@parity/product-lab 0.0.1-placeholder → 0.1.0

package/LICENSE

@@ -0,0 +1,204 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+Copyright (c) 2026 Parity Technologies (UK) Ltd.

package/README.md

@@ -1,2 +1,325 @@
-# @parity/product-lab
-This package is no longer published.
+> [!WARNING]
+> This open source code is provided for research, experimentation, and developer education only. This code has not been audited, is actively experimental, and may contain bugs, vulnerabilities, or incomplete features. Use at your own risk and obtain legal advice as appropriate - DYOR.
+
+Parity doesn’t deploy the code but may update it based on community feedback.
+
+If you experience problems with any product or service that was built on or deployed from this code, you should contact the third party who deployed the code in its amended form, not Parity.
+
+# product-lab
+
+End-to-end test framework for Polkadot product SPAs: the real app in a real truAPI host, driven by Gherkin scenarios
+against local chains, with every result checked on screen and on the finalized chain.
+
+[![Licence: Apache-2.0](https://img.shields.io/badge/licence-Apache--2.0-blue.svg)](#license)
+
+`product-sdk` builds products, **product-lab runs and tests them**, `product-deploy` ships them.
+
+## What it does
+
+- Starts the chains your app needs on your machine: the local dev chain (Omni Node), a local copy of Paseo or
+  Previewnet (Full or Light), or a Chopsticks copy. Live Paseo next-v2 when you choose it.
+- Opens your real app in a real truAPI host, the CLI host or the in-browser WASM host, one identity per person.
+- Drives it like a person, from scenarios written in plain Gherkin.
+- Checks each result twice: in the app, and on the finalized chain, read on the lab's own connection.
+- Runs the same scenarios in the lab window, where you watch and step through them, headless in CI, from the
+  terminal and from an AI assistant over MCP.
+
+## Quick start
+
+Requirements: Node.js 24 or newer and npm (Bun and pnpm work too), on macOS arm64 or Linux x86_64, and a single-page
+app with a `dev` (or `start`) script that serves it. The package is for internal use at Parity for now, and isn't
+supported yet for users outside Parity. In the app's folder:
+
+```sh
+npm install --save-dev @parity/product-lab
+npx --no-install product-lab init     # lab.config.ts, lab/ (steps and a first scenario), lab.lock.json, the scripts lab and lab:test
+npx --no-install product-lab fetch    # the locked runtime and node binary, downloaded once and verified
+npx --no-install product-lab doctor   # what this machine lacks (Chromium, for one) and the command that adds it
+npm run lab:test                      # the first scenario, headless: a new person opens the app and sees it
+npm run lab                           # the local dev chain, a host and your app, in the lab window
+```
+
+`--no-install` runs the installed `product-lab` or refuses; a plain `npx product-lab` could download another package
+of that name. `init` leaves TODOs in `lab.config.ts` and `lab/steps/`: the chains your app uses and the test ids the
+lab reads. In the lab window, pick a scenario and press **Run scenario**. **Watch** drives the app you see, every click
+and keystroke highlighted; **Background** runs headless, as CI does, while the window shows the progress.
+
+`product-lab doctor` also says what fits this machine (a copy of Paseo as Full or Light, how many people at once).
+
+## How a run works
+
+1. **Environment.** The lab starts the chains the scenario needs: the local dev chain in seconds, or a local copy of
+   a live network from a saved fork. A fixture restores a saved state instead of building it again.
+2. **People.** Each person in the scenario gets a fresh or saved identity and a host session of their own, which
+   holds the identity and signs. One scenario can put people on different hosts.
+3. **App.** The lab serves your app (its dev server, or the deployed build) and opens it inside each person's host,
+   in a browser it controls.
+4. **Steps.** Each sentence runs one of your actions through the app's own UI: fill, click, wait, as a person would.
+5. **Checks.** Each check reads the screen and the finalized chain separately and compares both with what the step
+   expected. The UI check can be pinned to a block, so a screen ahead of or behind the chain is caught.
+6. **Evidence.** Every step keeps screenshots, the chain reads, the transactions and the host's log. A run is recorded
+   and can be reopened and replayed after its environment has stopped.
+
+## Your product
+
+A product keeps one config file and a `lab/` folder in its own repository. The app itself adds test ids at most:
+no lab flag, no test build, no behaviour change.
