fix(host): support RFC-0023 signing callbacks by pgherveou · Pull Request #145 · paritytech/dotli-community

pgherveou · 2026-08-04T05:23:47Z

Summary

persist RFC-0023 AutoSigningKey values in opaque, encrypted core-storage slots
render a structured Dotli confirmation for non-AutoSigning SignVrf requests
require the RFC-0023 generated CoreStorageKey and confirmation types directly
raise the Workbox precache limit so the development TrUAPI WASM bundle remains atomically cached with its glue code

Authorization behavior

RFC-0023 has two paths:

a matching same-product AutoSigning grant signs locally without a prompt
every other request first shows Dotli's structured Sign VRF Transcript confirmation; only after approval does the pairing-host runtime forward it to the paired Account Holder, which presents its own confirmation and signs

The Dotli review shows the requesting product, signer, transcript label, and transcript item count. Cross-product requests always use this confirmed remote path.

Merge prerequisite

Merge the companion release PR and publish @parity/truapi@0.7.0 plus @parity/truapi-host@0.4.0. Then update this PR's dependency versions and lockfile before merging. Backward compatibility with the currently published @parity/truapi-host@0.3.0 is intentionally not provided.

Tests

Using the linked RFC-0023 TrUAPI checkout:

affected UI tests: 34 passed
full workspace typecheck
UI lint
production build
TrUAPI sign_vrf authorization tests: 5 passed
companion TrUAPI make e2e-dotli: 44 successful, 21 expected/allowlisted outcomes; Account/sign_vrf showed the Dotli Sign confirmation first, then passed through the paired signing-host CLI approval and returned a signature

Companion release PR

release: @parity/truapi 0.7.0, @parity/truapi-host 0.4.0 truapi#332 — @parity/truapi@0.7.0, @parity/truapi-host@0.4.0

github-actions · 2026-08-04T05:30:52Z

Bundle Size Report

Chunks over 500 KB:

File	Raw	Brotli	Gzip
`host/assets/paseo.smol-DboPaEh1.json`	1.84 MB	941.7 KB	1019.4 KB
`host/assets/paseo-people-next.smol.json`	3.36 MB	1.68 MB	1.82 MB
`host/assets/smoldot.js`	2.98 MB	2.22 MB (-1.1 KB)	2.23 MB
`host/assets/smoldot_worker.js`	2.95 MB	2.21 MB	2.22 MB
`host/assets/wasm/web/truapi_server_bg.wasm`	2.01 MB (+2.5 KB)	627.5 KB (-2.6 KB)	830.0 KB (-196 B)
Total	14.30 MB (+9.4 KB)	7.97 MB (-2.1 KB) (-44%)	8.46 MB (+1.8 KB)

