@parity/product-sdk-host 0.10.3 → 0.12.0

package/src/truapi.ts

@@ -3,310 +3,190 @@
 /**
  * TruAPI - the protocol for communicating between apps and the Polkadot host container.
  *
- * This module centralizes access to @novasamatech/host-api-wrapper and @novasamatech/host-api,
- * allowing other @parity/product-sdk-* packages to import from here rather than depending
- * directly on novasama packages.
+ * This module centralizes access to the in-house `@parity/truapi` client,
+ * allowing other `@parity/product-sdk-*` packages to import from here rather
+ * than depending directly on the protocol package. The client is built and
+ * cached by {@link module:transport}; this module adds the accessor plus the
+ * two helpers the convenience wrappers fold truapi's `ResultAsync` through —
+ * {@link mapHostResult} (returns a `Result`, used by the public operations) and
+ * {@link unwrapHostResult} (throws, used by the adapter-object methods).
  *
  * @module
  */
 
-import { createLogger } from "@parity/product-sdk-logger";
-
-import { enumValue } from "@novasamatech/host-api";
+import { scale } from "@parity/truapi";
 import type {
-    AllocatableResource as AllocatableResourceCodec,
-    AllocationOutcome as AllocationOutcomeCodec,
-    CodecType,
-    RemotePermission as RemotePermissionCodec,
-} from "@novasamatech/host-api";
-import type { createAccountsProvider, preimageManager } from "@novasamatech/host-api-wrapper";
+    AllocatableResource,
+    AllocationOutcome,
+    HexString,
+    RemotePermission,
+    TrUApiClient,
+} from "@parity/truapi";
+import { createLogger } from "@parity/product-sdk-logger";
 
-import { isInsideContainer } from "./container.js";
-import type { Statement, StatementProof } from "./types.js";
+import {
+    type HostError,
+    type HostErrorPayload,
+    HostCallFailedError,
+    HostUnavailableError,
+    formatHostError,
+} from "./errors.js";
+import { type Result, err, ok } from "./result.js";
+import { getClient, subscribeWithInterrupt } from "./transport.js";
+import type { HostSubscription, Statement, StatementProof } from "./types.js";
 
 const log = createLogger("host");
 
 /**
- * Extract a human-readable message from a host-side error. Hosts wrap
- * errors in versioned envelopes (`{ tag: "v1", value: CodecError }`); this
- * helper unwraps the envelope and renders the inner error's `name`/`message`
- * so callers see the host's actual diagnostic instead of `"[object Object]"`
- * (from `String(err)`) or a JSON-stringified envelope.
- *
- * Exported for the higher-level wrappers (`requestPermission`,
- * `deriveEntropy`, etc.) that build their `throw new Error(...)` messages.
+ * Await a host `ResultAsync`, returning its Ok value or throwing a diagnostic
+ * `Error` built from the host's error payload (preserved as `cause`).
+ *
+ * This is the *throwing* helper, retained for the methods of the adapter objects
+ * returned by the feature-detection getters (`PreimageManager.submit`,
+ * `HostLocalStorage.read`, `AccountsProvider` signing, …). Those objects often
+ * implement external interfaces (e.g. polkadot-api's `JsonRpcProvider`) whose
+ * method signatures can't carry a {@link Result}, so they keep the
+ * throw convention. The flat public operations use {@link mapHostResult} instead.
  */
-export function formatHostError(err: unknown): string {
-    // Single-level unwrap only; nested envelopes fall through to JSON.stringify.
-    const inner = isVersionedEnvelope(err) ? err.value : err;
-
-    if (inner instanceof Error) return inner.message;
-    if (typeof inner === "string") return inner;
-    if (
-        inner != null &&
-        typeof inner === "object" &&
-        "message" in inner &&
-        typeof (inner as { message: unknown }).message === "string"
-    ) {
-        const named = inner as { name?: unknown; message: string };
-        return typeof named.name === "string" ? `${named.name}: ${named.message}` : named.message;
-    }
-    try {
-        return JSON.stringify(inner);
-    } catch {
-        return String(inner);
-    }
+export function unwrapHostResult<T, E>(result: ResultAsync<T, E>, label: string): Promise<T> {
+    return result.match(
+        (value) => value,
+        (error: E) => {
+            throw new Error(`${label}: ${formatHostError(error)}`, { cause: error });
+        },
+    );
 }
 
