diff --git a/MIGRATION.md b/MIGRATION.md
new file mode 100644
index 0000000..077ef14
--- /dev/null
+++ b/MIGRATION.md
@@ -0,0 +1,106 @@
+# dotli host layer migration to TrUAPI
+
+This document records the current dotli host cutover state. The old
+`@novasamatech/*` host-container path is no longer part of the runtime design:
+dotli launches products through the Rust-backed TrUAPI host bridge and keeps
+only its own `.dot` resolution/smoldot protocol outside that boundary.
+
+## Current integration
+
+dotli still has two protocol layers:
+
+1. Host-product API frames, handled by TrUAPI.
+2. dotli's internal host-smoldot protocol in `packages/protocol/`, which owns
+   `.dot` resolution and is not replaced by TrUAPI.
+
+The active launch path is `packages/ui/src/bridge.ts`:
+
+- imports `@parity/truapi-host-wasm/web` and
+  `@parity/truapi-host-wasm/worker-runtime?worker`;
+- starts a Web Worker that owns the `truapi-server` WASM core;
+- adapts typed dotli callbacks with `createWasmRawCallbacks(...)`;
+- calls `createWebWorkerProvider(new HostWorker(), rawCallbacks, { runtimeConfig })`;
+- supplies callbacks from `packages/ui/src/host-callbacks/handlers.ts`;
+- calls `createIframeHost(...)` with the product URL, sandbox policy, allowed
+  origin, and the worker-backed provider.
+
+Product frames enter the Rust core through the iframe `MessageChannel`.
+Account, signing, statement-store, SSO pairing, restore, and logout are
+core-owned and do not cross the JS host callback boundary as Nova-specific
+routes.
+
+## dotli callback boundary
+
+dotli still supplies platform primitives that are host policy or browser UI:
+
+| Area                      | Files                                                                                  |
+| ------------------------- | -------------------------------------------------------------------------------------- |
+| navigation                | `packages/ui/src/host-callbacks/OpenUrl.ts`                                            |
+| notifications             | `packages/ui/src/host-callbacks/PushNotification.ts`                                   |
+| device/remote permissions | `packages/ui/src/host-callbacks/PromptPermission.ts`, `packages/ui/src/permissions.ts` |
+| feature support           | `packages/ui/src/host-callbacks/FeatureSupported.ts`                                   |
+| product storage           | `packages/ui/src/host-callbacks/LocalStorage.ts`                                       |
+| session persistence       | `packages/ui/src/host-callbacks/SessionStore.ts`                                       |
+| pairing presentation      | `packages/ui/src/host-callbacks/Pairing.ts`                                            |
+| user confirmations        | `packages/ui/src/host-callbacks/UserConfirmation.ts`                                   |
+| preimage lookup UI        | `packages/ui/src/host-callbacks/Preimage.ts`                                           |
+| theme subscription        | `packages/ui/src/host-callbacks/Theme.ts`                                              |
+| chain backend connection  | `packages/ui/src/host-callbacks/Chain.ts`                                              |
+
+These callbacks must remain generic host primitives. They should not re-add
+Nova package imports, wallet-specific JS channels, or statement-store request
+routing that belongs inside the Rust core.
+
+## Dependencies
+
+`packages/ui/package.json` depends on the local TrUAPI packages:
+
+```jsonc
+"@parity/truapi": "file:../../../../js/packages/truapi",
+"@parity/truapi-host-wasm": "file:../../../../js/packages/truapi-host-wasm"
+```
+
+> **TODO(packaging):** the `file:../../../../` links resolve only when dotli
+> lives at `hosts/dotli/` inside the TrUAPI monorepo. A standalone dotli
+> checkout (including dotli's own CI, which runs `bun install
+> --frozen-lockfile` without the parent repo) cannot install these packages.
+> Before this branch lands on dotli `main`, decide between publishing the
+> `@parity/truapi*` packages to a registry, vendoring tarballs, or retiring
+> dotli's standalone CI. Carry this note into the dotli PR description.
+
+The runtime manifests and source must not depend on or import the removed
+`@novasamatech/*` runtime packages. The canonical forbidden-package list lives
+in `packages/ui/tests/nova-removal.test.ts`; keep that guard broad rather than
+duplicating a package list in this document.
+
+`packages/ui/tests/nova-removal.test.ts` guards this invariant across dotli
+manifests, `bun.lock`, `THIRD_PARTY_NOTICES.md`, `apps/*/src`, and
+`packages/*/src`.
+
+## Nested dApps
+
+The old `setupNestedBridgeDetector` path created extra JS bridges for nested
+iframe sources. TrUAPI v1 does not create separate nested Rust runtimes,
+sessions, product identities, or storage namespaces. If nested traffic is
+forwarded later, it must use the shared top-level Rust core/provider context.
+
+The future usefulness of independent nested-product semantics is tracked in the
+parent TrUAPI design note `docs/design/host-contract-and-core-impl/I -
+nested-dapps.md`.
+
+## Non-TrUAPI dotli layers
+
+These areas remain dotli-owned and are intentionally outside the host-product
+replacement:
+
+- `apps/host/src/main.ts`: landing shell, `.dot` resolution, iframe mounting.
+- `apps/sandbox/src/main.ts`: content renderer.
+- `packages/protocol/`: smoldot protocol client/broker/session plumbing.
+- `packages/resolver/`: `.dot` name resolution.
+- `packages/content/` and `packages/storage/`: archive fetch and cache.
+- `packages/config/`, `packages/metrics/`, and `packages/shared/`: support
+  libraries.
+
+When auditing the migration, treat Nova runtime imports/dependencies as a
+regression, but do not confuse dotli's internal `packages/protocol/` with the
+removed host-product protocol.
diff --git a/README.md b/README.md
index a6abb74..2ee0da8 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ Each product gets its own `<label>.app.paseo.li` origin, so versions of the same
 
 1. **Resolves** `.dot` names via an in-browser [smoldot](https://github.com/paritytech/smoldot) light client connected to Asset Hub Paseo, querying dotNS contracts.
 2. **Fetches** content from the [Bulletin Chain](https://github.com/paritytech/polkadot-bulletin-chain) via smoldot `bitswap_v1_get` JSON-RPC or an IPFS gateway.
-3. **Renders** the content in a sandboxed iframe with a full host-container bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
+3. **Renders** the content in a sandboxed iframe with the Rust-backed TrUAPI bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
 
 ```
 host-playground.paseo.li
@@ -116,7 +116,7 @@ On repeat visits, content renders instantly from the cache while it is resolved
 
 If a background re-resolution finds the on-chain CID has changed, dotli shows a **New version available** notification with a **Reload** action rather than swapping content silently.
 
-## Host-container bridge
+## TrUAPI bridge
 
 Loaded SPAs communicate with dotli through a postMessage-based protocol. The bridge exposes:
 
@@ -124,18 +124,16 @@ Loaded SPAs communicate with dotli through a postMessage-based protocol. The bri
 | ------------------------------ | ---------------------------------------------------------------------- |
 | `accountGet`                   | Derives a per-app public key via HDKD soft derivation                  |
 | `getLegacyAccounts`            | Returns non-derived (imported) accounts — always empty on the web host |
-| `signPayload` / `signRaw`      | Shows signing modals, delegates to host-papp session                   |
+| `signPayload` / `signRaw`      | Shows signing modals and routes signing through the active session     |
 | `chainConnection`              | Returns a smoldot-backed JsonRpcProvider for supported chains          |
 | `localStorageRead/Write/Clear` | Scoped `localStorage` per `.dot` domain                                |
 | `navigateTo`                   | Opens URLs in new tabs                                                 |
 | `featureSupported`             | Reports whether a feature is supported (e.g. a chain's genesis hash)   |
 | `connectionStatus`             | Streams auth state changes to the SPA                                  |
 
-### Nested dApp support
+### App iframe model
 
-dApps can embed other dApps via iframes (e.g. a marketplace app embedding a payments app). The host automatically detects nested dApps and creates separate bridges for each one, regardless of nesting depth.
-
-When the host receives a protocol message from an unknown iframe window, it dynamically creates a new container bridge targeting that window. The dApp SDK always sends to `window.top`, so all nested dApps communicate directly with the host — no relay needed.
+The host creates one TrUAPI bridge for the rendered product iframe. dApp-in-dApp iframes are opaque to the host and must use the top-level product's shared Rust core/provider context rather than separate host-created bridges.
 
 The app context uses `document.write()` to eliminate extra iframe nesting: when loaded inside a host iframe, the app replaces its own document with the dApp content so the dApp occupies the iframe directly.
 
@@ -174,7 +172,7 @@ The published tag on the [Releases page](https://github.com/paritytech/dotli/rel
 
 ## Debug panel
 
-dotli ships a TrUAPI debug panel that aggregates host-side activity (boot/resolve/render/bridge events, TrUAPI host↔product messages, host-papp SSO/session events) into one time-aligned inspector. The panel chunk is dynamically imported, so users who never see it pay no download cost.
+dot.li ships a TrUAPI debug panel that aggregates host-side activity (boot/resolve/render/bridge events, TrUAPI host↔product messages, SSO/session events) into one time-aligned inspector. The panel chunk is dynamically imported, so users who never see it pay no download cost.
 
 In builds compiled with `VITE_APP_DEBUG=true` (local `bun run preview:debug`, and the staging dev deploys at `paseoli.dev` / `dotli.dev`) the panel auto-mounts collapsed. In staging/production it's off until you click **Open in debug mode** in the host Settings menu (or append `?debug=true` to any URL). The choice is sessionStorage-scoped — closing the tab clears it. Use `?debug=off` to silence it explicitly within the same session.
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 3005b7a..df4d889 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -12,7 +12,7 @@ compatible with this project's AGPL-3.0 outbound license. Build-time-only
 tooling under weak-copyleft (MPL-2.0) or source-available (FSL-1.1-MIT) terms is
 used to build the application and is not redistributed as part of it.
 
-> Generated from the resolved dependency tree (603 distinct third-party
+> Generated from the resolved dependency tree (595 distinct third-party
 > packages). Platform-specific binary packages (for example
 > `*-darwin-arm64`, `@esbuild/*`, `@rolldown/*`) reflect the build host;
 > other platforms resolve their own equivalents under the same licenses.
@@ -20,11 +20,11 @@ used to build the application and is not redistributed as part of it.
 
 ## MIT
 
-@apideck/better-ajv-errors, @babel/code-frame, @babel/compat-data, @babel/core, @babel/generator, @babel/helper-annotate-as-pure, @babel/helper-compilation-targets, @babel/helper-create-class-features-plugin, @babel/helper-create-regexp-features-plugin, @babel/helper-define-polyfill-provider, @babel/helper-globals, @babel/helper-member-expression-to-functions, @babel/helper-module-imports, @babel/helper-module-transforms, @babel/helper-optimise-call-expression, @babel/helper-plugin-utils, @babel/helper-remap-async-to-generator, @babel/helper-replace-supers, @babel/helper-skip-transparent-expression-wrappers, @babel/helper-string-parser, @babel/helper-validator-identifier, @babel/helper-validator-option, @babel/helper-wrap-function, @babel/helpers, @babel/parser, @babel/plugin-bugfix-firefox-class-in-computed-class-key, @babel/plugin-bugfix-safari-class-field-initializer-scope, @babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression, @babel/plugin-bugfix-safari-rest-destructuring-rhs-array, @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining, @babel/plugin-bugfix-v8-static-class-fields-redefine-readonly, @babel/plugin-proposal-private-property-in-object, @babel/plugin-syntax-import-assertions, @babel/plugin-syntax-import-attributes, @babel/plugin-syntax-unicode-sets-regex, @babel/plugin-transform-arrow-functions, @babel/plugin-transform-async-generator-functions, @babel/plugin-transform-async-to-generator, @babel/plugin-transform-block-scoped-functions, @babel/plugin-transform-block-scoping, @babel/plugin-transform-class-properties, @babel/plugin-transform-class-static-block, @babel/plugin-transform-classes, @babel/plugin-transform-computed-properties, @babel/plugin-transform-destructuring, @babel/plugin-transform-dotall-regex, @babel/plugin-transform-duplicate-keys, @babel/plugin-transform-duplicate-named-capturing-groups-regex, @babel/plugin-transform-dynamic-import, @babel/plugin-transform-explicit-resource-management, @babel/plugin-transform-exponentiation-operator, @babel/plugin-transform-export-namespace-from, @babel/plugin-transform-for-of, @babel/plugin-transform-function-name, @babel/plugin-transform-json-strings, @babel/plugin-transform-literals, @babel/plugin-transform-logical-assignment-operators, @babel/plugin-transform-member-expression-literals, @babel/plugin-transform-modules-amd, @babel/plugin-transform-modules-commonjs, @babel/plugin-transform-modules-systemjs, @babel/plugin-transform-modules-umd, @babel/plugin-transform-named-capturing-groups-regex, @babel/plugin-transform-new-target, @babel/plugin-transform-nullish-coalescing-operator, @babel/plugin-transform-numeric-separator, @babel/plugin-transform-object-rest-spread, @babel/plugin-transform-object-super, @babel/plugin-transform-optional-catch-binding, @babel/plugin-transform-optional-chaining, @babel/plugin-transform-parameters, @babel/plugin-transform-private-methods, @babel/plugin-transform-private-property-in-object, @babel/plugin-transform-property-literals, @babel/plugin-transform-regenerator, @babel/plugin-transform-regexp-modifiers, @babel/plugin-transform-reserved-words, @babel/plugin-transform-shorthand-properties, @babel/plugin-transform-spread, @babel/plugin-transform-sticky-regex, @babel/plugin-transform-template-literals, @babel/plugin-transform-typeof-symbol, @babel/plugin-transform-unicode-escapes, @babel/plugin-transform-unicode-property-regex, @babel/plugin-transform-unicode-regex, @babel/plugin-transform-unicode-sets-regex, @babel/preset-env, @babel/preset-modules, @babel/runtime, @babel/template, @babel/traverse, @babel/types, @commander-js/extra-typings, @ensdomains/content-hash, @esbuild/darwin-arm64, @eslint-community/eslint-utils, @eslint-community/regexpp, @eslint/js, @jridgewell/gen-mapping, @jridgewell/remapping, @jridgewell/resolve-uri, @jridgewell/source-map, @jridgewell/sourcemap-codec, @jridgewell/trace-mapping, @noble/ciphers, @noble/curves, @noble/hashes, @novasamatech/sdk-statement, @oxc-project/types, @polkadot-api/cli, @polkadot-api/codegen, @polkadot-api/ink-contracts, @polkadot-api/json-rpc-provider, @polkadot-api/json-rpc-provider-proxy, @polkadot-api/known-chains, @polkadot-api/logs-provider, @polkadot-api/merkleize-metadata, @polkadot-api/metadata-builders, @polkadot-api/metadata-compatibility, @polkadot-api/observable-client, @polkadot-api/pjs-signer, @polkadot-api/polkadot-signer, @polkadot-api/raw-client, @polkadot-api/signer, @polkadot-api/signers-common, @polkadot-api/sm-provider, @polkadot-api/smoldot, @polkadot-api/substrate-bindings, @polkadot-api/substrate-client, @polkadot-api/utils, @polkadot-api/wasm-executor, @polkadot-api/ws-middleware, @polkadot-api/ws-provider, @polkadot-labs/hdkd, @polkadot-labs/hdkd-helpers, @polkadot-labs/schnorrkel-wasm, @rolldown/binding-darwin-arm64, @rolldown/pluginutils, @rollup/plugin-babel, @rollup/plugin-node-resolve, @rollup/plugin-replace, @rollup/plugin-terser, @rollup/pluginutils, @rollup/rollup-darwin-arm64, @rx-state/core, @scure/base, @scure/sr25519, @sec-ant/readable-stream, @sentry-internal/browser-utils, @sentry-internal/feedback, @sentry-internal/replay, @sentry-internal/replay-canvas, @sentry/babel-plugin-component-annotate, @sentry/browser, @sentry/bundler-plugin-core, @sentry/core, @sentry/rollup-plugin, @sentry/vite-plugin, @sindresorhus/merge-streams, @standard-schema/spec, @turbo/darwin-arm64, @types/bun, @types/chai, @types/deep-eql, @types/esrecurse, @types/estree, @types/json-schema, @types/node, @types/normalize-package-data, @types/qrcode, @types/resolve, @types/trusted-types, @types/whatwg-mimetype, @types/ws, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, @typescript-eslint/project-service, @typescript-eslint/scope-manager, @typescript-eslint/tsconfig-utils, @typescript-eslint/type-utils, @typescript-eslint/types, @typescript-eslint/typescript-estree, @typescript-eslint/utils, @typescript-eslint/visitor-keys, @vitest/expect, @vitest/mocker, @vitest/pretty-format, @vitest/runner, @vitest/snapshot, @vitest/spy, @vitest/utils, acorn, acorn-jsx, agent-base, ajv, ansi-regex, ansi-styles, array-buffer-byte-length, arraybuffer.prototype.slice, assertion-error, async, async-function, available-typed-arrays, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3, babel-plugin-polyfill-regenerator, balanced-match, brace-expansion, browserslist, buffer-from, buffer-image-size, bun-types, call-bind, call-bind-apply-helpers, call-bound, camelcase, chai, chalk, cli-cursor, cli-spinners, color-convert, color-name, commander, common-tags, convert-source-map, core-js-compat, cross-spawn, crypto-random-string, data-view-buffer, data-view-byte-length, data-view-byte-offset, debug, decamelize, deep-is, deepmerge, define-data-property, define-properties, detect-indent, dijkstrajs, dunder-proto, emoji-regex, es-abstract, es-define-property, es-errors, es-module-lexer, es-object-atoms, es-set-tostringtag, es-to-primitive, esbuild, escalade, escape-string-regexp, eslint, eslint-config-prettier, eslint-plugin-turbo, estree-walker, eta, execa, fast-deep-equal, fast-json-stable-stringify, fast-levenshtein, fdir, figures, file-entry-cache, find-up, flat-cache, for-each, fs-extra, fs.promises.exists, fsevents, function-bind, function.prototype.name, functions-have-names, generator-function, gensync, get-east-asian-width, get-intrinsic, get-proto, get-stream, get-symbol-description, get-tsconfig, globalthis, gopd, happy-dom, has-bigints, has-property-descriptors, has-proto, has-symbols, has-tostringtag, hasown, https-proxy-agent, ignore, imurmurhash, index-to-position, internal-slot, is-array-buffer, is-async-function, is-bigint, is-boolean-object, is-callable, is-core-module, is-data-view, is-date-object, is-extglob, is-finalizationregistry, is-fullwidth-code-point, is-generator-function, is-glob, is-interactive, is-map, is-module, is-negative-zero, is-number-object, is-obj, is-plain-obj, is-regex, is-regexp, is-set, is-shared-array-buffer, is-stream, is-string, is-symbol, is-typed-array, is-unicode-supported, is-weakmap, is-weakref, is-weakset, isarray, js-sha3, js-tokens, jsesc, json-buffer, json-schema-traverse, json-stable-stringify-without-jsonify, json5, jsonfile, jsonpointer, keyv, leven, levn, locate-path, lodash.debounce, lodash.sortby, log-symbols, magic-string, math-intrinsics, mimic-function, ms, nanoevents, nanoid, natural-compare, neverthrow, node-fetch, node-releases, npm-run-path, object-inspect, object-keys, object.assign, obug, onetime, optionator, ora, own-keys, p-limit, p-locate, p-try, parse-json, parse-ms, path-exists, path-key, path-parse, pathe, picomatch, pngjs, polkadot-api, possible-typed-array-names, postcss, prelude-ls, prettier, pretty-bytes, pretty-ms, progress, proxy-from-env, punycode, qrcode, read-pkg, reflect.getprototypeof, regenerate, regenerate-unicode-properties, regexp.prototype.flags, regexpu-core, regjsgen, require-directory, require-from-string, resolve, resolve-pkg-maps, restore-cursor, rolldown, rollup, rollup-plugin-esbuild, safe-array-concat, safe-push-apply, safe-regex-test, scale-ts, set-function-length, set-function-name, set-proto, shebang-command, shebang-regex, side-channel, side-channel-list, side-channel-map, side-channel-weakmap, smob, sort-keys, source-map-support, spdx-expression-parse, stackback, std-env, stdin-discarder, stop-iteration-iterator, string-width, string.prototype.matchall, string.prototype.trim, string.prototype.trimend, string.prototype.trimstart, strip-ansi, strip-comments, strip-final-newline, supports-preserve-symlinks-flag, tagged-tag, temp-dir, tempy, tinybench, tinyexec, tinyglobby, tinyrainbow, tr46, ts-api-utils, tsc-prog, turbo, type-check, typed-array-buffer, typed-array-byte-length, typed-array-byte-offset, typed-array-length, typescript-eslint, unbox-primitive, undici-types, unicode-canonical-property-names-ecmascript, unicode-match-property-ecmascript, unicode-match-property-value-ecmascript, unicode-property-aliases-ecmascript, unicorn-magic, unique-string, universalify, unplugin-utils, upath, update-browserslist-db, varint, vite, vite-plugin-pwa, vite-plugin-wasm, vitest, whatwg-mimetype, whatwg-url, which-boxed-primitive, which-builtin-type, which-collection, which-typed-array, why-is-node-running, word-wrap, workbox-background-sync, workbox-broadcast-update, workbox-build, workbox-cacheable-response, workbox-core, workbox-expiration, workbox-google-analytics, workbox-navigation-preload, workbox-precaching, workbox-range-requests, workbox-recipes, workbox-routing, workbox-strategies, workbox-streams, workbox-sw, workbox-window, wrap-ansi, write-json-file, write-package, ws, yargs, yocto-queue, yoctocolors
+@apideck/better-ajv-errors, @babel/code-frame, @babel/compat-data, @babel/core, @babel/generator, @babel/helper-annotate-as-pure, @babel/helper-compilation-targets, @babel/helper-create-class-features-plugin, @babel/helper-create-regexp-features-plugin, @babel/helper-define-polyfill-provider, @babel/helper-globals, @babel/helper-member-expression-to-functions, @babel/helper-module-imports, @babel/helper-module-transforms, @babel/helper-optimise-call-expression, @babel/helper-plugin-utils, @babel/helper-remap-async-to-generator, @babel/helper-replace-supers, @babel/helper-skip-transparent-expression-wrappers, @babel/helper-string-parser, @babel/helper-validator-identifier, @babel/helper-validator-option, @babel/helper-wrap-function, @babel/helpers, @babel/parser, @babel/plugin-bugfix-firefox-class-in-computed-class-key, @babel/plugin-bugfix-safari-class-field-initializer-scope, @babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression, @babel/plugin-bugfix-safari-rest-destructuring-rhs-array, @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining, @babel/plugin-bugfix-v8-static-class-fields-redefine-readonly, @babel/plugin-proposal-private-property-in-object, @babel/plugin-syntax-import-assertions, @babel/plugin-syntax-import-attributes, @babel/plugin-syntax-unicode-sets-regex, @babel/plugin-transform-arrow-functions, @babel/plugin-transform-async-generator-functions, @babel/plugin-transform-async-to-generator, @babel/plugin-transform-block-scoped-functions, @babel/plugin-transform-block-scoping, @babel/plugin-transform-class-properties, @babel/plugin-transform-class-static-block, @babel/plugin-transform-classes, @babel/plugin-transform-computed-properties, @babel/plugin-transform-destructuring, @babel/plugin-transform-dotall-regex, @babel/plugin-transform-duplicate-keys, @babel/plugin-transform-duplicate-named-capturing-groups-regex, @babel/plugin-transform-dynamic-import, @babel/plugin-transform-explicit-resource-management, @babel/plugin-transform-exponentiation-operator, @babel/plugin-transform-export-namespace-from, @babel/plugin-transform-for-of, @babel/plugin-transform-function-name, @babel/plugin-transform-json-strings, @babel/plugin-transform-literals, @babel/plugin-transform-logical-assignment-operators, @babel/plugin-transform-member-expression-literals, @babel/plugin-transform-modules-amd, @babel/plugin-transform-modules-commonjs, @babel/plugin-transform-modules-systemjs, @babel/plugin-transform-modules-umd, @babel/plugin-transform-named-capturing-groups-regex, @babel/plugin-transform-new-target, @babel/plugin-transform-nullish-coalescing-operator, @babel/plugin-transform-numeric-separator, @babel/plugin-transform-object-rest-spread, @babel/plugin-transform-object-super, @babel/plugin-transform-optional-catch-binding, @babel/plugin-transform-optional-chaining, @babel/plugin-transform-parameters, @babel/plugin-transform-private-methods, @babel/plugin-transform-private-property-in-object, @babel/plugin-transform-property-literals, @babel/plugin-transform-regenerator, @babel/plugin-transform-regexp-modifiers, @babel/plugin-transform-reserved-words, @babel/plugin-transform-shorthand-properties, @babel/plugin-transform-spread, @babel/plugin-transform-sticky-regex, @babel/plugin-transform-template-literals, @babel/plugin-transform-typeof-symbol, @babel/plugin-transform-unicode-escapes, @babel/plugin-transform-unicode-property-regex, @babel/plugin-transform-unicode-regex, @babel/plugin-transform-unicode-sets-regex, @babel/preset-env, @babel/preset-modules, @babel/runtime, @babel/template, @babel/traverse, @babel/types, @commander-js/extra-typings, @ensdomains/content-hash, @esbuild/darwin-arm64, @eslint-community/eslint-utils, @eslint-community/regexpp, @eslint/js, @jridgewell/gen-mapping, @jridgewell/remapping, @jridgewell/resolve-uri, @jridgewell/source-map, @jridgewell/sourcemap-codec, @jridgewell/trace-mapping, @noble/ciphers, @noble/curves, @noble/hashes, @oxc-project/types, @polkadot-api/cli, @polkadot-api/codegen, @polkadot-api/ink-contracts, @polkadot-api/json-rpc-provider, @polkadot-api/json-rpc-provider-proxy, @polkadot-api/known-chains, @polkadot-api/logs-provider, @polkadot-api/merkleize-metadata, @polkadot-api/metadata-builders, @polkadot-api/metadata-compatibility, @polkadot-api/observable-client, @polkadot-api/pjs-signer, @polkadot-api/polkadot-signer, @polkadot-api/raw-client, @polkadot-api/signer, @polkadot-api/signers-common, @polkadot-api/sm-provider, @polkadot-api/smoldot, @polkadot-api/substrate-bindings, @polkadot-api/substrate-client, @polkadot-api/utils, @polkadot-api/wasm-executor, @polkadot-api/ws-middleware, @polkadot-api/ws-provider, @polkadot-labs/hdkd, @polkadot-labs/hdkd-helpers, @polkadot-labs/schnorrkel-wasm, @rolldown/binding-darwin-arm64, @rolldown/pluginutils, @rollup/plugin-babel, @rollup/plugin-node-resolve, @rollup/plugin-replace, @rollup/plugin-terser, @rollup/pluginutils, @rollup/rollup-darwin-arm64, @rx-state/core, @scure/base, @scure/sr25519, @sec-ant/readable-stream, @sentry-internal/browser-utils, @sentry-internal/feedback, @sentry-internal/replay, @sentry-internal/replay-canvas, @sentry/babel-plugin-component-annotate, @sentry/browser, @sentry/bundler-plugin-core, @sentry/core, @sentry/rollup-plugin, @sentry/vite-plugin, @sindresorhus/merge-streams, @standard-schema/spec, @turbo/darwin-arm64, @types/bun, @types/chai, @types/deep-eql, @types/esrecurse, @types/estree, @types/json-schema, @types/node, @types/normalize-package-data, @types/qrcode, @types/resolve, @types/trusted-types, @types/whatwg-mimetype, @types/ws, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, @typescript-eslint/project-service, @typescript-eslint/scope-manager, @typescript-eslint/tsconfig-utils, @typescript-eslint/type-utils, @typescript-eslint/types, @typescript-eslint/typescript-estree, @typescript-eslint/utils, @typescript-eslint/visitor-keys, @vitest/expect, @vitest/mocker, @vitest/pretty-format, @vitest/runner, @vitest/snapshot, @vitest/spy, @vitest/utils, acorn, acorn-jsx, agent-base, ajv, ansi-regex, ansi-styles, array-buffer-byte-length, arraybuffer.prototype.slice, assertion-error, async, async-function, available-typed-arrays, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3, babel-plugin-polyfill-regenerator, balanced-match, brace-expansion, browserslist, buffer-from, buffer-image-size, bun-types, call-bind, call-bind-apply-helpers, call-bound, camelcase, chai, chalk, cli-cursor, cli-spinners, color-convert, color-name, commander, common-tags, convert-source-map, core-js-compat, cross-spawn, crypto-random-string, data-view-buffer, data-view-byte-length, data-view-byte-offset, debug, decamelize, deep-is, deepmerge, define-data-property, define-properties, detect-indent, dijkstrajs, dunder-proto, emoji-regex, es-abstract, es-define-property, es-errors, es-module-lexer, es-object-atoms, es-set-tostringtag, es-to-primitive, esbuild, escalade, escape-string-regexp, eslint, eslint-config-prettier, eslint-plugin-turbo, estree-walker, eta, execa, fast-deep-equal, fast-json-stable-stringify, fast-levenshtein, fdir, figures, file-entry-cache, find-up, flat-cache, for-each, fs-extra, fs.promises.exists, fsevents, function-bind, function.prototype.name, functions-have-names, generator-function, gensync, get-east-asian-width, get-intrinsic, get-proto, get-stream, get-symbol-description, get-tsconfig, globalthis, gopd, happy-dom, has-bigints, has-property-descriptors, has-proto, has-symbols, has-tostringtag, hasown, https-proxy-agent, ignore, imurmurhash, index-to-position, internal-slot, is-array-buffer, is-async-function, is-bigint, is-boolean-object, is-callable, is-core-module, is-data-view, is-date-object, is-extglob, is-finalizationregistry, is-fullwidth-code-point, is-generator-function, is-glob, is-interactive, is-map, is-module, is-negative-zero, is-number-object, is-obj, is-plain-obj, is-regex, is-regexp, is-set, is-shared-array-buffer, is-stream, is-string, is-symbol, is-typed-array, is-unicode-supported, is-weakmap, is-weakref, is-weakset, isarray, js-sha3, js-tokens, jsesc, json-buffer, json-schema-traverse, json-stable-stringify-without-jsonify, json5, jsonfile, jsonpointer, keyv, leven, levn, locate-path, lodash.debounce, lodash.sortby, log-symbols, magic-string, math-intrinsics, mimic-function, ms, nanoevents, nanoid, natural-compare, neverthrow, node-fetch, node-releases, npm-run-path, object-inspect, object-keys, object.assign, obug, onetime, optionator, ora, own-keys, p-limit, p-locate, p-try, parse-json, parse-ms, path-exists, path-key, path-parse, pathe, picomatch, pngjs, polkadot-api, possible-typed-array-names, postcss, prelude-ls, prettier, pretty-bytes, pretty-ms, progress, proxy-from-env, punycode, qrcode, read-pkg, reflect.getprototypeof, regenerate, regenerate-unicode-properties, regexp.prototype.flags, regexpu-core, regjsgen, require-directory, require-from-string, resolve, resolve-pkg-maps, restore-cursor, rolldown, rollup, rollup-plugin-esbuild, safe-array-concat, safe-push-apply, safe-regex-test, scale-ts, set-function-length, set-function-name, set-proto, shebang-command, shebang-regex, side-channel, side-channel-list, side-channel-map, side-channel-weakmap, smob, sort-keys, source-map-support, spdx-expression-parse, stackback, std-env, stdin-discarder, stop-iteration-iterator, string-width, string.prototype.matchall, string.prototype.trim, string.prototype.trimend, string.prototype.trimstart, strip-ansi, strip-comments, strip-final-newline, supports-preserve-symlinks-flag, tagged-tag, temp-dir, tempy, tinybench, tinyexec, tinyglobby, tinyrainbow, tr46, ts-api-utils, tsc-prog, turbo, type-check, typed-array-buffer, typed-array-byte-length, typed-array-byte-offset, typed-array-length, typescript-eslint, unbox-primitive, undici-types, unicode-canonical-property-names-ecmascript, unicode-match-property-ecmascript, unicode-match-property-value-ecmascript, unicode-property-aliases-ecmascript, unicorn-magic, unique-string, universalify, unplugin-utils, upath, update-browserslist-db, varint, vite, vite-plugin-pwa, vite-plugin-wasm, vitest, whatwg-mimetype, whatwg-url, which-boxed-primitive, which-builtin-type, which-collection, which-typed-array, why-is-node-running, word-wrap, workbox-background-sync, workbox-broadcast-update, workbox-build, workbox-cacheable-response, workbox-core, workbox-expiration, workbox-google-analytics, workbox-navigation-preload, workbox-precaching, workbox-range-requests, workbox-recipes, workbox-routing, workbox-strategies, workbox-streams, workbox-sw, workbox-window, wrap-ansi, write-json-file, write-package, ws, yargs, yocto-queue, yoctocolors
 
 ## Apache-2.0
 
-@eslint/config-array, @eslint/config-helpers, @eslint/core, @eslint/object-schema, @eslint/plugin-kit, @humanfs/core, @humanfs/node, @humanfs/types, @humanwhocodes/module-importer, @humanwhocodes/retry, @novasamatech/host-api, @novasamatech/host-container, @novasamatech/host-papp, @novasamatech/scale, @novasamatech/statement-store, @novasamatech/storage-adapter, @novasamatech/substrate-slot-sr25519-wasm, @playwright/test, @trickfilm400/rollup-plugin-off-main-thread, baseline-browser-mapping, cborg, detect-libc, ejs, eslint-visitor-keys, expect-type, fake-indexeddb, filelist, human-signals, jake, jsqr, playwright, playwright-core, rxjs, spdx-correct, typescript, validate-npm-package-license
+@eslint/config-array, @eslint/config-helpers, @eslint/core, @eslint/object-schema, @eslint/plugin-kit, @humanfs/core, @humanfs/node, @humanfs/types, @humanwhocodes/module-importer, @humanwhocodes/retry, @playwright/test, @trickfilm400/rollup-plugin-off-main-thread, baseline-browser-mapping, cborg, detect-libc, ejs, eslint-visitor-keys, expect-type, fake-indexeddb, filelist, human-signals, jake, jsqr, playwright, playwright-core, rxjs, spdx-correct, typescript, validate-npm-package-license
 
 ## Apache-2.0 OR MIT
 
diff --git a/apps/host/index.html b/apps/host/index.html
index 4d7c92a..dfba7d4 100644
--- a/apps/host/index.html
+++ b/apps/host/index.html
@@ -77,6 +77,7 @@
                     id="auth-button"
                     class="topbar-btn"
                     title="Login with Polkadot Mobile"
+                    disabled
                 >
                     <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
                         <path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/>
diff --git a/apps/host/src/main.ts b/apps/host/src/main.ts
index 14704c3..c79bea0 100644
--- a/apps/host/src/main.ts
+++ b/apps/host/src/main.ts
@@ -65,9 +65,10 @@ import type {
   ManifestResult,
   RootManifest,
 } from "@dotli/resolver/manifest";
-import { BASE_DOMAIN, DEBUG, SITE_ID } from "@dotli/config/config";
+import { BASE_DOMAIN, DEBUG, SITE_ID, isLocalhost } from "@dotli/config/config";
 import { log } from "@dotli/shared/log";
 import { serializeError } from "@dotli/shared/errors";
+import { dotNsUrl } from "@dotli/shared/dotns-url";
 import { escapeHtml, isValidDotLabel } from "@dotli/shared/html";
 import { isMobileDevice } from "@dotli/shared/device";
 import { showNotification } from "@dotli/ui/notification";
@@ -164,6 +165,21 @@ if (m.enabled && typeof PerformanceObserver !== "undefined") {
 }
 
 const T0 = performance.now();
+const DOTLI_PRODUCT_ID_PARAM = "dotliProductId";
+
+function parseLocalProductIdOverride(): string | undefined {
+  if (!isLocalhost) {
+    return undefined;
+  }
+  const value = new URLSearchParams(window.location.search).get(
+    DOTLI_PRODUCT_ID_PARAM,
+  );
+  if (value === null || value.trim() === "") {
+    return undefined;
+  }
+  const productId = value.trim();
+  return dotNsUrl.isProductIdentifier(productId) ? productId : undefined;
+}
 
 /**
  * Parse a localhost proxy URL from the path.