All files

File	Raw	Brotli	Gzip
`host/.well-known/apple-app-site-association`	738 B	738 B	738 B
`host/.well-known/assetlinks.json`	1.3 KB	317 B	391 B
`host/assets/bridge.js`	68.9 KB (+357 B)	18.8 KB (+59 B)	21.7 KB (+78 B)
`host/assets/browser.js`	22.9 KB	7.5 KB (-35 B)	8.6 KB
`host/assets/client.js`	100.1 KB	29.4 KB (-30 B)	32.4 KB (-1 B)
`host/assets/dist.js`	39.0 KB	12.8 KB (-9 B)	14.6 KB
`host/assets/dotli-debug-bus.js`	710 B	710 B	710 B
`host/assets/get-sync-provider.js`	2.8 KB	1.1 KB	1.2 KB
`host/assets/hex.js`	154 B	154 B	154 B
`host/assets/index.js`	185.9 KB (+187 B)	46.8 KB (-32 B)	55.8 KB (+41 B)
`host/assets/index.css`	45.2 KB	7.1 KB	7.9 KB
`host/assets/manifest.js`	22.5 KB	7.2 KB (-31 B)	7.9 KB (-1 B)
`host/assets/panel.js`	76.2 KB	20.6 KB (+15 B)	23.2 KB (+1 B)
`host/assets/paseo.smol-DboPaEh1.json`	1.84 MB	941.7 KB	1019.4 KB
`host/assets/paseo-people-next.smol.json`	3.36 MB	1.68 MB	1.82 MB
`host/assets/paseo.smol.json`	22.3 KB	5.1 KB	5.9 KB
`host/assets/previewnet.smol.json`	179.0 KB	13.8 KB	34.0 KB
`host/assets/resolve.js`	128 B	128 B	128 B
`host/assets/rpc-resolve.js`	2.4 KB	1.0 KB (+16 B)	1.1 KB
`host/assets/shared-mode.js`	1.8 KB	744 B (-2 B)	844 B (-3 B)
`host/assets/smoldot.js`	2.98 MB	2.22 MB (-1.1 KB)	2.23 MB
`host/assets/smoldot_worker.js`	2.95 MB	2.21 MB	2.22 MB
`host/assets/src.js`	1.8 KB	845 B (-1 B)	946 B
`host/assets/styles.css`	15.3 KB	3.3 KB	3.8 KB
`host/assets/wasm/web/README.md`	11.5 KB (+194 B)	11.5 KB (+194 B)	11.5 KB (+194 B)
`host/assets/wasm/web/package.json`	371 B	371 B	371 B
`host/assets/wasm/web/truapi_server.d.ts`	6.9 KB	6.9 KB	6.9 KB
`host/assets/wasm/web/truapi_server.js`	35.6 KB	6.2 KB (-2 B)	7.2 KB (+7 B)
`host/assets/wasm/web/truapi_server_bg.wasm`	2.01 MB (+2.5 KB)	627.5 KB (-2.6 KB)	830.0 KB (-196 B)
`host/assets/wasm/web/truapi_server_bg.wasm.d.ts`	2.5 KB	2.5 KB	2.5 KB
`host/assets/web.js`	13.2 KB	3.5 KB	4.0 KB (-2 B)
`host/assets/worker-runtime.js`	6.3 KB (+6.2 KB)	1.6 KB (+1.5 KB)	1.8 KB (+1.7 KB)
`host/assets/worker-runtime.js`	106 B	106 B	106 B
`host/assets/ws.js`	23.1 KB	7.5 KB (-9 B)	8.2 KB (-1 B)
`host/dotli.png`	11.5 KB	11.5 KB	11.5 KB
`host/favicon.svg`	1.8 KB	1.8 KB	1.8 KB
`host/host-sw.js`	2.7 KB	1.1 KB (+10 B)	1.3 KB (+6 B)
`host/icon-192.png`	12.5 KB	12.5 KB	12.5 KB
`host/icon-512.png`	42.8 KB	42.8 KB	42.8 KB
`host/index.html`	19.9 KB	4.4 KB (+4 B)	5.4 KB (+2 B)
`host/manifest.webmanifest`	441 B	441 B	441 B
`host/workbox.js`	14.8 KB	4.6 KB	5.1 KB
`sandbox/app-sw.js`	9.6 KB	3.1 KB (+8 B)	3.5 KB (+2 B)
`sandbox/assets/bitswap-bridge.js`	840 B	840 B	840 B
`sandbox/assets/fetch.js`	3.4 KB	1.2 KB	1.4 KB (-3 B)
`sandbox/assets/index.css`	45.2 KB	7.1 KB	7.9 KB
`sandbox/assets/index.js`	118.0 KB	33.7 KB	39.6 KB
`sandbox/favicon.svg`	1.8 KB	1.8 KB	1.8 KB
`sandbox/index.html`	1.7 KB	581 B (-2 B)	785 B (-2 B)
Total	14.30 MB (+9.4 KB)	7.97 MB (-2.1 KB) (-44%)	8.46 MB (+1.8 KB)

_{Commit: bf73296}

github-actions · 2026-08-04T05:30:57Z

⚡ Performance Report

⚠️ No baseline found on main. This PR's results are recorded but cannot be compared.
Merge to main to establish a baseline.

github-actions · 2026-08-04T05:32:46Z

⚠️ E2E Product suite skipped — Nova signing bot is unavailable.