+
+```text
+app/              your SPA, unchanged
+lab/steps/        your actions and checks, each with a sentence (defineSteps)
+lab/features/     your scenarios (*.feature), negative controls beside them
+lab.config.ts     what is about your product
+lab.lock.json     the pinned runtimes and binaries
+```
+
+The config names your steps and the chains your app needs:
+
+```ts
+import { defineLab } from "@parity/product-lab";
+import { myApp } from "./lab/steps/my-app.ts";
+
+export default defineLab({
+  app: { steps: myApp, chains: ["people"] },
+});
+```
+
+Your steps give each action and check a sentence. An action does one unit of real work through the app; a check
+reads independently of the app:
+
+```ts
+import { chainEventAssertion, defineAction, defineAssertion, defineSteps } from "@parity/product-lab";
+
+export const myApp = defineSteps({
+  id: "my-app",
+  actions: {
+    send: defineAction({
+      title: "Send a remark",
+      via: "ui",
+      sentences: ["{actor} sends the remark {string}"],
+      async run({ actor, ui }, inputs) {
+        // fill the app's form and click Send, as a person would
+      },
+    }),
+  },
+  assertions: {
+    shown: defineAssertion({ title: "The remark is shown", sentence: "{actor}'s remark {string} is shown in the app", observe, compare }),
+    onChain: chainEventAssertion({
+      title: "The remark is on the finalized chain",
+      sentence: "{actor}'s remark {string} is on the finalized chain",
+      chain: "people", pallet: "System", event: "Remarked",
+      expected: (account, text) => ({ sender: account, hash: remarkHash(text) }),
+    }),
+  },
+});
+```
+
+A scenario is made of those sentences and the lab's own; there are no step files:
+
+```gherkin
+Scenario: A new actor sends a remark
+  Given Ada is a new actor
+  When Ada sends the remark "Hello from product-lab"
+  Then Ada's remark "Hello from product-lab" is shown in the app
+  And Ada's remark "Hello from product-lab" is on the finalized chain
+```
+
+The lab works out the rest: the environments that have your chains, the hosts, ports, the dev server and readiness.
+`product-lab config` shows every value it runs with, where it came from (yours, the lab's default and why, or detected
+from your product) and the line that changes it. The lab's own sentences cover people (`Ada is a new actor`,
+`Ada is a new actor on the "truapi-wasm" host`, `Ada is a new actor with no funds`), other apps opened in the same
+wallet, actions at the same time, and a person's network conditions (`Grace goes offline`).
+
+`product-lab ai init` installs the AI kit, whose references hold two complete labs: the smallest one (one page, one
+button, one signed remark) and Notes, which uses every feature.
+
+### Configure
+
+Write a field only when `product-lab config` shows a value that is wrong for your product. Two fields a product may
+need, each in a lab of its own here.
+
+The deployed build, on a local copy of Paseo taken before its name was re-pointed:
+
+```ts
+export default defineLab({
+  app: {
+    steps: myApp,
+    chains: ["people", "bulletin"],
+    deployed: {
+      name: "example.paseo",
+      cid: "<the build's CID>",
+      resolveOn: "wss://paseo-asset-hub-next-rpc.polkadot.io",
+      ipfsGateway: true,
+    },
+  },
+  defaultEnvironment: "paseo-copy",
+});
+```
+
+New people on the local dev chain, when your hosts derive persons under another label:
+
+```ts
+export default defineLab({
+  app: { steps: myApp, chains: ["people", "bulletin"] },
+  environments: { fast: { personProduct: "<your person product's label>" } },
+});
+```
+
+- `app.deployed.resolveOn`: `app.deployed` serves the build a DotNS name points at (`name`, or the web gateway's
+  `url`; `cid` pins the content) instead of your dev server. The lab resolves the name on the environment's Asset Hub,
+  as hosts do. `resolveOn` names another Asset Hub RPC to resolve it on instead, read-only: an origin only (`wss://`,
+  `ws://`, `https://` or `http://`, no path, query or credentials). Set it on a local copy of a network whose Asset
+  Hub predates the name's current record (the name was re-pointed after the copy's state was taken), with `cid`
+  pinning what the public record points at. Only the resolution moves: the content, the chains, the host, the accounts
+  and every write stay on the environment. A copy's Bulletin holds nothing stored before the copy was taken, so there
+  the content usually comes from the network's IPFS gateway, which is off on a copy unless you declare
+  `ipfsGateway: true` (more public contact, also recorded). The connection sends only DotNS reads (storage and the block header) and
+  refuses any other method. It is public contact when the RPC is public, so it is off unless you declare it, and the
+  endpoint and block are recorded in the start's progress and in `<run>/gateway-<id>.json` (`publicRead`). A pin the
+  public record does not match is refused. Absent: the environment's Asset Hub.