-function isVersionedEnvelope(value: unknown): value is { tag: string; value: unknown } {
-    return (
-        value != null &&
-        typeof value === "object" &&
-        "tag" in value &&
-        "value" in value &&
-        typeof (value as { tag: unknown }).tag === "string"
+/**
+ * Await a host `ResultAsync` and fold it into a tagged {@link Result}: maps the
+ * Ok value through `map`, or wraps the host error payload in a
+ * {@link HostCallFailedError} on the `err` channel. This is the non-throwing
+ * boundary the flat public host operations (`requestPermission`, `deriveEntropy`,
+ * `requestResourceAllocation`, …) return through.
+ */
+export function mapHostResult<T, U>(
+    result: ResultAsync<T, HostErrorPayload>,
+    map: (value: T) => U,
+    label: string,
+): Promise<Result<U, HostError>> {
+    return result.match(
+        (value) => ok(map(value)),
+        (error) => err(new HostCallFailedError(label, error)),
     );
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Helpers from @novasamatech/host-api (re-exported from @novasamatech/scale)
+// Hex helpers
 // ─────────────────────────────────────────────────────────────────────────────
 
-export {
-    /**
-     * Construct an enum variant for TruAPI calls.
-     *
-     * @example
-     * ```ts
-     * import { enumValue, getTruApi } from "@parity/product-sdk-host";
-     *
-     * const truApi = await getTruApi();
-     * if (truApi) {
-     *   await truApi.permission([enumValue("ChainSubmit")]);
-     * }
-     * ```
-     */
-    enumValue,
-    /**
-     * Check if a value is a specific enum variant.
-     */
-    isEnumVariant,
-    /**
-     * Assert that a value is a specific enum variant, throwing if not.
-     */
-    assertEnumVariant,
-    /**
-     * Unwrap a Result, throwing on error.
-     */
-    unwrapResultOrThrow,
-    /**
-     * Create an Ok result.
-     */
-    resultOk,
-    /**
-     * Create an Err result.
-     */
-    resultErr,
-    /**
-     * Convert bytes to hex string.
-     */
-    toHex,
-    /**
-     * Convert hex string to bytes.
-     */
-    fromHex,
-} from "@novasamatech/host-api";
-
-/** A `0x`-prefixed hex string (the template literal type ``\`0x${string}\``) used by the host API surface for raw byte payloads. Re-exported from `@novasamatech/host-api` so consumers bridging between host APIs and SDK code can reach the host-side type without an additional dependency. */
-export type { HexString } from "@novasamatech/host-api";
+/** Convert bytes to a `0x`-prefixed lower-case hex string. */
+export function toHex(bytes: Uint8Array): HexString {
+    return scale.bytesToHex(bytes);
+}
+
+/** Convert a hex string (with or without `0x`) to bytes. */
+export function fromHex(hex: string): Uint8Array {
+    return scale.hexToBytes(hex);
+}
+
+/** A `0x`-prefixed hex string used by the host API surface for raw byte payloads. */
+export type { HexString };
 
