@farmslot/adapter-web 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -6,6 +6,16 @@ All notable changes to `@farmslot/adapter-web` are tracked here.
 
 - Active-development baseline; add user-facing changes here before release or package publication.
 
+## 0.3.1 - 2026-10-06
+
+- Browser probes no longer leave Chrome for Testing running when the resolver is stopped mid-probe (a hook timeout, a signal, or the resolver killed outright): the probe browser and its temporary profile are removed.
+  - A resolver killed outright cannot clean up; the next probe by the same user stops its browser and removes its profile. `browser-resolver` exports that step as `reapOrphanedProbes(tmp?)`.
+
+## 0.3.0 - 2026-10-05
+
+- Add `dapp`, the web3 layer for a dapp under test, moved from `@deeeed/metamask-harness`'s Web Terminal adapter: the strict EIP-1193 test wallet (`createStrictWallet`), the page script that wraps the app's provider and logs its wallet requests or injects a provider the host answers (`pageScriptSource`, `pageReadyExpression`), the host's side of its bindings (`createWalletRequestBinding`: frame and document attribution, `outside-app-frame` and `unattributed` records, refusals) and the wallet request log (`windowSinceCursor`, `resetWindow`, `evaluateSignatureLog`, `awaitSignatureLog`, `writeLogArtifact`). Product policy is passed in: the typed data to refuse (`refuseTypedData`), the injected wallet's EIP-6963 identity and the log entries and typed-data classes a product forbids. Page bindings are `__farmslotWallet{Log,Request,Resolve}` and the page marker `__farmslotDapp`.
+- Add `origin` (`isAppUrl`, `originOf`, `isAppTopFrameContext`, `shortUrl`): exact app-origin checks, moved from the same adapter.
+
 ## 0.2.0 - 2026-10-05
 
 - Add `launch-browser` (`launchBrowser`: launch or release one isolated, detached, owned Chromium with an unpacked extension; `homeTabsToClose`) and `slot-title` (stamp the farm slot id into the extension home tab's title), moved from `@deeeed/metamask-harness`. Product knowledge is now passed in: the home page, its default title, the owner-root rule, a lock held for the launch, and the rerun command named in hints. `slot-title`'s `applyPersistentSlotTitle` takes `{ slotId, defaultTitle }`, `buildStampExpression(slotId, defaultTitle)` and `stampHomeTabsViaCdp({ homePage, defaultTitle, ... })` match it, and CDP stamping uses the global `WebSocket` (else `ws`), loaded only when it stamps.

package/README.md

@@ -1,6 +1,6 @@
 # @farmslot/adapter-web
 
-Web platform pieces for Farmslot recipes: pick and launch an isolated Chromium, prove which process owns a CDP port, load an unpacked extension, and give macOS focus back after a headed launch. A harness builds its `web` platform on these; the modules hold no product knowledge.
+Web platform pieces for Farmslot recipes: pick and launch an isolated Chromium, prove which process owns a CDP port, load an unpacked extension, give macOS focus back after a headed launch, and record (or answer) a dapp's wallet requests. A harness builds its `web` platform on these; the modules hold no product knowledge.
 
 ```js
 const { resolveBrowser } = require('@farmslot/adapter-web/browser-resolver');
@@ -17,16 +17,18 @@ Docs: https://farmslot.io/docs/reference/adapter-web
 | `browser-resolver`             | Chrome for Testing vs branded Chrome, probe-launch and its cache, extension loading method; CLI entry          |
 | `browser-cdp`                  | browser-level CDP client with deadlines, CDP-port ownership proof, `Extensions.loadUnpacked`, window placement |
 | `chrome-args`                  | remote-debugging flags, isolated profile flags, runtime identity nonce, launch quarantine markers              |
+| `dapp`                         | web dapps: strict EIP-1193 test wallet, wallet-request page script and its host binding, wallet request log    |
 | `extension-id`                 | Chromium extension id from a manifest key or an unpacked directory                                             |
 | `launch-browser`               | launch (or release) one isolated, detached, owned Chromium with an unpacked extension                          |
 | `macos-focus`                  | capture the frontmost app before a headed launch and restore it if one of our browsers took it                 |
+| `origin`                       | exact app-origin checks, the app top-frame CDP context check, URLs without query strings                       |
 | `page-target`                  | pick the page on an origin, preferring one whose URL carries a hash                                            |
 | `playwright-cdp`               | page evaluation over a raw CDP session (safe under LavaMoat scuttling)                                         |
 | `slot-title`                   | prefix the extension home tab's title with the farm slot id, kept across the page's own title resets           |
 | `validation-process-ownership` | find and stop the processes that own a slot profile                                                            |
 | `validation-launch-supervisor` | supervised child for one validation launch: port lease, quarantine and cleanup                                 |
 
-Sources are CommonJS (`src/*.cjs`) and ship as is; `yarn build` emits `.d.cts` declarations. Every library subpath can be `require`d or `import`ed with named imports, except `validation-launch-supervisor`: it is a child-process entry (it runs when loaded), so hosts `require.resolve` it and fork it.
+Sources are CommonJS (`src/**/*.cjs`) and ship as is; `yarn build` emits `.d.cts` declarations. Every library subpath can be `require`d or `import`ed with named imports, except `validation-launch-supervisor`: it is a child-process entry (it runs when loaded), so hosts `require.resolve` it and fork it.
 
 ## Launching a browser
 
@@ -52,6 +54,57 @@ launchBrowser({
 });
 ```
 
