@mysten-incubation/devstack 0.0.0

package/dist/plugins/wallet/protocol.mjs

@@ -0,0 +1,96 @@
+import { Schema } from "effect";
+//#region src/plugins/wallet/protocol.ts
+/**
+* Canonical path constants under the `/api/v1/devstack/*` prefix.
+*
+* Distilled-doc note (15-wallet.md "Fork-control routes declared but
+* unimplemented"): the legacy server declared four `FORK_*` path
+* constants whose handlers never landed. Per "no compat for never-
+* cases", we drop them from the wire protocol entirely — when the
+* fork-control surface is wired, those routes will be added (and the
+* dev-wallet adapter shipped together). No half-done stubs.
+*/
+const WalletHttpPath = {
+	HEALTH: "/api/v1/devstack/health",
+	ACCOUNTS: "/api/v1/devstack/accounts",
+	SIGN_TRANSACTION: "/api/v1/devstack/sign-transaction",
+	SIGN_PERSONAL_MESSAGE: "/api/v1/devstack/sign-personal-message",
+	EXECUTE: "/api/v1/devstack/execute"
+};
+/** Prefix gate: ANY path under this prefix is treated as protocol traffic
+*  (and subject to mandatory Origin + bearer); anything else is a flat
+*  404. */
+const WALLET_PROTOCOL_PREFIX = "/api/v1/devstack/";
+/**
+* Sui address — `0x` + 64 hex chars. Schema-validated so a typo or
+* truncated address surfaces as a structured `body-invalid` request
+* error rather than a confusing `address-not-found` (no account bound
+* at the address would be the same shape if we didn't validate).
+*/
+const SuiAddressSchema = Schema.String.check(Schema.isPattern(/^0x[0-9a-fA-F]{64}$/));
+/** Base64-encoded bytes — string-typed at the wire (we keep base64 over
+*  the cross-boundary; the server decodes with `Uint8Array.fromBase64`
+*  or equivalent before handing to the Account sign closures). */
+const Base64Schema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]*={0,2}$/));
+/** Signature scheme discriminator surfaced on `/accounts`. Mirrors the
+*  `AccountValue.scheme` shape from the account plugin. */
+const SignatureSchemeSchema = Schema.Union([
+	Schema.Literal("ed25519"),
+	Schema.Literal("secp256k1"),
+	Schema.Literal("secp256r1")
+]);
+/** Account-source discriminator. `'impersonate'` accounts cannot
+*  satisfy `signTransaction` / `signPersonalMessage` — only
+*  `/execute` (which routes through the fork-admin surface) makes
+*  sense for them. */
+const AccountSourceSchema = Schema.Union([Schema.Literal("real"), Schema.Literal("impersonate")]);
+Schema.Struct({ ok: Schema.Literal(true) });
+const AccountSummarySchema = Schema.Struct({
+	name: Schema.String,
+	address: SuiAddressSchema,
+	scheme: SignatureSchemeSchema,
+	/** Base64-encoded `publicKey`. Impersonation accounts publish a
+	*  zero-length string here — consumers branch on `source`, not on
+	*  publicKey emptiness. */
+	publicKey: Base64Schema,
+	source: AccountSourceSchema
+});
+Schema.Struct({ accounts: Schema.Array(AccountSummarySchema) });
+/** Canonical sign request — same shape for transaction and personal-
+*  message routes. `bytes` is the only payload key (no `txBytes`,
+*  `message`, or `messageBytes` aliases). */
+const SignRequestSchema = Schema.Struct({
+	address: SuiAddressSchema,
+	bytes: Base64Schema
+});
+Schema.Struct({
+	bytes: Base64Schema,
+	signature: Schema.String
+});
+/** Execute request — `bytes` is the BCS-serialized transaction.
+*  Impersonation accounts route through fork-admin (no signature
+*  needed); real accounts route through `signAndExecute`. */
+const ExecuteRequestSchema = Schema.Struct({
+	address: SuiAddressSchema,
+	bytes: Base64Schema
+});
+Schema.Struct({
+	digest: Schema.String,
+	effects: Schema.Unknown,
+	objectChanges: Schema.Array(Schema.Unknown),
+	balanceChanges: Schema.Array(Schema.Unknown)
+});
+Schema.Struct({
+	error: Schema.String,
+	code: Schema.String
+});
+const WALLET_AUTH_HEADER = "authorization";
+const WALLET_BEARER_PREFIX = "Bearer ";
+/** URL-fragment key the pair-URL carries the token under
+*  (`<wallet-url>/#token=<32-hex>`). Fragments are not sent to the
+*  server, so the token never appears in access logs / referrers. */
+const WALLET_TOKEN_FRAGMENT_KEY = "token";
+//#endregion
+export { AccountSourceSchema, AccountSummarySchema, Base64Schema, ExecuteRequestSchema, SignRequestSchema, SignatureSchemeSchema, SuiAddressSchema, WALLET_AUTH_HEADER, WALLET_BEARER_PREFIX, WALLET_PROTOCOL_PREFIX, WALLET_TOKEN_FRAGMENT_KEY, WalletHttpPath };
+
+//# sourceMappingURL=protocol.mjs.map

package/dist/plugins/wallet/protocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/plugins/wallet/protocol.ts"],"sourcesContent":["// Wallet plugin — wire-level protocol.\n//\n// This file is the ONE cross-boundary contract between the devstack-\n// side HTTP server (this plugin) and the browser-side adapter (the\n// `dev-wallet` package). The browser-side adapter MUST be kept in\n// lock-step with these schemas; today that's enforced by a mirror in\n// `dev-wallet/src/adapters/devstack-paths.ts` + a byte-equality test.\n//\n// Distilled-doc opportunity (15-wallet.md \"Acyclic-edge duplication\"):\n// the duplication exists because devstack peer-deps on dev-wallet (for\n// codegen output) and a reverse edge would close a workspace cycle.\n// Per the task's architecture-revision flag: the long-term fix is to\n// hoist this file into a third tiny package (e.g.\n// `@mysten-incubation/devstack-wallet-protocol`) consumed by BOTH\n// sides. See `## Architecture-doc revisions` in the report.\n//\n// Canonical envelope choice (15-wallet.md \"Asymmetric sign-response\n// field names\" + \"Dual field-name acceptance\"):\n//\n//   - Sign endpoints accept `{ address, bytes }` (always `bytes`, never\n//     `txBytes` or `messageBytes`).\n//   - Sign endpoints respond `{ bytes, signature }` (always those two\n//     names; never `txBytes` / `suiSignature`).\n//\n// This mirrors `@mysten/sui`'s `Signer.signTransaction` /\n// `signPersonalMessage` return shape exactly, eliminating the asymmetry\n// the legacy server carried. Per the memory note \"no compat for\n// never-cases\" — devstack is unreleased, no migration burden.\n//\n// Effect v4 Schema is the validator. Each request/response is a\n// Schema.Struct; handlers `Schema.decodeUnknown(...)` the body and\n// `catchTag('ParseError', ...)` into a `body-invalid` request error.\n\nimport { Schema } from 'effect';\n\n// ----------------------------------------------------------------------\n// Path constants\n// ----------------------------------------------------------------------\n\n/**\n * Canonical path constants under the `/api/v1/devstack/*` prefix.\n *\n * Distilled-doc note (15-wallet.md \"Fork-control routes declared but\n * unimplemented\"): the legacy server declared four `FORK_*` path\n * constants whose handlers never landed. Per \"no compat for never-\n * cases\", we drop them from the wire protocol entirely — when the\n * fork-control surface is wired, those routes will be added (and the\n * dev-wallet adapter shipped together). No half-done stubs.