@parity/product-lab 0.0.1-placeholder → 0.1.0

package/adapters/host/truapi-wasm/src/shared-host.d.ts

@@ -0,0 +1,94 @@
+import type { hostSettings, mockSettings } from "./config.js";
+import type { PermissionAuthorizationRequest, PermissionAuthorizationStatus } from "@parity/truapi-host";
+export interface SharedWasmHostApp {
+    readonly id: string;
+    readonly label: string;
+    readonly productId: string;
+    readonly url: string;
+}
+/** Original public provider bytes. Product/channel are supplied by the shell, not by the product. */
+export interface SharedWasmHostTransportEvent {
+    readonly productId: string;
+    readonly channel: number;
+    readonly direction: "request" | "response";
+    readonly bytes: string;
+}
+export interface SharedWasmHostBoot {
+    readonly entropy: readonly number[];
+    readonly namespace: string;
+    readonly identityPublicKey: string;
+    /** The caller verifies this handle's forward/reverse binding on the finalized chain. */
+    readonly liteUsername: string;
+    readonly apps: readonly SharedWasmHostApp[];
+    readonly mock: ReturnType<typeof mockSettings>;
+    readonly runtimeConfig: ReturnType<typeof hostSettings>["runtimeConfig"];
+    readonly allowances?: "chain";
+    /** Defaults 30000 ms; each must be an integer in 1..120000. */
+    readonly requestTimeoutMs?: number;
+    readonly operationGraceMs?: number;
+    /** Optional own-window async decision function. Requires deny-all defaults; permissions always remain denied. */
+    readonly reviewBridge?: string;
+    /** Optional fail-closed pre-forward decision for BOTH provider directions. Literal true admits.
+     * 2 MiB/frame, 200000 frames, 128 MiB/session; all errors/timeouts latch refusal. */
+    readonly transportBridge?: string;
+}
+/** Page control at window.__PRODUCT_LAB_SHARED_HOST__; never include boot arguments in public traces. */
+export interface SharedWasmHostControl {
+    boot(input: SharedWasmHostBoot): Promise<{
+        version: 1;
+        apps: readonly Pick<SharedWasmHostApp, "id" | "productId">[];
+    }>;
+    open(id: string, path?: string): Promise<{
+        id: string;
+        productId: string;
+        frameId: string;
+    }>;
+    reload(id: string): Promise<{
+        id: string;
+        productId: string;
+        frameId: string;
+    }>;
+    account(productId: string, index: number): Promise<{
+        publicKey: string;
+        address: string;
+        productId: string;
+        derivationIndex: number;
+    }>;
+    settled(): Promise<{
+        active?: string;
+        errors: readonly string[];
+    }>;
+    /** Contains private storage. Save only in private evidence; the context and host origin must stay the same. */
+    snapshot(): {
+        storage: {
+            owner?: string;
+            products: Record<string, string>;
+            core: Record<string, string>;
+        };
+        active?: string;
+        navigations: readonly string[];
+        errors: readonly string[];
+    };
+    signingLog(): readonly unknown[];
+    /** Original released-host reviews, including permission, alias and proof requests. */
+    reviews(): readonly unknown[];
+    /** Released device/remote permission decisions; separate from confirmation reviews. */
+    permissionLog(): readonly unknown[];
+    /** Read the active core's effective permission status without prompting or updating it. */
+    authorizationStatus(productId: string, request: PermissionAuthorizationRequest): Promise<PermissionAuthorizationStatus>;
+    dispose(): Promise<void>;
+}
+export interface SharedWasmHostServer {
+    readonly url: string;
+    readonly version: string;
+    /** Digests of the released asset bytes actually served, including the signing WASM. */
+    readonly assets: Readonly<Record<string, string>>;
+    close(): Promise<void>;
+}
+/**
+ * Explicit opt-in browser shell. Existing truapiWasmHost sessions remain unchanged.
+ * The caller allocates the loopback port and owns the server and each page/context it opens.
+ */
+export declare function createSharedWasmHostServer(options: {
+    readonly port: number;
+}): Promise<SharedWasmHostServer>;