+## Web dapps
+
+`dapp` is the web3 layer for a dapp under test: the browser's wallet requests are recorded and, with the injected signer, answered by a strict test wallet. The wallet host (a process attached to the slot browser over CDP) puts three pieces together:
+
+1. `pageScriptSource({ signer, appOrigin, refuseTypedData, injectedWallet })` is the preload to register with `Page.addScriptToEvaluateOnNewDocument`. It runs only in the app's top frame. With `signer: 'extension'` it wraps the provider a wallet extension injects; with `'injected'` it provides an EIP-1193 provider, announced over EIP-6963 with `injectedWallet.info`, whose requests go to the host. Every request in `LOGGED_METHODS` is reported through `LOG_BINDING` (method, EIP-712 primary type, domain and active chain, outcome, an error code and fixed category; never params or signatures). A request with no host binding attached is refused with 4100.
+2. `createWalletRequestBinding({ client, appOrigin, signer, wallet, refuseTypedData, record, say })` is the host's side. It judges each binding call against the frame and document that made it: an iframe, a blank popup or a foreign page is refused and recorded as `outside-app-frame`, and a call it can't attribute within `PENDING_CALL_TTL_MS` is recorded as `unattributed`. The host calls `install` when it hooks a tab, `commit` when the tab's top frame commits a document, `drain` once the tab's domains are enabled and `detach` when it goes.
+3. `createStrictWallet({ account, chainId })` answers the injected requests. It signs with the account the host passes and refuses what MetaMask refuses (typed data for another chain, another account), plus transactions; reads go to a public RPC.
+
+`pageReadyExpression({ signer, refusesTypedData })` checks a committed document: the bindings are attached, the preload installed with this policy, and the provider the app sees wrapped.
+
+Product policy is passed in. `refuseTypedData` is `{ reason, kind, message }`: typed data that `reason(typedData)` flags never reaches the signer. It is logged as `kind` and answered with code 4100 and `message`. `reason` also runs in the page, so it must be self-contained.
+
+The log is read through `{ logFile, cursorFile }`:
+
+- `windowSinceCursor` and `resetWindow` read the current window and start a new one.
+- `evaluateSignatureLog(entries, node, policy)` and `awaitSignatureLog` (which retries until `node.timeout_ms`) check `allowed_primary_types`, `counts`, `request_counts`, `methods`, `max_typed_data_requests`, `expect_confirmations`, `require_active_chain` and `max_rejected`.
+- `writeLogArtifact` keeps a window as run evidence.
+
+`policy.typedDataClasses` adds limited counters (for example, session-key payloads at most `node.max_session_requests`, default 0); `policy.forbiddenEntries` adds entries that always fail.
+
+```js
+const {
+  createStrictWallet,
+  createWalletRequestBinding,
+  pageScriptSource,
+} = require('@farmslot/adapter-web/dapp');
+
+const refuseTypedData = {
+  reason: function productionReason(data) {
+    return data?.message?.env === 'production' ? 'env=production' : null;
+  },
+  kind: 'refused-production',
+  message: 'Refused: this run signs only for staging.',
+};
+const source = pageScriptSource({
+  signer: 'injected',
+  appOrigin,
+  refuseTypedData,
+  injectedWallet: { info: { uuid, name: 'Test wallet', icon, rdns: 'test.wallet' } },
+});
+const wallet = createStrictWallet({ account, chainId: 1 });
+const binding = createWalletRequestBinding({
+  client,
+  appOrigin,
+  signer: 'injected',
+  wallet,
+  refuseTypedData,
+  record: (entry) => appendLine(logFile, entry),
+});
+```
+
 ## Resolver CLI
 
