@canton-network/wallet-gateway-remote 1.5.0 → 1.6.0

package/dist/config/Config.d.ts

@@ -15,6 +15,9 @@ export declare const serverConfigSchema: z.ZodObject<{
     requestRateLimit: z.ZodDefault<z.ZodNumber>;
     trustProxy: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber, z.ZodString]>>;
     admin: z.ZodOptional<z.ZodString>;
+    signingWorker: z.ZodPreprocess<z.ZodObject<{
+        pollInterval: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const rawConfigSchema: z.ZodObject<{
     kernel: z.ZodObject<{
@@ -33,6 +36,9 @@ export declare const rawConfigSchema: z.ZodObject<{
         requestRateLimit: z.ZodDefault<z.ZodNumber>;
         trustProxy: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber, z.ZodString]>>;
         admin: z.ZodOptional<z.ZodString>;
+        signingWorker: z.ZodPreprocess<z.ZodObject<{
+            pollInterval: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     logging: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
         level: z.ZodOptional<z.ZodEnum<{
@@ -229,6 +235,9 @@ export declare const configSchema: z.ZodObject<{
         requestRateLimit: z.ZodDefault<z.ZodNumber>;
         trustProxy: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber, z.ZodString]>>;
         admin: z.ZodOptional<z.ZodString>;
+        signingWorker: z.ZodPreprocess<z.ZodObject<{
+            pollInterval: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     logging: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
         level: z.ZodOptional<z.ZodEnum<{

package/dist/config/Config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,eAAO,MAAM,gBAAgB;;;;iBAY3B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAiD7B,CAAA;AAkCF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO1B,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,eAAO,MAAM,gBAAgB;;;;iBAY3B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;iBA0D7B,CAAA;AAkCF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO1B,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/dist/config/Config.js

@@ -57,6 +57,11 @@ export const serverConfigSchema = z.object({
     admin: z.string().optional().meta({
         description: 'The JWT claim (e.g. "sub") identifying the admin user. If set, requests with a matching claim will be granted admin privileges.',
     }),
+    signingWorker: z.preprocess((val) => val ?? {}, z.object({
+        pollInterval: z.number().int().positive().default(5000).meta({
+            description: 'Interval in milliseconds for the signing worker to poll external signing providers on pending transactions. Defaults to 5000.',
+        }),
+    })),
 });
 const loggingConfigSchema = z
     .object({

package/dist/dapp-api/controller.d.ts

@@ -3,7 +3,11 @@ import { Store } from '@canton-network/core-wallet-store';
 import { NotificationService } from '../notification/NotificationService.js';
 import { KernelInfo as KernelInfoConfig } from '../config/Config.js';
 import { Logger } from 'pino';
-export declare const dappController: (kernelInfo: KernelInfoConfig, dappUrl: string, userUrl: string, store: Store, notificationService: NotificationService, _logger: Logger, origin: string | null, context?: AuthContext) => {
+import { SigningDrivers } from '../signing/signing-drivers.js';
+export interface DappControllerDeps {
+    signingDrivers: SigningDrivers;
+}
+export declare const dappController: (kernelInfo: KernelInfoConfig, dappUrl: string, userUrl: string, store: Store, notificationService: NotificationService, _logger: Logger, origin: string | null, deps: DappControllerDeps, context?: AuthContext) => {
     status: import("./rpc-gen/typings.js").Status;
     connect: import("./rpc-gen/typings.js").Connect;
     disconnect: import("./rpc-gen/typings.js").Disconnect;

