feat(truapi): pay withdrawals into their account as getcash does

.changeset/funding-withdraw-payment.md

@@ -0,0 +1,5 @@
+---
+"@parity/truapi": patch
+---
+
+`assign_funding_withdrawal` gives an outbound funding session its withdrawal account and asks the host for the user's payment into it, as getcash pays its withdrawal key; the watch follows the payment to `Paid`, retries it under a new id, and expires it after 30 minutes untaken (Rust and native API).

rust/crates/truapi-host-cli/src/funding_check.rs

@@ -375,7 +375,8 @@ async fn follow(runtime: &SigningHostRuntime, intent: &str) -> Result<()> {
             FundingStage::Open
             | FundingStage::Converting { .. }
             | FundingStage::Converted
-            | FundingStage::Crediting { .. } => {}
+            | FundingStage::Crediting { .. }
+            | FundingStage::Paid { .. } => {}
         }
         tokio::time::sleep(POLL).await;
     }

rust/crates/truapi/RUNTIME.md

@@ -429,6 +429,18 @@ AutoSigning without approval. Legacy-account signing still asks the user.
   the account, stays out of the history bound, and `retry_funding` picks it
   up: the conversion again by its route, or the credit from its last
   attempt. A product sees the retried session by subscribing again.
+  For a withdrawal, `assign_funding_withdrawal` gives an outbound session
+  that names its amount a `wd:eph:<destination>:<n>` account, the next one
+  with no CASH on People, and asks the host's `PaymentPlatform` to have the
+  user pay the amount into it, as the funding product, under getcash's
+  payment ids (the account, then `blake2(account ‖ attempt)`). The watch
+  reads the account's CASH and the host's latest word on the current
+  attempt: CASH there moves the session to `Paid`, a payment under way no
+  longer expires, a failed or refused one ends the session for
+  `retry_funding`, which asks again under the next id while the account is
+  still read, and one never taken expires after 30 minutes. A cancel reads
+  both first and is refused once the payment is taken. The watch starts
+  before the request, which resolves only once the user has decided.
   `cancel_funding` cancels a session while nothing has arrived, as getcash
   does: it is refused once a deposit was seen or while anything is on the
   deposit account, which is read first, and nothing is cancelled if that

rust/crates/truapi/src/host_core.rs

@@ -683,6 +683,38 @@ impl SigningHostRuntime {
             })
     }
 
+    /// Give open outbound session `intent` a withdrawal account for
+    /// `destination_id` and ask the host to have the user pay the session's
+    /// amount into it, as getcash pays its withdrawal key. Returns the
+    /// account.
+    #[instrument(skip_all, fields(runtime.method = "signing_host_runtime.assign_funding_withdrawal"))]
+    pub async fn assign_funding_withdrawal(
+        &self,
+        intent: &str,
+        destination_id: &str,
+    ) -> Result<[u8; 32], v01::GenericError> {
+        let derive = |number| {
+            self.signing_host
+                .derive_funding_account(
+                    crate::host_logic::funding::FundingAccountKind::Withdrawal,
+                    destination_id,
+                    number,
+                )
+                .map_err(|err| v01::GenericError {
+                    reason: err.to_string(),
+                })?
+                .ok_or_else(|| v01::GenericError {
+                    reason: "no signing session is active".into(),
+                })
+        };
+        self.services
+            .assign_funding_withdrawal(intent, destination_id, derive)
+            .await
+            .map_err(|err| v01::GenericError {
+                reason: err.to_string(),
+            })
+    }
+
     /// The product's hard-subtree public key, derived from the active session
     /// root, or `None` while no session is active.
     ///