 `browser-resolver.cjs` is also a command, for hosts that need a bounded child process (a hung CDP call can't stall the caller). Every command finishes within 120 s, exits 0 on success and 1 with the error message on stderr otherwise. Hosts can keep their own script path by calling `runCli(argv)`.
@@ -64,7 +117,7 @@ launchBrowser({
 
 ## Maintenance rules
 
-1. No product knowledge. A product's build locks, titles, fixtures and wallet state stay in its harness and reach these modules as arguments.
+1. No product knowledge. A product's build locks, titles, fixtures, wallet state and signing policy stay in its harness and reach these modules as arguments.
 2. Process and on-disk identity strings (runtime nonce flag, launch markers, probe cache path) are how a launched browser and its profile are recognised. Changing one makes browsers started under the old name unrecognised; call that out in the release notes.
 3. Every CDP call has a deadline. Never add an unbounded wait.
 4. Never steal focus. A headed launch restores the previous frontmost app; window activation goes by pid, not by app name. `placeWindow` moves a visible window without activating it (restoring a minimized one can).

package/dist/browser-resolver.d.cts

@@ -64,6 +64,7 @@ export function probeLaunch(executable: any, { launchMethod, display, settleMs,
     durationMs: number;
 }>;
 export function readProbeCache(cachePath: any): any;
+export function reapOrphanedProbes(tmp?: string): void;
 export function renderCheck(port: any): Promise<{
     ok: boolean;
     reason?: undefined;

package/dist/dapp/index.d.cts

@@ -0,0 +1,32 @@
+export type TypedDataRefusal = import("./page-script.cjs").TypedDataRefusal;
+export type InjectedWallet = import("./page-script.cjs").InjectedWallet;
+export type SignatureLog = import("./signature-log.cjs").SignatureLog;
+export type SignaturePolicy = import("./signature-log.cjs").SignaturePolicy;
+export type SignatureSummary = import("./signature-log.cjs").SignatureSummary;
+export type LogEntry = import("./signature-log.cjs").LogEntry;
+import { DEFAULT_KNOWN_CHAINS } from "./strict-wallet.cjs";
+import { ERROR_CATEGORIES } from "./page-script.cjs";
+import { LOGGED_METHODS } from "./page-script.cjs";
+import { LOG_BINDING } from "./page-script.cjs";
+import { PAGE_MARKER } from "./page-script.cjs";
+import { PENDING_CALL_TTL_MS } from "./wallet-requests.cjs";
+import { READ_ONLY_RPC_METHODS } from "./strict-wallet.cjs";
+import { REQUEST_BINDING } from "./page-script.cjs";
+import { RESOLVE_FN } from "./page-script.cjs";
+import { awaitSignatureLog } from "./signature-log.cjs";
+import { createStrictWallet } from "./strict-wallet.cjs";
+import { createWalletRequestBinding } from "./wallet-requests.cjs";
+import { evaluateSignatureLog } from "./signature-log.cjs";
+import { isTypedDataRequest } from "./signature-log.cjs";
+import { pageReadyExpression } from "./page-script.cjs";
+import { pageScriptSource } from "./page-script.cjs";
+import { parseLog } from "./signature-log.cjs";
+import { readCursor } from "./signature-log.cjs";
+import { readLog } from "./signature-log.cjs";
+import { resetWindow } from "./signature-log.cjs";
+import { shortPrimaryType } from "./signature-log.cjs";
+import { summarize } from "./signature-log.cjs";
+import { windowSinceCursor } from "./signature-log.cjs";
+import { writeCursor } from "./signature-log.cjs";
+import { writeLogArtifact } from "./signature-log.cjs";
+export { DEFAULT_KNOWN_CHAINS, ERROR_CATEGORIES, LOGGED_METHODS, LOG_BINDING, PAGE_MARKER, PENDING_CALL_TTL_MS, READ_ONLY_RPC_METHODS, REQUEST_BINDING, RESOLVE_FN, awaitSignatureLog, createStrictWallet, createWalletRequestBinding, evaluateSignatureLog, isTypedDataRequest, pageReadyExpression, pageScriptSource, parseLog, readCursor, readLog, resetWindow, shortPrimaryType, summarize, windowSinceCursor, writeCursor, writeLogArtifact };

