@parity/product-lab 0.0.1-placeholder → 0.1.0

package/core/ports/src/driven/host/host-session.d.ts

@@ -0,0 +1,289 @@
+import type { Browser, BrowserPage, ConditionControl } from "../browser/index.js";
+import type { AppNetworkEvidence, HostNetworkNote, NavigationRequested, ProvisionedIdentity } from "@parity/product-lab/domain";
+import type { ApprovalPolicy } from "./host-provider.js";
+/**
+ * How the lab knows a product account (backlog item 62):
+ * - `identity`: derived from the identity the lab started the session with (`ProductAccountDerivation`); needs
+ *   nothing from the host beyond signing in as that identity, which the host contract's `account` contract checks;
+ * - `host`: the running host answered (`productAccountRead`);
+ * - `app`: a reader of the app's page supplied to the host adapter.
+ */
+export type AccountSource = "identity" | "host" | "app";
+/** A product account as the host derives it. */
+export interface VerifiedAccount {
+    /** SS58 address (generic Substrate prefix 42). */
+    address: string;
+    /** 0x-prefixed 32-byte public key. */
+    publicKey: string;
+    productId: string;
+    derivationIndex: number;
+    /** Where the answer came from; absent from adapters that predate the field. */
+    source?: AccountSource;
+}
+export interface AccountQuery {
+    /** Require this source (for example `host`, to check what the running host itself answers). Default: the first the session has, `identity` before `host` before `app`. */
+    readonly source?: AccountSource;
+}
+/** What the host knows of the product's connection to it, now (`HostSession.connection`). */
+export interface HostConnection {
+    /** The product called the host and the host answered: the two are talking. */
+    readonly connected: boolean;
+    /** What was seen, in words that fit after "the host saw: " (for example "the page loaded the host's bridge, and the app has not called the host"). */
+    readonly detail: string;
+}
+/** A signing request the host decided (`HostSession.approvals.signing`). */
+export interface SigningDecision {
+    /** Stable request/evidence id, including host restarts when available. */
+    readonly id?: string;
+    readonly at?: number;
+    /** Actual signature bytes; known typed encodings may be normalized to raw bytes for chain correlation. */
+    readonly signature?: string;
+    /** Exact signature bytes returned by the host, preserving any typed encoding discriminator. */
+    readonly returnedSignature?: string;
+    /** Scheme proven by the host's known signature encoding or signing implementation. */
+    readonly signatureScheme?: "ed25519" | "sr25519" | "ecdsa";
+    readonly signer?: string;
+    /** Exact signed transaction hash when the host has the complete encoded extrinsic. */
+    readonly transactionHash?: string;
+    /** Why this decision cannot correlate with a finalized extrinsic. */
+    readonly gap?: string;
+    readonly approved: boolean;
+    /**
+     * What was to be signed: `transaction` (a transaction payload: once approved, the app holds a signed transaction
+     * it can submit), `message` (raw bytes or a proof: nothing a chain accepts as a transaction), or `unknown` (the
+     * host's wording is not one this adapter recognises; treated as a possible transaction).
+     */
+    readonly payload: "transaction" | "message" | "unknown";
+    /** The request as the host words it. */
+    readonly action: string;
+}
+/** How a session's confirmations are decided: one policy for all of them, or
+ * each one by the lab (`per-request`, only where the host declares
+ * `perRequestApproval`). */
+export type SessionApprovals = ApprovalPolicy | "per-request";
+/** A confirmation the host is waiting on in a `per-request` session. */
+export interface PendingApproval {
+    /** The host's id for the request, unique within the session. */
+    id: string;
+    /** What is asked, as the host words it (for example `sign raw data`). */
+    action: string;
+    /** `permission`: a grant that may outlive the request (allow once, always,
+     * or deny); `action`: one operation, such as a signature. */
+    kind: "action" | "permission";
+    /** When the host asked (Unix ms, the host's clock). */
+    at: number;
+}
+/** A request the host blocked under deny-by-default networking. */
+export interface BlockedRequest {
+    url: string;
+    kind: "http" | "websocket" | "other";
+    at: number;
+}
+/** One request a deny-by-default session decided: allowed by a rule (`detail` names it, `chain people` for a chain route), or denied (why). */
+export interface NetworkLogEntry {
+    /** Milliseconds since the session started. */
+    at: number;
+    kind: "http" | "websocket";
+    url: string;
+    verdict: "allow" | "deny";
+    detail: string;
+}
+/** What an app saw for a URL it requested: a response (opaque in `no-cors` mode) or the error that stopped it. */
+export type AppRequestOutcome = {
+    readonly ok: true;
+    readonly status: number;
+} | {
+    readonly error: string;
+};
+/** Deny-by-default networking of one session, as its host reports it. */