@@ -193,8 +209,8 @@ function parseLocalhostUrl(): string | null {
   const host = match[1];
   const rest = match[2] || "";
   // Strip every reserved host-URL param so they do not leak into the
-  // proxied product. Covers the five settings axes, the sandbox contract's
-  // host-only signals (`fullReset`, `v`), and the Playwright auth hook.
+  // proxied product. Covers the settings axes and the sandbox contract's
+  // host-only signals (`fullReset`, `v`).
   const productSearch = new URLSearchParams(window.location.search);
   for (const k of RESERVED_HOST_PARAMS) {
     productSearch.delete(k);
@@ -211,7 +227,7 @@ const RESERVED_HOST_PARAMS = [
   "skipWorkerCache",
   "fullReset",
   "v",
-  "initAuthSubscribe",
+  DOTLI_PRODUCT_ID_PARAM,
 ] as const;
 
 /**
@@ -679,71 +695,6 @@ async function runBackgroundRevalidate(
   }
 }
 
-interface AuthSubscribeApi {
-  backend: string;
-  subscribeAll: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<{ count: number; isComplete: boolean }>;
-  subscribeAny: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<{ count: number; isComplete: boolean }>;
-}
-
-function hexToBytes(s: string): Uint8Array {
-  const h = s.startsWith("0x") ? s.slice(2) : s;
-  const bytes = new Uint8Array(h.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(h.slice(i * 2, i * 2 + 2), 16);
-  }
-  return bytes;
-}
-
-async function runAuthSubscribeHook(chainBackend: string): Promise<void> {
-  log.warn("[dot.li auth-subscribe] init auth + statement store");
-  const authMod = await import("@dotli/auth/auth");
-  await authMod.initAuth();
-  const store = await authMod.onStatementStoreReady();
-
-  type Filter = { matchAll: Uint8Array[] } | { matchAny: Uint8Array[] };
-
-  function subscribeFor(
-    filter: Filter,
-    timeoutMs: number,
-  ): Promise<{ count: number; isComplete: boolean }> {
-    return new Promise((resolve) => {
-      let count = 0;
-      let lastIsComplete = false;
-      const unsub = store.subscribeStatements(filter, (page) => {
-        count += page.statements.length;
-        lastIsComplete = page.isComplete;
-        return undefined;
-      });
-      setTimeout(() => {
-        unsub();
-        resolve({ count, isComplete: lastIsComplete });
-      }, timeoutMs);
-    });
-  }
-
-  const api: AuthSubscribeApi = {
-    backend: chainBackend,
-    subscribeAll: (topicsHex, timeoutMs) =>
-      subscribeFor({ matchAll: topicsHex.map(hexToBytes) }, timeoutMs),
-    subscribeAny: (topicsHex, timeoutMs) =>
-      subscribeFor({ matchAny: topicsHex.map(hexToBytes) }, timeoutMs),
-  };
-
-  (
-    window as unknown as { __dotliAuthSubscribe: AuthSubscribeApi }
-  ).__dotliAuthSubscribe = api;
-  log.warn(
-    `[dot.li auth-subscribe] window.__dotliAuthSubscribe ready (backend=${chainBackend})`,
-  );
-  document.title = "dotli-auth-subscribe-ready";
-}
-
 /** Best-effort `localStorage.getItem`, returning null on Safari-private-mode failure. */
 function readRawLocalStorage(key: string): string | null {
   try {
@@ -1038,21 +989,11 @@ async function main(): Promise<void> {
     });
   }
 
-  // Auth-subscribe hook: when `?initAuthSubscribe=1` is in the URL,
-  // initialize the auth module and statement-store, expose
-  // `window.__dotliAuthSubscribe` for the Playwright spec, then bail out
-  // before the normal landing/.dot flow runs. The protocol iframe
-  // pre-warm above is what makes `createRemoteChainProvider(...)` work
-  // for the smoldot statement-store path, so this branch sits AFTER the
-  // pre-warm.
-  if (
-    new URLSearchParams(window.location.search).get("initAuthSubscribe") === "1"
-  ) {
-    await runAuthSubscribeHook(chainBackend);
-    return;
-  }
+  const bridgeModulePromise = import("@dotli/ui/bridge");
+  const bridgeModule = await bridgeModulePromise;
+  bridgeModule.initBridgeEventListeners();
 
-  // Initialize top bar UI (auth is lazy-loaded inside topbar when needed)
+  // Initialize top bar UI.
   const t0 = performance.now();
   initTopBar();
   log.warn(`[dot.li perf] initTopBar() done (${dur(t0)})`);
@@ -1065,6 +1006,7 @@ async function main(): Promise<void> {
   });
 
   const label = parseDotLabel();
+  const productIdOverride = parseLocalProductIdOverride();
 
   if (label === null && previewTargetUrl !== null) {
     const host = new URL(previewTargetUrl).host;
@@ -1077,13 +1019,17 @@ async function main(): Promise<void> {
       urlBar.innerHTML = `<div class="topbar-url-pill localhost-pill" id="url-pill"><svg class="localhost-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg><span class="topbar-url-text"><span class="dot-domain">${escapeHtml(host)}</span></span></div>`;
     }
 
-    const { renderIframe } = await import("@dotli/ui/bridge");
-    await renderIframe(previewTargetUrl, host);
-    history.replaceState(
-      null,
-      "",
-      `/__preview?url=${encodeURIComponent(previewTargetUrl)}`,
-    );
+    const { renderIframe } = await bridgeModulePromise;
+    await renderIframe(previewTargetUrl, host, {
+      productId: productIdOverride,
+    });
+    const nextSearch = new URLSearchParams({
+      url: previewTargetUrl,
+    });
+    if (productIdOverride !== undefined) {
+      nextSearch.set(DOTLI_PRODUCT_ID_PARAM, productIdOverride);
+    }
+    history.replaceState(null, "", `/__preview?${nextSearch.toString()}`);
     document.title = `${host} — ${SITE_ID}`;
     performance.mark("dotli:main:end");
     return;
@@ -1112,15 +1058,21 @@ async function main(): Promise<void> {
       urlBar.innerHTML = `<div class="topbar-url-pill localhost-pill" id="url-pill"><svg class="localhost-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg><span class="topbar-url-text"><span class="dot-domain">${escapeHtml(host)}</span></span></div>`;
     }
 
-    const { renderIframe } = await import("@dotli/ui/bridge");
-    await renderIframe(localhostUrl, host);
+    const { renderIframe } = await bridgeModulePromise;
+    await renderIframe(localhostUrl, host, { productId: productIdOverride });
 
     shieldVerified = true;
     bindTopbarAutoHide();
     setupTopbarAutoHide();
 
     // Deep path was forwarded to the product iframe, so strip it so the URL bar doesn't show a stale path
-    history.replaceState(null, "", "/" + host);
+    history.replaceState(
+      null,
+      "",
+      productIdOverride === undefined
+        ? "/" + host
+        : `/${host}?${DOTLI_PRODUCT_ID_PARAM}=${encodeURIComponent(productIdOverride)}`,
+    );
     document.title = `${host} — ${SITE_ID}`;
     performance.mark("dotli:main:end");
     emitDotliDebugEvent({
diff --git a/apps/host/src/pwa.ts b/apps/host/src/pwa.ts
index 662f4c4..d5d52c6 100644
--- a/apps/host/src/pwa.ts
+++ b/apps/host/src/pwa.ts
@@ -19,7 +19,7 @@ import { log } from "@dotli/shared/log";
 
 const UPDATE_INTERVAL_MS = 15 * 60 * 1000;
 
-if ("serviceWorker" in navigator) {
+if (import.meta.env.PROD && "serviceWorker" in navigator) {
   const wb = new Workbox("/host-sw.js");
 
   wb.addEventListener("waiting", () => {
diff --git a/apps/host/tests/e2e/fixtures/paired.ts b/apps/host/tests/e2e/fixtures/paired.ts
index 87d6fa7..fa5b188 100644
--- a/apps/host/tests/e2e/fixtures/paired.ts
+++ b/apps/host/tests/e2e/fixtures/paired.ts
@@ -118,7 +118,7 @@ export const test = base.extend<
         if (
           type === "error" ||
           type === "warning" ||
-          /\[dotli|\[dot\.li|host-papp|statement.store|signing/i.test(text)
+          /\[dotli|\[dot\.li|statement.store|signing/i.test(text)
         ) {
           const isFullText =
             type === "error" ||
diff --git a/apps/host/tests/e2e/global-setup.ts b/apps/host/tests/e2e/global-setup.ts
index aac8aa5..fd9157d 100644
--- a/apps/host/tests/e2e/global-setup.ts
+++ b/apps/host/tests/e2e/global-setup.ts
@@ -28,7 +28,10 @@ const BOT_NETWORK = requiredEnv("SIGNER_BOT_NETWORK");
 // Local-dev knobs. Defaults are fine because they don't depend on
 // external services.
 const PORT = process.env.PORT ?? "5173";
-const HOST = process.env.E2E_HOST ?? "host-playground";
+// Pairing only needs the host shell and protocol iframe. Loading the
+// host-playground product here can open product permission modals before the
+// auth button is clicked, so keep global auth setup on the bare host origin.
+const AUTH_HOST = process.env.E2E_AUTH_HOST ?? "localhost";
 
 function requiredEnv(name: string): string {
   const value = process.env[name];
@@ -139,7 +142,7 @@ async function pairOnce(
   });
 
   try {
-    await page.goto(`http://${HOST}.localhost:${PORT}/`, { timeout: 60_000 });
+    await page.goto(`http://${AUTH_HOST}:${PORT}/`, { timeout: 60_000 });
     await page
       .getByRole("button", { name: "Switch to Gateway" })
       .click({ timeout: 5_000 })
diff --git a/apps/host/tests/e2e/helpers/extract-qr-payload.ts b/apps/host/tests/e2e/helpers/extract-qr-payload.ts
index c8dc9c6..fb94678 100644
--- a/apps/host/tests/e2e/helpers/extract-qr-payload.ts
+++ b/apps/host/tests/e2e/helpers/extract-qr-payload.ts
@@ -11,6 +11,14 @@ export async function extractQrPayload(
 ): Promise<string> {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
+    const embedded = await page
+      .locator(canvasSelector)
+      .getAttribute("data-qr-payload", { timeout: 250 })
+      .catch(() => null);
+    if (embedded?.startsWith("polkadotapp://")) {
+      return embedded;
+    }
+
     const px = await page.evaluate((sel) => {
       const canvas = document.querySelector(sel) as HTMLCanvasElement | null;
       if (!canvas || canvas.width === 0) return null;
diff --git a/apps/host/tests/e2e/helpers/signer-bot.ts b/apps/host/tests/e2e/helpers/signer-bot.ts
index 45d4987..c259c1e 100644
--- a/apps/host/tests/e2e/helpers/signer-bot.ts
+++ b/apps/host/tests/e2e/helpers/signer-bot.ts
@@ -5,12 +5,36 @@ import { setTimeout as sleep } from "node:timers/promises";
 
 const TRANSIENT = new Set([502, 503, 504]);
 
-// Per-attempt request timeout. The bot side rarely needs more than a few
-// seconds, even for pair (attestation and handshake). Without a client-side
-// cap, a hung response would silently extend the whole suite.
-const PAIR_REQUEST_TIMEOUT_MS = 30_000;
+// Per-attempt request timeout. First-time pair can include user creation and
+// People-chain attestation, so give the one-shot handshake room to finish
+// instead of aborting and retrying the same QR payload.
+const PAIR_REQUEST_TIMEOUT_MS = Number(
+  process.env.SIGNER_BOT_PAIR_TIMEOUT_MS ?? "120000",
+);
 const HEALTH_REQUEST_TIMEOUT_MS = 5_000;
 
+function shellQuote(value: string): string {
+  if (value.length === 0) return "''";
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
+function buildPairCurl(url: string, body: unknown): string {
+  return [
+    `curl -sS -X POST ${shellQuote(url)}`,
+    '-H "Authorization: Bearer ${SIGNER_BOT_SVC_TOKEN}"',
+    "-H 'Content-Type: application/json'",
+    "-H 'Accept: application/json'",
+    `--data-raw ${shellQuote(JSON.stringify(body))}`,
+  ].join(" \\\n  ");
+}
+
+function redactSignerBotResponse(text: string): string {
+  return text.replace(
+    /"mnemonic"\s*:\s*"[^"]+"/g,
+    '"mnemonic":"[redacted]"',
+  );
+}
+
 async function fetchWithTimeout(
   url: string,
   init: RequestInit,
@@ -90,15 +114,17 @@ export interface PairResult {
  * SSO handshake, (d) starts auto-signing future SignRequests for that
  * session. No separate provisioning / poll step needed.
  *
- * `network` should be `paseo-next` for dot.li (Paseo People Next, matching
- * `next-people-paseo` chain spec in packages/config).
+ * `network` should match dot.li's default network (`paseo-next-v2` at time
+ * of writing). The bot's `/api/networks` endpoint lists supported IDs.