package/dist/dapp/page-script.d.cts

@@ -0,0 +1,96 @@
+export type TypedDataRefusal = {
+    /**
+     * Why the run must not sign this typed data, or null. Runs in the page too: self-contained (no closure, no imports).
+     */
+    reason: (typedData: any) => string | null;
+    /**
+     * The log entry kind of a refusal.
+     */
+    kind: string;
+    /**
+     * The refusal's error message (code 4100).
+     */
+    message: string;
+};
+export type InjectedWallet = {
+    /**
+     * EIP-6963 provider info to announce.
+     */
+    info: {
+        uuid: string;
+        name: string;
+        icon: string;
+        rdns: string;
+    };
+    /**
+     * Present the provider as MetaMask (`isMetaMask`, `_metamask.isUnlocked`).
+     */
+    isMetaMask?: boolean | undefined;
+};
+export const ERROR_CATEGORIES: Readonly<{
+    4001: "user-rejected";
+    4100: "unauthorized";
+    4200: "unsupported-method";
+    4900: "disconnected";
+    4901: "chain-disconnected";
+    4902: "unrecognized-chain";
+    [-32602]: "invalid-params";
+    [-32603]: "internal";
+}>;
+export const LOGGED_METHODS: readonly string[];
+export const LOG_BINDING: "__farmslotWalletLog";
+export const PAGE_MARKER: "__farmslotDapp";
+export const REQUEST_BINDING: "__farmslotWalletRequest";
+export const REFUSAL_CHECK_FAILED: "the refusal check threw";
+export const RESOLVE_FN: "__farmslotWalletResolve";
+/**
+ * Refuse a policy the page or the host could not apply: kind and message must
+ * be non-empty strings, and reason a function whose source is an expression
+ * in the page (a function declaration or an arrow; not a method shorthand, a
+ * bound or a native function).
+ * @param {TypedDataRefusal | null | undefined} refuseTypedData
+ */
+export function assertTypedDataRefusal(refuseTypedData: TypedDataRefusal | null | undefined): void;
+/**
+ * An expression that is true on a document whose preload is installed for
+ * this signer and policy, whose bindings are attached, and whose provider the
+ * app sees (window.ethereum) is wrapped with no wrap failure.
+ *
+ * @param {{ signer: 'extension' | 'injected', refusesTypedData: boolean }} options
+ * @returns {string}
+ */
+export function pageReadyExpression({ signer, refusesTypedData }: {
+    signer: "extension" | "injected";
+    refusesTypedData: boolean;
+}): string;
+/**
+ * @typedef {object} TypedDataRefusal
+ * @property {(typedData: any) => string | null} reason Why the run must not sign this typed data, or null. Runs in the page too: self-contained (no closure, no imports).
+ * @property {string} kind The log entry kind of a refusal.
+ * @property {string} message The refusal's error message (code 4100).
+ */
+/**
+ * @typedef {object} InjectedWallet
+ * @property {{ uuid: string, name: string, icon: string, rdns: string }} info EIP-6963 provider info to announce.
+ * @property {boolean} [isMetaMask] Present the provider as MetaMask (`isMetaMask`, `_metamask.isUnlocked`).
+ */
+/**
+ * The preload for one app origin.
+ * - `signer`: 'extension' wraps the provider a wallet extension injects;
+ *   'injected' provides one whose requests go to the host (REQUEST_BINDING).
+ * - `refuseTypedData`: `{ reason, kind, message }` or null. `reason(typedData)`
+ *   returns why the run must not sign it, or null; it runs in the page, so it
+ *   must be a self-contained function (no closure, no imports). A refusal is
+ *   logged as `kind` and answered with code 4100 and `message`.
+ * - `injectedWallet` (injected signer): `{ info, isMetaMask }`, the EIP-6963
+ *   provider info to announce and whether the provider presents as MetaMask.
+ *
+ * @param {{ signer: 'extension' | 'injected', appOrigin: string, refuseTypedData?: TypedDataRefusal | null, injectedWallet?: InjectedWallet }} options
+ * @returns {string}
+ */
+export function pageScriptSource({ signer, appOrigin, refuseTypedData, injectedWallet }: {
+    signer: "extension" | "injected";
+    appOrigin: string;
+    refuseTypedData?: TypedDataRefusal | null;
+    injectedWallet?: InjectedWallet;
+}): string;

