, userId: string, networkId: string, logger: Logger): Promise<AutomationRunContext | undefined>;
+//# sourceMappingURL=service-account-session.d.ts.map

package/dist/signing/service-account-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-session.d.ts","sourceRoot":"","sources":["../../src/signing/service-account-session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EACH,SAAS,EACT,WAAW,EACX,iBAAiB,EACpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAElE,MAAM,MAAM,0BAA0B,GAAG,CACrC,OAAO,EAAE,OAAO,KACf,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAE/B,MAAM,WAAW,oBAAoB;IACjC,WAAW,EAAE,WAAW,CAAA;IACxB,WAAW,EAAE,KAAK,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC7C,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAkC3C"}

package/dist/signing/service-account-session.js

@@ -0,0 +1,25 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { AuthTokenProvider, } from '@canton-network/core-wallet-auth';
+/**
+ * Resolves auth for background completion of pending external transactions.
+ * Service-account networks can run without a pre-existing session by minting
+ * an access token. Interactive networks still require a valid stored session.
+ */
+export async function resolveAutomationRunContext(bootstrapStore, userId, networkId, logger) {
+    const network = await bootstrapStore.getNetwork(networkId);
+    if (!network) {
+        logger.warn({ userId, networkId }, 'Skipping signing worker tick: network not found');
+        return undefined;
+    }
+    if (!network.serviceAccountAuth) {
+        logger.debug({ userId, networkId }, 'Skipping signing worker tick: network is not service-account');
+        return undefined;
+    }
+    const idp = await bootstrapStore.getIdp(network.identityProviderId);
+    const provider = AuthTokenProvider.fromGatewayConfig(idp, network.serviceAccountAuth, logger);
+    const authContext = await provider.getAuthContext();
+    const scopedStore = bootstrapStore.withAuthContext(authContext);
+    logger.debug({ userId, networkId }, 'Signing worker prepared service account session');
+    return { authContext, scopedStore, network };
+}

package/dist/signing/service-account-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-account-session.test.d.ts.map

package/dist/signing/service-account-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-session.test.d.ts","sourceRoot":"","sources":["../../src/signing/service-account-session.test.ts"],"names":[],"mappings":""}

package/dist/signing/service-account-session.test.js

@@ -0,0 +1,89 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { afterEach, describe, expect, it, vi } from 'vitest';
+vi.mock('uuid', () => ({ v4: vi.fn(() => 'session-new') }));
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { resolveAutomationRunContext } from './service-account-session.js';
+vi.mock('@canton-network/core-wallet-auth', async () => {
+    const actual = await vi.importActual('@canton-network/core-wallet-auth');
+    return {
+        ...actual,
+        AuthTokenProvider: {
+            fromGatewayConfig: vi.fn().mockReturnValue({
+                getAuthContext: vi.fn().mockResolvedValue({
+                    userId: 'service_account',
+                    accessToken: 'abc',
+                }),
+            }),
+        },
+    };
+});
+const idp = {
+    id: 'idp1',
+    type: 'oauth',
+    issuer: 'https://issuer.example',
+    configUrl: 'https://issuer.example/.well-known/openid-configuration',
+};
+const m2mNetwork = {
+    id: 'net-m2m',
+    name: 'm2m',
+    description: '',
+    synchronizerId: 'sync::fp',
+    identityProviderId: 'idp1',
+    ledgerApi: { baseUrl: 'http://ledger' },
+    auth: {
+        method: 'authorization_code',
+        clientId: 'svc',
+        audience: 'aud',
+        scope: 'scope',
+    },
+    serviceAccountAuth: {
+        method: 'client_credentials',
+        clientId: 'svc',
+        clientSecret: 'secret',
+        audience: 'aud',
+        scope: 'scope',
+    },
+};
+const logger = pino({ level: 'silent' }, sink());
+describe('resolveAutomationRunContext', () => {
+    afterEach(() => vi.clearAllMocks());
+    it('reuses a valid client-credentials session', async () => {
+        const session = {
+            id: 'session-1',
+            network: 'net-m2m',
+            accessToken: 'abc',
+        };
+        const scopedStore = { setSession: vi.fn() };
+        const store = {
+            getIdp: vi.fn().mockResolvedValue(idp),
+            getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+            withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        };
+        const result = await resolveAutomationRunContext(store, 'service_account', 'net-m2m', logger);
+        expect(result?.authContext).toEqual({
+            userId: 'service_account',
+            accessToken: session.accessToken,
+        });
+    });
+    it('mints a token when no usable session exists', async () => {
+        const scopedStore = { setSession: vi.fn() };
+        const store = {
+            getIdp: vi.fn().mockResolvedValue(idp),
+            getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+            withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        };
+        const result = await resolveAutomationRunContext(store, 'service_account', 'net-m2m', logger);
+        expect(result?.authContext.userId).toBe('service_account');
+    });
+    it('mints when the stored session is not a client-credentials token', async () => {
+        const scopedStore = { setSession: vi.fn() };
+        const store = {
+            getIdp: vi.fn().mockResolvedValue(idp),
+            getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+            withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        };
+        await resolveAutomationRunContext(store, 'service_account', 'net-m2m', logger);
+    });
+});