 // ─────────────────────────────────────────────────────────────────────────────
 // TruAPI accessor
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * The TruApi type - provides low-level methods for communicating with the host.
- *
- * Methods include:
- * - `navigateTo(url)` - Navigate to a URL within the host
- * - `permission(permissions)` - Request permissions from the host
- * - `localStorageRead/Write/Clear` - Host-backed storage
- * - `sign(payload)` - Request transaction signing
- * - `deriveEntropy(context)` - Derive deterministic entropy
- * - `themeSubscribe()` - Subscribe to host theme changes
- * - And many more...
- *
- * Type identical to `hostApi` from `@novasamatech/host-api-wrapper` so that
- * `truApi.X(...)` calls keep their full inference (return types, method
- * names, parameter shapes) instead of decaying to `any`.
- */
-export type TruApi = typeof import("@novasamatech/host-api-wrapper").hostApi;
-
-/** Cached TruApi instance */
-let cachedTruApi: TruApi | null = null;
-
-/**
- * Get the TruAPI instance for direct low-level access.
- *
- * Returns the `hostApi` object from `@novasamatech/host-api-wrapper` which provides
- * methods for communicating directly with the host container. Returns `null`
- * when running outside a container or when the SDK is unavailable.
- *
- * For most use cases, prefer the higher-level functions like `getHostLocalStorage()`,
- * `getHostProvider()`, etc. Use this when you need direct access to host methods
- * like `navigateTo()`, `permission()`, or `deriveEntropy()`.
+ * The TruApi client — namespaced access to every host protocol domain
+ * (`permissions`, `entropy`, `signing`, `statementStore`, `system`,
+ * `localStorage`, …). Identical to `TrUApiClient` from `@parity/truapi`.
  *
  * @example
  * ```ts
- * import { getTruApi, enumValue } from "@parity/product-sdk-host";
- *
  * const truApi = await getTruApi();
  * if (truApi) {
- *   // Request permission
- *   const result = await truApi.permission([enumValue("ChainSubmit")]);
- *
- *   // Navigate to a URL
- *   await truApi.navigateTo("polkadot://settings");
- *
- *   // Subscribe to theme changes
- *   const sub = truApi.themeSubscribe(undefined, (theme) => {
- *     console.log("Theme changed:", theme);
+ *   await truApi.permissions.requestRemotePermission({
+ *     permission: { tag: "ChainSubmit", value: undefined },
  *   });
+ *   await truApi.system.navigateTo({ url: "polkadot://settings" });
  * }
  * ```
- *
- * @returns The TruAPI instance, or `null` if unavailable.
  */
-export async function getTruApi(): Promise<TruApi | null> {
-    if (cachedTruApi) return cachedTruApi;
-
-    try {
-        const sdk = await import("@novasamatech/host-api-wrapper");
-        cachedTruApi = sdk.hostApi;
-        log.debug("TruAPI loaded");
-        return cachedTruApi;
-    } catch {
-        log.debug("TruAPI unavailable (not in container or SDK not installed)");
-        return null;
-    }
-}
+export type TruApi = TrUApiClient;
 
 /**
- * Get the preimage manager for bulletin chain operations.
+ * Get the TruAPI client for direct low-level access to host protocol domains.
  *
- * The preimage manager handles uploading and looking up preimages (arbitrary data)
- * on the bulletin chain through the host's optimized path.
+ * Returns the cached `@parity/truapi` client once the host transport is built
+ * and the handshake has run, or `null` when running outside a container.
  *
- * @returns The preimage manager, or `null` if unavailable.
+ * For most use cases, prefer the higher-level functions like
+ * {@link requestPermission}, {@link deriveEntropy}, or `getHostLocalStorage()`.
  *
- * @example
- * ```ts
- * import { getPreimageManager } from "@parity/product-sdk-host";
- *
- * const manager = await getPreimageManager();
- * if (manager) {
- *   // Submit a preimage
- *   const key = await manager.submit(new Uint8Array([1, 2, 3]));
- *
- *   // Look up a preimage
- *   const sub = manager.lookup(key, (data) => {
- *     if (data) console.log("Found:", data);
- *   });
- * }
- * ```
+ * @returns The TruAPI client, or `null` if unavailable.
  */
-export async function getPreimageManager(): Promise<PreimageManager | null> {
-    try {
-        const sdk = await import("@novasamatech/host-api-wrapper");
-        return sdk.preimageManager;
-    } catch (err) {
-        log.debug("getPreimageManager unavailable", err);
-        return null;
-    }
+export async function getTruApi(): Promise<TruApi | null> {
+    return getClient();
 }
 
