feat(carpincho-wallet): amulet faucet, per-origin gating, activity & utils tabs, vault backup, and 3-step onboarding

.gitignore

@@ -8,6 +8,7 @@ dist-extension/
 # env
 .env
 .env.local
+.env.fivenorth
 
 # typescript
 *.tsbuildinfo

canton-barebones/wallet-service/AGENTS.md

@@ -4,7 +4,7 @@ This file applies only to `canton-barebones/wallet-service/`. For monorepo-wide
 
 ## Scope
 
-The wallet-service is a consumer-dApp-agnostic Express JSON-RPC bridge between Carpincho and the local Canton participant. It holds the Canton bearer token boundary, prepares and executes transactions, proxies participant reads, exposes CIP-56 token-standard reads/transfers and Amulet (Canton Coin) preapproval management, and handles wallet-internal party onboarding.
+The wallet-service is a consumer-dApp-agnostic Express JSON-RPC bridge between Carpincho and the local Canton participant. It holds the Canton bearer token boundary, prepares and executes transactions, proxies participant reads, exposes CIP-56 token-standard reads/transfers and Amulet (Canton Coin) preapproval management and DevNet faucet tap, and handles wallet-internal party onboarding.
 
 ## Working Rules
 

canton-barebones/wallet-service/README.md

@@ -76,8 +76,9 @@ These add Canton token-standard reads and transfers plus Amulet (Canton Coin) pr
 | `amulet.preapproval.create` | Prepares enabling Amulet auto-accept. |
 | `amulet.preapproval.cancel` | Prepares disabling Amulet auto-accept. |
 | `amulet.preapproval.acceptProposal` | Accepts a `TransferPreapprovalProposal` for the receiver. |
+| `amulet.tap` | Prepares the fixed 100 AMT Splice DevNet faucet tap for a receiver (DevNet only). |
 
-The write methods (`create*`, `acceptTransfer`, `amulet.preapproval.create/cancel/acceptProposal`) return prepared transactions; Carpincho signs locally and submits via `executePrepared`.
+The write methods (`create*`, `acceptTransfer`, `amulet.preapproval.create/cancel/acceptProposal`, `amulet.tap`) return prepared transactions; Carpincho signs locally and submits via `executePrepared`.
 
 `prepareExecute`, `prepareExecuteAndWait`, and `signMessage` stay in
 Carpincho because they require the user's key and approval UI.

canton-barebones/wallet-service/src/mock.ts

@@ -159,6 +159,11 @@ export const createMockRpc = (
           return rpcResult(id, { commands: [], disclosedContracts: [] })
         case 'amulet.preapproval.status':
           return rpcResult(id, { active: false, expired: false })
+        case 'amulet.tap':
+          return rpcResult(id, {
+            commands: { ExerciseCommand: { choice: 'AmuletRules_DevNet_Tap' } },
+            disclosedContracts: [],
+          })
         case 'amulet.preapproval.create':
         case 'amulet.preapproval.cancel':
           return rpcResult(id, { commands: [], disclosedContracts: [] })
@@ -218,6 +223,7 @@ export const createMockRpc = (
       'cip56.listHoldings',
       'cip56.createTransfer',
       'amulet.preapproval.status',
+      'amulet.tap',
       'amulet.preapproval.create',
       'amulet.preapproval.acceptProposal',
       'amulet.preapproval.cancel',

canton-barebones/wallet-service/src/rpc.ts

@@ -105,6 +105,7 @@ type ActiveJsContractReader = {
 
 type Cip56TokenSdk = {
   amulet?: {
+    tap?: (receiver: string, amount: string) => Promise<[unknown, unknown[]]>
     preapproval: {
       ctx?: {
         validatorParty?: string
@@ -256,6 +257,7 @@ const TRANSFER_PREAPPROVAL_PROPOSAL_TEMPLATE_ID =
   '#splice-wallet:Splice.Wallet.TransferPreapproval:TransferPreapprovalProposal'
 const TRANSFER_PREAPPROVAL_PROPOSAL_MAX_ATTEMPTS = 31
 const TRANSFER_PREAPPROVAL_PROPOSAL_RETRY_MS = 1_000
+const AMULET_TAP_AMOUNT = '100'
 
 export const rpcResult = (id: JsonRpcId, result: unknown): JsonRpcSuccess => ({
   jsonrpc: '2.0',
@@ -571,7 +573,7 @@ export const createRpc = (config: WalletServiceConfig, deps: RpcDependencies = {
       amulet: {
         validatorUrl: config.splice.validatorUrl,
         scanApiUrl: config.splice.scanApiUrl,
-        registryUrl: config.splice.registryApiUrl,
+        registryUrl: new URL(config.splice.registryApiUrl),
         auth,
       },
     })
@@ -880,6 +882,20 @@ export const createRpc = (config: WalletServiceConfig, deps: RpcDependencies = {
     }
   }
 
