feat: create transaction refinement

[johnthecat]

Refines host_create_transaction and the product-account signer

Cleans up the create-transaction API and makes getProductAccountSigner actually produce a usable PAPI signer.

Protocol changes

host_create_transaction / host_create_transaction_with_legacy_account:

• The account moves into the payload as a typed signer field. The separate accountId parameter is gone.
• The context block (runtime metadata, token symbol/decimals, best block height) is dropped — the signer is online and reads those from the chain.
• The VersionedTxPayload envelope is gone — pass TxPayloadV1<Signer> directly. signer is required (was Option<str>).

Before:

fn host_create_transaction(
  accountId: ProductAccountId,
  payload: VersionedTxPayload // wraps TxPayloadV1 { signer, callData, extensions, txExtVersion, context }
) -> Result<Vec<u8>, CreateTransactionErr>;

After:

fn host_create_transaction(
  payload: TxPayloadV1<ProductAccountId> // { signer, genesisHash, callData, extensions, txExtVersion }
) -> Result<Vec<u8>, CreateTransactionErr>;

product-sdk

• getProductAccountSigner(account) now returns a PolkadotSigner whose signTx routes through host_create_transaction and returns a fully signed extrinsic. Previously it returned a detached signature via host_sign_payload and made the caller assemble the extrinsic.

• New top-level accounts export — a ready-to-use provider built on the default sandbox transport, so products that don't need a custom transport can skip createAccountsProvider():

  import { accounts } from '@novasamatech/product-sdk';
  
  const result = await accounts.getProductAccount('product.dot', 0);
  if (result.isOk()) {
    const signer = accounts.getProductAccountSigner(result.value);
    await tx.signAndSubmit(signer);
  }

• Signer.createTransaction payload shape changes to match the new TxPayloadV1 (no version, no context, typed signer).

• Exports ProductAccountId and LegacyAccount types.

• New runtime dependency: @polkadot-api/substrate-bindings (used to read the extrinsic version from metadata).

host-papp

• UserSession gains createTransaction(payload). The Host can now delegate product-account transaction signing to the paired Polkadot Mobile app over SSO via the new CreateTransactionRequest / CreateTransactionResponse message pair. Legacy-account signing stays Host-local.

Compatibility

No shim. host_create_transaction had no production consumers and host_create_transaction_with_legacy_account is only reachable via product-sdk, which is bumped in lockstep.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​novasamatech/​storage-adapter@​0.7.8 ⏵ 0.7.9-6				+1
	@​novasamatech/​tr-ui@​0.2.7 ⏵ 0.2.9	-5		+1	+1
	@​novasamatech/​scale@​0.7.8 ⏵ 0.7.9-6				+1
	@​types/​qrcode@​1.5.6
	@​novasamatech/​statement-store@​0.7.8 ⏵ 0.7.9-6				+1
	@​novasamatech/​host-api-wrapper@​0.7.8 ⏵ 0.7.9-6	-24			-8
	@​novasamatech/​host-container@​0.7.8 ⏵ 0.7.9-6	+1		+1	+1
	@​novasamatech/​host-api@​0.7.8 ⏵ 0.7.9-6	+1			+1
	@​novasamatech/​host-papp@​0.7.8 ⏵ 0.7.9-6	+1		+1	+1
	qrcode@​1.5.4

View full report