@parity/product-lab 0.0.1-placeholder → 0.1.0

package/adapters/features/cucumber/src/steps/register-feature-steps.js

@@ -0,0 +1,276 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import * as cucumber from "@cucumber/cucumber";
+import { OutputReference, SHARED_FIXTURE_TAG, stepFailure } from "@parity/product-lab/domain";
+import { plainLine, plainOutput } from "@parity/product-lab/domain/features";
+async function attachFailure(world, error) {
+    await world.attach(JSON.stringify({ productLab: "failure", ...stepFailure(error) }), "application/json");
+}
+export const GENERATED_STEP = "product-lab:generated";
+const scenarios = new WeakMap();
+const planning = new Set();
+const abandoned = new WeakSet();
+export const STOP_GRACE_MS = 5_000;
+let abandoning;
+let stopAsked = Promise.withResolvers();
+export async function planningSettled() {
+    while (planning.size) {
+        const all = Promise.allSettled([...planning]);
+        if (!abandoning) {
+            await Promise.race([all, stopAsked.promise]);
+            continue;
+        }
+        await Promise.race([all, abandoning]);
+        if (planning.size) {
+            planning.clear();
+            abandoning = undefined;
+            stopAsked = Promise.withResolvers();
+        }
+        return;
+    }
+    abandoning = undefined;
+    stopAsked = Promise.withResolvers();
+}
+export function abandonPlanning(graceMs = STOP_GRACE_MS) {
+    if (abandoning)
+        return;
+    abandoning = new Promise((done) => {
+        const timer = setTimeout(done, graceMs);
+        timer.unref?.();
+    });
+    stopAsked.resolve();
+}
+function track(world, begun) {
+    const tracked = begun
+        .then(async (handle) => {
+        if (abandoned.has(world))
+            await handle.end({ status: "failed", failure: { step: -1, text: "a hook", error: "Cucumber gave up on planning the scenario before its start state was ready" } });
+    }, 
+    (error) => void error)
+        .finally(() => planning.delete(tracked));
+    planning.add(tracked);
+}
+function keepEnding(ending) {
+    const tracked = ending.then(() => undefined, 
+    (error) => void error).finally(() => planning.delete(tracked));
+    planning.add(tracked);
+}
+export function scenarioOf(world) {
+    return scenarios.get(world)?.scenario;
+}
+export function pickleSource(pickle, document) {
+    const target = pickle.astNodeIds.at(-1);
+    const lines = new Map();
+    const visit = (children) => {
+        for (const child of children) {
+            if (child.rule?.children)
+                visit(child.rule.children);
+            const scenario = child.scenario;
+            if (!scenario)
+                continue;
+            lines.set(scenario.id, scenario.location.line);
+            for (const examples of scenario.examples ?? [])
+                for (const row of examples.tableBody ?? [])
+                    lines.set(row.id, row.location.line);
+        }
+    };
+    visit(document?.feature?.children ?? []);
+    const line = target !== undefined ? lines.get(target) : undefined;
+    return { uri: pickle.uri, ...(line !== undefined ? { line } : {}) };
+}
+export function scenarioOutcome(pickle, result, current) {
+    const status = String(result?.status ?? "").toUpperCase();
+    if (status === "PASSED")
+        return { status: "passed" };
+    if (status === "SKIPPED")
+        return { status: "skipped" };
+    const text = current >= 0 ? pickle.steps[current]?.text : undefined;
+    const error = (result?.message ?? "").split("\n").filter((line) => !/^\s+at /.test(line)).join("\n").trim();
+    return { status: "failed", failure: { step: text !== undefined ? current : -1, text: text ?? "a hook", error: error || `Cucumber reported ${status.toLowerCase() || "no result"}` } };
+}
+export function pickleSteps(pickle) {
+    return pickle.steps.map((step) => {
+        const rows = step.argument?.dataTable?.rows;
+        const docString = step.argument?.docString?.content;
+        return { text: step.text, ...(rows ? { table: rows.map((row) => row.cells.map((cell) => cell.value)) } : {}), ...(docString !== undefined ? { docString } : {}) };
+    });
+}
+export function registerFeatureSteps(session, options = {}) {
+    const api = options.cucumber ?? cucumber;
+    const stepTimeout = options.stepTimeoutMs ?? 10 * 60_000;
+    const hookTimeout = options.hookTimeoutMs ?? 5 * 60_000;