package/dist/dapp-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/dapp-api/controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAEH,WAAW,EAEd,MAAM,kCAAkC,CAAA;AAczC,OAAO,EAAE,KAAK,EAAe,MAAM,mCAAmC,CAAA;AAQtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAK7B,eAAO,MAAM,cAAc,GACvB,YAAY,gBAAgB,EAC5B,SAAS,MAAM,EACf,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,SAAS,MAAM,EACf,QAAQ,MAAM,GAAG,IAAI,EACrB,UAAU,WAAW;;;;;;;;;;;;;;;;CA0YxB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/dapp-api/controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAEH,WAAW,EAEd,MAAM,kCAAkC,CAAA;AAczC,OAAO,EAAE,KAAK,EAAe,MAAM,mCAAmC,CAAA;AAQtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAK7B,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAG9D,MAAM,WAAW,kBAAkB;IAC/B,cAAc,EAAE,cAAc,CAAA;CACjC;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,gBAAgB,EAC5B,SAAS,MAAM,EACf,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,SAAS,MAAM,EACf,QAAQ,MAAM,GAAG,IAAI,EACrB,MAAM,kBAAkB,EACxB,UAAU,WAAW;;;;;;;;;;;;;;;;CA2cxB,CAAA"}

package/dist/dapp-api/controller.js

@@ -5,9 +5,17 @@ import buildController from './rpc-gen/index.js';
 import { LedgerClient, } from '@canton-network/core-ledger-client';
 import { v4 } from 'uuid';
 import { networkStatus, ledgerPrepareParams, logDynamically } from '../utils.js';
+import { TransactionService } from '../ledger/transaction-service.js';
 import { rpcErrors } from '@canton-network/core-rpc-errors';
-export const dappController = (kernelInfo, dappUrl, userUrl, store, notificationService, _logger, origin, context) => {
+export const dappController = (kernelInfo, dappUrl, userUrl, store, notificationService, _logger, origin, deps, context) => {
     const logger = _logger.child({ component: 'dapp-controller' });
+    function assertActAsPartiesBelongToUser(actAs, wallets) {
+        for (const party of actAs) {
+            if (wallets.find((w) => w.partyId === party) === undefined) {
+                throw rpcErrors.invalidRequest(`Acting party ${party} does not belong to user`);
+            }
+        }
+    }
     return buildController({
         connect: async () => {
             if (!context || !(await store.getSession())) {
@@ -127,54 +135,63 @@ export const dappController = (kernelInfo, dappUrl, userUrl, store, notification
             return result;
         },
         prepareExecute: async (params) => {
-            const wallet = await store.getPrimaryWallet();
+            const primaryWallet = await store.getPrimaryWallet();
             const wallets = await store.getWallets();
             const network = await store.getCurrentNetwork();
             if (context === undefined) {
                 throw new Error('Unauthenticated context');
             }
-            if (wallet === undefined) {
-                throw new Error('No primary wallet found');
-            }
-            let userId = context.userId;
+            // determine user ID
+            const gatewayUserId = context.userId;
+            let ledgerUserId = context.userId;
             const accessTokenProvider = AuthTokenProvider.fromToken(context.accessToken, logger);
             if (context?.isApiKey) {
                 logger.info('Authenticated with API Key, fetching m2m token for ledger access');
-                userId = context.ledgerUserId;
+                ledgerUserId = context.ledgerUserId;
+            }
+            // determine party ID
+            let actAs = params.actAs || [];
+            if (actAs.length === 0) {
+                if (!primaryWallet) {
+                    throw new Error('No primary wallet found. Create or sync a wallet and set it as primary before prepareExecute.');
+                }
+                actAs = [primaryWallet.partyId];
+            }
+            assertActAsPartiesBelongToUser(actAs, wallets);
+            // determine wallet
+            const wallet = wallets.find((w) => w.partyId === actAs[0]);
+            if (wallet === undefined) {
+                throw new Error('No wallet found for the first acting party. Create or sync a wallet and set it as primary before prepareExecute.');
             }
             const ledgerClient = new LedgerClient({
                 baseUrl: new URL(network.ledgerApi.baseUrl),
                 logger,
                 accessTokenProvider,
             });
-            const notifier = notificationService.getNotifier(userId);
+            const notifier = notificationService.getNotifier(gatewayUserId);
             const commandId = params.commandId || v4();
             const transactionId = v4();
             notifier.emit('txChanged', { status: 'pending', commandId });
             const synchronizerId = network.synchronizerId ??