package/adapters/host/truapi-wasm/src/shared-host.js

@@ -0,0 +1,63 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import { createServer } from "node:http";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { SHARED_HOST_PAGE_ENTRY } from "./shared-page.js";
+export async function createSharedWasmHostServer(options) {
+    if (!Number.isInteger(options.port) || options.port < 1024 || options.port > 65535)
+        throw new Error("Shared WASM host needs an allocated port in 1024-65535");
+    const { build } = await import("esbuild");
+    const root = dirname(dirname(fileURLToPath(import.meta.resolve("@parity/truapi-host"))));
+    const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version;
+    const wasmRoot = join(root, "dist", "wasm", "testing");
+    const assetNames = (prefix = "") => readdirSync(join(wasmRoot, prefix), { withFileTypes: true }).flatMap((entry) => {
+        const name = prefix ? `${prefix}/${entry.name}` : entry.name;
+        return entry.isDirectory() ? assetNames(name) : entry.isFile() && /\.(?:js|wasm)$/.test(name) ? [name] : [];
+    });
+    const released = new Map(assetNames().map((name) => [name, readFileSync(join(wasmRoot, name))]));
+    const assets = Object.fromEntries([...released].map(([name, bytes]) => [`/wasm/testing/${name}`, createHash("sha256").update(bytes).digest("hex")]));
+    const plugin = { name: "released-signing-wasm", setup(context) {
+            context.onResolve({ filter: /wasm\/(?:web|testing)\/truapi_server\.js$/ }, () => ({ path: "/wasm/testing/truapi_server.js", external: true }));
+        } };
+    const [page, worker] = await Promise.all([
+        build({ stdin: { contents: SHARED_HOST_PAGE_ENTRY, resolveDir: root, sourcefile: "shared-host-page.js" }, bundle: true, format: "esm", platform: "browser", write: false, plugins: [plugin], external: ["*.wasm"] }),
+        build({ entryPoints: [fileURLToPath(import.meta.resolve("@parity/truapi-host/worker-runtime"))], bundle: true, format: "esm", platform: "browser", write: false, plugins: [plugin], external: ["*.wasm"] }),
+    ]);
+    const pageCode = page.outputFiles[0]?.contents, workerCode = worker.outputFiles[0]?.contents;
+    if (!pageCode || !workerCode)
+        throw new Error("Shared WASM host shell compilation emitted no browser scripts");
+    const html = `<!doctype html><html><head><meta charset="utf-8"><title>Shared wallet host</title><style>html,body{margin:0;height:100%;font-family:system-ui}#apps{height:40px;display:flex;gap:8px;align-items:center;padding:0 8px}#apps button[aria-pressed=true]{font-weight:bold}#surfaces{height:calc(100% - 40px)}#surfaces>iframe{display:block;width:100%;height:100%;border:0}#surfaces>iframe[hidden]{display:none}</style></head><body><nav id="apps" aria-label="Apps"></nav><main id="surfaces"></main><script type="module" src="/host-page.js"></script></body></html>`;
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        response.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+        response.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+        response.setHeader("Cache-Control", "no-store");
+        const send = (type, value) => { response.writeHead(200, { "Content-Type": type }); response.end(value); };
+        if (url.pathname === "/")
+            return send("text/html; charset=utf-8", html);
+        if (url.pathname === "/host-page.js")
+            return send("text/javascript; charset=utf-8", pageCode);
+        if (url.pathname === "/host-worker.js")
+            return send("text/javascript; charset=utf-8", workerCode);
+        const prefix = "/wasm/testing/", name = url.pathname.slice(prefix.length);
+        if (url.pathname.startsWith(prefix) && released.has(name))
+            return send(name.endsWith(".wasm") ? "application/wasm" : "text/javascript; charset=utf-8", released.get(name));
+        response.writeHead(404);
+        response.end("Not found");
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, "127.0.0.1", () => { server.off("error", reject); resolve(); });
+    });
+    let closing;
+    return { url: `http://127.0.0.1:${options.port}`, version, assets,
+        close() {
+            return closing ??= new Promise((resolve, reject) => {
+                server.closeAllConnections();
+                server.close((error) => error ? reject(error) : resolve());
+            });
+        } };
+}

package/adapters/host/truapi-wasm/src/shared-page.d.ts

@@ -0,0 +1 @@
+export declare const SHARED_HOST_PAGE_ENTRY: string;