+export interface HostSessionNetwork {
+    blocked(): Promise<BlockedRequest[]>;
+    /**
+     * Request `url` from the app's own document, as the app's own code would (`no-cors`), and say what the app saw: how
+     * a scenario probes the lock (`{actor}'s app requests {string}`). Absent: this host cannot make the app request it.
+     */
+    request?(url: string): Promise<AppRequestOutcome>;
+    /** Every request decided so far, allowed and denied, in order. Absent: the host reports only what it blocked. */
+    log?(): readonly NetworkLogEntry[];
+    /**
+     * Present where the session's sockets are observed, not routed (a lab-window tile routes its requests but not its
+     * sockets): what the observation saw of the session's traffic, since its policy log cannot show its sockets.
+     */
+    observed?(): Promise<AppNetworkEvidence>;
+}
+export interface HostActor {
+    id: string;
+    name: string;
+    /** The identity this actor signs as. Every session of one actor uses the
+     * same identity, so its product accounts match across apps. */
+    identity?: ProvisionedIdentity;
+}
+/** What a host tells an app about itself when it loads it. */
+export interface HostAppContext {
+    /** Development bridge script the app must load (truAPI CLI), or null when
+     * the host embeds the app itself (WASM test host iframe). */
+    hostBridgeUrl: string | null;
+}
+export interface HostApp {
+    /** Lab-wide app id (for example `notes`). */
+    id: string;
+    /** DotNS product id the host runs it under, for example `example.paseo`. */
+    productId: string;
+    /** Where the app is served. A function receives the host context, for apps
+     * that need the bridge URL in their address. */
+    url: string | ((context: HostAppContext) => string);
+}
+export interface HostSessionRequest {
+    actor: HostActor;
+    app: HostApp;
+    /** Defaults to the provider's first declared policy. `per-request` needs
+     * `perRequestApproval`. */
+    approvals?: SessionApprovals;
+    /** Root-relative path to open first (default `/`). */
+    path?: string;
+    /**
+     * Backlog 31: the identity's conditions will be set, so open the session ready for them (a native host opens its
+     * own conditioned links only then). Without it a host may give the session no `conditions`.
+     */
+    conditions?: boolean;
+    /**
+     * Backlog 108: open the session there (a lab-window tile), not in a browser context of the host's own. Only a host
+     * declaring `capabilities.placement` is given one.
+     */
+    placement?: SessionPlacement;
+}
+/**
+ * A place a host session can be opened in instead of a browser context of its own (backlog 108): a person's
+ * lab-window tile, so the host page they watch is their session and there is no second, unseen one.
+ */
+export interface SessionPlacement {
+    /** The place as a browser: its one context is the place, the context's one tab the place's document. */
+    readonly browser: Browser;
+    /** Where, for evidence and messages ("Ada's lab-window tile"). */
+    readonly label: string;
+    /**
+     * Names this placement in a page shared with others: the host tags the documents it opens with it, so a script it
+     * installs acts only in its own (every person's scripts are installed on the one shared page).
+     */
+    readonly tag: string;
+    /**
+     * What per-session network routing can do in this place (the page is shared with other people's sessions):
+     * `unavailable`: none applies, and the host applies none and records this reason as its network evidence, never a
+     * policy it did not enforce. `sockets` (C4, 6 October 2026): the place routes this session's requests but not its
+     * sockets; the host applies its policy to requests, leaves sockets open, and says so (`HostSession.networkNote`).
+     */
+    readonly network?: {
+        readonly unavailable: string;
+        readonly sockets?: never;
+    } | {
+        readonly sockets: string;
+        readonly unavailable?: never;
+    };
+}
+/** Each person's placement (by actor id), or undefined for a person whose sessions open as usual. */
+export type SessionPlacements = (actorId: string) => SessionPlacement | undefined;
+/** Provider evidence recorded with every session. */
+export interface HostSessionEvidence {
+    host: string;
+    version: string;
+    /** Lab patches in effect. */
+    patches: readonly string[];
+    /** `faked` settings never count as coverage. */
+    coverage: "faithful" | "faked";
+    [key: string]: unknown;
+}
+/** Backlog 192: a log a host writes for one session (its process's standard output and error), where the host keeps it. */
+export interface HostLogFile {
+    /** Its name in a few words ("truapi-host"), as views and the kept file's name say it. */
+    readonly label: string;
+    /** Absolute path of the file, as long as the session lives; the lab copies it, never writes it. */
+    readonly path: string;
+}
+export interface HostSession {
+    /**
+     * Backlog 192: the logs this session's host writes, where it keeps them. A failed run keeps a copy of each beside its