                 (await ledgerClient.getSynchronizerId());
-            let actAs = [wallet.partyId];
-            if (params.actAs && params.actAs.length > 0) {
-                actAs = params.actAs;
-                for (const actingParty of actAs) {
-                    if (wallets.find((w) => w.partyId === actingParty) ===
-                        undefined) {
-                        throw rpcErrors.invalidRequest(`Acting party ${actingParty} does not belong to user`);
-                    }
-                }
-            }
             logDynamically(logger, 'prepareExecute: Submitting request to ledger', {
                 info: { transactionId },
-                debug: { commandId, userId, actAs },
+                debug: {
+                    commandId,
+                    gatewayUserId,
+                    ledgerUserId,
+                    actAs,
+                    params,
+                },
             });
-            const actAsParty = params.actAs || [wallet.partyId];
-            const prepared = await prepareSubmission(context.userId, actAsParty, synchronizerId, params, ledgerClient);
+            const prepared = await prepareSubmission(ledgerUserId, actAs, synchronizerId, params, ledgerClient);
             logDynamically(logger, 'prepareExecute: Received response from ledger', {
                 info: { transactionId },
                 debug: {
                     commandId,
-                    userId,
-                    partyId: actAsParty,
+                    gatewayUserId,
+                    ledgerUserId,
+                    actAs,
                     prepared,
                 },
             });
@@ -189,18 +206,45 @@ export const dappController = (kernelInfo, dappUrl, userUrl, store, notification
                 createdAt: new Date(),
             };
             logger.info({
-                actAs: params.actAs || [wallet.partyId],
+                actAs,
                 readAs: params.readAs || [],
-                userId,
+                gatewayUserId,
+                ledgerUserId,
                 commandId,
                 commands: params.commands?.[0],
                 confirmationRequestTrafficCostEstimation: prepared.costEstimation
                     ?.confirmationRequestTrafficCostEstimation,
             }, 'prepared transaction traffic estimation');
             await store.setTransaction(transaction);
+            const approveUrl = `${userUrl}/approve/index.html?transactionId=${transactionId}&commandId=${commandId}&closeafteraction`;
+            if (context.isApiKey) {
+                logger.info({
+                    gatewayUserId,
+                    ledgerUserId,
+                    commandId,
+                    transactionId,
+                    signingProviderId: wallet.signingProviderId,
+                }, 'Service account straight-through prepare/sign/execute');
+                const transactionService = new TransactionService(store, logger, deps.signingDrivers, notifier);
+                try {
+                    await transactionService.signAndExecute(context, network, wallet, transaction);
+                }
+                catch (error) {
+                    logger.error({
+                        err: error,
+                        gatewayUserId,
+                        ledgerUserId,
+                        commandId,
+                        transactionId,
+                        actAs,
+                        signingProviderId: wallet.signingProviderId,
+                    }, 'Service account sign/execute failed after prepare');
+                    throw error;
+                }
+            }
             return {
                 // closeafteraction query param flag makes approving or deleting tx close the popup
-                userUrl: `${userUrl}/approve/index.html?transactionId=${transactionId}&commandId=${commandId}&closeafteraction`,
+                userUrl: approveUrl,
             };
         },
         status: async () => {

package/dist/dapp-api/controller.test.js

@@ -107,8 +107,8 @@ async function createStore(logger, context, options = {}) {
     }
     return store;
 }
-function createController(store, notificationService, logger, context, requestOrigin = origin) {
-    return dappController(kernelInfo, dappUrl, userUrl, store, notificationService, logger, requestOrigin, context);
+function createController(store, notificationService, logger, context, requestOrigin = origin, deps) {
+    return dappController(kernelInfo, dappUrl, userUrl, store, notificationService, logger, requestOrigin, deps || { signingDrivers: {} }, context);
 }
 describe('dappController', () => {
     let logger;