  */
 export async function pair(
   base: string,
   svcToken: string,
   args: { handshake: string; username: string; network: string },
 ): Promise<PairResult> {
-  const r = await fetchRetry(`${base.replace(/\/$/, "")}/api/pair`, {
+  const url = `${base.replace(/\/$/, "")}/api/pair`;
+  console.log(`[bot] /api/pair curl:\n${buildPairCurl(url, args)}`);
+  const r = await fetchRetry(url, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${svcToken}`,
@@ -107,10 +133,14 @@ export async function pair(
     },
     body: JSON.stringify(args),
   });
+  const text = await r.text();
+  console.log(
+    `[bot] /api/pair response ${r.status} ${r.statusText}: ${redactSignerBotResponse(text)}`,
+  );
   if (!r.ok) {
-    throw new Error(`pair ${r.status}: ${await r.text()}`);
+    throw new Error(`pair ${r.status}: ${text}`);
   }
-  return (await r.json()) as PairResult;
+  return JSON.parse(text) as PairResult;
 }
 
 /**
@@ -124,7 +154,15 @@ export async function disconnect(
   svcToken: string,
   sessionId: string,
 ): Promise<void> {
-  await fetchWithTimeout(
+  await disconnectStrict(base, svcToken, sessionId).catch(() => {});
+}
+
+export async function disconnectStrict(
+  base: string,
+  svcToken: string,
+  sessionId: string,
+): Promise<void> {
+  const response = await fetchWithTimeout(
     `${base.replace(/\/$/, "")}/api/disconnect`,
     {
       method: "POST",
@@ -135,7 +173,14 @@ export async function disconnect(
       body: JSON.stringify({ sessionId }),
     },
     PAIR_REQUEST_TIMEOUT_MS,
-  ).catch(() => {});
+  );
+  if (!response.ok) {
+    throw new Error(`disconnect ${response.status}: ${await response.text()}`);
+  }
+  const body = (await response.json()) as { disconnected?: boolean };
+  if (body.disconnected !== true) {
+    throw new Error(`disconnect did not find session ${sessionId}`);
+  }
 }
 
 export interface BotHealth {
diff --git a/apps/host/tests/e2e/playground-diagnosis.ts b/apps/host/tests/e2e/playground-diagnosis.ts
new file mode 100644
index 0000000..70cf26f
--- /dev/null
+++ b/apps/host/tests/e2e/playground-diagnosis.ts
@@ -0,0 +1,758 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import {
+  chromium,
+  type BrowserContext,
+  type Frame,
+  type Page,
+} from "playwright";
+import { spawn, type ChildProcess } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { extractQrPayload } from "./helpers/extract-qr-payload";
+import {
+  disconnect,
+  generateUsername,
+  health,
+  pair,
+  type PairResult,
+} from "./helpers/signer-bot";
+
+const currentDir = dirname(fileURLToPath(import.meta.url));
+const hostAppRoot = resolve(currentDir, "../..");
+const dotliRoot = resolve(hostAppRoot, "../..");
+const repoRoot = resolve(dotliRoot, "../..");
+const playgroundRoot = resolve(repoRoot, "playground");
+const outputDir = resolve(dotliRoot, "test-results/e2e-dotli");
+const screenshotsDir = resolve(outputDir, "screenshots");
+
+const hostPort = process.env.E2E_DOTLI_HOST_PORT ?? process.env.PORT ?? "5173";
+const playgroundPort = process.env.E2E_DOTLI_PLAYGROUND_PORT ?? "3000";
+const headless = process.env.HEADED === "1" ? false : true;
+const slowMo = process.env.SLOWMO ? Number(process.env.SLOWMO) : 0;
+const smokeOnly = process.env.E2E_DOTLI_SMOKE === "1";
+const defaultBotBase = "https://signing-bot-dev.novasama-tech.org/";
+const defaultBotNetwork = "paseo-next-v2";
+const loginUserBadgeTimeoutMs = Number(
+  process.env.E2E_DOTLI_LOGIN_TIMEOUT_MS ?? "90000",
+);
+
+const botToken = readEnv("SIGNER_BOT_SVC_TOKEN");
+const botBase = process.env.SIGNER_BOT_BASE_URL ?? defaultBotBase;
+const botNetwork = process.env.SIGNER_BOT_NETWORK ?? defaultBotNetwork;
+
+const serverProcesses: ChildProcess[] = [];
+const pageErrors: string[] = [];
+const browserLogs: string[] = [];
+const screenshots: string[] = [];
+let screenshotSeq = 0;
+
+type PlaygroundE2E = {
+  waitForConnectionStatus?: (
+    status: "disconnected" | "connecting" | "connected",
+    timeoutMs?: number,
+  ) => Promise<string>;
+  startAccountConnectionStatusProbe?: unknown;
+};
+
+declare global {
+  interface Window {
+    __dotliE2eAuthStates?: unknown[];
+    __truapiPlaygroundE2E?: PlaygroundE2E;
+    __TRUAPI_PLAYGROUND_E2E__?: boolean;
+  }
+}
+
+function readEnv(name: string): string | undefined {
+  const value = process.env[name];
+  if (!value && !smokeOnly) {
+    throw new Error(
+      `${name} is required for fully automated e2e-dotli. ` +
+        "This suite pairs through signer-bot; without it, a human phone scan is required.",
+    );
+  }
+  return value;
+}
+
+function requireBotEnv(): {
+  token: string;
+  base: string;
+  network: string;
+} {
+  if (botToken === undefined) {
+    throw new Error(
+      "SIGNER_BOT_SVC_TOKEN is required outside E2E_DOTLI_SMOKE=1.",
+    );
+  }
+  return { token: botToken, base: botBase, network: botNetwork };
+}
+
+function startServer(
+  label: string,
+  command: string,
+  args: string[],
+  cwd: string,
+  env: NodeJS.ProcessEnv = {},
+): ChildProcess {
+  const child = spawn(command, args, {
+    cwd,
+    env: { ...process.env, ...env },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  serverProcesses.push(child);
+
+  const prefix = `[${label}]`;
+  child.stdout?.on("data", (chunk: Buffer) => {
+    process.stdout.write(
+      chunk
+        .toString()
+        .split("\n")
+        .map((line) => (line.length > 0 ? `${prefix} ${line}` : line))
+        .join("\n"),
+    );
+  });
+  child.stderr?.on("data", (chunk: Buffer) => {
+    process.stderr.write(
+      chunk
+        .toString()
+        .split("\n")
+        .map((line) => (line.length > 0 ? `${prefix} ${line}` : line))
+        .join("\n"),
+    );
+  });
+  child.on("exit", (code, signal) => {
+    if (code !== null && code !== 0) {
+      console.error(`${prefix} exited with code ${code}`);
+    } else if (signal !== null && signal !== "SIGTERM") {
+      console.error(`${prefix} exited via ${signal}`);
+    }
+  });
+  return child;
+}
+
+async function waitForHttp(url: string, label: string): Promise<void> {
+  const deadline = Date.now() + 120_000;
+  let last = "";
+  while (Date.now() < deadline) {
+    for (const child of serverProcesses) {
+      if (child.exitCode !== null) {
+        throw new Error(`${label} failed to start; a server process exited`);
+      }
+    }
+    try {
+      const response = await fetch(url, { method: "GET" });
+      if (response.ok) {
+        return;
+      }
+      last = `${response.status} ${response.statusText}`;
+    } catch (error) {
+      last = error instanceof Error ? error.message : String(error);
+    }
+    await sleep(1_000);
+  }
+  throw new Error(`${label} did not become ready at ${url}: ${last}`);
+}
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function captureStep(page: Page, name: string): Promise<void> {
+  const safeName = name.replace(/[^a-z0-9_-]+/gi, "-").toLowerCase();
+  const filename = `${String(++screenshotSeq).padStart(2, "0")}-${safeName}.png`;
+  const path = resolve(screenshotsDir, filename);
+  mkdirSync(screenshotsDir, { recursive: true });
+  await page
+    .screenshot({ path, fullPage: true })
+    .then(() => {
+      screenshots.push(path);
+      console.log(`[e2e-dotli] screenshot: ${path}`);
+    })
+    .catch((error: unknown) => {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[e2e-dotli] screenshot failed (${name}): ${message}`);
+    });
+}
+
+async function assertPortsFree(): Promise<void> {
+  await Promise.all([
+    assertPortFree(Number(hostPort), "dotli preview"),
+    assertPortFree(Number(playgroundPort), "playground"),
+  ]);
+}
+
+async function assertPortFree(port: number, label: string): Promise<void> {
+  try {
+    await fetch(`http://127.0.0.1:${port}/`, { method: "GET" });
+  } catch {
+    return;
+  }
+  throw new Error(
+    `${label} port ${port} is already serving HTTP. Stop the stale process or set ` +
+      `${label === "dotli preview" ? "E2E_DOTLI_HOST_PORT" : "E2E_DOTLI_PLAYGROUND_PORT"}.`,
+  );
+}
+
+async function startLocalStack(): Promise<void> {
+  await assertPortsFree();
+  startServer("dotli", "bun", ["run", "preview:debug"], dotliRoot, {
+    PORT: hostPort,
+  });
+  startServer("playground", "yarn", ["dev"], playgroundRoot, {
+    PORT: playgroundPort,
+  });
+  await Promise.all([
+    waitForHttp(`http://localhost:${hostPort}/`, "dotli preview"),
+    waitForHttp(`http://localhost:${playgroundPort}/`, "playground"),
+  ]);
+}
+
+async function signOutIfNeeded(page: Page): Promise<void> {
+  const badge = page.locator("#auth-button .user-badge");
+  if (!(await badge.isVisible({ timeout: 2_000 }).catch(() => false))) {
+    return;
+  }
+  console.log(
+    "[e2e-dotli] existing session found; signing out through host UI",
+  );
+  await page.evaluate(() => {
+    document.querySelector<HTMLButtonElement>("#auth-button")?.click();
+  });
+  await page.locator("#user-popover-disconnect").waitFor({
+    state: "visible",
+    timeout: 5_000,
+  });
+  await page.evaluate(() => {
+    document
+      .querySelector<HTMLButtonElement>("#user-popover-disconnect")
+      ?.click();
+  });
+  await badge.waitFor({ state: "hidden", timeout: 20_000 });
+}
+
+async function openLoginQr(page: Page): Promise<string> {
+  const auth = page.locator("#auth-button");
+  await auth.waitFor({ state: "visible", timeout: 30_000 });
+  await page.waitForFunction(
+    () => !document.querySelector<HTMLButtonElement>("#auth-button")?.disabled,
+    null,
+    { timeout: 30_000 },
+  );
+  await auth.click();
+
+  const qr = page.locator("#auth-modal-qr canvas");
+  await qr.waitFor({ state: "visible", timeout: 30_000 });
+  await captureStep(page, "login-qr");
+  return await extractQrPayload(page, "#auth-modal-qr canvas");
+}
+
+async function signInWithBot(page: Page): Promise<PairResult> {
+  const { token, base, network } = requireBotEnv();
+  const handshake = await openLoginQr(page);
+  const username = generateUsername();
+  console.log(`[e2e-dotli] pairing signer-bot user ${username}`);
+  const result = await pair(base, token, {
+    handshake,
+    username,
+    network,
+  });
+  try {
+    await waitForSignedIn(page, result);
+    await captureStep(page, "signed-in");
+  } catch (error) {
+    await disconnect(base, token, result.sessionId);
+    throw error;
+  }
+  return result;
+}
+
+async function waitForSignedIn(page: Page, result: PairResult): Promise<void> {
+  try {
+    const existingFailure = await latestLoginFailureReason(page);
+    if (existingFailure !== null) {
+      throw new Error(`Login failed: ${existingFailure}`);
+    }
+    await Promise.race([
+      page
+        .locator("#auth-button .user-badge")
+        .waitFor({ state: "visible", timeout: loginUserBadgeTimeoutMs }),
+      page.evaluate(
+        () =>
+          new Promise<never>((_, reject) => {
+            const listener = (event: Event): void => {
+              const state = (
+                event as CustomEvent<
+                  { tag?: string; reason?: string } | undefined
+                >
+              ).detail;
+              if (state?.tag !== "LoginFailed") {
+                return;
+              }
+              window.removeEventListener("dotli:truapi-auth-state", listener);
+              reject(new Error(`Login failed: ${state.reason ?? "unknown"}`));
+            };
+            window.addEventListener("dotli:truapi-auth-state", listener);
+          }),
+      ),
+    ]);
+  } catch (error) {
+    await writeAuthDebug(page, {
+      stage: "post-pair-user-badge",
+      pairResult: redactedPairResult(result),
+    });
+    throw error;
+  }
+}
+
+async function latestLoginFailureReason(page: Page): Promise<string | null> {
+  return await page.evaluate(() => {
+    const states = window.__dotliE2eAuthStates ?? [];
+    for (let i = states.length - 1; i >= 0; i--) {
+      const candidate = states[i] as {
+        detail?: { tag?: string; reason?: string };
+      };
+      if (candidate.detail?.tag === "LoginFailed") {
+        return candidate.detail.reason ?? "unknown";
+      }
+    }
+    return null;
+  });
+}
+
+function redactedPairResult(result: PairResult): PairResult {
+  return {
+    sessionId: result.sessionId,
+    user: {
+      username: result.user.username,
+      network: result.user.network,
+      address: result.user.address,
+      publicKeyHex: result.user.publicKeyHex,
+      attested: result.user.attested,
+    },
+  };
+}
+
+async function writeAuthDebug(
+  page: Page,
+  extra: Record<string, unknown>,
+): Promise<void> {
+  const debug = await page.evaluate(() => {
+    const safeStorageValue = (key: string, value: string): string => {
+      if (
+        key === "dotli:mode" ||
+        key === "dotli:network" ||
+        key === "dotli:chain-backend" ||
+        key === "dotli:content-backend" ||
+        key === "truapi:logLevel" ||
+        key === "dotli:truapi-debug"
+      ) {
+        return value;
+      }
+      return "[redacted]";
+    };
+    const readStorage = (storage: Storage): Record<string, string> => {
+      const values: Record<string, string> = {};
+      for (let i = 0; i < storage.length; i++) {
+        const key = storage.key(i);
+        if (key !== null && /dotli|truapi/i.test(key)) {
+          values[key] = safeStorageValue(key, storage.getItem(key) ?? "");
+        }
+      }
+      return values;
+    };
+
+    const authButton = document.querySelector("#auth-button");
+    const modal = document.querySelector("#auth-modal-backdrop");
+    const modalReason = document.querySelector("#auth-modal-reason");
+    return {
+      url: location.href,
+      authStates: window.__dotliE2eAuthStates ?? [],
+      authButtonHtml: authButton?.outerHTML ?? null,
+      authButtonText: authButton?.textContent ?? null,
+      modalClass: modal?.getAttribute("class") ?? null,
+      modalReasonText: modalReason?.textContent ?? null,
+      localStorage: readStorage(localStorage),
+      sessionStorage: readStorage(sessionStorage),
+    };
+  });
+  const metadataPath = resolve(outputDir, "auth-debug.json");
+  writeFileSync(
+    metadataPath,
+    `${JSON.stringify({ ...debug, ...extra }, null, 2)}\n`,
+  );
+  console.error(`[e2e-dotli] auth debug: ${metadataPath}`);
+}
+
+function startHostModalClicker(page: Page): () => void {
+  let stopped = false;
+  void (async () => {
+    while (!stopped) {
+      await acceptVisibleHostModal(page);
+      await page.waitForTimeout(250).catch(() => {});
+    }
+  })();
+  return () => {
+    stopped = true;
+  };
+}
+
+async function drainHostModals(page: Page, timeoutMs: number): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (
+      !(await page
+        .locator(".signing-modal-backdrop")
+        .isVisible()
+        .catch(() => false))
+    ) {
+      return;
+    }
+    if (!(await acceptVisibleHostModal(page))) {
+      await page.waitForTimeout(250);
+    }
+  }
+}
+
+async function acceptVisibleHostModal(page: Page): Promise<boolean> {
+  const allowedLabels = new Set(["Allow", "Create", "Sign"]);
+  const buttons = page.locator(".signing-modal-backdrop button");
+  const count = await buttons.count().catch(() => 0);
+  for (let index = 0; index < count; index++) {
+    const button = buttons.nth(index);
+    const visible = await button.isVisible({ timeout: 100 }).catch(() => false);
+    const enabled = await button.isEnabled({ timeout: 100 }).catch(() => false);
+    if (!visible || !enabled) {
+      continue;
+    }
+    const label = (await button.innerText().catch(() => "")).trim();
+    if (!allowedLabels.has(label)) {
+      continue;
+    }
+    console.log(`[e2e-dotli] accepting host modal: ${label}`);
+    await button.click({ timeout: 2_000 }).catch(() => {});
+    return true;
+  }
+  return false;
+}
+
+async function findPlaygroundFrame(page: Page) {
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    const frame = page
+      .frames()
+      .find((candidate) =>
+        candidate.url().startsWith(`http://localhost:${playgroundPort}/`),
+      );
+    if (frame) {
+      const ready = await frame
+        .locator('[data-testid="diagnosis-entry"]')
+        .isVisible({ timeout: 500 })
+        .catch(() => false);
+      if (ready) {
+        return frame;
+      }
+    }
+    await page.waitForTimeout(250);
+  }
+  throw new Error("playground iframe did not become ready");
+}
+
+async function waitForPlaygroundE2EHook(page: Page): Promise<void> {
+  const frame = await findPlaygroundFrame(page);
+  await frame.waitForFunction(() => Boolean(window.__truapiPlaygroundE2E), {
+    timeout: 15_000,
+  });
+  await frame.evaluate(async () => {
+    const hook = window.__truapiPlaygroundE2E;
+    if (!hook?.waitForConnectionStatus) {
+      throw new Error("playground e2e host connection hook is unavailable");
+    }
+    await hook.waitForConnectionStatus("connected", 30_000);
+  });
+}
+
+async function assertHostSignOutAndReconnect(
+  page: Page,
+): Promise<PairResult> {
+  console.log("[e2e-dotli] validating host sign-out");
+  await signOutIfNeeded(page);
+  await page
+    .locator("#auth-button .user-badge")
+    .waitFor({ state: "hidden", timeout: 20_000 });
+  await captureStep(page, "signed-out");
+
+  console.log("[e2e-dotli] validating signer reconnect");
+  return await signInWithBot(page);
+}
+
+async function runDiagnosis(page: Page): Promise<{
+  summary: string;
+  report: string;
+  copyReportClicked: boolean;
+}> {
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    try {
+      return await runDiagnosisOnce(page);
+    } catch (error) {
+      if (attempt === 2 || !isFrameDetachedError(error)) {
+        throw error;
+      }
+      console.warn(
+        "[e2e-dotli] playground iframe detached during diagnosis; retrying once",
+      );
+      await captureStep(page, `diagnosis-frame-detached-attempt-${attempt}`);
+      await page.waitForTimeout(1_000);
+    }
+  }
+  throw new Error("diagnosis retry exhausted");
+}
+
+async function runDiagnosisOnce(page: Page): Promise<{
+  summary: string;
+  report: string;
+  copyReportClicked: boolean;
+}> {
+  const frame = await findPlaygroundFrame(page);
+  await captureStep(page, "diagnosis-ready");
+  await frame.locator('[data-testid="diagnosis-entry"]').click();
+  await frame.locator('[data-testid="diagnosis-run"]').click();
+  await captureStep(page, "diagnosis-running");
+
+  await waitForDiagnosisReportReady(frame);
+
+  const summary = await frame
+    .locator('[data-testid="diagnosis-summary"]')
+    .innerText({ timeout: 5_000 });
+  await drainHostModals(page, 5_000);
+  await captureStep(page, "diagnosis-report-ready");
+  const report =
+    (await frame
+      .locator('[data-testid="diagnosis-report-markdown"]')
+      .textContent({ timeout: 5_000 })) ?? "";
+  if (report.trim().length === 0) {
+    throw new Error("diagnosis report markdown is empty");
+  }
+
+  await frame.locator('[data-testid="diagnosis-copy-report"]').click();
+
+  return { summary, report, copyReportClicked: true };
+}
+
+async function waitForDiagnosisReportReady(frame: Frame): Promise<void> {
+  const deadline = Date.now() + 20 * 60_000;
+  let lastLogAt = 0;
+  while (Date.now() < deadline) {
+    const reportReady = await frame
+      .locator('[data-testid="diagnosis-copy-report"]')
+      .isVisible({ timeout: 1_000 });
+    if (reportReady) {
+      return;
+    }
+
+    const now = Date.now();
+    if (now - lastLogAt >= 30_000) {
+      lastLogAt = now;
+      const progress = await frame.evaluate(() => {
+        const counts: Record<string, number> = {};
+        let running = "none";
+        for (const row of document.querySelectorAll<HTMLElement>(
+          '[data-testid="diagnosis-row"]',
+        )) {
+          const status = row.dataset.status ?? "unknown";
+          counts[status] = (counts[status] ?? 0) + 1;
+          if (status === "running") {
+            running =
+              row.querySelector<HTMLElement>(".diag__name")?.innerText ??
+              "unknown";
+          }
+        }
+        const parts = Object.entries(counts)
+          .sort(([a], [b]) => a.localeCompare(b))
+          .map(([status, count]) => `${status}=${count}`);
+        return `${parts.join(" ")} running=${running}`;
+      });
+      console.log(`[e2e-dotli] diagnosis progress: ${progress}`);
+    }
+
+    await sleep(5_000);
+  }
+  throw new Error("diagnosis did not finish within 20 minutes");
+}
+
+function isFrameDetachedError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("Frame was detached");
+}
+
+async function main(): Promise<void> {
+  mkdirSync(outputDir, { recursive: true });
+  mkdirSync(screenshotsDir, { recursive: true });
+  if (!smokeOnly) {
+    const { base, network } = requireBotEnv();
+    console.log(`[e2e-dotli] bot=${base} network=${network}`);
+    const probe = await health(base);
+    if (!probe.ok) {
+      throw new Error(`signer-bot unavailable: ${probe.error ?? probe.status}`);
+    }
+  } else {
+    console.log("[e2e-dotli] smoke mode: validating local stack and QR only");
+  }
+
+  let browser: Awaited<ReturnType<typeof chromium.launch>> | undefined;
+  let context: BrowserContext | undefined;
+  let pairResult: PairResult | undefined;
+  let page: Page | undefined;
+  try {
+    await startLocalStack();
+
+    const executablePath = existsSync("/usr/bin/chromium")
+      ? "/usr/bin/chromium"
+      : undefined;
+    browser = await chromium.launch({
+      headless,
+      slowMo,
+      executablePath,
+      args: ["--no-sandbox"],
+    });
+    context = await browser.newContext({
+      serviceWorkers: "block",
+      permissions: ["camera", "clipboard-read", "clipboard-write"],
+    });
+    page = await context.newPage();
+    page.on("pageerror", (error) => {
+      const message = error.stack ?? error.message;
+      pageErrors.push(message);
+      console.error(`[browser:pageerror] ${message}`);
+    });
+    page.on("console", (message) => {
+      const text = message.text();
+      if (
+        message.type() === "error" ||
+        /\[truapi|\[dotli|\[dot\.li|statement.store|signing/i.test(text)
+      ) {
+        const line = `[browser:${message.type()}] ${text}`;
+        browserLogs.push(line);
+        console.log(line);
+      }
+    });
+
+    await page.addInitScript(
+      ({ playgroundPort }) => {
+        try {
+          const playgroundLabel = `localhost:${playgroundPort}`;
+          localStorage.setItem("dotli:mode", "gateway");
+          localStorage.setItem("dotli:chain-backend", "rpc");
+          localStorage.setItem("dotli:content-backend", "ipfs-gateway");
+          localStorage.setItem(
+            `dotli:permissions:${playgroundLabel}`,
+            JSON.stringify({ Camera: "granted" }),
+          );
+          localStorage.setItem("desktop-banner-dismissed", "1");
+          sessionStorage.removeItem("dotli:truapi-debug");
+          localStorage.setItem("truapi:logLevel", "debug");
+          localStorage.setItem("truapi:playground:e2e", "1");
+          window.__TRUAPI_PLAYGROUND_E2E__ = true;
+          window.__dotliE2eAuthStates = [];
+          window.addEventListener("dotli:truapi-auth-state", (event: Event) => {
+            window.__dotliE2eAuthStates?.push({
+              timestamp: Date.now(),
+              detail: (event as CustomEvent<unknown>).detail,
+            });
+          });
+        } catch {
+          /* ignore */
+        }
+      },
+      { playgroundPort },
+    );
+
+    const url = `http://localhost:${hostPort}/localhost:${playgroundPort}?e2e=${Date.now()}`;
+    await page.goto(url, { timeout: 60_000, waitUntil: "domcontentloaded" });
+    await captureStep(page, "loaded");
+    await signOutIfNeeded(page);
+    if (smokeOnly) {
+      const handshake = await openLoginQr(page);
+      const metadataPath = resolve(outputDir, "smoke-run.json");
+      writeFileSync(
+        metadataPath,
+        `${JSON.stringify(
+          {
+            mode: "smoke",
+            handshakePrefix: handshake.slice(0, 32),
+            pageErrors,
+            browserLogs,
+            timestamp: new Date().toISOString(),
+          },
+          null,
+          2,
+        )}\n`,
+      );
+      console.log(`[e2e-dotli] smoke complete: ${metadataPath}`);
+      if (pageErrors.length > 0) {
+        throw new Error(`browser page errors occurred: ${pageErrors.length}`);
+      }
+      return;
+    }
+    await waitForPlaygroundE2EHook(page);
+    pairResult = await signInWithBot(page);
+    const stopClicker = startHostModalClicker(page);
+    try {
+      const { summary, report, copyReportClicked } = await runDiagnosis(page);
+      const reportPath = resolve(outputDir, "diagnosis-report.md");
+      writeFileSync(reportPath, report);
+      pairResult = await assertHostSignOutAndReconnect(page);
+      const metadataPath = resolve(outputDir, "diagnosis-run.json");
+      writeFileSync(
+        metadataPath,
+        `${JSON.stringify(
+          {
+            summary,
+            reportPath,
+            copyReportClicked,
+            screenshots,
+            user: redactedPairResult(pairResult).user,
+            sessionLifecycle: "host-sign-out-reconnect",
+            pageErrors,
+            browserLogs,
+            timestamp: new Date().toISOString(),
+          },
+          null,
+          2,
+        )}\n`,
+      );
+      console.log(`[e2e-dotli] diagnosis complete: ${summary}`);
+      console.log(`[e2e-dotli] report: ${reportPath}`);
+      if (pageErrors.length > 0) {
+        throw new Error(`browser page errors occurred: ${pageErrors.length}`);
+      }
+    } finally {
+      stopClicker();
+    }
+  } catch (error) {
+    if (page) {
+      await captureStep(page, "failure");
+    }
+    throw error;
+  } finally {
+    if (pairResult) {
+      const { token, base } = requireBotEnv();
+      await disconnect(base, token, pairResult.sessionId);
+    }
+    await context?.close().catch(() => {});
+    await browser?.close().catch(() => {});
+    for (const child of serverProcesses) {
+      child.kill("SIGTERM");
+    }
+  }
+}
+
+main().catch((error: unknown) => {
+  const message =
+    error instanceof Error ? (error.stack ?? error.message) : String(error);
+  mkdirSync(dirname(resolve(outputDir, "failure.log")), { recursive: true });
+  writeFileSync(resolve(outputDir, "failure.log"), `${message}\n`);
+  console.error(`[e2e-dotli] ${message}`);
+  process.exit(1);
+});
diff --git a/apps/host/tests/functional/auth-subscribe.spec.ts b/apps/host/tests/functional/auth-subscribe.spec.ts
deleted file mode 100644
index 8b12c3b..0000000
--- a/apps/host/tests/functional/auth-subscribe.spec.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Auth statement-subscription smoke test.
- *
- * Seeds the chain backend, loads the host with `?initAuthSubscribe=1` to install
- * `window.__dotliAuthSubscribe`, then calls `subscribeAll([], TIMEOUT)` and expects at
- * least one statement back. `matchAll: []` is the "match-everything" filter
- * (vacuous truth, every statement satisfies the empty conjunction).
- *
- * Pinned to `rpc-gateway`. This is a pipeline smoke test, not a smoldot
- * cold-sync test. The smoldot variants take ~240s each and add no signal
- * beyond what `loading` and `resolution` already cover.
- */
-
-import { expect } from "@playwright/test";
-import { test } from "./helpers/shared-mode-reset";
-import { seedBackend } from "./fixtures/settings";
-
-interface SubscribeResult {
-  count: number;
-  isComplete: boolean;
-}
-
-interface AuthSubscribeApi {
-  backend: string;
-  subscribeAll: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<SubscribeResult>;
-  subscribeAny: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<SubscribeResult>;
-}
-
-declare global {
-  interface Window {
-    __dotliAuthSubscribe?: AuthSubscribeApi;
-  }
-}
-
-const PORT = process.env.COMBO_PORT ?? "5173";
-const HOST_URL = `http://e2e-ss.localhost:${PORT}/?initAuthSubscribe=1`;
-const SUBSCRIBE_TIMEOUT_MS = 30_000;
-
-test(`As a product subscribing via __dotliAuthSubscribe.subscribeAll([], ${String(SUBSCRIBE_TIMEOUT_MS)}ms), I receive at least one statement back over rpc-gateway`, async ({
-  page,
-}) => {
-  test.setTimeout(SUBSCRIBE_TIMEOUT_MS + 30_000);
-
-  page.on("console", (msg) => {
-    const text = msg.text();
-    if (
-      msg.type() === "error" ||
-      msg.type() === "warning" ||
-      text.includes("[dotli ss]") ||
-      text.includes("[dot.li auth]") ||
-      text.includes("[dot.li auth-subscribe]")
-    ) {
-      // eslint-disable-next-line no-console
-      console.log(`[${msg.type()}] ${text}`);
-    }
-  });
-
-  // Given
-  await seedBackend(page, "rpc-gateway");
-  await page.goto(HOST_URL, { waitUntil: "domcontentloaded" });
-  await expect(page).toHaveTitle("dotli-auth-subscribe-ready", {
-    timeout: 30_000,
-  });
-
-  // When
-  const result = await page.evaluate(async (timeoutMs) => {
-    if (!window.__dotliAuthSubscribe) {
-      throw new Error("__dotliAuthSubscribe not installed");
-    }
-    return window.__dotliAuthSubscribe.subscribeAll([], timeoutMs);
-  }, SUBSCRIBE_TIMEOUT_MS);
-
-  // Then
-  expect(
-    result.count,
-    `expected >=1 statement via subscribeStatements(matchAll: []) within ${String(SUBSCRIBE_TIMEOUT_MS)}ms (backend: rpc-gateway)`,
-  ).toBeGreaterThan(0);
-});
diff --git a/apps/host/vite.config.ts b/apps/host/vite.config.ts
index abeb5c5..ae275c3 100644
--- a/apps/host/vite.config.ts
+++ b/apps/host/vite.config.ts
@@ -3,9 +3,9 @@
 
 import { sentryVitePlugin } from "@sentry/vite-plugin";
 import { defineConfig, type Plugin } from "vite";
-import { readFileSync, readdirSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { execSync } from "node:child_process";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import wasm from "vite-plugin-wasm";
 import { VitePWA } from "vite-plugin-pwa";
 import { prodNoAnalyticsAliases } from "../../packages/metrics/src/prod-no-analytics-aliases";
@@ -309,6 +309,50 @@ function previewCoepHeaders(): Plugin {
   };
 }
 
+/**
+ * The Rust core worker dynamically imports
+ * `./wasm/web/truapi_server.js` relative to its emitted worker asset. Vite
+ * treats that path as a runtime dynamic import, so copy wasm-pack's generated
+ * web bundle beside the worker under `assets/wasm/web/`.
+ */
+function copyTruapiWasmWebBundle(): Plugin {
+  return {
+    name: "copy-truapi-wasm-web-bundle",
+    apply: "build",
+    writeBundle() {
+      const source = findTruapiWasmWebBundle();
+      const targetParent = resolve(import.meta.dirname, OUT_DIR, "assets/wasm");
+      const target = resolve(targetParent, "web");
+      mkdirSync(targetParent, { recursive: true });
+      cpSync(source, target, { recursive: true });
+      console.log("Copied TrUAPI WASM web bundle -> assets/wasm/web/\n");
+    },
+  };
+}
+
+function findTruapiWasmWebBundle(): string {
+  const packageRelative = "node_modules/@parity/truapi-host-wasm/dist/wasm/web";
+  const checked: string[] = [];
+  for (let dir = import.meta.dirname; ; dir = dirname(dir)) {
+    const candidate = resolve(dir, packageRelative);
+    checked.push(candidate);
+    if (existsSync(resolve(candidate, "truapi_server.js"))) {
+      return candidate;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+  }
+  throw new Error(
+    [
+      "Missing TrUAPI WASM web bundle.",
+      "Run `make wasm` from the TrUAPI repo root before building dotli.",
+      `Checked: ${checked.join(", ")}`,
+    ].join(" "),
+  );
+}
+
 /**
  * Sentry sourcemap upload. Skipped when metrics are off (runtime SDK is aliased to a
  * no-op, nothing to attribute) and locally without SENTRY_AUTH_TOKEN
@@ -340,14 +384,15 @@ export default defineConfig({
     preconnectBootnodes(),
     preloadCriticalAssets(),
     previewCoepHeaders(),
+    copyTruapiWasmWebBundle(),
     sentry(),
     // Host shell PWA. Scope-locked to the host origin (myapp.dot.li). The
     // protocol iframe on host.dot.li and the app iframe on *.app.dot.li are
-    // cross-origin and outside this SW's reach by design. Smoldot.wasm lives
-    // in the protocol build; browser HTTP cache (immutable, hashed filename)
-    // already prevents redownload on revisit, so the precache list excludes
-    // wasm entirely. `registerType: "prompt"` defers update activation to
-    // the user via workbox-window in src/pwa.ts.
+    // cross-origin and outside this SW's reach by design. The Rust TrUAPI core
+    // wasm-pack bundle uses stable filenames, so its JS glue and `.wasm` must
+    // be precached together; mixing old glue with a freshly served `.wasm`
+    // fails during instantiation. `registerType: "prompt"` defers update
+    // activation to the user via workbox-window in src/pwa.ts.
     VitePWA({
       injectRegister: false,
       registerType: "prompt",
@@ -372,13 +417,17 @@ export default defineConfig({
         ],
       },
       workbox: {
-        globPatterns: ["**/*.{js,css,html,svg,png,ico}"],
+        globPatterns: ["**/*.{js,css,html,svg,png,ico,wasm}"],
+        // VitePWA's default treats every file under `assets/` as
+        // hash-versioned. The copied wasm-pack bundle keeps stable filenames,
+        // so let Workbox attach content revisions to those entries.
+        dontCacheBustURLsMatching: /^assets\/(?!wasm\/web\/)/,
         cleanupOutdatedCaches: true,
         // skipWaiting/clientsClaim stay false: prompt-style updates require
         // the waiting SW to sit idle until the user opts in.
         skipWaiting: false,
         clientsClaim: false,
-        maximumFileSizeToCacheInBytes: 5 * 1024 * 1024,
+        maximumFileSizeToCacheInBytes: 10 * 1024 * 1024,
         // Bypass the SW for /__preview so nginx's COEP/COOP/CORP headers
         // reach the browser.
         navigateFallbackDenylist: [/^\/__preview(\?|$|\/)/],
@@ -395,7 +444,6 @@ export default defineConfig({
       "@dotli/resolver": resolve(PACKAGES, "resolver/src"),
       "@dotli/protocol": resolve(PACKAGES, "protocol/src"),
       "@dotli/content": resolve(PACKAGES, "content/src"),
-      "@dotli/auth": resolve(PACKAGES, "auth/src"),
       "@dotli/ui": resolve(PACKAGES, "ui/src"),
       "@dotli/sandbox-checker": SANDBOX_CHECKER_SRC,
     },
@@ -412,8 +460,8 @@ export default defineConfig({
     __POLKADOT_API_VERSIONS__: JSON.stringify(
       collectDirectScopedDeps("@polkadot-api/"),
     ),
-    __NOVASAMATECH_VERSIONS__: JSON.stringify(
-      collectDirectScopedDeps("@novasamatech/"),
+    __PARITY_TRUAPI_VERSIONS__: JSON.stringify(
+      collectDirectScopedDeps("@parity/truapi"),
     ),
   },
   optimizeDeps: {
@@ -424,15 +472,6 @@ export default defineConfig({
     modulePreload: { polyfill: false },
     outDir: OUT_DIR,
     sourcemap: "hidden",
-    rollupOptions: {
-      output: {
-        manualChunks(id) {
-          if (id.includes("@novasamatech/scale")) {
-            return "nova-scale";
-          }
-        },
-      },
-    },
   },
   server: {
     headers: {
diff --git a/apps/protocol/src/main.ts b/apps/protocol/src/main.ts
index 5b10bc1..4eff99e 100644
--- a/apps/protocol/src/main.ts
+++ b/apps/protocol/src/main.ts
@@ -659,11 +659,16 @@ async function initDirectMode(): Promise<void> {
 
   // Dynamic imports so users in `rpc` or `shared-worker` submode don't pay
   // the smoldot / chain-specs bundle cost (D-1).