+     * recording before the session closes. Absent: the host writes no log file of its own (the WASM host logs into the
+     * page, which the recording's console keeps).
+     */
+    logs?(): readonly HostLogFile[];
+    /** The app's direct traffic, excluding its host bridge; preserve unsupported observation as gaps. */
+    networkEvidence?(): Promise<AppNetworkEvidence>;
+    /**
+     * C4: the session's network as it really is where it opened, when that differs from what its host's options say
+     * (a lock that applies only in part in a placement). Views show it on the person's row and tile alike
+     * (`withNetworkNote`). Absent: the options say it.
+     */
+    readonly networkNote?: HostNetworkNote;
+    readonly actor: HostActor;
+    readonly app: HostApp;
+    readonly approvalPolicy: SessionApprovals;
+    readonly evidence: HostSessionEvidence;
+    /** The app document (for an embedding host, the product frame). Adding to
+     * `BrowserPage` is a deliberate decision checked against every provider. */
+    page(): Promise<BrowserPage>;
+    /**
+     * The product account this session's app signs with. Rejects with `UnsupportedHostOperation` when the host cannot
+     * tell (no derivation for it, no host read, no app reader), naming what is missing: the caller then needs a reader
+     * of its own and must say so, never guess.
+     */
+    account(index?: number, query?: AccountQuery): Promise<VerifiedAccount>;
+    /**
+     * The accounts this session's host claims chain resources for on the app's behalf (a statement allowance, Bulletin
+     * long-term storage), derived from the identity the lab started the host with. Absent: the host derives none the lab
+     * can know, and a claim for such an account stays unattributed. `signs`: the host itself signs chain transactions
+     * with this account, with no signing request from the app (RFC-0010: a truAPI host's Bulletin `TransactionStorage.store`
+     * with its bulletin account); the host check credits a finalized transaction it signs to this session's app.
+     */
+    resourceAccounts?(): Promise<readonly {
+        readonly account: string;
+        readonly resource: string;
+        readonly signs?: boolean;
+    }[]>;
+    /**
+     * Whether the product is connected to the host, as the host (or the adapter that runs it) observes it: no element
+     * or attribute of the app is read. Absent: this host cannot tell, and an app's readiness must be declared another
+     * way (`apps.<id>.ready`).
+     */
+    connection?(): Promise<HostConnection>;
+    /**
+     * Per-identity conditions (backlog 31): the session's page, and for a native host its own connections too (so
+     * offline means neither the app nor its host reaches the chain). A slower device slows the app's page; a host's own
+     * work outside it (a native process, a worker) runs at full speed. Absent: this host cannot condition an identity,
+     * and a scenario that sets a condition is refused before it runs.
+     */
+    readonly conditions?: ConditionControl;
+    /**
+     * The origins on the identity's own device (backlog 31): the app's own origin (its pages and assets are local, as an
+     * installed app's are) and its link to its host when that is network traffic. A surface conditioning this identity's
+     * network never conditions them (phone semantics).
+     */
+    localLinks?(): readonly string[];
+    approvals: {
+        /** In a `per-request` session: decide the oldest pending request,
+         * waiting for one (up to the provider's timeout), and return it. With a
+         * fixed policy: accepted only when it matches the policy. */
+        approve(): Promise<PendingApproval | void>;
+        deny(): Promise<PendingApproval | void>;
+        /** Requests waiting for a decision, oldest first (`per-request` sessions). */
+        pending?(): Promise<PendingApproval[]>;
+        /** Confirmations the host decided so far, in order, as the host words
+         * them (for example `denied remote permission`), when it records them. */
+        decisions?(): Promise<string[]>;
+        /**
+         * Every signing request the host decided since the session started, in order, when the host records them
+         * (backlog item 63): how the lab knows whether the app asked for a signature during a step, without reading the
+         * app's page. The record restarts when the session's host does; a caller comparing two lengths must treat a
+         * shorter later record as a restart.
+         */
+        signing?(): Promise<readonly SigningDecision[]>;
+    };
+    /** Every iteration replays the session's requests from its start, then
+     * follows new ones until the session stops. Present only when the host
+     * declares `navigationEvents`. */
+    navigations?: AsyncIterable<NavigationRequested>;
+    /** Load the app at a root-relative path in this session (`openPath`). */
+    open?(path: string): Promise<void>;
+    /** Present only when the host declares `denyByDefaultNetwork`. */
+    network?: HostSessionNetwork;
+    stop(): Promise<void>;
+}