+    const planTimeout = options.planTimeoutMs ?? PLAN_TIMEOUT_MS;
+    const settled = planningSettled;
+    const sentences = session.sentences();
+    const custom = options.customSteps !== false ? options.customStepSource : undefined;
+    const plain = plainOutput(process.env);
+    const log = options.log ?? ((line) => {
+        process.stdout.write(plain ? plainLine(`  ${line.replace(/^\[product-lab\] /, "")}`) : `\n${line}\n`);
+    });
+    const reported = new Set();
+    api.Before({ name: "product-lab: plan the scenario", timeout: planTimeout }, async function ({ pickle, gherkinDocument }) {
+        const notFor = (await session.notFor?.(pickle.tags.map((tag) => tag.name))) ?? [];
+        if (notFor.length) {
+            await this.attach(JSON.stringify({ productLab: "not-for", notFor }), "application/json");
+            for (const item of notFor)
+                if (!reported.has(item.tag)) {
+                    reported.add(item.tag);
+                    log(`[product-lab] Not for this chain: ${item.reason} (${item.tag}); its scenarios are skipped`);
+                }
+            return "skipped";
+        }
+        const shared = pickle.tags.find((tag) => tag.name === SHARED_FIXTURE_TAG);
+        let scenario;
+        try {
+            const begun = session.begin({
+                name: pickle.name,
+                steps: pickleSteps(pickle),
+                custom: (text) => (custom?.isCustom(text) ?? false) || !!options.custom?.(text),
+                ...(options.bindings ? { bindings: options.bindings } : {}),
+                ...(options.hosts ? { hosts: options.hosts } : {}),
+                tags: pickle.tags.map((tag) => tag.name),
+                ...(shared ? { fixtureGroup: `${pickle.uri}#${shared.astNodeId}` } : {}),
+                source: pickleSource(pickle, gherkinDocument),
+            });
+            track(this, begun);
+            scenario = await begun;
+            if (abandoned.has(this))
+                return;
+        }
+        catch (error) {
+            await attachFailure(this, error);
+            throw error;
+        }
+        scenarios.set(this, { scenario, ids: pickle.steps.map((step) => step.id), current: -1 });
+        const fixture = scenario.fixture;
+        if (fixture) {
+            await this.attach(JSON.stringify({ productLab: "fixture", ...fixture }), "application/json");
+            if (fixture.action === "run-start")
+                log(`[product-lab] Starting state kept as ${fixture.name} in ${(fixture.ms / 1000).toFixed(1)} s before "${pickle.name}" (Keep each fork run's starting state)`);
+            else
+                log(`[product-lab] Fixture ${fixture.name} ${fixture.action}${fixture.action === "restored" || fixture.action === "built" ? ` in ${(fixture.ms / 1000).toFixed(1)} s` : ""} before "${pickle.name}"${fixture.reason && fixture.action !== "built" ? ` (${fixture.reason})` : ""}`);
+        }
+        const isolation = scenario.isolation;
+        if (isolation)
+            log(`[product-lab] Isolated scenario: the start state was ${isolation.action} on ${isolation.environment} in ${(isolation.ms / 1000).toFixed(1)} s before "${pickle.name}"${isolation.reason ? ` (${isolation.reason})` : ""}`);
+    });
+    api.BeforeStep(function ({ pickleStep }) {
+        const state = scenarios.get(this);
+        if (state)
+            state.current = state.ids.indexOf(pickleStep.id);
+    });
+    if (options.beforeStep) {
+        const gate = options.beforeStep;
+        api.BeforeStep({ timeout: -1 }, async function ({ pickle, pickleStep }) {
+            const state = scenarios.get(this);
+            await gated(gate({ scenario: pickle.name, index: state ? state.ids.indexOf(pickleStep.id) : -1, text: pickleStep.text, status: "pending" }));
+        });
+    }
+    for (const view of sentences) {
+        const body = async function () {
+            const state = scenarios.get(this);
+            if (!state)
+                throw new Error("The scenario was not planned (the product-lab Before hook did not run)");
+            const index = state.current;
+            state.pending = index;
+            try {
+                const trace = await state.scenario.run(index);
+                await this.attach(JSON.stringify({ productLab: "step", ...trace }), "application/json");
+            }
+            catch (error) {
+                const trace = error.trace;
