feat(server,cli): auto-renew statement-store allowances

Makefile

@@ -3,7 +3,7 @@
 # Run `make help` for the list of targets.
 
 .DEFAULT_GOAL := help
-.PHONY: help setup build codegen test check clean playground wasm wasm-crypto-test dotli-link dev dev-bootstrap dev-link-check e2e-dotli matrix explorer
+.PHONY: help setup build codegen test check clean playground wasm wasm-crypto-test dotli-link dev dev-bootstrap dev-link-check e2e-dotli headless install matrix explorer
 
 TRUAPI_PKG := js/packages/truapi
 PLAYGROUND := playground
@@ -55,6 +55,13 @@ build: ## Build the Rust workspace and the TypeScript client.
 	cd $(TRUAPI_PKG) && npm run build
 	cd $(HOST_WASM_PKG) && npm run build
 
+headless: ## Build everything the headless-host e2e needs (truapi-host CLI + TS client).
+	cargo build -p truapi-host-cli
+	cd $(TRUAPI_PKG) && npm run build
+
+install: headless ## Install the truapi-host CLI into Cargo's bin dir; use as `make headless install`.
+	cargo install --path rust/crates/truapi-host-cli --bin truapi-host --locked --force
+
 codegen: ## Regenerate generated TS/Rust artifacts from the Rust crates.
 	./scripts/codegen.sh
 	cd $(PLAYGROUND) && rm -rf node_modules/@parity && yarn install

README.md

@@ -105,6 +105,13 @@ make wasm     # rebuild truapi-server WASM artifacts under js/packages/truapi-ho
 CI regenerates the shared bindings before building and testing both npm
 packages, so generated client and host callback changes are checked together.
 
