@parity/product-lab 0.0.1-placeholder → 0.1.0

package/adapters/host/truapi-wasm/src/truapi-wasm-host-factory.d.ts

@@ -0,0 +1,111 @@
+import type { VersionResolution } from "@parity/product-lab/domain/versions";
+import type { HostProvider, HostReleaseRequest, HostRouting, HostToolContext } from "@parity/product-lab/ports/host";
+import type { AdapterFlag } from "@parity/product-lab/ports/factory";
+import type { HostAdapterFactory, HostOptionDeclaration } from "@parity/product-lab/ports/host";
+import type { ProductAccountDerivation } from "@parity/product-lab/ports/identity";
+import type { SystemPorts } from "@parity/product-lab/ports/system";
+import { z } from "zod";
+import { type TruapiWasmOptions, type WasmHostSession } from "./provider.js";
+import type { HostNetworkRoutes } from "@parity/product-lab/domain";
+/** The adapter kind (`HostAdapterFactory.kind`). */
+export declare const TRUAPI_WASM_KIND = "truapi-wasm";
+/** The data options of a WASM test host (what a lab can declare). */
+export declare const truapiWasmHostOptionsSchema: z.ZodObject<{
+    port: z.ZodOptional<z.ZodNumber>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        faithful: "faithful";
+        faked: "faked";
+    }>>;
+    approvals: z.ZodOptional<z.ZodEnum<{
+        "approve-all": "approve-all";
+        "deny-all": "deny-all";
+    }>>;
+    topology: z.ZodOptional<z.ZodEnum<{
+        worker: "worker";
+        "main-thread": "main-thread";
+    }>>;
+    logLevel: z.ZodOptional<z.ZodString>;
+    readyTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    denyByDefault: z.ZodOptional<z.ZodBoolean>;
+    networkExceptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        origin: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strict>>>;
+    networkLocked: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/** Backlog 185: the switches this adapter offers on its hosts (`HostAdapterFactory.hostOptions`). */
+export declare const TRUAPI_WASM_HOST_OPTIONS: readonly HostOptionDeclaration[];
+/**
+ * What a lab written in the product shape (`defineLab({ app })`) gives this host when its config sets nothing: network
+ * locked, so the default lab proves the app calls nothing it should not. The option's own default stays off for labs
+ * that declare their hosts.
+ */
+export declare const TRUAPI_WASM_LAB_DEFAULTS: Readonly<Record<string, unknown>>;
+export type TruapiWasmHostConfig = z.input<typeof truapiWasmHostOptionsSchema>;
+/** What a WASM host runs with besides its options. `versions`: the run's resolution (a suite row's resolved host release). */
+export type TruapiWasmHostDeps = Omit<TruapiWasmOptions, keyof TruapiWasmHostConfig> & {
+    system?: Partial<Pick<SystemPorts, "inspectAppFraming" | "ports">>;
+    versions?: VersionResolution;
+};
+/** What every host this factory creates shares. */
+export interface TruapiWasmFactorySettings {
+    /** Derives product accounts from identities for every host this factory creates (the composition root's), unless the caller's dependencies carry their own. */
+    readonly accounts?: ProductAccountDerivation;
+    /** The lab's cache directory (`PRODUCT_LAB_CACHE_DIR`): where `routeRelease` installs a resolved release (backlog 27). */
