Ledger-side credit and withdrawal-intent paths

server/market/custody-db-args.ts

@@ -1,9 +1,11 @@
 export const CUSTODY_DB_ACTION_ARGUMENT_COUNTS = {
   migrate: 0,
   'migrate-mainnet-schema': 0,
+  'initialize-mainnet-custody-identity': 1,
   'grant-runtime': 1,
   'grant-monero-observer-runtime': 1,
   'grant-monero-deposit-allocator-runtime': 1,
+  'grant-monero-withdrawal-runtime': 1,
   'grant-monero-credit-runtime': 1,
   'import-sqlite': 1,
   audit: 0,
@@ -21,12 +23,16 @@ export type CustodyDbAction = keyof typeof CUSTODY_DB_ACTION_ARGUMENT_COUNTS;
 export type CustodyDbArguments = { action: CustodyDbAction; argument?: string; extraArgument?: string };
 
 export function assertCustodyDbActionAllowedOnNetwork(action: CustodyDbAction, isMainnet: boolean): void {
-  if (action === 'migrate-mainnet-schema' && !isMainnet) {
-    throw new Error('Mainnet schema migration action requires the mainnet profile');
+  if ((action === 'migrate-mainnet-schema' || action === 'initialize-mainnet-custody-identity') && !isMainnet) {
+    throw new Error('Mainnet custody operation requires the mainnet profile');
   }
-  if (isMainnet && action !== 'grant-monero-observer-runtime' && action !== 'grant-monero-deposit-allocator-runtime' &&
-      action !== 'migrate-mainnet-schema') {
-    throw new Error('Only explicitly scoped Monero infrastructure-role grants and schema migration are allowed on mainnet');
+  const mainnetAllowed = ['grant-monero-observer-runtime', 'grant-monero-deposit-allocator-runtime',
+    'grant-monero-withdrawal-runtime',
+    'grant-monero-credit-runtime', 'migrate-mainnet-schema', 'initialize-mainnet-custody-identity',
+    'deposit-prepare-credit', 'deposit-stage-credit', 'deposit-prepare-release', 'deposit-release',
+    'deposit-reconcile-holds', 'deposit-prepare-resolve-hold', 'deposit-resolve-hold'];
+  if (isMainnet && !mainnetAllowed.includes(action)) {
+    throw new Error('Only scoped Monero infrastructure grants, identity initialization, and reviewed credit/withdrawal-intent operations are allowed on mainnet');
   }
 }
 
@@ -36,6 +42,14 @@ export function assertMainnetSchemaMigrationAcknowledged(action: CustodyDbAction
   }
 }
 
+export function assertMainnetCustodyOperationAcknowledged(action: CustodyDbAction, acknowledgement: string | undefined): void {
+  const requiresReviewAck = action === 'initialize-mainnet-custody-identity' || action === 'grant-monero-credit-runtime' ||
+    action.startsWith('deposit-');
+  if (requiresReviewAck && acknowledgement !== 'reviewed-credit-only') {
+    throw new Error('Mainnet deposit operations require WIKIDECK_MAINNET_CUSTODY_OPERATIONS=reviewed-credit-only');
+  }
+}
+
 export function parseCustodyDbArguments(args: readonly string[]): CustodyDbArguments {
   const [action, ...values] = args;
   if (!action || !Object.hasOwn(CUSTODY_DB_ACTION_ARGUMENT_COUNTS, action)) {