+The native `truapi-host` utility can run pairing and signing hosts against the
+real SSO transport for local end-to-end work. Its signing-host command provides
+a transcript-based terminal UI, slash commands such as `/whoami`, `/deeplink`,
+and `/script`, plus a non-interactive `exec` form for automation. See the
+[`truapi-host-cli` guide](rust/crates/truapi-host-cli/README.md) for setup,
+controls, and examples.
+
 To run the playground locally:
 
 ```bash

explorer/diagnosis-reports/pairing-host-cli.md

@@ -0,0 +1,68 @@
+## Truapi Pairing Host CLI Diagnosis
+
+| Method | Status | Details |
+| --- | --- | --- |
+| `Account/connection_status_subscribe` | ✅ |  |
+| `Account/get_account` | ✅ |  |
+| `Account/get_account_alias` | ✅ |  |
+| `Account/create_account_proof` | ✅ |  |
+| `Account/get_legacy_accounts` | ✅ |  |
+| `Account/get_user_id` | ✅ |  |
+| `Account/request_login` | ✅ |  |
+| `Chain/follow_head_subscribe` | ✅ |  |
+| `Chain/get_head_header` | ✅ |  |
+| `Chain/get_head_body` | ✅ |  |
+| `Chain/get_head_storage` | ✅ |  |
+| `Chain/call_head` | ✅ |  |
+| `Chain/unpin_head` | ✅ |  |
+| `Chain/continue_head` | ✅ |  |
+| `Chain/stop_head_operation` | ✅ |  |
+| `Chain/get_spec_genesis_hash` | ✅ |  |
+| `Chain/get_spec_chain_name` | ✅ |  |
+| `Chain/get_spec_properties` | ✅ |  |
+| `Chain/broadcast_transaction` | ✅ |  |
+| `Chain/stop_transaction` | ✅ |  |
+| `Chat/create_room` | ❌ | createRoom failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Chat/register_bot` | ❌ | registerBot failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Chat/list_subscribe` | ❌ | no elements in sequence |
+| `Chat/post_message` | ❌ | postMessage failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Chat/action_subscribe` | ❌ | no elements in sequence |
+| `Chat/custom_message_render_subscribe` | ❌ | no elements in sequence |
+| `Coin Payment/create_purse` | ❌ | createPurse failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/query_purse` | ❌ | queryPurse failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/rebalance_purse` | ❌ | Subscription interrupted |
+| `Coin Payment/delete_purse` | ❌ | Subscription interrupted |
+| `Coin Payment/create_receivable` | ❌ | createReceivable failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/create_cheque` | ❌ | createCheque failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/deposit` | ❌ | Subscription interrupted |
+| `Coin Payment/refund` | ❌ | Subscription interrupted |
+| `Coin Payment/listen_for_payment` | ❌ | Subscription interrupted |
+| `Entropy/derive` | ✅ |  |
+| `Local Storage/read` | ✅ |  |
+| `Local Storage/write` | ✅ |  |
+| `Local Storage/clear` | ✅ |  |
+| `Notifications/send_push_notification` | ✅ |  |
+| `Notifications/cancel_push_notification` | ✅ |  |
+| `Payment/balance_subscribe` | ❌ | Subscription interrupted |
+| `Payment/top_up` | ❌ | topUp failed: { "error": { "tag": "Domain", "value": { "tag": "V1", "value": { "tag": "Unknown", "value": { "reason": "Payments are not supported in dot.li" } } } } } |
+| `Payment/request` | ❌ | topUp failed: { "error": { "tag": "Domain", "value": { "tag": "V1", "value": { "tag": "Unknown", "value": { "reason": "Payments are not supported in dot.li" } } } } } |
+| `Payment/status_subscribe` | ❌ | topUp failed: { "error": { "tag": "Domain", "value": { "tag": "V1", "value": { "tag": "Unknown", "value": { "reason": "Payments are not supported in dot.li" } } } } } |
+| `Permissions/request_device_permission` | ✅ |  |
+| `Permissions/request_remote_permission` | ✅ |  |
+| `Preimage/lookup_subscribe` | ✅ |  |
+| `Preimage/submit` | ✅ |  |
+| `Resource Allocation/request` | ✅ |  |
+| `Signing/create_transaction` | ✅ |  |
+| `Signing/create_transaction_with_legacy_account` | ✅ |  |
+| `Signing/sign_raw_with_legacy_account` | ✅ |  |
+| `Signing/sign_payload_with_legacy_account` | ✅ |  |
+| `Signing/sign_raw` | ✅ |  |
+| `Signing/sign_payload` | ✅ |  |
+| `Statement Store/subscribe` | ✅ |  |
+| `Statement Store/create_proof` | ✅ |  |
+| `Statement Store/submit` | ✅ |  |
+| `Statement Store/create_proof_authorized` | ✅ |  |
+| `System/handshake` | ✅ |  |