+    readonly cacheDir?: string;
+    /**
+     * Backlog 27: the route file a suite row's run was given (the composition root passes `PRODUCT_LAB_HOST_ROUTE`): the
+     * row's resolved release is served from the package directory the route installed.
+     */
+    readonly routeFile?: string;
+    /** Product-lab's checkout only: serve the entropy patch to sessions with short entropy (`TruapiWasmOptions.shortEntropy`). */
+    readonly shortEntropy?: boolean;
+}
+export declare class TruapiWasmHostFactory implements HostAdapterFactory<TruapiWasmHostConfig, HostProvider<WasmHostSession>, TruapiWasmHostDeps> {
+    private readonly settings;
+    readonly kind = "truapi-wasm";
+    readonly label = "truAPI WASM test host (@parity/truapi-host/testing)";
+    readonly color: string;
+    readonly options: z.ZodObject<{
+        port: z.ZodOptional<z.ZodNumber>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            faithful: "faithful";
+            faked: "faked";
+        }>>;
+        approvals: z.ZodOptional<z.ZodEnum<{
+            "approve-all": "approve-all";
+            "deny-all": "deny-all";
+        }>>;
+        topology: z.ZodOptional<z.ZodEnum<{
+            worker: "worker";
+            "main-thread": "main-thread";
+        }>>;
+        logLevel: z.ZodOptional<z.ZodString>;
+        readyTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        denyByDefault: z.ZodOptional<z.ZodBoolean>;
+        networkExceptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            origin: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strict>>>;
+        networkLocked: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+    readonly hostOptions: readonly HostOptionDeclaration[];
+    /** Its hosts were the "In-browser host" until 6 October 2026 (now "truAPI WASM"): scenarios naming them so keep working. */
+    readonly formerNames: string[];
+    readonly flags: readonly AdapterFlag[];
+    constructor(settings?: TruapiWasmFactorySettings);
+    /** Backlog 28: the WASM host needs People and Asset Hub routed with their genesis (its runtime config resolves there). */
+    routingProblem(_options: TruapiWasmHostConfig, routes: HostNetworkRoutes): string | undefined;
+    /**
+     * A host for options its schema accepted (the registry validates them first). A run that resolved
+     * `host:truapi-wasm` serves the release its suite row's route installed; without a route only the installed release
+     * can be that version, and another is refused rather than served by the wrong package.
+     */
+    create(given: TruapiWasmHostConfig, deps: TruapiWasmHostDeps): HostProvider<WasmHostSession>;
+    /**
+     * Backlog 27: how a suite row runs a @parity/truapi-host release its run resolved from npm: as published, installed
+     * into the lab's cache with its tarball's integrity checked, when it speaks the truAPI of the apps' @parity/truapi;
+     * otherwise unsupported, with the pairing refusal (route-release.ts).
+     */
+    routeRelease(request: HostReleaseRequest<TruapiWasmHostConfig>, { log, signal, commands }: HostToolContext): Promise<HostRouting>;
+}