package/adapters/host/truapi-wasm/src/shared-page.js

@@ -0,0 +1,336 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export const SHARED_HOST_PAGE_ENTRY = String.raw `
+import { CoreStorageKey } from "@parity/truapi-host";
+import { createMockHost, mockRuntimeConfig, MOCK_GENESIS } from "@parity/truapi-host/testing";
+import { resolveAccount } from "@parity/truapi-host/testing/dev-accounts";
+import { createIframeHost, createWebWorkerPairingHostRuntime } from "@parity/truapi-host/web";
+import { DerivationIndex } from "@parity/truapi";
+import { bytesToHex, hexToBytes } from "@parity/truapi/scale";
+
+const STORAGE = "product-lab:shared-wasm-host:v1";
+const frames = new Map();
+let runtime, worker, host, catalogue = [], active, bootStarted = false, disposed = false;
+let transportTail = Promise.resolve(), transportRefused = false, channelSequence = 0, transportBridge;
+let transportMessages = 0, transportBytes = 0;
+let surfaceTail = Promise.resolve(), storageTail = Promise.resolve(), releaseOwner;
+let bootTask, cleanupTask, stopping;
+let requestTimeoutMs = 30_000, operationGraceMs = 30_000, runtimeDisposalRequested = false, workerStopped = false;
+const bounded = async (promise, operation) => {
+  let timer;
+  try { return await Promise.race([promise, new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("Shared host timed out: " + operation)), requestTimeoutMs); })]); }
+  finally { clearTimeout(timer); }
+};
+const disposeRuntime = () => { if (runtime && !runtimeDisposalRequested) { runtimeDisposalRequested = true; runtime.dispose(); } };
+const stopWorker = () => { if (worker && !workerStopped) { workerStopped = true; worker.terminate(); } };
+const failures = [];
+const recordFailure = (error) => { failures.push(String(error instanceof Error ? error.message : error)); };
+const checkAlive = () => { if (disposed) throw new Error("Shared host has been disposed"); };
+async function cleanup() {
+  if (cleanupTask) return cleanupTask;
+  cleanupTask = (async () => {
+    const deadline = Date.now() + operationGraceMs;
+    disposeRuntime();
+    if (!runtime) stopWorker();
+    await bounded(surfaceTail, "surface shutdown").catch(recordFailure);
+    await bounded(transportTail, "transport shutdown").catch(recordFailure);
+    await bounded(storageTail, "storage shutdown").catch(recordFailure);
+    // The released runtime defers teardown for its background operations, with a 30 s ceiling.
+    // Keep its worker, callback store and exclusive ownership alive until that grace has elapsed.
+    while (host?.getOpenOperations().length && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 25));
+    await new Promise(resolve => setTimeout(resolve, 0));
+    const interrupted = !!host?.getOpenOperations().length;
+    stopWorker();
+    await bounded(storageTail, "final storage shutdown").catch(recordFailure);
+    for (const entry of frames.values()) { entry.detach(); entry.frame.dispose(); }
+    frames.clear(); host?.dispose(); releaseOwner?.();
+    if (interrupted) throw new Error("Shared host background operations exceeded shutdown grace (" + operationGraceMs + " ms)");
+  })();
+  return cleanupTask;
+}
+const data = () => {
+  const value = localStorage.getItem(STORAGE);
+  if (!value) return { products: {}, core: {} };
+  const parsed = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || !/^0x[0-9a-f]{64}$/.test(parsed.owner) ||
+      [parsed.products, parsed.core].some(section => !section || typeof section !== "object" || Array.isArray(section) ||
+        Object.values(section).some(value => typeof value !== "string" || !/^0x(?:[0-9a-f]{2})*$/.test(value)))) throw new Error("Invalid shared host storage");
+  return parsed;
+};
+let stored;
+const save = () => localStorage.setItem(STORAGE, JSON.stringify(stored));
+const enqueue = (operation) => {
+  const result = surfaceTail.then(operation);
+  surfaceTail = result.catch(recordFailure);
+  return result;
+};
+function persist(section, key, value, apply) {
+  const result = storageTail.then(async () => {
+    const previous = stored, values = { ...stored[section] };
+    if (value === undefined) delete values[key]; else values[key] = bytesToHex(value);
+    const next = { ...stored, [section]: values };
+    // Refuse quota/serialization failures before changing the released in-memory callbacks.
+    localStorage.setItem(STORAGE, JSON.stringify(next));
+    try { await apply(); }
+    catch (error) { localStorage.setItem(STORAGE, JSON.stringify(previous)); throw error; }
+    stored = next;
+  });
+  storageTail = result.catch(() => {});
+  return result;
+}
+
+function faithfulSettings(input) {
+  const mock = input.mock;
+  if (input.reviewBridge !== undefined && (typeof input.reviewBridge !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,99}$/.test(input.reviewBridge) ||
+      !Object.hasOwn(window, input.reviewBridge) || typeof window[input.reviewBridge] !== "function" || mock?.confirmUserActions !== false))
+    throw new Error("Shared host review bridge requires an existing own-window function and deny-all defaults");
+  if (!mock || Object.keys(mock).some(key => !["chainProxies", "supportedChains", "confirmUserActions"].includes(key)) ||
+      typeof mock.confirmUserActions !== "boolean" || (input.allowances !== undefined && input.allowances !== "chain"))