+| `System/feature_supported` | ✅ |  |
+| `System/navigate_to` | ✅ |  |
+| `Theme/subscribe` | ✅ |  |

explorer/diagnosis-reports/signing-host-cli.md

@@ -0,0 +1,68 @@
+## Truapi Signing Host CLI Diagnosis
+
+| Method | Status | Details |
+| --- | --- | --- |
+| `Account/connection_status_subscribe` | ✅ |  |
+| `Account/get_account` | ✅ |  |
+| `Account/get_account_alias` | ✅ |  |
+| `Account/create_account_proof` | ✅ |  |
+| `Account/get_legacy_accounts` | ✅ |  |
+| `Account/get_user_id` | ✅ |  |
+| `Account/request_login` | ✅ |  |
+| `Chain/follow_head_subscribe` | ✅ |  |
+| `Chain/get_head_header` | ✅ |  |
+| `Chain/get_head_body` | ✅ |  |
+| `Chain/get_head_storage` | ✅ |  |
+| `Chain/call_head` | ✅ |  |
+| `Chain/unpin_head` | ✅ |  |
+| `Chain/continue_head` | ✅ |  |
+| `Chain/stop_head_operation` | ✅ |  |
+| `Chain/get_spec_genesis_hash` | ✅ |  |
+| `Chain/get_spec_chain_name` | ✅ |  |
+| `Chain/get_spec_properties` | ✅ |  |
+| `Chain/broadcast_transaction` | ✅ |  |
+| `Chain/stop_transaction` | ✅ |  |
+| `Chat/create_room` | ❌ | createRoom failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Chat/register_bot` | ❌ | registerBot failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Chat/list_subscribe` | ❌ | no elements in sequence |
+| `Chat/post_message` | ❌ | postMessage failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Chat/action_subscribe` | ❌ | no elements in sequence |
+| `Chat/custom_message_render_subscribe` | ❌ | no elements in sequence |
+| `Coin Payment/create_purse` | ❌ | createPurse failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/query_purse` | ❌ | queryPurse failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/rebalance_purse` | ❌ | Subscription interrupted |
+| `Coin Payment/delete_purse` | ❌ | Subscription interrupted |
+| `Coin Payment/create_receivable` | ❌ | createReceivable failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/create_cheque` | ❌ | createCheque failed: { "error": { "tag": "HostFailure", "value": { "reason": "unavailable" } } } |
+| `Coin Payment/deposit` | ❌ | Subscription interrupted |
+| `Coin Payment/refund` | ❌ | Subscription interrupted |
+| `Coin Payment/listen_for_payment` | ❌ | Subscription interrupted |
+| `Entropy/derive` | ✅ |  |
+| `Local Storage/read` | ✅ |  |
+| `Local Storage/write` | ✅ |  |
+| `Local Storage/clear` | ✅ |  |
+| `Notifications/send_push_notification` | ✅ |  |
+| `Notifications/cancel_push_notification` | ✅ |  |
+| `Payment/balance_subscribe` | ❌ | Subscription interrupted |
+| `Payment/top_up` | ❌ | topUp failed: { "error": { "tag": "Domain", "value": { "tag": "V1", "value": { "tag": "Unknown", "value": { "reason": "Payments are not supported in dot.li" } } } } } |
+| `Payment/request` | ❌ | topUp failed: { "error": { "tag": "Domain", "value": { "tag": "V1", "value": { "tag": "Unknown", "value": { "reason": "Payments are not supported in dot.li" } } } } } |
+| `Payment/status_subscribe` | ❌ | topUp failed: { "error": { "tag": "Domain", "value": { "tag": "V1", "value": { "tag": "Unknown", "value": { "reason": "Payments are not supported in dot.li" } } } } } |
+| `Permissions/request_device_permission` | ✅ |  |
+| `Permissions/request_remote_permission` | ✅ |  |
+| `Preimage/lookup_subscribe` | ✅ |  |
+| `Preimage/submit` | ✅ |  |
+| `Resource Allocation/request` | ✅ |  |
+| `Signing/create_transaction` | ✅ |  |
+| `Signing/create_transaction_with_legacy_account` | ✅ |  |
+| `Signing/sign_raw_with_legacy_account` | ✅ |  |
+| `Signing/sign_payload_with_legacy_account` | ✅ |  |
+| `Signing/sign_raw` | ✅ |  |
+| `Signing/sign_payload` | ✅ |  |
+| `Statement Store/subscribe` | ✅ |  |
+| `Statement Store/create_proof` | ✅ |  |
+| `Statement Store/submit` | ✅ |  |
+| `Statement Store/create_proof_authorized` | ✅ |  |
+| `System/handshake` | ✅ |  |
+| `System/feature_supported` | ✅ |  |
+| `System/navigate_to` | ✅ |  |
+| `Theme/subscribe` | ✅ |  |

playground/src/components/MethodView.tsx

@@ -9,7 +9,7 @@ import { methodTestId, revealInRail, serviceTestId } from "@/src/lib/rail";
 import { services } from "@/src/lib/services";