package/adapters/host/truapi-wasm/src/truapi-wasm-host-factory.js

@@ -0,0 +1,99 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { z } from "zod";
+import { hostPackageDir, installHostPackage } from "./host-package.js";
+import { appsClientVersion, installedVersion, NETWORK_LOCKED_LABEL, TRUAPI_WASM_HOST, truapiWasmHost } from "./provider.js";
+import { readWasmRouteSelection, routeWasmRelease, TRUAPI_WASM_COMPONENT } from "./route-release.js";
+import { assertLocalChains, localChains } from "./config.js";
+export const TRUAPI_WASM_KIND = "truapi-wasm";
+export const truapiWasmHostOptionsSchema = z
+    .strictObject({
+    port: z.number().int().min(1024).max(65535).optional(),
+    mode: z.enum(["faithful", "faked"]).optional(),
+    approvals: z.enum(["approve-all", "deny-all"]).optional(),
+    topology: z.enum(["worker", "main-thread"]).optional(),
+    logLevel: z.string().min(1).optional(),
+    readyTimeoutMs: z.number().int().positive().optional(),
+    denyByDefault: z.boolean().optional(),
+    networkExceptions: z
+        .array(z.strictObject({ origin: z.string().min(1), reason: z.string().trim().min(1) }))
+        .optional(),
+    networkLocked: z.boolean().optional(),
+});
+export const TRUAPI_WASM_HOST_OPTIONS = [
+    {
+        name: "networkLocked",
+        label: NETWORK_LOCKED_LABEL,
+        why: "The page around the app may reach only the lab's own chains, every other request blocked and listed: proves the app calls nothing it should not. A worker's sockets are observed and listed, not blocked: no browser control sees them to block",
+        type: "boolean",
+        default: false,
+        perIdentity: true,
+    },
+];
+export const TRUAPI_WASM_LAB_DEFAULTS = { networkLocked: true };
+export class TruapiWasmHostFactory {
+    settings;
+    kind = TRUAPI_WASM_KIND;
+    label = "truAPI WASM test host (@parity/truapi-host/testing)";
+    color = TRUAPI_WASM_HOST.color;
+    options = truapiWasmHostOptionsSchema;
+    hostOptions = TRUAPI_WASM_HOST_OPTIONS;
+    formerNames = ["In-browser host"];
+    flags = [];
+    constructor(settings = {}) {
+        this.settings = settings;
+    }
+    routingProblem(_options, routes) {
+        try {
+            assertLocalChains(localChains(routes));
+            return undefined;
+        }
+        catch (error) {
+            return error instanceof Error ? error.message : String(error);
+        }
+    }
+    create(given, deps) {
+        const { networkLocked, ...declared } = given;
+        const options = networkLocked !== undefined ? { ...declared, denyByDefault: networkLocked } : declared;
+        const { versions, ...rest } = deps;
+        const accounts = rest.accounts ?? this.settings.accounts;
+        const resolved = versions?.get(TRUAPI_WASM_COMPONENT)?.component.version;
+        let hostPackage;
+        if (resolved !== undefined && this.settings.routeFile) {
+            const selection = readWasmRouteSelection(this.settings.routeFile);
+            if (selection.version !== resolved)
+                throw new Error(`The run resolved ${TRUAPI_WASM_COMPONENT} ${resolved}, but its route (${this.settings.routeFile}) installed ${selection.version}`);
+            hostPackage = selection.hostPackage;
+        }
+        else if (resolved !== undefined && resolved !== installedVersion())
+            throw new Error(`The run resolved ${TRUAPI_WASM_COMPONENT} ${resolved}, but the installed @parity/truapi-host is ${installedVersion()}: a suite row routes a resolved release (routeRelease) before its run`);
+        return truapiWasmHost({
+            ...options,
+            ...rest,
+            ...(rest.system?.inspectAppFraming ? { inspectAppFraming: rest.system.inspectAppFraming } : {}),
+            ...(options.port === undefined && rest.system?.ports?.next ? { nextPort: rest.system.ports.next.bind(rest.system.ports) } : {}),
+            ...(accounts ? { accounts } : {}),
+            ...(hostPackage ? { hostPackage } : {}),
+            ...(this.settings.shortEntropy ? { shortEntropy: true } : {}),
+        });
+    }
+    async routeRelease(request, { log, signal, commands }) {
+        const { cacheDir } = this.settings;
+        return routeWasmRelease({ release: request.release, digests: request.digests, ...(request.decideOnly ? { decideOnly: true } : {}) }, {
+            client: appsClientVersion,
+            installedAt: (version) => {
+                if (!cacheDir)
+                    throw new Error("Routing a WASM host release needs the lab's cache directory");
+                return hostPackageDir(cacheDir, version);
+            },
+            install: (version, integrity) => {
+                if (!cacheDir)
+                    throw new Error("Routing a WASM host release needs the lab's cache directory");
+                if (!commands)
+                    throw new Error("Routing a WASM host release needs the runtime's command runner");
+                return installHostPackage({ version, cacheDir, commands, integrity, signal, log });
+            },
+            log,
+        });
+    }
+}