\n */\nexport const WalletHttpPath = {\n\tHEALTH: '/api/v1/devstack/health',\n\tACCOUNTS: '/api/v1/devstack/accounts',\n\tSIGN_TRANSACTION: '/api/v1/devstack/sign-transaction',\n\tSIGN_PERSONAL_MESSAGE: '/api/v1/devstack/sign-personal-message',\n\tEXECUTE: '/api/v1/devstack/execute',\n} as const;\n\nexport type WalletHttpPathValue = (typeof WalletHttpPath)[keyof typeof WalletHttpPath];\n\n/** Prefix gate: ANY path under this prefix is treated as protocol traffic\n *  (and subject to mandatory Origin + bearer); anything else is a flat\n *  404. */\nexport const WALLET_PROTOCOL_PREFIX = '/api/v1/devstack/' as const;\n\n// ----------------------------------------------------------------------\n// Shared primitives\n// ----------------------------------------------------------------------\n\n/**\n * Sui address — `0x` + 64 hex chars. Schema-validated so a typo or\n * truncated address surfaces as a structured `body-invalid` request\n * error rather than a confusing `address-not-found` (no account bound\n * at the address would be the same shape if we didn't validate).\n */\nexport const SuiAddressSchema = Schema.String.check(Schema.isPattern(/^0x[0-9a-fA-F]{64}$/));\n\n/** Base64-encoded bytes — string-typed at the wire (we keep base64 over\n *  the cross-boundary; the server decodes with `Uint8Array.fromBase64`\n *  or equivalent before handing to the Account sign closures). */\nexport const Base64Schema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]*={0,2}$/));\n\n/** Signature scheme discriminator surfaced on `/accounts`. Mirrors the\n *  `AccountValue.scheme` shape from the account plugin. */\nexport const SignatureSchemeSchema = Schema.Union([\n\tSchema.Literal('ed25519'),\n\tSchema.Literal('secp256k1'),\n\tSchema.Literal('secp256r1'),\n]);\n\n/** Account-source discriminator. `'impersonate'` accounts cannot\n *  satisfy `signTransaction` / `signPersonalMessage` — only\n *  `/execute` (which routes through the fork-admin surface) makes\n *  sense for them. */\nexport const AccountSourceSchema = Schema.Union([\n\tSchema.Literal('real'),\n\tSchema.Literal('impersonate'),\n]);\n\n// ----------------------------------------------------------------------\n// Response envelopes (200)\n// ----------------------------------------------------------------------\n\nexport const HealthResponseSchema = Schema.Struct({\n\tok: Schema.Literal(true),\n});\nexport type HealthResponse = Schema.Schema.Type<typeof HealthResponseSchema>;\n\nexport const AccountSummarySchema = Schema.Struct({\n\tname: Schema.String,\n\taddress: SuiAddressSchema,\n\tscheme: SignatureSchemeSchema,\n\t/** Base64-encoded `publicKey`. Impersonation accounts publish a\n\t *  zero-length string here — consumers branch on `source`, not on\n\t *  publicKey emptiness. */\n\tpublicKey: Base64Schema,\n\tsource: AccountSourceSchema,\n});\nexport type AccountSummary = Schema.Schema.Type<typeof AccountSummarySchema>;\n\nexport const AccountsResponseSchema = Schema.Struct({\n\taccounts: Schema.Array(AccountSummarySchema),\n});\nexport type AccountsResponse = Schema.Schema.Type<typeof AccountsResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Sign endpoints — request + response\n// ----------------------------------------------------------------------\n\n/** Canonical sign request — same shape for transaction and personal-\n *  message routes. `bytes` is the only payload key (no `txBytes`,\n *  `message`, or `messageBytes` aliases). */\nexport const SignRequestSchema = Schema.Struct({\n\taddress: SuiAddressSchema,\n\tbytes: Base64Schema,\n});\nexport type SignRequest = Schema.Schema.Type<typeof SignRequestSchema>;\n\n/** Canonical sign response — same shape for transaction and personal-\n *  message routes. Matches `@mysten/sui`'s `Signer` return shape\n *  byte-for-byte. */\nexport const SignResponseSchema = Schema.Struct({\n\tbytes: Base64Schema,\n\tsignature: Schema.String,\n});\nexport type SignResponse = Schema.Schema.Type<typeof SignResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Execute endpoint — request + response\n// ----------------------------------------------------------------------\n\n/** Execute request — `bytes` is the BCS-serialized transaction.\n *  Impersonation accounts route through fork-admin (no signature\n *  needed); real accounts route through `signAndExecute`. */\nexport const ExecuteRequestSchema = Schema.Struct({\n\taddress: SuiAddressSchema,\n\tbytes: Base64Schema,\n});\nexport type ExecuteRequest = Schema.Schema.Type<typeof ExecuteRequestSchema>;\n\n/** Execute response — the narrow `TxResult` projection the account\n *  plugin already publishes. The `effects` / `objectChanges` /\n *  `balanceChanges` fields cross the wire as opaque JSON; downstream\n *  consumers do their own parsing. */\nexport const ExecuteResponseSchema = Schema.Struct({\n\tdigest: Schema.String,\n\teffects: Schema.Unknown,\n\tobjectChanges: Schema.Array(Schema.Unknown),\n\tbalanceChanges: Schema.Array(Schema.Unknown),\n});\nexport type ExecuteResponse = Schema.Schema.Type<typeof ExecuteResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Error envelope\n// ----------------------------------------------------------------------\n\n/** Error response body. The HTTP status carries the broad classification\n *  (400/401/403/404/500); `code` carries the narrow phase so callers\n *  can branch programmatically. */\nexport const ErrorResponseSchema = Schema.Struct({\n\terror: Schema.String,\n\tcode: Schema.String,\n});\nexport type ErrorResponse = Schema.Schema.Type<typeof ErrorResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Header constants (shared so the dev-wallet adapter doesn't open-code\n// the same strings).\n// ----------------------------------------------------------------------\n\nexport const WALLET_AUTH_HEADER = 'authorization' as const;\nexport const WALLET_BEARER_PREFIX = 'Bearer ' as const;\n\n/** URL-fragment key the pair-URL carries the token under\n *  (`<wallet-url>/#token=<32-hex>`). Fragments are not sent to the\n *  server, so the token never appears in access logs / referrers. */\nexport const WALLET_TOKEN_FRAGMENT_KEY = 'token' as const;\n\n/** Constant carried token byte length (16 random bytes → 32 hex chars).\n *  The on-disk token file is rejected + re-minted if it doesn't match. */\nexport const WALLET_TOKEN_HEX_LENGTH = 32 as const;\n"],"mappings":";;;;;;;;;;;;AAiDA,MAAa,iBAAiB;CAC7B,QAAQ;CACR,UAAU;CACV,kBAAkB;CAClB,uBAAuB;CACvB,SAAS;CACT;;;;AAOD,MAAa,yBAAyB;;;;;;;AAYtC,MAAa,mBAAmB,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC;;;;AAK5F,MAAa,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;;;AAI3F,MAAa,wBAAwB,OAAO,MAAM;CACjD,OAAO,QAAQ,UAAU;CACzB,OAAO,QAAQ,YAAY;CAC3B,OAAO,QAAQ,YAAY;CAC3B,CAAC;;;;;AAMF,MAAa,sBAAsB,OAAO,MAAM,CAC/C,OAAO,QAAQ,OAAO,EACtB,OAAO,QAAQ,cAAc,CAC7B,CAAC;AAMkC,OAAO,OAAO,EACjD,IAAI,OAAO,QAAQ,KAAK,EACxB,CAAC;AAGF,MAAa,uBAAuB,OAAO,OAAO;CACjD,MAAM,OAAO;CACb,SAAS;CACT,QAAQ;;;;CAIR,WAAW;CACX,QAAQ;CACR,CAAC;AAGoC,OAAO,OAAO,EACnD,UAAU,OAAO,MAAM,qBAAqB,EAC5C,CAAC;;;;AAUF,MAAa,oBAAoB,OAAO,OAAO;CAC9C,SAAS;CACT,OAAO;CACP,CAAC;AAMgC,OAAO,OAAO;CAC/C,OAAO;CACP,WAAW,OAAO;CAClB,CAAC;;;;AAUF,MAAa,uBAAuB,OAAO,OAAO;CACjD,SAAS;CACT,OAAO;CACP,CAAC;AAOmC,OAAO,OAAO;CAClD,QAAQ,OAAO;CACf,SAAS,OAAO;CAChB,eAAe,OAAO,MAAM,OAAO,QAAQ;CAC3C,gBAAgB,OAAO,MAAM,OAAO,QAAQ;CAC5C,CAAC;AAUiC,OAAO,OAAO;CAChD,OAAO,OAAO;CACd,MAAM,OAAO;CACb,CAAC;AAQF,MAAa,qBAAqB;AAClC,MAAa,uBAAuB;;;;AAKpC,MAAa,4BAA4B"}

package/dist/plugins/wallet/routable.mjs

@@ -0,0 +1,32 @@
+//#region src/plugins/wallet/routable.ts
+/** Canonical endpoint name. The router orchestrator surfaces this in
+*  the manifest under `endpoints['wallet-app']`; downstream consumers
+*  (codegen, TUI, doctor) read it by this key.
