@canton-network/wallet-gateway-remote 1.5.0 → 1.6.0

package/dist/signing/service-account-session.test.js

@@ -0,0 +1,89 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { afterEach, describe, expect, it, vi } from 'vitest';
+vi.mock('uuid', () => ({ v4: vi.fn(() => 'session-new') }));
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { resolveAutomationRunContext } from './service-account-session.js';
+vi.mock('@canton-network/core-wallet-auth', async () => {
+    const actual = await vi.importActual('@canton-network/core-wallet-auth');
+    return {
+        ...actual,
+        AuthTokenProvider: {
+            fromGatewayConfig: vi.fn().mockReturnValue({
+                getAuthContext: vi.fn().mockResolvedValue({
+                    userId: 'service_account',
+                    accessToken: 'abc',
+                }),
+            }),
+        },
+    };
+});
+const idp = {
+    id: 'idp1',
+    type: 'oauth',
+    issuer: 'https://issuer.example',
+    configUrl: 'https://issuer.example/.well-known/openid-configuration',
+};
+const m2mNetwork = {
+    id: 'net-m2m',
+    name: 'm2m',
+    description: '',
+    synchronizerId: 'sync::fp',
+    identityProviderId: 'idp1',
+    ledgerApi: { baseUrl: 'http://ledger' },
+    auth: {
+        method: 'authorization_code',
+        clientId: 'svc',
+        audience: 'aud',
+        scope: 'scope',
+    },
+    serviceAccountAuth: {
+        method: 'client_credentials',
+        clientId: 'svc',
+        clientSecret: 'secret',
+        audience: 'aud',
+        scope: 'scope',
+    },
+};
+const logger = pino({ level: 'silent' }, sink());
+describe('resolveAutomationRunContext', () => {
+    afterEach(() => vi.clearAllMocks());
+    it('reuses a valid client-credentials session', async () => {
+        const session = {
+            id: 'session-1',
+            network: 'net-m2m',
+            accessToken: 'abc',
+        };
+        const scopedStore = { setSession: vi.fn() };
+        const store = {
+            getIdp: vi.fn().mockResolvedValue(idp),
+            getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+            withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        };
+        const result = await resolveAutomationRunContext(store, 'service_account', 'net-m2m', logger);
+        expect(result?.authContext).toEqual({
+            userId: 'service_account',
+            accessToken: session.accessToken,
+        });
+    });
+    it('mints a token when no usable session exists', async () => {
+        const scopedStore = { setSession: vi.fn() };
+        const store = {
+            getIdp: vi.fn().mockResolvedValue(idp),
+            getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+            withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        };
+        const result = await resolveAutomationRunContext(store, 'service_account', 'net-m2m', logger);
+        expect(result?.authContext.userId).toBe('service_account');
+    });
+    it('mints when the stored session is not a client-credentials token', async () => {
+        const scopedStore = { setSession: vi.fn() };
+        const store = {
+            getIdp: vi.fn().mockResolvedValue(idp),
+            getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+            withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        };
+        await resolveAutomationRunContext(store, 'service_account', 'net-m2m', logger);
+    });
+});