package/dist/dapp-api/server.d.ts

@@ -1,9 +1,10 @@
 import express from 'express';
 import { Logger } from 'pino';
 import { Store } from '@canton-network/core-wallet-store';
-import { AuthService, AuthAware } from '@canton-network/core-wallet-auth';
+import { AuthAware } from '@canton-network/core-wallet-auth';
 import { Server } from 'http';
 import { NotificationService } from '../notification/NotificationService.js';
 import { KernelInfo, ServerConfig } from '../config/Config.js';
-export declare const dapp: (route: string, app: express.Express, logger: Logger, server: Server, kernelInfo: KernelInfo, dappUrl: string, userUrl: string, serverConfig: ServerConfig, notificationService: NotificationService, authService: AuthService, store: Store & AuthAware<Store>) => Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;
+import { DappControllerDeps } from './controller.js';
+export declare const dapp: (route: string, app: express.Express, logger: Logger, server: Server, kernelInfo: KernelInfo, dappUrl: string, userUrl: string, serverConfig: ServerConfig, notificationService: NotificationService, store: Store & AuthAware<Store>, controllerDeps: DappControllerDeps) => Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;
 //# sourceMappingURL=server.d.ts.map

package/dist/dapp-api/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dapp-api/server.ts"],"names":[],"mappings":"AAGA,OAAO,OAAO,MAAM,SAAS,CAAA;AAG7B,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAG7B,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAO9D,eAAO,MAAM,IAAI,GACb,OAAO,MAAM,EACb,KAAK,OAAO,CAAC,OAAO,EACpB,QAAQ,MAAM,EACd,QAAQ,MAAM,EACd,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,SAAS,MAAM,EACf,cAAc,YAAY,EAC1B,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,EACxB,OAAO,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,kGA4FlC,CAAA"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dapp-api/server.ts"],"names":[],"mappings":"AAGA,OAAO,OAAO,MAAM,SAAS,CAAA;AAG7B,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAG7B,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAOpD,eAAO,MAAM,IAAI,GACb,OAAO,MAAM,EACb,KAAK,OAAO,CAAC,OAAO,EACpB,QAAQ,MAAM,EACd,QAAQ,MAAM,EACd,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,SAAS,MAAM,EACf,cAAc,YAAY,EAC1B,qBAAqB,mBAAmB,EACxC,OAAO,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAC/B,gBAAgB,kBAAkB,kGA6FrC,CAAA"}

package/dist/dapp-api/server.js

@@ -7,7 +7,7 @@ function writeSSE(res, event, data) {
     res.write(`event: ${event}\n`);
     res.write(`data: ${JSON.stringify(data)}\n\n`);
 }
-export const dapp = (route, app, logger, server, kernelInfo, dappUrl, userUrl, serverConfig, notificationService, authService, store) => {
+export const dapp = (route, app, logger, server, kernelInfo, dappUrl, userUrl, serverConfig, notificationService, store, controllerDeps) => {
     app.use(cors({
         origin: serverConfig.allowedOrigins,
     }));
@@ -67,7 +67,7 @@ export const dapp = (route, app, logger, server, kernelInfo, dappUrl, userUrl, s
     app.use(route, (req, res, next) => {
         const origin = req.headers.origin ?? null;
         jsonRpcHandler({
-            controller: dappController(kernelInfo, dappUrl, userUrl, store.withAuthContext(req.authContext), notificationService, logger, origin, req.authContext),
+            controller: dappController(kernelInfo, dappUrl, userUrl, store.withAuthContext(req.authContext), notificationService, logger, origin, controllerDeps, req.authContext),
             logger,
         })(req, res, next);
     });