+    throw new Error("Shared host requires faithful chain settings without mock responses or faults");
+  const roles = { People: "people", AssetHub: "assetHub", Bulletin: "bulletin" };
+  const chains = mock.supportedChains?.chains, proxies = mock.chainProxies;
+  if (!Array.isArray(chains) || !Array.isArray(proxies) || typeof mock.supportedChains.network !== "string" || !mock.supportedChains.network || mock.supportedChains.network === "mock" ||
+      !chains.some(chain => chain.identifier === "People") || !chains.some(chain => chain.identifier === "AssetHub") ||
+      new Set(chains.map(chain => chain.identifier)).size !== chains.length || new Set(chains.map(chain => chain.genesisHash)).size !== chains.length ||
+      proxies.length !== chains.length || Object.keys(input.runtimeConfig ?? {}).length !== chains.length)
+    throw new Error("Shared host requires matching real chain routes and runtime configuration");
+  for (const chain of chains) {
+    const role = roles[chain.identifier], config = input.runtimeConfig[role];
+    const proxy = proxies.filter(item => item.genesisHash === chain.genesisHash);
+    if (!role || !/^0x[0-9a-f]{64}$/.test(chain.genesisHash) || Object.values(MOCK_GENESIS).includes(chain.genesisHash) || !config || Object.keys(config).length !== 1 || config.genesisHash !== chain.genesisHash ||
+        proxy.length !== 1 || Object.keys(proxy[0]).sort().join(",") !== "genesisHash,rpcUrl")
+      throw new Error("Shared host requires hashed chain proxies with matching runtime genesis");
+    const endpoint = new URL(proxy[0].rpcUrl);
+    if (!["ws:", "wss:"].includes(endpoint.protocol) || !["127.0.0.1", "[::1]", "localhost"].includes(endpoint.hostname) || endpoint.username || endpoint.password)
+      throw new Error("Shared host requires loopback chain proxies");
+  }
+}
+
+// Only the shell knows the registered provider's product and channel. Never take them from app data.
+function forwardTransport(productId, channel, direction, bytes, forward) {
+  if (!(bytes instanceof Uint8Array) || bytes.length > 2_097_152 ||
+      ++transportMessages > 200_000 || (transportBytes += bytes.length) > 128 * 1024 * 1024) {
+    transportRefused = true; recordFailure("Shared host transport frame/count/byte limit exceeded"); return;
+  }
+  const copy = Uint8Array.from(bytes);
+  const operation = transportTail.then(async () => {
+    checkAlive();
+    if (transportRefused) throw new Error("Shared host transport was already refused");
+    if (transportBridge && await bounded(Promise.resolve().then(() => transportBridge({
+      productId, channel, direction, bytes: bytesToHex(copy),
+    })), "transport admission") !== true) throw new Error("Shared host transport admission refused");
+    checkAlive();
+    if (transportRefused) throw new Error("Shared host transport was refused before forwarding");
+    forward(copy);
+  });
+  transportTail = operation.catch(error => { transportRefused = true; recordFailure(error); });
+}
+
+async function openNow(id, path) {
+  if (!runtime || disposed) throw new Error("Shared host has not been activated");
+  const app = catalogue.find((item) => item.id === id);
+  if (!app) throw new Error("Unknown shared host app");
+  let entry = frames.get(id);
+  if (!entry) {
+    const target = new URL(app.url);
+    if (path) {
+      const next = new URL(path, target);
+      if (next.origin !== target.origin) throw new Error("App path changed its registered origin");
+      target.href = next.href;
+    }
+    let pending = true, provider;
+    const channel = ++channelSequence;
+    try {
+      provider = await bounded(runtime.createProvider({ productId: app.productId }).then(created => {
+        if (!pending || disposed) { created.dispose(); throw new Error("Shared host provider creation was cancelled"); }
+        return created;
+      }), "product provider creation");
+    } finally { pending = false; }
+    if (disposed) { provider.dispose(); throw new Error("Shared host has been disposed"); }
+    let unsubscribe = () => {};
+    const detach = () => { unsubscribe(); provider.dispose(); };
+    const frame = createIframeHost({ iframeUrl: target.href, container: document.querySelector("#surfaces"),
+      allow: "camera; microphone; display-capture", onPort(port) {
+        unsubscribe = provider.subscribe((bytes) => transportBridge
+          ? forwardTransport(app.productId, channel, "response", bytes, copy => port.postMessage(copy))
+          : port.postMessage(bytes));
+        port.onmessage = (event) => {
+          if (transportBridge) forwardTransport(app.productId, channel, "request", event.data, copy => provider.postMessage(copy));
+          else if (event.data instanceof Uint8Array) provider.postMessage(event.data);
+        };
+        port.start();
+      } });
+    frame.iframe.id = "app-" + app.id;
+    frame.iframe.name = "app-" + app.id;
+    frame.iframe.dataset.app = app.id;
+    entry = { frame, detach };
+    frames.set(id, entry);
+  } else if (path) {
+    const target = new URL(path, app.url);
+    if (target.origin !== new URL(app.url).origin) throw new Error("App path changed its registered origin");
+    // A path change requires a new product document/port; keep the shared wallet and storage owner.