 /**
- * Preimage manager handle for bulletin chain operations. `lookup` returns a
- * `Subscription<void>` (`unsubscribe` + `onInterrupt`); `submit` returns a
- * `0x`-prefixed hex preimage key.
- *
- * Type identical to `preimageManager` from `@novasamatech/host-api-wrapper`.
+ * Preimage manager handle for bulletin chain operations, backed by
+ * `truApi.preimage.*`. `lookup` opens a {@link HostSubscription} (`unsubscribe`
+ * + `onInterrupt`) that delivers the preimage bytes — or `null` until the host
+ * finds them; `submit` uploads a preimage and resolves to its `0x`-prefixed hex
+ * key.
  */
-export type PreimageManager = typeof preimageManager;
+export interface PreimageManager {
+    lookup(key: HexString, callback: (preimage: Uint8Array | null) => void): HostSubscription;
+    submit(value: Uint8Array): Promise<HexString>;
+}
+
+/** Build a {@link PreimageManager} over a TruAPI client's `preimage` domain. */
+function adaptPreimageManager(client: TrUApiClient): PreimageManager {
+    const preimage = client.preimage;
+    return {
+        lookup(key, callback) {
+            return subscribeWithInterrupt(preimage.lookupSubscribe({ request: { key } }), (item) =>
+                callback(item.value !== undefined ? fromHex(item.value) : null),
+            );
+        },
+        submit(value) {
+            return unwrapHostResult(preimage.submit(toHex(value)), "preimage submit failed");
+        },
+    };
+}
 
 /**
- * Construct a fresh `PreimageManager` instance with an optional custom
- * transport. Use this when you need a non-default transport; otherwise
- * prefer {@link getPreimageManager}, which returns the shared singleton.
- *
- * Mirrors `createPreimageManager` from `@novasamatech/host-api-wrapper`.
+ * Get the preimage manager for bulletin chain operations.
  *
- * @param transport - Optional transport; defaults to the sandbox transport.
- * @returns A new `PreimageManager` instance, or `null` if unavailable.
+ * @returns The preimage manager, or `null` if unavailable (outside a container).
  */
-export async function createHostPreimageManager(
-    transport?: import("@novasamatech/host-api").Transport,
-): Promise<PreimageManager | null> {
-    if (!(await isInsideContainer())) return null;
-    try {
-        const sdk = await import("@novasamatech/host-api-wrapper");
-        return sdk.createPreimageManager(transport);
-    } catch (err) {
-        log.debug("createHostPreimageManager unavailable", err);
-        return null;
-    }
+export async function getPreimageManager(): Promise<PreimageManager | null> {
+    const client = await getClient();
+    return client ? adaptPreimageManager(client) : null;
 }
 
 /**
- * Get the accounts provider for managing host accounts.
+ * Construct a `PreimageManager`. Retained for API compatibility; with the single
+ * cached TruAPI client this is equivalent to {@link getPreimageManager}.
  *
- * @returns The accounts provider, or `null` if unavailable.
+ * @returns A `PreimageManager` instance, or `null` if unavailable.
  */
-export async function getAccountsProvider(): Promise<AccountsProvider | null> {
-    try {
-        const sdk = await import("@novasamatech/host-api-wrapper");
-        return sdk.createAccountsProvider();
-    } catch (err) {
-        log.debug("getAccountsProvider unavailable", err);
-        return null;
-    }
+export async function createHostPreimageManager(): Promise<PreimageManager | null> {
+    return getPreimageManager();
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Resource allocation
 // ─────────────────────────────────────────────────────────────────────────────
 
