@parity/product-lab 0.0.1-placeholder → 0.1.0

package/adapters/host/truapi-wasm/src/provider.js

@@ -0,0 +1,496 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { UnsupportedHostOperation, appUrl, appUrlAt, navigationRequest, } from "@parity/product-lab/domain";
+import { assertBip39Entropy } from "@parity/product-lab/domain";
+import { NetworkPolicy } from "@parity/product-lab/domain";
+import { hostPageUrl, localChains, mockSettings } from "./config.js";
+import { BULLETIN_LIMIT_LABEL, BULLETIN_LIMIT_WHY, bulletinLimits, bulletinReadProbe } from "./bulletin-read-probe.js";
+import { ENTROPY_PATCH_ID, patchEntropyCheck, RELEASED_PAGE_ENTROPY_BYTES, shortEntropyRefusal } from "./entropy-patch.js";
+import { ownLoader, ownScript } from "./own-script.js";
+import { clientVersionBeside, truapiPairing } from "./truapi-pairing.js";
+import { hostPageLayoutScript } from "./host-page-layout.js";
+import { SESSION_TAG_PARAM, accountEntry, forgetSignInParameters, signInKey, signInScript } from "./sign-in.js";
+import { inspectFraming } from "./framing.js";
+import { namedByChain } from "./endpoint-chains.js";
+export const PACKAGE = "@parity/truapi-host";
+export const VERIFIED_VERSION = "0.23.0";
+export const PRODUCT_FRAME = "#product-frame";
+function packageRoot(hostPackage) {
+    return hostPackage ?? dirname(dirname(fileURLToPath(import.meta.resolve(PACKAGE))));
+}
+export function installedVersion(hostPackage) {
+    const manifest = JSON.parse(readFileSync(join(packageRoot(hostPackage), "package.json"), "utf8"));
+    if (hostPackage !== undefined && manifest.name !== PACKAGE)
+        throw new Error(`${hostPackage} holds ${String(manifest.name)}, not ${PACKAGE}`);
+    return manifest.version;
+}
+export function appsClientVersion() {
+    return clientVersionBeside(packageRoot());
+}
+function defaultServer(hostPackage) {
+    return async (port) => {
+        const { createTestHostServer } = (hostPackage === undefined
+            ? await import("@parity/truapi-host/testing/server")
+            : await import(__rewriteRelativeImportExtension(pathToFileURL(join(hostPackage, "dist", "testing", "server.js")).href)));
+        const server = await createTestHostServer({ port });
+        return {
+            ...server,
+            async bundle() {
+                const response = await fetch(`${server.url}/test-host.js`);
+                if (!response.ok)
+                    throw new Error(`The WASM test host server answered ${response.status} for its bundle`);
+                return response.text();
+            },
+        };
+    };
+}
+const unsupported = (operation, missing) => new UnsupportedHostOperation("truapi-wasm", operation, missing);
+const origin = (url) => new URL(url).origin;
+async function applyPolicy(context, policy, events, started, sockets = true) {
+    const record = (kind, url) => {
+        const decision = policy.decide(url, kind);
+        events.push({
+            at: Math.round(performance.now() - started),
+            kind,
+            url: url.length > 300 ? `${url.slice(0, 300)}…` : url,
+            verdict: decision.verdict,
+            detail: decision.verdict === "allow" ? `${decision.rule} ${decision.target}` : decision.reason,
+        });
+        return decision.verdict === "allow";
+    };
+    await context.route("**/*", (route) => (record("http", route.request().url()) ? route.continue() : route.abort("blockedbyclient")));
+    if (!sockets)
+        return;
+    await context.routeWebSocket(() => true, (socket) => {
+        if (record("websocket", socket.url()))
+            socket.connectToServer();
+        else
+            socket.close({ code: 4403, reason: "denied by product-lab" }).catch(() => undefined);
+    });
+}
+async function verifyBackstop(browser, serverUrl) {
+    const port = new URL(serverUrl).port;
+    const page = await browser.newPage();
+    try {
+        const result = await page.evaluate((url) => fetch(url, { mode: "no-cors", cache: "no-store" }).then(() => "reached", (error) => String(error)), `http://${NetworkPolicy.BACKSTOP_CANARY}:${port}/`);
+        if (result !== "reached")
+            throw new Error(`deny-by-default needs the browser launched with the network policy's resolver backstop ` +
+                `(--host-resolver-rules=<NetworkPolicy.hostResolverRules()>): the canary ${NetworkPolicy.BACKSTOP_CANARY} did not resolve (${result})`);
+    }
+    finally {