package/core/ports/src/driven/host/host-session.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/host/host-tool-source.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The host adapter factories `product-lab host fetch|build` offers (refactor
+ * step 8): by default the ones the composition root constructs, or those a
+ * tools module default-exports (`--config <tools.ts>`). Before this port the
+ * CLI loaded a path into the truAPI CLI adapter by default.
+ */
+import type { HostAdapterFactory } from "./host-adapter-factory.js";
+export interface HostTools {
+    /** Where the factories come from (a module path, or the composition root). */
+    readonly source: string;
+    /** Validated: no malformed factory, no kind twice. */
+    readonly factories: readonly HostAdapterFactory[];
+}
+export interface HostToolSource {
+    /** The factories of `module`, else the default ones. Throws when the module does not default-export factories, or they are invalid. */
+    load(module?: string): Promise<HostTools>;
+    /** Whether `module` exists (the default always does). */
+    exists(module?: string): boolean;
+}

package/core/ports/src/driven/host/host-tool-source.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/host/host-upstream.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Which upstream commit a host tool works on (`product-lab host rebase-check`):
+ * a host adapter names its upstream and a selector, and whoever composes the
+ * runtime answers with an exact commit. The host adapter never talks to a
+ * release service itself (docs/verification/2026-09-26-host-patch-rebase.md).
+ */
+export interface UpstreamRequest {
+    /** `owner/repo`. */
+    readonly repository: string;
+    /** How the upstream names a release of this host, `{version}` replaced (for example `@parity/truapi@{version}`). */
+    readonly tag: string;
+    /** `latest` (the newest non-prerelease release whose tag matches), or an explicit version (`0.21.0`). */
+    readonly selector: "latest" | {
+        readonly version: string;
+    };
+    readonly signal?: AbortSignal;
+}
+export interface UpstreamRef {
+    /** Full 40-hex commit. */
+    readonly commit: string;
+    readonly version: string;
+    readonly tag: string;
+}
+export type UpstreamResolver = (request: UpstreamRequest) => Promise<UpstreamRef>;