This is a Nova-side outage and not a dot.li test failure. Re-run
from the Actions tab once the bot recovers.

Logs: https://github.com/paritytech/dotli-community/actions/runs/30880865836

socket-security · 2026-08-04T11:05:05Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@parity/truapi-host@0.3.0 ⏵ 0.4.0	⁺¹		⁺¹	⁺¹
	@parity/truapi@0.6.0 ⏵ 0.7.0				⁺¹

View full report

…advisories

github-actions · 2026-08-04T11:50:08Z

❌ E2E Product suite failed on cdb3ed420a7f63f8436497438223e7ee7314552c — 29 passed, 32 failed, 1 skipped.

Failed tests:

Product is ready
Get Product Account
Product Signer
Account Connection Status
Product Account Alias
Request Login
Get User Identity
Subscribe Theme
Derive Entropy
Well-Known Chains
StatementStore Allowance
Bulletin Allowance
Smart-Contract Allowance
All Allowances
String Write & Read
Bytes Write & Read
JSON Write & Read
Clear
Factory
Feature Check
Remote: HTTP/WS
Remote: WebRTC
Remote: Chain Submit
Remote: Preimage Submit
Remote: Statement Submit
As a product user, I can create an authorized statement proof
As a product user, I can submit a statement
Subscribe Match All
Subscribe Match Any
HTTP URL
Polkadot URL
As a product user, I can navigate within the current product

Logs: https://github.com/paritytech/dotli-community/actions/runs/30904235928
Artifacts: e2e-product-results (uploaded above) — open the failed test's trace.zip with npx playwright show-trace.

BigTava

Looks good!

fix(host): support RFC-0023 signing callbacks

ad3e326

pgherveou requested review from BigTava, Cyr06130, KarimJedda, ba1uev, justraman, leonardocustodio and tallesborges as code owners August 4, 2026 05:23

github-actions Bot assigned pgherveou Aug 4, 2026

github-actions Bot added app: host pkg: ui labels Aug 4, 2026

pgherveou mentioned this pull request Aug 4, 2026

release: @parity/truapi 0.7.0, @parity/truapi-host 0.4.0 paritytech/truapi#332

Merged

8 tasks

fix(host): tolerate pre-release RFC-0023 types

f7d518b

pg and others added 5 commits August 4, 2026 08:09

refactor(host): require RFC-0023 generated types

dc588da

fix(host): keep VRF confirmation on account holder

de78cd7

fix(host): restore RFC-0023 VRF confirmation

e7bb586

bump truapi to 0.7.0 and truapi-host to 0.4.0

2fbf454

add updated bun.lock

dc685bc

chore: bump fast-uri and brace-expansion overrides to patch two high …

cdb3ed4

…advisories

BigTava self-assigned this Aug 4, 2026

BigTava approved these changes Aug 4, 2026

View reviewed changes

Imod7 merged commit 584af2d into main Aug 4, 2026
14 of 15 checks passed

Imod7 deleted the codex/rfc23-sign-vrf-host branch August 4, 2026 13:57

pgherveou added the deploy: dotli.dev label Aug 5, 2026

pgherveou requested a deployment to dotli.dev August 5, 2026 10:01 — with GitHub Actions Waiting

Navigation Menu

Uh oh!

fix(host): support RFC-0023 signing callbacks - #145

fix(host): support RFC-0023 signing callbacks#145
Imod7 merged 8 commits into
mainfrom
codex/rfc23-sign-vrf-host

pgherveou commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

socket-security Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

BigTava left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

pgherveou commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Authorization behavior

Merge prerequisite

Tests

Companion release PR

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Size Report

Uh oh!

github-actions Bot commented Aug 4, 2026

⚡ Performance Report

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

socket-security Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

BigTava left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pgherveou commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

socket-security Bot commented Aug 4, 2026 •

edited

Loading