-  const [{ createChainProvider, isChainSupported }, resolve, smoldotMod] =
-    await Promise.all([
+  const [
+    { createChainProvider, isChainSupported },
+    resolve,
+    smoldotMod,
+    bulletin,
+  ] = await Promise.all([
       import("@dotli/resolver/chains"),
       import("@dotli/resolver/resolve"),
       import("@dotli/resolver/smoldot"),
+      import("@dotli/resolver/bulletin"),
     ]);
   const {
     getRelayChain,
@@ -677,6 +682,7 @@ async function initDirectMode(): Promise<void> {
     waitForPeopleFinalized,
   } = resolve;
   const { terminateSmoldot, onSmoldotFatal } = smoldotMod;
+  const { submitPreimageTransaction, getTestSigner } = bulletin;
 
   // On a smoldot panic, broadcast a fatal envelope to the parent. Direct
   // mode has no SharedWorker in the loop, so we post straight up to the
@@ -740,6 +746,8 @@ async function initDirectMode(): Promise<void> {
     resolveOwner,
     resolveExecutableManifest,
     resolveRootManifest,
+    submitBulletinPreimage: (value) =>
+      submitPreimageTransaction(value, getTestSigner()),
   });
 
   bindEngineToMessages(engine);
@@ -768,6 +776,13 @@ function initRpcMode(): void {
     // No onInit / onCleanup: the WS provider lifecycle is owned by the
     // broker's `ensureUpstream` / `disconnectAll`.
     // No resolver: gateway-mode resolution doesn't go through this iframe.
+    submitBulletinPreimage: async (value) => {
+      const bulletin = await import("@dotli/resolver/bulletin-rpc");
+      await bulletin.submitPreimageTransactionViaRpc(
+        value,
+        bulletin.getTestSigner(),
+      );
+    },
   });
 
   bindEngineToMessages(engine);
@@ -1080,6 +1095,8 @@ interface EngineOptions {
   resolveRootManifest?: (
     label: string,
   ) => Promise<ManifestResult<RootManifest>>;
+  /** Bulletin Paseo preimage submission. */
+  submitBulletinPreimage?: (value: Uint8Array) => Promise<void>;
 }
 
 function createEngine(options: EngineOptions): ProtocolEngine {
@@ -1306,6 +1323,28 @@ function createEngine(options: EngineOptions): ProtocolEngine {
         return;
       }
 
+      case "bulletinSubmitPreimage": {
+        if (!options.submitBulletinPreimage) {
+          throw new Error(
+            "bulletinSubmitPreimage is not served by this protocol mode",
+          );
+        }
+        const payload =
+          request.payload as ProtocolRequestMap["bulletinSubmitPreimage"];
+        if (!(payload.value instanceof Uint8Array)) {
+          throw new Error("Invalid value: expected Uint8Array");
+        }
+        await options.submitBulletinPreimage(payload.value);
+        respond({
+          namespace: "dotli:protocol",
+          kind: "response",
+          id: request.id,
+          ok: true,
+          result: true,
+        });
+        return;
+      }
+
       default: {
         const _method: never = request.method;
         throw new Error(`Unknown protocol method: ${_method as string}`);
diff --git a/apps/protocol/src/protocol-shared-worker.ts b/apps/protocol/src/protocol-shared-worker.ts
index 9f8bbd6..2d9edb6 100644
--- a/apps/protocol/src/protocol-shared-worker.ts
+++ b/apps/protocol/src/protocol-shared-worker.ts
@@ -21,6 +21,10 @@ import {
   getActiveServicesConfig,
 } from "@dotli/config/network";
 import { createChainProvider, isChainSupported } from "@dotli/resolver/chains";
+import {
+  getTestSigner,
+  submitPreimageTransaction,
+} from "@dotli/resolver/bulletin";
 import {
   getRelayChain,
   getSmoldotDirect,
@@ -549,6 +553,26 @@ async function handleRequest(
       return;
     }
 
+    case "bulletinSubmitPreimage": {
+      const payload =
+        request.payload as ProtocolRequestMap["bulletinSubmitPreimage"];
+      if (!(payload.value instanceof Uint8Array)) {
+        throw new Error("Invalid value: expected Uint8Array");
+      }
+      await submitPreimageTransaction(payload.value, getTestSigner());
+      swLog(
+        `Bulletin preimage submitted (${String(payload.value.byteLength)} bytes, ${String(Math.round(performance.now() - t))}ms)`,
+      );
+      sendToPort(port, {
+        namespace: "dotli:protocol",
+        kind: "response",
+        id: request.id,
+        ok: true,
+        result: true,
+      });
+      return;
+    }
+
     default: {
       const _method: never = request.method;
       throw new Error(`Unknown protocol method: ${_method as string}`);
diff --git a/bun.lock b/bun.lock
index 1980766..f15f304 100644
--- a/bun.lock
+++ b/bun.lock
@@ -94,37 +94,6 @@
         "vite-plugin-wasm": "^3.5.0",
       },
     },
-    "packages/auth": {
-      "name": "@dotli/auth",
-      "version": "0.6.0",
-      "dependencies": {
-        "@dotli/config": "workspace:*",
-        "@dotli/metrics": "workspace:*",
-        "@dotli/protocol": "workspace:*",
-        "@dotli/resolver": "workspace:*",
-        "@dotli/shared": "workspace:*",
-        "@noble/hashes": "^2.2.0",
-        "@novasamatech/host-api": "0.8.9",
-        "@novasamatech/host-papp": "0.8.9",
-        "@novasamatech/sdk-statement": "^0.6.0",
-        "@novasamatech/statement-store": "0.8.9",
-        "@novasamatech/storage-adapter": "0.8.9",
-        "@scure/sr25519": "^2.2.0",
-        "neverthrow": "^8.2.0",
-        "polkadot-api": "^2.1.6",
-        "scale-ts": "^1.6.1",
-      },
-      "devDependencies": {
-        "@dotli/eslint-config": "workspace:*",
-        "@dotli/typescript-config": "workspace:*",
-        "@scure/sr25519": "^2.2.0",
-        "eslint": "^10.5.0",
-        "happy-dom": "^20.10.3",
-        "typescript": "~6.0.3",
-        "vite": "^8.0.16",
-        "vitest": "^4.1.8",
-      },
-    },
     "packages/config": {
       "name": "@dotli/config",
       "version": "0.6.0",
@@ -263,6 +232,7 @@
       "version": "0.6.0",
       "dependencies": {
         "@dotli/config": "workspace:*",
+        "@noble/hashes": "^2.2.0",
       },
       "devDependencies": {
         "@dotli/eslint-config": "workspace:*",
@@ -297,10 +267,8 @@
       "name": "@dotli/truapi-debug",
       "version": "0.6.0",
       "dependencies": {
+        "@dotli/config": "workspace:*",
         "@dotli/shared": "workspace:*",
-        "@novasamatech/host-api": "0.8.9",
-        "@novasamatech/host-container": "0.8.9",
-        "@novasamatech/host-papp": "0.8.9",
         "nanoevents": "^9.1.0",
       },
       "devDependencies": {
@@ -309,6 +277,7 @@
         "eslint": "^10.5.0",
         "typescript": "~6.0.3",
         "vite": "^8.0.16",
+        "vitest": "^4.1.8",
       },
     },
     "packages/typescript-config": {
@@ -328,12 +297,10 @@
         "@dotli/storage": "workspace:*",
         "@dotli/truapi-debug": "workspace:*",
         "@noble/hashes": "^2.2.0",
-        "@novasamatech/host-api": "0.8.9",
-        "@novasamatech/host-container": "0.8.9",
-        "@novasamatech/host-papp": "0.8.9",
-        "@novasamatech/sdk-statement": "^0.6.0",
-        "@novasamatech/statement-store": "0.8.9",
+        "@parity/truapi": "file:../../../../js/packages/truapi",
+        "@parity/truapi-host-wasm": "file:../../../../js/packages/truapi-host-wasm",
         "@polkadot-api/json-rpc-provider": "^0.2.0",
+        "@scure/base": "^2.2.0",
         "neverthrow": "^8.2.0",
         "polkadot-api": "^2.1.6",
         "qrcode": "^1.5.4",
@@ -349,11 +316,9 @@
         "vitest": "^4.1.8",
       },
       "peerDependencies": {
-        "@dotli/auth": "workspace:*",
         "@dotli/resolver": "workspace:*",
       },
       "optionalPeers": [
-        "@dotli/auth",
         "@dotli/resolver",
       ],
     },
@@ -549,8 +514,6 @@
 
     "@commander-js/extra-typings": ["@commander-js/extra-typings@15.0.0", "", { "peerDependencies": { "commander": "~15.0.0" } }, "sha512-yeJlba62xqmkgELUsn7356MEnzLLu/fw2x4lofFqGnXh6YysRdEs2BaLeLtg1+KU0AXvMeqQvTTp+3hBEBK+EA=="],
 
-    "@dotli/auth": ["@dotli/auth@workspace:packages/auth"],
-
     "@dotli/config": ["@dotli/config@workspace:packages/config"],
 
     "@dotli/content": ["@dotli/content@workspace:packages/content"],
@@ -581,13 +544,13 @@
 
     "@dotli/ui": ["@dotli/ui@workspace:packages/ui"],
 
-    "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
+    "@emnapi/core": ["@emnapi/core@1.11.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.11.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw=="],
 
-    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
 
-    "@ensdomains/content-hash": ["@ensdomains/content-hash@3.0.0", "", { "dependencies": { "@multiformats/sha3": "^2.0.17", "multiformats": "^12.0.1" } }, "sha512-5ongDPX9qDkemcYZ2rPXsRzCRDneoR2xujm2Tq3u0ZefQa49ZAURVKGqbJdjoL0VIZDfceLkBXekYKqkfrR5Ww=="],
+    "@ensdomains/content-hash": ["@ensdomains/content-hash@3.1.1", "", { "dependencies": { "@multiformats/sha3": "^4.0.0", "multiformats": "^13.0.0" } }, "sha512-BKB3BtAtfDkSX3DOYsnnTlzAeM55bI0ze7UJhk8TzoxO5/4iHjgPoEHDzjgzCTYJoCOkpFPEDah+gl62e7HJjA=="],
 
     "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="],
 
@@ -687,9 +650,9 @@
 
     "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
 
-    "@multiformats/sha3": ["@multiformats/sha3@2.0.17", "", { "dependencies": { "js-sha3": "^0.8.0", "multiformats": "^9.5.4" } }, "sha512-7ik6pk178qLO2cpNucgf48UnAOBMkq/2H92DP4SprZOJqM9zqbVaKS7XyYW6UvhRsDJ3wi921fYv1ihTtQHLtA=="],
+    "@multiformats/sha3": ["@multiformats/sha3@4.0.0", "", { "dependencies": { "js-sha3": "^0.9.1", "multiformats": "^14.0.0" } }, "sha512-y/tB2RWyeIhUToaUIYkwZUtGqfGIa3kaTvAMVekvxWJUYaD7YLa7L6O8QYaOblxxc1MMobGwh63kS1NhocRQPw=="],
 
-    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.6", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg=="],
 
     "@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="],
 
@@ -697,27 +660,11 @@
 
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
-    "@novasamatech/host-api": ["@novasamatech/host-api@0.8.9", "", { "dependencies": { "@novasamatech/scale": "0.8.9", "nanoevents": "9.1.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "scale-ts": "1.6.1" } }, "sha512-KPh81iVv3sQckq7/oyRpFF2uYBPXJD0+7cRuXO+lnWPAxQBXK1aNUQzSq+vJUHkcGRXJd0up/IlHJ4DMfQyUhQ=="],
-
-    "@novasamatech/host-container": ["@novasamatech/host-container@0.8.9", "", { "dependencies": { "@noble/hashes": "2.2.0", "@novasamatech/host-api": "0.8.9", "@polkadot-api/substrate-client": "^0.7.0", "nanoevents": "9.1.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "polkadot-api": ">=2" } }, "sha512-zcBVTvmxxhD8DOlxJZ9r85TjUYsyEh/MjicZcd2SfY7oJOPg6r/cMh8byO3rhrAtP7QsvRIRg0hjTQHGCneSog=="],
-
-    "@novasamatech/host-papp": ["@novasamatech/host-papp@0.8.9", "", { "dependencies": { "@noble/ciphers": "2.2.0", "@noble/curves": "2.2.0", "@noble/hashes": "2.2.0", "@novasamatech/host-api": "0.8.9", "@novasamatech/scale": "0.8.9", "@novasamatech/statement-store": "0.8.9", "@novasamatech/storage-adapter": "0.8.9", "@polkadot-api/utils": "^0.4.0", "@polkadot-labs/hdkd-helpers": "^0.0.30", "nanoevents": "9.1.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "polkadot-api": ">=2", "rxjs": "^7.8.2", "scale-ts": "1.6.1" } }, "sha512-Z1iENq/nn3e1P/4Mj0SS98yqO7tD8841G3xNGqO+O7tSnEjxDY4keS4uy4Rhx5hYIIRcUxe3xe1g/kUbJWVa+g=="],
-
-    "@novasamatech/scale": ["@novasamatech/scale@0.8.9", "", { "dependencies": { "@polkadot-api/utils": "^0.4.0", "scale-ts": "1.6.1" } }, "sha512-/Gt0KwfdkQZGyqd7e8YApx/QPMj/WDFrFYYOW5qxNWlbDpSUmYqNX+D1LECSokXw1vqE2m+ydBmNsAwyhJCLuQ=="],
+    "@oxc-project/types": ["@oxc-project/types@0.137.0", "", {}, "sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA=="],
 
-    "@novasamatech/sdk-statement": ["@novasamatech/sdk-statement@0.6.0", "", { "dependencies": { "@polkadot-api/substrate-bindings": "0.20.1", "@polkadot-api/utils": "^0.4.0", "polkadot-api": "^2.0.2" } }, "sha512-NTqM+yS45iHgy87lVSWIpFozrTfCUWb7r4ZpsDtN1eFnfixXpDKpPXDWQsvPs+nh18r/jmoMgtlTjUltrS6mYQ=="],
+    "@playwright/test": ["@playwright/test@1.61.1", "", { "dependencies": { "playwright": "1.61.1" }, "bin": { "playwright": "cli.js" } }, "sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig=="],
 
-    "@novasamatech/statement-store": ["@novasamatech/statement-store@0.8.9", "", { "dependencies": { "@noble/ciphers": "2.2.0", "@noble/hashes": "2.2.0", "@novasamatech/scale": "0.8.9", "@novasamatech/sdk-statement": "^0.6.0", "@novasamatech/substrate-slot-sr25519-wasm": "0.8.9", "@polkadot-api/substrate-bindings": "^0.20.3", "@polkadot-api/substrate-client": "^0.7.0", "@polkadot-labs/hdkd-helpers": "^0.0.30", "@polkadot-labs/schnorrkel-wasm": "0.0.9", "@scure/sr25519": "2.2.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "polkadot-api": ">=2", "scale-ts": "1.6.1" } }, "sha512-MCx9ah9vVoetU1+7BTU/85gUiUjirNqky4yy6ydKiYLgLAjMiRsGW02rjlngJ+4tnE0Xy3euuJcCI8FjOwMoSA=="],
-
-    "@novasamatech/storage-adapter": ["@novasamatech/storage-adapter@0.8.9", "", { "dependencies": { "nanoevents": "^9.1.0", "neverthrow": "^8.2.0" } }, "sha512-JXo6mfx0x9dZJzevKYD9MK6WxvlH5N9lBQegcSvWt3wpIniDriEUN8gmyJRkdbDdTZLwhmw1VM6mukM+RhJw1A=="],
-
-    "@novasamatech/substrate-slot-sr25519-wasm": ["@novasamatech/substrate-slot-sr25519-wasm@0.8.9", "", {}, "sha512-Y8tkYq7h9gGn0WwtxrdCjGBUdG+nVXEDzKDo+5WXe+MZI+kTc2zmhlaxXWe3f/gzqNktxKGEkJXyokB8b21buA=="],
-
-    "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="],
-
-    "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
-
-    "@polkadot-api/cli": ["@polkadot-api/cli@0.21.5", "", { "dependencies": { "@commander-js/extra-typings": "^15.0.0", "@polkadot-api/codegen": "0.22.5", "@polkadot-api/ink-contracts": "0.6.3", "@polkadot-api/json-rpc-provider": "0.2.0", "@polkadot-api/known-chains": "0.11.5", "@polkadot-api/metadata-compatibility": "0.6.3", "@polkadot-api/observable-client": "0.18.7", "@polkadot-api/sm-provider": "0.3.6", "@polkadot-api/smoldot": "0.4.5", "@polkadot-api/substrate-bindings": "0.20.3", "@polkadot-api/substrate-client": "0.7.0", "@polkadot-api/utils": "0.4.0", "@polkadot-api/wasm-executor": "^0.2.3", "@polkadot-api/ws-middleware": "0.3.5", "@polkadot-api/ws-provider": "0.9.0", "@types/node": "^25.9.1", "commander": "^15.0.0", "execa": "^9.6.1", "fs.promises.exists": "^1.1.4", "ora": "^9.4.0", "read-pkg": "^10.1.0", "rollup": "^4.61.1", "rollup-plugin-esbuild": "^6.2.1", "rxjs": "^7.8.2", "tsc-prog": "^2.3.0", "typescript": "^6.0.3", "write-package": "^7.2.0" }, "bin": { "papi": "dist/main/src/main.js", "polkadot-api": "dist/main/src/main.js" } }, "sha512-VcTfNrzIf6acMSbBlmnyTWsR4KIMGc/QmIzGzIUne+Qj145H7BkYJ7Rvr7dG92tK+eT7Keack+CJME6pjPXcLQ=="],
+    "@polkadot-api/cli": ["@polkadot-api/cli@0.21.6", "", { "dependencies": { "@commander-js/extra-typings": "^15.0.0", "@polkadot-api/codegen": "0.22.5", "@polkadot-api/ink-contracts": "0.6.3", "@polkadot-api/json-rpc-provider": "0.2.0", "@polkadot-api/known-chains": "0.11.6", "@polkadot-api/metadata-compatibility": "0.6.3", "@polkadot-api/observable-client": "0.18.7", "@polkadot-api/sm-provider": "0.3.6", "@polkadot-api/smoldot": "0.4.5", "@polkadot-api/substrate-bindings": "0.20.3", "@polkadot-api/substrate-client": "0.7.0", "@polkadot-api/utils": "0.4.0", "@polkadot-api/wasm-executor": "^0.2.3", "@polkadot-api/ws-middleware": "0.3.5", "@polkadot-api/ws-provider": "0.9.0", "@types/node": "^25.9.4", "commander": "^15.0.0", "execa": "^9.6.1", "fs.promises.exists": "^1.1.4", "ora": "^9.4.1", "read-pkg": "^10.1.0", "rollup": "^4.62.2", "rollup-plugin-esbuild": "^6.2.1", "rxjs": "^7.8.2", "tsc-prog": "^2.3.0", "typescript": "^6.0.3", "write-package": "^7.2.0" }, "bin": { "papi": "dist/main/src/main.js", "polkadot-api": "dist/main/src/main.js" } }, "sha512-1OQ2LvRSHkUcT4WRvLQFJ5PhLLN1Z1o6X1c7dguWW3eZ0bv7I9PWrbE5AyyXcy/jkceKCQ6HyISsfbBv8tIQmw=="],
 
     "@polkadot-api/codegen": ["@polkadot-api/codegen@0.22.5", "", { "dependencies": { "@polkadot-api/ink-contracts": "0.6.3", "@polkadot-api/metadata-builders": "0.14.3", "@polkadot-api/metadata-compatibility": "0.6.3", "@polkadot-api/substrate-bindings": "0.20.3", "@polkadot-api/utils": "0.4.0" } }, "sha512-zwZJAlviI211zhj5i6oXkrr0crrbO3GZjBd2vC9AshY1pRmyiNLV9DZsXw4E6l4JQwdAAyNWtPdnvvB9T3TpKg=="],
 
@@ -727,7 +674,7 @@
 
     "@polkadot-api/json-rpc-provider-proxy": ["@polkadot-api/json-rpc-provider-proxy@0.4.0", "", {}, "sha512-h+ay62wwj4y+PJ/JiZ8o54il9UYsgBxq1dxas8mN1Ybth1QxxYPxWvkhyswBNQuWBZIWJw5p3X9cGQku+LvaWQ=="],
 
-    "@polkadot-api/known-chains": ["@polkadot-api/known-chains@0.11.5", "", {}, "sha512-KOVQRyZj43lr1W5w1lZpzzLUszjPPGV32USsGVxFdguWG7L/gH+nHyBPkyhw3GhN+8NMQD7ZCyuMuNKXbRYlDA=="],
+    "@polkadot-api/known-chains": ["@polkadot-api/known-chains@0.11.6", "", {}, "sha512-EEffAbSELaYgUjZN1oiPQuJLshI0kuepr+QcT3Z28CQFRfCfSvhLTI0YE4keJ43b8TnqK5VvE8g4fW/rZqTxoA=="],
 
     "@polkadot-api/logs-provider": ["@polkadot-api/logs-provider@0.2.0", "", { "dependencies": { "@polkadot-api/json-rpc-provider": "0.2.0" } }, "sha512-BH9YdxZu+ZBPPAUwGrvqHPn1hQStL2Im3MmTwYkwXOWW2HlGHULcF65QKvyK+T6/mj2vDvl3MgivnGkUw4pVxg=="],
 
@@ -769,37 +716,35 @@
 
     "@polkadot-labs/hdkd-helpers": ["@polkadot-labs/hdkd-helpers@0.0.30", "", { "dependencies": { "@noble/curves": "^2.2.0", "@noble/hashes": "^2.2.0", "@scure/base": "^2.2.0", "@scure/sr25519": "^1.0.0", "scale-ts": "^1.6.1" } }, "sha512-qWmmD6ayj14RenDuDFfjF3sHS7ObqPzwIIMPcSVoDeKFSeQV7RY0HwyhC5CG4i6FoguMzak2dbtjYpNN5XQiwQ=="],
 
-    "@polkadot-labs/schnorrkel-wasm": ["@polkadot-labs/schnorrkel-wasm@0.0.9", "", {}, "sha512-MWO28z29OgKihdXjybvbuECASAIu52KZfBMFNZtK7jeyoFvA8ZrpJzYxPgFaBIsk1hHM488q7EXHckaMnZ1xng=="],
-
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.3", "", { "os": "android", "cpu": "arm64" }, "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.1.3", "", { "os": "android", "cpu": "arm64" }, "sha512-DT6Z3PhvioeHMvxo+xHc3KtqggrI7CCTXCmC2h/5zUlp5jVitv7XEy+9q5/7v8IolhlioawpMo8Kg0EEBy7J0g=="],
 
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.1.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0NwgwsjM7LrsuVnXMK3koTpagBNOhloc/BNjKqZjv4V5zI5r13qx69uVhRx+o5Z0yy4Hzq+lpy7TAgUG/ocvrw=="],
 
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.1.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-YtiBp4disu6V560loT6PjMdiRaWmVvDNrUunAalbiFx2ggeJwxdAsgZMcoGP17uyAsTwAj5V1niksxlHnVQ1Sw=="],
 
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.1.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-yD3EkEdXk2LypPxnf/kSZHirarsI8gcPzc62SukhR9VJTyvV+F9Q/GxWNuCojc7sXyuVC4DxRGhdDK4X8VSsbw=="],
 
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.3", "", { "os": "linux", "cpu": "arm" }, "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.1.3", "", { "os": "linux", "cpu": "arm" }, "sha512-c+8vieQbsD7HNAHKIA34w0GJ9FedFFuJGD+7E6vz7Q3uqAIugL5p45fhlsj4UaAsHpcmlqugBWMhA0/j7o0sIg=="],
 
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.1.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-50jD0uUwLvur7Zz9LHz17kaAdTPjn5wN93hEgjvmYFRZwiR7ZJYovTd5ipyWJDAnXKvZ+wgc+/Ika6dwSF5OcA=="],
 
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.1.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-BO9+oPL8K9poZJBfYPsXNtYjPE5uM3qeehT3aFcW4LITOl+iSqhp0abzjR2nWBUNjIZeKXjAEWBZ64WjNoHd6w=="],
 
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.1.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-f3VpLB1vQ0Eo6ecr/6cekLnvYMFF4YBFoVGkfkvPLq1bAkbAwHYQPZKoAmG6OJyTcxxoC+AvezGx/S1obNC0Mw=="],
 
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.1.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-AmurZ26Pqx/RI9N1gzEOCklkKXl927yjfXWUUS0O7Puh8ARM/Ob8qfrD3qnWksScdw6cSrW5PSHE9DyLu7+PtA=="],
 
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.3", "", { "os": "linux", "cpu": "x64" }, "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.1.3", "", { "os": "linux", "cpu": "x64" }, "sha512-JJpqs8bRGITDOdbkNKnlojzBabbOHrqjSvDr0IVsZObE1lBcPjxItUEY9eWIDbxaJ3cGrXPWGfGkIxFijg/URg=="],
 
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.3", "", { "os": "linux", "cpu": "x64" }, "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.1.3", "", { "os": "linux", "cpu": "x64" }, "sha512-rSJcdjPxzA/by/6/rYs+v+bXU7UjvnbUWz8MJb6kh6+knqB1dCrtHg0uu7C/4haqJvqdkYHQ5IGn+tCH9GLW/g=="],
 
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.3", "", { "os": "none", "cpu": "arm64" }, "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.1.3", "", { "os": "none", "cpu": "arm64" }, "sha512-hQ3/PYkDJICgevvyNcVrihVeqq7k1Pp3VZ9lY+dauAYUJKO+auqApvANhvR1An9BhmqYKvW2Mu1F9u4DXSMLxQ=="],
 
-    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.3", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg=="],
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.1.3", "", { "dependencies": { "@emnapi/core": "1.11.1", "@emnapi/runtime": "1.11.1", "@napi-rs/wasm-runtime": "^1.1.6" }, "cpu": "none" }, "sha512-Elcv/BtML9lXrV6JuKITc/grN2kYV9gjsQpW8Jfw4ioK0TOkjBjye0nnyqQNy9STNaI20lXNaQBRrD5gSgR0Yg=="],
 
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.1.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-2DrEfhluH9yhiaFApmsjsjwrSYbNcY1oFTzYSP1a535jDbV98zCFanA/96TBUd0iDFcxGmw9QRExwGCXz3U+/g=="],
 
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.3", "", { "os": "win32", "cpu": "x64" }, "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.1.3", "", { "os": "win32", "cpu": "x64" }, "sha512-OL4OMk7UPXOeVGGd3qo5zJyPIljf4AFgk5QAkPPS+OoLuOOozhuaQGC18MxVTnw/06q93gShAJzlwnSCY9YtqA=="],
 
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
@@ -813,75 +758,69 @@
 
     "@rollup/pluginutils": ["@rollup/pluginutils@5.4.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg=="],
 
-    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.61.1", "", { "os": "android", "cpu": "arm" }, "sha512-JnBB8MdXj45cajvTuO5FmPlvFVJRQgvrz1uSEl3NwqFnReAPGwb8EanbGi4z2nRaqLzjJSv5/JmycoTKlRZxHA=="],
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.62.2", "", { "os": "android", "cpu": "arm" }, "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg=="],
 
-    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.61.1", "", { "os": "android", "cpu": "arm64" }, "sha512-Jx2g7iSjw4AOT0HDPHM9RV3GNjRXwybWtSFZiZAYUTjUwjVrYIwq3kBf+LnhqJlzXFAqTAh2F7IGI+O568exPw=="],
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.62.2", "", { "os": "android", "cpu": "arm64" }, "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw=="],
 
-    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.61.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0F1L/Z3Eqv8mT2n3dCpeO8GcTvHvVqkP5/t6DMsn0KzhYVcg+s7Ncl5DS8qjKYEeio6Az0Gt6nyBORay5qIlCA=="],
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.62.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A=="],
 
-    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.61.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-qLttcH871ujY4YcVfUSShhOw+CsoTatYz8gRbHO7Bb92QH059/P0y5do1KMs41fY0BpD2x4AJH/gID0zFiqVKQ=="],
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.62.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA=="],
 
-    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.61.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-fUI4RapGE0Oh3mb8mgfvC1O2nU1RpDZUKnDQm3xB1Ipg7C2wTs5Kstz7G2uWK99a8S2yTMq8/P4uycwNa0nJyw=="],
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.62.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw=="],
 
-    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.61.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-H5YrdvJaDtI/U9/emrD4b++xkvp3y/JvOe4rizHbxvkyMfRS/CiRYdji+Pl8D0brEaNFWUh1drQxgAGIl6Xudw=="],
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.62.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg=="],
 
-    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.61.1", "", { "os": "linux", "cpu": "arm" }, "sha512-Q8CBCCQtDFrYtXoeUXSrnFXKOnyUhx6bz+SkL6A0E7V8kAiCJ5pamq1WtbfpVGhR5TSpXY6ak3avmDc5fHTyJA=="],
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.62.2", "", { "os": "linux", "cpu": "arm" }, "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg=="],
 
-    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.61.1", "", { "os": "linux", "cpu": "arm" }, "sha512-nwnhk1581l0FBVellGcVCAT0Oi06onEA3WB53sf01VO3I0UPBkMH9sXONYME2K0ovXcNayJfNtHfm6mpJElatQ=="],
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.62.2", "", { "os": "linux", "cpu": "arm" }, "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA=="],
 
-    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.61.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-x5Xr49hwt3hdW75UOZm3395YwwzPyauktslv29KpWL/T+vVAzoT3azLcTWv0eMciBNrx+DYjH4paehHoLpPvpg=="],
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.62.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA=="],
 
-    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.61.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-unMS3H73DpaoPyyEVPjGKleM/s0mkmsauTENpw4INQY8y4+IuLNjkueQ5QCtC0D3N38Y38yhAU8OoZ20S2Tm6w=="],
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.62.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ=="],
 