+        await page.close();
+    }
+}
+export const NETWORK_LOCKED_LABEL = "network locked";
+export const NETWORK_PARTLY_LOCKED_LABEL = "network partly locked: sockets open";
+export const NETWORK_SOCKETS_LISTED_LABEL = "network locked: sockets observed and listed, not blocked";
+export const TRUAPI_WASM_LIMITS = [{ label: BULLETIN_LIMIT_LABEL, why: BULLETIN_LIMIT_WHY }];
+export const TRUAPI_WASM_HOST = { id: "truapi-wasm", label: "truAPI WASM", color: "#7a5af8", limits: TRUAPI_WASM_LIMITS };
+export function truapiWasmHost(options) {
+    const { hostPackage } = options;
+    const mode = options.mode ?? "faithful";
+    let routes = options.routes;
+    let chains = localChains(routes);
+    let gated;
+    const defaultApprovals = options.approvals ?? "approve-all";
+    let server;
+    let bundle;
+    let opened = 0;
+    let backstop = false;
+    const sessions = new Set();
+    const identities = new WeakMap();
+    const patchedPages = new WeakSet();
+    const assertPageTakes = (identity, session) => {
+        assertBip39Entropy(identity.entropy);
+        if (identity.entropy.length === RELEASED_PAGE_ENTROPY_BYTES || (session && patchedPages.has(session)) || (!session && options.shortEntropy))
+            return;
+        throw unsupported(`Signing in ${identity.liteUsername ?? "a person"}`, shortEntropyRefusal(identity.entropy.length, options.shortEntropy ? "released-session" : "product"));
+    };
+    if (options.denyByDefault)
+        NetworkPolicy.from({ routes: options.routes, appOrigins: [], exceptions: options.networkExceptions ?? [] });
+    const capabilities = {
+        localNetwork: true,
+        localApps: true,
+        navigationEvents: true,
+        identityImport: true,
+        productAccountRead: !!options.readAccount,
+        approvalPolicies: [defaultApprovals, defaultApprovals === "approve-all" ? "deny-all" : "approve-all"],
+        perRequestApproval: false,
+        denyByDefaultNetwork: !!options.denyByDefault,
+        openPath: false,
+        signing: "scripted",
+        concurrentSessions: false,
+        sessionsPerProcess: Number.POSITIVE_INFINITY,
+        ...(options.topology === "main-thread" ? { conditions: {} } : {}),
+        placement: true,
+    };
+    const signInKeys = new WeakMap();
+    const accountName = (identity, fallbackName) => identity.liteUsername ?? fallbackName;
+    async function verifySignedIn(session, identity, name) {
+        const active = await session.control("getActiveAccount");
+        const authenticated = await session.control("getIsAuthenticated");
+        if (active !== name || !authenticated) {
+            throw new Error(`identity import failed: active=${String(active)} authenticated=${String(authenticated)}`);
+        }
+        if (identity.liteUsername)
+            delete session.evidence.usernamePlaceholder;
+        else
+            session.evidence.usernamePlaceholder = name;
+    }
+    async function importInto(session, identity, fallbackName) {
+        assertPageTakes(identity, session);
+        const started = performance.now();
+        const name = accountName(identity, fallbackName);
+        const entry = accountEntry(identity, name);
+        await session.hostPage().evaluate(([accountName, bytes, key, stored]) => {
+            const host = globalThis.__TRUAPI_TEST_HOST__;
+            sessionStorage.setItem(key, stored);
+            return host.setAccounts([{ name: accountName, entropy: Uint8Array.from(bytes) }]);
+        }, [name, Array.from(identity.entropy), signInKeys.get(session) ?? signInKey(), entry]);
+        await verifySignedIn(session, identity, name);
+        session.evidence.importMs = performance.now() - started;
+    }
+    let probed;
+    return {
+        id: TRUAPI_WASM_HOST.id,
+        label: TRUAPI_WASM_HOST.label,
+        color: TRUAPI_WASM_HOST.color,
+        get limits() {
+            return bulletinLimits(probed);
+        },
+        probes: ["bulletin-read"],
+        capabilities,
+        async probe(request) {
+            const content = request.content;
+            if (!content)
+                return (probed = { capability: request.capability, state: "not-probed", reason: request.unprobed ?? "no content was put on Bulletin to ask for", ms: 0 });
+            let mock;
+            try {
+                mock = mockSettings({ network: options.routes.network, chains: localChains(options.routes), mode, approvals: "approve-all" });