package/adapters/keys/sr25519/README.md

@@ -0,0 +1,53 @@
+# @product-lab/keys-sr25519
+
+`KeyDerivation` adapter (`@product-lab/ports/chain`) over
+`@polkadot-labs/hdkd-helpers` (refactor step 3).
+
+- `Sr25519KeyDerivation`: `derive(secretUri, { ss58Prefix })` returns
+  `{ address, publicKey, signer }`, where `signer` is an `Sr25519Signer`
+  (`KeySigner`: raw sr25519 signatures, no wrapping). `address(publicKey, prefix)`
+  and `publicKey(address)` convert SS58. No I/O; errors never echo the secret.
+- `SecretUri.parse(uri)`: the one secret-URI parser, re-exported from the domain
+  model (`core/domain/src/shared/secret-uri.ts` since refactor step 4; parsing
+  and redaction are domain rules, key derivation stays here).
+  `<mnemonic | 0x 32-byte seed>[//hard | /soft …][///password]`, trimmed; a bare
+  path (`//Alice`) uses the Substrate development phrase. It redacts itself when
+  serialised or inspected.
+- Since 4 October 2026 `derive` also takes a `0x` 64-byte expanded sr25519 secret (the key and its nonce, the form some
+  chains' sudo keys come in), signing with it as it is (`@scure/sr25519`); it takes no junctions or password, and a `0x`
+  secret of any other length is refused by its length, never echoed. Tests: `tests/sr25519-key-derivation.test.ts`
+  (the development seed's expanded form is the same account, and its signature verifies).
+
+The composition root uses it when a lab declares no `keys` (`composition/src/create-lab-runtime.ts`),
+and for the development authority in default sessions (`composition/src/default-session.ts`). A lab
+can also declare it itself; secrets then resolve to signers:
+
+```ts
+import { defineLab, devAccount } from "@product-lab/core";
+import { Sr25519KeyDerivation } from "@product-lab/keys-sr25519";
+
+export default defineLab({ /* … */ secrets: { admin: devAccount("//Alice") }, keys: new Sr25519KeyDerivation() });
+```
+
+It replaces the two parsers that disagreed before step 3: core's
+`parseSecretUri` (kept semantics: `0x` seeds, `///password`, trimming, the
+"neither a mnemonic nor a 0x-prefixed 32-byte seed" error) and platform's
+`sr25519FromSuri` (a mnemonic or a development path; it rejected `0x` seeds and
+ignored passwords). The tests pin both old behaviours and the two differences.
+
+| | |
+| --- | --- |
+| Nx project | `keys-sr25519` |
+| Tags | `scope:provider`, `type:adapter` |
+| Exports | `src/index.ts`: `Sr25519KeyDerivation`, `Sr25519Signer`, `Sr25519ProductAccounts`, and `SecretUri` re-exported from `@product-lab/domain` |
+| Implements | `KeyDerivation`, `KeySigner` (`@product-lab/ports/chain`); `ProductAccountDerivation` (`@product-lab/ports/identity`, backlog item 62) |
+| Depends on | `@product-lab/ports`, `@product-lab/domain` (`SecretUri`, `AccountAddress`), `@polkadot-labs/hdkd-helpers` 0.0.34, `@scure/sr25519` 2.4.0 |
+| Used by | the composition root (the default `keys`; `Sr25519ProductAccounts` for the truAPI CLI and WASM test host adapters), two examples (`examples/minimal` for its live proof), `tools/verify` |
+
+`Sr25519ProductAccounts.resourceAccounts(entropy, productId)` gives the accounts a truAPI host claims resources for on a product's behalf (host-rust-core RFC-0010): hard `//allowance//statement-store//<productId>` (People's statement allowance) and `//allowance//bulletin//<productId>` (Bulletin long-term storage), checked against hdkd's own derivation in `tests/sr25519-product-accounts.test.ts`. `Sr25519ProductAccounts.productAccount(entropy, productId, index?)` is the account a truAPI host gives a product (RFC-0022): the wallet's sr25519 key from the BIP-39 entropy, the hard junctions `//product//<productId>`, then the account index as a soft junction. It lets a host adapter tell an actor's account from the identity the lab started the host with, without a patch and without reading the app's page. Each instance keeps the derivations it made (up to 256, by a hash of the entropy, never the entropy), since each runs PBKDF2 and the host check asks again at every step's edge (backlog 209); callers get copies. `tests/sr25519-product-accounts.test.ts` pins the mobile wallet's published vector and checks it against hdkd's own derivation.
+
+Contract kit: `tests/contract.test.ts` runs the [chain contract kit](../../../contracts/chain/README.md), declaring `keys`, `sr25519` and `signatureCheck` (hdkd-helpers' `sr25519.verify`).
+
+Tests: `bunx nx run keys-sr25519:test` (including a pin of the domain's `DEVELOPMENT_AUTHORITY` public key against `//Alice` derived here, refactor step 7).
+
+Private, workspace-only package. Consumers will install the single umbrella package `@parity/product-lab` once it is published.