package/core/ports/src/driven/host/host-upstream.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/host/host-verifier.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Host verification (refactor step 8): run the host conformance kit against
+ * one host adapter a targets module defines (`defineHostVerifications`).
+ * Before this port the CLI (`host verify`) and the MCP server (`host_verify`)
+ * each loaded the module and ran the kit; `VerifyHost`
+ * (@product-lab/application) is its only caller, and `ModuleHostVerifier`
+ * (@product-lab/contract-host) implements it. The report types are the kit's.
+ */
+import type { HostCapabilities, HostRequirement, ResolvedHost } from "./host-provider.js";
+/**
+ * `inconclusive`: the contract ran but its positive control did not hold, so the attack proves nothing either way (a
+ * host that never reached the chain cannot be said to have kept an app off it, nor to have let it through). Never a
+ * pass, never a fail; a report with one does not conform.
+ */
+export type ContractStatus = "pass" | "fail" | "inconclusive" | "unsupported" | "skipped";
+/** An input a contract needs from the kit's fixture rather than a host capability (`fixture.chains`): a target that
+ * does not supply it gets the contract reported `unsupported`, never passed. */
+export type FixtureRequirement = `fixture.${string}`;
+export interface ContractResult {
+    id: string;
+    title: string;
+    requires: readonly HostRequirement[];
+    status: ContractStatus;
+    /** Declared-capability gaps (or fixture inputs the target did not supply) for `unsupported`. */
+    missing?: (HostRequirement | FixtureRequirement)[];
+    ms: number;
+    evidence: Record<string, unknown>;
+    /** Why it failed, or for `inconclusive` why it proves nothing. */
+    error?: string;
+}
+export interface ConformanceReport {
+    host: string;
+    resolved?: ResolvedHost;
+    capabilities: HostCapabilities;
+    startedAt: string;
+    finishedAt: string;
+    results: ContractResult[];
+    summary: Record<ContractStatus, number>;
+    /** Failures outside any contract (prepare, cleanup). */
+    errors: string[];
+}
+export interface VerifiedHostReport extends ConformanceReport {
+    /** Extra facts the target reports (topology, binaries, block heights). */
+    provenance?: Record<string, unknown>;
+}
+/**
+ * The running lab a verification is run from (D10, 6 October 2026): its local environment's chain endpoints by chain id
+ * (`people`, `bulletin`, ...), so a target uses the lab's own chains instead of asking for a prepared baseline.
+ */
+export interface HostVerificationLab {
+    /** The environment's name, for the report. */
+    environment: string;
+    endpoints: Readonly<Record<string, string>>;
+}
+/** A targets module a verifier knows without being told (D9): the composition root's, with each host it defines. */
+export interface KnownHostTargets {
+    /** The module's absolute path. */
+    module: string;
+    /** The module's path as a person reads it: relative to the lab's directory when one is given. */
+    shown: string;
+    /** `unavailable`: why the host cannot run here now, on this machine or the running lab's chains (the target says; the lab window greys it with it). */
+    hosts: readonly {
+        id: string;
+        description?: string;
+        unavailable?: string;
+    }[];
+}
+export interface HostVerificationRequest {
+    /** The targets module (absolute path). */
+    targets: string;
+    /** A host id the module defines. */
+    host: string;
+    /** Run only these contract ids (the rest are reported skipped). */
+    only?: readonly string[];
+    /** The running lab's local chains, when it runs one: a target uses them before starting chains of its own. */
+    lab?: HostVerificationLab;
+    log?: (line: string) => void;
+    signal?: AbortSignal;
+}
+export interface HostVerifier {
+    /** The host ids a targets module defines; throws when it does not default-export `defineHostVerifications([...])`. */
+    hosts(targets: string): Promise<string[]>;
+    /** Set the target up, run the kit, close what the setup started. */
+    verify(request: HostVerificationRequest): Promise<VerifiedHostReport>;
+    /** Every declared contract passed and nothing failed outside them. */
+    conforms(report: ConformanceReport): boolean;
+    /** The report as text, one line per contract. */
+    format(report: ConformanceReport): string;
+    /**
+     * The targets modules this verifier knows (D9: the lab window's Hostile apps offers them as a menu), paths shown
+     * relative to `root`; a module that does not load is left out. Absent or empty: none known. `lab`: the running local
+     * environment's chains, so a target can say it cannot run on them (dot.li on a chain made from scratch).
+     */
+    known?(root?: string, lab?: HostVerificationLab): Promise<readonly KnownHostTargets[]>;
+}