package/dist/dapp-api/server.test.js

@@ -11,11 +11,6 @@ import { NotificationService } from '../notification/NotificationService.js';
 import { pino } from 'pino';
 import { sink } from 'pino-test';
 import { createServer } from 'http';
-const authService = {
-    verifyToken: async () => {
-        return new Promise((resolve) => resolve({ userId: 'user123', accessToken: 'token123' }));
-    },
-};
 const configPath = '../test/config.json';
 const config = ConfigUtils.loadConfigFile(configPath);
 const store = new StoreInternal(config.bootstrap, pino(sink()));
@@ -26,7 +21,7 @@ test('call connect rpc', async () => {
     app.use(express.json());
     const server = createServer(app);
     const { dappApiUrl, publicUrl } = deriveUrls(config);
-    const response = await request(dapp('/api/v0/dapp', app, pino(sink()), server, config.kernel, dappApiUrl, publicUrl, config.server, notificationService, authService, store))
+    const response = await request(dapp('/api/v0/dapp', app, pino(sink()), server, config.kernel, dappApiUrl, publicUrl, config.server, notificationService, store, { signingDrivers: {} }))
         .post('/api/v0/dapp')
         .send({ jsonrpc: '2.0', id: 0, method: 'connect', params: [] })
         .set('Accept', 'application/json');

package/dist/example-config.d.ts

@@ -16,6 +16,9 @@ declare const _default: {
         requestRateLimit: number;
         trustProxy: false;
         admin: string;
+        signingWorker: {
+            pollInterval: number;
+        };
     };
     signingStore: {
         connection: {

package/dist/example-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"example-config.d.ts","sourceRoot":"","sources":["../src/example-config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,wBAkGqB"}
+{"version":3,"file":"example-config.d.ts","sourceRoot":"","sources":["../src/example-config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,wBAqGqB"}

package/dist/example-config.js

@@ -18,6 +18,9 @@ export default {
         requestRateLimit: 10000,
         trustProxy: false,
         admin: 'sub',
+        signingWorker: {
+            pollInterval: 5000,
+        },
     },
     signingStore: {
         connection: {

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAyB7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAuMvC,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAoKhE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAyB7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAyMvC,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAmLhE"}

package/dist/init.js

@@ -23,8 +23,10 @@ import { sessionHandler } from './middleware/sessionHandler.js';
 import { NotificationService } from './notification/NotificationService.js';
 import { sql } from 'kysely';
 import { Env } from './env.js';
+import { SigningWorker } from './signing/signing-worker.js';
 import { apiKeyAuth } from './middleware/apiKeyAuth.js';
 let isReady = false;
+let signingWorker;
 async function initializeDatabase(config, logger) {
     logger.info('Checking for database migrations...');
     let exists = true;
@@ -231,8 +233,21 @@ export async function initialize(opts, logger) {
     app.use('/api/*splat', express.json(), preAuthRateLimit, apiKeyAuth(store, config.server.dappPath, logger.child({ component: 'ApiKeyHandler' })), jwtAuth(authService, logger.child({ component: 'JwtHandler' })), postAuthRateLimit, sessionHandler(store, allowedPaths, logger.child({ component: 'SessionHandler' })));
     logger.info({ ...config.server, port }, 'Server configuration');
     const kernelInfo = config.kernel;
+    const signingWorkerLogger = logger.child({
+        component: 'SigningWorker',
+    });
+    signingWorker = new SigningWorker({
+        intervalMs: config.server.signingWorker.pollInterval,
+        signingDrivers: drivers,
+        store,
+        notificationService,
+        logger: signingWorkerLogger,
+    });
+    signingWorker.start();
     // register dapp API handlers
-    dapp(config.server.dappPath, app, logger, server, kernelInfo, dappApiUrl, publicUrl, config.server, notificationService, authService, store);
+    dapp(config.server.dappPath, app, logger, server, kernelInfo, dappApiUrl, publicUrl, config.server, notificationService, store, {
+        signingDrivers: drivers,
+    });
     // register user API handlers
     user(config.server.userPath, app, logger, kernelInfo, publicUrl, notificationService, drivers, store, config.server.admin);
     // register web handler

