Wallet address of the customer's reward inventory. Reads the persisted address first; on a miss it derives the address from the Doppler keypair and persists it, so subsequent reads (including the keypair-free customer query service) resolve it straight from the database.
Signer for the customer's reward inventory. The returned signer carries its
own .address, so the funding path needs only this one call.
Privileged: only the reward-claim workflow funds payouts from inventory.
Privileged access to a customer's reward-inventory keypair.
This is the only reward-inventory service that touches the Doppler-backed signing keypair, so it is admin-only and must never be wired into a customer-facing app. It also owns provisioning: getAddress persists the derived wallet address into
reward_inventory, so read-only surfaces (which never touch Doppler) can resolve the address from the database via RewardInventoryQueryService.