+            }
+            catch (error) {
+                return (probed = { capability: request.capability, state: "not-probed", reason: `the host's chain settings could not be built: ${error instanceof Error ? error.message : String(error)}`, ms: 0 });
+            }
+            const load = async () => (await import(__rewriteRelativeImportExtension(pathToFileURL(join(packageRoot(hostPackage), "dist", "web", "create-mock-host.js")).href)));
+            probed = await bulletinReadProbe({ load, mock, version: installedVersion(hostPackage), request: { ...request, content }, now: () => performance.now() });
+            return probed;
+        },
+        async resolve() {
+            const version = installedVersion(hostPackage);
+            const artifact = join(packageRoot(hostPackage), "dist", "wasm", "testing", "truapi_server_bg.wasm");
+            return {
+                id: "truapi-wasm",
+                version,
+                artifact: `${PACKAGE}@${version}/dist/wasm/testing/truapi_server_bg.wasm`,
+                sha256: createHash("sha256").update(readFileSync(artifact)).digest("hex"),
+                patches: options.shortEntropy ? [ENTROPY_PATCH_ID] : [],
+            };
+        },
+        async prepare() {
+            const client = appsClientVersion();
+            const mismatch = client === undefined ? undefined : truapiPairing(installedVersion(hostPackage), client);
+            if (mismatch)
+                throw new UnsupportedHostOperation("truapi-wasm", "Hosting apps", mismatch);
+            server ??= await (options.startServer ?? defaultServer(hostPackage))(options.port ?? (await options.nextPort?.()) ?? 0);
+            if (options.denyByDefault && options.chainGates && !gated) {
+                gated = await options.chainGates.gated();
+                gated.admit([origin(server.url)]);
+                routes = gated.routes;
+                chains = localChains(routes);
+            }
+            if (options.denyByDefault && !backstop) {
+                await verifyBackstop(options.browser, server.url);
+                backstop = true;
+            }
+        },
+        async createSession({ actor, app, approvals: requested = defaultApprovals, path, placement }) {
+            if (!server)
+                throw new Error("call prepare() before createSession()");
+            if (requested === "per-request")
+                throw new UnsupportedHostOperation("truapi-wasm", "A per-request session", "confirmUserActions is one boot-time policy for every review; needs an upstream pending-review hook");
+            const approvals = requested;
+            const started = performance.now();
+            const startedAt = Date.now();
+            const timeout = options.readyTimeoutMs ?? 60_000;
+            const base = appUrl(app, { hostBridgeUrl: null });
+            const framing = await inspectFraming(app.id, base, origin(server.url), "The WASM test host", options.documentHeaders, options.inspectAppFraming);
+            if (framing.status === "refused")
+                throw new UnsupportedHostOperation("truapi-wasm", `Showing ${app.id}`, framing.message);
+            const initial = actor.identity;
+            if (initial)
+                assertPageTakes(initial);
+            const patchedPage = !!options.shortEntropy && (!initial || initial.entropy.length !== RELEASED_PAGE_ENTROPY_BYTES);
+            const edit = (page) => (patchedPage ? patchEntropyCheck(page) : page);
+            const own = server.bundle ? ownScript(++opened) : undefined;
+            if (own)
+                bundle ??= server.bundle();
+            const script = own ? edit(await bundle.catch((error) => { bundle = undefined; throw error; })) : undefined;
+            const events = [];
+            let policy;
+            const initialName = initial ? accountName(initial, `${actor.id}.0`) : undefined;
+            const context = await (placement?.browser ?? options.browser).newContext();
+            const unrouted = options.denyByDefault ? placement?.network?.unavailable : undefined;
+            const socketsOpen = options.denyByDefault ? placement?.network?.sockets : undefined;
+            if (options.denyByDefault && unrouted === undefined) {
+                policy = NetworkPolicy.from({
+                    routes,
+                    appOrigins: [origin(server.url), origin(base)],