package/dist/ledger/transaction-service.d.ts

@@ -7,6 +7,7 @@ import { ExecuteParams, ExecuteResult, SignParams } from '../user-api/rpc-gen/ty
 import { UserId } from '../dapp-api/rpc-gen/typings.js';
 import { Notifier } from '../notification/NotificationService.js';
 import { AuthContext } from '@canton-network/core-wallet-auth';
+export type SignAndExecuteResult = SignResult | ExecuteResult;
 export declare class TransactionService {
     private store;
     private logger;
@@ -15,6 +16,7 @@ export declare class TransactionService {
     constructor(store: Store, logger: Logger, signingDrivers: SigningDrivers | undefined, notifier: Notifier);
     sign(authContext: AuthContext, wallet: Wallet, signParams: SignParams): Promise<SignResult>;
     execute(userId: UserId, wallet: Wallet, transaction: Transaction, executeParams?: ExecuteParams, ledgerClient?: LedgerClient, network?: Network): Promise<ExecuteResult>;
+    signAndExecute(authContext: AuthContext, network: Network, wallet: Wallet, transaction: Transaction): Promise<SignAndExecuteResult>;
     private loadPreparedTransactionForSigning;
     private signWithParticipant;
     private signWithWalletKernel;

package/dist/ledger/transaction-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transaction-service.d.ts","sourceRoot":"","sources":["../../src/ledger/transaction-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,OAAO,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAOhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EACH,aAAa,EACb,aAAa,EACb,UAAU,EAEb,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAMjE,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAW9D,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,QAAQ;gBAHR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,cAAc,YAAK,EACnC,QAAQ,EAAE,QAAQ;IAGjB,IAAI,CACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAiDf,OAAO,CACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,EACxB,aAAa,CAAC,EAAE,aAAa,EAC7B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,aAAa,CAAC;YA6DX,iCAAiC;IAW/C,OAAO,CAAC,mBAAmB;YASb,oBAAoB;YAyDpB,mBAAmB;YAiHnB,kBAAkB;IAqHhC;;;;;OAKG;YACW,YAAY;IA2G1B;;;;OAIG;YACW,eAAe;YAgCf,sBAAsB;YAoDtB,mBAAmB;CAiEpC"}
+{"version":3,"file":"transaction-service.d.ts","sourceRoot":"","sources":["../../src/ledger/transaction-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACjE,OAAO,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,OAAO,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAOhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EACH,aAAa,EACb,aAAa,EACb,UAAU,EAEb,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAMjE,OAAO,EACH,WAAW,EAEd,MAAM,kCAAkC,CAAA;AAEzC,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,aAAa,CAAA;AAW7D,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,QAAQ;gBAHR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,cAAc,YAAK,EACnC,QAAQ,EAAE,QAAQ;IAGjB,IAAI,CACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,UAAU,CAAC;IAiDf,OAAO,CACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,EACxB,aAAa,CAAC,EAAE,aAAa,EAC7B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,aAAa,CAAC;IAiEZ,cAAc,CACvB,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,GACzB,OAAO,CAAC,oBAAoB,CAAC;YAyDlB,iCAAiC;IAkB/C,OAAO,CAAC,mBAAmB;YASb,oBAAoB;YAyDpB,mBAAmB;YAiHnB,kBAAkB;IAqHhC;;;;;OAKG;YACW,YAAY;IA2G1B;;;;OAIG;YACW,eAAe;YAgCf,sBAAsB;YAoDtB,mBAAmB;CAiEpC"}