+  // Prepares the fixed DevNet tap command so Carpincho can sign as the receiver.
+  const amuletTap = async (
+    params: unknown,
+  ): Promise<{ commands: unknown; disclosedContracts: unknown[] }> => {
+    const p = objectParam<Record<string, unknown>>(params, 'amulet.tap')
+    const receiver = requiredStringParam(p, 'receiver')
+    const sdk = await getTokenSdk()
+    if (sdk.amulet?.tap === undefined) {
+      throw new Error('Amulet tap is unavailable')
+    }
+    const [commands, disclosedContracts] = await sdk.amulet.tap(receiver, AMULET_TAP_AMOUNT)
+    return { commands, disclosedContracts }
+  }
+
   // Prepares the receiver-signed proposal that asks the validator provider to enable auto-accept.
   const amuletPreapprovalCreate = async (
     params: unknown,
@@ -1082,6 +1098,8 @@ export const createRpc = (config: WalletServiceConfig, deps: RpcDependencies = {
           return rpcResult(id, await cip56CreateTransfer(request.params))
         case 'amulet.preapproval.status':
           return rpcResult(id, await amuletPreapprovalStatus(request.params))
+        case 'amulet.tap':
+          return rpcResult(id, await amuletTap(request.params))
         case 'amulet.preapproval.create':
           return rpcResult(id, await amuletPreapprovalCreate(request.params))
         case 'amulet.preapproval.acceptProposal':
@@ -1137,6 +1155,7 @@ export const createRpc = (config: WalletServiceConfig, deps: RpcDependencies = {
       'cip56.acceptTransfer',
       'cip56.createTransfer',
       'amulet.preapproval.status',
+      'amulet.tap',
       'amulet.preapproval.create',
       'amulet.preapproval.acceptProposal',
       'amulet.preapproval.cancel',

canton-barebones/wallet-service/test/rpc.test.ts

@@ -246,7 +246,7 @@ describe('CIP-56 token helpers', () => {
     assert.deepEqual(seen.amuletConfig, {
       validatorUrl: 'http://localhost:2000/api/validator',
       scanApiUrl: 'http://scan.localhost:4000/api/scan',
-      registryUrl: 'http://localhost:2000/api/validator/v0/scan-proxy',
+      registryUrl: new URL('http://localhost:2000/api/validator/v0/scan-proxy'),
       auth: { method: 'static', token: 'backend.jwt' },
     })
   })
@@ -465,6 +465,39 @@ describe('CIP-56 token helpers', () => {
     })
   })
 
+  it('prepares a fixed DevNet Amulet tap command for the receiver party', async () => {
+    // Scenario: Carpincho needs a test-only faucet button that requests a fixed
+    // 100 AMT for the selected external party while preserving local signing.
+    const disclosedContracts = [{ contractId: 'tap-context-cid', createdEventBlob: 'blob' }]
+    const seen: { receiver?: string; amount?: string } = {}
+    const rpc = createRpc(withToken(), {
+      sdkFactory: async () => ({
+        amulet: {
+          tap: async (receiver: string, amount: string) => {
+            seen.receiver = receiver
+            seen.amount = amount
+            return [{ ExerciseCommand: { choice: 'AmuletRules_DevNet_Tap' } }, disclosedContracts]
+          },
+        },
+      }),
+    })
+
+    const res = (await rpc.handle({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'amulet.tap',
+      params: { receiver: 'receiver::party' },
+    })) as JsonRpcResponse
+
+    assert.ok('result' in res)
+    assert.deepEqual(res.result, {
+      commands: { ExerciseCommand: { choice: 'AmuletRules_DevNet_Tap' } },
+      disclosedContracts,
+    })
+    assert.equal(seen.receiver, 'receiver::party')
+    assert.equal(seen.amount, '100')
+  })
+
   it('accepts an Amulet transfer preapproval proposal as the validator provider', async () => {
     // Scenario: after Carpincho creates the receiver-signed proposal, the local
     // validator provider must accept it with a normal participant submit.

carpincho-wallet/.env.example

@@ -0,0 +1,4 @@
+# Optional. Minimum zxcvbn strength score (0-4) required to set a vault password.
+# 0 too weak, 1 very guessable, 2 fair, 3 strong, 4 excellent.
+# Defaults to 1 when unset. Use 3 for a security-conscious build.
+# VITE_MIN_PASSWORD_SCORE=1

carpincho-wallet/README.md

@@ -2,7 +2,7 @@
 
 Standalone browser wallet for the Canton barebones.
 
-Carpincho is a wallet/provider UI with an encrypted local vault, an injected CIP-0103 browser provider, and optional WalletConnect support. A dApp connects to Carpincho through the injected provider by default; Carpincho answers wallet/provider requests and forwards Canton execution requests to the app's wallet-service JSON-RPC endpoint.
+Carpincho is a wallet/provider UI with an encrypted local vault, an injected CIP-0103 browser provider, and optional WalletConnect support. A dApp connects to Carpincho through the injected provider by default; Carpincho answers wallet/provider requests and forwards Canton execution requests to the app's wallet-service JSON-RPC endpoint. A dApp must be explicitly approved per origin before Carpincho exposes accounts or signs for it: an unapproved site sees no accounts, and the first `connect` opens an approval prompt in Carpincho.
 
 ```text
 dApp frontend -> injected CIP-0103 provider -> carpincho-wallet -> wallet-service /rpc -> Canton participant