+                    exceptions: options.networkExceptions ?? [],
+                });
+                await applyPolicy(context, policy, events, started, socketsOpen === undefined);
+            }
+            await context.addInitScript({ content: signInScript(origin(server.url), initial ? accountEntry(initial, initialName) : undefined, placement?.tag) });
+            await context.addInitScript({ content: hostPageLayoutScript(origin(server.url)) });
+            const page = await context.newPage();
+            const localLinks = () => [origin(server.url), origin(base)];
+            const conditions = capabilities.conditions && !placement ? page.conditions?.(localLinks) : undefined;
+            await page.route("**/test-host.js", async (route) => {
+                if (own !== undefined && script !== undefined) {
+                    const { pathname } = new URL(route.request().url());
+                    const headers = { "content-type": "text/javascript; charset=utf-8" };
+                    if (pathname === "/test-host.js")
+                        return route.fulfill({ status: 200, headers, body: ownLoader(own) });
+                    if (pathname === own)
+                        return route.fulfill({ status: 200, headers, body: script });
+                }
+                const response = await route.fetch();
+                if (!patchedPage)
+                    return route.fulfill({ response });
+                await route.fulfill({ response, body: patchEntropyCheck(await response.text()) });
+            });
+            const boot = async () => {
+                await page.waitForFunction(() => !!globalThis.__TRUAPI_TEST_HOST__, undefined, { timeout });
+                const element = await page.waitForSelector(PRODUCT_FRAME, { timeout });
+                const frame = await element?.contentFrame();
+                if (!frame)
+                    throw new Error("the test host page has no product frame");
+                await page.evaluate(forgetSignInParameters, undefined);
+                return frame;
+            };
+            const tagged = (url) => {
+                if (!placement)
+                    return url;
+                const address = new URL(url);
+                address.searchParams.set(SESSION_TAG_PARAM, placement.tag);
+                return address.toString();
+            };
+            const opening = page.goto(tagged(hostPageUrl(server.url, {
+                productUrl: path ? appUrlAt(base, path) : base,
+                productId: app.productId,
+                network: options.routes.network,
+                chains,
+                mode,
+                approvals,
+                ...(options.topology ? { topology: options.topology } : {}),
+                ...(options.logLevel ? { logLevel: options.logLevel } : {}),
+            })));
+            let product;
+            try {
+                await opening;
+                product = await boot();
+            }
+            catch (error) {
+                await page.close().catch(() => undefined);
+                await context.close().catch(() => undefined);
+                throw error;
+            }
+            let stopped = false;
+            let keptSigningLog;
+            const identityOf = () => identities.get(session);
+            const control = (method, ...args) => page.evaluate(([name, callArgs]) => {
+                const host = globalThis.__TRUAPI_TEST_HOST__;
+                const fn = host?.[name];
+                if (typeof fn !== "function")
+                    throw new Error(`test host has no control method ${name}`);
+                return fn.apply(host, callArgs);
+            }, [method, args]);
+            const session = {
+                actor,
+                app,
+                approvalPolicy: approvals,
+                evidence: {
+                    host: "truapi-wasm",
+                    version: installedVersion(hostPackage),
+                    coverage: mode,
+                    patches: patchedPage ? [ENTROPY_PATCH_ID] : [],
+                    approvals,
+                    bootMs: performance.now() - started,
+                    framing,
+                    ...(policy ? { network: socketsOpen !== undefined ? { policy: policy.toJSON(), socketsOpen } : { policy: policy.toJSON(), backstop: "verified" } } : {}),
+                    ...(unrouted !== undefined ? { network: { unavailable: unrouted } } : {}),
