Module server

Modules§

audit: PERMISSION AUDIT — record what a REAL wallet would have prompted the user for.
broadcast_follow_up: What the served /createAction does AFTER Wallet::create_action returns.
handlers
types

bind_addr_from_env: The address to bind: BIND_ADDR when it parses, else 127.0.0.1. Read by every served command and by the bind guard, so the two agree.
make_router: Build the axum Router with all 28 WalletInterface endpoints.
make_wallet_state
make_wallet_state_from_arc: Build a WalletState from an existing Arc<Wallet>.
refuse_open_bind: The bind guard (0.7.1). With no bearer token a served wallet answers any caller that can reach it, and its two BEEF doors take a body of any size (0.7.0), so an address beyond loopback needs a token or the operator’s explicit allow_no_token. An empty token counts as none. Loopback is unchanged. Run at startup, before the wallet is opened or a socket bound.
refuse_open_bind_from_env: refuse_open_bind on the environment the served commands read (BIND_ADDR, AUTH_TOKEN).
run
sanitize_lone_surrogates: Browser wallets accept JSON whose strings carry lone UTF-16 surrogate escapes ("\ud83d" without its pair); serde does not, so a page whose keyID or data happened to contain one got 400 Failed to parse the request body as JSON: keyID: lone leading surrogate from this wallet while MetaNet Desktop served the same call (beta soak, 2026-09-02, two logins lost). A browser’s encoder turns such a code unit into U+FFFD when it hashes the string, so the same substitution here yields the same bytes the JS wallet would derive from.

SpendingLock: Lock that serializes spending operations (createAction). Non-spending endpoints (encrypt, getPublicKey, listOutputs, etc.) are unaffected.