-/**
- * Resource types requestable via {@link requestResourceAllocation}.
- * Derived from the upstream codec so variant renames surface as compile
- * errors, not runtime failures.
- */
-export type AllocatableResource = CodecType<typeof AllocatableResourceCodec>;
-
-/** Tag-only view of {@link AllocatableResource} for places that just need the variant name. */
-export type AllocatableResourceTag = AllocatableResource["tag"];
-
-/**
- * Per-resource outcome from {@link requestResourceAllocation}.
- * The host strips secret payloads from `Allocated` before returning, so
- * `value` is always `undefined` on the product side.
- */
-export type AllocationOutcome = CodecType<typeof AllocationOutcomeCodec>;
-
-/** Tag-only view of {@link AllocationOutcome} (`"Allocated" | "Rejected" | "NotAvailable"`). */
-export type AllocationOutcomeTag = AllocationOutcome["tag"];
-
-/**
- * Remote permission the dapp can ask the host to grant via
- * {@link requestPermission}.
- *
- * Derived from the upstream codec so variant renames surface as compile
- * errors, not runtime failures.
- */
-export type RemotePermission = CodecType<typeof RemotePermissionCodec>;
-
-/** Tag-only view of {@link RemotePermission}. */
-export type RemotePermissionTag = RemotePermission["tag"];
+// Resource-allocation / permission types, re-exported verbatim from
+// `@parity/truapi` (imported above for the local signatures):
+// - `AllocatableResource` — resource types requestable via `requestResourceAllocation`.
+// - `AllocationOutcome` — per-resource outcome, the string union
+//   `"Allocated" | "Rejected" | "NotAvailable"` (RFC-10).
+// - `RemotePermission` — permission the dapp asks the host to grant via `requestPermission`.
+export type { AllocatableResource, AllocationOutcome, RemotePermission };
 
 /**
  * Request the host to pre-allocate one or more resource allowances.
@@ -315,34 +195,30 @@ export type RemotePermissionTag = RemotePermission["tag"];
  * granted allowance don't re-prompt.
  *
  * @param resources - Resources to request.
- * @returns Per-resource outcomes in the same order as `resources`.
- * @throws If the host is unavailable or the request fails.
+ * @returns `ok` with per-resource outcomes in the same order as `resources`, or
+ *   `err(HostUnavailableError | HostCallFailedError)`.
  *
  * @example
  * ```ts
- * const outcomes = await requestResourceAllocation([
+ * const r = await requestResourceAllocation([
  *   { tag: "BulletinAllowance", value: undefined },
  * ]);
- * if (outcomes[0].tag === "Allocated") { ... }
+ * if (r.ok && r.value[0] === "Allocated") { ... }
  * ```
  */
 export async function requestResourceAllocation(
     resources: AllocatableResource[],
-): Promise<AllocationOutcome[]> {
+): Promise<Result<AllocationOutcome[], HostError>> {
     const truApi = await getTruApi();
     if (!truApi) {
-        throw new Error("requestResourceAllocation: TruAPI unavailable");
+        return err(new HostUnavailableError("requestResourceAllocation: TruAPI unavailable"));
     }
     log.debug("requestResourceAllocation", { resources: resources.map((r) => r.tag) });
 
-    // `.match()` because the host returns a neverthrow ResultAsync, not a Promise.
-    return await truApi.requestResourceAllocation(enumValue("v1", resources)).match(
-        (envelope: { tag: "v1"; value: AllocationOutcome[] }) => envelope.value,
-        (err: unknown) => {
-            throw new Error(`requestResourceAllocation failed: ${formatHostError(err)}`, {
-                cause: err,
-            });
-        },
+    return mapHostResult(
+        truApi.resourceAllocation.request({ resources }),
+        (response) => response.outcomes,
+        "requestResourceAllocation failed",
     );
 }
 