+                if (trace)
+                    await this.attach(JSON.stringify({ productLab: "step", ...trace }), "application/json");
+                await attachFailure(this, error);
+                throw error;
+            }
+            finally {
+                delete state.pending;
+            }
+        };
+        Object.defineProperty(body, "length", { value: view.parameters + (view.takesTable ? 1 : 0) });
+        api.defineStep(new RegExp(view.regex), { timeout: stepTimeout, wrapperOptions: { [GENERATED_STEP]: view.pattern } }, body);
+    }
+    custom?.forward((step) => registerCustomStep(api, step, stepTimeout));
+    if (options.afterStep) {
+        const gate = options.afterStep;
+        api.AfterStep({ timeout: -1 }, async function ({ pickle, pickleStep, result }) {
+            const state = scenarios.get(this);
+            await gated(gate({ scenario: pickle.name, index: state ? state.ids.indexOf(pickleStep.id) : -1, text: pickleStep.text, status: String(result.status).toLowerCase() }));
+        });
+    }
+    api.After({ name: "product-lab: end the scenario", timeout: hookTimeout }, async function ({ pickle, result }) {
+        const state = scenarios.get(this);
+        scenarios.delete(this);
+        if (!state)
+            abandoned.add(this);
+        if (!state)
+            return;
+        const pending = state.pending;
+        const ending = state.scenario.end(scenarioOutcome(pickle, result, state.current));
+        keepEnding(ending);
+        try {
+            await ending;
+        }
+        finally {
+            const trace = pending === undefined ? undefined : state.scenario.trace().find((step) => step.index === pending);
+            const errors = trace?.calls.flatMap((call) => call.abortDetail ? [`${call.error ?? "Aborted"}; action failed while aborting: ${call.abortDetail}`] : []) ?? [];
+            if (errors.length)
+                await this.attach(JSON.stringify({ productLab: "abort-diagnostics", index: pending, error: errors.join("; ") }), "application/json");
+        }
+    });
+    return { sentences: sentences.length, settled };
+}
+export const PLAN_TIMEOUT_MS = 31 * 60_000;
+export const STEP_GATE_MS = 24 * 60 * 60_000;
+export async function gated(wait, ms = STEP_GATE_MS) {
+    let timer;
+    const bound = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error(`The step gate was not released within ${ms} ms`)), ms);
+        timer.unref();
+    });
+    try {
+        await Promise.race([wait, bound]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function customValue(kind, text, scenario) {
+    const reference = kind === "int" || kind === "string" ? OutputReference.parse(text) : undefined;
+    if (reference) {
+        const value = scenario.outputs.latest(reference.name, reference.actor);
+        if (value === undefined)
+            throw new Error(`${reference} refers to no earlier output`);
+        return value;
+    }
+    return kind === "int" || kind === "count" ? Number(text) : text;
+}
+function registerCustomStep(api, custom, stepTimeout) {
+    const { pattern } = custom;
+    const body = async function (...args) {
+        const state = scenarios.get(this);
+        if (!state)
+            throw new Error("The scenario was not planned (the product-lab Before hook did not run)");
+        const values = pattern.parameters.map((kind, index) => customValue(kind, String(args[index]), state.scenario));
+        const table = pattern.takesTable ? args[pattern.parameters.length].raw() : undefined;
+        await this.attach(JSON.stringify({ productLab: "step", custom: true, pattern: pattern.text, index: state.current }), "application/json");
+        const attach = this.attach.bind(this);
+        try {
+            await custom.run({
+                lab: {
+                    scenario: state.scenario.name,
+                    actor: (name) => state.scenario.actor(name),
+                    outputs: state.scenario.outputs,
+                    attach: (evidence) => Promise.resolve(attach(JSON.stringify(evidence), "application/json")),
+                },
+            }, ...values, ...(table ? [table] : []));
+        }
+        catch (error) {
+            await attachFailure(this, error);
+            throw error;
+        }
+    };
+    Object.defineProperty(body, "length", { value: pattern.parameters.length + (pattern.takesTable ? 1 : 0) });