-    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.61.1", "", { "os": "linux", "cpu": "none" }, "sha512-zNZzGRnAhwjFEYmvphJRV5XaQGjs62cCmeYYHUT//NbvEnHauw+I85nGG+SiVg5ld4GX8D1IbKIX+ozITQnhMQ=="],
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg=="],
 
-    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.61.1", "", { "os": "linux", "cpu": "none" }, "sha512-LdpWGL8X209B2SIvWjqlc8VZgM6PKfontSerGepuldQmHYrAOtnMCXeJkxXGbC+PPZVOuu5czJo7fNV6aeW8rQ=="],
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ=="],
 
-    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.61.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-EC5kTtNaNGOmbMGqar8dvJy6y/hg99GAwjfBz++pxZhQATXGcRjd6c5en5wcbru0vkRmiMGsQKdMJOOf6sza4g=="],
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.62.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A=="],
 
-    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.61.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-8hiwp6D4acEcNK78I4rP0/XtS1sknWIAMJBPdR4l6zUtyTm5KiTDr5bXmWt4foY7nAN7AThDHgkLIEZOWKbzWw=="],
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.62.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w=="],
 
-    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.61.1", "", { "os": "linux", "cpu": "none" }, "sha512-10dh/h/BqA7DuMPWSxkR8uks18FRwnwOEqr5zOTEl+NOwP/OMzKX8OFR/Of9xxDA7D5qef1Nzar5WDD2kCCr1g=="],
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg=="],
 
-    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.61.1", "", { "os": "linux", "cpu": "none" }, "sha512-YKJ5lg35DP17gcAOggnihe+APw9HLyj1Xn7gsmGumBJAUDa6NGXNixJzmkWLhcK9TOuuyQjdamzvJefkO7qHZQ=="],
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.62.2", "", { "os": "linux", "cpu": "none" }, "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q=="],
 
-    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.61.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-Mlil5G2Jj6a7B3LWGctg+XPL9vdXYuzCtNXfxOQ0nPjc2m6ueUktocPGH9bnAM0bNRKb/bAWTujUU7IJQdQA+g=="],
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.62.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg=="],
 
-    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.61.1", "", { "os": "linux", "cpu": "x64" }, "sha512-bVWIOIk6pV01p4CdUbPP7CJ/434z+OooYjDuFcR+44N35YvKUC66G8MGnvcWx5mWKW3g61J+t74l3Kj15Kwn2Q=="],
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.62.2", "", { "os": "linux", "cpu": "x64" }, "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A=="],
 
-    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.61.1", "", { "os": "linux", "cpu": "x64" }, "sha512-qy5pBvZbqNFheBz61R1rzsezjm0J7O2oNGoWtGoY89SZYLUfxAJTBAqDChqAIdB4rCiIbi9nF7yZ83GnNiLwSw=="],
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.62.2", "", { "os": "linux", "cpu": "x64" }, "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg=="],
 
-    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.61.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-E83TXjI4zm0+5f2qO+UOudaCYIhYwpJ5jq6YCZNIZ+6CbfhKrkAGezeiASBL9ElxAxFsRS9ZhESv8mfnj6TKeg=="],
+    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.62.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg=="],
 
-    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.61.1", "", { "os": "none", "cpu": "arm64" }, "sha512-fbWnKqVkjrJN38vNe3ahkbk6iejS/3b0Nt7EEtPpE6RBacZcGXNKbzfHN3GUUlXOPghUg0j6XUGrtjX9z1sIvA=="],
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.62.2", "", { "os": "none", "cpu": "arm64" }, "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA=="],
 
-    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.61.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-ArMl38iVAbk0New1ogihQNY6iphLi4ZaRsa037gUzv5yeKPY8TD3Dmy4x2RNC1VztU/uqm+G+/RwFrSka3Oy2g=="],
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.62.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg=="],
 
-    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.61.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-0mYtjHS9ucAbcATycCNK9IGBk/cCe/ma7EmSLGZdsxnOA8cjRIyU04wDpVAD9NiOfLUR9KTxdiO53uOkherqjQ=="],
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.62.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q=="],
 
-    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.61.1", "", { "os": "win32", "cpu": "x64" }, "sha512-gK1iCEPfpoSG9wfBihXxvBMi8ZfcWffYkEsC/Eih+iFENTaewvNcrEQ69lIOWYO5pePHKLHHO7nq5AILGO/HQQ=="],
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.62.2", "", { "os": "win32", "cpu": "x64" }, "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg=="],
 
-    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.61.1", "", { "os": "win32", "cpu": "x64" }, "sha512-X+zaP2x+j4RXGfbp/seSoRHWnPxzApilDszisZxbYH5C/jTxFhCtDNdPGZb9lJyYPs24wGxruPF7Y+sIXt9Gzw=="],
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.62.2", "", { "os": "win32", "cpu": "x64" }, "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA=="],
 
     "@rx-state/core": ["@rx-state/core@0.1.4", "", { "peerDependencies": { "rxjs": ">=7" } }, "sha512-Z+3hjU2xh1HisLxt+W5hlYX/eGSDaXXP+ns82gq/PLZpkXLu0uwcNUh9RLY3Clq4zT+hSsA3vcpIGt6+UAb8rQ=="],
 
     "@scure/base": ["@scure/base@2.2.0", "", {}, "sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg=="],
 
-    "@scure/sr25519": ["@scure/sr25519@2.2.0", "", { "dependencies": { "@noble/curves": "~2.2.0", "@noble/hashes": "~2.2.0" } }, "sha512-UTOZb6Hzw44REQdl2SWNBhBFIoqOIhMLNIz3zYyVQLbqdshhuyuuxYoibKHlDg9oqdwdCHQe5LkTsevugPpUbw=="],
+    "@scure/sr25519": ["@scure/sr25519@1.0.0", "", { "dependencies": { "@noble/curves": "~2.0.0", "@noble/hashes": "~2.0.0" } }, "sha512-b+uhK5akMINXZP95F3gJGcb5CMKYxf+q55fwMl0GoBwZDbWolmGNi1FrBSwuaZX5AhqS2byHiAueZgtDNpot2A=="],
 
     "@sec-ant/readable-stream": ["@sec-ant/readable-stream@0.4.1", "", {}, "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="],
 
-    "@sentry-internal/browser-utils": ["@sentry-internal/browser-utils@10.57.0", "", { "dependencies": { "@sentry/core": "10.57.0" } }, "sha512-tXObp954rMTSYKlbftjVXHtNl4t/6ssks3jkqyzmKb+PDPWzabGQO7sWwqVuTjT8Kx/8A3FmriS1bGmqxiJy3A=="],
-
-    "@sentry-internal/feedback": ["@sentry-internal/feedback@10.57.0", "", { "dependencies": { "@sentry/core": "10.57.0" } }, "sha512-ZcF4QhkqGX3iiQSXB2N0N3Awp+j5iqnDRu6PA/qyLFrWqH5ZiiAAgu59OLD9E6XAdg6iFtLYw19MAMZVK8qNOQ=="],
-
-    "@sentry-internal/replay": ["@sentry-internal/replay@10.57.0", "", { "dependencies": { "@sentry-internal/browser-utils": "10.57.0", "@sentry/core": "10.57.0" } }, "sha512-Wmnx/6ABynVH1iwuoNUqJNyjIUqsqoGML7qsyivBRKb5Wo2YQtPOQlQYfxfZSvWzGpcoSVdInkRjDssUQxQEQg=="],
-
-    "@sentry-internal/replay-canvas": ["@sentry-internal/replay-canvas@10.57.0", "", { "dependencies": { "@sentry-internal/replay": "10.57.0", "@sentry/core": "10.57.0" } }, "sha512-zsfa4JcfV0AEc9YhNxNabd5lSZL2Av84saAyexGAqcHs+67m9Gd0cGStOzMb/nCl7UAtmdP0aI+G7a3rcxxN/A=="],
-
     "@sentry/babel-plugin-component-annotate": ["@sentry/babel-plugin-component-annotate@5.3.0", "", {}, "sha512-p4q8gn8wcFqZGP/s2MnJCAAd8fTikaU6A0mM97RDHQgStcrYiaS0Sc5zUNfb1V+UOLPuvdEdL6MwyxfzjYJQTA=="],
 
-    "@sentry/browser": ["@sentry/browser@10.57.0", "", { "dependencies": { "@sentry-internal/browser-utils": "10.57.0", "@sentry-internal/feedback": "10.57.0", "@sentry-internal/replay": "10.57.0", "@sentry-internal/replay-canvas": "10.57.0", "@sentry/core": "10.57.0" } }, "sha512-s36AQy/CKXTfyY9Z+qUhzNomntZXgfs0rbaK7q9ffnFkqcPwzE8qQtVs58y3Suut56u+AhwSztgQtERcuZ5VIA=="],
+    "@sentry/browser": ["@sentry/browser@10.61.0", "", { "dependencies": { "@sentry/browser-utils": "10.61.0", "@sentry/core": "10.61.0", "@sentry/feedback": "10.61.0", "@sentry/replay": "10.61.0", "@sentry/replay-canvas": "10.61.0" } }, "sha512-I02k3/tpCbQ+Dm3d1eA+JHVS452gY4fCTh+fT3FcfZkovB/WaeJcwc+ywQN1jpTYBRKZ1HbXXZQhEhXYvb8MkA=="],
+
+    "@sentry/browser-utils": ["@sentry/browser-utils@10.61.0", "", { "dependencies": { "@sentry/core": "10.61.0" } }, "sha512-kj/Qs5hz/VQPOLesgv9wq8O1z3aKSHSkyFiCSzaOthb8ARISchk8Eiukbvw9GxX2gmgsCd0L35gD6gxnhlE9ag=="],
 
     "@sentry/bundler-plugin-core": ["@sentry/bundler-plugin-core@5.3.0", "", { "dependencies": { "@babel/core": "^7.18.5", "@sentry/babel-plugin-component-annotate": "5.3.0", "@sentry/cli": "^2.58.5", "dotenv": "^16.3.1", "find-up": "^5.0.0", "glob": "^13.0.6", "magic-string": "~0.30.8" } }, "sha512-L5T60sWdAI3qWwdg3Ptwek/0TY59PERrxyqp4XMUkroayQvGd9r5dIW9Q1kSeXX9iJ442nXbFZKAOyCKV4Z13Q=="],
 
@@ -903,7 +842,13 @@
 
     "@sentry/cli-win32-x64": ["@sentry/cli-win32-x64@2.58.6", "", { "os": "win32", "cpu": "x64" }, "sha512-R35WJ17oF4D2eqI1DR2sQQqr0fjRTt5xoP16WrTu91XM2lndRMFsnjh+/GttbxapLCBNlrjzia99MJ0PZHZpgA=="],
 
-    "@sentry/core": ["@sentry/core@10.57.0", "", {}, "sha512-kntItTA2kiT0YpL7encXaF6mkdZMB+y48lwj8w1wkfBpfJAC7sifdgrzLQZqmsqVNE3crg9VfufaAGA+78uFMg=="],
+    "@sentry/core": ["@sentry/core@10.61.0", "", {}, "sha512-Edg8t2w45qEKiFnjeA6zRmU47R6la5FEMG+maZEOB2oTyJ+ujmh8LGaZ3G8aC0VdkKn8CXhHtDesze6oDc1oTA=="],
+
+    "@sentry/feedback": ["@sentry/feedback@10.61.0", "", { "dependencies": { "@sentry/core": "10.61.0" } }, "sha512-DvG5pc2BibQjdvFC75u1S5DzghcFZ/juCDb2UnRKjiWnNhiUUAweAkUv4mMednrbuOeGOgO2R3CaiqIvDrAUAw=="],
+
+    "@sentry/replay": ["@sentry/replay@10.61.0", "", { "dependencies": { "@sentry/browser-utils": "10.61.0", "@sentry/core": "10.61.0" } }, "sha512-EkLaPR7A89mRGucZY9WxKLGeiRKMuNeGfIthLrs9cumUP8Smc80qxSAsF3NggRHSQEeYHDAifY/1q1qW16yvJg=="],
+
+    "@sentry/replay-canvas": ["@sentry/replay-canvas@10.61.0", "", { "dependencies": { "@sentry/core": "10.61.0", "@sentry/replay": "10.61.0" } }, "sha512-n6QUN+qylEdKLcijpJsJ58ekY58kg0nG0dKxkD2wecKubl7B1mj/gwP35NmJOZ35vJTk/KbJeWB//finspJqYg=="],
 
     "@sentry/rollup-plugin": ["@sentry/rollup-plugin@5.3.0", "", { "dependencies": { "@sentry/bundler-plugin-core": "5.3.0", "magic-string": "~0.30.8" }, "peerDependencies": { "rollup": ">=3.2.0" }, "optionalPeers": ["rollup"] }, "sha512-hgPGPYdQJ/G1cGYOxAb7d4z3V+/k/E5/P/5TFPEEBLuIbFFk+JG0CISUDJdzXJjO382Lb99PBJuXGbueBmO79w=="],
 
@@ -915,19 +860,19 @@
 
     "@trickfilm400/rollup-plugin-off-main-thread": ["@trickfilm400/rollup-plugin-off-main-thread@3.0.0-pre1", "", { "dependencies": { "ejs": "^3.1.10", "json5": "^2.2.3", "magic-string": "^0.30.21", "string.prototype.matchall": "^4.0.12" } }, "sha512-/67zpWDBLV+oYAEL682s1ktXL0HgqX76f6gaVGkGnVZlBbm1zd0v4Bz8MFF2GGhoX9rvfq3KSQHubFHwa6w6/Q=="],
 
-    "@turbo/darwin-64": ["@turbo/darwin-64@2.9.18", "", { "os": "darwin", "cpu": "x64" }, "sha512-9f27peFu16ur8c0v9nUFUEyBnbKuuFsUTjHFWfmwGfzySBXbHwzU44QhZon6Mznz0cHsIr3984NQj/bVrnGSRw=="],
+    "@turbo/darwin-64": ["@turbo/darwin-64@2.10.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-EwvHThXzpY0KGd1/NAmuewI5D+aVa3Rl/OlxE36yfjUKb/+ySrfJrSlEFt8aD1OXwnnaHnQnPKHFndor0Zxlsg=="],
 
-    "@turbo/darwin-arm64": ["@turbo/darwin-arm64@2.9.18", "", { "os": "darwin", "cpu": "arm64" }, "sha512-9A6TMRq/Ib+QnbhLlgkhOm+624wO4pzSQ/yQviQfWHOlFvaYxdnIAYmu2H6TS6y7kSVL0DvzNe04NbESTOzFVQ=="],
+    "@turbo/darwin-arm64": ["@turbo/darwin-arm64@2.10.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-9d2fTyyG0lf5Wq1bwJA9qUaeecViMkLcdctWaMMmCkxZ/JqypmqOwK3W6vmejeKVgkr06gSoiX8bD+xN5Jpxcg=="],
 
-    "@turbo/linux-64": ["@turbo/linux-64@2.9.18", "", { "os": "linux", "cpu": "x64" }, "sha512-zCdIDtz69AnbYh913elJRRoF3QY5aa2HNnf+4rAkc7bQ+tWujiDkCNV7stazOUPggaDvhKIf2Z87qHftTeXSkw=="],
+    "@turbo/linux-64": ["@turbo/linux-64@2.10.0", "", { "os": "linux", "cpu": "x64" }, "sha512-sZBtjMuufitanjzi6UssoUpJMnnPlLMcdcJj3m3ptNsSq31Xh7MnjhwA5nWvLDTfEFg8GPcbYFXMo8vSdKRfqQ=="],
 
-    "@turbo/linux-arm64": ["@turbo/linux-arm64@2.9.18", "", { "os": "linux", "cpu": "arm64" }, "sha512-Va1kXI04naMgYwqv/5Dfa36dTDx8015U7oaQAjrXa45ua9OoFjSV4OmvkML4EmXvUclQHCiBRbY8bvd0jV7eAg=="],
+    "@turbo/linux-arm64": ["@turbo/linux-arm64@2.10.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-vkq/Z8R+1DQ+kifWFa810IjRy2NNBVvha3cg9sWA3nFh6nnGrHSMnnJKrzH7c/No9kq4Jb55Ru44YKsCSBgrKg=="],
 
-    "@turbo/windows-64": ["@turbo/windows-64@2.9.18", "", { "os": "win32", "cpu": "x64" }, "sha512-m0kDhZANxSNz9ck1ybogFscHabriAsp4eDFNrN/1H5WrgTF7b3VlcPZnhuO3v2+E2KnCbeAc+UUT10BZZHdDKw=="],
+    "@turbo/windows-64": ["@turbo/windows-64@2.10.0", "", { "os": "win32", "cpu": "x64" }, "sha512-CRUEguLWxFQHptYZS7HjPhNhAFawfea07iR+xAQ5e4klgLrPCMdexBkXwSCwOxqTFknJ7RZFN3gOaADsw+Gttg=="],
 
-    "@turbo/windows-arm64": ["@turbo/windows-arm64@2.9.18", "", { "os": "win32", "cpu": "arm64" }, "sha512-nUdR8WqoomUys9iIQmG45TMiizJ+5BV8egSeLLZba/AWblyp3fVBcIH1kSE58OtK4g2YzbMJEth6Ttv9w5rqMA=="],
+    "@turbo/windows-arm64": ["@turbo/windows-arm64@2.10.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-dVHGaf9F8twzgibcBqKoADT/LLqf9++jDb+hq/LPWWaOmRpp4M+/pVOm7vy4z9D++xg8eaxWLT0+wQxFwhYu9A=="],
 
-    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
 
     "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="],
 
@@ -939,7 +884,7 @@
 
     "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
 
-    "@types/node": ["@types/node@25.9.3", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg=="],
+    "@types/node": ["@types/node@25.9.4", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-dszCsrKb5U7ZsVZBWiHFklTloVl0mSEnWH/iZXfZUlI4rzCUnsvGmgqfuVRHL54ugE7/wRuxEIXRa2iMZ+BG6g=="],
 
     "@types/normalize-package-data": ["@types/normalize-package-data@2.4.4", "", {}, "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="],
 
@@ -953,41 +898,41 @@
 
     "@types/ws": ["@types/ws@8.18.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg=="],
 
-    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.61.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.61.0", "@typescript-eslint/type-utils": "8.61.0", "@typescript-eslint/utils": "8.61.0", "@typescript-eslint/visitor-keys": "8.61.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.61.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-bFNvl9ZczlVb+wR2Akszf3gHfKVj/8WanXaGJ3UstTA7brNKg0cNdk6X1Psu5V7MZ2oQtzZKOEzIUehaoxbDGw=="],
+    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.62.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.62.0", "@typescript-eslint/type-utils": "8.62.0", "@typescript-eslint/utils": "8.62.0", "@typescript-eslint/visitor-keys": "8.62.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.62.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-o+mpz7EYiMzXoySXiKmzlabIvTVqUuK5yLrAedRPRDA0IpPFMUV1IXt6OqljIxX/kumN6EjUYp41Hqelh6p/Dw=="],
 
-    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.61.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.61.0", "@typescript-eslint/types": "8.61.0", "@typescript-eslint/typescript-estree": "8.61.0", "@typescript-eslint/visitor-keys": "8.61.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-5B7PfA2e1NQGCnDHd/0lW7W3gvp3d59Ryw54FYO8Uswxo9f6ikw3AZV+Xj/TvpImmpsiYyUqAfhC6kJID1jF6w=="],
+    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.62.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.62.0", "@typescript-eslint/types": "8.62.0", "@typescript-eslint/typescript-estree": "8.62.0", "@typescript-eslint/visitor-keys": "8.62.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA=="],
 
-    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.61.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.61.0", "@typescript-eslint/types": "^8.61.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-DV42F7MLJO6Rax7SK1yg43tcnEfGUrurSpSxKuVX+a3RCTzBlH3fuxprrOJXKCJGAaw82xXocikJ0uQaqwXgGA=="],
+    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.62.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.62.0", "@typescript-eslint/types": "^8.62.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ=="],
 
-    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.61.0", "", { "dependencies": { "@typescript-eslint/types": "8.61.0", "@typescript-eslint/visitor-keys": "8.61.0" } }, "sha512-IWdXFHFSb6mlC3HPc7QsLDm5zYEbUla6trDEHf32D3/dnuUyXd87plScSNXSbm0/RxMvObpI17sv/EDTGrGZkA=="],
+    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.62.0", "", { "dependencies": { "@typescript-eslint/types": "8.62.0", "@typescript-eslint/visitor-keys": "8.62.0" } }, "sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA=="],
 
-    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.61.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-O5Amvdv9ztMpxpf+vmFULGG78IE6Qwdr3bCGvqwG4nwc9H2qXkOYJJnRbRHyMkQTjv1d03olqwwwzHLMqpFePQ=="],
+    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.62.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g=="],
 
-    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.61.0", "", { "dependencies": { "@typescript-eslint/types": "8.61.0", "@typescript-eslint/typescript-estree": "8.61.0", "@typescript-eslint/utils": "8.61.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-TuBiQYIkd97yBfInHCTKVYMbX4kvEmpOEuixIuzCU9p8BGT1SfyyO0d0IfDMbPIHcjn/hWnusUX5e8v5Xg+X8A=="],
+    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.62.0", "", { "dependencies": { "@typescript-eslint/types": "8.62.0", "@typescript-eslint/typescript-estree": "8.62.0", "@typescript-eslint/utils": "8.62.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-+g5O3j0w2ldzC86Pv6fvbO/xhAonbJFIdf/MKQ1d30gndlsVzUOE83ldfSE15Qrl9fhFjK6AovHs5Wpp6vx86w=="],
 
-    "@typescript-eslint/types": ["@typescript-eslint/types@8.61.0", "", {}, "sha512-9QTQpZ5Iin4CdIodfbDQFSeiSJKidgYJYug1P9CC2xWgUTvlmixViqDZNciMjwLBZyJnG4tGmPl97rVAFb1AJg=="],
+    "@typescript-eslint/types": ["@typescript-eslint/types@8.62.0", "", {}, "sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg=="],
 
-    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.61.0", "", { "dependencies": { "@typescript-eslint/project-service": "8.61.0", "@typescript-eslint/tsconfig-utils": "8.61.0", "@typescript-eslint/types": "8.61.0", "@typescript-eslint/visitor-keys": "8.61.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-42zatd5qSvvcV1JdDBCLxYRznvP4eIHpPoZXdkPFnAmanA4FuZ5dibSnCBggY8hQnqajPpoGjXFdZ7fIJKQnlA=="],
+    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.62.0", "", { "dependencies": { "@typescript-eslint/project-service": "8.62.0", "@typescript-eslint/tsconfig-utils": "8.62.0", "@typescript-eslint/types": "8.62.0", "@typescript-eslint/visitor-keys": "8.62.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A=="],
 
-    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.61.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.61.0", "@typescript-eslint/types": "8.61.0", "@typescript-eslint/typescript-estree": "8.61.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-3bzFt7ImFMW/jVYwJamDoe/dMOdFLSC6pom6rRjdh4SZJEYupyMzem8e7vKZLclLfpHjlwSAXOUxtKxGXUiLqA=="],
+    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.62.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.62.0", "@typescript-eslint/types": "8.62.0", "@typescript-eslint/typescript-estree": "8.62.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g=="],
 
-    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.61.0", "", { "dependencies": { "@typescript-eslint/types": "8.61.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-QVLZu3ZPQEE+HICQyAMZ2yLQhxf0meY/wx6Hx14YcTNj13JB3qHlX3lJ02L3fLGHgERRH71kvYDwiXIguT3AjQ=="],
+    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.62.0", "", { "dependencies": { "@typescript-eslint/types": "8.62.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ=="],
 
-    "@vitest/expect": ["@vitest/expect@4.1.8", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.8", "@vitest/utils": "4.1.8", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ=="],
+    "@vitest/expect": ["@vitest/expect@4.1.9", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.9", "@vitest/utils": "4.1.9", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA=="],
 
-    "@vitest/mocker": ["@vitest/mocker@4.1.8", "", { "dependencies": { "@vitest/spy": "4.1.8", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw=="],
+    "@vitest/mocker": ["@vitest/mocker@4.1.9", "", { "dependencies": { "@vitest/spy": "4.1.9", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw=="],
 
-    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.8", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA=="],
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.9", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A=="],
 
-    "@vitest/runner": ["@vitest/runner@4.1.8", "", { "dependencies": { "@vitest/utils": "4.1.8", "pathe": "^2.0.3" } }, "sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg=="],
+    "@vitest/runner": ["@vitest/runner@4.1.9", "", { "dependencies": { "@vitest/utils": "4.1.9", "pathe": "^2.0.3" } }, "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg=="],
 
-    "@vitest/snapshot": ["@vitest/snapshot@4.1.8", "", { "dependencies": { "@vitest/pretty-format": "4.1.8", "@vitest/utils": "4.1.8", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ=="],
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.9", "", { "dependencies": { "@vitest/pretty-format": "4.1.9", "@vitest/utils": "4.1.9", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA=="],
 
-    "@vitest/spy": ["@vitest/spy@4.1.8", "", {}, "sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA=="],
+    "@vitest/spy": ["@vitest/spy@4.1.9", "", {}, "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA=="],
 
-    "@vitest/utils": ["@vitest/utils@4.1.8", "", { "dependencies": { "@vitest/pretty-format": "4.1.8", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg=="],
+    "@vitest/utils": ["@vitest/utils@4.1.9", "", { "dependencies": { "@vitest/pretty-format": "4.1.9", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA=="],
 
-    "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
+    "acorn": ["acorn@8.17.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg=="],
 
     "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
 
@@ -1021,11 +966,11 @@
 
     "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.34", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-IMDedajPifLnHNY0X9n8hKxRTQ6/eTHwr5bDo04WnuqxyKw6LYtQywCuuqPZwhl3aBXMvQpJov42GLCwRRdQzw=="],
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.40", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw=="],
 
     "brace-expansion": ["brace-expansion@5.0.6", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g=="],
 
-    "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
+    "browserslist": ["browserslist@4.28.4", "", { "dependencies": { "baseline-browser-mapping": "^2.10.38", "caniuse-lite": "^1.0.30001799", "electron-to-chromium": "^1.5.376", "node-releases": "^2.0.48", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw=="],
 
     "buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
 
@@ -1039,9 +984,9 @@
 
     "camelcase": ["camelcase@5.3.1", "", {}, "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001793", "", {}, "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001799", "", {}, "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw=="],
 
-    "cborg": ["cborg@5.1.1", "", { "bin": { "cborg": "lib/bin.js" } }, "sha512-BDbSRIp6XrQXkTc7g+DN0RB9RrDPTUfals2ecWUlt3juPLjbAvy/V72mJcXY0Ehu0Dq/3WpNCOCT68HUTbW+lw=="],
+    "cborg": ["cborg@5.1.4", "", { "bin": { "cborg": "lib/bin.js" } }, "sha512-EDoD59RBV51H5ar6i29ut7AyOJi0BUIEhtbnJJac3qYcMG74Db6eVce/dIh+Wh6tVwBi7cRWDXmdms+fKPQvcQ=="],
 
     "chai": ["chai@6.2.2", "", {}, "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="],
 
@@ -1057,7 +1002,7 @@
 
     "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
 
-    "commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
+    "commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
 
     "common-tags": ["common-tags@1.8.2", "", {}, "sha512-gk/Z852D2Wtb//0I+kRFNKKE9dIIVirjoqPoA1wJU+XePVXZfGeBpk45+A1rKO4Q43prqWBNY/MiIeRLbPWUaA=="],
 
@@ -1101,7 +1046,7 @@
 
     "ejs": ["ejs@3.1.10", "", { "dependencies": { "jake": "^10.8.5" }, "bin": { "ejs": "bin/cli.js" } }, "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA=="],
 
-    "electron-to-chromium": ["electron-to-chromium@1.5.368", "", {}, "sha512-7RckJJK4uESJF9PxvfMWd3TGqIiieUTG4HxnKaKuIpGbcr+r2ZEB3g2gAhCP3Fqm42vJSzLfgab9eva/C4/XVw=="],
+    "electron-to-chromium": ["electron-to-chromium@1.5.378", "", {}, "sha512-VinvOAuuPmdD1guEgGv5f2Qp7/vlfqOrUOMYNnOD4wj3pit8kRsQHzfIf6teyUGWo15Tg5+bOJaRunvyltpVWQ=="],
 
     "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
 
@@ -1109,6 +1054,8 @@
 