+    entry.detach(); entry.frame.dispose(); frames.delete(id);
+    return openNow(id, path);
+  }
+  active = id;
+  for (const [other, surface] of frames) surface.frame.iframe.hidden = other !== id;
+  for (const button of document.querySelectorAll("#apps button")) button.setAttribute("aria-pressed", String(button.dataset.app === id));
+  return { id, productId: app.productId, frameId: entry.frame.iframe.id };
+}
+const open = (id, path) => enqueue(() => openNow(id, path));
+
+async function boot(input) {
+  if (bootStarted) throw new Error("A shared host wallet cannot be replaced; open a fresh page after a failed activation");
+  bootStarted = true;
+  bootTask = (async () => {
+    try { return await activate(input); }
+    catch (error) {
+      disposed = true;
+      await cleanup();
+      throw error;
+    }
+  })();
+  return bootTask;
+}
+
+async function activate(input) {
+  checkAlive();
+  for (const [name, value] of [["requestTimeoutMs", input.requestTimeoutMs], ["operationGraceMs", input.operationGraceMs]])
+    if (value !== undefined && (!Number.isInteger(value) || value < 1 || value > 120_000)) throw new Error("Invalid shared host " + name);
+  requestTimeoutMs = input.requestTimeoutMs ?? 30_000;
+  operationGraceMs = input.operationGraceMs ?? 30_000;
+  faithfulSettings(input);
+  if (input.transportBridge !== undefined) {
+    if (typeof input.transportBridge !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,99}$/.test(input.transportBridge) ||
+        !Object.hasOwn(window, input.transportBridge) || typeof window[input.transportBridge] !== "function" || input.mock.confirmUserActions !== false)
+      throw new Error("Shared host transport bridge requires an existing own-window function and deny-all defaults");
+    transportBridge = window[input.transportBridge];
+  }
+  if (!Array.isArray(input.entropy) || input.entropy.length !== 32 || input.entropy.some((value) => !Number.isInteger(value) || value < 0 || value > 255))
+    throw new Error("Shared host requires 32 bytes of BIP39 entropy");
+  const account = resolveAccount({ name: input.liteUsername, entropy: Uint8Array.from(input.entropy) });
+  if (typeof input.namespace !== "string" || !/^[a-z]+$/.test(input.namespace)) throw new Error("Invalid shared host namespace");
+  if (typeof input.liteUsername !== "string" || !/^[a-z]{6,29}\.(?:0?[1-9]|[1-9][0-9])$/.test(input.liteUsername)) throw new Error("Invalid shared host lite username");
+  const glue = await bounded(import("/wasm/testing/truapi_server.js"), "signing glue import"); checkAlive();
+  await bounded(glue.default(), "signing WASM initialization"); checkAlive();
+  const identitySubtree = glue.deriveProductSubtreePublicKey(account.entropy, "uid." + input.namespace);
+  const actualOwner = bytesToHex(glue.deriveProductAccountPublicKey(identitySubtree, DerivationIndex.enc({ tag: "Index", value: 0 })));
+  if (actualOwner !== input.identityPublicKey) throw new Error("Shared host wallet does not match its provisioned public identity");
+  catalogue = input.apps.map((app) => {
+    const target = new URL(app.url);
+    if (!/^[a-z][a-z0-9-]*$/.test(app.id) || target.hostname !== app.productId || !["http:", "https:"].includes(target.protocol) || target.origin === window.location.origin)
+      throw new Error("Shared host app URL must retain its canonical product hostname");
+    return { ...app };
+  });
+  if (new Set(catalogue.map((app) => app.id)).size !== catalogue.length || new Set(catalogue.map((app) => app.productId)).size !== catalogue.length)
+    throw new Error("Shared host catalogue contains duplicate apps or product identities");
+  if (!navigator.locks) throw new Error("Shared host requires browser Web Locks for its storage owner");
+  await new Promise((resolve, reject) => {
+    navigator.locks.request(STORAGE, { ifAvailable: true }, async lock => {
+      if (!lock) { reject(new Error("Shared host storage is already open in another page")); return; }
+      await new Promise(release => { releaseOwner = release; resolve(); });
+    }).catch(reject);
+  });
+  checkAlive();
+  stored = data();
+  if (stored.owner && stored.owner !== actualOwner) throw new Error("Shared host storage belongs to a different wallet");
+  stored.owner = actualOwner;
+  save();
+  host = createMockHost(input.mock);
+  if (input.reviewBridge !== undefined) {
+    // Device/remote callbacks are separate from confirmPermission and otherwise default to allow-all.
+    host.setPermissionBehavior("deny-all");
+    const decide = window[input.reviewBridge], confirmation = host.callbacks.userConfirmation;
+    const action = confirmation.confirmUserAction.bind(confirmation), permission = confirmation.confirmPermission.bind(confirmation);
+    confirmation.confirmUserAction = async review => {
+      await action(review); // Keep the release's original review before asking the caller.
+      try { return await bounded(Promise.resolve().then(() => decide({ kind: "action", review })), "review decision") === true; }
+      catch (error) { recordFailure(error); return false; }
+    };
+    confirmation.confirmPermission = async review => {
+      await permission(review);
+      try { await bounded(Promise.resolve().then(() => decide({ kind: "permission", review })), "permission observation"); }