package/dist/ledger/transaction-service.js

@@ -1,7 +1,9 @@
 // Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
+import { LedgerClient } from '@canton-network/core-ledger-client';
 import { SigningProvider, } from '@canton-network/core-signing-lib';
 import { ledgerPrepareParams, logDynamically, } from '../utils.js';
+import { AuthTokenProvider, } from '@canton-network/core-wallet-auth';
 function handleSigningError(result) {
     if ('error' in result) {
         throw new Error(`Error from signing driver: ${result.error_description}`);
@@ -45,6 +47,9 @@ export class TransactionService {
         }
     }
     execute(userId, wallet, transaction, executeParams, ledgerClient, network) {
+        if (transaction.status === 'executed') {
+            throw new Error('Transaction is already executed.');
+        }
         switch (wallet.signingProviderId) {
             case SigningProvider.PARTICIPANT: {
                 try {
@@ -82,11 +87,46 @@ export class TransactionService {
                 throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
         }
     }
+    async signAndExecute(authContext, network, wallet, transaction) {
+        const signParams = {
+            transactionId: transaction.id,
+            partyId: wallet.partyId,
+        };
+        const signResult = await this.sign(authContext, wallet, signParams);
+        if (signResult.status === 'pending') {
+            return signResult;
+        }
+        if (signResult.status !== 'signed') {
+            throw new Error(`Service account signing failed with status: ${signResult.status}`);
+        }
+        if (!('signature' in signResult) ||
+            signResult.signature === undefined) {
+            throw new Error('Service account signing did not return a signature');
+        }
+        const ledgerClient = new LedgerClient({
+            baseUrl: new URL(network.ledgerApi.baseUrl),
+            logger: this.logger,
+            accessTokenProvider: AuthTokenProvider.fromToken(authContext.accessToken, this.logger),
+        });
+        const executeParams = {
+            transactionId: transaction.id,
+            partyId: wallet.partyId,
+            signature: signResult.signature,
+            signedBy: signResult.signedBy,
+        };
+        const userId = authContext.isApiKey
+            ? authContext.ledgerUserId
+            : authContext.userId;
+        return this.execute(userId, wallet, transaction, executeParams, ledgerClient, network);
+    }
     async loadPreparedTransactionForSigning(transactionId) {
         const existingTx = await this.store.getTransaction(transactionId);
         if (!existingTx) {
             throw new Error(`Transaction not found with id: ${transactionId}`);
         }
+        if (existingTx.status !== 'pending') {
+            throw new Error(`Cannot sign an already ${existingTx.status} transaction`);
+        }
         return existingTx;
     }
     signWithParticipant(wallet) {

package/dist/ledger/transaction-service.test.js

@@ -353,4 +353,38 @@ describe('TransactionService', () => {
             });
         });
     });
+    describe('signAndExecute', () => {
+        const participantWallet = walletWithProvider(SigningProvider.PARTICIPANT);
+        it('signs and executes when signing completes synchronously', async () => {
+            const service = createService(createStore(), {}, notifier, logger);
+            const executeSpy = vi
+                .spyOn(service, 'execute')
+                .mockResolvedValue({ commandId: 'cmd-1' });
+            vi.spyOn(service, 'sign').mockResolvedValue({
+                status: 'signed',
+                signature: 'sig',
+                signedBy: 'namespace',
+                partyId: participantWallet.partyId,
+            });
+            const result = await service.signAndExecute(authContext, network, participantWallet, pendingTransaction);
+            expect(result).toEqual({ commandId: 'cmd-1' });
+            expect(executeSpy).toHaveBeenCalled();
+        });
+        it('returns pending sign result without executing', async () => {
+            const service = createService(createStore(), {}, notifier, logger);
+            const executeSpy = vi.spyOn(service, 'execute');
+            vi.spyOn(service, 'sign').mockResolvedValue({
+                status: 'pending',
+                externalTxId: 'ext-1',
+                partyId: participantWallet.partyId,
+            });
+            const result = await service.signAndExecute(authContext, network, participantWallet, pendingTransaction);
+            expect(result).toEqual({
+                status: 'pending',
+                externalTxId: 'ext-1',
+                partyId: participantWallet.partyId,
+            });
+            expect(executeSpy).not.toHaveBeenCalled();
+        });
+    });
 });

package/dist/middleware/apiKeyAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeyAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/apiKeyAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EACH,SAAS,EAGZ,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAMzD,wBAAgB,UAAU,CACtB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,IAEA,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,wDAuHhE"}
+{"version":3,"file":"apiKeyAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/apiKeyAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EACH,SAAS,EAGZ,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAMzD,wBAAgB,UAAU,CACtB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,IAEA,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,wDAiIhE"}

