WIP refactor: replace @novasamatech with @parity/truapi

[valentinfernandez1]

Summary

Replaces the third-party @novasamatech/host-api-wrapper (plus host-api and sdk-statement) with our in-house @parity/truapi client. The whole host-API surface now goes through truapi; neither @parity/product-sdk-host nor @parity/product-sdk-signer imports the wrapper at runtime anymore.

What moved to @parity/truapi

• Host API: getTruApi, requestPermission / requestDevicePermission, deriveEntropy, requestResourceAllocation, host localStorage, isInsideContainer.
• Statement store: getStatementStore, createProofAuthorized (the RFC-10 sponsored path), subscribe / submit. @parity/product-sdk-statement-store no longer depends on @novasamatech/sdk-statement, and its statement types are derived from the truapi wire types now, so protocol changes flow through automatically.
• Preimage: getPreimageManager / createHostPreimageManager.
• Theme / chat / payments: getThemeProvider, getChatManager, getPaymentManager.
• Chain provider: getHostProvider, the PAPI JsonRpcProvider. This one is a backport of the wrapper's createPapiProvider into a new papi-provider module, rebuilt on chain.* + system.featureSupported.
• Accounts + signer: getAccountsProvider, a new accounts module (backport of createAccountsProvider) on account.* + signing.*, including the PAPI PolkadotSigner factories. The signer's HostProvider now just consumes host's getAccountsProvider and asks for ChainSubmit through host's requestPermission, instead of importing the wrapper itself.

Dependencies

Removed @novasamatech/host-api, host-api-wrapper, and sdk-statement everywhere they were declared: host, signer, the example demos, the catalog, and the tsup external lists. @parity/truapi is now a hard dependency of host, along with @polkadot-api/json-rpc-provider (for the PAPI provider) and @polkadot-api/substrate-bindings (the signer needs it to decode metadata).

@parity/product-sdk-terminal is out of scope here. It depends on a different @novasamatech family (host-papp / statement-store / storage-adapter) that has nothing to do with the host-api wrapper.

Before merge: @parity/truapi@0.3.0 is now published. The local .pnpmfile.cjs link has been removed and the workspace resolves it from the registry via the catalog (^0.3.0); the lockfile points at the published package. The only remaining step is promoting the parked changeset (pending-changesets/migrate-host-statement-store-to-truapi.md → .changeset/), done in the dedicated release PR.

Breaking change: the getTruApi() client shape

If you only use the high-level helpers (getStatementStore, getPaymentManager, getThemeProvider, getChatManager, getHostProvider, getAccountsProvider, requestPermission, …), nothing changes for you.

The raw client from getTruApi() is a different story. It went from the flat, versioned wrapper shape to truapi's namespaced client. Four things change at basically every call site:

1. Methods sit under a domain now. truApi.devicePermission(…) becomes truApi.permissions.requestDevicePermission(…).
2. The { tag: "v1", value } envelope is gone. Pass the request straight in; truapi handles versioning internally.
3. Requests and responses use named fields instead of tuples or a bare res.value. An account id is { dotNsIdentifier, derivationIndex } (not [dotNs, idx]), a chain is { genesisHash }, raw bytes are { bytes: "0x…" }, and responses read res.granted / res.supported / res.signature / res.outcomes.
4. Errors follow truapi's shapes. GenericError is { reason } and tagged errors are { tag, value? } (previously { value: { name, … } }).

// before
const r = await truApi.devicePermission({ tag: "v1", value: "Camera" });
r.match((res) => res.value, (err) => err.value.name);

// after
const r = await truApi.permissions.requestDevicePermission("Camera");
r.match((res) => res.granted, (err) => err.reason);

A few smaller ones worth calling out: ChatMessageContent's Text variant wraps its string as { text } now, chat custom-message rendering is gone (truapi has no equivalent yet), and host-mode statement submission uses the RFC-10 sponsored path.

The full cheat-sheet and worked examples are in the guide: Migrating to @parity/truapi.

Validation

I tested this against host-playground, which has a harness in src/lib/tests.ts with one entry per host-API method. Each one calls the real method against the SDK inside a live host container and checks the result.

What I did:

1. Linked the working-tree host, signer, and chain-client packages into host-playground.
2. Updated every getTruApi() call in tests.ts to the new shapes (the same changes the guide describes: domain methods, no { tag: "v1" } envelopes, object account ids, { bytes } payloads, the new response and error fields).
3. Ran the whole harness.