+*
+*  Stable across rewrite + legacy so existing consumers don't break. */
+const WALLET_ENDPOINT_NAME = "wallet-app";
+const WALLET_ENTRYPOINT_PORT = 6173;
+const WALLET_ENTRYPOINTS = [{
+	name: WALLET_ENDPOINT_NAME,
+	port: WALLET_ENTRYPOINT_PORT,
+	protocol: "http"
+}];
+/** Construct the Routable decl for the stack-scoped wallet endpoint. */
+const makeWalletRoutable = (parts) => ({
+	kind: "routable",
+	endpointName: WALLET_ENDPOINT_NAME,
+	dispatchId: {
+		serviceKey: `wallet.${parts.app}.${parts.stack}`,
+		role: "api"
+	},
+	upstream: {
+		type: "host-loopback",
+		port: parts.port
+	},
+	cors: true,
+	wireProtocol: "http"
+});
+//#endregion
+export { WALLET_ENDPOINT_NAME, WALLET_ENTRYPOINTS, WALLET_ENTRYPOINT_PORT, makeWalletRoutable };
+
+//# sourceMappingURL=routable.mjs.map

package/dist/plugins/wallet/routable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/wallet/routable.ts"],"sourcesContent":["// Wallet plugin — Routable contribution.\n//\n// The wallet's HTTP server is a HOST PROCESS (not a docker container)\n// listening on a loopback port the substrate's port broker hands us.\n// The router (Traefik) fronts the loopback port under a stack-scoped\n// hostname like `wallet.<app>.localhost:<router-port>`.\n//\n// This contribution is what tells the router about the upstream. The\n// router orchestrator reads the decl, mints the stack-scoped hostname,\n// and writes the file-provider YAML without ever naming the wallet\n// plugin.\n//\n// The wallet always emits this decl. The router is the standard app\n// and wallet entrypoint, while the loopback URL remains an internal\n// fallback for tests and direct host tooling.\n\nimport type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n// ----------------------------------------------------------------------\n// Endpoint name constant\n// ----------------------------------------------------------------------\n\n/** Canonical endpoint name. The router orchestrator surfaces this in\n *  the manifest under `endpoints['wallet-app']`; downstream consumers\n *  (codegen, TUI, doctor) read it by this key.\n *\n *  Stable across rewrite + legacy so existing consumers don't break. */\nexport const WALLET_ENDPOINT_NAME = 'wallet-app' as const;\nexport const WALLET_ROUTE_ROLE = 'api' as const;\nexport const WALLET_ENTRYPOINT_PORT = 6173;\n\nexport const WALLET_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: WALLET_ENDPOINT_NAME, port: WALLET_ENTRYPOINT_PORT, protocol: 'http' },\n];\n\n// ----------------------------------------------------------------------\n// Decl\n// ----------------------------------------------------------------------\n\n/** Construct the Routable decl for the stack-scoped wallet endpoint. */\nexport const makeWalletRoutable = (parts: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: WALLET_ENDPOINT_NAME,\n\tdispatchId: {\n\t\t// Convention: `<plugin>.<app>.<stack>` keeps dispatch-file\n\t\t// listings readable; the router still hashes the full\n\t\t// `(app, stack, serviceKey, role)` tuple for uniqueness.\n\t\tserviceKey: `wallet.${parts.app}.${parts.stack}`,\n\t\trole: WALLET_ROUTE_ROLE,\n\t},\n\tupstream: { type: 'host-loopback', port: parts.port },\n\tcors: true,\n\twireProtocol: 'http',\n});\n"],"mappings":";;;;;;AA2BA,MAAa,uBAAuB;AAEpC,MAAa,yBAAyB;AAEtC,MAAa,qBAAoD,CAChE;CAAE,MAAM;CAAsB,MAAM;CAAwB,UAAU;CAAQ,CAC9E;;AAOD,MAAa,sBAAsB,WAId;CACpB,MAAM;CACN,cAAc;CACd,YAAY;EAIX,YAAY,UAAU,MAAM,IAAI,GAAG,MAAM;EACzC,MAAA;EACA;CACD,UAAU;EAAE,MAAM;EAAiB,MAAM,MAAM;EAAM;CACrD,MAAM;CACN,cAAc;CACd"}

package/dist/plugins/wallet/server.d.mts

@@ -0,0 +1,12 @@
+import { Effect, Scope } from "effect";
+
+//#region src/plugins/wallet/server.d.ts
+/** Opaque server handle. The substrate's scope finalizer chain
+ *  invokes `.close()`; callers don't dispatch into it directly. */
+interface WalletServerHandle {
+  readonly url: string;
+  readonly close: () => Effect.Effect<void>;
+}
+//#endregion
+export { WalletServerHandle };
+//# sourceMappingURL=server.d.mts.map

package/dist/plugins/wallet/server.mjs

@@ -0,0 +1,317 @@
+import { decodeJsonText } from "../../substrate/runtime/runtime-decode.mjs";
+import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
+import { walletBootError, walletRequestError } from "./errors.mjs";
+import { ExecuteRequestSchema, SignRequestSchema, WALLET_AUTH_HEADER, WalletHttpPath } from "./protocol.mjs";
+import { parseBearerHeader, safeBearerEquals } from "./pairing.mjs";
+import { checkOrigin, corsHeadersFor } from "./origin-policy.mjs";
+import { listenScopedHttpServer } from "../../substrate/runtime/scoped-http-server.mjs";
+import { Effect } from "effect";
+import { randomUUID } from "node:crypto";
+//#region src/plugins/wallet/server.ts
+/** Body cap — 64 KiB. Above the largest reasonable sign-tx payload,
+*  well below any OOM threshold. */
+const MAX_BODY_BYTES = 64 * 1024;
+/** Per-request socket-level timeout, milliseconds. Caps the time a
+*  malicious / hung peer can hold an idle connection. */
+const REQUEST_SOCKET_TIMEOUT_MS = 3e4;
+/**
+* Boot the wallet HTTP server.
+*
+* Wires `node:http.createServer` against the dispatcher. Listens on
+* `bindAddress:port` (the substrate's port broker chose `port` upstream
+* of this call). The scope finalizer awaits graceful close on teardown
+* — `closeAllConnections()` followed by `close()` with await.
+*
+*  Request flow (per connection):
+*
+*    1. `request` listener fires with `IncomingMessage`+`ServerResponse`.
+*    2. We buffer the request body up to `MAX_BODY_BYTES`. If the
+*       inbound payload exceeds the cap, the socket is destroyed and
+*       a 413 returned without ever invoking the dispatcher (closes the
+*       supervisor-OOM path).
+*    3. Construct a `WalletRequest` from the buffered body + headers.
+*    4. `Effect.runForkWith(supervisorContext)(dispatch(config, req))`
+*       — captured at acquire time so handler logs/spans flow to the
+*       TUI logger sink.
+*    5. On fiber completion, write status + headers + body to `res`.
+*    6. On uncaught exception in the listener path: 500 with an opaque
+*       message (no token leak, no internal-state leak).
+*
+*  Scope finalizer:
+*
+*    Calls `server.closeAllConnections()` (kills idle keepalive
+*    sockets) then awaits `server.close()` (drains in-flight). The
+*    finalizer is uninterruptible so a Ctrl-C double-tap doesn't
+*    leave the socket dangling.
+*/
+const startHttpServer = (config) => Effect.gen(function* () {
+	const supervisorContext = yield* Effect.context();
+	const runDispatch = Effect.runForkWith(supervisorContext);
+	const handle = yield* listenScopedHttpServer({
+		bindAddress: config.bindAddress,
+		port: config.port,
+		listener: makeRequestListener(config, runDispatch),
+		onListenError: (cause) => walletBootError({
+			phase: "listen",
+			message: `wallet HTTP server listen failed on ${config.bindAddress}:${config.port} — ` + (cause instanceof Error ? cause.message : String(cause)),
+			hint: "check that the port broker did not hand out a busy port; a sibling devstack on the same address would also explain this.",
+			cause
+		})
+	});
+	yield* Effect.logInfo("wallet HTTP server listening").pipe(Effect.annotateLogs({
+		[SpanAttr.host]: config.bindAddress,
+		[SpanAttr.port]: config.port
+	}));
+	return {
+		url: handle.url,
+		close: handle.close
+	};
+});
+/**
+* Build the `(req, res)` listener Node hands to `http.createServer`.
+*
+* The listener:
+*
+*   - Buffers the request body up to `MAX_BODY_BYTES`. Over-cap →
+*     413 + socket destroyed (the dispatcher's body-cap check is the
+*     second line of defense; this one is the first).
+*   - Drops invalid socket-level errors silently (defensive: the
+*     wallet is loopback-only, but a malformed HTTP/1.1 line shouldn't
+*     crash the supervisor).
+*   - Forks the dispatcher Effect via the captured supervisor runtime.
+*   - Writes the resolved `WalletResponse` back to `res`.
+*
+* Returns void (Node listener signature) — all error reporting flows
+* through the dispatcher (request errors) or `Effect.logError` (boot/
+* listener path errors).
+*/
+const makeRequestListener = (config, runDispatch) => (req, res) => {
+	req.socket.setTimeout(REQUEST_SOCKET_TIMEOUT_MS);
+	const chunks = [];
+	let totalBytes = 0;
+	let overflowed = false;
+	req.on("data", (chunk) => {
+		if (overflowed) return;
+		totalBytes += chunk.length;
+		if (totalBytes > 65536) {
+			overflowed = true;
+			writeOverflow(res);
+			try {
+				req.destroy();
+			} catch {}
+			return;
+		}
+		chunks.push(chunk);
+	});
+	req.on("error", () => {});
+	req.on("end", () => {
+		if (overflowed) return;
+		const body = Buffer.concat(chunks).toString("utf8");
+		runDispatch(dispatch(config, {
+			method: req.method ?? "GET",
+			url: req.url ?? "/",
+			headers: normalizeHeaders(req.headers),
+			body
+		}).pipe(Effect.matchEffect({
+			onFailure: (cause) => Effect.sync(() => {
+				writeServerError(res, cause);
+			}),
+			onSuccess: (resp) => Effect.sync(() => writeResponse(res, resp))
+		})));
+	});
+};
+const writeResponse = (res, resp) => {
+	if (res.writableEnded) return;
+	res.statusCode = resp.status;
+	for (const [k, v] of Object.entries(resp.headers)) res.setHeader(k, v);
+	res.end(resp.body);
+};
+const writeOverflow = (res) => {
+	if (res.writableEnded) return;
+	res.statusCode = 413;
+	res.setHeader("content-type", "text/plain; charset=utf-8");
+	res.end("payload too large");
+};
+const writeServerError = (res, cause) => {
+	if (res.writableEnded) return;
+	res.statusCode = 500;
+	res.setHeader("content-type", "application/json; charset=utf-8");
+	res.end(JSON.stringify({
+		error: "internal error",
+		code: "internal-error"
+	}));
+};
+/** Normalize Node's `IncomingHttpHeaders` (string | string[] | undefined)
+*  to the `WalletRequest.headers` shape (string | undefined). Picks the
+*  first value for repeated headers — matches browser send semantics
+*  for the headers we care about (Origin, Authorization, Content-Type). */
+const normalizeHeaders = (headers) => {
+	const out = {};
+	for (const [k, v] of Object.entries(headers)) if (v === void 0) out[k] = void 0;
+	else if (Array.isArray(v)) out[k] = v[0];
+	else out[k] = v;
+	return out;
+};
+const json = (status, body, extraHeaders = {}) => ({
+	status,
+	headers: {
+		"content-type": "application/json; charset=utf-8",
+		...extraHeaders
+	},
+	body: JSON.stringify(body)
+});
+const text = (status, body, extraHeaders = {}) => ({
+	status,
+	headers: {
+		"content-type": "text/plain; charset=utf-8",
+		...extraHeaders
+	},
+	body
+});
+/**
+* Dispatch a single request to its handler. Returns an Effect that
+* always succeeds (the response is built); request-level failures
+* are projected to JSON envelopes via `errorEnvelope` below.