package/adapters/keys/sr25519/src/index.d.ts

@@ -0,0 +1,3 @@
+export { SecretUri } from "@parity/product-lab/domain";
+export { Sr25519KeyDerivation, Sr25519Signer } from "./sr25519-key-derivation.js";
+export { Sr25519ProductAccounts } from "./sr25519-product-accounts.js";

package/adapters/keys/sr25519/src/index.js

@@ -0,0 +1,5 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export { SecretUri } from "@parity/product-lab/domain";
+export { Sr25519KeyDerivation, Sr25519Signer } from "./sr25519-key-derivation.js";
+export { Sr25519ProductAccounts } from "./sr25519-product-accounts.js";

package/adapters/keys/sr25519/src/sr25519-key-derivation.d.ts

@@ -0,0 +1,34 @@
+import type { DerivedAccount, KeyDerivation, KeySigner } from "@parity/product-lab/ports/chain";
+declare const INSPECT: unique symbol;
+/** An sr25519 key pair. The private key stays in a closure; serialising shows the public key only. */
+export declare class Sr25519Signer implements KeySigner {
+    #private;
+    readonly publicKey: Uint8Array;
+    readonly scheme: "sr25519";
+    constructor(publicKey: Uint8Array, sign: (payload: Uint8Array) => Uint8Array);
+    /** Raw sr25519 signature of exactly these bytes. Bound, so it can be passed around. */
+    readonly sign: (payload: Uint8Array) => Uint8Array;
+    toJSON(): {
+        scheme: "sr25519";
+        publicKey: string;
+    };
+    [INSPECT](): string;
+}
+/**
+ * KeyDerivation over @polkadot-labs/hdkd-helpers: sr25519 accounts from secret
+ * URIs ({@link SecretUri}). The secret may be a BIP-39 mnemonic of 12 or more
+ * words (with an optional `///password`) or a `0x` 32-byte mini secret, either
+ * followed by hard (`//`) and soft (`/`) junctions; a bare path uses the
+ * development phrase. Since 4 October 2026 it may also be a `0x` 64-byte
+ * expanded sr25519 secret (the key and its nonce, as some chains' sudo keys
+ * are kept), used as it is: it takes no junctions or password. No I/O; errors
+ * never echo the secret.
+ */
+export declare class Sr25519KeyDerivation implements KeyDerivation {
+    derive(secretUri: string, options?: {
+        readonly ss58Prefix?: number;
+    }): DerivedAccount;
+    address(publicKey: Uint8Array, ss58Prefix?: number): string;
+    publicKey(address: string): Uint8Array;
+}
+export {};