package/dist/signing/signing-worker.d.ts

@@ -0,0 +1,83 @@
+import { Logger } from 'pino';
+import { AuthAware } from '@canton-network/core-wallet-auth';
+import { Store } from '@canton-network/core-wallet-store';
+import { NotificationService } from '../notification/NotificationService.js';
+import type { SigningDrivers } from './signing-drivers.js';
+export type { AccessTokenProviderFactory } from './service-account-session.js';
+/** Configuration for {@link SigningWorker}. */
+export interface SigningWorkerOptions {
+    /** Poll interval in ms (`server.signingWorker.pollInterval`, default 5000). */
+    intervalMs: number;
+    signingDrivers: SigningDrivers;
+    store: Store & AuthAware<Store>;
+    notificationService: NotificationService;
+    logger: Logger;
+}
+/**
+ * Background poller that completes service-account transactions stuck in external
+ * custody approval.
+ *
+ * ## When this runs
+ *
+ * During M2M automation (`prepareExecute` → `signAndExecute`), external signing
+ * providers (Fireblocks, Blockdaemon, Dfns) may return `pending` instead of a
+ * signature. The gateway persists the transaction with `status: 'pending'` and
+ * an `externalTxId` from the provider. This worker picks up those rows on each
+ * tick via {@link Store.listAllPendingTransactions} (rows with an
+ * `externalTxId` are processed; others are skipped).
+ *
+ * Participant and wallet-kernel sign synchronously and never appear here.
+ *
+ * ## What happens on each tick
+ *
+ * For every pending row the worker resolves an M2M auth context
+ * ({@link resolveAutomationRunContext}), loads the user's primary wallet, and
+ * calls {@link TransactionService.signAndExecute}.
+ *
+ * Although the worker always invokes `signAndExecute`, **retries do not submit a
+ * new sign request**. `TransactionService.sign()` checks whether the stored
+ * transaction already has an `externalTxId`:
+ *
+ * - **First pass** (no `externalTxId`): `driver.signTransaction()` submits to
+ *   custody and stores the returned `externalTxId`.
+ * - **Subsequent ticks** (`externalTxId` present): `driver.getTransaction()`
+ *   polls the existing custody request for an updated status/signature.
+ *
+ * `signAndExecute` then:
+ *
+ * - returns early while the provider still reports `pending` (worker logs and
+ *   waits for the next tick), or
+ * - calls `execute()` once signing is `signed` (Dfns is special: it broadcasts
+ *   at sign-time, so execute only reconciles local state).
+ *
+ * A transaction is re-read before processing so a concurrent DApp call or an
+ * earlier tick that already completed it is skipped.
+ *
+ * ## Lifecycle
+ *
+ * Started once at gateway init (`start()`). Ticks are serialized: if a tick is
+ * still running, the next interval callback is a no-op. Use `stop()` on shutdown.
+ */
+export declare class SigningWorker {
+    private readonly options;
+    private timer;
+    private running;
+    constructor(options: SigningWorkerOptions);
+    /** Starts the interval timer. Idempotent if already started. */
+    start(): void;
+    /** Clears the interval timer. */
+    stop(): void;
+    /**
+     * One poll cycle: list all pending transactions and attempt to complete
+     * external-custody rows via {@link processPending}. Safe to call directly in
+     * tests.
+     */
+    tick(): Promise<void>;
+    /**
+     * Drives a single pending transaction through `signAndExecute`. Skips when
+     * automation context, submitting wallet, or refreshed `pending` status is missing.
+     * Errors are logged per transaction; other rows in the same tick still run.
+     */
+    private processPending;
+}
+//# sourceMappingURL=signing-worker.d.ts.map

package/dist/signing/signing-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-worker.d.ts","sourceRoot":"","sources":["../../src/signing/signing-worker.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAC5D,OAAO,EAAE,KAAK,EAAuB,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAG1D,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AAE9E,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACjC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAC/B,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,MAAM,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,qBAAa,aAAa;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,OAAO,CAAQ;gBAEM,OAAO,EAAE,oBAAoB;IAE1D,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAcb,iCAAiC;IACjC,IAAI,IAAI,IAAI;IAOZ;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B3B;;;;OAIG;YACW,cAAc;CAqH/B"}