+*
+* The dispatch order matters:
+*   1. OPTIONS preflight (returns 204 + CORS) — no auth required.
+*   2. Path-prefix gate — anything not under `/api/v1/devstack/` is
+*      a flat 404 (text/plain). PROTECTS the auth gate from being
+*      visible on arbitrary URLs.
+*   3. Origin check (must be in policy.allowed; missing → 403).
+*   4. Bearer check (must constant-time-equal `config.token`).
+*   5. Method+path route to handler.
+*/
+const dispatch = (config, req) => Effect.gen(function* () {
+	const requestId = randomUUID();
+	yield* Effect.annotateCurrentSpan({
+		"wallet.request.id": requestId,
+		"wallet.request.method": req.method,
+		"wallet.request.url": req.url
+	});
+	if (req.method === "OPTIONS") {
+		const origin = req.headers["origin"];
+		if (origin !== void 0 && config.policy.allowed.has(origin)) return {
+			status: 204,
+			headers: corsHeadersFor(origin),
+			body: ""
+		};
+		return text(403, "forbidden origin");
+	}
+	const path = req.url.split("?")[0] ?? "";
+	if (!path.startsWith("/api/v1/devstack/")) return text(404, "not found");
+	const originResult = checkOrigin(config.policy, req.headers["origin"]);
+	if (originResult === "missing") {
+		yield* Effect.logWarning("wallet origin missing").pipe(Effect.annotateLogs({
+			[SpanAttr.requestId]: requestId,
+			[SpanAttr.httpMethod]: req.method,
+			[SpanAttr.httpPath]: path
+		}));
+		return text(403, "Origin header required");
+	}
+	if (originResult === "forbidden") {
+		yield* Effect.logWarning("wallet origin forbidden").pipe(Effect.annotateLogs({
+			[SpanAttr.requestId]: requestId,
+			[SpanAttr.walletOrigin]: req.headers.origin ?? "(missing)",
+			[SpanAttr.httpMethod]: req.method,
+			[SpanAttr.httpPath]: path
+		}));
+		return text(403, "forbidden origin");
+	}
+	const origin = req.headers["origin"];
+	const bearer = parseBearerHeader(req.headers[WALLET_AUTH_HEADER]);
+	const bearerValid = bearer !== null && safeBearerEquals(bearer, config.token);
+	yield* Effect.annotateCurrentSpan({ [SpanAttr.walletBearerValid]: bearerValid });
+	if (!bearerValid) {
+		yield* Effect.logWarning("wallet bearer check failed").pipe(Effect.annotateLogs({
+			[SpanAttr.requestId]: requestId,
+			[SpanAttr.walletBearerValid]: bearerValid,
+			[SpanAttr.httpMethod]: req.method,
+			[SpanAttr.httpPath]: path
+		}));
+		return errorEnvelope(walletRequestError({
+			phase: "unauthorized",
+			httpStatus: 401,
+			message: "unauthorized"
+		}), corsHeadersFor(origin));
+	}
+	const corsHdr = corsHeadersFor(origin);
+	return yield* routeRequest(config, req, path, corsHdr).pipe(Effect.catchTag("WalletRequestError", (err) => Effect.succeed(errorEnvelope(err, corsHdr))));
+});
+const routeRequest = (config, req, path, corsHdr) => {
+	if (req.method === "GET" && path === WalletHttpPath.HEALTH) return Effect.succeed(json(200, { ok: true }, corsHdr));
+	if (req.method === "GET" && path === WalletHttpPath.ACCOUNTS) return handleAccounts(config, corsHdr);
+	if (req.method === "POST" && path === WalletHttpPath.SIGN_TRANSACTION) return handleSign(config, req, "transaction", corsHdr);
+	if (req.method === "POST" && path === WalletHttpPath.SIGN_PERSONAL_MESSAGE) return handleSign(config, req, "personal-message", corsHdr);
+	if (req.method === "POST" && path === WalletHttpPath.EXECUTE) return handleExecute(config, req, corsHdr);
+	return Effect.fail(walletRequestError({
+		phase: "route-not-found",
+		httpStatus: 404,
+		message: `no route for ${req.method} ${path}`
+	}));
+};
+const handleAccounts = (config, corsHdr) => Effect.sync(() => {
+	return json(200, { accounts: Array.from(config.accountsByAddress.values()).map((acct) => ({
+		name: acct.name,
+		address: acct.address,
+		scheme: acct.scheme,
+		publicKey: Buffer.from(acct.publicKey).toString("base64"),
+		source: acct.source
+	})) }, corsHdr);
+});
+const decodeJsonBody = (schema, body) => Effect.gen(function* () {
+	if (body.length > 65536) return yield* Effect.fail(walletRequestError({
+		phase: "body-invalid",
+		httpStatus: 400,
+		message: `body exceeds ${MAX_BODY_BYTES}-byte cap`
+	}));
+	return yield* decodeJsonText(schema, body, {
+		source: "wallet request body",
+		mkError: (issue) => walletRequestError({
+			phase: "body-invalid",
+			httpStatus: 400,
+			message: issue.message === "failed to parse JSON" ? "invalid JSON body" : "request body did not match schema",
+			cause: issue.cause
+		})
+	});
+});
+const handleSign = (config, req, kind, corsHdr) => Effect.gen(function* () {
+	const body = yield* decodeJsonBody(SignRequestSchema, req.body);
+	const account = config.accountsByAddress.get(body.address);
+	if (account === void 0) return yield* Effect.fail(walletRequestError({
+		phase: "address-not-found",
+		httpStatus: 404,
+		message: `no account for address '${body.address}'`
+	}));
+	const bytes = Buffer.from(body.bytes, "base64");
+	return json(200, yield* (kind === "transaction" ? account.signTransaction(bytes) : account.signPersonalMessage(bytes)).pipe(Effect.mapError((cause) => walletRequestError({
+		phase: "sign-route-failed",
+		httpStatus: 500,
+		message: `${kind === "transaction" ? "signTransaction" : "signPersonalMessage"} failed`,
+		cause
+	}))), corsHdr);
+});
+const handleExecute = (config, req, corsHdr) => Effect.gen(function* () {
+	const body = yield* decodeJsonBody(ExecuteRequestSchema, req.body);
+	const account = config.accountsByAddress.get(body.address);
+	if (account === void 0) return yield* Effect.fail(walletRequestError({
+		phase: "address-not-found",
+		httpStatus: 404,
+		message: `no account for address '${body.address}'`
+	}));
+	const bytes = Buffer.from(body.bytes, "base64");
+	return json(200, yield* account.signAndExecute(bytes).pipe(Effect.mapError((cause) => walletRequestError({
+		phase: "sign-route-failed",
+		httpStatus: 500,
+		message: "signAndExecute failed",
+		cause
+	}))), corsHdr);
+});
+const errorEnvelope = (err, corsHdr) => json(err.httpStatus, {
+	error: err.message,
+	code: err.phase
+}, corsHdr);
+//#endregion
+export { MAX_BODY_BYTES, dispatch, startHttpServer };
+
+//# sourceMappingURL=server.mjs.map

package/dist/plugins/wallet/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.mjs","names":[],"sources":["../../../src/plugins/wallet/server.ts"],"sourcesContent":["// Wallet plugin — in-process HTTP server.\n//\n// Responsibilities:\n//\n//   1. Bind a `node:http` server on a substrate-allocated port (the\n//      port broker hands the port in; we don't pick it here).\n//   2. Dispatch by `(METHOD, path)` to the four handlers below\n//      (health, accounts, sign-transaction, sign-personal-message,\n//      execute).\n//   3. Enforce the auth gate: mandatory Origin in policy.allowed +\n//      constant-time bearer compare.\n//   4. Body-cap enforcement: 64 KiB before buffering — protects the\n//      supervisor from OOM via streaming payloads.\n//   5. Per-request span + log annotation under the captured\n//      supervisor context — so handler errors hit the TUI logger\n//      sink instead of bare stderr.\n//   6. Scope-finalizer teardown: `closeAllConnections()` →\n//      `close()` awaited → port release (the substrate's scope\n//      finalizer chain handles release; we just close).\n//\n// Wiring status (15-wallet.md alignment): both the per-route handler\n// bodies (auth + decode + dispatch to `AccountValue` sign closures)\n// AND the in-process `node:http.Server` listen loop are real. The\n// listener buffers each request body up to `MAX_BODY_BYTES`, forks the\n// dispatcher Effect under the captured supervisor context (so handler\n// logs flow to the TUI logger sink), while the substrate scoped HTTP\n// listener owns bind/close lifecycle.