+      catch (error) { recordFailure(error); }
+      return "Deny";
+    };
+  }
+  const products = { ...host.callbacks.productStorage }, core = { ...host.callbacks.coreStorage };
+  // Restore only bytes previously written by the real core's host callbacks, with their original namespace.
+  for (const [key, value] of Object.entries(stored.products)) await products.write(key, hexToBytes(value));
+  for (const [key, value] of Object.entries(stored.core)) await core.writeCoreStorage(CoreStorageKey.dec(hexToBytes(key)), hexToBytes(value));
+  checkAlive();
+  host.callbacks.productStorage.write = (key, value) => persist("products", key, value, () => products.write(key, value));
+  host.callbacks.productStorage.clear = (key) => persist("products", key, undefined, () => products.clear(key));
+  host.callbacks.coreStorage.writeCoreStorage = (key, value) => persist("core", bytesToHex(CoreStorageKey.enc(key)), value, () => core.writeCoreStorage(key, value));
+  host.callbacks.coreStorage.clearCoreStorage = (key) => persist("core", bytesToHex(CoreStorageKey.enc(key)), undefined, () => core.clearCoreStorage(key));
+  const navigate = host.callbacks.navigation.navigateTo;
+  host.callbacks.navigation.navigateTo = async (url) => {
+    await navigate(url);
+    const target = new URL(url);
+    if (!["polkadot:", "http:", "https:"].includes(target.protocol)) throw new Error("Unsupported host navigation scheme");
+    const app = catalogue.find((item) => item.productId === target.hostname);
+    if (!app) throw new Error("Host navigation requested an unregistered product");
+    const path = target.pathname + target.search + target.hash;
+    void open(app.id, path === "/" || path === "" ? undefined : path).catch(() => {});
+    // Do not await the new provider while the old core is awaiting this platform callback.
+  };
+  const { productId, ...hostConfig } = mockRuntimeConfig(input.runtimeConfig);
+  worker = new Worker("/host-worker.js", { type: "module" });
+  runtime = await bounded(createWebWorkerPairingHostRuntime(worker, host.callbacks, { hostConfig, role: "signing", operationGraceMs }).then(created => {
+    if (disposed) { created.dispose(); stopWorker(); throw new Error("Shared host has been disposed"); }
+    return created;
+  }), "worker runtime creation");
+  checkAlive();
+  // No unchecked allocation/preimage flags: all grants and submissions go through the actual core/chains.
+  await bounded(runtime.activateLocalSession(account.entropy, input.liteUsername), "session activation");
+  checkAlive();
+  for (const app of catalogue) {
+    const button = document.createElement("button");
+    button.textContent = app.label;
+    button.dataset.app = app.id;
+    button.onclick = () => { void open(app.id).catch(() => {}); };
+    document.querySelector("#apps").append(button);
+  }
+  return { version: 1, apps: catalogue.map(({ id, productId }) => ({ id, productId })) };
+}
+
+window.__PRODUCT_LAB_SHARED_HOST__ = {
+  boot, open,
+  reload(id) { return enqueue(async () => {
+    const entry = frames.get(id);
+    if (!entry) throw new Error("Cannot reload an unopened app");
+    entry.detach(); entry.frame.dispose(); frames.delete(id);
+    return openNow(id);
+  }); },
+  async account(productId, index) {
+    if (!runtime) throw new Error("Shared host has not been activated");
+    if (!Number.isInteger(index) || index < 0 || index > 4294967295) throw new Error("Account index is not a u32");
+    const subtree = await bounded(runtime.getProductSubtreePublicKey(productId, requestTimeoutMs), "product account read");
+    if (!subtree) throw new Error("Shared host has no active wallet");
+    const wasm = await import("/wasm/testing/truapi_server.js"); await wasm.default();
+    const key = wasm.deriveProductAccountPublicKey(subtree, DerivationIndex.enc({ tag: "Index", value: index }));
+    return { publicKey: bytesToHex(key), address: wasm.productAccountAddress(key), productId, derivationIndex: index };
+  },
+  async settled() { await surfaceTail; await transportTail; await storageTail; return { active, errors: [...failures] }; },
+  snapshot() { return { storage: data(), active, navigations: host?.getNavigationLog() ?? [], errors: [...failures] }; },
+  signingLog() { return host?.getSigningLog() ?? []; },
+  reviews() { return host?.reviews() ?? []; },
+  permissionLog() { return host?.getPermissionLog() ?? []; },
+  async authorizationStatus(productId, request) {
+    checkAlive();
+    if (!runtime || !catalogue.some(app => app.productId === productId)) throw new Error("Permission inspection requires an active registered product");
+    const status = await bounded(runtime.getPermissionAuthorizationStatus(productId, request), "permission status read");
+    if (!["Authorized", "Denied", "NotDetermined"].includes(status)) throw new Error("Permission inspection returned an unknown status");
+    return status;
+  },
+  dispose() {
+    if (stopping) return stopping;
+    disposed = true;
+    disposeRuntime();
+    if (!runtime) stopWorker();
+    stopping = (async () => { await bootTask?.catch(() => {}); await cleanup(); })();
+    return stopping;
+  },
+};
+window.addEventListener("unhandledrejection", (event) => recordFailure(event.reason));
+`;