@@ -351,105 +227,33 @@ export async function requestResourceAllocation(
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * Have the host sign a Statement using an allowance-bearing account it
- * picks internally — RFC-10 §"Statement Store allowance".
- *
- * The product passes only the Statement payload; the host chooses the
- * `//allowance//statement-store//{productId}` account that holds SSS
- * allowance and signs with it. Allowance is provisioned implicitly on
- * first use if the host hasn't already pre-allocated via
- * {@link requestResourceAllocation}; products never see the signing
- * account or its key material.
+ * Have the host sign a Statement using the product's allowance-bearing account,
+ * which it picks internally — RFC-10 §"Statement Store allowance". No per-call
+ * account id is needed (this is the sponsored-submission path).
  *
- * Pairs with {@link getStatementStore}'s `submit`: call this to obtain
- * a proof, attach it to the Statement, and submit the result.
+ * Pairs with {@link getStatementStore}'s `submit`: call this to obtain a proof,
+ * attach it to the Statement, and submit the result.
  *
  * @param statement - The Statement to be signed.
- * @returns The proof to attach before submitting.
- * @throws If the host is unavailable or the host-side signing fails.
- *
- * @example
- * ```ts
- * import { createProofAuthorized, getStatementStore } from "@parity/product-sdk-host";
- *
- * const statement = {
- *     proof: undefined,
- *     decryptionKey: undefined,
- *     expiry: undefined,
- *     channel: undefined,
- *     topics: [],
- *     data: payload,
- * };
- * const proof = await createProofAuthorized(statement);
- * const store = await getStatementStore();
- * await store?.submit({ ...statement, proof });
- * ```
- *
- * @remarks
- * RFC-10 introduces this as a new, strictly additive TruAPI call. The
- * pre-existing `HostStatementStore.createProof(accountId, statement)`
- * surface stays available for products that own a non-allowance signing
- * account; this wrapper is the sponsored-submission path.
+ * @returns `ok` with the proof to attach before submitting, or
+ *   `err(HostUnavailableError | HostCallFailedError)`.
  */
-export async function createProofAuthorized(statement: Statement): Promise<StatementProof> {
+export async function createProofAuthorized(
+    statement: Statement,
+): Promise<Result<StatementProof, HostError>> {
     const truApi = await getTruApi();
     if (!truApi) {
-        throw new Error("createProofAuthorized: TruAPI unavailable");
+        return err(new HostUnavailableError("createProofAuthorized: TruAPI unavailable"));
     }
-    log.debug("createProofAuthorized", {
-        topics: statement.topics.length,
-        dataLen: statement.data?.length ?? 0,
-    });
+    log.debug("createProofAuthorized", { topics: statement.topics.length });
 
-    // `.match()` because the host returns a neverthrow ResultAsync, not a Promise.
-    return await truApi.statementStoreCreateProofAuthorized(enumValue("v1", statement)).match(
-        (envelope: { tag: "v1"; value: StatementProof }) => envelope.value,
-        (err: unknown) => {
-            throw new Error(`createProofAuthorized failed: ${formatHostError(err)}`, {
-                cause: err,
-            });
-        },
+    return mapHostResult(
+        truApi.statementStore.createProofAuthorized(statement),
+        (response) => response.proof,
+        "createProofAuthorized failed",
     );
 }
 
-/**
- * One of the user's existing wallet accounts, surfaced through the host and
- * identified by its public key and an optional name. Contrast with
- * {@link ProductAccount}, which is also user-controlled but derived by the
- * host for a specific app rather than picked from the user's existing keys.
- */
-export interface HostAccount {
-    publicKey: Uint8Array;
-    name?: string;
-}
-
-/**
- * A product account — an app-scoped derived account managed by the host wallet.
- *
- * The host derives a unique keypair for each app (identified by `dotNsIdentifier`)
- * so apps get their own account that the user controls but is scoped to the app.
- */
-export interface ProductAccount {
-    /** App identifier (e.g., "mark3t.dot"). */
-    dotNsIdentifier: string;
-    /** Derivation index within the app scope. Default: 0 */
-    derivationIndex: number;
-    /** Raw public key (32 bytes). */
-    publicKey: Uint8Array;
-}
-
-/**
- * A contextual alias obtained from Ring VRF.
- *
- * Proves account membership in a ring without revealing which account.
- */
-export interface ContextualAlias {
-    /** Ring context (32 bytes). */
-    context: Uint8Array;
-    /** The Ring VRF alias bytes. */
-    alias: Uint8Array;
-}
-
 /**
  * Neverthrow-style ResultAsync returned by product-sdk methods.
  *
@@ -459,18 +263,6 @@ export interface ResultAsync<T, E> {
     match: <A, B = A>(ok: (t: T) => A, err: (e: E) => B) => Promise<A | B>;
 }
 