\n\nimport { Context, Effect, Schema } from 'effect';\nimport type { Scope } from 'effect';\nimport { randomUUID } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nimport { listenScopedHttpServer } from '../../substrate/runtime/scoped-http-server.ts';\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport { decodeJsonText } from '../../substrate/runtime/runtime-decode.ts';\nimport type { AccountValue } from '../account/service.ts';\nimport {\n\twalletBootError,\n\twalletRequestError,\n\ttype WalletBootError,\n\ttype WalletRequestError,\n} from './errors.ts';\nimport { checkOrigin, corsHeadersFor, type OriginPolicy } from './origin-policy.ts';\nimport { parseBearerHeader, safeBearerEquals, type PairingToken } from './pairing.ts';\nimport {\n\tAccountsResponseSchema,\n\tExecuteRequestSchema,\n\tHealthResponseSchema,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tWALLET_AUTH_HEADER,\n\tWALLET_PROTOCOL_PREFIX,\n\tWalletHttpPath,\n\ttype AccountSummary,\n} from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// Server config + handle\n// ----------------------------------------------------------------------\n\n/** Inputs the substrate hands to `startHttpServer`. The plugin's\n *  acquire body builds this from its resolved inputs (port broker,\n *  origin policy, accounts map, token). */\nexport interface WalletServerConfig {\n\treadonly bindAddress: string;\n\treadonly port: number;\n\treadonly token: PairingToken;\n\treadonly policy: OriginPolicy;\n\treadonly accountsByAddress: ReadonlyMap<string, AccountValue>;\n\t/** Captured supervisor context — handler errors log under this so\n\t *  the TUI logger sink receives them. Stub: the substrate primitive\n\t *  will hand this in; today the field is opaque. */\n\treadonly supervisorCtx: unknown;\n}\n\n/** Opaque server handle. The substrate's scope finalizer chain\n *  invokes `.close()`; callers don't dispatch into it directly. */\nexport interface WalletServerHandle {\n\treadonly url: string; // direct loopback URL — `http://<bindAddress>:<port>`\n\treadonly close: () => Effect.Effect<void>;\n}\n\n/** Body cap — 64 KiB. Above the largest reasonable sign-tx payload,\n *  well below any OOM threshold. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\n// ----------------------------------------------------------------------\n// Top-level boot\n// ----------------------------------------------------------------------\n\n/** Per-request socket-level timeout, milliseconds. Caps the time a\n *  malicious / hung peer can hold an idle connection. */\nconst REQUEST_SOCKET_TIMEOUT_MS = 30_000;\n\n/**\n * Boot the wallet HTTP server.\n *\n * Wires `node:http.createServer` against the dispatcher. Listens on\n * `bindAddress:port` (the substrate's port broker chose `port` upstream\n * of this call). The scope finalizer awaits graceful close on teardown\n * — `closeAllConnections()` followed by `close()` with await.\n *\n *  Request flow (per connection):\n *\n *    1. `request` listener fires with `IncomingMessage`+`ServerResponse`.\n *    2. We buffer the request body up to `MAX_BODY_BYTES`. If the\n *       inbound payload exceeds the cap, the socket is destroyed and\n *       a 413 returned without ever invoking the dispatcher (closes the\n *       supervisor-OOM path).\n *    3. Construct a `WalletRequest` from the buffered body + headers.\n *    4. `Effect.runForkWith(supervisorContext)(dispatch(config, req))`\n *       — captured at acquire time so handler logs/spans flow to the\n *       TUI logger sink.\n *    5. On fiber completion, write status + headers + body to `res`.\n *    6. On uncaught exception in the listener path: 500 with an opaque\n *       message (no token leak, no internal-state leak).\n *\n *  Scope finalizer:\n *\n *    Calls `server.closeAllConnections()` (kills idle keepalive\n *    sockets) then awaits `server.close()` (drains in-flight). The\n *    finalizer is uninterruptible so a Ctrl-C double-tap doesn't\n *    leave the socket dangling.\n */\nexport const startHttpServer = (\n\tconfig: WalletServerConfig,\n): Effect.Effect<WalletServerHandle, WalletBootError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// Capture the supervisor context so handler fibers run with the\n\t\t// same Logger / span sinks as the rest of the stack. The\n\t\t// dispatcher's R-channel is `never`, but capturing the context\n\t\t// keeps fiber-refs (logger, spans) flowing.\n\t\tconst supervisorContext = yield* Effect.context<never>();\n\t\tconst runDispatch = Effect.runForkWith(supervisorContext as Context.Context<never>);\n\n\t\tconst handle = yield* listenScopedHttpServer({\n\t\t\tbindAddress: config.bindAddress,\n\t\t\tport: config.port,\n\t\t\tlistener: makeRequestListener(config, runDispatch),\n\t\t\tonListenError: (cause): WalletBootError =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'listen',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`wallet HTTP server listen failed on ${config.bindAddress}:${config.port} — ` +\n\t\t\t\t\t\t(cause instanceof Error ? cause.message : String(cause)),\n\t\t\t\t\thint:\n\t\t\t\t\t\t'check that the port broker did not hand out a busy port; ' +\n\t\t\t\t\t\t'a sibling devstack on the same address would also explain this.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\tyield* Effect.logInfo('wallet HTTP server listening').pipe(\n\t\t\tEffect.annotateLogs({\n\t\t\t\t[SpanAttr.host]: config.bindAddress,\n\t\t\t\t[SpanAttr.port]: config.port,\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\turl: handle.url,\n\t\t\tclose: handle.close,\n\t\t} satisfies WalletServerHandle;\n\t});\n\n// ----------------------------------------------------------------------\n// Node request listener — bridges `node:http` → dispatcher Effect\n// ----------------------------------------------------------------------\n\n/**\n * Build the `(req, res)` listener Node hands to `http.createServer`.\n *\n * The listener:\n *\n *   - Buffers the request body up to `MAX_BODY_BYTES`. Over-cap →\n *     413 + socket destroyed (the dispatcher's body-cap check is the\n *     second line of defense; this one is the first).\n *   - Drops invalid socket-level errors silently (defensive: the\n *     wallet is loopback-only, but a malformed HTTP/1.1 line shouldn't\n *     crash the supervisor).\n *   - Forks the dispatcher Effect via the captured supervisor runtime.\n *   - Writes the resolved `WalletResponse` back to `res`.\n *\n * Returns void (Node listener signature) — all error reporting flows\n * through the dispatcher (request errors) or `Effect.logError` (boot/\n * listener path errors).\n */\nconst makeRequestListener =\n\t(\n\t\tconfig: WalletServerConfig,\n\t\trunDispatch: <A, E>(effect: Effect.Effect<A, E, never>) => unknown,\n\t): ((req: IncomingMessage, res: ServerResponse) => void) =>\n\t(req, res) => {\n\t\t// Socket-level timeout — protects against hung peers parking\n\t\t// requests on the supervisor's loopback.\n\t\treq.socket.setTimeout(REQUEST_SOCKET_TIMEOUT_MS);\n\n\t\tconst chunks: Buffer[] = [];\n\t\tlet totalBytes = 0;\n\t\tlet overflowed = false;\n\n\t\treq.on('data', (chunk: Buffer) => {\n\t\t\tif (overflowed) return;\n\t\t\ttotalBytes += chunk.length;\n\t\t\tif (totalBytes > MAX_BODY_BYTES) {\n\t\t\t\toverflowed = true;\n\t\t\t\twriteOverflow(res);\n\t\t\t\ttry {\n\t\t\t\t\treq.destroy();\n\t\t\t\t} catch {\n\t\t\t\t\t/* defensive */\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tchunks.push(chunk);\n\t\t});\n\n\t\treq.on('error', () => {\n\t\t\t// Socket-level error — drop. Per-request errors are handled\n\t\t\t// inside the dispatcher.