package/adapters/host/truapi-wasm/src/sign-in.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Booting the test host page signed in, without putting the identity in a URL
+ * that is requested or recorded.
+ *
+ * The host page activates `?accounts=<name>:<entropy hex>` before it creates
+ * the product frame when `?login=auto` (`testing/host-page.js`), so the app
+ * sees the identity from its first request, as under a real signed-in host.
+ * Importing after boot (`setAccounts`) is too late for apps that ask for their
+ * account once at load: the core declines the request while signed out, and
+ * the frame receives its host port once (`web/create-iframe-host.js`), so it
+ * cannot reload into the new session.
+ *
+ * The page is requested with `login=manual` and no accounts. An init script,
+ * running in the host page's origin only, adds both parameters to the page's
+ * own address (`history.replaceState`) from session storage before the host's
+ * module reads them; the provider removes them again once the host has booted.
+ * So the entropy crosses only the automation channel and the page's memory:
+ * never a network request, a server log or the recorded network log. Session
+ * storage survives a reload of the same page, so a reload stays signed in as
+ * the current identity (`importIdentity` updates it).
+ */
+import type { ProvisionedIdentity } from "@parity/product-lab/domain";
+/** The session storage key the init script reads the signed-in account from. */
+export declare const SIGN_IN_KEY = "product-lab:truapi-wasm:accounts";
+/**
+ * Backlog 108: the host page address parameter naming a placed session (`SessionPlacement.tag`). In a page shared by
+ * several placed sessions (the lab window, one tile each) every session's script is installed on the one page and two
+ * host pages share an origin, hence session storage: each script acts only in the host page with its own tag, under a
+ * key of its own. Never a secret.
+ */
+export declare const SESSION_TAG_PARAM = "product-lab-session";
+/** The session storage key of a session: its tag's own in a placement, else the one key of its own context. */
+export declare const signInKey: (tag?: string) => string;
+/** The host page's `accounts` entry for an identity: `<name>:<entropy hex>`. */
+export declare function accountEntry(identity: ProvisionedIdentity, name: string): string;
+/**
+ * The init script for one session's browser context. It acts only in the host
+ * page (`hostOrigin`), never in the product frame, and only when an account is
+ * stored or given as `initial`. With a `tag` (a placed session) it acts only in
+ * the host page whose address carries that tag, under the tag's own key.
+ */
+export declare function signInScript(hostOrigin: string, initial: string | undefined, tag?: string): string;
+/** Remove the sign-in parameters from the booted page's address (run in the host page). */
+export declare function forgetSignInParameters(): void;

