chore(deploy): Seity layer + JamPeerTransport (#287 + #290)

.github/workflows/test.yml

@@ -87,6 +87,13 @@ jobs:
             echo "::error::PolkaVM functional specs must have 0 failures"
             exit 1
           fi
+          UPGRADE_EXECUTED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "host-upgrade.spec.ts") | select(any(.tests[]?.results[]?; .status != "skipped"))] | length' tests/functional/results.json)
+          UPGRADE_FAILED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "host-upgrade.spec.ts" and .ok == false)] | length' tests/functional/results.json)
+          UPGRADE_SKIPPED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "host-upgrade.spec.ts") | .tests[]?.results[]? | select(.status == "skipped")] | length' tests/functional/results.json)
+          if [ "$UPGRADE_EXECUTED" -lt 2 ] || [ "$UPGRADE_FAILED" -gt 0 ] || [ "$UPGRADE_SKIPPED" -gt 0 ]; then
+            echo "::error::host-upgrade.spec.ts must execute its upgrade scenarios without failures or skips (executed: $UPGRADE_EXECUTED, failed: $UPGRADE_FAILED, skipped: $UPGRADE_SKIPPED)"
+            exit 1
+          fi
           LOADING_FAILED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "loading.spec.ts" and .ok == false)] | length' tests/functional/results.json)
           RESOLUTION_FAILED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "resolution.spec.ts" and .ok == false)] | length' tests/functional/results.json)
           TRANSPORT_FAILED=$(jq '[.suites[] | recurse(.suites[]?) | .specs[]? | select(.file == "network-transport.spec.ts" and .ok == false)] | length' tests/functional/results.json)

README.md

@@ -150,6 +150,26 @@ traffic stays on the bounded PolkaVM runtime ABI 1. Guest Host requests use the
 Host-frame bytes use the canonical TrUAPI wire codec, currently version 3. Build guest clients against the SDK recorded
 in `vendor/truapi-host.lock.json`; runtime ABI 1 compatibility alone does not imply TrUAPI wire compatibility.
 
+On this branch, `vendor/truapi-host.lock.json` pins the canonical SDK and Wasm to `feat/jam-peer-transport-on-seity`.
+JAM peer transport is execution-local in the sandbox. Before dialing a network, it requests `JamPeers` permission
+through the product's authenticated port to the shared page core. The host's Solid permission dialog shows the full
+genesis hash and offers **Allow once**, **Always allow**, and **Deny**; dismissal saves no decision. Durable decisions
+are scoped to product and genesis, while a one-time grant lasts only for that execution. This grants no account,
+signing, storage, or arbitrary web access.
+
+The sandbox checks for the required browser WebTransport capability before requesting permission. If it is unavailable,
+the host leaves the stored permission unchanged, shows the detected browser version and compatibility requirements, and
+the app can continue with its verified snapshot. Supported versions are Chrome or Edge 100+, Firefox 125+, and
+Safari/iOS 26.4+.
+
+The canonical session uses WebTransport to validators, with at most eight connections, sixteen streams per connection,
+and 1 MiB messages. Received data remains unverified until the guest checks it. The runtime menu's **Network access**
+section lists this execution's grants. Network updates continue while its display/audio menu is paused. Stop,
+replacement, and runtime failure close the session and refuse outstanding permission requests; a replacement guest
+cannot consume old replies. Ordinary host frames retain their 1 MiB bound and still use the shared page core; only peer
+frames use the larger bound needed for message framing. The session's ten-second dial deadline includes the permission
+prompt: a late decision does not resurrect an expired dial, though a retry can use the remembered decision.
+
 App manifest v2 uses runtime ABI 1 with framebuffer, Tri2D, WebGPU Raster, and bounded capability negotiation; TrUAPI,
 MotionSample v1, text, IME, focus, and wheel input use the same pinned browser runtime as native Hosts. UI output v1
 applies cursor and IME-agent state in the sandbox. Clipboard text and HTTP(S) navigation cross an origin-checked parent
@@ -226,6 +246,17 @@ current page was loaded:
 If a background re-resolution finds the on-chain CID has changed, dotli shows a **New version available** notification
 with a **Reload** action rather than swapping content silently.
 