     "es-abstract": ["es-abstract@1.24.2", "", { "dependencies": { "array-buffer-byte-length": "^1.0.2", "arraybuffer.prototype.slice": "^1.0.4", "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "call-bound": "^1.0.4", "data-view-buffer": "^1.0.2", "data-view-byte-length": "^1.0.2", "data-view-byte-offset": "^1.0.1", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "es-set-tostringtag": "^2.1.0", "es-to-primitive": "^1.3.0", "function.prototype.name": "^1.1.8", "get-intrinsic": "^1.3.0", "get-proto": "^1.0.1", "get-symbol-description": "^1.1.0", "globalthis": "^1.0.4", "gopd": "^1.2.0", "has-property-descriptors": "^1.0.2", "has-proto": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "internal-slot": "^1.1.0", "is-array-buffer": "^3.0.5", "is-callable": "^1.2.7", "is-data-view": "^1.0.2", "is-negative-zero": "^2.0.3", "is-regex": "^1.2.1", "is-set": "^2.0.3", "is-shared-array-buffer": "^1.0.4", "is-string": "^1.1.1", "is-typed-array": "^1.1.15", "is-weakref": "^1.1.1", "math-intrinsics": "^1.1.0", "object-inspect": "^1.13.4", "object-keys": "^1.1.1", "object.assign": "^4.1.7", "own-keys": "^1.0.1", "regexp.prototype.flags": "^1.5.4", "safe-array-concat": "^1.1.3", "safe-push-apply": "^1.0.0", "safe-regex-test": "^1.1.0", "set-proto": "^1.0.0", "stop-iteration-iterator": "^1.1.0", "string.prototype.trim": "^1.2.10", "string.prototype.trimend": "^1.0.9", "string.prototype.trimstart": "^1.0.8", "typed-array-buffer": "^1.0.3", "typed-array-byte-length": "^1.0.3", "typed-array-byte-offset": "^1.0.4", "typed-array-length": "^1.0.7", "unbox-primitive": "^1.1.0", "which-typed-array": "^1.1.19" } }, "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg=="],
 
+    "es-abstract-get": ["es-abstract-get@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "es-object-atoms": "^1.1.2", "is-callable": "^1.2.7", "object-inspect": "^1.13.4" } }, "sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg=="],
+
     "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="],
 
     "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
@@ -1119,7 +1066,7 @@
 
     "es-set-tostringtag": ["es-set-tostringtag@2.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA=="],
 
-    "es-to-primitive": ["es-to-primitive@1.3.0", "", { "dependencies": { "is-callable": "^1.2.7", "is-date-object": "^1.0.5", "is-symbol": "^1.0.4" } }, "sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g=="],
+    "es-to-primitive": ["es-to-primitive@1.3.1", "", { "dependencies": { "es-abstract-get": "^1.0.0", "es-errors": "^1.3.0", "is-callable": "^1.2.7", "is-date-object": "^1.1.0", "is-symbol": "^1.1.1" } }, "sha512-CxN9N56HYfd2m/acc/NOFrZQsN9kU4eh+2kk6A707Kz1krH8tKmfrs5RnftB8WNX80T0NS7vSQsDOlg23diR2g=="],
 
     "esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="],
 
@@ -1131,7 +1078,7 @@
 
     "eslint-config-prettier": ["eslint-config-prettier@10.1.8", "", { "peerDependencies": { "eslint": ">=7.0.0" }, "bin": { "eslint-config-prettier": "bin/cli.js" } }, "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w=="],
 
-    "eslint-plugin-turbo": ["eslint-plugin-turbo@2.9.18", "", { "dependencies": { "dotenv": "16.0.3" }, "peerDependencies": { "eslint": ">6.6.0", "turbo": ">2.0.0" } }, "sha512-WbvNDtwxyNQnX6ODtWs39EutD8a2Eoh25EgGkSqbqRpw8llHG/waCgBUwUUG7i1yh73d6p4HNBWEk+C+mvx9Xw=="],
+    "eslint-plugin-turbo": ["eslint-plugin-turbo@2.10.0", "", { "dependencies": { "dotenv": "16.0.3" }, "peerDependencies": { "eslint": ">6.6.0", "turbo": ">2.0.0" } }, "sha512-0HoDr8jdJ5oN9n2ip1DMDtFwmkXYc1ry/JsqGLA1fv6w3kdpvUinPm1FiJPcNnXLxO38N6It//YhW3tfk5j8TQ=="],
 
     "eslint-scope": ["eslint-scope@9.1.2", "", { "dependencies": { "@types/esrecurse": "^4.3.1", "@types/estree": "^1.0.8", "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ=="],
 
@@ -1153,7 +1100,7 @@
 
     "execa": ["execa@9.6.1", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "cross-spawn": "^7.0.6", "figures": "^6.1.0", "get-stream": "^9.0.0", "human-signals": "^8.0.1", "is-plain-obj": "^4.1.0", "is-stream": "^4.0.1", "npm-run-path": "^6.0.0", "pretty-ms": "^9.2.0", "signal-exit": "^4.1.0", "strip-final-newline": "^4.0.0", "yoctocolors": "^2.1.1" } }, "sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA=="],
 
-    "expect-type": ["expect-type@1.3.0", "", {}, "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA=="],
+    "expect-type": ["expect-type@1.4.0", "", {}, "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA=="],
 
     "fake-indexeddb": ["fake-indexeddb@6.2.5", "", {}, "sha512-CGnyrvbhPlWYMngksqrSSUT1BAVP49dZocrHuK0SvtR0D5TMs5wP0o3j7jexDJW01KSadjBp1M/71o/KR3nD1w=="],
 
@@ -1191,7 +1138,7 @@
 
     "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
 
-    "function.prototype.name": ["function.prototype.name@1.1.8", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "functions-have-names": "^1.2.3", "hasown": "^2.0.2", "is-callable": "^1.2.7" } }, "sha512-e5iwyodOHhbMr/yNrc7fDYG4qlbIvI5gajyzPnb5TCwyhjApznQh1BMFou9b30SevY43gCJKXycoCBjMbsuW0Q=="],
+    "function.prototype.name": ["function.prototype.name@1.2.0", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "functions-have-names": "^1.2.3", "has-property-descriptors": "^1.0.2", "hasown": "^2.0.4", "is-callable": "^1.2.7", "is-document.all": "^1.0.0" } }, "sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew=="],
 
     "functions-have-names": ["functions-have-names@1.2.3", "", {}, "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ=="],
 
@@ -1225,7 +1172,7 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "happy-dom": ["happy-dom@20.10.3", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-Hjdiy8RziuCcn5z04QI/rlsNuQoG8P0xxjgvsSMpi89cvIXIOcucQtiHS1yHSShxoBcSCeYqAskINmTiy/mlfw=="],
+    "happy-dom": ["happy-dom@20.10.6", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-6QD0ilzDDt93tX44y8tbmZdAcdTRYDhUP+Asgi6pC8Pp5IA3cvaZGyoVN/EGtlq9ziT65iPuBBn3ASLr6hCgVw=="],
 
     "has-bigints": ["has-bigints@1.1.0", "", {}, "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg=="],
 
@@ -1273,6 +1220,8 @@
 
     "is-date-object": ["is-date-object@1.1.0", "", { "dependencies": { "call-bound": "^1.0.2", "has-tostringtag": "^1.0.2" } }, "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg=="],
 
+    "is-document.all": ["is-document.all@1.0.0", "", { "dependencies": { "call-bound": "^1.0.4" } }, "sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g=="],
+
     "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
 
     "is-finalizationregistry": ["is-finalizationregistry@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg=="],
@@ -1305,7 +1254,7 @@
 
     "is-shared-array-buffer": ["is-shared-array-buffer@1.0.4", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A=="],
 
-    "is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+    "is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
 
     "is-string": ["is-string@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA=="],
 
@@ -1329,7 +1278,7 @@
 
     "jake": ["jake@10.9.4", "", { "dependencies": { "async": "^3.2.6", "filelist": "^1.0.4", "picocolors": "^1.1.1" }, "bin": { "jake": "bin/cli.js" } }, "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA=="],
 
-    "js-sha3": ["js-sha3@0.8.0", "", {}, "sha512-gF1cRrHhIzNfToc802P800N8PpXS+evLLXfsVpowqmAFR9uwbi89WvXg2QspOmXL8QL86J4T1EpFu+yUkwJY3Q=="],
+    "js-sha3": ["js-sha3@0.9.3", "", {}, "sha512-BcJPCQeLg6WjEx3FE591wVAevlli8lxsxm9/FzV4HXkV49TmBH38Yvrpce6fjbADGMKFrBMGTqrVz3qPIZ88Gg=="],
 
     "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
@@ -1401,11 +1350,11 @@
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
-    "multiformats": ["multiformats@14.0.0", "", {}, "sha512-iWK1RrAS58p2NDfeZFuSUSv3ZPewTIhsGbh/5NgeGGJwJmRljLxGtjRR3nkn+loG3zl+IrfR/W1590QnrSK+Gg=="],
+    "multiformats": ["multiformats@14.0.2", "", {}, "sha512-sF7F3gBKCyehzIhDwVuTRf79TZ8qWRz5NXwWYBX+4a+n22KcFqqcDYJvZr7tySrI0MhuTBXVOlo3qMTiAHC78g=="],
 
     "nanoevents": ["nanoevents@9.1.0", "", {}, "sha512-Jd0fILWG44a9luj8v5kED4WI+zfkkgwKyRQKItTtlPfEsh7Lznfi1kr8/iZ+XAIss4Qq5GqRB0qtWbaz9ceO/A=="],
 
-    "nanoid": ["nanoid@5.1.11", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg=="],
+    "nanoid": ["nanoid@3.3.15", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA=="],
 
     "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
 
@@ -1413,7 +1362,7 @@
 
     "node-fetch": ["node-fetch@2.7.0", "", { "dependencies": { "whatwg-url": "^5.0.0" }, "peerDependencies": { "encoding": "^0.1.0" }, "optionalPeers": ["encoding"] }, "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A=="],
 
-    "node-releases": ["node-releases@2.0.47", "", {}, "sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og=="],
+    "node-releases": ["node-releases@2.0.50", "", {}, "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg=="],
 
     "normalize-package-data": ["normalize-package-data@8.0.0", "", { "dependencies": { "hosted-git-info": "^9.0.0", "semver": "^7.3.5", "validate-npm-package-license": "^3.0.4" } }, "sha512-RWk+PI433eESQ7ounYxIp67CYuVsS1uYSonX3kA6ps/3LWfjVQa/ptEg6Y3T6uAMq1mWpX9PQ+qx+QaHpsc7gQ=="],
 
@@ -1425,13 +1374,13 @@
 
     "object.assign": ["object.assign@4.1.7", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0", "has-symbols": "^1.1.0", "object-keys": "^1.1.1" } }, "sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw=="],
 
-    "obug": ["obug@2.1.2", "", {}, "sha512-AWGB9WFcRXOQs48Z/udjI5ZcZMHXwX8XPByNpOydgcGsDLIzjGizhoMWJyKAWze7AVW/2W1i+/gPX4YtKe5cyg=="],
+    "obug": ["obug@2.1.3", "", {}, "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg=="],
 
     "onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
 
     "optionator": ["optionator@0.9.4", "", { "dependencies": { "deep-is": "^0.1.3", "fast-levenshtein": "^2.0.6", "levn": "^0.4.1", "prelude-ls": "^1.2.1", "type-check": "^0.4.0", "word-wrap": "^1.2.5" } }, "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g=="],
 
-    "ora": ["ora@9.4.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.2", "string-width": "^8.1.0" } }, "sha512-84cglkRILFxdtA8hAvLNdMrtBpPNBTrQ9/ulg0FA7xLMnD6mifv+enAIeRmvtv+WgdCE+LPGOfQmtJRrVaIVhQ=="],
+    "ora": ["ora@9.4.1", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.2", "string-width": "^8.1.0" } }, "sha512-6VlU9MLXbjVQD04AZCMX28hVtA5bUoadvUqO76MUCVA0ilwJbMiHsITRPfyVm6p/BC0Av/BXMujx39WCe1LEqw=="],
 
     "own-keys": ["own-keys@1.0.1", "", { "dependencies": { "get-intrinsic": "^1.2.6", "object-keys": "^1.1.1", "safe-push-apply": "^1.0.0" } }, "sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg=="],
 
@@ -1461,13 +1410,13 @@
 
     "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
 
-    "playwright": ["playwright@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA=="],
+    "playwright": ["playwright@1.61.1", "", { "dependencies": { "playwright-core": "1.61.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ=="],
 
-    "playwright-core": ["playwright-core@1.60.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA=="],
+    "playwright-core": ["playwright-core@1.61.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg=="],
 
     "pngjs": ["pngjs@5.0.0", "", {}, "sha512-40QW5YalBNfQo5yRYmiw7Yz6TKKVr3h6970B2YE+3fQpsWcrbj1PzJgxeJ19DRQjhMbKPIuMY8rFaXc8moolVw=="],
 
-    "polkadot-api": ["polkadot-api@2.1.6", "", { "dependencies": { "@polkadot-api/cli": "0.21.5", "@polkadot-api/ink-contracts": "0.6.3", "@polkadot-api/json-rpc-provider": "0.2.0", "@polkadot-api/known-chains": "0.11.5", "@polkadot-api/logs-provider": "0.2.0", "@polkadot-api/metadata-builders": "0.14.3", "@polkadot-api/metadata-compatibility": "0.6.3", "@polkadot-api/observable-client": "0.18.7", "@polkadot-api/pjs-signer": "0.7.3", "@polkadot-api/polkadot-signer": "0.1.6", "@polkadot-api/signer": "0.3.3", "@polkadot-api/sm-provider": "0.3.6", "@polkadot-api/smoldot": "0.4.5", "@polkadot-api/substrate-bindings": "0.20.3", "@polkadot-api/substrate-client": "0.7.0", "@polkadot-api/utils": "0.4.0", "@polkadot-api/ws-middleware": "0.3.5", "@polkadot-api/ws-provider": "0.9.0", "@rx-state/core": "^0.1.4" }, "peerDependencies": { "rxjs": ">=7.8.0" }, "bin": { "papi": "bin/cli.js", "polkadot-api": "bin/cli.js" } }, "sha512-2bfCqQPA0is/Y8Okwz50TtoUlPfWdA+1/C+Fr7HaDDdpcr6TDB9TjN0zcZktT32U4gwLiYa8bsSf8kmL4p0jsw=="],
+    "polkadot-api": ["polkadot-api@2.1.7", "", { "dependencies": { "@polkadot-api/cli": "0.21.6", "@polkadot-api/ink-contracts": "0.6.3", "@polkadot-api/json-rpc-provider": "0.2.0", "@polkadot-api/known-chains": "0.11.6", "@polkadot-api/logs-provider": "0.2.0", "@polkadot-api/metadata-builders": "0.14.3", "@polkadot-api/metadata-compatibility": "0.6.3", "@polkadot-api/observable-client": "0.18.7", "@polkadot-api/pjs-signer": "0.7.3", "@polkadot-api/polkadot-signer": "0.1.6", "@polkadot-api/signer": "0.3.3", "@polkadot-api/sm-provider": "0.3.6", "@polkadot-api/smoldot": "0.4.5", "@polkadot-api/substrate-bindings": "0.20.3", "@polkadot-api/substrate-client": "0.7.0", "@polkadot-api/utils": "0.4.0", "@polkadot-api/ws-middleware": "0.3.5", "@polkadot-api/ws-provider": "0.9.0", "@rx-state/core": "^0.1.4" }, "peerDependencies": { "rxjs": ">=7.8.0" }, "bin": { "papi": "bin/cli.js", "polkadot-api": "bin/cli.js" } }, "sha512-hSXzpbxtm4DkgBxC1m3ahqCiGTnOI75NmkWOJHlqgR3jmFYzPCMjuURpe8V1gKxzcDWMcffEmgwsM/4nm1Ox5Q=="],
 
     "possible-typed-array-names": ["possible-typed-array-names@1.1.0", "", {}, "sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg=="],
 
@@ -1505,7 +1454,7 @@
 
     "regjsgen": ["regjsgen@0.8.0", "", {}, "sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q=="],
 
-    "regjsparser": ["regjsparser@0.13.1", "", { "dependencies": { "jsesc": "~3.1.0" }, "bin": { "regjsparser": "bin/parser" } }, "sha512-dLsljMd9sqwRkby8zhO1gSg3PnJIBFid8f4CQj/sXx+7cKx+E7u0PKhZ+U4wmhx7EfmtvnA318oVaIkAB1lRJw=="],
+    "regjsparser": ["regjsparser@0.13.2", "", { "dependencies": { "jsesc": "~3.1.0" }, "bin": { "regjsparser": "bin/parser" } }, "sha512-NgRBy2Nx/bE+9F27nVHnqcN5HjyLmecqsqx2PJHu3/IEtADD4WuxuXIVExD5PoSDFVrl78dOonfcOe5O+5nbzQ=="],
 
     "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
 
@@ -1519,9 +1468,9 @@
 
     "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
 
-    "rolldown": ["rolldown@1.0.3", "", { "dependencies": { "@oxc-project/types": "=0.133.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.3", "@rolldown/binding-darwin-arm64": "1.0.3", "@rolldown/binding-darwin-x64": "1.0.3", "@rolldown/binding-freebsd-x64": "1.0.3", "@rolldown/binding-linux-arm-gnueabihf": "1.0.3", "@rolldown/binding-linux-arm64-gnu": "1.0.3", "@rolldown/binding-linux-arm64-musl": "1.0.3", "@rolldown/binding-linux-ppc64-gnu": "1.0.3", "@rolldown/binding-linux-s390x-gnu": "1.0.3", "@rolldown/binding-linux-x64-gnu": "1.0.3", "@rolldown/binding-linux-x64-musl": "1.0.3", "@rolldown/binding-openharmony-arm64": "1.0.3", "@rolldown/binding-wasm32-wasi": "1.0.3", "@rolldown/binding-win32-arm64-msvc": "1.0.3", "@rolldown/binding-win32-x64-msvc": "1.0.3" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g=="],
+    "rolldown": ["rolldown@1.1.3", "", { "dependencies": { "@oxc-project/types": "=0.137.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.1.3", "@rolldown/binding-darwin-arm64": "1.1.3", "@rolldown/binding-darwin-x64": "1.1.3", "@rolldown/binding-freebsd-x64": "1.1.3", "@rolldown/binding-linux-arm-gnueabihf": "1.1.3", "@rolldown/binding-linux-arm64-gnu": "1.1.3", "@rolldown/binding-linux-arm64-musl": "1.1.3", "@rolldown/binding-linux-ppc64-gnu": "1.1.3", "@rolldown/binding-linux-s390x-gnu": "1.1.3", "@rolldown/binding-linux-x64-gnu": "1.1.3", "@rolldown/binding-linux-x64-musl": "1.1.3", "@rolldown/binding-openharmony-arm64": "1.1.3", "@rolldown/binding-wasm32-wasi": "1.1.3", "@rolldown/binding-win32-arm64-msvc": "1.1.3", "@rolldown/binding-win32-x64-msvc": "1.1.3" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-1F1eEtUBtFvcGm1HQ9TiUIUHPQG7mSAODrhIzjxoUEFuo8OcbrGLiVLkevNgj84TE4lnHvnumwFjhJO5Eu135g=="],
 
-    "rollup": ["rollup@4.61.1", "", { "dependencies": { "@types/estree": "1.0.9" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.61.1", "@rollup/rollup-android-arm64": "4.61.1", "@rollup/rollup-darwin-arm64": "4.61.1", "@rollup/rollup-darwin-x64": "4.61.1", "@rollup/rollup-freebsd-arm64": "4.61.1", "@rollup/rollup-freebsd-x64": "4.61.1", "@rollup/rollup-linux-arm-gnueabihf": "4.61.1", "@rollup/rollup-linux-arm-musleabihf": "4.61.1", "@rollup/rollup-linux-arm64-gnu": "4.61.1", "@rollup/rollup-linux-arm64-musl": "4.61.1", "@rollup/rollup-linux-loong64-gnu": "4.61.1", "@rollup/rollup-linux-loong64-musl": "4.61.1", "@rollup/rollup-linux-ppc64-gnu": "4.61.1", "@rollup/rollup-linux-ppc64-musl": "4.61.1", "@rollup/rollup-linux-riscv64-gnu": "4.61.1", "@rollup/rollup-linux-riscv64-musl": "4.61.1", "@rollup/rollup-linux-s390x-gnu": "4.61.1", "@rollup/rollup-linux-x64-gnu": "4.61.1", "@rollup/rollup-linux-x64-musl": "4.61.1", "@rollup/rollup-openbsd-x64": "4.61.1", "@rollup/rollup-openharmony-arm64": "4.61.1", "@rollup/rollup-win32-arm64-msvc": "4.61.1", "@rollup/rollup-win32-ia32-msvc": "4.61.1", "@rollup/rollup-win32-x64-gnu": "4.61.1", "@rollup/rollup-win32-x64-msvc": "4.61.1", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-I4KW6iuRpuu2uHBLraZ1wNZe0DP7lnRha+VJ9tNaYVaVgKhW0aI3h4RYnoRPeql0flHm/Co55b7snEDcOfOJrA=="],
+    "rollup": ["rollup@4.62.2", "", { "dependencies": { "@types/estree": "1.0.9" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.62.2", "@rollup/rollup-android-arm64": "4.62.2", "@rollup/rollup-darwin-arm64": "4.62.2", "@rollup/rollup-darwin-x64": "4.62.2", "@rollup/rollup-freebsd-arm64": "4.62.2", "@rollup/rollup-freebsd-x64": "4.62.2", "@rollup/rollup-linux-arm-gnueabihf": "4.62.2", "@rollup/rollup-linux-arm-musleabihf": "4.62.2", "@rollup/rollup-linux-arm64-gnu": "4.62.2", "@rollup/rollup-linux-arm64-musl": "4.62.2", "@rollup/rollup-linux-loong64-gnu": "4.62.2", "@rollup/rollup-linux-loong64-musl": "4.62.2", "@rollup/rollup-linux-ppc64-gnu": "4.62.2", "@rollup/rollup-linux-ppc64-musl": "4.62.2", "@rollup/rollup-linux-riscv64-gnu": "4.62.2", "@rollup/rollup-linux-riscv64-musl": "4.62.2", "@rollup/rollup-linux-s390x-gnu": "4.62.2", "@rollup/rollup-linux-x64-gnu": "4.62.2", "@rollup/rollup-linux-x64-musl": "4.62.2", "@rollup/rollup-openbsd-x64": "4.62.2", "@rollup/rollup-openharmony-arm64": "4.62.2", "@rollup/rollup-win32-arm64-msvc": "4.62.2", "@rollup/rollup-win32-ia32-msvc": "4.62.2", "@rollup/rollup-win32-x64-gnu": "4.62.2", "@rollup/rollup-win32-x64-msvc": "4.62.2", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA=="],
 
     "rollup-plugin-esbuild": ["rollup-plugin-esbuild@6.2.1", "", { "dependencies": { "debug": "^4.4.0", "es-module-lexer": "^1.6.0", "get-tsconfig": "^4.10.0", "unplugin-utils": "^0.2.4" }, "peerDependencies": { "esbuild": ">=0.18.0", "rollup": "^1.20.0 || ^2.0.0 || ^3.0.0 || ^4.0.0" } }, "sha512-jTNOMGoMRhs0JuueJrJqbW8tOwxumaWYq+V5i+PD+8ecSCVkuX27tGW7BXqDgoULQ55rO7IdNxPcnsWtshz3AA=="],
 
@@ -1535,9 +1484,9 @@
 
     "scale-ts": ["scale-ts@1.6.1", "", {}, "sha512-PBMc2AWc6wSEqJYBDPcyCLUj9/tMKnLX70jLOSndMtcUoLQucP/DM0vnQo1wJAYjTrQiq8iG9rD0q6wFzgjH7g=="],
 
-    "semver": ["semver@7.8.2", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ=="],
+    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
 
-    "serialize-javascript": ["serialize-javascript@7.0.5", "", {}, "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw=="],
+    "serialize-javascript": ["serialize-javascript@7.0.6", "", {}, "sha512-ATTK5Q4gFVg0YDp1my2vqygyvhcklD/UV5GIlYHooGTn/NogJqIzpetkD6E5kmuVULqz/S9inUL25XcAgDRJQg=="],
 
     "set-blocking": ["set-blocking@2.0.0", "", {}, "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw=="],
 
@@ -1551,7 +1500,7 @@
 
     "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
 
-    "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="],
+    "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
 
     "side-channel-list": ["side-channel-list@1.0.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4" } }, "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w=="],
 
@@ -1597,9 +1546,9 @@
 
     "string.prototype.matchall": ["string.prototype.matchall@4.0.12", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "es-abstract": "^1.23.6", "es-errors": "^1.3.0", "es-object-atoms": "^1.0.0", "get-intrinsic": "^1.2.6", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "internal-slot": "^1.1.0", "regexp.prototype.flags": "^1.5.3", "set-function-name": "^2.0.2", "side-channel": "^1.1.0" } }, "sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA=="],
 
-    "string.prototype.trim": ["string.prototype.trim@1.2.10", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.2", "define-data-property": "^1.1.4", "define-properties": "^1.2.1", "es-abstract": "^1.23.5", "es-object-atoms": "^1.0.0", "has-property-descriptors": "^1.0.2" } }, "sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA=="],
+    "string.prototype.trim": ["string.prototype.trim@1.2.11", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-data-property": "^1.1.4", "define-properties": "^1.2.1", "es-abstract": "^1.24.2", "es-object-atoms": "^1.1.2", "has-property-descriptors": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w=="],
 
-    "string.prototype.trimend": ["string.prototype.trimend@1.0.9", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.2", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0" } }, "sha512-G7Ok5C6E/j4SGfyLCloXTrngQIQU3PWtXGst3yM7Bea9FRURf1S42ZHlZZtsNque2FN2PoUhfZXYLNWwEr4dLQ=="],
+    "string.prototype.trimend": ["string.prototype.trimend@1.0.10", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-properties": "^1.2.1", "es-object-atoms": "^1.1.2" } }, "sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw=="],
 
     "string.prototype.trimstart": ["string.prototype.trimstart@1.0.8", "", { "dependencies": { "call-bind": "^1.0.7", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0" } }, "sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg=="],
 
@@ -1637,11 +1586,11 @@
 
     "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "turbo": ["turbo@2.9.18", "", { "optionalDependencies": { "@turbo/darwin-64": "2.9.18", "@turbo/darwin-arm64": "2.9.18", "@turbo/linux-64": "2.9.18", "@turbo/linux-arm64": "2.9.18", "@turbo/windows-64": "2.9.18", "@turbo/windows-arm64": "2.9.18" }, "bin": { "turbo": "bin/turbo" } }, "sha512-bwabv6PupzeavybzEoArBAkwq5fnzwf8OFnRtpHwnviFWuwJPFxtyH+aVp36TmIqK3aYYgtTJ3J0m2ysxxSzQg=="],
+    "turbo": ["turbo@2.10.0", "", { "optionalDependencies": { "@turbo/darwin-64": "2.10.0", "@turbo/darwin-arm64": "2.10.0", "@turbo/linux-64": "2.10.0", "@turbo/linux-arm64": "2.10.0", "@turbo/windows-64": "2.10.0", "@turbo/windows-arm64": "2.10.0" }, "bin": { "turbo": "bin/turbo" } }, "sha512-o016H9PPtuH2deb3mh3Vci3Avfi9UYgM/RONQisY7HnloupP0IFSbFS3gFYJgFJP8nwBrByHWFQIDa8T2zIXPw=="],
 
     "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
 
-    "type-fest": ["type-fest@5.7.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg=="],
+    "type-fest": ["type-fest@0.16.0", "", {}, "sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg=="],
 
     "typed-array-buffer": ["typed-array-buffer@1.0.3", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "is-typed-array": "^1.1.14" } }, "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw=="],
 
@@ -1653,7 +1602,7 @@
 
     "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
 
-    "typescript-eslint": ["typescript-eslint@8.61.0", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.61.0", "@typescript-eslint/parser": "8.61.0", "@typescript-eslint/typescript-estree": "8.61.0", "@typescript-eslint/utils": "8.61.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-8y31Rd0eGTrDKqhy6vT0HtzhN+YLjQizwX3aA3hPXP/ynSfnrBXcQY5IzsP9/DM7+klX4IUncZZjkchP0z+rUw=="],
+    "typescript-eslint": ["typescript-eslint@8.62.0", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.62.0", "@typescript-eslint/parser": "8.62.0", "@typescript-eslint/typescript-estree": "8.62.0", "@typescript-eslint/utils": "8.62.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-8QxXi+ZACKX0kaqO4gY8kn0RSD9gFfaHDWwjqtEN48aWCBkX4MJaufWN+c3BzlrXLOxfywDL8CaoqUwcRq4j4Q=="],
 
     "uint8-varint": ["uint8-varint@3.0.0", "", { "dependencies": { "uint8arraylist": "^3.0.1", "uint8arrays": "^6.1.0" } }, "sha512-S4DdpXBaLwKcFo7f0bWzWfHjbZ/i3QhM842qn+ZvHjxqFCfUcEB9SQNcmI69S+zMlcmIcKxsk9Iyw77S2Kxv6Q=="],
 
@@ -1691,13 +1640,13 @@
 
     "varint": ["varint@6.0.0", "", {}, "sha512-cXEIW6cfr15lFv563k4GuVuW/fiwjknytD37jIOLSdSWuOI6WnO/oKwmP2FQTU2l01LP8/M5TSAJpzUaGe3uWg=="],
 
-    "vite": ["vite@8.0.16", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.15", "rolldown": "1.0.3", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.18", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw=="],
+    "vite": ["vite@8.1.0", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.15", "rolldown": "~1.1.2", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.3.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-BuJcQK/56NQTWDGn4ABea3q4SSBdNPWwNZKTkkUpcMPnLoquSYH8llRtSUIgoL1KSCpHt5eghLShn50mH36y7Q=="],
 
     "vite-plugin-pwa": ["vite-plugin-pwa@1.3.0", "", { "dependencies": { "debug": "^4.3.6", "pretty-bytes": "^6.1.1", "tinyglobby": "^0.2.10", "workbox-build": "^7.4.1", "workbox-window": "^7.4.1" }, "peerDependencies": { "@vite-pwa/assets-generator": "^1.0.0", "vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["@vite-pwa/assets-generator"] }, "sha512-c5kMgN+ITrOtHXp8PAtk2uOIEea6XjP/unCGxOWWBzQ6qa65qj/awHg0wf+QF9E/2u9vh86LqxPwzEPNbM2r5A=="],
 