package/dist/signing/signing-drivers.d.ts

@@ -0,0 +1,7 @@
+import { SigningDriverInterface, SigningProvider } from '@canton-network/core-signing-lib';
+/**
+ * Signing drivers registered at Wallet Gateway startup.
+ * Partial because only configured providers are present (e.g. Dfns when env vars are set).
+ */
+export type SigningDrivers = Partial<Record<SigningProvider, SigningDriverInterface>>;
+//# sourceMappingURL=signing-drivers.d.ts.map

package/dist/signing/signing-drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-drivers.d.ts","sourceRoot":"","sources":["../../src/signing/signing-drivers.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AAEzC;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAChC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA"}

package/dist/signing/signing-drivers.js

@@ -0,0 +1,3 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/dist/signing/signing-worker.d.ts

@@ -0,0 +1,83 @@
+import { Logger } from 'pino';
+import { AuthAware } from '@canton-network/core-wallet-auth';
+import { Store } from '@canton-network/core-wallet-store';
+import { NotificationService } from '../notification/NotificationService.js';
+import type { SigningDrivers } from './signing-drivers.js';
+export type { AccessTokenProviderFactory } from './service-account-session.js';
+/** Configuration for {@link SigningWorker}. */
+export interface SigningWorkerOptions {
+    /** Poll interval in ms (`server.signingWorker.pollInterval`, default 5000). */
+    intervalMs: number;
+    signingDrivers: SigningDrivers;
+    store: Store & AuthAware<Store>;
+    notificationService: NotificationService;
+    logger: Logger;
+}
+/**
+ * Background poller that completes service-account transactions stuck in external
+ * custody approval.
+ *
+ * ## When this runs
+ *
+ * During M2M automation (`prepareExecute` → `signAndExecute`), external signing
+ * providers (Fireblocks, Blockdaemon, Dfns) may return `pending` instead of a
+ * signature. The gateway persists the transaction with `status: 'pending'` and
+ * an `externalTxId` from the provider. This worker picks up those rows on each
+ * tick via {@link Store.listAllPendingTransactions} (rows with an
+ * `externalTxId` are processed; others are skipped).
+ *
+ * Participant and wallet-kernel sign synchronously and never appear here.
+ *
+ * ## What happens on each tick
+ *
+ * For every pending row the worker resolves an M2M auth context
+ * ({@link resolveAutomationRunContext}), loads the user's primary wallet, and
+ * calls {@link TransactionService.signAndExecute}.
+ *
+ * Although the worker always invokes `signAndExecute`, **retries do not submit a
+ * new sign request**. `TransactionService.sign()` checks whether the stored
+ * transaction already has an `externalTxId`:
+ *
+ * - **First pass** (no `externalTxId`): `driver.signTransaction()` submits to
+ *   custody and stores the returned `externalTxId`.
+ * - **Subsequent ticks** (`externalTxId` present): `driver.getTransaction()`
+ *   polls the existing custody request for an updated status/signature.
+ *
+ * `signAndExecute` then:
+ *
+ * - returns early while the provider still reports `pending` (worker logs and
+ *   waits for the next tick), or
+ * - calls `execute()` once signing is `signed` (Dfns is special: it broadcasts
+ *   at sign-time, so execute only reconciles local state).
+ *
+ * A transaction is re-read before processing so a concurrent DApp call or an
+ * earlier tick that already completed it is skipped.
+ *
+ * ## Lifecycle
+ *
+ * Started once at gateway init (`start()`). Ticks are serialized: if a tick is
+ * still running, the next interval callback is a no-op. Use `stop()` on shutdown.
+ */
+export declare class SigningWorker {
+    private readonly options;
+    private timer;
+    private running;
+    constructor(options: SigningWorkerOptions);
+    /** Starts the interval timer. Idempotent if already started. */
+    start(): void;
+    /** Clears the interval timer. */
+    stop(): void;
+    /**
+     * One poll cycle: list all pending transactions and attempt to complete
+     * external-custody rows via {@link processPending}. Safe to call directly in
+     * tests.
+     */
+    tick(): Promise<void>;
+    /**
+     * Drives a single pending transaction through `signAndExecute`. Skips when
+     * automation context, submitting wallet, or refreshed `pending` status is missing.
+     * Errors are logged per transaction; other rows in the same tick still run.
+     */
+    private processPending;
+}
+//# sourceMappingURL=signing-worker.d.ts.map

package/dist/signing/signing-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-worker.d.ts","sourceRoot":"","sources":["../../src/signing/signing-worker.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAC5D,OAAO,EAAE,KAAK,EAAuB,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAG1D,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AAE9E,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACjC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAC/B,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,MAAM,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,qBAAa,aAAa;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,OAAO,CAAQ;gBAEM,OAAO,EAAE,oBAAoB;IAE1D,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAcb,iCAAiC;IACjC,IAAI,IAAI,IAAI;IAOZ;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B3B;;;;OAIG;YACW,cAAc;CAqH/B"}