\n\t\t});\n\n\t\treq.on('end', () => {\n\t\t\tif (overflowed) return;\n\t\t\tconst body = Buffer.concat(chunks).toString('utf8');\n\t\t\tconst walletReq: WalletRequest = {\n\t\t\t\tmethod: req.method ?? 'GET',\n\t\t\t\turl: req.url ?? '/',\n\t\t\t\theaders: normalizeHeaders(req.headers),\n\t\t\t\tbody,\n\t\t\t};\n\t\t\tconst program = dispatch(config, walletReq).pipe(\n\t\t\t\tEffect.matchEffect({\n\t\t\t\t\tonFailure: (cause) =>\n\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t// `dispatch` is typed `Effect<WalletResponse>` (no\n\t\t\t\t\t\t\t// failure channel); a thrown defect lands here as a\n\t\t\t\t\t\t\t// `Cause`. Log + write a 500.\n\t\t\t\t\t\t\twriteServerError(res, cause);\n\t\t\t\t\t\t}),\n\t\t\t\t\tonSuccess: (resp) => Effect.sync(() => writeResponse(res, resp)),\n\t\t\t\t}),\n\t\t\t);\n\t\t\trunDispatch(program);\n\t\t});\n\t};\n\nconst writeResponse = (res: ServerResponse, resp: WalletResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = resp.status;\n\tfor (const [k, v] of Object.entries(resp.headers)) {\n\t\tres.setHeader(k, v);\n\t}\n\tres.end(resp.body);\n};\n\nconst writeOverflow = (res: ServerResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = 413;\n\tres.setHeader('content-type', 'text/plain; charset=utf-8');\n\tres.end('payload too large');\n};\n\nconst writeServerError = (res: ServerResponse, cause: unknown): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = 500;\n\tres.setHeader('content-type', 'application/json; charset=utf-8');\n\t// Opaque error body — no token, no internal state leak.\n\tres.end(\n\t\tJSON.stringify({\n\t\t\terror: 'internal error',\n\t\t\tcode: 'internal-error',\n\t\t}),\n\t);\n\tvoid cause; // surfaces via Effect.logError on the dispatcher path\n};\n\n/** Normalize Node's `IncomingHttpHeaders` (string | string[] | undefined)\n *  to the `WalletRequest.headers` shape (string | undefined). Picks the\n *  first value for repeated headers — matches browser send semantics\n *  for the headers we care about (Origin, Authorization, Content-Type). */\nconst normalizeHeaders = (\n\theaders: IncomingMessage['headers'],\n): Readonly<Record<string, string | undefined>> => {\n\tconst out: Record<string, string | undefined> = {};\n\tfor (const [k, v] of Object.entries(headers)) {\n\t\tif (v === undefined) {\n\t\t\tout[k] = undefined;\n\t\t} else if (Array.isArray(v)) {\n\t\t\tout[k] = v[0];\n\t\t} else {\n\t\t\tout[k] = v;\n\t\t}\n\t}\n\treturn out;\n};\n\n// ----------------------------------------------------------------------\n// Dispatcher — pure(ish) function from request → effect\n// ----------------------------------------------------------------------\n\n/** Inbound request shape — substrate-runtime-agnostic. The substrate's\n *  http-server primitive converts a `node:http` IncomingMessage into\n *  this; tests can construct it directly. */\nexport interface WalletRequest {\n\treadonly method: string;\n\treadonly url: string; // path + query, no host\n\treadonly headers: Readonly<Record<string, string | undefined>>;\n\treadonly body: string; // already-buffered (capped at MAX_BODY_BYTES)\n}\n\n/** Outbound response. */\nexport interface WalletResponse {\n\treadonly status: number;\n\treadonly headers: Readonly<Record<string, string>>;\n\treadonly body: string;\n}\n\nconst json = (\n\tstatus: number,\n\tbody: unknown,\n\textraHeaders: Readonly<Record<string, string>> = {},\n): WalletResponse => ({\n\tstatus,\n\theaders: { 'content-type': 'application/json; charset=utf-8', ...extraHeaders },\n\tbody: JSON.stringify(body),\n});\n\nconst text = (\n\tstatus: number,\n\tbody: string,\n\textraHeaders: Readonly<Record<string, string>> = {},\n): WalletResponse => ({\n\tstatus,\n\theaders: { 'content-type': 'text/plain; charset=utf-8', ...extraHeaders },\n\tbody,\n});\n\n/**\n * Dispatch a single request to its handler. Returns an Effect that\n * always succeeds (the response is built); request-level failures\n * are projected to JSON envelopes via `errorEnvelope` below.\n *\n * The dispatch order matters:\n *   1. OPTIONS preflight (returns 204 + CORS) — no auth required.\n *   2. Path-prefix gate — anything not under `/api/v1/devstack/` is\n *      a flat 404 (text/plain). PROTECTS the auth gate from being\n *      visible on arbitrary URLs.\n *   3. Origin check (must be in policy.allowed; missing → 403).\n *   4. Bearer check (must constant-time-equal `config.token`).\n *   5. Method+path route to handler.\n */\nexport const dispatch = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n): Effect.Effect<WalletResponse> =>\n\tEffect.gen(function* () {\n\t\tconst requestId = randomUUID();\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'wallet.request.id': requestId,\n\t\t\t'wallet.request.method': req.method,\n\t\t\t'wallet.request.url': req.url,\n\t\t});\n\n\t\t// 1. OPTIONS preflight — no auth check, but the origin still has\n\t\t//    to be in the allowlist so we don't leak CORS headers to\n\t\t//    arbitrary callers.\n\t\tif (req.method === 'OPTIONS') {\n\t\t\tconst origin = req.headers['origin'];\n\t\t\tif (origin !== undefined && config.policy.allowed.has(origin)) {\n\t\t\t\treturn { status: 204, headers: corsHeadersFor(origin), body: '' };\n\t\t\t}\n\t\t\treturn text(403, 'forbidden origin');\n\t\t}\n\n\t\t// 2. Path-prefix gate.\n\t\tconst path = req.url.split('?')[0] ?? '';\n\t\tif (!path.startsWith(WALLET_PROTOCOL_PREFIX)) {\n\t\t\treturn text(404, 'not found');\n\t\t}\n\n\t\t// 3. Origin check.\n\t\tconst originResult = checkOrigin(config.policy, req.headers['origin']);\n\t\tif (originResult === 'missing') {\n\t\t\t// Log the BEARER-VALIDITY only, never the token itself.\n\t\t\tyield* Effect.logWarning('wallet origin missing').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.requestId]: requestId,\n\t\t\t\t\t[SpanAttr.httpMethod]: req.method,\n\t\t\t\t\t[SpanAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn text(403, 'Origin header required');\n\t\t}\n\t\tif (originResult === 'forbidden') {\n\t\t\tyield* Effect.logWarning('wallet origin forbidden').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.requestId]: requestId,\n\t\t\t\t\t[SpanAttr.walletOrigin]: req.headers.origin ?? '(missing)',\n\t\t\t\t\t[SpanAttr.httpMethod]: req.method,\n\t\t\t\t\t[SpanAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn text(403, 'forbidden origin');\n\t\t}\n\t\tconst origin = req.headers['origin']!;\n\n\t\t// 4. Bearer check. Token never appears in log lines — only the\n\t\t//    boolean validity.\n\t\tconst bearer = parseBearerHeader(req.headers[WALLET_AUTH_HEADER]);\n\t\tconst bearerValid = bearer !== null && safeBearerEquals(bearer, config.token);\n\t\tyield* Effect.annotateCurrentSpan({ [SpanAttr.walletBearerValid]: bearerValid });\n\t\tif (!bearerValid) {\n\t\t\tyield* Effect.logWarning('wallet bearer check failed').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.requestId]: requestId,\n\t\t\t\t\t[SpanAttr.walletBearerValid]: bearerValid,\n\t\t\t\t\t[SpanAttr.httpMethod]: req.method,\n\t\t\t\t\t[SpanAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn errorEnvelope(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'unauthorized',\n\t\t\t\t\thttpStatus: 401,\n\t\t\t\t\tmessage: 'unauthorized',\n\t\t\t\t}),\n\t\t\t\tcorsHeadersFor(origin),\n\t\t\t);\n\t\t}\n\n\t\t// 5. Route.