package/adapters/keys/sr25519/src/sr25519-key-derivation.js

@@ -0,0 +1,66 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { createDerive, mnemonicToMiniSecret, sr25519, sr25519Derive, ss58Address, ss58Decode, } from "@polkadot-labs/hdkd-helpers";
+import { getPublicKey, sign } from "@scure/sr25519";
+import { SecretUri } from "@parity/product-lab/domain";
+const INSPECT = Symbol.for("nodejs.util.inspect.custom");
+const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+export class Sr25519Signer {
+    publicKey;
+    scheme = "sr25519";
+    #sign;
+    constructor(publicKey, sign) {
+        this.publicKey = publicKey;
+        this.#sign = sign;
+    }
+    sign = (payload) => this.#sign(payload);
+    toJSON() {
+        return { scheme: this.scheme, publicKey: `0x${hex(this.publicKey)}` };
+    }
+    [INSPECT]() {
+        return `Sr25519Signer(0x${hex(this.publicKey)})`;
+    }
+}
+function expanded(uri, ss58Prefix) {
+    const length = (uri.phrase.length - 2) / 2;
+    if (length !== 64)
+        throw new Error(`A 0x secret must be a 32-byte seed or a 64-byte expanded sr25519 secret (key and nonce); this one is ${Number.isInteger(length) ? `${length} bytes` : "not whole bytes"}`);
+    if (uri.path || uri.password !== undefined)
+        throw new Error("A 64-byte expanded sr25519 secret takes no derivation path or password: derive from its seed or phrase instead");
+    const secret = Uint8Array.from(uri.phrase.slice(2).match(/../g), (pair) => parseInt(pair, 16));
+    let publicKey;
+    try {
+        publicKey = getPublicKey(secret);
+    }
+    catch {
+        throw new Error("The 64-byte secret is not a valid expanded sr25519 secret");
+    }
+    return { address: ss58Address(publicKey, ss58Prefix), publicKey, signer: new Sr25519Signer(publicKey, (payload) => sign(secret, payload)) };
+}
+export class Sr25519KeyDerivation {
+    derive(secretUri, options = {}) {
+        const uri = SecretUri.parse(secretUri);
+        if (/^0x[0-9a-fA-F]*$/.test(uri.phrase) && uri.phrase.length !== 66)
+            return expanded(uri, options.ss58Prefix ?? 42);
+        let seed;
+        if (/^0x[0-9a-fA-F]{64}$/.test(uri.phrase))
+            seed = uri.phrase.slice(2);
+        else if (uri.phrase.split(/\s+/).length >= 12)
+            seed = mnemonicToMiniSecret(uri.phrase, uri.password);
+        else
+            throw new Error("Secret is neither a mnemonic nor a 0x-prefixed 32-byte seed");
+        const pair = createDerive({ seed, curve: sr25519, derive: sr25519Derive })(uri.path);
+        return {
+            address: ss58Address(pair.publicKey, options.ss58Prefix ?? 42),
+            publicKey: pair.publicKey,
+            signer: new Sr25519Signer(pair.publicKey, (payload) => pair.sign(payload)),
+        };
+    }
+    address(publicKey, ss58Prefix = 42) {
+        return ss58Address(publicKey, ss58Prefix);
+    }
+    publicKey(address) {
+        const [payload] = ss58Decode(address);
+        return payload;
+    }
+}

package/adapters/keys/sr25519/src/sr25519-product-accounts.d.ts

@@ -0,0 +1,8 @@
+import type { DerivedProductAccount, DerivedResourceAccount, ProductAccountDerivation } from "@parity/product-lab/ports/identity";
+export declare class Sr25519ProductAccounts implements ProductAccountDerivation {
+    private readonly products;
+    private readonly resources;
+    productAccount(entropy: Uint8Array, productId: string, index?: number): DerivedProductAccount;
+    /** RFC-0010's resource accounts: hard `//allowance//<resource>//<product id>` from the same mini secret. */
+    resourceAccounts(entropy: Uint8Array, productId: string): readonly DerivedResourceAccount[];
+}