-/**
- * Accounts provider handle from `@novasamatech/host-api-wrapper`. Surfaces the
- * full upstream API - host wallet accounts, app-scoped product accounts,
- * Ring VRF, user identity (`getUserId`, `requestLogin`), and connection
- * status subscription.
- *
- * Type identical to `createAccountsProvider()` from
- * `@novasamatech/host-api-wrapper`; methods return neverthrow `ResultAsync`
- * values with typed `CodecError` variants in the error channel.
- */
-export type AccountsProvider = ReturnType<typeof createAccountsProvider>;
-
 // ─────────────────────────────────────────────────────────────────────────────
 // Tests
 // ─────────────────────────────────────────────────────────────────────────────
@@ -478,17 +270,13 @@ export type AccountsProvider = ReturnType<typeof createAccountsProvider>;
 if (import.meta.vitest) {
     const { test, expect } = import.meta.vitest;
 
-    test("getTruApi returns TruApi when SDK is available", async () => {
-        // Reset cache for test
-        cachedTruApi = null;
+    test("getTruApi returns null outside a container", async () => {
         const api = await getTruApi();
-        // In dev/test mode, product-sdk is installed
         expect(api === null || typeof api === "object").toBe(true);
     });
 
-    test("getPreimageManager returns manager when SDK is available", async () => {
+    test("getPreimageManager returns manager or null", async () => {
         const manager = await getPreimageManager();
-        // In dev/test mode, product-sdk is installed
         expect(manager === null || typeof manager === "object").toBe(true);
     });
 
@@ -496,58 +284,27 @@ if (import.meta.vitest) {
         expect(await createHostPreimageManager()).toBeNull();
     });
 
-    test("formatHostError unwraps versioned envelopes and renders CodecError", () => {
-        expect(
-            formatHostError({
-                tag: "v1",
-                value: { name: "GenericError", message: "boom" },
-            }),
-        ).toBe("GenericError: boom");
-        expect(formatHostError(new Error("plain"))).toBe("plain");
-        expect(formatHostError("string err")).toBe("string err");
-        expect(formatHostError({ tag: "v1", value: { message: "no-name" } })).toBe("no-name");
-    });
-
-    test("getAccountsProvider returns provider when SDK is available", async () => {
-        // In dev/test mode, product-sdk is installed, so this returns a provider
-        const provider = await getAccountsProvider();
-        // Just verify it returns something (null when SDK unavailable, provider when available)
-        expect(provider === null || typeof provider === "object").toBe(true);
+    test("hex helpers", () => {
+        expect(toHex(new Uint8Array([0xde, 0xad]))).toBe("0xdead");
+        expect(Array.from(fromHex("0xdead"))).toEqual([0xde, 0xad]);
     });
 
-    test("enumValue is exported", async () => {
-        const { enumValue } = await import("./truapi.js");
-        expect(typeof enumValue).toBe("function");
-    });
-
-    test("requestResourceAllocation throws when TruAPI is unavailable", async () => {
-        cachedTruApi = null;
+    test("requestResourceAllocation returns err when TruAPI is unavailable", async () => {
         const api = await getTruApi();
         if (api === null) {
-            await expect(
-                requestResourceAllocation([{ tag: "BulletinAllowance", value: undefined }]),
-            ).rejects.toThrow(/TruAPI unavailable/);
+            const result = await requestResourceAllocation([
+                { tag: "BulletinAllowance", value: undefined },
+            ]);
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.error).toBeInstanceOf(HostUnavailableError);
+            }
         } else {
             expect(typeof requestResourceAllocation).toBe("function");
         }
     });
 
-    test("createProofAuthorized throws when TruAPI is unavailable", async () => {
-        cachedTruApi = null;
-        const api = await getTruApi();
-        if (api === null) {
-            await expect(
-                createProofAuthorized({
-                    proof: undefined,
-                    decryptionKey: undefined,
-                    expiry: undefined,
-                    channel: undefined,
-                    topics: [],
-                    data: undefined,
-                }),
-            ).rejects.toThrow(/TruAPI unavailable/);
-        } else {
-            expect(typeof createProofAuthorized).toBe("function");
-        }
+    test("createProofAuthorized is callable", () => {
+        expect(typeof createProofAuthorized).toBe("function");
     });
 }