package/adapters/host/truapi-wasm/src/sign-in.js

@@ -0,0 +1,38 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export const SIGN_IN_KEY = "product-lab:truapi-wasm:accounts";
+export const SESSION_TAG_PARAM = "product-lab-session";
+export const signInKey = (tag) => (tag === undefined ? SIGN_IN_KEY : `${SIGN_IN_KEY}:${tag}`);
+const NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/i;
+const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+export function accountEntry(identity, name) {
+    if (!NAME.test(name))
+        throw new Error(`account name ${JSON.stringify(name)} must be a lite username (letters, digits, dots)`);
+    return `${name}:${hex(identity.entropy)}`;
+}
+export function signInScript(hostOrigin, initial, tag) {
+    return `(() => {
+  try {
+    if (location.origin !== ${JSON.stringify(hostOrigin)}) return;
+    const tag = ${JSON.stringify(tag ?? null)};
+    if (tag !== null && new URL(location.href).searchParams.get(${JSON.stringify(SESSION_TAG_PARAM)}) !== tag) return;
+    const key = ${JSON.stringify(signInKey(tag))};
+    const stored = sessionStorage.getItem(key);
+    const account = stored ?? ${JSON.stringify(initial ?? null)};
+    if (!account) return;
+    if (stored === null) sessionStorage.setItem(key, account);
+    const url = new URL(location.href);
+    url.searchParams.set("accounts", account);
+    url.searchParams.set("login", "auto");
+    history.replaceState(history.state, "", url);
+  } catch {
+    // Storage or history blocked in this page: the host boots signed out, which verifySignedIn then reports.
+  }
+})();`;
+}
+export function forgetSignInParameters() {
+    const url = new URL(location.href);
+    url.searchParams.delete("accounts");
+    url.searchParams.set("login", "manual");
+    history.replaceState(history.state, "", url);
+}

package/adapters/host/truapi-wasm/src/truapi-pairing.d.ts

@@ -0,0 +1,7 @@
+/** Why `host` (`@parity/truapi-host`) cannot serve apps on `client` (`@parity/truapi`), or undefined when it can. */
+export declare function truapiPairing(host: string, client: string): string | undefined;
+/**
+ * The `@parity/truapi` version Node's resolution finds from `packageRoot` (the installed `@parity/truapi-host`): the
+ * one installed beside the host, which the apps of the same install use. Undefined when none is found.
+ */
+export declare function clientVersionBeside(packageRoot: string): string | undefined;

package/adapters/host/truapi-wasm/src/truapi-pairing.js

@@ -0,0 +1,23 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, join } from "node:path";
+const release = (version) => /^(\d+)\.(\d+)\./.exec(version)?.slice(1, 3).join(".");
+export function truapiPairing(host, client) {
+    const core = release(host);
+    const wire = release(client);
+    if (core !== undefined && core === wire)
+        return undefined;
+    return (`@parity/truapi-host ${host} speaks truAPI ${core ?? host}, but the apps use @parity/truapi ${client} (the lab's install): ` +
+        `their frames differ, and the first transaction would fail with MalformedFrame. Install ` +
+        `@parity/truapi-host ${wire ?? client}.x, or @parity/truapi ${core ?? host}.x for the apps`);
+}
+export function clientVersionBeside(packageRoot) {
+    for (let directory = realpathSync(packageRoot);; directory = dirname(directory)) {
+        const manifest = join(directory, "node_modules", "@parity", "truapi", "package.json");
+        if (existsSync(manifest))
+            return JSON.parse(readFileSync(manifest, "utf8")).version;
+        if (dirname(directory) === directory)
+            return undefined;
+    }
+}