+    api.defineStep(pattern.regex, { timeout: custom.timeoutMs ?? stepTimeout, wrapperOptions: { "product-lab:custom": pattern.text } }, body);
+}

package/adapters/features/cucumber/src/support/bundled-support.d.ts

@@ -0,0 +1 @@
+export {};

package/adapters/features/cucumber/src/support/bundled-support.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { pathToFileURL } from "node:url";
+import { AfterAll, BeforeAll } from "@cucumber/cucumber";
+import { plainLine, plainOutput } from "@parity/product-lab/domain/features";
+import { featureSessionSettings } from "../steps/feature-session-settings.js";
+import { abandonPlanning, planningSettled, registerFeatureSteps } from "../steps/register-feature-steps.js";
+const module = process.env.PRODUCT_LAB_RUNTIME_MODULE;
+if (!module)
+    throw new Error("A bundled run needs PRODUCT_LAB_RUNTIME_MODULE (set by the composition root's feature runner)");
+const { featureRuntime, customStepSource } = (await import(__rewriteRelativeImportExtension(pathToFileURL(module).href)));
+const runtime = featureRuntime();
+await runtime.load();
+const minutes = (name, fallback) => Number(process.env[name] ?? fallback) * 60_000;
+registerFeatureSteps(runtime.featureSession(featureSessionSettings((name) => process.env[name])), {
+    ...(customStepSource ? { customStepSource } : {}),
+    stepTimeoutMs: minutes("PRODUCT_LAB_STEP_TIMEOUT_MINUTES", 10),
+});
+let stopping;
+const stop = () => (stopping ??= (async () => {
+    try {
+        await planningSettled();
+        await runtime.stopEnvironment({ interruptRun: true });
+    }
+    finally {
+        await runtime.close();
+    }
+})());
+const interrupted = () => {
+    abandonPlanning();
+    void stop().then(() => process.exit(130), (error) => {
+        console.error(`[product-lab] stopping the environment after the interrupt failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        process.exit(1);
+    });
+};
+BeforeAll({ name: "product-lab: start the environment", timeout: minutes("PRODUCT_LAB_STARTUP_TIMEOUT_MINUTES", 30) }, async () => {
+    process.once("SIGINT", interrupted);
+    process.once("SIGTERM", interrupted);
+    const environment = process.env.PRODUCT_LAB_ENVIRONMENT;
+    const warnings = runtime.subscribe((event) => {
+        if (event.type !== "environment-progress" || !event.message.startsWith("Warning:"))
+            return;
+        if (plainOutput(process.env))
+            process.stdout.write(plainLine(`  ${event.message}`));
+        else
+            console.warn(`[product-lab] ${event.message}`);
+    });
+    try {
+        await runtime.startEnvironment(environment ? { environment } : {});
+    }
+    finally {
+        warnings();
+    }
+    if (process.env.PRODUCT_LAB_ROOT_CALLS === "1")
+        runtime.allowRootCalls({ confirmation: runtime.snapshot().confirmations.rootCalls });
+});
+AfterAll({ name: "product-lab: stop the environment", timeout: minutes("PRODUCT_LAB_CLEANUP_TIMEOUT_MINUTES", 5) }, async () => {
+    process.off("SIGINT", interrupted);
+    process.off("SIGTERM", interrupted);
+    await stop();
+});

package/adapters/host/dotli/README.md

@@ -0,0 +1,135 @@
+# @product-lab/host-dotli
+
+Status: **unsigned sessions**. Host provider: dot.li browser host with interception; sessions run a locked debug build with deny-by-default networking, and are not signed in.
+
+What is here is what the 2026-09-24 browser spike proved:
+
+- `routing.ts`: the interception table. Public People, Asset Hub and Bulletin RPC
+  endpoints compiled into dot.li bridge to the local fork; the public IPFS gateway
+  is answered from local content; relay endpoints are denied unless mapped. Since
+  Phase 3 everything else is decided by the domain's `NetworkPolicy` (`table.policy`):
+  the environment's
+  routes, the dot.li build origins (`http://*.<suffix>:<hostPort>`) and `allowOrigins`
+  as app origins, and optional `exceptions` (origin and reason) are allowed; the rest
+  is denied with the policy's reason. `createInterceptionTable` takes `routes` (or
+  bare `local` endpoints, turned into a routing); `hostResolverBackstop(table?)` is the
+  policy's `hostResolverRules()`, which now also maps the backstop canary. `localEndpoints(routes)`
+  (refactor step 7 part b) derives the table's local endpoints (`LocalEndpoints`)
+  from the domain's `HostNetworkRoutes`: People, Asset Hub and Bulletin required,
+  the relay when routed.