     "vite-plugin-wasm": ["vite-plugin-wasm@3.6.0", "", { "peerDependencies": { "vite": "^2 || ^3 || ^4 || ^5 || ^6 || ^7 || ^8" } }, "sha512-mL/QPziiIA4RAA6DkaZZzOstdwbW5jO4Vz7Zenj0wieKWBlNvIvX5L5ljum9lcUX0ShNfBgCNLKTjNkRVVqcsw=="],
 
-    "vitest": ["vitest@4.1.8", "", { "dependencies": { "@vitest/expect": "4.1.8", "@vitest/mocker": "4.1.8", "@vitest/pretty-format": "4.1.8", "@vitest/runner": "4.1.8", "@vitest/snapshot": "4.1.8", "@vitest/spy": "4.1.8", "@vitest/utils": "4.1.8", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.8", "@vitest/browser-preview": "4.1.8", "@vitest/browser-webdriverio": "4.1.8", "@vitest/coverage-istanbul": "4.1.8", "@vitest/coverage-v8": "4.1.8", "@vitest/ui": "4.1.8", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig=="],
+    "vitest": ["vitest@4.1.9", "", { "dependencies": { "@vitest/expect": "4.1.9", "@vitest/mocker": "4.1.9", "@vitest/pretty-format": "4.1.9", "@vitest/runner": "4.1.9", "@vitest/snapshot": "4.1.9", "@vitest/spy": "4.1.9", "@vitest/utils": "4.1.9", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.9", "@vitest/browser-preview": "4.1.9", "@vitest/browser-webdriverio": "4.1.9", "@vitest/coverage-istanbul": "4.1.9", "@vitest/coverage-v8": "4.1.9", "@vitest/ui": "4.1.9", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "./vitest.mjs" } }, "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ=="],
 
     "webidl-conversions": ["webidl-conversions@4.0.2", "", {}, "sha512-YQ+BmxuTgd6UXZW3+ICGfyqRyHXVlD5GtQr5+qjiNW7bF0cqrzX500HVXPBOvgXb5YnzDd+h0zqyv61KUD7+Sg=="],
 
@@ -1715,7 +1664,7 @@
 
     "which-module": ["which-module@2.0.1", "", {}, "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ=="],
 
-    "which-typed-array": ["which-typed-array@1.1.21", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.9", "call-bound": "^1.0.4", "for-each": "^0.3.5", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2" } }, "sha512-zbRA8cVm6io/d5W8uIe2hblzN76/Wm3v/yiythQvr+dpBWeqhPSWIDNj4zOyHi4zKbMK6DN34Xsr9jPHJERAEw=="],
+    "which-typed-array": ["which-typed-array@1.1.22", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.9", "call-bound": "^1.0.4", "for-each": "^0.3.5", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2" } }, "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw=="],
 
     "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
 
@@ -1787,42 +1736,34 @@
 
     "@babel/preset-env/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "@commander-js/extra-typings/commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
+    "@dotli/ui/@parity/truapi": ["@parity/truapi@file:../../js/packages/truapi", { "dependencies": { "@noble/hashes": "^2.2.0", "neverthrow": "^8.2.0", "scale-ts": "^1.6.1" }, "devDependencies": { "typescript": "^6.0" } }],
 
-    "@ensdomains/content-hash/multiformats": ["multiformats@12.1.3", "", {}, "sha512-eajQ/ZH7qXZQR2AgtfpmSMizQzmyYVmCql7pdhldPuYQi4atACekbJaQplk6dWyIi10jCaFnd6pqvcEFXjbaJw=="],
-
-    "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
+    "@dotli/ui/@parity/truapi-host-wasm": ["@parity/truapi-host-wasm@file:../../js/packages/truapi-host-wasm", { "dependencies": { "@parity/truapi": "file:../truapi" }, "devDependencies": { "typescript": "^5.7" } }],
 
-    "@multiformats/sha3/multiformats": ["multiformats@9.9.0", "", {}, "sha512-HoMUjhH9T8DDBNT+6xzkrd9ga/XiBI4xLr58LJACwK6G3HTOPeMz4nB4KJs33L2BelrIJa7P0VuNaVF3hMYfjg=="],
+    "@ensdomains/content-hash/multiformats": ["multiformats@13.4.2", "", {}, "sha512-eh6eHCrRi1+POZ3dA+Dq1C6jhP1GNtr9CRINMb67OKzqW9I5DUuZM/3jLPlzhgpGeiNUlEGEbkCYChXMCc/8DQ=="],
 
-    "@novasamatech/sdk-statement/@polkadot-api/substrate-bindings": ["@polkadot-api/substrate-bindings@0.20.1", "", { "dependencies": { "@noble/hashes": "^2.2.0", "@polkadot-api/utils": "0.4.0", "@scure/base": "^2.0.0", "scale-ts": "^1.6.1" } }, "sha512-AU7uUqSFt6nH8wrD7DJZkmrFs1QjLeA/Z4Qmf03ExUqsKDQ893pPjbQU2qAaPvWzDmaJotT8B8DENRqEUt8ruw=="],
-
-    "@polkadot-api/cli/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
-
-    "@polkadot-api/cli/commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
+    "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
-    "@polkadot-api/smoldot/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
+    "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
-    "@polkadot-labs/hdkd-helpers/@scure/sr25519": ["@scure/sr25519@1.0.0", "", { "dependencies": { "@noble/curves": "~2.0.0", "@noble/hashes": "~2.0.0" } }, "sha512-b+uhK5akMINXZP95F3gJGcb5CMKYxf+q55fwMl0GoBwZDbWolmGNi1FrBSwuaZX5AhqS2byHiAueZgtDNpot2A=="],
+    "@scure/sr25519/@noble/curves": ["@noble/curves@2.0.1", "", { "dependencies": { "@noble/hashes": "2.0.1" } }, "sha512-vs1Az2OOTBiP4q0pwjW5aF0xp9n4MxVrmkFBxc6EKZc6ddYx5gaZiAsZoq0uRRXWbi3AT/sBqn05eRPtn1JCPw=="],
 
-    "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+    "@scure/sr25519/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
 
     "@sentry/bundler-plugin-core/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "@sentry/bundler-plugin-core/glob": ["glob@13.0.6", "", { "dependencies": { "minimatch": "^10.2.2", "minipass": "^7.1.3", "path-scurry": "^2.0.2" } }, "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw=="],
 
-    "@types/qrcode/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
-
-    "@types/ws/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
-
     "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
 
     "babel-plugin-polyfill-corejs2/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "buffer-image-size/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
+    "execa/is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
 
     "filelist/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
 
+    "get-stream/is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+
     "hosted-git-info/lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
 
     "node-fetch/whatwg-url": ["whatwg-url@5.0.0", "", { "dependencies": { "tr46": "~0.0.3", "webidl-conversions": "^3.0.0" } }, "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw=="],
@@ -1839,15 +1780,13 @@
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
-    "postcss/nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
+    "read-pkg/type-fest": ["type-fest@5.7.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg=="],
 
     "rollup-plugin-esbuild/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
 
     "source-map-support/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "tempy/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
-
-    "tempy/type-fest": ["type-fest@0.16.0", "", {}, "sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg=="],
+    "terser/commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
 
     "workbox-build/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
@@ -1861,9 +1800,9 @@
 
     "@apideck/better-ajv-errors/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
-    "@polkadot-labs/hdkd-helpers/@scure/sr25519/@noble/curves": ["@noble/curves@2.0.1", "", { "dependencies": { "@noble/hashes": "2.0.1" } }, "sha512-vs1Az2OOTBiP4q0pwjW5aF0xp9n4MxVrmkFBxc6EKZc6ddYx5gaZiAsZoq0uRRXWbi3AT/sBqn05eRPtn1JCPw=="],
+    "@dotli/ui/@parity/truapi-host-wasm/@parity/truapi": ["@parity/truapi@file:../../js/packages/truapi", {}],
 
-    "@polkadot-labs/hdkd-helpers/@scure/sr25519/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
+    "@dotli/ui/@parity/truapi-host-wasm/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
 
     "filelist/minimatch/brace-expansion": ["brace-expansion@2.1.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA=="],
 
diff --git a/packages/auth/eslint.config.js b/packages/auth/eslint.config.js
deleted file mode 100644
index 46d277e..0000000
--- a/packages/auth/eslint.config.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { config } from "@dotli/eslint-config/vite";
-
-export default [
-  ...config,
-  {
-    languageOptions: {
-      parserOptions: {
-        tsconfigRootDir: import.meta.dirname,
-      },
-    },
-  },
-];
diff --git a/packages/auth/package.json b/packages/auth/package.json
deleted file mode 100644
index a8d758a..0000000
--- a/packages/auth/package.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "name": "@dotli/auth",
-  "private": true,
-  "license": "AGPL-3.0-only",
-  "version": "0.6.0",
-  "type": "module",
-  "exports": {
-    "./*": "./src/*"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit",
-    "lint": "bunx eslint src/",
-    "test": "vitest run"
-  },
-  "devDependencies": {
-    "@dotli/eslint-config": "workspace:*",
-    "@dotli/typescript-config": "workspace:*",
-    "@scure/sr25519": "^2.2.0",
-    "eslint": "^10.5.0",
-    "happy-dom": "^20.10.3",
-    "typescript": "~6.0.3",
-    "vite": "^8.0.16",
-    "vitest": "^4.1.8"
-  },
-  "dependencies": {
-    "@dotli/config": "workspace:*",
-    "@dotli/metrics": "workspace:*",
-    "@dotli/protocol": "workspace:*",
-    "@dotli/resolver": "workspace:*",
-    "@dotli/shared": "workspace:*",
-    "@noble/hashes": "^2.2.0",
-    "@novasamatech/host-api": "0.8.9",
-    "@novasamatech/host-papp": "0.8.9",
-    "@novasamatech/sdk-statement": "^0.6.0",
-    "@novasamatech/statement-store": "0.8.9",
-    "@novasamatech/storage-adapter": "0.8.9",
-    "@scure/sr25519": "^2.2.0",
-    "neverthrow": "^8.2.0",
-    "polkadot-api": "^2.1.6",
-    "scale-ts": "^1.6.1"
-  }
-}
diff --git a/packages/auth/src/account.ts b/packages/auth/src/account.ts
deleted file mode 100644
index 11ebb5c..0000000
--- a/packages/auth/src/account.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Product account derivation for dot.li.
-//
-// Derives a product-specific public key from the user's root public key
-// using HDKD soft derivation through junctions ['product', dotDomain, derivationIndex].
-// Mirrors context__desktop/src/domains/product/account/service.ts
-
-import { HDKD } from "@scure/sr25519";
-import { blake2b } from "@noble/hashes/blake2.js";
-import type { CodecType, ProductAccountId } from "@novasamatech/host-api";
-import { EXECUTABLE_KINDS } from "@dotli/shared/executables";
-import { AccountId } from "polkadot-api";
-import { str, u64 } from "scale-ts";
-
-const JUNCTION_ID_LEN = 32;
-const NUMERIC_JUNCTION_RE = /^\d+$/;
-
-const createChainCode = (code: string): Uint8Array => {
-  const encoded = NUMERIC_JUNCTION_RE.test(code)
-    ? u64.enc(BigInt(code))
-    : str.enc(code);
-  if (encoded.length > JUNCTION_ID_LEN) {
-    return blake2b(encoded, { dkLen: JUNCTION_ID_LEN });
-  }
-
-  const chainCode = new Uint8Array(JUNCTION_ID_LEN);
-  chainCode.set(encoded);
-  return chainCode;
-};
-
-export const deriveProductPublicKey = (
-  rootPublicKey: Uint8Array,
-  productId: string,
-  derivationIndex: number,
-): Uint8Array => {
-  const junctions = ["product", productId, String(derivationIndex)];
-
-  return junctions.reduce((publicKey, junction) => {
-    return HDKD.publicSoft(publicKey, createChainCode(junction));
-  }, rootPublicKey);
-};
-
-const EXECUTABLE_SUBNAME_PREFIX = new RegExp(
-  `^(?:${EXECUTABLE_KINDS.join("|")})\\.`,
-  "i",
-);
-
-export const stripExecutableSubname = (productId: string): string => {
-  const withoutSubname = productId.replace(EXECUTABLE_SUBNAME_PREFIX, "");
-  const isValidBaseName = withoutSubname.split(".").length >= 2;
-  return isValidBaseName ? withoutSubname : productId;
-};
-
-/**
- * Normalize a `[productId, derivationIndex]` tuple by stripping the executable
- * subname, so every executable of a product resolves to one derived account.
- * Mirrors polkadot-desktop `productAccountService.normalizeProductAccountId`.
- */
-export const normalizeProductAccountId = (
-  productAccountId: CodecType<typeof ProductAccountId>,
-): CodecType<typeof ProductAccountId> => [
-  stripExecutableSubname(productAccountId[0]),
-  productAccountId[1],
-];
-
-const ss58Codec = AccountId();
-
-/**
- * SS58-encode a 32-byte public key with the substrate-generic prefix (42).
- *
- * Matches the format the wallet uses when it hands a `signer` string back
- * to legacy-aware products, so byte-for-byte string comparison works for
- * `signPayloadWithLegacyAccount` and `signRawWithLegacyAccount` round-trips.
- */
-export const productPublicKeyToAddress = (publicKey: Uint8Array): string =>
-  ss58Codec.dec(publicKey);
-
-/**
- * Inverse of `productPublicKeyToAddress`: decode an SS58 address string back to
- * its 32-byte public key. Used to turn a legacy account's `signer` address
- * (the wire format products send) into the `AccountId` bytes host-papp's
- * `signRawLegacy` expects. Throws on a malformed address.
- */
-export const productAddressToPublicKey = (address: string): Uint8Array =>
-  ss58Codec.enc(address);
-
-// NOTE: Uncomment when derived product accounts get their own network
-// allowance (quota) on People Chain. Currently only the root session account
-// has allowance, so createProof signs with the root ssSecret directly.
-// Once per-product allowance is supported, use this in handleStatementStoreCreateProof
-// to sign with the product-derived key instead.
-// export const deriveProductSecretKey = (
-//   rootSecret: Uint8Array,
-//   productId: string,
-//   derivationIndex: number,
-// ): Uint8Array => {
-//   const junctions = ["product", productId, String(derivationIndex)];
-//   return junctions.reduce((secret, junction) => {
-//     return HDKD.secretSoft(secret, createChainCode(junction));
-//   }, rootSecret);
-// };
diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts
deleted file mode 100644
index 98d6370..0000000
--- a/packages/auth/src/auth.ts
+++ /dev/null
@@ -1,565 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Authentication for dot.li via the Polkadot App (host-papp).
-//
-// Wraps @novasamatech/host-papp for QR-code-based pairing with the Polkadot App.
-// Provides a simple pub-sub interface for the top bar UI.
-
-import {
-  createPappAdapter,
-  type AllowanceService,
-  type PappAdapter,
-  type PairingStatus,
-  type Identity,
-  type UserSession,
-} from "@novasamatech/host-papp";
-import { createSharedAuthStorageAdapter } from "./shared-storage";
-import {
-  createLazyClient,
-  createPapiStatementStoreAdapter,
-  type StatementStoreAdapter,
-} from "@novasamatech/statement-store";
-import type { Statement } from "@novasamatech/sdk-statement";
-import { toHex } from "@novasamatech/host-api";
-import { getWsProvider } from "polkadot-api/ws";
-import { createRemoteChainProvider } from "@dotli/protocol/client";
-import { ok, ResultAsync, type Result } from "neverthrow";
-import { SITE_ID } from "@dotli/config/config";
-import { getActiveServicesConfig } from "@dotli/config/network";
-import { getBackend } from "@dotli/config/mode";
-import { log } from "@dotli/shared/log";
-import { m } from "@dotli/metrics/metrics";
-import * as S from "@dotli/metrics/spans";
-import { SHARED_AUTH_SESSION_KEY } from "@dotli/protocol/auth-storage";
-
-declare const __DOTLI_VERSION__: string | undefined;
-
-export type AuthState =
-  | { status: "idle" }
-  | { status: "pairing"; payload: string }
-  | { status: "attesting" }
-  | { status: "authenticated"; session: UserSession; identity: Identity | null }
-  | { status: "error"; message: string };
-
-type AuthListener = (state: AuthState) => void;
-
-let adapter: PappAdapter | null = null;
-let sharedStorage: ReturnType<typeof createSharedAuthStorageAdapter> | null =
-  null;
-let statementStoreInstance: StatementStoreAdapter | null = null;
-let storeReadyResolvers: ((store: StatementStoreAdapter) => void)[] = [];
-let currentState: AuthState = { status: "idle" };
-let identitySub: { unsubscribe: () => void } | null = null;
-const listeners = new Set<AuthListener>();
-
-function setState(state: AuthState): void {
-  log.warn("[dot.li auth]", state.status, state);
-  currentState = state;
-  for (const fn of listeners) {
-    fn(state);
-  }
-}
-
-export function getAuthState(): AuthState {
-  return currentState;
-}
-
-export function onAuthStateChange(fn: AuthListener): () => void {
-  listeners.add(fn);
-  return () => listeners.delete(fn);
-}
-
-export function getStatementStore(): StatementStoreAdapter | null {
-  return statementStoreInstance;
-}
-
-export function getAllowanceService(): AllowanceService | null {
-  return adapter?.allowance ?? null;
-}
-
-export function onStatementStoreReady(): Promise<StatementStoreAdapter> {
-  if (statementStoreInstance) {
-    return Promise.resolve(statementStoreInstance);
-  }
-  return new Promise((resolve) => {
-    storeReadyResolvers.push(resolve);
-  });
-}
-
-export async function readSessionSecret(
-  sessionId: string,
-): Promise<Uint8Array | null> {
-  if (!adapter) {
-    return null;
-  }
-  const result = await adapter.secrets.read(sessionId);
-  if (result.isErr() || !result.value) {
-    return null;
-  }
-  return result.value.ssSecret;
-}
-
-let initialized = false;
-
-function toHexSafe(value: unknown): string {
-  if (value instanceof Uint8Array) {
-    return toHex(value);
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  return String(value);
-}
-
-function logStatement(prefix: string, stmt: Statement): void {
-  const keys = Object.keys(stmt);
-  log.warn(`${prefix} keys:`, keys);
-  if (stmt.channel !== undefined) {
-    log.warn(`${prefix} channel:`, stmt.channel);
-  }
-  if (stmt.topics !== undefined) {
-    log.warn(`${prefix} topics:`, stmt.topics);
-  }
-  if (stmt.data !== undefined) {
-    log.warn(
-      `${prefix} data (${String(stmt.data.length)} bytes):`,
-      toHexSafe(stmt.data),
-    );
-  }
-}
-
-function createLoggingStatementStore(
-  inner: StatementStoreAdapter,
-  queryTimeoutMs: number,
-): StatementStoreAdapter {
-  return {
-    queryStatements(filter) {
-      // sdk-statement's getStatements implements "query" as a subscribe that
-      // waits for an event with `data.remaining === 0`. Smoldot only emits the
-      // statement_statement notification when fresh statements arrive via
-      // gossip, never as an empty-initial-page sentinel, so for a topic
-      // with no statements the query hangs forever. That leaves
-      // session.init() stuck in 'initialization' and silently queues every
-      // subsequent submitRequestMessage. Race against a short timeout
-      // resolving to [] so init can proceed. The parallel subscribe still
-      // delivers new statements normally.
-      const inner$: Promise<Result<Statement[], Error>> = Promise.resolve(
-        inner.queryStatements(filter),
-      );
-      const timeout$ = new Promise<Result<Statement[], Error>>((resolve) => {
-        setTimeout(() => {
-          resolve(ok([]));
-        }, queryTimeoutMs);
-      });
-      return new ResultAsync<Statement[], Error>(
-        Promise.race([inner$, timeout$]),
-      );
-    },
-    subscribeStatements(filter, callback) {
-      const topics = "matchAll" in filter ? filter.matchAll : filter.matchAny;
-      log.warn(
-        "[dotli ss] subscribeStatements called, topics count:",
-        topics.length,
-      );
-      for (let i = 0; i < topics.length; i++) {
-        log.warn(
-          `[dotli ss]   topic[${String(i)}] (${String(topics[i].length)} bytes):`,
-          toHexSafe(topics[i]),
-        );
-      }
-      return inner.subscribeStatements(filter, (page) => {
-        log.warn(
-          "[dotli ss] >>> RECEIVED",
-          page.statements.length,
-          "statements (isComplete:",
-          page.isComplete,
-          ")",
-        );
-        for (let i = 0; i < page.statements.length; i++) {
-          logStatement(`[dotli ss]   stmt[${String(i)}]`, page.statements[i]);
-        }
-        return callback(page);
-      });
-    },
-    submitStatement(statement) {
-      log.warn("[dotli ss] submitStatement called");
-      logStatement("[dotli ss]  ", statement);
-      const result = inner.submitStatement(statement);
-      result.map(() => {
-        log.warn("[dotli ss] submitStatement OK");
-      });
-      result.mapErr((e: Error) => {
-        if (e.message.toLowerCase().includes("expiry too low")) {
-          log.warn(
-            "[dotli ss] submitStatement ExpiryTooLow (non-critical):",
-            e.message,
-          );
-        } else {
-          log.error("[dotli ss] submitStatement ERROR:", e);
-        }
-      });
-      return result;
-    },
-  };
-}
-
-interface NavigatorUAData {
-  getHighEntropyValues(
-    hints: string[],
-  ): Promise<{ platform?: string; platformVersion?: string }>;
-}
-
-function getPlatformTypeFromUserAgent(): string {
-  const agent = navigator.userAgent;
-  if (agent.includes("Win")) {
-    return "Windows";
-  }
-  if (agent.includes("Mac")) {
-    return "macOS";
-  }
-  if (agent.includes("Linux")) {
-    return "Linux";
-  }
-  return "Unknown";
-}
-
-async function getPlatformInfo(): Promise<{
-  platformType: string;
-  platformVersion?: string;
-}> {
-  const ua = (navigator as { userAgentData?: NavigatorUAData }).userAgentData;
-  if (ua === undefined) {
-    return { platformType: getPlatformTypeFromUserAgent() };
-  }
-  try {
-    const hints = await ua.getHighEntropyValues([
-      "platform",
-      "platformVersion",
-    ]);
-    return {
-      platformType: hints.platform ?? getPlatformTypeFromUserAgent(),
-      platformVersion: hints.platformVersion ?? undefined,
-    };
-  } catch (err: unknown) {
-    log.warn("[dot.li auth] Failed to read platform hints:", err);
-    return { platformType: getPlatformTypeFromUserAgent() };
-  }
-}
-
-export async function initAuth(): Promise<void> {
-  if (initialized) {
-    return;
-  }
-  initialized = true;
-
-  const siteId = SITE_ID;
-  const storage = createSharedAuthStorageAdapter(siteId);
-  sharedStorage = storage;
-  // Statement-store transport tracks the main Backend. smoldot variants
-  // route through the protocol bridge. `rpc-gateway` uses the WS provider
-  // directly.
-  const useSmoldotForAuth = getBackend() !== "rpc-gateway";
-  // Auth people chain endpoint resolved against the active network's services
-  // config. The smoldot path routes through the protocol bridge by genesis.
-  // The WS path dials the first RPC endpoint configured for the active people chain.
-  const people = getActiveServicesConfig().people;
-  let peopleProvider;
-  let peopleRpcEndpoint: string | null = null;
-  if (useSmoldotForAuth) {
-    const remote = createRemoteChainProvider(people.genesis);
-    if (remote === null) {
-      throw new Error(
-        "[dot.li auth] Protocol bridge does not support People Paseo chain",
-      );
-    }
-    peopleProvider = remote;
-  } else {
-    if (people.rpcs.length === 0) {
-      throw new Error(
-        "[dot.li auth] Active network has no public People RPC endpoint",
-      );
-    }
-    peopleRpcEndpoint = people.rpcs[0];
-    peopleProvider = getWsProvider([peopleRpcEndpoint], {
-      heartbeatTimeout: 120_000, // the default 40s is too aggressive through tunnels
-    });
-  }
-  const lazyClient = createLazyClient(peopleProvider);
-  if (peopleRpcEndpoint !== null) {
-    m.setDefaults({ people_rpc_endpoint: peopleRpcEndpoint });
-  }
-
-  // Short timeout for the smoldot path covers its empty-topic hang. WS is a
-  // generous upper bound that should never trip in practice.
-  const queryStatementsTimeoutMs = useSmoldotForAuth ? 3_000 : 30_000;
-  const rawStatementStore = createPapiStatementStoreAdapter(lazyClient);
-  const statementStore = createLoggingStatementStore(
-    rawStatementStore,
-    queryStatementsTimeoutMs,
-  );
-  statementStoreInstance = statementStore;
-  for (const resolve of storeReadyResolvers) {
-    resolve(statementStore);
-  }
-  storeReadyResolvers = [];
-
-  const platformInfo = await getPlatformInfo();
-
-  adapter = createPappAdapter({
-    appId: siteId,
-    hostMetadata: {
-      hostName: "Polkadot Web",
-      hostIcon: "https://dot.li/dotli.png",
-      hostVersion:
-        typeof __DOTLI_VERSION__ === "string" ? __DOTLI_VERSION__ : undefined,
-      ...platformInfo,
-    },
-    adapters: { lazyClient, statementStore, storage },
-  });
-
-  // Check for the existing session
-  const stopRestore = m.timer(S.AUTH_SESSION_RESTORE);
-  const sessions = adapter.sessions.sessions.read();
-  if (sessions.length > 0) {
-    resolveIdentityAndSetAuth(sessions[0]);
-  }
-  stopRestore();
-  m.breadcrumb("Auth module loaded");
-
-  // Subscribe to session changes (handles reconnects). When an authenticated
-  // session disappears — whether from the Log Out button or a phone-initiated
-  // disconnect — this is the single place that runs the local teardown, so both
-  // paths reset identically.