+The host PWA caches its shell separately from the cross-origin sandbox. On a worker update, open host pages report their
+sandbox-contract version. Matching hosts keep the normal update prompt. Legacy, incompatible, or nonresponsive hosts are
+reloaded at the same URL after the new shell finishes installing, without clearing wallet/app storage or product caches.
+This lets an already cached host recover even when it cannot understand the newer sandbox's update request; the
+sandbox's strict contract validation remains unchanged. As with any host reload, in-memory app state and credentialless
+iframe storage restart; persistent host storage is retained.
+
+Astro builds the release-specific classic upgrade worker after its static pages and before Workbox emits `host-sw.js`.
+Browser validation and Node-loaded build configuration share the version in
+`packages/config/src/host-sandbox-version.ts`; the build does not import browser network configuration.
+
 ## TrUAPI bridge
 
 Loaded SPAs communicate with dotli through a postMessage-based protocol. The bridge exposes:

apps/host/astro.config.ts

@@ -9,7 +9,7 @@
 import { sentryVitePlugin } from '@sentry/vite-plugin';
 import { defineConfig } from 'astro/config';
 import type { AstroIntegration } from 'astro';
-import type { Plugin, PluginOption } from 'vite';
+import { build as viteBuild, type Plugin, type PluginOption } from 'vite';
 import { readFileSync, readdirSync } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { execSync } from 'node:child_process';
@@ -21,6 +21,7 @@ import { astroPwa } from '@config/vite/astro-pwa';
 import { buildInfo, readPackageVersion } from '@config/vite/build-info';
 import { appBuildOptions, rolldownOptions } from '@config/vite/build-options';
 import { runtimeNetworkConfigScript } from '@config/vite/runtime-network-config';
+import { SANDBOX_SCHEMA_VERSION } from '../../packages/config/src/host-sandbox-version.ts';
 import { stripAnalytics } from '@dotli/metrics/vite';
 import { handleNodeIdentityProxy, IDENTITY_PROXY_PREFIX } from '../../scripts/identity-proxy.ts';
 
@@ -48,6 +49,38 @@ if ((process.env['VITE_COMMIT_SHA'] ?? '') === '') {
 
 const OUT_DIR = 'dist';
 const APP_URL = process.env['VITE_APP_URL'] ?? '';
+const HOST_UPDATE_SCRIPT = `assets/host-update-${process.env['VITE_COMMIT_SHA'] ?? 'dev'}.js`;
+
+function hostUpdateWorker(): AstroIntegration {
+  return {
+    name: 'host-update-worker',
+    hooks: {
+      // Finish before astroPwa generates the importing service worker.
+      // A release-specific URL avoids stale HTTP-cached importScripts.
+      'astro:build:done': async ({ dir }) => {
+        await viteBuild({
+          configFile: false,
+          define: {
+            __HOST_SANDBOX_SCHEMA_VERSION__: JSON.stringify(SANDBOX_SCHEMA_VERSION),
+          },
+          build: {
+            emptyOutDir: false,
+            outDir: fileURLToPath(dir),
+            lib: {
+              entry: resolve(import.meta.dirname, 'src/host-update.ts'),
+              formats: ['iife'],
+              name: 'DotliHostUpdate',
+              fileName: () => HOST_UPDATE_SCRIPT,
+            },
+            sourcemap: false,
+            minify: true,
+          },
+          logLevel: 'warn',
+        });
+      },
+    },
+  };
+}
 