+- `interception.ts`: installs the table on a browser context (the Browser port's
+  `BrowserContext`; a Playwright context satisfies it). WebSockets are
+  bridged in Node because `WebSocketRoute.connectToServer()` cannot change the URL.
+  The host-resolver backstop must be passed to the browser launch, because
+  SharedWorker traffic bypasses Playwright routing.
+- Local content: `installDotliInterception(context, table, { content })` answers dot.li's
+  `GET /ipfs/<cid>?format=car` through the `ContentArchiver` port (`@product-lab/ports/deploy`,
+  refactor step 8): `archive(cid)` from the local content store, and `reverify(cid, car)` for the
+  opt-in public-gateway fallback, every block checked against its CID. The caller passes an
+  implementation, today `BulletinContentReader` from `@product-lab/deploy-bulletin` (the CAR
+  builder over Bulletin `bitswap_v1_get` that lived in `local-content.ts` until step 8, when it
+  moved there with its tests). The fallback fetch is bounded by `publicFallbackTimeoutMs` (default
+  60 000 ms): a gateway that does not answer in time gets the page a 502 and a recorded denial. A page
+  socket that cannot be closed (the page already gone) is recorded as an event, not reported as a second
+  denial (`tests/interception.test.ts`).
+
+- `dotli-host.ts`, `dotli-host-factory.ts` (refactor step 7): `DotliHostFactory`, a
+  `HostAdapterFactory` like the truAPI CLI and WASM hosts' (kind `dotli`, options schema
+  `dotliHostOptionsSchema`: optional `hostPort`, `hostnameSuffix`, loopback `allowOrigins`, `build`,
+  `denyByDefault`, `networkExceptions`, `readyTimeoutMs`; its dependencies are `{ routes, browser? }`,
+  the environment's `HostNetworkRoutes` and the Browser port, and `system.ports`), and `DotliHost implements HostProvider`.
+  It builds the interception table from its routes and options (`host.table`). Without `hostPort` (`hosts: { dotli: {} }`,
+  7 October 2026) the host reserves a free port of the lab's (`system.ports.next`, as the truAPI WASM host does for its
+  `port`) in `prepare()`, before its gates admit dot.li's origins and its server binds; `host.table` is built then, and
+  read before it says so. No `hostPort` and no lab ports: `prepare()` is refused by name. `tests/dotli-host.test.ts`
+  ("hosts: { dotli: {} }", with a planted control).
+- **Sessions** (25 September 2026), only when a
+  browser is given: `prepare()` resolves the locked dot.li build (`resolve()`: label, directory, tree
+  sha256), with `denyByDefault` checks the browser's resolver backstop (dot.li runs its core in a
+  SharedWorker, which page routing cannot see), and serves the build on `127.0.0.1:<hostPort>`
+  (`dotli-server.ts`, the routing of dot.li's own preview server). `createSession` opens
+  `http://localhost:<hostPort>/localhost:<appPort><path>?…&dotliProductId=<productId>` (the debug build's
+  local-product path) in a browser context of its own with the interception installed: chain endpoints
+  compiled into dot.li bridge to the routes, the dot.li origins and the app's origin are allowed, and
+  everything else is decided by the domain's `NetworkPolicy`; denials are reported
+  (`session.network.blocked()`) and every decision is kept (`host.interceptionLog()`). The dot.li page's console
+  (the page and its frames, from before the first navigation; `src/page-console.ts`) is kept too, every text
+  redacted (`scrubConsoleText`, then the `redactConsole` option): `session.console()`, `host.consoleLog()` with
+  dot.li's diagnostics picked out ("[dot.li protocol] Requested mode", "[dot.li perf] chain=…", init-failed;
+  dot.li's SharedWorker prints to its own console, a recorded gap). `page()` is dot.li's
+  product frame (`#app iframe`). Sessions are **not signed in**: `productAccounts: false`, no approval
+  policy (a session requested with one is refused), `account()`, `approvals` and `importIdentity` throw
+  `UnsupportedHostOperation`. Capabilities with a browser: `localNetwork`, `localApps`,
+  `sessionsPerProcess: 1`, and `denyByDefaultNetwork` only with `denyByDefault`. Without a browser, nothing
+  (every flag false, as before). Given `chainGates` too (backlog 92's origin gates: the factory's `deps.chainGates`,
+  the composition root's, or a targets module's), a deny-by-default host routes itself through them in `prepare()`
+  and admits only dot.li's own page and protocol frame (`dotliOrigins`: `http://localhost:<port>`,
+  `http://host.<suffix>:<port>`). The bridge to the nodes runs in Node and passes the gates; routing cannot tell which
+  frame opens a local node, so a product frame that opens the gate is refused there, and the node's own address is no
+  route any more (denied by the interception). Both are in `session.network.blocked()`; `evidence.network.gates`
+  names the admitted origins. Limit: a product frame
+  that opens one of dot.li's public chain URLs is bridged like dot.li's own (Playwright's `WebSocketRoute` names no
+  frame). A session's `stop()` closes its page and its context and reports a close
+  that fails (`AggregateError`) instead of dropping it (`tests/dotli-host.test.ts`).