package/dist/signing/signing-worker.js

@@ -0,0 +1,206 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { TransactionService } from '../ledger/transaction-service.js';
+import { resolveAutomationRunContext } from './service-account-session.js';
+/**
+ * Background poller that completes service-account transactions stuck in external
+ * custody approval.
+ *
+ * ## When this runs
+ *
+ * During M2M automation (`prepareExecute` → `signAndExecute`), external signing
+ * providers (Fireblocks, Blockdaemon, Dfns) may return `pending` instead of a
+ * signature. The gateway persists the transaction with `status: 'pending'` and
+ * an `externalTxId` from the provider. This worker picks up those rows on each
+ * tick via {@link Store.listAllPendingTransactions} (rows with an
+ * `externalTxId` are processed; others are skipped).
+ *
+ * Participant and wallet-kernel sign synchronously and never appear here.
+ *
+ * ## What happens on each tick
+ *
+ * For every pending row the worker resolves an M2M auth context
+ * ({@link resolveAutomationRunContext}), loads the user's primary wallet, and
+ * calls {@link TransactionService.signAndExecute}.
+ *
+ * Although the worker always invokes `signAndExecute`, **retries do not submit a
+ * new sign request**. `TransactionService.sign()` checks whether the stored
+ * transaction already has an `externalTxId`:
+ *
+ * - **First pass** (no `externalTxId`): `driver.signTransaction()` submits to
+ *   custody and stores the returned `externalTxId`.
+ * - **Subsequent ticks** (`externalTxId` present): `driver.getTransaction()`
+ *   polls the existing custody request for an updated status/signature.
+ *
+ * `signAndExecute` then:
+ *
+ * - returns early while the provider still reports `pending` (worker logs and
+ *   waits for the next tick), or
+ * - calls `execute()` once signing is `signed` (Dfns is special: it broadcasts
+ *   at sign-time, so execute only reconciles local state).
+ *
+ * A transaction is re-read before processing so a concurrent DApp call or an
+ * earlier tick that already completed it is skipped.
+ *
+ * ## Lifecycle
+ *
+ * Started once at gateway init (`start()`). Ticks are serialized: if a tick is
+ * still running, the next interval callback is a no-op. Use `stop()` on shutdown.
+ */
+export class SigningWorker {
+    constructor(options) {
+        this.options = options;
+        this.running = false;
+    }
+    /** Starts the interval timer. Idempotent if already started. */
+    start() {
+        this.options.logger.info('Starting signing worker');
+        if (this.timer) {
+            return;
+        }
+        this.timer = setInterval(() => {
+            void this.tick();
+        }, this.options.intervalMs);
+        this.options.logger.info({ intervalMs: this.options.intervalMs }, 'Signing worker started');
+    }
+    /** Clears the interval timer. */
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+    }
+    /**
+     * One poll cycle: list all pending transactions and attempt to complete
+     * external-custody rows via {@link processPending}. Safe to call directly in
+     * tests.
+     */
+    async tick() {
+        this.options.logger.trace(`Signing worker: executing a tick`);
+        if (this.running) {
+            return;
+        }
+        this.running = true;
+        try {
+            const pending = await this.options.store.listAllPendingTransactions();
+            for (const tx of pending) {
+                if (!tx.externalTxId) {
+                    continue;
+                }
+                await this.processPending(tx);
+            }
+        }
+        catch (error) {
+            this.options.logger.error({ err: error }, 'Signing worker tick failed');
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    /**
+     * Drives a single pending transaction through `signAndExecute`. Skips when
+     * automation context, submitting wallet, or refreshed `pending` status is missing.
+     * Errors are logged per transaction; other rows in the same tick still run.
+     */
+    async processPending(transaction) {
+        const logger = this.options.logger;
+        const { userId, networkId, externalTxId } = transaction;
+        if (!externalTxId || !userId || !networkId) {
+            logger.debug({ transaction }, 'Skipping signing worker tick: missing required fields');
+            return;
+        }