package/core/ports/src/driven/host/host-verifier.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/host/index.d.ts

@@ -0,0 +1,7 @@
+export type { HostOptionDeclaration, HostOptionValue, HostOptionValues } from "@parity/product-lab/domain/actors";
+export type { HostAdapterFactory, HostAvailability, HostReleaseRequest, HostRouting, HostToolContext } from "./host-adapter-factory.js";
+export type { ApprovalPolicy, HostCapabilities, HostProbe, HostProbeRequest, HostProvider, HostRequirement, ResolvedHost } from "./host-provider.js";
+export type { AccountQuery, AppRequestOutcome, AccountSource, BlockedRequest, HostActor, HostApp, HostAppContext, HostConnection, HostSession, HostLogFile, HostSessionEvidence, HostSessionNetwork, HostSessionRequest, NetworkLogEntry, PendingApproval, SessionApprovals, SessionPlacement, SessionPlacements, SigningDecision, VerifiedAccount, } from "./host-session.js";
+export type { ConformanceReport, ContractResult, ContractStatus, FixtureRequirement, HostVerificationLab, HostVerificationRequest, HostVerifier, KnownHostTargets, VerifiedHostReport, } from "./host-verifier.js";
+export type { HostTools, HostToolSource } from "./host-tool-source.js";
+export type { UpstreamRef, UpstreamRequest, UpstreamResolver } from "./host-upstream.js";

package/core/ports/src/driven/host/index.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/identity/identity-provisioner.d.ts

@@ -0,0 +1,23 @@
+import type { ProvisionedIdentity } from "@parity/product-lab/domain/identity";
+export interface IdentityProvisionerCapabilities {
+    /** Registers a lite username on the People chain (onboarding). */
+    readonly registersUsername: boolean;
+    /** Accepts entropy chosen by the lab instead of generating its own. */
+    readonly acceptsEntropy: boolean;
+    /** Needs a local identity backend (`identity-backend` service). */
+    readonly needsIdentityBackend: boolean;
+}
+export interface ProvisionRequest {
+    actor: {
+        id: string;
+        name: string;
+    };
+    /** Entropy to adopt; only for provisioners that declare `acceptsEntropy`. */
+    entropy?: Uint8Array;
+    signal?: AbortSignal;
+}
+export interface IdentityProvisioner {
+    readonly id: string;
+    readonly capabilities: IdentityProvisionerCapabilities;
+    provision(request: ProvisionRequest): Promise<ProvisionedIdentity>;
+}

package/core/ports/src/driven/identity/identity-provisioner.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/identity/index.d.ts

@@ -0,0 +1,2 @@
+export type { IdentityProvisioner, IdentityProvisionerCapabilities, ProvisionRequest } from "./identity-provisioner.js";
+export type { DerivedProductAccount, DerivedResourceAccount, ProductAccountDerivation } from "./product-account-derivation.js";

package/core/ports/src/driven/identity/index.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/identity/product-account-derivation.d.ts