+- `dotli-build.ts`: `dotli.lock.json` pins `paritytech/dotli-community` at a full commit, the network
+  (`paseo-next-v2`), a debug build and the truAPI that build bundles (`truapi`). Since 6 October 2026 it pins
+  `577ddd50e` (dotli-community `main` that day; `@parity/truapi` 0.23.0, `@parity/truapi-host` 0.23.0,
+  `@parity/truapi-provider` 0.3.1, as live paseo.li), before that `d91104b` of 10 September (truAPI 0.13.1).
+  `product-lab host build --host dotli [--repo <clone>] [--workdir <dir>]
+  [--keep-workdir] [--cache <dir>]` fetches only that commit, installs with the package manager its lockfile names
+  (`npm ci` for a `package-lock.json`, as dot.li since its move to npm; else `bun install --frozen-lockfile`), builds
+  (`npm run build` or `bun run build`) with `VITE_NETWORKS=<network> VITE_APP_DEBUG=true`, and caches
+  `apps/{host,sandbox,protocol}/dist` under `<cache>/hosts/dotli/<commit12>-<network>-debug/` with `acquired.json`
+  (a digest over every file, the tools and, since 6 October, the truAPI packages the checkout installed, which
+  `tests/dotli-build.test.ts` compares with the lock; an older Bun build's source maps name them instead; 13.8 s end
+  to end on 25 September 2026; for `577ddd50e` with npm: fetch 24 s, install 19 s, build 7 s). `findDotliBuild()` refuses a missing, other-commit or modified copy
+  and names that command. `product-lab host fetch --host dotli` reports the cached build (nothing is
+  downloaded). The build is not byte-reproducible (two builds of the commit had different tree digests),
+  so the digest identifies one cached build, not the commit.
+  The asynchronous build takes `HostToolContext.commands` and its abort signal:
+  tool checks have a 30 s limit, Git inspection 10 s, fetch 10 minutes, and each
+  other build command 15 minutes. A timeout or abort stops the command tree and
+  fails the build. Each build command requests the previous 64 MiB cap per output stream.
+
+Conformance: `product-lab host verify --host dotli --config tools/verify/src/dotli.ts` (and `--host dotli-leaky`,
+whose session policy lets `https://example.com` through as an exception the kit does not know; its network
+contract must fail), with optional `PRODUCT_LAB_PORT_BASE` and `PRODUCT_LAB_STATE_DIR`. Live on 25 September 2026: 2
+passed (session, network), 10 unsupported; the leaky control fails the network contract. Since 6 October 2026 they
+take People as the truAPI targets do (the running lab's chain, `host verify --environment`, then `PRODUCT_LAB_PEOPLE_WS`,
+then a node from `PRODUCT_LAB_BASELINE`) and are in the lab window's Hostile apps menu, where only the chain-node bypass
+is checked (the other three attacks need a signed-in account); without the locked build they are greyed there with
+`MissingDotliBuildError`'s fix. dot.li serves a product only the chains whose genesis it compiles in
+(`DotliNetworkEndpoints.genesis`, from dotli-community's `packages/config/src/network.ts`; its provider returns none
+for another genesis): a copy of paseo-next-v2 keeps those hashes, a chain made from scratch (Notes' fast) does
+not. `unservedChains(routes, roles)` names the routed chains it would not serve and `unservedReason` says so in words;
+the targets refuse such a People chain at setup and are greyed with that reason while one runs. Before that check a run
+on fast waited two minutes and reported "The host let a hostile app through", which was false.