package/dist/dapp/signature-log.d.cts

@@ -0,0 +1,119 @@
+export type SignatureLog = {
+    logFile: string;
+    cursorFile: string;
+};
+export type LogEntry = {
+    seq: number;
+    kind?: string;
+    [field: string]: any;
+};
+export type PrimaryTypeSummary = {
+    requested: number;
+    signed: number;
+    rejected: number;
+    chainIds: Array<number | null | undefined>;
+};
+export type SignatureSummary = {
+    requests: number;
+    typedDataRequests: number;
+    confirmationsShown: number;
+    unattributed: number;
+    outsideAppFrame: number;
+    byPrimaryType: Record<string, PrimaryTypeSummary>;
+    byMethod: Record<string, number>;
+};
+export type SignaturePolicy = {
+    typedDataClasses?: Record<string, {
+        match(entry: LogEntry): boolean;
+        param: string;
+        defaultMax: number;
+        failure(count: number, max: number): string;
+    }> | undefined;
+    forbiddenEntries?: Record<string, {
+        match(entry: LogEntry): boolean;
+        failure(count: number): string;
+    }> | undefined;
+};
+/** @param {SignatureLog} log @param {Record<string, any>} [node] @param {SignaturePolicy} [policy] */
+export function awaitSignatureLog(log: SignatureLog, node?: Record<string, any>, policy?: SignaturePolicy): Promise<{
+    window: {
+        cursor: number;
+        entries: LogEntry[];
+        total: number;
+    };
+    result: {
+        ok: boolean;
+        failures: string[];
+        summary: SignatureSummary & Record<string, any>;
+    };
+}>;
+/**
+ * @param {LogEntry[]} entries
+ * @param {Record<string, any>} [node]
+ * @param {SignaturePolicy} [policy]
+ * @returns {{ ok: boolean, failures: string[], summary: SignatureSummary & Record<string, any> }}
+ */
+export function evaluateSignatureLog(entries: LogEntry[], node?: Record<string, any>, policy?: SignaturePolicy): {
+    ok: boolean;
+    failures: string[];
+    summary: SignatureSummary & Record<string, any>;
+};
+/** @param {LogEntry} entry */
+export function isTypedDataRequest(entry: LogEntry): boolean;
+/**
+ * @typedef {{ logFile: string, cursorFile: string }} SignatureLog
+ * @typedef {{ seq: number, kind?: string, [field: string]: any }} LogEntry
+ * @typedef {{ requested: number, signed: number, rejected: number, chainIds: Array<number | null | undefined> }} PrimaryTypeSummary
+ * @typedef {object} SignatureSummary
+ * @property {number} requests
+ * @property {number} typedDataRequests
+ * @property {number} confirmationsShown
+ * @property {number} unattributed
+ * @property {number} outsideAppFrame
+ * @property {Record<string, PrimaryTypeSummary>} byPrimaryType
+ * @property {Record<string, number>} byMethod
+ * @typedef {object} SignaturePolicy
+ * @property {Record<string, { match(entry: LogEntry): boolean, param: string, defaultMax: number, failure(count: number, max: number): string }>} [typedDataClasses]
+ * @property {Record<string, { match(entry: LogEntry): boolean, failure(count: number): string }>} [forbiddenEntries]
+ */
+/** @param {string} text @returns {LogEntry[]} */
+export function parseLog(text: string): LogEntry[];
+/** @param {SignatureLog} log @returns {Promise<number>} */
+export function readCursor({ cursorFile }: SignatureLog): Promise<number>;
+/** @param {SignatureLog} log @returns {Promise<LogEntry[]>} */
+export function readLog({ logFile }: SignatureLog): Promise<LogEntry[]>;
+/** @param {SignatureLog} log */
+export function resetWindow(log: SignatureLog): Promise<{
+    cursor: number;
+    previousEntries: number;
+}>;
+/** @param {unknown} primaryType @returns {string | null} */
+export function shortPrimaryType(primaryType: unknown): string | null;
+/**
+ * @param {LogEntry[]} entries
+ * @param {SignaturePolicy} [policy]
+ * @returns {SignatureSummary & Record<string, any>} The policy's counters are extra top-level keys.
+ */
+export function summarize(entries: LogEntry[], policy?: SignaturePolicy): SignatureSummary & Record<string, any>;
+/** @param {SignatureLog} log */
+export function windowSinceCursor(log: SignatureLog): Promise<{
+    cursor: number;
+    entries: LogEntry[];
+    total: number;
+}>;
+/** @param {SignatureLog} log @param {number} seq */
+export function writeCursor({ cursorFile }: SignatureLog, seq: number): Promise<void>;
+/**
+ * @param {{ artifactsDir?: string, nodeId: string, folder: string }} target
+ * @param {unknown} payload
+ * @returns {Promise<Array<{ path: string, type: 'report', nodeId: string }>>}
+ */
+export function writeLogArtifact({ artifactsDir, nodeId, folder }: {
+    artifactsDir?: string;
+    nodeId: string;
+    folder: string;
+}, payload: unknown): Promise<Array<{
+    path: string;
+    type: "report";
+    nodeId: string;
+}>>;