+        const runContext = await resolveAutomationRunContext(this.options.store, userId, networkId, logger);
+        if (!runContext) {
+            logger.debug({ runContext, transactionId: transaction.id }, 'Skipping signing worker tick: no run context');
+            return;
+        }
+        const store = runContext.scopedStore;
+        const wallet = await resolveWalletFromTransaction(transaction, store, logger);
+        if (!wallet) {
+            logger.warn({
+                userId,
+                networkId,
+                transactionId: transaction.id,
+                commandId: transaction.commandId,
+            }, 'Skipping signing worker tick: could not deduce submitting wallet from transaction payload');
+            return;
+        }
+        const refreshedTx = await store.getTransaction(transaction.id);
+        if (!refreshedTx || refreshedTx.status !== 'pending') {
+            logger.debug({ refreshedTx }, 'Skipping signing worker tick: transaction no longer pending');
+            return;
+        }
+        const notifier = this.options.notificationService.getNotifier(userId);
+        const transactionLogger = this.options.logger.child({
+            component: 'TransactionService',
+        });
+        const transactionService = new TransactionService(store, transactionLogger, this.options.signingDrivers, notifier);
+        try {
+            const result = await transactionService.signAndExecute(runContext.authContext, runContext.network, wallet, refreshedTx);
+            if ('status' in result && result.status === 'pending') {
+                logger.info({
+                    userId,
+                    networkId,
+                    transactionId: transaction.id,
+                    commandId: transaction.commandId,
+                    externalTxId: result.externalTxId,
+                    signingProviderId: wallet.signingProviderId,
+                }, 'Signing worker: transaction still awaiting external signing');
+            }
+            else {
+                logger.info({
+                    userId,
+                    networkId,
+                    transactionId: transaction.id,
+                    commandId: transaction.commandId,
+                    externalTxId: transaction.externalTxId,
+                    partyId: wallet.partyId,
+                    signingProviderId: wallet.signingProviderId,
+                    result,
+                }, 'Signing worker completed service account transaction');
+            }
+        }
+        catch (error) {
+            logger.error({
+                err: error,
+                userId,
+                networkId,
+                transactionId: transaction.id,
+                commandId: transaction.commandId,
+                externalTxId: transaction.externalTxId,
+                partyId: wallet.partyId,
+                signingProviderId: wallet.signingProviderId,
+            }, 'Signing worker failed to complete service account transaction');
+        }
+    }
+}
+/**
+ * Given the transaction, attempt to resolve the original wallet that submitted it.
+ * It's not guaranteed that the primary wallet was used, so we check the `actAs` field in the payload and find a wallet with a matching party ID.
+ *
+ * Returns `undefined` if the wallet cannot be resolved.
+ */
+async function resolveWalletFromTransaction(tx, store, logger) {
+    logger.debug({ tx, store }, 'Resolving wallet from transaction payload');
+    // first see if we can determine the wallet from the payload's actAs field.
+    // If not, we will default to the primary wallet.
+    let wallet = undefined;
+    const payload = tx.payload;
+    if (payload && typeof payload === 'object') {
+        const actAs = payload.actAs;
+        if (Array.isArray(actAs) && actAs.length !== 0) {
+            if (actAs.length > 1) {
+                logger.warn({ actAs }, 'Transaction has multiple acting parties; using the first one to resolve wallet');
+            }
+            const partyId = actAs[0];
+            const wallets = await store.getAllWallets();
+            wallet = wallets.find((wallet) => wallet.partyId === partyId);
+        }
+    }
+    if (!wallet) {
+        // No actAs was given: lets default to the primary party.
+        wallet = await store.getPrimaryWallet();
+        logger.debug({ wallet, tx }, 'Transaction has no actAs; using primary wallet');
+    }
+    return wallet;
+}