+
+truAPI pairing: the kit's probe and the locked build must speak the same truAPI release (`dotliTruapiPairing` in
+`tools/verify/src/dotli.ts` greys the `dotli` targets otherwise). `d91104b` (truAPI 0.13) against the probe's 0.23 was
+such a gap on 6 October 2026: dot.li never answered the probe's chain request; `577ddd50e` closes it.
+
+Placeholders: signing, login/pairing and navigation events (`dotliCapabilities`). A local pairing spike on
+4 October 2026 got as far as the pairing handshake and stopped where the signing side needs an account that is a ring member on the chain.
+
+Every browser session exposes passive `networkEvidence()` from its tab. Direct endpoints and opaque
+traffic remain listed, and a browser without this observation reports incomplete coverage. dot.li's host
+and app share a context: the adapter cannot prove whether shared-worker traffic belongs to the host or
+the app, so every session records that attribution gap. These unsigned sessions provide no signing
+evidence or inferred signature correlation.
+
+
+| | |
+| --- | --- |
+| Nx project | `host-dotli` |
+| Tags | `scope:provider`, `type:adapter` |
+| Exports | `src/index.ts` only: the routing (with `localEndpoints`) and interception functions above, `DotliHostDeps`, `status`, `dotliCapabilities`, `DotliHost`, `DotliHostSession`, `DotliSessionEvidence`, `DotliHostFactory`, `dotliHostOptionsSchema`, `DOTLI_KIND`, `DOTLI_FLAGS`, `DOTLI_HOST_ID`, `DOTLI_HOST_COLOR` (`#0e7490`), `DOTLI_HOST_CAPABILITIES`, `DOTLI_NETWORKS`, `DOTLI_PRODUCT_FRAME`, `DOTLI_PRODUCT_ID_PARAM`, `productUrlFor`, `dotliSessionUrl`, `dotliOrigins`; the console (`watchDotliConsole`, `dotliDiagnostics`, `scrubConsoleText`, `DOTLI_DIAGNOSTIC`, `DotliConsoleEntry`, `DotliConsoleRecord`); the build (`buildDotli`, `findDotliBuild`, `readDotliLock`, `dotliCacheRoot`, `dotliBuildDir`, `treeDigest`, `MissingDotliBuildError`, `DOTLI_BUILDS`, `DOTLI_LOCK_FILE`) and `startDotliServer` |
+| Implements | `HostAdapterFactory` (`DotliHostFactory`, with `fetch`, `build` and `availability`) and `HostProvider` (`DotliHost`), both `@product-lab/ports/host`, with unsigned sessions when given a browser; uses `ContentArchiver` (`@product-lab/ports/deploy`) and the Browser port |
+| Depends on | `@product-lab/ports` (`HostProvider`, the Browser port, `HostAdapterFactory`), `@product-lab/domain` (`UnsupportedHostOperation`, `appUrl`, `LoopbackUrl`, `HostNetworkRoutes`, `NetworkPolicy`), `zod`; no other adapter |
+| Used by | the composition root (`composition/src/adapter-catalogue.ts`, host kind `dotli`, also in `HOST_TOOL_KINDS` for `host fetch` and `host build`), `tools/verify` (`src/dotli.ts`), `tools/spikes/browser` |
+
+Tests: `bunx nx run host-dotli:test` (routing decisions; the factory and host: options refused, table built, session operations refused without a browser, capabilities with one, the session URL; the console kept from before the first navigation, redacted, bounded, detached on stop (`tests/page-console.test.ts`); with chain gates, the routes swapped once, only dot.li's origins admitted and the refusals reported; the lock and the truAPI it names, the cache check (missing, other commit, modified) and the server's routing; no browser, no chain). Browser: `tools/verify/tests/dotli-gates-browser.test.ts` (a real Chromium, a stand-in dot.li build, real gates in front of a fake node; control: gates off). Live: the conformance targets above.