\n\t\tconst corsHdr = corsHeadersFor(origin);\n\t\treturn yield* routeRequest(config, req, path, corsHdr).pipe(\n\t\t\tEffect.catchTag('WalletRequestError', (err) => Effect.succeed(errorEnvelope(err, corsHdr))),\n\t\t);\n\t});\n\n// ----------------------------------------------------------------------\n// Routing\n// ----------------------------------------------------------------------\n\nconst routeRequest = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tpath: string,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> => {\n\tif (req.method === 'GET' && path === WalletHttpPath.HEALTH) {\n\t\treturn Effect.succeed(\n\t\t\tjson(200, { ok: true } satisfies Schema.Schema.Type<typeof HealthResponseSchema>, corsHdr),\n\t\t);\n\t}\n\tif (req.method === 'GET' && path === WalletHttpPath.ACCOUNTS) {\n\t\treturn handleAccounts(config, corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.SIGN_TRANSACTION) {\n\t\treturn handleSign(config, req, 'transaction', corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.SIGN_PERSONAL_MESSAGE) {\n\t\treturn handleSign(config, req, 'personal-message', corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.EXECUTE) {\n\t\treturn handleExecute(config, req, corsHdr);\n\t}\n\treturn Effect.fail(\n\t\twalletRequestError({\n\t\t\tphase: 'route-not-found',\n\t\t\thttpStatus: 404,\n\t\t\tmessage: `no route for ${req.method} ${path}`,\n\t\t}),\n\t);\n};\n\n// ----------------------------------------------------------------------\n// Handlers\n// ----------------------------------------------------------------------\n\nconst handleAccounts = (\n\tconfig: WalletServerConfig,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.sync(() => {\n\t\tconst accounts: ReadonlyArray<AccountSummary> = Array.from(\n\t\t\tconfig.accountsByAddress.values(),\n\t\t).map((acct) => ({\n\t\t\tname: acct.name,\n\t\t\taddress: acct.address,\n\t\t\tscheme: acct.scheme,\n\t\t\tpublicKey: Buffer.from(acct.publicKey).toString('base64'),\n\t\t\tsource: acct.source,\n\t\t}));\n\t\t// Schema-validate the response so a drift between AccountValue\n\t\t// and the wire envelope blows up at the boundary rather than at\n\t\t// the browser-side decode.\n\t\tconst validated: Schema.Schema.Type<typeof AccountsResponseSchema> = { accounts };\n\t\treturn json(200, validated, corsHdr);\n\t});\n\nconst decodeJsonBody = <A>(\n\tschema: Schema.Schema<A>,\n\tbody: string,\n): Effect.Effect<A, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\tif (body.length > MAX_BODY_BYTES) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'body-invalid',\n\t\t\t\t\thttpStatus: 400,\n\t\t\t\t\tmessage: `body exceeds ${MAX_BODY_BYTES}-byte cap`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn yield* decodeJsonText(schema as Schema.Decoder<unknown>, body, {\n\t\t\tsource: 'wallet request body',\n\t\t\tmkError: (issue) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'body-invalid',\n\t\t\t\t\thttpStatus: 400,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tissue.message === 'failed to parse JSON'\n\t\t\t\t\t\t\t? 'invalid JSON body'\n\t\t\t\t\t\t\t: 'request body did not match schema',\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t}) as Effect.Effect<A, WalletRequestError>;\n\t});\n\nconst handleSign = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tkind: 'transaction' | 'personal-message',\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\tconst body = yield* decodeJsonBody(SignRequestSchema, req.body);\n\t\tconst account = config.accountsByAddress.get(body.address);\n\t\tif (account === undefined) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'address-not-found',\n\t\t\t\t\thttpStatus: 404,\n\t\t\t\t\tmessage: `no account for address '${body.address}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bytes = Buffer.from(body.bytes, 'base64');\n\t\tconst signed = yield* (\n\t\t\tkind === 'transaction' ? account.signTransaction(bytes) : account.signPersonalMessage(bytes)\n\t\t).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'sign-route-failed',\n\t\t\t\t\thttpStatus: 500,\n\t\t\t\t\tmessage: `${kind === 'transaction' ? 'signTransaction' : 'signPersonalMessage'} failed`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tconst resp: Schema.Schema.Type<typeof SignResponseSchema> = signed;\n\t\treturn json(200, resp, corsHdr);\n\t});\n\nconst handleExecute = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\tconst body = yield* decodeJsonBody(ExecuteRequestSchema, req.body);\n\t\tconst account = config.accountsByAddress.get(body.address);\n\t\tif (account === undefined) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'address-not-found',\n\t\t\t\t\thttpStatus: 404,\n\t\t\t\t\tmessage: `no account for address '${body.address}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bytes = Buffer.from(body.bytes, 'base64');\n\t\tconst result = yield* account.signAndExecute(bytes).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'sign-route-failed',\n\t\t\t\t\thttpStatus: 500,\n\t\t\t\t\tmessage: 'signAndExecute failed',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\treturn json(200, result, corsHdr);\n\t});\n\n// ----------------------------------------------------------------------\n// Error envelope\n// ----------------------------------------------------------------------\n\nconst errorEnvelope = (\n\terr: WalletRequestError,\n\tcorsHdr: Readonly<Record<string, string>>,\n): WalletResponse => json(err.httpStatus, { error: err.message, code: err.phase }, corsHdr);\n"],"mappings":";;;;;;;;;;;;AAqFA,MAAa,iBAAiB,KAAK;;;AAQnC,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgClC,MAAa,mBACZ,WAEA,OAAO,IAAI,aAAa;CAKvB,MAAM,oBAAoB,OAAO,OAAO,SAAgB;CACxD,MAAM,cAAc,OAAO,YAAY,kBAA4C;CAEnF,MAAM,SAAS,OAAO,uBAAuB;EAC5C,aAAa,OAAO;EACpB,MAAM,OAAO;EACb,UAAU,oBAAoB,QAAQ,YAAY;EAClD,gBAAgB,UACf,gBAAgB;GACf,OAAO;GACP,SACC,uCAAuC,OAAO,YAAY,GAAG,OAAO,KAAK,QACxE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GACxD,MACC;GAED;GACA,CAAC;EACH,CAAC;AAEF,QAAO,OAAO,QAAQ,+BAA+B,CAAC,KACrD,OAAO,aAAa;GAClB,SAAS,OAAO,OAAO;GACvB,SAAS,OAAO,OAAO;EACxB,CAAC,CACF;AAED,QAAO;EACN,KAAK,OAAO;EACZ,OAAO,OAAO;EACd;EACA;;;;;;;;;;;;;;;;;;;AAwBH,MAAM,uBAEJ,QACA,iBAEA,KAAK,QAAQ;AAGb,KAAI,OAAO,WAAW,0BAA0B;CAEhD,MAAM,SAAmB,EAAE;CAC3B,IAAI,aAAa;CACjB,IAAI,aAAa;AAEjB,KAAI,GAAG,SAAS,UAAkB;AACjC,MAAI,WAAY;AAChB,gBAAc,MAAM;AACpB,MAAI,aAAA,OAA6B;AAChC,gBAAa;AACb,iBAAc,IAAI;AAClB,OAAI;AACH,QAAI,SAAS;WACN;AAGR;;AAED,SAAO,KAAK,MAAM;GACjB;AAEF,KAAI,GAAG,eAAe,GAGpB;AAEF,KAAI,GAAG,aAAa;AACnB,MAAI,WAAY;EAChB,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO;AAmBnD,cAZgB,SAAS,QAAQ;GALhC,QAAQ,IAAI,UAAU;GACtB,KAAK,IAAI,OAAO;GAChB,SAAS,iBAAiB,IAAI,QAAQ;GACtC;GAEyC,CAAC,CAAC,KAC3C,OAAO,YAAY;GAClB,YAAY,UACX,OAAO,WAAW;AAIjB,qBAAiB,KAAK,MAAM;KAC3B;GACH,YAAY,SAAS,OAAO,WAAW,cAAc,KAAK,KAAK,CAAC;GAChE,CAAC,CAEgB,CAAC;GACnB;;AAGJ,MAAM,iBAAiB,KAAqB,SAA+B;AAC1E,KAAI,IAAI,cAAe;AACvB,KAAI,aAAa,KAAK;AACtB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,QAAQ,CAChD,KAAI,UAAU,GAAG,EAAE;AAEpB,KAAI,IAAI,KAAK,KAAK;;AAGnB,MAAM,iBAAiB,QAA8B;AACpD,KAAI,IAAI,cAAe;AACvB,KAAI,aAAa;AACjB,KAAI,UAAU,gBAAgB,4BAA4B;AAC1D,KAAI,IAAI,oBAAoB;;AAG7B,MAAM,oBAAoB,KAAqB,UAAyB;AACvE,KAAI,IAAI,cAAe;AACvB,KAAI,aAAa;AACjB,KAAI,UAAU,gBAAgB,kCAAkC;AAEhE,KAAI,IACH,KAAK,UAAU;EACd,OAAO;EACP,MAAM;EACN,CAAC,CACF;;;;;;AAQF,MAAM,oBACL,YACkD;CAClD,MAAM,MAA0C,EAAE;AAClD,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,CAC3C,KAAI,MAAM,KAAA,EACT,KAAI,KAAK,KAAA;UACC,MAAM,QAAQ,EAAE,CAC1B,KAAI,KAAK,EAAE;KAEX,KAAI,KAAK;AAGX,QAAO;;AAwBR,MAAM,QACL,QACA,MACA,eAAiD,EAAE,MAC9B;CACrB;CACA,SAAS;EAAE,gBAAgB;EAAmC,GAAG;EAAc;CAC/E,MAAM,KAAK