package/dist/signing/signing-worker.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signing-worker.test.d.ts.map

package/dist/signing/signing-worker.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-worker.test.d.ts","sourceRoot":"","sources":["../../src/signing/signing-worker.test.ts"],"names":[],"mappings":""}

package/dist/signing/signing-worker.test.js

@@ -0,0 +1,152 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { SigningWorker } from './signing-worker.js';
+import { SigningProvider } from '@canton-network/core-signing-lib';
+const mocks = vi.hoisted(() => ({
+    signAndExecute: vi.fn().mockResolvedValue({ commandId: 'cmd-1' }),
+}));
+vi.mock('@canton-network/core-wallet-auth', async () => {
+    const actual = await vi.importActual('@canton-network/core-wallet-auth');
+    return {
+        ...actual,
+        AuthTokenProvider: {
+            fromGatewayConfig: vi.fn().mockReturnValue({
+                getAuthContext: vi.fn().mockResolvedValue({
+                    userId: 'service_account',
+                    accessToken: 'abc',
+                }),
+            }),
+        },
+    };
+});
+vi.mock('../ledger/transaction-service.js', () => ({
+    TransactionService: vi.fn(function TransactionServiceMock() {
+        return { signAndExecute: mocks.signAndExecute };
+    }),
+}));
+const idp = {
+    id: 'idp1',
+    type: 'oauth',
+    issuer: 'https://issuer.example',
+    configUrl: 'https://issuer.example/.well-known/openid-configuration',
+};
+const m2mNetwork = {
+    id: 'net-m2m',
+    name: 'm2m',
+    description: '',
+    synchronizerId: 'sync::fp',
+    identityProviderId: 'idp1',
+    ledgerApi: { baseUrl: 'http://ledger' },
+    auth: {
+        method: 'authorization_code',
+        clientId: 'user',
+        audience: 'aud',
+        scope: 'scope',
+    },
+    serviceAccountAuth: {
+        method: 'client_credentials',
+        clientId: 'svc',
+        clientSecret: 'secret',
+        audience: 'aud',
+        scope: 'scope',
+    },
+};
+const wallet = {
+    primary: true,
+    partyId: 'party::ns',
+    status: 'allocated',
+    hint: 'party',
+    publicKey: 'pk',
+    namespace: 'ns',
+    networkId: 'net-m2m',
+    signingProviderId: SigningProvider.FIREBLOCKS,
+    rights: [],
+};
+const aliceWallet = {
+    primary: false,
+    partyId: 'alice::ns2',
+    status: 'allocated',
+    hint: 'alice',
+    publicKey: 'pk2',
+    namespace: 'ns2',
+    networkId: 'net-m2m',
+    signingProviderId: SigningProvider.FIREBLOCKS,
+    rights: [],
+};
+const pendingTransaction = {
+    id: 'tx-1',
+    commandId: 'cmd-1',
+    status: 'pending',
+    preparedTransaction: 'blob',
+    preparedTransactionHash: 'hash',
+    externalTxId: 'ext-1',
+    origin: null,
+    userId: 'user-1',
+    networkId: 'net-m2m',
+};
+function createWorker(storeOverrides = {}) {
+    const scopedStore = {
+        setSession: vi.fn().mockResolvedValue(undefined),
+        getPrimaryWallet: vi.fn().mockResolvedValue(wallet),
+        getAllWallets: vi.fn().mockResolvedValue([wallet, aliceWallet]),
+        getTransaction: vi.fn().mockResolvedValue(pendingTransaction),
+    };
+    const store = {
+        listAllPendingTransactions: vi
+            .fn()
+            .mockResolvedValue([pendingTransaction]),
+        getIdp: vi.fn().mockResolvedValue(idp),
+        getNetwork: vi.fn().mockResolvedValue(m2mNetwork),
+        withAuthContext: vi.fn().mockReturnValue(scopedStore),
+        ...storeOverrides,
+    };
+    const logger = pino({ level: 'silent' }, sink());
+    return {
+        worker: new SigningWorker({
+            intervalMs: 1000,
+            signingDrivers: {},
+            store: store,
+            notificationService: {
+                getNotifier: vi.fn(() => ({ emit: vi.fn() })),
+            },
+            logger,
+        }),
+        store,
+        scopedStore,
+    };
+}
+describe('SigningWorker', () => {
+    afterEach(() => vi.clearAllMocks());
+    it('completes pending external transactions with a primary wallet', async () => {
+        const { worker } = createWorker();
+        await worker.tick();
+        expect(mocks.signAndExecute.mock.calls[0][2].partyId).toBe('party::ns');
+    });
+    it('uses a non-primary wallet when actAs payload is present', async () => {
+        const { worker } = createWorker({
+            listAllPendingTransactions: vi.fn().mockResolvedValue([
+                {
+                    ...pendingTransaction,
+                    payload: { actAs: ['alice::ns2'] },
+                },
+            ]),
+        });
+        await worker.tick();
+        expect(mocks.signAndExecute).toHaveBeenCalledOnce();
+        expect(mocks.signAndExecute.mock.calls[0][2].partyId).toBe('alice::ns2');
+    });
+    it('skips pending transactions without an externalTxId', async () => {
+        const { worker } = createWorker({
+            listAllPendingTransactions: vi
+                .fn()
+                .mockResolvedValue([
+                { ...pendingTransaction, externalTxId: undefined },
+            ]),
+        });
+        await worker.tick();
+        expect(mocks.signAndExecute).not.toHaveBeenCalled();
+    });
+});

package/dist/user-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAYnE,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,cAAc,EACvB,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4hCvB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAYnE,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,cAAc,EACvB,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgiCvB,CAAA"}

package/dist/user-api/controller.js

@@ -46,6 +46,9 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             const adminAuth = network.adminAuth
                 ? authSchema.parse(network.adminAuth)
                 : undefined;
+            const serviceAccountAuth = network.serviceAccountAuth
+                ? authSchema.parse(network.serviceAccountAuth)
+                : undefined;
             const newNetwork = {
                 name: network.name,
                 id: network.id,
@@ -54,6 +57,7 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
                 identityProviderId: network.identityProviderId,
                 auth,
                 adminAuth,
+                serviceAccountAuth,
                 ledgerApi,
             };
             // TODO: Add an explicit updateNetwork method to the User API spec and controller
@@ -434,12 +438,12 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             try {
                 const newSessionId = v4();
                 logger.info(`Adding session with ID ${newSessionId} for network ${params.networkId}`);
+                const network = await store.getNetwork(params.networkId);
                 await store.setSession({
                     id: newSessionId,
                     network: params.networkId,
                     accessToken: authContext?.accessToken || '',
                 });
-                const network = await store.getCurrentNetwork();
                 const idp = await store.getIdp(network.identityProviderId);
                 // Assumption: `setSession` calls `assertConnected`, so its safe to declare that the authContext is defined.
                 const { userId, accessToken } = authContext;
@@ -779,6 +783,9 @@ function toNetworkDto(network) {
         ...(network.adminAuth
             ? { adminAuth: toAuthDto(network.adminAuth) }
             : {}),
+        ...(network.serviceAccountAuth
+            ? { serviceAccountAuth: toAuthDto(network.serviceAccountAuth) }
+            : {}),
     };
 }
 function toPublicNetwork(network) {