+                    ...(placement ? { placement: placement.label } : {}),
+                },
+                ...(policy && socketsOpen !== undefined ? { networkNote: { label: page.networkEvidence ? NETWORK_SOCKETS_LISTED_LABEL : NETWORK_PARTLY_LOCKED_LABEL, why: socketsOpen, replaces: NETWORK_LOCKED_LABEL } } : {}),
+                async networkEvidence() {
+                    const attribution = "The embedded host and app share a browser context: host-owned and app-owned worker traffic cannot be distinguished";
+                    if (!page.networkEvidence)
+                        return { observations: [], coverage: { beforeNavigation: false, pages: false, workers: false, gaps: ["This browser provides no passive app network observation", attribution] } };
+                    const observed = await page.networkEvidence();
+                    const hostOrigin = origin(server.url);
+                    const ofHost = (document) => {
+                        try {
+                            return new URL(document).origin === hostOrigin;
+                        }
+                        catch {
+                            return false;
+                        }
+                    };
+                    const observations = namedByChain(observed.observations, [routes, options.routes]).map((item) => (!item.purpose && (item.document !== undefined ? ofHost(item.document) : item.origin !== undefined && item.origin === hostOrigin) ? { ...item, purpose: "host" } : item));
+                    const unattributed = observations.some((item) => item.document === undefined && !item.purpose);
+                    const hostOnly = new Set(observations.filter((item) => item.purpose === "host").map((item) => item.endpoint).filter((endpoint) => observations.every((item) => item.endpoint !== endpoint || item.purpose === "host")));
+                    const gaps = observed.coverage.gaps.filter((gap) => ![...hostOnly].some((endpoint) => gap.startsWith(`${endpoint}: `)));
+                    return { ...observed, observations, coverage: { ...observed.coverage, gaps: [...gaps, ...(unattributed ? [attribution] : [])] } };
+                },
+                control,
+                hostPage: () => page,
+                localLinks,
+                ...(conditions ? { conditions } : {}),
+                async page() {
+                    return product;
+                },
+                async reload() {
+                    await page.reload();
+                    product = await boot();
+                    const identity = identityOf();
+                    if (identity)
+                        await verifySignedIn(session, identity, accountName(identity, `${actor.id}.0`));
+                    return product;
+                },
+                ...(policy
+                    ? {
+                        network: {
+                            log: () => [...events],
+                            request: (url) => product.evaluate((address) => fetch(address, { mode: "no-cors", cache: "no-store" }).then((response) => ({ ok: true, status: response.status }), (error) => ({ error: String(error) })), url),
+                            ...(socketsOpen !== undefined && page.networkEvidence ? { observed: () => session.networkEvidence() } : {}),
+                            async blocked() {
+                                const refusedByGate = (gated?.refused() ?? [])
+                                    .filter((refusal) => refusal.at >= startedAt && (refusal.origin === undefined || refusal.origin === "null" || refusal.origin === origin(base)))
+                                    .map(({ url, kind, at }) => ({ url, kind, at: at - startedAt }));
+                                return [...events.filter((event) => event.verdict === "deny").map(({ url, kind, at }) => ({ url, kind, at })), ...refusedByGate];
+                            },
+                        },
+                        networkLog: () => [...events],
+                    }
+                    : {}),
+                async account(index = 0, query = {}) {
+                    const missing = [];
+                    if (!query.source || query.source === "identity") {
+                        const identity = identityOf();
+                        if (options.accounts && identity)
+                            return { ...options.accounts.productAccount(identity.entropy, app.productId, index), productId: app.productId, derivationIndex: index, source: "identity" };
