feat(platform,server): match manifest execution kinds and serve custom chat rendering from a JS host

[johnthecat]

Six changes Polkadot Desktop needs to run its worker on the shared core.

Execution kinds match the manifest

ProductExecutionKind is App | Widget | Worker, matching the kinds a product manifest declares. Worker is the only kind that serves Chat. App and Widget reach the same APIs and differ only in how a host presents them.

SCALE indices are App=0, Widget=1, Worker=2, so this is a wire change and not only a rename. A host still encoding 1 for its worker claims to be a widget and loses Chat. Paired Rust and TypeScript tests pin all three, and the wasm entrypoint rejects an unknown kind rather than falling back to a default.

The host CLI's --execution-kind takes app and worker, the same names, so reading --execution-kind worker no longer requires knowing that chat meant a Worker. The checked-in diagnosis reports keep their spa/ and chat/ directories, which name a report's modality rather than an executable kind, and the explorer matrix reads those paths.

Custom chat messages reach a JS host

renderCustomMessage?(request, sink): () => void;
publishChatAction?(action): Promise<void>;

renderCustomMessage streams the trees a product draws for one stored custom message. publishChatAction carries a tapped button back to the product. A host with only the first draws buttons that do nothing, so both land together. Both sit behind the Chat access policy that governs every other Chat call.

Host-initiated subscriptions report failure

A product that cannot serve a render sends _interrupt. One that finishes sends nothing at all (js/packages/truapi/src/client.ts:405-433). HostInitiatedSubscription yields Result<Item, GenericError> so those two stay distinct. onComplete means the last tree delivered stands, onError means it is partial. A dropped sender is a clean end, since that is the host closing the manager rather than the product failing.

NativeCustomRendererObserver gains on_error(reason), and the Swift conformer finishes throwing.

Product subtree keys survive a restart

CoreStorageKey::ProductSubtree { session_id, product_id } holds the 32-byte key unframed. One slot per product keeps a persist to a single write rather than a read-modify-write of a whole session, and lets a host derive addresses from a slot it already stores.

Lookup order is memory, storage, wallet. A stored key passes the same currency check as a freshly fetched one. A persist runs under the session-secret storage guard and rolls its entry back if the pairing is lost mid-write. A slot that is not exactly 32 bytes reads as a miss, so a damaged entry re-asks the wallet rather than deriving a wrong account.

Product accounts derive in a JS host

deriveProductAccountPublicKey(subtreePublicKey, derivationIndex) -> Uint8Array
productAccountAddress(publicKey) -> string

Both pure, exported from @parity/truapi-host/wasm/web. The index crosses as a SCALE-encoded DerivationIndex, which keeps the 32-byte chain code core-owned. That is the reason for the shape. The chain code is a u32 little-endian followed by an index magic, and a host that rebuilds it wrongly does not fail. It gets a valid-looking wrong address, on a signing review, beside a fee fetched for the wrong account. The wire index also handles Raw selectors, which a hand-rolled u32 path gets silently wrong.

productAccountAddress applies the prefix host-spec C.6 fixes. The composition is pinned against the vector the mobile hosts share.

Hosts resolve a subtree key on their own deadline

async fn get_product_subtree_public_key(
    &self,
    product_id: String,
    timeout_ms: Option<u32>,
) -> Result<Option<Bytes32>, GenericError>;

Memory cache, then the persisted slot, then the Account Holder. The wallet answers without prompting the user, though it can wake the phone. A signing host derives locally and never waits. None means no active session. Missing the deadline is an error.

The deadline drops the call rather than cancelling it and waiting for it to finish. Only the SSO response wait watches the cancellation token. The statement-store client acquisition and topic subscriptions ahead of it do not, so a call parked there ignores a cancel and outlives a deadline that waits on it. A test with an unanswerable wallet pins this, and hung four runs in five before the call was dropped instead.

Passing no deadline keeps the timeout a product gets while awaiting a signature. That is three minutes, which is far too long to hold a render, so a host drawing one should pass its own.

Reached over the worker protocol as well, so a worker-runtime host uses its existing wasm instance instead of initialising a second one to reach the derivation exports.

Two crash-shaped bugs in the worker bridge

A tree the host's codec cannot decode, or a renderer that throws on one, ends that render through onError. Such a throw escaping the worker message listener leaves the render with no terminal at all, so a caller awaiting one waits forever. Products built against a newer protocol than the host's bundled @parity/truapi are the realistic trigger.

Render subscriptions are keyed by core on both sides of the worker boundary, and a disposed provider fails its outstanding renders. Desktop runs one provider per open product plus one per worker, so cross-product cancellation is reachable there.

CoreStorage documents the product-slot sweep

Session teardown drops only the product-indexed slots the core holds in memory, so a product never opened during a run keeps its entries. CoreStorage says clearing those belongs to the host, covering PermissionAuthorization, AutoSigningKey and ProductSubtree rather than the subtree alone, and names describe_core_storage_key as the way to find a slot's owner. The trait doc reaches JS hosts through codegen.

Notes

Merges from main carry chat work written against the old ProductExecutionKind names, and git reports no conflict when the enum comes from this branch and the call sites come from the other. Compile after one rather than trusting it.

remote_authority_call, which every product signing path uses, has the same gap: it cancels and then awaits, so its deadline is not a hard bound either. Left alone here, since fixing it touches every signing call.

cargo test --workspace --all-features 998 passed 0 failed, cargo clippy --workspace --all-targets --all-features -- -D warnings, cargo +nightly fmt --all --check, cargo check --target wasm32-unknown-unknown -p truapi-server, codegen goldens, sync-bindings.sh, @parity/truapi 231 tests, @parity/truapi-host 65 tests, explorer typecheck, playground build and lint.

[filvecchiato]

Looks good to me - just CI needs fixing

[TarikGul]

Nice job, one small nit - if we can get this merged soon that would be amazing