package/dist/web/frontend/404/index.html

@@ -4,8 +4,8 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Not found</title>
-      <script type="module" crossorigin src="../assets/404-MVLWUPwN.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-D1dC4Cl9.js">
+      <script type="module" crossorigin src="../assets/404-C4hCL2o8.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-CFnOucPK.js">
     </head>
 
     <body>

package/dist/web/frontend/activities/index.html

@@ -4,9 +4,9 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Activities</title>
-      <script type="module" crossorigin src="../assets/activities-DaWkmGqA.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-D1dC4Cl9.js">
-      <link rel="modulepreload" crossorigin href="../assets/state-Bq65GwdF.js">
+      <script type="module" crossorigin src="../assets/activities-Bq7yMMQY.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-CFnOucPK.js">
+      <link rel="modulepreload" crossorigin href="../assets/state-DkxLvywv.js">
       <link rel="modulepreload" crossorigin href="../assets/index-CiMGhYb1.js">
     </head>
     <body>

package/dist/web/frontend/approve/index.html

@@ -4,11 +4,11 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Wallet Gateway - Activity detail</title>
-      <script type="module" crossorigin src="../assets/approve-WbGL4E82.js"></script>
-      <link rel="modulepreload" crossorigin href="../assets/index-D1dC4Cl9.js">
-      <link rel="modulepreload" crossorigin href="../assets/state-Bq65GwdF.js">
+      <script type="module" crossorigin src="../assets/approve-BuA5DGC2.js"></script>
+      <link rel="modulepreload" crossorigin href="../assets/index-CFnOucPK.js">
+      <link rel="modulepreload" crossorigin href="../assets/state-DkxLvywv.js">
       <link rel="modulepreload" crossorigin href="../assets/index-CiMGhYb1.js">
-      <link rel="modulepreload" crossorigin href="../assets/utils-B2iziW8V.js">
+      <link rel="modulepreload" crossorigin href="../assets/utils-DvJKIYxT.js">
     </head>
 
     <body>

package/dist/web/frontend/assets/404-C4hCL2o8.js

@@ -0,0 +1,5 @@
+import{h as m,i as z,A,b as E,t as I}from"./index-CFnOucPK.js";var j=Object.create,s=Object.defineProperty,k=Object.getOwnPropertyDescriptor,y=(r,e)=>(e=Symbol[r])?e:Symbol.for("Symbol."+r),x=r=>{throw TypeError(r)},D=(r,e,o)=>e in r?s(r,e,{enumerable:!0,configurable:!0,writable:!0,value:o}):r[e]=o,F=(r,e)=>s(r,"name",{value:e,configurable:!0}),g=r=>[,,,j(r?.[y("metadata")]??null)],C=["class","method","getter","setter","accessor","field","value","get","set"],S=r=>r!==void 0&&typeof r!="function"?x("Function expected"):r,M=(r,e,o,_,t)=>({kind:C[r],name:e,metadata:_,addInitializer:a=>o._?x("Already initialized"):t.push(S(a||null))}),N=(r,e)=>D(e,y("metadata"),r[3]),T=(r,e,o,_)=>{for(var t=0,a=r[e>>1],n=a&&a.length;t<n;t++)a[t].call(o);return _},$=(r,e,o,_,t,a)=>{var n,p,f,i=e&7,b=!1,h=0,P=r[h]||(r[h]=[]),c=i&&(t=t.prototype,i<5&&(i>3||!b)&&k(t,o));F(t,o);for(var d=_.length-1;d>=0;d--)f=M(i,o,p={},r[3],P),n=(0,_[d])(t,f),p._=1,S(n)&&(t=n);return N(r,t),c&&s(t,o,c),b?i^4?a:c:t},w,v,O;w=[I("user-ui-404")];const u=class u extends(O=m){render(){return E`<not-found href=${A("/")}></not-found>`}};u.styles=[m.styles,z`
+            :host {
+                display: block;
+            }
+        `];let l=u;v=g(O);l=$(v,0,"NotFoundUi",w,l);T(v,1,l);