release: @parity/truapi 0.7.0, @parity/truapi-host 0.4.0

[pgherveou]

Release: @parity/truapi 0.7.0, @parity/truapi-host 0.4.0

Summary

This minor release ships the RFC-0022 mobile host cutover together with the completed RFC-0023 account VRF signing flow. It publishes the generated AutoSigningKey and SignVrf host types, implements the Rust pairing-host API, persists product-scoped auto-signing keys, and requires Dotli confirmation before forwarding non-auto-signed requests to the paired Account Holder.

Authorization behavior:

• a matching same-product AutoSigning grant signs locally without confirmation or a remote-SSO roundtrip
• every other request first asks the pairing host for UserConfirmationReview::SignVrf; approval forwards it to the paired Account Holder for its own confirmation and signature
• rejecting the pairing-host confirmation stops the request before any remote message is sent
• cross-product accounts always use the confirmed remote path

The linked Dotli integration and structured confirmation UI are in paritytech/dotli-community#145.

Versions

• @parity/truapi: 0.6.0 → 0.7.0
• @parity/truapi-host: 0.3.0 → 0.4.0
• @parity/truapi-host dependency: @parity/truapi@^0.7.0

Checklist

• Added and consumed minor Changesets for both packages
• Ran npm run version-packages
• js/packages/truapi/package.json is 0.7.0
• js/packages/truapi-host/package.json is 0.4.0
• @parity/truapi-host depends on @parity/truapi@^0.7.0
• Updated both package changelogs
• rust/crates/truapi/Cargo.toml and Cargo.lock use 0.7.0
• No leftover release files under .changeset/ other than config.json

Verification

• npm run check-release-versions
• cargo test -p truapi: 6 passed
• @parity/truapi: build and 203 tests passed
• @parity/truapi-host: build and 40 tests passed
• cargo test -p truapi-server
• focused sign_vrf authorization tests: 5 passed
• Dotli affected callback/storage tests: 34 passed
• Dotli workspace typecheck, UI lint, and production build
• make e2e-dotli: 44 successful, 21 expected/allowlisted outcomes; Account/sign_vrf showed the Dotli confirmation first, then passed through the paired signing-host CLI approval and returned a signature

Keep the release: prefix when squash-merging so the post-CI publish workflow runs.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​parity/​truapi@​0.6.0 ⏵ 0.7.0	N/A	N/A	N/A	N/A	N/A

View full report