package/adapters/keys/sr25519/src/sr25519-product-accounts.js

@@ -0,0 +1,95 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { blake2b256, entropyToMiniSecret, ss58Address } from "@polkadot-labs/hdkd-helpers";
+import { HDKD, getPublicKey, secretFromSeed } from "@scure/sr25519";
+import { BIP39_ENTROPY_LENGTHS } from "@parity/product-lab/domain/identity";
+const JUNCTION_LENGTH = 32;
+const encoder = new TextEncoder();
+const hex = (bytes) => `0x${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+function compactLength(length) {
+    if (length < 1 << 6)
+        return Uint8Array.of(length << 2);
+    if (length < 1 << 14)
+        return Uint8Array.of(((length << 2) | 1) & 0xff, length >> 6);
+    throw new Error("A derivation junction is too long");
+}
+function junctionChainCode(junction) {
+    let encoded;
+    if (junction.length > 0 && /^\d+$/.test(junction)) {
+        const value = BigInt(junction);
+        if (value > 0xffffffffffffffffn)
+            throw new Error("A numeric derivation junction is outside the u64 range");
+        encoded = new Uint8Array(8);
+        new DataView(encoded.buffer).setBigUint64(0, value, true);
+    }
+    else {
+        const bytes = encoder.encode(junction);
+        const prefix = compactLength(bytes.length);
+        encoded = new Uint8Array(prefix.length + bytes.length);
+        encoded.set(prefix);
+        encoded.set(bytes, prefix.length);
+    }
+    if (encoded.length > JUNCTION_LENGTH)
+        return blake2b256(encoded);
+    const code = new Uint8Array(JUNCTION_LENGTH);
+    code.set(encoded);
+    return code;
+}
+function indexBytes(index) {
+    const bytes = new Uint8Array(32);
+    new DataView(bytes.buffer).setUint32(0, index, true);
+    bytes.set(blake2b256(encoder.encode("product-account-index")).subarray(0, 28), 4);
+    return bytes;
+}
+const KEPT = 256;
+class Derivations {
+    kept = new Map();
+    get(key, derive) {
+        const found = this.kept.get(key);
+        if (found !== undefined)
+            return found;
+        const made = derive();
+        if (this.kept.size >= KEPT)
+            this.kept.delete(this.kept.keys().next().value);
+        this.kept.set(key, made);
+        return made;
+    }
+}
+const key = (entropy, ...parts) => [hex(blake2b256(entropy)), ...parts].join("\u0000");
+export class Sr25519ProductAccounts {
+    products = new Derivations();
+    resources = new Derivations();
+    productAccount(entropy, productId, index = 0) {
+        if (!(entropy instanceof Uint8Array) || !BIP39_ENTROPY_LENGTHS.includes(entropy.length))
+            throw new Error(`A product account derives from BIP-39 entropy of ${BIP39_ENTROPY_LENGTHS.join(", ")} bytes`);
+        if (typeof productId !== "string" || !productId)
+            throw new Error("A product account derives for a product id");
+        if (!Number.isInteger(index) || index < 0 || index > 0xffff_ffff)
+            throw new Error(`Derivation index ${String(index)} is not a u32`);
+        return { ...this.products.get(key(entropy, "product", productId, index), () => derivedProductAccount(entropy, productId, index)) };
+    }
+    resourceAccounts(entropy, productId) {
+        if (!(entropy instanceof Uint8Array) || !BIP39_ENTROPY_LENGTHS.includes(entropy.length))
+            throw new Error(`A resource account derives from BIP-39 entropy of ${BIP39_ENTROPY_LENGTHS.join(", ")} bytes`);
+        if (typeof productId !== "string" || !productId)
+            throw new Error("A resource account derives for a product id");
+        return this.resources.get(key(entropy, "resources", productId), () => derivedResourceAccounts(entropy, productId)).map((account) => ({ ...account }));
+    }
+}
+function derivedProductAccount(entropy, productId, index) {
+    let secret = secretFromSeed(entropyToMiniSecret(entropy));
+    for (const junction of ["product", productId])
+        secret = HDKD.secretHard(secret, junctionChainCode(junction));
+    const publicKey = HDKD.publicSoft(getPublicKey(secret), indexBytes(index));
+    return { publicKey: hex(publicKey), address: ss58Address(publicKey, 42) };
+}
+function derivedResourceAccounts(entropy, productId) {
+    const root = secretFromSeed(entropyToMiniSecret(entropy));
+    return ["statement-store", "bulletin"].map((resource) => {
+        let secret = root;
+        for (const junction of ["allowance", resource, productId])
+            secret = HDKD.secretHard(secret, junctionChainCode(junction));
+        const publicKey = getPublicKey(secret);
+        return { resource, publicKey: hex(publicKey), address: ss58Address(publicKey, 42) };
+    });
+}

package/adapters/lab/module/src/config-path.d.ts

@@ -0,0 +1,2 @@
+/** Resolve a lab config path: an explicit file or directory, else `lab.config.ts` in `cwd`. */
+export declare function resolveConfigPath(config: string | undefined, cwd?: string): string;

package/adapters/lab/module/src/config-path.js

@@ -0,0 +1,10 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+export function resolveConfigPath(config, cwd = process.cwd()) {
+    const candidate = resolve(cwd, config ?? "lab.config.ts");
+    if (existsSync(candidate) && !candidate.endsWith(".ts") && !candidate.endsWith(".js") && !candidate.endsWith(".mjs"))
+        return resolve(candidate, "lab.config.ts");
+    return candidate;
+}

package/adapters/lab/module/src/definition-lab-source.d.ts

@@ -0,0 +1,11 @@
+import type { LabDefinitionSource } from "@parity/product-lab/ports/lab";
+export declare class DefinitionLabSource implements LabDefinitionSource {
+    private readonly definition;
+    readonly root: string;
+    readonly path: string;
+    constructor(definition: () => unknown, where: {
+        root: string;
+        path?: string;
+    });
+    load(): Promise<unknown>;
+}