package/dist/dapp/strict-wallet.d.cts

@@ -0,0 +1,27 @@
+export const DEFAULT_KNOWN_CHAINS: readonly number[];
+export const READ_ONLY_RPC_METHODS: readonly string[];
+/**
+ * @param {object} options
+ * @param {{ address: string, signTypedData(args: any): Promise<string>, signMessage(args: any): Promise<string> }} options.account
+ * @param {number} [options.chainId]
+ * @param {readonly number[]} [options.knownChains]
+ * @param {boolean} [options.refuseSwitch]
+ * @param {typeof fetch} [options.fetchImpl]
+ */
+export function createStrictWallet({ account, chainId, knownChains, refuseSwitch, fetchImpl, }: {
+    account: {
+        address: string;
+        signTypedData(args: any): Promise<string>;
+        signMessage(args: any): Promise<string>;
+    };
+    chainId?: number | undefined;
+    knownChains?: readonly number[] | undefined;
+    refuseSwitch?: boolean | undefined;
+    fetchImpl?: typeof fetch | undefined;
+}): {
+    request: ({ method, params }: {
+        method: string;
+        params?: any[];
+    }) => Promise<any>;
+    readonly chainId: number;
+};

package/dist/dapp/wallet-requests.d.cts

@@ -0,0 +1,48 @@
+export const PENDING_CALL_TTL_MS: 5000;
+/**
+ * - `client`: `{ send(method, params, sessionId), on(event, handler(params, sessionId)) }`.
+ * - `signer`: 'extension' (log only) or 'injected' (`wallet` answers requests).
+ * - `wallet`: an EIP-1193 `{ request }` for the injected signer.
+ * - `refuseTypedData`: the page script's policy (`{ reason, kind, message }`),
+ *   applied again here before the wallet signs.
+ * - `record(entry)`: append one entry to the wallet request log.
+ * - `say(message)`: the host's own log.
+ *
+ * @param {object} options
+ * @param {{ send(method: string, params?: object, sessionId?: string): Promise<any>, on(method: string, handler: (params: any, sessionId?: string) => void): unknown }} options.client
+ * @param {string} options.appOrigin
+ * @param {'extension' | 'injected'} options.signer
+ * @param {{ request(args: { method: string, params?: unknown }): Promise<unknown> } | null} [options.wallet]
+ * @param {import('./page-script.cjs').TypedDataRefusal | null} [options.refuseTypedData]
+ * @param {(entry: Record<string, unknown>) => void} options.record
+ * @param {(message: string) => void} [options.say]
+ */
+export function createWalletRequestBinding({ client, appOrigin, signer, wallet, refuseTypedData, record, say, }: {
+    client: {
+        send(method: string, params?: object, sessionId?: string): Promise<any>;
+        on(method: string, handler: (params: any, sessionId?: string) => void): unknown;
+    };
+    appOrigin: string;
+    signer: "extension" | "injected";
+    wallet?: {
+        request(args: {
+            method: string;