+                        missing.push(identity ? "no product-account derivation was given to this host (`accounts`; the composition root supplies one)" : "the session is not signed in as an identity");
+                    }
+                    if (!query.source || query.source === "app") {
+                        if (options.readAccount)
+                            return { ...(await options.readAccount(product, app, index)), productId: app.productId, derivationIndex: index, source: "app" };
+                        missing.push("no reader of the app's page was given (`readAccount`)");
+                    }
+                    if (!query.source || query.source === "host")
+                        missing.push("its control surface has no product-account read (upstream: getProductAccount(productId, index) on the test host control surface)");
+                    throw unsupported(query.source === "host" ? "Reading the product account from the host" : "Telling the product account", missing.join("; "));
+                },
+                ...(options.accounts?.resourceAccounts
+                    ? { resourceAccounts: async () => { const identity = identityOf(); return identity ? options.accounts.resourceAccounts(identity.entropy, app.productId).map(({ publicKey, resource }) => ({ account: publicKey, resource, ...(resource === "bulletin" ? { signs: true } : {}) })) : []; } }
+                    : {}),
+                async connection() {
+                    const calls = await control("getHostCallCount");
+                    return calls > 0
+                        ? { connected: true, detail: `the product's frames reached the host (${calls} call${calls === 1 ? "" : "s"} into the host)` }
+                        : { connected: false, detail: "the product frame has its host port, and no call has reached the host" };
+                },
+                approvals: {
+                    async approve() {
+                        if (approvals !== "approve-all")
+                            throw unsupported("Approving one request in a deny-all session", "confirmUserActions is one policy fixed when the page boots");
+                    },
+                    async deny() {
+                        if (approvals !== "deny-all")
+                            throw unsupported("Denying one request", "confirmUserActions is one policy for every review (identity disclosure, " +
+                                "account access and signing), fixed when the page boots; upstream needs a " +
+                                "pending-review hook in createMockHost");
+                    },
+                    async decisions() {
+                        const reviews = await control("confirmations");
+                        const verdict = approvals === "approve-all" ? "approved" : "denied";
+                        return reviews.map((review) => `${verdict} ${review}`);
+                    },
+                    async signing() {
+                        if (stopped && !keptSigningLog)
+                            throw new Error("The session stopped before its signing log could be read");
+                        const log = stopped ? keptSigningLog : await control("getSigningLog");
+                        return [{ approved: false, payload: "unknown", action: "signing evidence coverage", gap: "The WASM host exposes no actual returned signatures or complete transactions, including when its review log is empty" }, ...log.map(({ type }) => ({
+                                approved: approvals === "approve-all",
+                                payload: type === "payload" || type === "createTransaction" ? "transaction" : type === "raw" ? "message" : "unknown",
+                                action: type,
+                                ...(approvals === "approve-all" ? { gap: "The WASM signing log records a review without the actual returned signature or complete transaction" } : {}),
+                            }))];
+                    },
+                },
+                navigations: {
+                    async *[Symbol.asyncIterator]() {
+                        let seen = 0;
+                        while (!stopped) {
+                            const log = await control("getNavigationLog").catch(() => []);
+                            for (; seen < log.length; seen++) {