package/dist/middleware/apiKeyAuth.js

@@ -48,6 +48,7 @@ export function apiKeyAuth(store, dappApiPath, logger) {
             const network = await authStore.getNetwork(matchingKey.networkId);
             const idp = await authStore.getIdp(network.identityProviderId);
             if (!network.serviceAccountAuth) {
+                logger.debug({ network }, 'Network does not have a service account configured');
                 return res.status(401).json(jsonRpcResponse(reqId, {
                     error: {
                         code: rpcErrors.invalidRequest().code,
@@ -56,6 +57,7 @@ export function apiKeyAuth(store, dappApiPath, logger) {
                 }));
             }
             if (network.serviceAccountAuth.method !== 'client_credentials') {
+                logger.debug({ network }, 'Network does not have a service account configured with client_credentials method');
                 return res.status(401).json(jsonRpcResponse(reqId, {
                     error: {
                         code: rpcErrors.invalidRequest().code,

package/dist/signing/service-account-session.d.ts

@@ -0,0 +1,16 @@
+import { Logger } from 'pino';
+import { AuthAware, AuthContext, AuthTokenProvider } from '@canton-network/core-wallet-auth';
+import { Network, Store } from '@canton-network/core-wallet-store';
+export type AccessTokenProviderFactory = (network: Network) => Promise<AuthTokenProvider>;
+export interface AutomationRunContext {
+    authContext: AuthContext;
+    scopedStore: Store;
+    network: Network;
+}
+/**
+ * Resolves auth for background completion of pending external transactions.
+ * Service-account networks can run without a pre-existing session by minting
+ * an access token. Interactive networks still require a valid stored session.
+ */
+export declare function resolveAutomationRunContext(bootstrapStore: Store & AuthAware<Store>, userId: string, networkId: string, logger: Logger): Promise<AutomationRunContext | undefined>;
+//# sourceMappingURL=service-account-session.d.ts.map

package/dist/signing/service-account-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-session.d.ts","sourceRoot":"","sources":["../../src/signing/service-account-session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EACH,SAAS,EACT,WAAW,EACX,iBAAiB,EACpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAElE,MAAM,MAAM,0BAA0B,GAAG,CACrC,OAAO,EAAE,OAAO,KACf,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAE/B,MAAM,WAAW,oBAAoB;IACjC,WAAW,EAAE,WAAW,CAAA;IACxB,WAAW,EAAE,KAAK,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC7C,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAkC3C"}

package/dist/signing/service-account-session.js

@@ -0,0 +1,25 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { AuthTokenProvider, } from '@canton-network/core-wallet-auth';
+/**
+ * Resolves auth for background completion of pending external transactions.
+ * Service-account networks can run without a pre-existing session by minting
+ * an access token. Interactive networks still require a valid stored session.
+ */
+export async function resolveAutomationRunContext(bootstrapStore, userId, networkId, logger) {
+    const network = await bootstrapStore.getNetwork(networkId);
+    if (!network) {
+        logger.warn({ userId, networkId }, 'Skipping signing worker tick: network not found');
+        return undefined;
+    }
+    if (!network.serviceAccountAuth) {
+        logger.debug({ userId, networkId }, 'Skipping signing worker tick: network is not service-account');
+        return undefined;
+    }
+    const idp = await bootstrapStore.getIdp(network.identityProviderId);
+    const provider = AuthTokenProvider.fromGatewayConfig(idp, network.serviceAccountAuth, logger);
+    const authContext = await provider.getAuthContext();
+    const scopedStore = bootstrapStore.withAuthContext(authContext);
+    logger.debug({ userId, networkId }, 'Signing worker prepared service account session');
+    return { authContext, scopedStore, network };
+}

package/dist/signing/service-account-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-account-session.test.d.ts.map

package/dist/signing/service-account-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-session.test.d.ts","sourceRoot":"","sources":["../../src/signing/service-account-session.test.ts"],"names":[],"mappings":""}