fix(truapi-host): serve the host surface from a signing worker host

[johnthecat]

A web host booted with createWebWorkerPairingHostRuntime(worker, callbacks, { role: "signing" }) serves the same host surface as a pairing host.

Why

dotli's local wallet mode boots a signing host on the testing bundle. When it mounts a product it reads stored device permissions to build the iframe allow attribute, and the worker failed with runtime.permissionAuthorizationStatuses is not a function, so no product loaded. WasmSigningHostRuntime had no permission methods. TypeScript did not catch this because the worker's WorkerSigningHostRuntime type extended the pairing type and claimed every pairing method.

What the signing host does

• SigningHostRuntime has permission_authorization_status, permission_authorization_statuses and set_permission_authorization_status, delegating to its HostAdmin as PairingHostRuntime does. WasmSigningHostRuntime exposes them under the pairing wrapper's names and signatures, plus notifyContactsChanged.
• The signing wasm constructor installs every optional platform adapter the pairing constructor installs: chat, contacts and the device permission status host. Each adapter field is named, so a new one cannot be dropped from one constructor. A device capability the browser blocks reads as Denied whatever is stored, and on the test host a Worker product's chat calls reach the mock, which is what the Playwright fixture's getChatRooms, getChatBots and getChatMessageLog record.
• The worker records the role it booted. WorkerHostRuntime holds what both runtimes offer, and the pairing and signing types extend it with only their own methods, so a role-specific call has to check the role. A request only a pairing host answers, such as getSessionChatIdentityKey or activateStoredSession, rejects with an error naming the request. cancelPairing and notifySessionStoreChanged do nothing on a signing host, which has no pairing and no stored session.

The worker's runtime types are internal. The published wasm/* types come from the wasm-bindgen declarations, which gain methods only.

Testing

src/worker-signing-host.test.ts runs the real createWebWorkerPairingHostRuntime against the real worker script and the testing bundle in one process, which is the path dotli takes. It covers a permission read through the browser's device gate, a Worker product's chat call reaching the mock host, and a pairing-only request being refused by name. Each case fails against the previous code.

Locally: make wasm, REQUIRE_WASM=1 bun test in js/packages/truapi-host, tsc, rustfmt, and clippy for the native (--all-features) and wasm (wasm-signing-host,test-host) builds of truapi. Not run: the workspace cargo test and the browser Playwright suites.

[github-actions]

Bundle size report

Compared with main at ac4aed0.

	Raw	Gzip	Brotli
truapi-host	7.86 MiB (+916 B)	5.65 MiB (+161 B)	5.38 MiB (+25 B)
truapi-provider	4.03 MiB	1.27 MiB	959.8 KiB
truapi	6.01 MiB	849.3 KiB	695.9 KiB
Total	17.90 MiB (+916 B)	7.75 MiB (+161 B)	7.00 MiB (+25 B)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.75 MiB	980.8 KiB (+13 B)	739.3 KiB (-132 B)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.1 KiB

Changed files (1)

	Raw	Gzip	Brotli
truapi-host/worker-runtime.js	38.5 KiB (+916 B, +2.4%)	9.8 KiB (+148 B, +1.5%)	8.6 KiB (+157 B, +1.8%)

_{Commit: 372ef47}

[github-actions]

CI Status: 24 required jobs green, 21 passed and 3 skipped by path filter.

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	success
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-09, a release may fail

_{Commit 372ef47c · run log}