package/adapters/lab/module/src/definition-lab-source.js

@@ -0,0 +1,16 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { resolve } from "node:path";
+export class DefinitionLabSource {
+    definition;
+    root;
+    path;
+    constructor(definition, where) {
+        this.definition = definition;
+        this.root = resolve(where.root);
+        this.path = where.path ? resolve(where.path) : resolve(this.root, "lab.config.ts");
+    }
+    async load() {
+        return this.definition();
+    }
+}

package/adapters/lab/module/src/index.d.ts

@@ -0,0 +1,6 @@
+export { ModuleLabSource, type ModuleLabSourceOptions } from "./module-lab-source.js";
+export { DefinitionLabSource } from "./definition-lab-source.js";
+export { ModuleHostTools, type HostToolValidator } from "./module-host-tools.js";
+export { resolveConfigPath } from "./config-path.js";
+export { sourceFingerprint } from "./source-fingerprint.js";
+export { TranspiledClientBundles, transpileClientModule, runtimeImports } from "./transpiled-client-bundles.js";

package/adapters/lab/module/src/index.js

@@ -0,0 +1,8 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+export { ModuleLabSource } from "./module-lab-source.js";
+export { DefinitionLabSource } from "./definition-lab-source.js";
+export { ModuleHostTools } from "./module-host-tools.js";
+export { resolveConfigPath } from "./config-path.js";
+export { sourceFingerprint } from "./source-fingerprint.js";
+export { TranspiledClientBundles, transpileClientModule, runtimeImports } from "./transpiled-client-bundles.js";

package/adapters/lab/module/src/module-host-tools.d.ts

@@ -0,0 +1,11 @@
+import type { HostTools, HostToolSource } from "@parity/product-lab/ports/host";
+/** Checks loaded factories and returns them as host tools, or throws naming every problem. */
+export type HostToolValidator = (factories: readonly unknown[], source: string) => HostTools;
+export declare class ModuleHostTools implements HostToolSource {
+    private readonly defaults;
+    private readonly validate;
+    /** `defaults`: the factories offered without a module (built when first asked for); `validate`: the composition root's check. */
+    constructor(defaults: () => Promise<HostTools>, validate: HostToolValidator);
+    exists(module?: string): boolean;
+    load(module?: string): Promise<HostTools>;
+}

package/adapters/lab/module/src/module-host-tools.js

@@ -0,0 +1,37 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+export class ModuleHostTools {
+    defaults;
+    validate;
+    constructor(defaults, validate) {
+        this.defaults = defaults;
+        this.validate = validate;
+    }
+    exists(module) {
+        return module === undefined || existsSync(resolve(module));
+    }
+    async load(module) {
+        if (module === undefined) {
+            const defaults = await this.defaults();
+            return this.validate(defaults.factories, defaults.source);
+        }
+        const file = resolve(module);
+        if (!existsSync(file))
+            throw new Error(`No host tools module at ${file}; pass --config <tools.ts>`);
+        const loaded = (await import(__rewriteRelativeImportExtension(pathToFileURL(file).href)));
+        if (!Array.isArray(loaded.default))
+            throw new Error(`${file} must export default [host adapter factories]`);
+        return this.validate(loaded.default, file);
+    }
+}

package/adapters/lab/module/src/module-lab-source.d.ts

@@ -0,0 +1,16 @@
+import type { LabDefinitionSource } from "@parity/product-lab/ports/lab";
+export interface ModuleLabSourceOptions {
+    /** Re-evaluate edited lab files on later loads (the MCP server). */
+    reload?: boolean;
+}
+export declare class ModuleLabSource implements LabDefinitionSource {
+    private readonly options;
+    readonly path: string;
+    readonly root: string;
+    private generation;
+    private fingerprint?;
+    constructor(configPath: string, options?: ModuleLabSourceOptions);
+    changed(): boolean;
+    /** The module's default export, untrusted. */
+    load(): Promise<unknown>;
+}