Talk to Canton directly and drop wallet-service #36

Objective

Carpincho should talk to a Canton participant directly from the browser using the Canton wallet SDK, and stop forwarding every operation to canton-wallet-service.

Rationale

wallet-service exists only because the Canton libraries could once be imported from Node but not from a browser. That is no longer true. Removing it drops a repository, a deployment and a DigitalOcean droplet, and takes a whole integration out of the stack. A spike proved the SDK runs inside the extension against LocalNet, creating and verifying a real external party with wallet-service switched off.

Scope

In scope:

• prepareTransaction and executePrepared
• ledgerApi passthrough, for dApps and for internal reads
• cip56 holdings, holding summary and pending transfers
• cip56 create transfer and accept transfer
• amulet preapproval status, create, cancel, accept proposal, and tap
• External party onboarding, replacing the two admin endpoints
• DAR upload as a ledger call
• Provider status and getActiveNetwork, including where the network id comes from
• Endpoint reachability and the Test button, which lose /health
• WalletConnect's use of the network id
• Endpoint config: ledger, validator, scan and registry urls plus a token, with a migration
• Vite alias, dynamic import and dev-server proxy
• Reworking the tests that stub wallet-service
• Updating architecture.md and CLAUDE.md

Out of scope:

• canton-dappbooster changes
• dappbooster-canton-landing changes
• Archiving canton-wallet-service and retiring the droplet

Architecture & technical considerations

• @canton-network/wallet-sdk 1.5.1 bundles for the browser at 188 kB gzip, no polyfills and no gRPC
• The SDK only needs the HTTP JSON API url; the grpc:// urls in wallet-service config are metadata
• @mojotech/json-type-validation ships a broken ESM entry holding a bare require; fix with a Vite resolve.alias to its UMD build
• Dynamic-import the SDK so it stays out of the popup startup chunk, as src/wc/client.ts does for WalletConnect
• The extension bypasses CORS through host_permissions; the local web build needs a dev-server proxy for the ledger api
• Hosted validators use an OAuth client credentials grant, which a browser cannot hold; this needs a public client with PKCE
• Holdings are read by paging the active contracts snapshot, not by sdk.token.utxos.list
• The network id is a value wallet-service is configured with, not something the ledger reports. Issue Changing an endpoint's networkId label hides every account on that network #29 showed accounts must not be keyed on it, so it likely becomes a per-endpoint label
• Decide whether the bearer token lives in the encrypted vault or in plain storage
• Error codes and messages reaching dApps change; wallet-service unavailable: is currently part of the status payload

Dependencies

• canton-dappbooster PR 199 merged, so the wallet need not serve the dApp an Amulet transfer context
• The token decision for hosted validators has to land before the endpoint config work
• Blocks archiving canton-wallet-service and retiring its droplet

Issue breakdown

• Decide how the wallet gets a ledger token, for LocalNet and for hosted validators
• Add the SDK, the Vite alias and the dynamic import
• Move prepareTransaction, executePrepared and ledgerApi
• Move the cip56 reads
• Move the cip56 transfers
• Move amulet preapproval and tap
• Move external party onboarding
• Move DAR upload
• Decide and implement the network id source, covering status, getActiveNetwork and WalletConnect
• Redefine endpoint reachability and the Test button
• Reshape the endpoint config and migrate stored endpoints
• Rework the tests that stub wallet-service
• Delete src/api/walletService.ts
• Update architecture.md and CLAUDE.md

Acceptance criteria

• Every Canton operation works with wallet-service stopped
• Account creation, send, accept, auto-accept, tap, active contracts, create, exercise and DAR upload all pass in the extension against LocalNet
• The local web build works against LocalNet
• dApps still get a network id from status and getActiveNetwork
• WalletConnect pairing still resolves a network id
• Stored endpoints migrate without the user re-entering anything
• No reference to wallet-service remains in src/
• architecture.md and CLAUDE.md describe the new data flow
• lint, typecheck, test, knip, build and build:extension pass