 import type { MethodInfo, ServiceInfo } from "@/src/lib/services";
 
-const CALL_TIMEOUT_MS = 30_000;
+const CALL_TIMEOUT_MS = 45_000;
 
 const CARGO_DOC_BASE =
   process.env.NEXT_PUBLIC_CARGO_DOC_BASE ??

playground/tests/e2e/dotli/helpers/signer-bot.ts

@@ -5,11 +5,12 @@ import { setTimeout as sleep } from "node:timers/promises";
 
 const TRANSIENT = new Set([502, 503, 504]);
 
-// Per-attempt request timeout. First-time pair can include user creation and
-// People-chain attestation, so give the one-shot handshake room to finish
-// instead of aborting and retrying the same QR payload.
+// Per-attempt request timeout. First-time pair can include user creation,
+// People-chain attestation, and V2 pairing-time device allowance finalization.
+// Give the one-shot handshake room to finish instead of aborting and retrying
+// the same QR payload.
 const PAIR_REQUEST_TIMEOUT_MS = Number(
-  process.env.SIGNER_BOT_PAIR_TIMEOUT_MS ?? "120000",
+  process.env.SIGNER_BOT_PAIR_TIMEOUT_MS ?? "240000",
 );
 const HEALTH_REQUEST_TIMEOUT_MS = 5_000;
 
@@ -115,6 +116,7 @@ async function fetchTextRetry(
       );
     } catch (e) {
       last = e;
+      if ((e as Error).name === "AbortError") throw e;
       if (i === attempts) throw e;
       console.warn(
         `[bot] ${init.method ?? "GET"} ${url} threw "${(e as Error).message}" (attempt ${i}/${attempts})`,
@@ -160,9 +162,9 @@ export interface PairResult {
  *
  * The Nova bot's `/api/pair` is one-shot: given a handshake, it
  * (a) creates the user if `username` is new, (b) attests the account on
- * People chain so it has Statement Store allowance, (c) completes the
- * SSO handshake, (d) starts auto-signing future SignRequests for that
- * session. No separate provisioning / poll step needed.
+ * People chain so it has Statement Store allowance, (c) submits V2
+ * pairing-time device allowance, (d) completes the SSO handshake, and
+ * (e) starts auto-signing future SignRequests for that session.
  *
  * `network` should match dot.li's default network (`paseo-next-v2` at time
  * of writing). The bot's `/api/networks` endpoint lists supported IDs.

rust/crates/truapi-host-cli/Cargo.toml

@@ -0,0 +1,48 @@
+[package]
+name = "truapi-host-cli"
+version = "0.1.0"
+edition.workspace = true
+description = "Headless TrUAPI hosts: a signing-host companion and a pairing host that pair over the real People-chain statement store, for end-to-end testing without an external signer service"
+license = "MIT"
+
+[[bin]]
+name = "truapi-host"
+path = "src/main.rs"
+
+[lints.rust]
+unsafe_code = "forbid"
+
+[dependencies]
+truapi = { path = "../truapi" }
+truapi-platform = { path = "../truapi-platform" }
+truapi-server = { path = "../truapi-server" }
+anyhow = "1"
+arboard = { version = "3.6.1", default-features = false }
+async-trait = "0.1"
+bip39 = { version = "2", features = ["rand"] }
+clap = { version = "4", features = ["derive", "env"] }
+crossterm = { version = "0.29", features = ["event-stream"] }
+futures = "0.3"
+futures-util = "0.3"
+fs2 = "0.4"
+hex = "0.4"
+parity-scale-codec = { version = "3", features = ["derive"] }
+ratatui = { version = "0.30.2", default-features = false, features = ["crossterm", "unstable-rendered-line-info"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+rustls = { version = "0.23", default-features = false, features = ["ring"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+shlex = "1"
+subxt-rpcs = { version = "0.50.1", default-features = false, features = ["jsonrpsee", "native"] }
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "io-util", "io-std", "net", "time", "signal", "process"] }
+tokio-stream = { version = "0.1", features = ["sync"] }
+tokio-tungstenite = { version = "0.24", features = ["connect", "rustls-tls-webpki-roots"] }
+# TLS is compiled in for required People/Bulletin host traffic and optional
+# `Chain/*` playground methods. Product live-chain routing is opt-in
+# (`E2E_LIVE_CHAIN=1`); required host routes remain enabled. See src/chain.rs.
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["fmt", "env-filter"] }
+unicode-width = "0.2"
+
+[dev-dependencies]
+tempfile = "3"