+
+Private, workspace-only package. Consumers will install the single umbrella package `@parity/product-lab` once it is published.
+
+Framing reuse (item82): normal product framing checks call the injected `AppFramingInspector` through the host's system dependencies. The optional legacy `documentHeaders` callback remains a compatibility override and uses the shared pure domain decision. Session evidence includes allowed/refused/unknown framing status; missing or failed reader evidence is unknown. The adapter constructs no Node reader and imports no application or panel code. Capability declarations and existing native-host qualification are unchanged; these source controls do not establish a new live host capability.

package/adapters/host/dotli/src/dotli-build.d.ts

@@ -0,0 +1,85 @@
+import { z } from "zod";
+import type { CommandRunner } from "@parity/product-lab/ports/system";
+export declare const DOTLI_LOCK_FILE: string;
+/** The builds dot.li serves, by the monorepo path they are built into. */
+export declare const DOTLI_BUILDS: readonly ["apps/host/dist", "apps/sandbox/dist", "apps/protocol/dist"];
+declare const lockSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    repository: z.ZodURL;
+    commit: z.ZodString;
+    network: z.ZodString;
+    debug: z.ZodLiteral<true>;
+    truapi: z.ZodObject<{
+        client: z.ZodString;
+        host: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type DotliLock = z.infer<typeof lockSchema>;
+export declare function readDotliLock(file?: string): DotliLock;
+/** product-lab's shared cache (`PRODUCT_LAB_CACHE_DIR`, else `$XDG_CACHE_HOME/product-lab`, else `~/.cache/product-lab`). */
+export declare function dotliCacheRoot(env?: Readonly<Record<string, string | undefined>>): string;
+export declare const dotliBuildName: (lock: Pick<DotliLock, "commit" | "network">) => string;
+export declare const dotliBuildDir: (cacheDir: string, lock: Pick<DotliLock, "commit" | "network">) => string;
+export interface DotliBuildRecord {
+    schemaVersion: 1;
+    label: string;
+    repository: string;
+    commit: string;
+    network: string;
+    debug: true;
+    /** sha256 over every served file's path and digest, sorted. */
+    treeSha256: string;
+    files: number;
+    bytes: number;
+    builtAt: string;
+    tools: Record<string, string>;
+    steps: {
+        name: string;
+        ms: number;
+    }[];
+    /**
+     * The truAPI packages the checkout installed (`@parity/truapi`, `@parity/truapi-host`, `@parity/truapi-provider`), read
+     * from its `node_modules` after the install. Absent in builds made before 6 October 2026, whose source maps name them.
+     */
+    truapi?: {
+        client?: string;
+        host?: string;
+        provider?: string;
+    };
+}
+export interface DotliBuild {
+    /** The cache directory holding `apps/*\/dist`. */
+    dir: string;
+    record: DotliBuildRecord;
+}
+/** Digest of a directory tree: every file's relative path and sha256, sorted. */
+export declare function treeDigest(root: string, parts?: readonly string[]): {
+    sha256: string;
+    files: number;
+    bytes: number;
+};
+export declare class MissingDotliBuildError extends Error {
+    readonly command = "product-lab host build --host dotli";
+    constructor(message: string);
+}
+/** The cached build for the lock, verified against its recorded digest. */
+export declare function findDotliBuild(options?: {
+    cacheDir?: string;
+    lock?: DotliLock;
+}): DotliBuild;
+export interface DotliBuildOptions {
+    /** Bounded, cancellable one-shot commands supplied by the caller. */
+    commands: CommandRunner;
+    signal?: AbortSignal;
+    cacheDir?: string;
+    lock?: DotliLock;
+    /** A local dot.li clone to clone from (its working tree is never touched; it must contain the locked commit). */
+    repo?: string;
+    /** New directory for the checkout (default: a new temporary directory). Removed afterwards unless `keepWorkdir`. */
+    workdir?: string;
+    keepWorkdir?: boolean;
+    log?: (line: string) => void;
+}
+/** Clone, build (debug, the locked network) and cache the locked dot.li. */
+export declare function buildDotli(options: DotliBuildOptions): Promise<DotliBuild>;
+export {};