,UAAU,KAAK;CAC1B;AAED,MAAM,QACL,QACA,MACA,eAAiD,EAAE,MAC9B;CACrB;CACA,SAAS;EAAE,gBAAgB;EAA6B,GAAG;EAAc;CACzE;CACA;;;;;;;;;;;;;;;AAgBD,MAAa,YACZ,QACA,QAEA,OAAO,IAAI,aAAa;CACvB,MAAM,YAAY,YAAY;AAC9B,QAAO,OAAO,oBAAoB;EACjC,qBAAqB;EACrB,yBAAyB,IAAI;EAC7B,sBAAsB,IAAI;EAC1B,CAAC;AAKF,KAAI,IAAI,WAAW,WAAW;EAC7B,MAAM,SAAS,IAAI,QAAQ;AAC3B,MAAI,WAAW,KAAA,KAAa,OAAO,OAAO,QAAQ,IAAI,OAAO,CAC5D,QAAO;GAAE,QAAQ;GAAK,SAAS,eAAe,OAAO;GAAE,MAAM;GAAI;AAElE,SAAO,KAAK,KAAK,mBAAmB;;CAIrC,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM;AACtC,KAAI,CAAC,KAAK,WAAA,oBAAkC,CAC3C,QAAO,KAAK,KAAK,YAAY;CAI9B,MAAM,eAAe,YAAY,OAAO,QAAQ,IAAI,QAAQ,UAAU;AACtE,KAAI,iBAAiB,WAAW;AAE/B,SAAO,OAAO,WAAW,wBAAwB,CAAC,KACjD,OAAO,aAAa;IAClB,SAAS,YAAY;IACrB,SAAS,aAAa,IAAI;IAC1B,SAAS,WAAW;GACrB,CAAC,CACF;AACD,SAAO,KAAK,KAAK,yBAAyB;;AAE3C,KAAI,iBAAiB,aAAa;AACjC,SAAO,OAAO,WAAW,0BAA0B,CAAC,KACnD,OAAO,aAAa;IAClB,SAAS,YAAY;IACrB,SAAS,eAAe,IAAI,QAAQ,UAAU;IAC9C,SAAS,aAAa,IAAI;IAC1B,SAAS,WAAW;GACrB,CAAC,CACF;AACD,SAAO,KAAK,KAAK,mBAAmB;;CAErC,MAAM,SAAS,IAAI,QAAQ;CAI3B,MAAM,SAAS,kBAAkB,IAAI,QAAQ,oBAAoB;CACjE,MAAM,cAAc,WAAW,QAAQ,iBAAiB,QAAQ,OAAO,MAAM;AAC7E,QAAO,OAAO,oBAAoB,GAAG,SAAS,oBAAoB,aAAa,CAAC;AAChF,KAAI,CAAC,aAAa;AACjB,SAAO,OAAO,WAAW,6BAA6B,CAAC,KACtD,OAAO,aAAa;IAClB,SAAS,YAAY;IACrB,SAAS,oBAAoB;IAC7B,SAAS,aAAa,IAAI;IAC1B,SAAS,WAAW;GACrB,CAAC,CACF;AACD,SAAO,cACN,mBAAmB;GAClB,OAAO;GACP,YAAY;GACZ,SAAS;GACT,CAAC,EACF,eAAe,OAAO,CACtB;;CAIF,MAAM,UAAU,eAAe,OAAO;AACtC,QAAO,OAAO,aAAa,QAAQ,KAAK,MAAM,QAAQ,CAAC,KACtD,OAAO,SAAS,uBAAuB,QAAQ,OAAO,QAAQ,cAAc,KAAK,QAAQ,CAAC,CAAC,CAC3F;EACA;AAMH,MAAM,gBACL,QACA,KACA,MACA,YACuD;AACvD,KAAI,IAAI,WAAW,SAAS,SAAS,eAAe,OACnD,QAAO,OAAO,QACb,KAAK,KAAK,EAAE,IAAI,MAAM,EAA4D,QAAQ,CAC1F;AAEF,KAAI,IAAI,WAAW,SAAS,SAAS,eAAe,SACnD,QAAO,eAAe,QAAQ,QAAQ;AAEvC,KAAI,IAAI,WAAW,UAAU,SAAS,eAAe,iBACpD,QAAO,WAAW,QAAQ,KAAK,eAAe,QAAQ;AAEvD,KAAI,IAAI,WAAW,UAAU,SAAS,eAAe,sBACpD,QAAO,WAAW,QAAQ,KAAK,oBAAoB,QAAQ;AAE5D,KAAI,IAAI,WAAW,UAAU,SAAS,eAAe,QACpD,QAAO,cAAc,QAAQ,KAAK,QAAQ;AAE3C,QAAO,OAAO,KACb,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,gBAAgB,IAAI,OAAO,GAAG;EACvC,CAAC,CACF;;AAOF,MAAM,kBACL,QACA,YAEA,OAAO,WAAW;AAcjB,QAAO,KAAK,KAAK,EADsD,UAZvB,MAAM,KACrD,OAAO,kBAAkB,QAAQ,CACjC,CAAC,KAAK,UAAU;EAChB,MAAM,KAAK;EACX,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,WAAW,OAAO,KAAK,KAAK,UAAU,CAAC,SAAS,SAAS;EACzD,QAAQ,KAAK;EACb,EAI8E,EACrD,EAAE,QAAQ;EACnC;AAEH,MAAM,kBACL,QACA,SAEA,OAAO,IAAI,aAAa;AACvB,KAAI,KAAK,SAAA,MACR,QAAO,OAAO,OAAO,KACpB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,gBAAgB,eAAe;EACxC,CAAC,CACF;AAEF,QAAO,OAAO,eAAe,QAAmC,MAAM;EACrE,QAAQ;EACR,UAAU,UACT,mBAAmB;GAClB,OAAO;GACP,YAAY;GACZ,SACC,MAAM,YAAY,yBACf,sBACA;GACJ,OAAO,MAAM;GACb,CAAC;EACH,CAAC;EACD;AAEH,MAAM,cACL,QACA,KACA,MACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO,eAAe,mBAAmB,IAAI,KAAK;CAC/D,MAAM,UAAU,OAAO,kBAAkB,IAAI,KAAK,QAAQ;AAC1D,KAAI,YAAY,KAAA,EACf,QAAO,OAAO,OAAO,KACpB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,2BAA2B,KAAK,QAAQ;EACjD,CAAC,CACF;CAEF,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,SAAS;AAc/C,QAAO,KAAK,KAAK,QAZhB,SAAS,gBAAgB,QAAQ,gBAAgB,MAAM,GAAG,QAAQ,oBAAoB,MAAM,EAC3F,KACD,OAAO,UAAU,UAChB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,GAAG,SAAS,gBAAgB,oBAAoB,sBAAsB;EAC/E;EACA,CAAC,CACF,CACD,EAEsB,QAAQ;EAC9B;AAEH,MAAM,iBACL,QACA,KACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO,eAAe,sBAAsB,IAAI,KAAK;CAClE,MAAM,UAAU,OAAO,kBAAkB,IAAI,KAAK,QAAQ;AAC1D,KAAI,YAAY,KAAA,EACf,QAAO,OAAO,OAAO,KACpB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,2BAA2B,KAAK,QAAQ;EACjD,CAAC,CACF;CAEF,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,SAAS;AAW/C,QAAO,KAAK,KAAK,OAVK,QAAQ,eAAe,MAAM,CAAC,KACnD,OAAO,UAAU,UAChB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS;EACT;EACA,CAAC,CACF,CACD,EACwB,QAAQ;EAChC;AAMH,MAAM,iBACL,KACA,YACoB,KAAK,IAAI,YAAY;CAAE,OAAO,IAAI;CAAS,MAAM,IAAI;CAAO,EAAE,QAAQ"}

package/dist/plugins/wallet/service.d.mts

@@ -0,0 +1,68 @@
+import { ResourceRef } from "../../substrate/plugin.mjs";
+import { AccountValue } from "../account/service.mjs";
+import { AccountResourceId } from "../account/index.mjs";
+import { DappKitConfigBindings } from "./codegen.mjs";
+import { PairingToken } from "./pairing.mjs";
+import { WalletServerHandle } from "./server.mjs";
+import { Effect, FileSystem, Scope } from "effect";
+
+//#region src/plugins/wallet/service.d.ts
+/** Literal sentinel for `WalletOptions.accounts: 'all'` — every account
+ *  member in the stack. Expanded by the composer at `defineDevstack`
+ *  call time (api-surface-design §4 D6). Kept as an exported constant
+ *  so the wallet factory + composer share one source of truth. */
+declare const WALLET_ACCOUNTS_ALL: "all";
+/** A user-supplied account ref. The user passes the result of
+ *  `account('alice')` — NOT a bare string. Generic over the literal
+ *  account name so the wallet's dependency tuple preserves each
+ *  per-account resource id (`account/alice`, `account/bob`, ...). */
+type WalletAccountMember<Name extends string = string> = ResourceRef<AccountResourceId<Name>, AccountValue>;
+interface WalletOptions<Accounts extends ReadonlyArray<WalletAccountMember> = ReadonlyArray<WalletAccountMember>> {
+  /** Accounts the wallet binds. Each is yielded for ordering AND its
+   *  resolved value is keyed by address into the sign-handler map.
+   *
+   *  Two shapes:
+   *
+   *   - Explicit tuple — each entry is the plugin/resource ref returned
+   *     by `account('name')`. Pins the bound set at the wallet's call
+   *     site; preserves each literal `account/${Name}` so stack
+   *     composition can validate and recursively expand the refs.
+   *
+   *   - The literal `'all'` — shorthand for "every account member in
+   *     the stack". The composer expands this against the final
+   *     member tuple at `defineDevstack(...)` time (api-surface-design
+   *     §4 D6). The wallet member returned by the factory carries an
+   *     expander hook keyed off `WALLET_ACCOUNTS_ALL` that the
+   *     composer invokes once the account-providing members are
+   *     known. */
+  readonly accounts: Accounts | typeof WALLET_ACCOUNTS_ALL;
+  /** Extra origins merged on top of the stack-scoped auto-derived
+   *  origin. Useful for headless test runners and custom dev hosts. */
+  readonly allowedOrigins?: ReadonlyArray<string>;
+  /** Preferred host port. Substrate's port broker forward-scans if
+   *  this is taken. Default: substrate-picked (no preference). */
+  readonly port?: number;
+  /** NIC the HTTP server binds. Defaults to `'0.0.0.0'` because the
+   *  router runs in Docker and must reach the host process through the
+   *  host-gateway address on native Linux. The public wallet URL remains
+   *  router-fronted and stack-scoped. */
+  readonly bindAddress?: string;
+  /** Opt-in: allowlist the bare `http://localhost:<vite-port>` form.
+   *  Off by default to close the cross-stack pairing risk (see
+   *  `origin-policy.ts` for the long-form rationale). */
+  readonly allowLocalhostVite?: boolean;
+}
+interface WalletValue {
+  readonly url: string;
+  readonly pairUrl: string;
+  readonly bindings: DappKitConfigBindings;
+  readonly localPort: number;
+  readonly token: PairingToken;
+  /** Server handle — substrate's scope finalizer chain invokes
+   *  `.close()`; callers don't reach in. Exposed here so tests can
+   *  drive teardown explicitly. */
+  readonly server: WalletServerHandle;
+}
+//#endregion
+export { WALLET_ACCOUNTS_ALL, WalletAccountMember, WalletOptions, WalletValue };
+//# sourceMappingURL=service.d.mts.map