 /**
  * Walk every workspace member's `package.json` and collect its direct
@@ -286,11 +319,12 @@ export default defineConfig({
     astroSolid(),
     // Before astroPwa: it rewrites the page that the precache manifest hashes.
     pagePreloads(),
+    hostUpdateWorker(),
     // Host shell PWA. Scope-locked to the host origin (myapp.dot.li). The
     // protocol iframe on host.dot.li and the app iframe on *.app.dot.li are
-    // cross-origin and outside this SW's reach by design. `registerType:
-    // "prompt"` defers update activation to the user via workbox-window in
-    // src/pwa.ts.
+    // cross-origin and outside this SW's reach by design. Compatible host
+    // sessions keep prompt-style updates. The imported upgrade worker replaces
+    // incompatible cached shells without touching wallet or application storage.
     astroPwa({
       injectRegister: false,
       registerType: 'prompt',
@@ -319,10 +353,11 @@ export default defineConfig({
         // The TrUAPI core loads its ring-VRF module (~4.6 MB) only when a
         // ring-VRF operation first needs it. Precaching it would make every
         // installed shell download it after each release.
-        globIgnores: ['**/truapi_provider_bg*.wasm', '**/truapi_verifiable_bg*.wasm'],
+        globIgnores: ['**/truapi_provider_bg*.wasm', '**/truapi_verifiable_bg*.wasm', '**/host-update-*.js'],
         cleanupOutdatedCaches: true,
-        // skipWaiting/clientsClaim stay false: prompt-style updates require
-        // the waiting SW to sit idle until the user opts in.
+        importScripts: [HOST_UPDATE_SCRIPT],
+        // The upgrade worker overrides these only for outdated shells;
+        // matching-contract sessions still opt into an ordinary update.
         skipWaiting: false,
         clientsClaim: false,
         maximumFileSizeToCacheInBytes: 32 * 1024 * 1024,

apps/host/package.json

@@ -13,7 +13,7 @@
     "build": "astro build",
     "build:prod": "astro check && astro build && node ../../scripts/compress-dist.ts",
     "test": "vitest run",
-    "test:functional": "playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts tests/functional/network-transport.spec.ts tests/functional/ui-smoke.spec.ts tests/functional/host-settings.spec.ts tests/functional/polkavm.spec.ts tests/functional/chinpokomon.spec.ts",
+    "test:functional": "playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts tests/functional/network-transport.spec.ts tests/functional/ui-smoke.spec.ts tests/functional/host-settings.spec.ts tests/functional/polkavm.spec.ts tests/functional/chinpokomon.spec.ts tests/functional/host-upgrade.spec.ts",
     "test:e2e": "playwright test --config=tests/e2e/playwright.config.ts",
     "test:e2e:local": "E2E_PRODUCT_URL=${E2E_PRODUCT_URL:-http://localhost:5199} SIGNING_HOST_NETWORK=${SIGNING_HOST_NETWORK:-paseo-next-v2} playwright test --config=tests/e2e/playwright.config.ts",
     "test:perf": "PERF_RUNS=10 PERF_DOMAIN_A=browse PERF_DOMAIN_B=host-playground playwright test --config=tests/performance/playwright.config.ts tests/performance/cold-start.spec.ts",