+            params?: unknown;
+        }): Promise<unknown>;
+    } | null | undefined;
+    refuseTypedData?: import("./page-script.cjs").TypedDataRefusal | null | undefined;
+    record: (entry: Record<string, unknown>) => void;
+    say?: ((message: string) => void) | undefined;
+}): {
+    /**
+     * Track an app tab and add its bindings. Call before the page script is
+     * registered; neither needs the target running.
+     */
+    install(sessionId: any, targetId: any): Promise<[any, ...any[]]>;
+    /** The tab's top frame committed `url` (a frameNavigated or the frame tree). */
+    commit(sessionId: any, url: any, loaderId: any): void;
+    /** Judge the calls that were waiting for the tab's contexts. */
+    drain: (sessionId: any) => void;
+    /** The tab detached: calls still waiting for their document can no longer be judged. */
+    detach(sessionId: any): void;
+};

package/dist/origin.d.cts

@@ -0,0 +1,21 @@
+/**
+ * @param {{ origin?: string, auxData?: { isDefault?: boolean, frameId?: string } } | null | undefined} context
+ * @param {{ targetId: string | undefined, appOrigin: string, committedUrl: string | null }} scope
+ */
+export function isAppTopFrameContext(context: {
+    origin?: string;
+    auxData?: {
+        isDefault?: boolean;
+        frameId?: string;
+    };
+} | null | undefined, { targetId, appOrigin, committedUrl }: {
+    targetId: string | undefined;
+    appOrigin: string;
+    committedUrl: string | null;
+}): boolean;
+/** @param {unknown} url @param {string} appOrigin */
+export function isAppUrl(url: unknown, appOrigin: string): boolean;
+/** @param {unknown} url @returns {string | null} */
+export function originOf(url: unknown): string | null;
+/** @param {unknown} url @returns {string} */
+export function shortUrl(url: unknown): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farmslot/adapter-web",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Web platform adapter for Farmslot recipes: resolve and launch an isolated Chromium, own its CDP port, load unpacked extensions, and keep macOS focus.",
   "type": "commonjs",
   "exports": {
@@ -16,6 +16,10 @@
       "types": "./dist/chrome-args.d.cts",
       "default": "./src/chrome-args.cjs"
     },
+    "./dapp": {
+      "types": "./dist/dapp/index.d.cts",
+      "default": "./src/dapp/index.cjs"
+    },
     "./extension-id": {
       "types": "./dist/extension-id.d.cts",
       "default": "./src/extension-id.cjs"
@@ -28,6 +32,10 @@
       "types": "./dist/macos-focus.d.cts",
       "default": "./src/macos-focus.cjs"
     },
+    "./origin": {
+      "types": "./dist/origin.d.cts",
+      "default": "./src/origin.cjs"
+    },
     "./package.json": "./package.json",
     "./page-target": {
       "types": "./dist/page-target.d.cts",