+                                const request = navigationRequest(log[seen], Date.now());
+                                yield request;
+                            }
+                            await new Promise((resolve) => setTimeout(resolve, 100));
+                        }
+                    },
+                },
+                async stop() {
+                    if (stopped)
+                        return;
+                    stopped = true;
+                    keptSigningLog = await control("getSigningLog").catch(() => undefined);
+                    sessions.delete(session);
+                    const errors = [];
+                    await page.close().catch((error) => errors.push(error));
+                    await context.close().catch((error) => errors.push(error));
+                    if (errors.length)
+                        throw new AggregateError(errors, `Stopping the WASM host session of ${actor.id}/${app.id} failed`);
+                },
+            };
+            sessions.add(session);
+            identities.set(session, initial);
+            if (patchedPage)
+                patchedPages.add(session);
+            signInKeys.set(session, signInKey(placement?.tag));
+            if (initial) {
+                try {
+                    await verifySignedIn(session, initial, initialName);
+                }
+                catch (error) {
+                    await session.stop().catch(() => undefined);
+                    throw error;
+                }
+                session.evidence.signedIn = "at boot";
+            }
+            return session;
+        },
+        async importIdentity(session, identity) {
+            await importInto(session, identity, `${session.actor.id}.0`);
+            identities.set(session, identity);
+        },
+        async dispose() {
+            for (const session of [...sessions])
+                await session.stop();
+            await server?.close();
+            server = undefined;
+            bundle = undefined;
+        },
+    };
+}

package/adapters/host/truapi-wasm/src/ring-vrf-member.d.ts

@@ -0,0 +1,4 @@
+/** The released core's testing build: `ringVrfMember` is exported there. */
+export declare const RING_VRF_MODULE = "@parity/truapi-host/wasm/testing";
+/** The ring-VRF member key (32 bytes) of a person's 32-byte ring-VRF entropy, from the released truAPI core. */
+export declare function ringVrfMemberKey(ringEntropy: Uint8Array): Promise<Uint8Array>;

package/adapters/host/truapi-wasm/src/ring-vrf-member.js

@@ -0,0 +1,47 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { readFile } from "node:fs/promises";
+import { dirname, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+export const RING_VRF_MODULE = "@parity/truapi-host/wasm/testing";
+let core;
+async function loadCore() {
+    const entry = fileURLToPath(import.meta.resolve(RING_VRF_MODULE));
+    const loaded = (await import(__rewriteRelativeImportExtension(RING_VRF_MODULE)));
+    await loaded.default({ module_or_path: await readFile(entry.replace(/\.js$/, "_bg.wasm")) });
+    const folder = dirname(entry) + sep;
+    const original = globalThis.fetch;
+    globalThis.fetch = async (input, init) => {
+        const url = input instanceof Request ? input.url : String(input);
+        if (url.startsWith("file:") && fileURLToPath(url).startsWith(folder))
+            return new Response(await readFile(fileURLToPath(url)));
+        return original(input, init);
+    };
+    try {
+        await loaded.ringVrfMember(new Uint8Array(32));
+    }
+    finally {
+        globalThis.fetch = original;
+    }
+    return loaded;
+}
+export async function ringVrfMemberKey(ringEntropy) {
+    if (ringEntropy.length !== 32)
+        throw new Error(`ring-VRF entropy is 32 bytes, not ${ringEntropy.length}`);
+    core ??= loadCore().catch((error) => {
+        core = undefined;
+        throw error;
+    });
+    const member = await (await core).ringVrfMember(ringEntropy);
+    if (member.length !== 32)
+        throw new Error(`${RING_VRF_MODULE} ringVrfMember returned ${member.length} bytes, not a 32-byte member key`);
+    return member;
+}

package/adapters/host/truapi-wasm/src/route-release.d.ts

@@ -0,0 +1,29 @@
+import type { HostRelease } from "@parity/product-lab/domain/versions";
+import type { HostRouting } from "@parity/product-lab/ports/host";
+/** The component a suite row resolves for this host. */
