Struct Wallets 

pub struct Wallets { /* private fields */ }

Linking a person’s own EVM or Solana wallet to their signed-in account.

Implementations

impl Wallets

pub fn builder() -> WalletsBuilder

A builder with no domain and no entropy source — not a working composition until .domain(..) and .random(..) are set; Module::self_check names what is missing.

pub fn new() -> Self

Short for Wallets::builder().build().

Trait Implementations

impl Default for Wallets

fn default() -> Self

Returns the “default value” for a type.

impl Module for Wallets

fn requires(&self) -> &'static [Port]

Nonces and links live in the database, and every route answers only to a signed-in caller — a wallet signature proves ownership of an address, never of a session.

fn optional(&self) -> &'static [Port]

The Clock decides “now” for nonce and message expiry. The IdGen names each link; without one the handler falls back to a derived id.

fn personal_data(&self) -> &'static [PersonalDataSet]

Two subject-owned datasets, one per table.

wallet_nonces is an attempt in flight: who asked for a nonce, for which chain, and when it lapsed. It says nothing about a wallet — the address arrives in the signed message, and the row is deleted once it expires whether or not it was ever spent.

wallet_links is the durable one: the address a person proved they control, the chain it lives on and when it was linked. It is Erase, because a person who deletes their account expects the wallet they linked to it to go with it — a wallet address is a durable identifier, not a receipt.

fn validate_config(&self, _cfg: &dyn Config) -> Result<(), ConfigError>

No configuration keys of its own: the composition is what a venture decides, and self_check reports a composition that cannot verify a single signature.

fn surface(&self) -> Surface

The four routes, all Audience::Subject.

They are RoutePolicy::Open at the gateway and authenticate themselves, deliberately: the proof here is not a signed link or a CAPTCHA but a signature over a message the caller had to be signed in to fetch, and a CAPTCHA on a POST from a wallet extension would be a widget nobody can solve. The handlers refuse an anonymous or unidentified caller before touching a byte of body, and Port::Auth is required, so a deployment cannot mount these without a way to identify callers at all.

fn scheduled<'a>( &'a self, ctx: &'a ModuleContext, cron: &'a str, ) -> BoxFuture<'a, Result<(), AnyError>>

The scheduled purge: nonces past their expiry are deleted, spent or not. A spent nonce is already useless, and a lapsed one is the only kind worth reclaiming — leaving them would let the table grow without bound and leave rows describing when each account was trying to connect a wallet. One statement, so it spends one unit of the invocation’s budget (ADR 0023).

fn name(&self) -> &'static str

Kebab-case name; mounted at /v1/<name>.

fn version(&self) -> &'static str

env!("CARGO_PKG_VERSION"), surfaced by /__health.

fn tables(&self) -> &'static [&'static str]

Table names this module owns; duplicates across modules are a build error.

fn migrations(&self) -> Migrations

The module’s migrations, embedded per dialect.

fn self_check(&self) -> Vec<String>

Problems the module can find in itself, with no configuration and no environment: its own embedded data, checked against its own declarations.

fn router(&self, ctx: ModuleContext) -> Router

The module’s router, nested under /v1/<name>.

fn harness_api(&self) -> u32

Contract version, checked by Harness::build.

fn depends_on(&self) -> &'static [&'static str]

Modules this one’s schema sits on top of, by name.

fn actor_kinds(&self) -> &'static [&'static str]

Actor kinds this module owns, each [a-z0-9_-]; duplicates across modules are a build error, and so is a kind with no handler registered through HarnessBuilder::actor.

fn emits(&self) -> &'static [&'static str]

Event names this module emits ("<module>.<event>"), listed by /__health.

fn public_writes(&self) -> bool

Whether the module has public write endpoints.

fn public_write_policy(&self) -> RoutePolicy

What actually protects those public writes, for a module with no ADR 0010 surface to hang a per-action RoutePolicy on (issue #143).

fn signature_verification(&self) -> SignatureVerification

Which verifier proves this module’s RoutePolicy::Signature deliveries (issue #533): how a webhook handler checks a machine signature before acting.

fn max_body_bytes(&self, _cfg: &dyn Config) -> usize

The largest request body any route of this module accepts, so a runtime can refuse an oversize body before buffering it (issue #440).

fn streaming_routes(&self) -> &'static [StreamRoute]

Routes this module serves in streaming mode (issue #585), each with its own StreamRoute::max_bytes ceiling. Opt-in: the default is empty, and every existing route keeps the buffered behaviour it always had.

fn max_blob_object_bytes(&self) -> u64

The largest object this module’s streamed and multipart blob writes may produce (issue #586), enforced by the ScopedBlob the harness hands the module on put_stream, upload_part and complete_multipart.

fn well_known(&self) -> Option<Router>

Routes this module serves at the root under /.well-known, for spec-mandated discovery documents (OIDC openid-configuration, jwks.json) that must live outside /v1 (issue #46). Paths are relative to the prefix: register /jwks.json, not /.well-known/jwks.json.

fn events( &self, ) -> Vec<(String, Arc<dyn Fn(&Scope, Value) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn Error + Sync + Send>>> + Send>> + Sync + Send>)>

Handlers for events other modules emit; registered at Harness::build.