+- `environments.fast.personProduct`: when your app writes through Bulletin or the Statement Store, each new actor on
+  the local dev chain is made a person, and the lab derives the person's People member key under a person product's
+  label: the DotNS label alone, without the network's suffix, which the lab adds (`<label>.paseo`, `<label>.testnet`).
+  Default: the label the released truAPI host derives under (the lab's internal `DEFAULT_PERSON_PRODUCT`);
+  `product-lab config` shows its value as `environments.fast.personProduct`. Set it when the hosts your app runs on
+  derive persons under another label. It is refused when it is not a label (up to 63 lowercase letters, digits and
+  inner hyphens, not all digits), and, when your app needs persons, together with
+  `environments.fast.onboarding: "truapi-cli"`, whose host derives under its own preset.
+
+### Custom panels
+
+The lab window generates a form for each of your actions. Your steps can add browser modules to it: a panel of your
+own under Tools, Extensions, or a renderer for one action's input or one run's result. Each module's default export
+has `apiVersion: 1` and `mount(element, api)`. A panel's `api` reads data your steps publish (`api.resource(id)`, from
+`resources` in `defineSteps`) and runs one of your actions (`api.runAction(id, inputs)`); a renderer's `api` holds its
+field or its run, and the same calls under `api.lab`. Name the modules in your steps:
+
+```ts
+ui: {
+  panels: [{ id: "account", title: "Account", module: new URL("../ui/account-panel.ts", import.meta.url) }],
+  resultRenderers: { send: new URL("../ui/send-result.ts", import.meta.url) },
+},
+```
+
+The lab serves a module only when it imports nothing but files of its own folder, so services, signers and secrets
+never reach the browser. A module that fails shows its error in its own box; nothing else stops. The Notes lab in the
+AI kit has a panel and both kinds of renderer.
+
+## Environments and hosts
+
+Environments, by the id a scenario or mode names:
+
+- `fast`: the local dev chain (Omni Node with the locked runtimes), up in seconds, with very fast blocks. The default.
+- `paseo-copy`: a local copy of Paseo next-v2 from a saved fork, Full or Light, with root calls allowed if you list
+  them (`rootCalls`).
+- `previewnet-copy`: the same for Previewnet, when listed.
+- `chopsticks`: a Chopsticks copy of Paseo next-v2 or of the local dev chain, when listed.
+- `live-next-v2`: live Paseo next-v2. Read-only unless you name the people who exist there and who funds new ones.
+  Its identity enrollment uses `https://identity-backend-next.parity-testnet.parity.io`: a testnet identity endpoint;
+  availability isn't guaranteed and it may change. To use another, declare your own environment with its
+  `services.identityBackend` endpoint.
+
+Hosts, one per person:
+
+- `truapi-cli`: the truAPI CLI host, the default. Can lock the app's network to what the host declares.
+- `truapi-wasm`: the in-browser truAPI test host. It cannot read Bulletin yet (upstream).
+- `dotli`: dot.li, built locally at a locked commit. It can be turned on (`hosts: { dotli: {} }`), but its people
+  are not signed in yet and it serves the Paseo copy only.
+
+An environment or host your app cannot use is shown greyed in the window, with what it lacks and the line to add.
+
+A product runs released hosts only: the truAPI WASM test host on every environment, and the truAPI CLI host's locked
+official release (downloaded and verified). That release runs a local environment once it takes the lab's local
+endpoints: `host.lock.json` lists what it provides (`official.provides`). The locked 0.26.0 release provides local
+routing and navigation, so products can use it on local environments as well as live networks.
+`product-lab init` makes the CLI host the default when the locked release takes local endpoints;
+`product-lab doctor` reports which behaviours it provides.