+export declare const TRUAPI_WASM_COMPONENT = "host:truapi-wasm";
+/** What the row's run gets (`PRODUCT_LAB_HOST_ROUTE`): the release as published, from its package directory. */
+export interface WasmRouteSelection {
+    readonly route: "official";
+    readonly version: string;
+    /** The installed package directory (`TruapiWasmOptions.hostPackage`). */
+    readonly hostPackage: string;
+}
+export interface WasmRouteSteps {
+    /** The `@parity/truapi` version the apps use (the lab's install); undefined when none is found. */
+    client(): string | undefined;
+    /** Install the release into the lab's cache, its tarball checked against `integrity` (`sha512-…`); its package directory. */
+    install(version: string, integrity: string): Promise<string>;
+    /** Where `install` puts `version`, without installing (a dry run's selection). */
+    installedAt(version: string): string;
+    log(line: string): void;
+}
+/** A lock digest `sha512:<hex>` as a registry integrity (`sha512-<base64>`); undefined when it is not one. */
+export declare function integrityOf(digest: string | undefined): string | undefined;
+export declare function routeWasmRelease(input: {
+    release: HostRelease;
+    digests: Readonly<Record<string, string>>;
+    decideOnly?: boolean;
+}, steps: WasmRouteSteps): Promise<HostRouting>;
+/** The route file a suite row's run was given (PRODUCT_LAB_HOST_ROUTE), for this adapter's component. */
+export declare function readWasmRouteSelection(file: string): WasmRouteSelection;

package/adapters/host/truapi-wasm/src/route-release.js

@@ -0,0 +1,47 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { truapiPairing } from "./truapi-pairing.js";
+export const TRUAPI_WASM_COMPONENT = "host:truapi-wasm";
+export function integrityOf(digest) {
+    const hex = /^sha512:([0-9a-f]{128})$/.exec(digest ?? "")?.[1];
+    return hex ? `sha512-${Buffer.from(hex, "hex").toString("base64")}` : undefined;
+}
+const unsupported = (release, why) => ({
+    route: { route: "unsupported", release, needs: [], blocking: [], reason: `${release.component} ${release.tag} cannot run here: ${why}` },
+});
+export async function routeWasmRelease(input, steps) {
+    const { release } = input;
+    const integrity = integrityOf(input.digests.tarball);
+    if (!integrity)
+        return unsupported(release, "the resolution records no sha512 tarball digest for it (a WASM host release comes from npm, versions.npm)");
+    const client = steps.client();
+    if (client === undefined)
+        return unsupported(release, "no @parity/truapi was found in the lab's install, so the truAPI release the apps speak is unknown");
+    const mismatch = truapiPairing(release.version, client);
+    if (mismatch)
+        return unsupported(release, mismatch);
+    const route = {
+        route: "official",
+        release,
+        needs: [],
+        reason: `official ${release.tag} from npm: it speaks the truAPI of the apps' @parity/truapi ${client}, and needs no lab patch beyond the entropy one applied to its host page at load`,
+    };
+    if (input.decideOnly)
+        return { route, selection: { route: "official", version: release.version, hostPackage: steps.installedAt(release.version) } };
+    steps.log(`installing ${release.tag} into the lab's cache (tarball integrity checked)`);
+    const hostPackage = await steps.install(release.version, integrity);
+    return { route, selection: { route: "official", version: release.version, hostPackage } };
+}
+export function readWasmRouteSelection(file) {
+    const data = JSON.parse(readFileSync(file, "utf8"));
+    if (data.kind !== "product-lab-host-route" || data.schemaVersion !== 1)
+        throw new Error(`${file} is not a product-lab host route (kind product-lab-host-route, schemaVersion 1)`);
+    if (data.component !== TRUAPI_WASM_COMPONENT)
+        throw new Error(`${file} routes ${String(data.component)}, not ${TRUAPI_WASM_COMPONENT}`);
+    const selection = data.selection;
+    if (selection?.route === "official" && typeof selection.version === "string" && /^\d+\.\d+\.\d+/.test(selection.version) && typeof selection.hostPackage === "string" && isAbsolute(selection.hostPackage))
+        return { route: "official", version: selection.version, hostPackage: selection.hostPackage };
+    throw new Error(`${file}: the route's selection is not an official release with its package directory`);
+}