apps/host/src/host-update.ts

@@ -0,0 +1,96 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+/// <reference lib="webworker" />
+declare const self: ServiceWorkerGlobalScope;
+
+declare const __HOST_SANDBOX_SCHEMA_VERSION__: number;
+
+export {};
+
+const VERSION_REPLY_TIMEOUT_MS = 1_500;
+
+function hasCurrentContract(client: WindowClient): Promise<boolean> {
+  const { promise, resolve } = Promise.withResolvers<boolean>();
+  const channel = new MessageChannel();
+  const finish = (matches: boolean): void => {
+    clearTimeout(timer);
+    channel.port1.onmessage = null;
+    channel.port1.close();
+    resolve(matches);
+  };
+  const timer = setTimeout(() => {
+    finish(false);
+  }, VERSION_REPLY_TIMEOUT_MS);
+  channel.port1.onmessage = (event: MessageEvent<unknown>) => {
+    const data = event.data;
+    finish(
+      typeof data === 'object' &&
+        data !== null &&
+        'version' in data &&
+        data.version === __HOST_SANDBOX_SCHEMA_VERSION__,
+    );
+  };
+  try {
+    client.postMessage({ type: 'dotli:host-contract-version' }, [channel.port2]);
+  } catch {
+    // The document can disappear while the worker is checking open tabs.
+    channel.port2.close();
+    finish(false);
+  }
+  return promise;
+}
+
+async function outdatedClients(): Promise<WindowClient[]> {
+  const windows = (await self.clients.matchAll({ type: 'window', includeUncontrolled: true })).filter(client =>
+    client.url.startsWith(self.registration.scope),
+  );
+  const compatible = await Promise.all(windows.map(hasCurrentContract));
+  return windows.filter((_, index) => compatible[index] !== true);
+}
+
+function isWindowClient(client: Client | undefined): client is WindowClient {
+  return client?.type === 'window';
+}
+
+self.addEventListener('install', (event: ExtendableEvent) => {
+  if (self.registration.active === null) {
+    return;
+  }
+  event.waitUntil(
+    outdatedClients().then(async clients => {
+      // Compatible sessions retain the normal update prompt. Legacy hosts do
+      // not answer this query and cannot be relied on to handle a new sandbox's
+      // update request. Activate only after Workbox's precache install succeeds.
+      if (clients.length > 0) {
+        await self.skipWaiting();
+      }
+    }),
+  );
+});
+
+self.addEventListener('activate', (event: ExtendableEvent) => {
+  event.waitUntil(
+    (async () => {
+      // Probe again: the worker can restart between installation and activation,
+      // and a tab may have navigated while the new assets were downloading.
+      const clients = await outdatedClients();
+      if (clients.length === 0) {
+        return;
+      }
+      await self.clients.claim();
+      await Promise.all(
+        clients.map(async client => {
+          const current = await self.clients.get(client.id);
+          if (isWindowClient(current)) {
+            // Navigation fetches wait for activation. Awaiting them here would
+            // deadlock the worker and every tab it just claimed.
+            void current.navigate(current.url).catch((error: unknown) => {
+              console.warn('[dot.li] Could not reload an outdated host', error);
+            });
+          }
+        }),
+      );
+    })(),
+  );
+});

apps/host/src/pwa.ts

@@ -16,11 +16,27 @@
 import { Workbox } from 'workbox-window';
 import { showNotification } from '@dotli/ui';
 import { log } from '@dotli/shared';
+import { SANDBOX_SCHEMA_VERSION } from '@dotli/config';
 
 const UPDATE_INTERVAL_MS = 15 * 60 * 1000;
 
 if ('serviceWorker' in navigator) {
   const wb = new Workbox('/host-sw.js');
+  navigator.serviceWorker.addEventListener('message', (event: MessageEvent<unknown>) => {
+    const data = event.data;
+    const reply = event.ports.at(0);
+    if (
+      typeof data !== 'object' ||
+      data === null ||
+      !('type' in data) ||
+      data.type !== 'dotli:host-contract-version' ||
+      reply === undefined
+    ) {
+      return;
+    }
+    reply.postMessage({ version: SANDBOX_SCHEMA_VERSION });
+    reply.close();
+  });
   let hostUpdateRequired = false;
   let applyingUpdate = false;
 

apps/host/tests/functional/chinpokomon.spec.ts

@@ -15,7 +15,7 @@ import { expect, test, type Page } from '@playwright/test';
 import { readFile, readdir } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 // Node-loaded specs use the side-effect-free contract, not the browser config barrel.
-import { SANDBOX_SCHEMA_VERSION } from '../../../../packages/config/src/host-sandbox-contract.js';
+import { SANDBOX_SCHEMA_VERSION } from '../../../../packages/config/src/host-sandbox-version.js';
 import { archiveCar, installTruapiPortResponder } from './helpers/polkavm.js';
 
 const bundleDir = process.env['DOTLI_CHINPOKOMON_BUNDLE'];