+
+
+## In CI
+
+Modes in the config say how each pipeline runs:
+
+```ts
+modes: {
+  pr: { environment: "fast", tags: "@smoke", onlyAffected: true, budget: "10m" },
+  merge: { environment: "fast" },
+  nightly: { environments: ["fast", "paseo-copy"], hosts: ["truapi-cli", "truapi-wasm"], versions: ["locked", "latest"], workers: 4 },
+},
+```
+
+`product-lab test --mode merge` runs one, headless, with JUnit and HTML reports and one exit code. `versions: ["latest"]`
+runs the same scenarios against the latest releases of everything `lab.lock.json` pins, so an upstream change shows up
+before you upgrade. Tags add checks to a scenario: `@visual` compares each step's screen with a baseline,
+`@accessibility` runs axe-core after each step.
+
+## When a check fails
+
+A failure names the step and which side disagreed, the chain or the screen, with screenshots and the chain reads as
+evidence, and the run can be replayed step by step. When a failed step may have sent a transaction, the lab checks
+the chain itself and adds whether it landed. In the window you can set breakpoints on steps, pause a run and continue
+it one step at a time.
+
+Every check has a negative control: a scenario tagged `@negative-control` that must fail at the expected step
+(`@fails-at-step-N`) for the expected reason (`@fails-with:not-on-chain`, `screen-mismatch`, a chain error by its
+`Pallet.Error` name, or one of yours). A check that cannot fail is caught.
+
+`product-lab explore` runs seeded random scenarios of your actions with your invariants checked after every step, and
+shrinks the first failure to the smallest Gherkin scenario that fails the same way.
+
+## With an AI assistant
+
+`product-lab mcp` serves the lab over MCP: 33 tools to describe the lab and its resolved config, start and stop
+environments, run scenarios and actions, read the chain and the screen, explain a failure and its evidence, and manage
+the locked versions. Resetting an environment, allowing root calls (`root_calls_allow`), opening the lab window or
+rewriting the lock needs a confirmation token. `product-lab ai init` installs the kit for Claude Code and Codex in a
+product's repository: the MCP server, skills, agents and a section for `AGENTS.md`. The kit, with its skills and the
+two reference labs, ships in the installed package under `entrypoints/cli/ai-kit/`
+(`node_modules/@parity/product-lab/entrypoints/cli/ai-kit/`); `product-lab ai init` copies it into the project.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `product-lab` (`npm run lab`) | Start the environment and the people's sessions and open the lab window |
+| `product-lab test` | Run scenarios headless: `--tags`, `--mode <name>`, `--negative-control`; JUnit and HTML reports |
+| `product-lab config` | Every value the lab runs with and where it came from. Starts nothing |
+| `product-lab check`, `lint`, `coverage` | What can run where and why not; every scenario's plan; which sentences are used. Start nothing |
+| `product-lab doctor` | What this machine lacks, and what fits it |
+| `product-lab fixture`, `explore`, `what-if` | Saved states; random scenarios with invariants; branches from one shared start |
+| `product-lab versions` | Show, update, pin and verify `lab.lock.json` |
+| `product-lab mcp`, `ai init` | The MCP server; the AI kit |
+
+Every command's options: `npx --no-install product-lab <command> --help`.
+
+## How it is built
+
+The core knows no product: your domain lives in your steps. Environments, hosts, chain clients and browsers are
+adapters behind ports, each passing a contract kit, so a new host or environment is one adapter. The window, the CLI,
+CI and the MCP server drive the same application.
+
+## Status
+
+Experimental. The config may change between versions. The locks pin macOS arm64 and Linux x86_64; Linux is still
+being qualified.
+
+## Contributions and security reports
+
+product-lab is developed in a private repository, and outside contributions aren't taken for now. There is no
+public issue tracker yet. Report a security issue through https://parity.io/bug-bounty.
+
+## Security
+
+Before deploying it for real use cases, you are responsible for:
+
+- Reviewing the code yourself, we publish a reference, not a hardened production build
+- Checking that the dependencies are up to date and free of known vulnerabilities
+- Securing your own fork or deployment environment (keys, secrets, network configuration)
+- Tracking the latest tagged release/commits for security fixes; older releases are not backported (exceptions might apply)
+
+For Parity's security disclosure process, and Bug Bounty program, feel free to visit: https://parity.io/bug-bounty
+
+## License
+
+Apache-2.0: see LICENSE. The icons and fonts the lab window carries keep their own licences, in the files beside them
+(`lucide.LICENSE`, `*.OFL.txt`); the packages npm installs with this one keep theirs.