@@ -0,0 +1,23 @@
+/** A product account as the derivation gives it. */
+export interface DerivedProductAccount {
+    /** 0x-prefixed 32-byte public key. */
+    readonly publicKey: string;
+    /** SS58 address (generic Substrate prefix 42). */
+    readonly address: string;
+}
+/** An account a host claims a chain resource for on a product's behalf (RFC-0010), and which resource. */
+export interface DerivedResourceAccount extends DerivedProductAccount {
+    /** `statement-store` (People's statement allowance) or `bulletin` (Bulletin's long-term storage). */
+    readonly resource: "statement-store" | "bulletin";
+}
+export interface ProductAccountDerivation {
+    /** The account of `productId` at `index` (default 0) for an identity's `entropy`. Never echoes the entropy in an error. */
+    productAccount(entropy: Uint8Array, productId: string, index?: number): DerivedProductAccount;
+    /**
+     * The accounts a truAPI host claims resources for on `productId`'s behalf, hard-derived from the identity's entropy:
+     * `//allowance//statement-store//<product id>` and `//allowance//bulletin//<product id>` (host-rust-core RFC-0010).
+     * The host registers them through a ring proof (`AsResources`), which names no account: the lab credits such a
+     * claim to the session whose derivation gives its beneficiary.
+     */
+    resourceAccounts?(entropy: Uint8Array, productId: string): readonly DerivedResourceAccount[];
+}

package/core/ports/src/driven/identity/product-account-derivation.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/lab/client-bundles.d.ts

@@ -0,0 +1,13 @@
+/** One checked module: the folder it is confined to, the files it would serve, or why it is refused. */
+export interface ClientBundleCheck {
+    /** The entry's folder: a bundle may import only files inside it. */
+    readonly root: string;
+    /** Files of the bundle, relative to `root`, in the order they were reached. */
+    readonly files: readonly string[];
+    /** Why it is refused: a package import, a path outside `root`, a missing file, or a secret value. */
+    readonly refused?: string;
+}
+/** Walks a module's runtime imports from its entry file. `secret(text)` is true when the text holds a secret value. */
+export interface ClientBundleChecker {
+    check(file: string, secret: (text: string) => boolean): ClientBundleCheck;
+}

package/core/ports/src/driven/lab/client-bundles.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/core/ports/src/driven/lab/index.d.ts

@@ -0,0 +1,7 @@
+export type { InputField, Inputs, RunOptions, ScenarioContext, ScenarioDefinition, ScenarioStep, SetupContext, SetupScenarioDefinition, SetupStep } from "./scenario.js";
+export type { ActorlessCallContext, LabSentences, SentenceAction, SentenceArgument, SentenceInvariant, SentenceCallContext, SentenceScenarioContext, SentenceScenarioScope, StepOutputs } from "./lab-sentences.js";
+export type { ActorFunds, ActorRemoval, ActorRemovalSource, AppUpdateEvent, AppUpdateIdentity, AppUpdates, EnvironmentConditions, EnvironmentFixtures, EnvironmentHost, FixtureExpiry, FollowedApp, IdentityReserveStatus, LabEnvironment, NavigationRecords, PreOnboardedActorView, RootCallControl, SessionFixtureState, UnconfiguredHost, WorkspaceStatus } from "./lab-environment.js";
+export type { AppNavigation, AppRoute, EnvironmentDefinition, EnvironmentStartMeasurement, EnvironmentStartOptions, LabConfig, RunObservation, RouteField } from "./lab-configuration.js";
+export type { EnvironmentAdapters, EnvironmentDeclaration, LabCatalog, LabEnvironmentTooling, LabLoader, LabSentence, LoadedLab, EnvironmentAlias, PreviewApp, TopologyDeclaration, TopologyOverrides, TopologyPreviewRequest, } from "./loaded-lab.js";
+export type { ClientBundleCheck, ClientBundleChecker } from "./client-bundles.js";
+export type { LabDefinitionSource } from "./lab-definition-source.js";

package/core/ports/src/driven/lab/index.js

@@ -0,0 +1,3 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export {};