-  adapter.sessions.sessions.subscribe((sessions: UserSession[]) => {
-    if (sessions.length > 0 && currentState.status !== "authenticated") {
-      resolveIdentityAndSetAuth(sessions[0]);
-    } else if (
-      sessions.length === 0 &&
-      currentState.status === "authenticated"
-    ) {
-      const { session } = currentState;
-      identitySub?.unsubscribe();
-      identitySub = null;
-      setState({ status: "idle" });
-      void teardownAfterDisconnect(session);
-    }
-  });
-}
-
-async function teardownAfterDisconnect(session: UserSession): Promise<void> {
-  if (sharedStorage) {
-    await Promise.all([
-      sharedStorage.clear(`UserSecretsV2_${session.id}`),
-      sharedStorage.clear(`AllowanceKeys_${session.id}`),
-      sharedStorage.clear("DeviceIdentity"),
-    ]);
-  }
-  adapter?.sso.abortAuthentication();
-}
-
-function resolveIdentityAndSetAuth(session: UserSession): void {
-  if (!adapter) {
-    return;
-  }
-
-  // Drop any previous watch so a stale subscription can't write into a new
-  // session's state.
-  identitySub?.unsubscribe();
-  identitySub = null;
-
-  setState({ status: "authenticated", session, identity: null });
-
-  const accountId = Array.from(session.remoteAccount.accountId)
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
-
-  identitySub = adapter.identity.watchIdentity(`0x${accountId}`).subscribe({
-    next: (identity) => {
-      if (
-        identity &&
-        currentState.status === "authenticated" &&
-        currentState.session.id === session.id
-      ) {
-        setState({ status: "authenticated", session, identity });
-      }
-    },
-    error: (err: unknown) => {
-      log.warn("[dot.li] Failed to resolve identity:", err);
-    },
-  });
-}
-
-/**
- * Pick up the first available session from the adapter.
- * Used as a fallback after pairing/attestation finishes.
- */
-function pickUpSession(): void {
-  if (!adapter) {
-    return;
-  }
-  if (currentState.status === "authenticated") {
-    return;
-  }
-
-  const sessions = adapter.sessions.sessions.read();
-  if (sessions.length > 0) {
-    resolveIdentityAndSetAuth(sessions[0]);
-  }
-}
-
-let unsubPairing: (() => void) | null = null;
-
-export function startPairing(): void {
-  if (!adapter) {
-    return;
-  }
-
-  // Show spinner immediately (don't wait for subscription callback)
-  setState({ status: "pairing", payload: "" });
-
-  // Clean up previous subscription (without aborting the adapter)
-  unsubPairing?.();
-  unsubPairing = null;
-
-  unsubPairing = adapter.sso.pairingStatus.subscribe(
-    (status: PairingStatus) => {
-      log.warn("[dot.li auth] pairingStatus:", status.step, status);
-      switch (status.step) {
-        case "initial":
-          setState({ status: "pairing", payload: "" });
-          break;
-        case "pairing":
-          setState({ status: "pairing", payload: status.payload });
-          break;
-        case "pending":
-          // Setup work in progress (attestation etc.). Show the spinner.
-          if (currentState.status !== "authenticated") {
-            setState({ status: "attesting" });
-          }
-          break;
-        case "pairingError":
-          setState({ status: "error", message: status.message });
-          break;
-        case "finished":
-          // Pairing and attestation both done, session is persisted.
-          // sessions.subscribe() is the primary pickup path, but call
-          // pickUpSession() here as a fallback.
-          if (currentState.status !== "authenticated") {
-            setState({ status: "attesting" });
-          }
-          pickUpSession();
-          break;
-        case "none":
-          break;
-      }
-    },
-  );
-
-  adapter.sso.authenticate().then(
-    (result) => {
-      log.warn("[dot.li auth] authenticate() resolved:", result);
-      if (result.isOk() && result.value) {
-        // authenticate() resolved successfully, session is now persisted.
-        // Pick up via sessions subscription or fallback here.
-        pickUpSession();
-      } else if (result.isErr()) {
-        log.error("[dot.li auth] authenticate() error:", result.error);
-        // Only show error if we're still in an active auth flow (not idle/authenticated)
-        if (
-          currentState.status !== "authenticated" &&
-          currentState.status !== "idle"
-        ) {
-          setState({ status: "error", message: result.error.message });
-        }
-      }
-    },
-    (err) => {
-      log.error("[dot.li auth] authenticate() rejected:", err);
-    },
-  );
-}
-
-export function abortPairing(): void {
-  // Unsubscribe first to prevent status callbacks from firing during abort
-  unsubPairing?.();
-  unsubPairing = null;
-
-  if (adapter) {
-    adapter.sso.abortAuthentication();
-  }
-
-  // Reset to idle so the UI is clean
-  if (currentState.status !== "authenticated") {
-    setState({ status: "idle" });
-  }
-}
-
-export async function disconnect(): Promise<void> {
-  if (!adapter) {
-    return;
-  }
-  if (currentState.status !== "authenticated") {
-    return;
-  }
-
-  const session = currentState.session;
-
-  // Notify the peer and let host-papp tear down its own session state,
-  // best-effort. Removing the session drives the sessions subscription, which
-  // runs the shared local teardown (secrets, allowance, device-identity
-  // rotation, in-memory reset) — the same path a phone-initiated disconnect
-  // takes.
-  await adapter.sessions.disconnect(session);
-  await sharedStorage?.clear(SHARED_AUTH_SESSION_KEY);
-}
-
-// Keep this union aligned with the host-API wire codec (`LoginResult`),
-// which is `"success" | "alreadyConnected" | "rejected"`.
-export type LoginFlowResult = "success" | "alreadyConnected" | "rejected";
-
-/**
- * Open the login flow on behalf of a product and resolve once auth settles.
- *
- * Products reach this through `handleRequestLogin` in the container. We
- * dispatch a DOM event so the topbar (which owns the QR pairing modal) can
- * open the UI without this module pulling in any DOM.
- */
-export function requestLogin(
-  reason: string | undefined,
-  label?: string,
-): Promise<LoginFlowResult> {
-  if (currentState.status === "authenticated") {
-    return Promise.resolve("alreadyConnected");
-  }
-
-  return new Promise((resolve) => {
-    // Dispatch first so the topbar transitions us out of `idle` before
-    // the subscription is installed. That way any post-subscribe
-    // `idle` callback is unambiguously a user cancellation.
-    window.dispatchEvent(
-      new CustomEvent("dotli:request-login", { detail: { reason, label } }),
-    );
-
-    const unsubscribe = onAuthStateChange((state) => {
-      if (state.status === "authenticated") {
-        unsubscribe();
-        resolve("success");
-      } else if (state.status === "error" || state.status === "idle") {
-        unsubscribe();
-        resolve("rejected");
-      }
-    });
-  });
-}
-
-export function shortenName(identity: Identity): string {
-  if (identity.fullUsername !== null && identity.fullUsername.length > 0) {
-    const parts = identity.fullUsername.split(" ");
-    if (parts.length === 1) {
-      return identity.fullUsername.slice(0, 2);
-    }
-    return parts[0].charAt(0) + parts[1].charAt(0);
-  }
-  return identity.liteUsername.slice(0, 2);
-}
diff --git a/packages/auth/src/shared-storage.ts b/packages/auth/src/shared-storage.ts
deleted file mode 100644
index f61a23a..0000000
--- a/packages/auth/src/shared-storage.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import type { SiteId } from "@dotli/config/config";
-import {
-  clearSharedAuthStorage,
-  readSharedAuthStorage,
-  subscribeSharedAuthStorage,
-  writeSharedAuthStorage,
-} from "@dotli/protocol/client";
-import type { StorageAdapter } from "@novasamatech/storage-adapter";
-import { fromPromise } from "neverthrow";
-
-type StorageListener = (value: string | null) => unknown;
-
-function toError(error: unknown): Error {
-  return error instanceof Error ? error : new Error(String(error));
-}
-
-/**
- * Storage adapter backed by the shared host-window localStorage (on
- * `host.<root-domain>`) instead of the per-subdomain localStorage.
- *
- * - All read/write/clear calls proxy through the protocol iframe.
- * - In-process subscribers receive updates from same-tab writes via a
- *   local emit in the write/clear pipeline.
- * - Cross-tab subscribers on the same root domain receive updates via the
- *   protocol client's `subscribeSharedAuthStorage`, which is driven by a
- *   `BroadcastChannel` running inside the host iframe. This preserves the
- *   cross-tab contract of the upstream `@novasamatech/storage-adapter`
- *   `createLocalStorageAdapter`, which used the `storage` event.
- */
-export function createSharedAuthStorageAdapter(siteId: SiteId): StorageAdapter {
-  const listeners = new Map<string, Set<StorageListener>>();
-  let broadcastUnsubscribe: (() => void) | null = null;
-
-  function emit(key: string, value: string | null): void {
-    const callbacks = listeners.get(key);
-    if (!callbacks) {
-      return;
-    }
-    for (const callback of callbacks) {
-      callback(value);
-    }
-  }
-
-  function ensureBroadcastSubscription(): void {
-    if (broadcastUnsubscribe !== null) {
-      return;
-    }
-    broadcastUnsubscribe = subscribeSharedAuthStorage((change) => {
-      // Scope per-root-domain: ignore notifications from a different siteId.
-      // This is already enforced in the host iframe (which only accepts its
-      // own SITE_ID), but we filter defensively here too.
-      if (change.siteId !== siteId) {
-        return;
-      }
-      emit(change.key, change.value);
-    });
-  }
-
-  return {
-    read(key) {
-      return fromPromise(readSharedAuthStorage(siteId, key), toError);
-    },
-    write(key, value) {
-      // The iframe on `host.<root>` is the authoritative store: after a
-      // write resolves, read back through the iframe before firing the
-      // local `emit`. Trusting the local `value` we just tried to write
-      // would let a same-tab subscriber observe an update that the
-      // upstream storage quietly rejected (quota, validation, etc.). The
-      // cross-tab BroadcastChannel listener handles other tabs. Here we
-      // reconcile this tab against the source of truth.
-      return fromPromise(
-        writeSharedAuthStorage(siteId, key, value),
-        toError,
-      ).map(() => {
-        void readSharedAuthStorage(siteId, key).then(
-          (actual) => {
-            emit(key, actual);
-          },
-          () => {
-            // Read-back failed, so fall back to the value we intended.
-            // The subsequent write or subscription tick will reconcile.
-            emit(key, value);
-          },
-        );
-      });
-    },
-    clear(key) {
-      return fromPromise(clearSharedAuthStorage(siteId, key), toError).map(
-        () => {
-          void readSharedAuthStorage(siteId, key).then(
-            (actual) => {
-              emit(key, actual);
-            },
-            () => {
-              emit(key, null);
-            },
-          );
-        },
-      );
-    },
-    subscribe(key, callback) {
-      ensureBroadcastSubscription();
-
-      const callbacks = listeners.get(key) ?? new Set<StorageListener>();
-      callbacks.add(callback);
-      listeners.set(key, callbacks);
-
-      return () => {
-        const current = listeners.get(key);
-        if (!current) {
-          return;
-        }
-        current.delete(callback);
-        if (current.size === 0) {
-          listeners.delete(key);
-        }
-      };
-    },
-  };
-}
diff --git a/packages/auth/src/signing.ts b/packages/auth/src/signing.ts
deleted file mode 100644
index 31b5818..0000000
--- a/packages/auth/src/signing.ts
+++ /dev/null
@@ -1,660 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Signing confirmation modals for dot.li (vanilla DOM).
-//
-// Bridges host-container's `{ account, payload }` request to host-papp's
-// `{ productAccountId, ...payload }` shape (host-api 0.7.6+). host-papp
-// derives the signing secret on the wallet side from the product account
-// tuple, so the host only forwards the tuple, with no address conversion or
-// local derivation. The modal displays the tuple itself ("my-app.dot / 0")
-// rather than a derived address. Computing the address would mean
-// duplicating the wallet's derivation logic for display only.
-
-import {
-  CreateTransactionErr,
-  SigningErr,
-  enumValue,
-  toHex,
-} from "@novasamatech/host-api";
-import { log } from "@dotli/shared/log";
-import type { UserSession } from "@novasamatech/host-papp";
-import { productPublicKeyToAddress } from "./account";
-
-export interface SigningResult {
-  signature: `0x${string}`;
-  signedTransaction?: `0x${string}`;
-}
-
-export interface ContainerSignPayloadRequest {
-  account: [string, number];
-  payload: {
-    blockHash: `0x${string}`;
-    blockNumber: `0x${string}`;
-    era: `0x${string}`;
-    genesisHash: `0x${string}`;
-    method: `0x${string}`;
-    nonce: `0x${string}`;
-    specVersion: `0x${string}`;
-    tip: `0x${string}`;
-    transactionVersion: `0x${string}`;
-    signedExtensions: string[];
-    version: number;
-    assetId: `0x${string}` | undefined;
-    metadataHash: `0x${string}` | undefined;
-    mode: number | undefined;
-    withSignedTransaction: boolean | undefined;
-  };
-}
-
-export interface ContainerSignRawRequest {
-  account: [string, number];
-  payload:
-    | { tag: "Bytes"; value: Uint8Array }
-    | { tag: "Payload"; value: string };
-}
-
-export interface ContainerCreateTransactionPayload {
-  signer: [string, number];
-  genesisHash: Uint8Array;
-  callData: Uint8Array;
-  extensions: { id: string; extra: Uint8Array; additionalSigned: Uint8Array }[];
-  txExtVersion: number;
-}
-
-/**
- * Legacy-account variant of `ContainerCreateTransactionPayload`. The signer is
- * a raw 32-byte public key (host-api `AccountId = Bytes(32)`) rather than the
- * `[dotNsIdentifier, derivationIndex]` product tuple, matching host-papp's
- * `LegacyTransaction = GenericTxPayloadV1(AccountId)`.
- */
-export interface ContainerCreateTransactionLegacyPayload {
-  signer: Uint8Array;
-  genesisHash: Uint8Array;
-  callData: Uint8Array;
-  extensions: { id: string; extra: Uint8Array; additionalSigned: Uint8Array }[];
-  txExtVersion: number;
-}
-
-/** Timeout for the wallet to respond (ms). Covers WS drops and unresponsive wallets. */
-const SIGN_TIMEOUT_MS = 300_000; // 300 seconds
-
-class SignTimeoutError extends Error {
-  constructor() {
-    super("Wallet did not respond in time — the connection may have dropped.");
-    this.name = "SignTimeoutError";
-  }
-}
-
-/** Race a thenable against a timeout. Clears the timer on settlement. */
-function withTimeout<T>(thenable: PromiseLike<T>, ms: number): Promise<T> {
-  return new Promise<T>((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new SignTimeoutError());
-    }, ms);
-    const cleanup = (): void => {
-      clearTimeout(timer);
-    };
-    Promise.resolve(thenable).then(
-      (v) => {
-        cleanup();
-        resolve(v);
-      },
-      (e: unknown) => {
-        cleanup();
-        reject(e instanceof Error ? e : new Error(String(e)));
-      },
-    );
-  });
-}
-
-function createModalDOM(
-  title: string,
-  fields: { label: string; value: string; mono?: boolean }[],
-): {
-  backdrop: HTMLDivElement;
-  signBtn: HTMLButtonElement;
-  cancelBtn: HTMLButtonElement;
-} {
-  const backdrop = document.createElement("div");
-  backdrop.className = "signing-modal-backdrop";
-
-  const modal = document.createElement("div");
-  modal.className = "signing-modal";
-
-  const heading = document.createElement("h2");
-  heading.textContent = title;
-  modal.appendChild(heading);
-
-  const fieldsContainer = document.createElement("div");
-  fieldsContainer.className = "signing-fields";
-
-  for (const field of fields) {
-    const group = document.createElement("div");
-    group.className = "signing-field";
-
-    const label = document.createElement("div");
-    label.className = "signing-field-label";
-    label.textContent = field.label;
-    group.appendChild(label);
-
-    const value = document.createElement("div");
-    value.className = "signing-field-value";
-    if (field.mono === true) {
-      value.classList.add("mono");
-    }
-    value.textContent = field.value;
-    group.appendChild(value);
-
-    fieldsContainer.appendChild(group);
-  }
-  modal.appendChild(fieldsContainer);
-
-  const footer = document.createElement("div");
-  footer.className = "signing-modal-footer";
-
-  const cancelBtn = document.createElement("button");
-  cancelBtn.className = "signing-btn-cancel";
-  cancelBtn.textContent = "Cancel";
-  footer.appendChild(cancelBtn);
-
-  const signBtn = document.createElement("button");
-  signBtn.className = "signing-btn-sign";
-  signBtn.textContent = "Sign";
-  footer.appendChild(signBtn);
-
-  modal.appendChild(footer);
-  backdrop.appendChild(modal);
-  document.body.appendChild(backdrop);
-
-  return { backdrop, signBtn, cancelBtn };
-}
-
-function removeModal(backdrop: HTMLDivElement): void {
-  backdrop.remove();
-}
-
-/**
- * Sign-payload modal.
- *
- * Receives the calling product's `[dotNsIdentifier, derivationIndex]` tuple,
- * which is what host-papp requires. The modal displays the tuple as the
- * "Signer" line. The wallet derives and signs with the matching secret on
- * its side.
- */
-export function showSignPayloadModal(
-  session: UserSession,
-  payload: ContainerSignPayloadRequest["payload"],
-  appLabel: string,
-  productAccountId: [string, number],
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = `${productAccountId[0]} / ${String(productAccountId[1])}`;
-
-    log.warn("[dot.li signing] signPayload request received:", {
-      appLabel,
-      productAccountId,
-      genesisHash: payload.genesisHash,
-      method: payload.method.slice(0, 40) + "...",
-      mode: payload.mode,
-      withSignedTransaction: payload.withSignedTransaction,
-      metadataHash: payload.metadataHash,
-      assetId: payload.assetId,
-    });
-    log.warn("[dot.li signing] session info:", {
-      localAccountId: toHex(session.localAccount.accountId),
-      sessionRoot: toHex(session.remoteAccount.accountId),
-    });
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel },
-      { label: "Genesis Hash", value: payload.genesisHash, mono: true },
-      { label: "Call Data", value: payload.method, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      log.warn("[dot.li signing] user cancelled signPayload");
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      const signRequest = { productAccountId, ...payload };
-      log.warn("[dot.li signing] dispatching signPayload to session:", {
-        productAccountId,
-        method: signRequest.method.slice(0, 40) + "...",
-        mode: signRequest.mode,
-        withSignedTransaction: signRequest.withSignedTransaction,
-      });
-
-      void withTimeout(session.signPayload(signRequest), SIGN_TIMEOUT_MS).then(
-        (result) => {
-          result.match(
-            ({ signature, signedTransaction }) => {
-              log.warn("[dot.li signing] signPayload SUCCESS:", {
-                signature: toHex(signature).slice(0, 20) + "...",
-                hasSignedTx: !!signedTransaction,
-              });
-              removeModal(backdrop);
-              resolve({
-                signature: toHex(signature),
-                signedTransaction: signedTransaction
-                  ? typeof signedTransaction === "string"
-                    ? signedTransaction
-                    : toHex(signedTransaction)
-                  : undefined,
-              });
-            },
-            (e) => {
-              log.error("[dot.li signing] signPayload FAILED:", e.message, e);
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signPayload timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/** Sign-raw counterpart of `showSignPayloadModal`; see that function for rationale. */
-export function showSignRawModal(
-  session: UserSession,
-  data: ContainerSignRawRequest["payload"],
-  appLabel: string,
-  productAccountId: [string, number],
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = `${productAccountId[0]} / ${String(productAccountId[1])}`;
-    const message = data.tag === "Payload" ? data.value : toHex(data.value);
-
-    log.warn("[dot.li signing] signRaw request received:", {
-      appLabel,
-      productAccountId,
-      dataTag: data.tag,
-      message: message.slice(0, 80) + (message.length > 80 ? "..." : ""),
-    });
-    log.warn("[dot.li signing] session info:", {
-      localAccountId: toHex(session.localAccount.accountId),
-      sessionRoot: toHex(session.remoteAccount.accountId),
-    });
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel },
-      { label: "Message", value: message, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Message",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      log.warn("[dot.li signing] user cancelled signRaw");
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      log.warn("[dot.li signing] dispatching signRaw to session");
-
-      const signRawRequest = { productAccountId, data };
-      void withTimeout(session.signRaw(signRawRequest), SIGN_TIMEOUT_MS).then(
-        (result) => {
-          result.match(
-            ({ signature, signedTransaction }) => {
-              log.warn("[dot.li signing] signRaw SUCCESS:", {
-                signature: toHex(signature).slice(0, 20) + "...",
-                hasSignedTx: !!signedTransaction,
-              });
-              removeModal(backdrop);
-              resolve({
-                signature: toHex(signature),
-                signedTransaction: signedTransaction
-                  ? typeof signedTransaction === "string"
-                    ? signedTransaction
-                    : toHex(signedTransaction)
-                  : undefined,
-              });
-            },
-            (e) => {
-              log.error("[dot.li signing] signRaw FAILED:", e.message, e);
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signRaw timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Create-transaction modal. host-api 0.7.9 delegates extrinsic construction
- * to the wallet via host_create_transaction. The host forwards the typed
- * payload (signer tuple, genesis hash, call data, extensions, txExtVersion)
- * and the wallet returns the signed extrinsic bytes. The legacy-account
- * variant routes through the same flow with a synthetic product-account
- * tuple, see handleCreateTransactionWithLegacyAccount in container.ts.
- */
-export function showCreateTransactionModal(
-  session: UserSession,
-  payload: ContainerCreateTransactionPayload,
-  appLabel: string,
-): Promise<Uint8Array> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = `${payload.signer[0]} / ${String(payload.signer[1])}`;
-    const genesisHashHex = toHex(payload.genesisHash);
-    const callDataHex = toHex(payload.callData);
-    const callDataPreview =
-      callDataHex.length > 80 ? `${callDataHex.slice(0, 80)}...` : callDataHex;
-
-    log.warn("[dot.li signing] createTransaction request received:", {
-      appLabel,
-      signer: payload.signer,
-      genesisHash: genesisHashHex,
-      callDataLen: payload.callData.length,
-      extensions: payload.extensions.map((e) => e.id),
-      txExtVersion: payload.txExtVersion,
-    });
-    log.warn("[dot.li signing] session info:", {
-      localAccountId: toHex(session.localAccount.accountId),
-      sessionRoot: toHex(session.remoteAccount.accountId),
-    });
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel },
-      { label: "Genesis Hash", value: genesisHashHex, mono: true },
-      { label: "Call Data", value: callDataPreview, mono: true },
-      { label: "Tx Ext Version", value: String(payload.txExtVersion) },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      log.warn("[dot.li signing] user cancelled createTransaction");
-      removeModal(backdrop);
-      reject(new CreateTransactionErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      log.warn("[dot.li signing] dispatching createTransaction to session");
-
-      void withTimeout(
-        session.createTransaction({
-          payload: enumValue("v1", payload),
-        }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signedTransaction) => {
-              log.warn("[dot.li signing] createTransaction SUCCESS:", {
-                signedTxLen: signedTransaction.length,
-              });
-              removeModal(backdrop);
-              resolve(signedTransaction);
-            },
-            (e) => {
-              log.error(
-                "[dot.li signing] createTransaction FAILED:",
-                e.message,
-                e,
-              );
-              removeModal(backdrop);
-              reject(new CreateTransactionErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] createTransaction timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new CreateTransactionErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Sign-raw modal for a true legacy (imported) account.
- *
- * Unlike `showSignRawModal`, the wallet is asked to sign with a concrete
- * account public key (`signRawLegacy`) rather than deriving a product key from
- * a `[dotNsIdentifier, index]` tuple. host-papp's `signRawLegacy` returns the
- * raw signature only (no signed transaction).
- */
-export function showSignRawLegacyModal(
-  session: UserSession,
-  data: ContainerSignRawRequest["payload"],
-  appLabel: string,
-  account: Uint8Array,
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = productPublicKeyToAddress(account);
-    const message = data.tag === "Payload" ? data.value : toHex(data.value);
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel, mono: true },
-      { label: "Message", value: message, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Message",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      void withTimeout(
-        session.signRawLegacy({ account, data }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signature) => {
-              removeModal(backdrop);
-              resolve({ signature: toHex(signature) });
-            },
-            (e) => {
-              log.error("[dot.li signing] signRawLegacy FAILED:", e.message, e);
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signRawLegacy timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Create-transaction modal for a true legacy (imported) account. Mirrors
- * `showCreateTransactionModal` but routes through host-papp's
- * `createTransactionLegacy`, which carries the signer as a raw public key.
- */
-export function showCreateTransactionLegacyModal(
-  session: UserSession,
-  payload: ContainerCreateTransactionLegacyPayload,
-  appLabel: string,
-): Promise<Uint8Array> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = productPublicKeyToAddress(payload.signer);
-    const genesisHashHex = toHex(payload.genesisHash);
-    const callDataHex = toHex(payload.callData);
-    const callDataPreview =
-      callDataHex.length > 80 ? `${callDataHex.slice(0, 80)}...` : callDataHex;
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel, mono: true },
-      { label: "Genesis Hash", value: genesisHashHex, mono: true },
-      { label: "Call Data", value: callDataPreview, mono: true },
-      { label: "Tx Ext Version", value: String(payload.txExtVersion) },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      removeModal(backdrop);
-      reject(new CreateTransactionErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      void withTimeout(
-        session.createTransactionLegacy({
-          payload: enumValue("v1", payload),
-        }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signedTransaction) => {
-              removeModal(backdrop);
-              resolve(signedTransaction);
-            },
-            (e) => {
-              log.error(
-                "[dot.li signing] createTransactionLegacy FAILED:",
-                e.message,
-                e,
-              );
-              removeModal(backdrop);
-              reject(new CreateTransactionErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] createTransactionLegacy timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new CreateTransactionErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Sign-payload modal for a true legacy (imported) account. host-papp has no
- * `signPayloadLegacy`, so the JSON-encoded payload is signed through
- * `signRawLegacy` (Payload variant), mirroring polkadot-desktop. Returns the
- * raw signature only (no signed transaction).
- */
-export function showSignPayloadLegacyModal(
-  session: UserSession,
-  payload: ContainerSignPayloadRequest["payload"],
-  appLabel: string,
-  account: Uint8Array,
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = productPublicKeyToAddress(account);
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel, mono: true },
-      { label: "Genesis Hash", value: payload.genesisHash, mono: true },
-      { label: "Call Data", value: payload.method, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      void withTimeout(
-        session.signRawLegacy({
-          account,
-          data: { tag: "Payload", value: JSON.stringify(payload) },
-        }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signature) => {
-              removeModal(backdrop);
-              resolve({ signature: toHex(signature) });
-            },
-            (e) => {
-              log.error(
-                "[dot.li signing] signPayloadLegacy FAILED:",
-                e.message,
-                e,
-              );
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signPayloadLegacy timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
diff --git a/packages/auth/tests/account.test.ts b/packages/auth/tests/account.test.ts
deleted file mode 100644
index f00ace5..0000000
--- a/packages/auth/tests/account.test.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { describe, it, expect } from "vitest";
-import {
-  deriveProductPublicKey,
-  productPublicKeyToAddress,
-} from "@dotli/auth/account";
-import { AccountId } from "polkadot-api";
-import { secretFromSeed, getPublicKey } from "@scure/sr25519";
-
-describe("deriveProductPublicKey", () => {
-  // Generate a valid SR25519 public key from a deterministic seed
-  const seed = new Uint8Array(32);
-  seed[0] = 0x01;
-  const secret = secretFromSeed(seed);
-  const rootPublicKey = getPublicKey(secret);
-
-  it("returns a 32-byte public key", () => {
-    const derived = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    expect(derived).toBeInstanceOf(Uint8Array);
-    expect(derived.length).toBe(32);
-  });
-
-  it("produces different keys for different product IDs", () => {
-    const key1 = deriveProductPublicKey(rootPublicKey, "app1.dot", 0);
-    const key2 = deriveProductPublicKey(rootPublicKey, "app2.dot", 0);
-    expect(Buffer.from(key1).equals(Buffer.from(key2))).toBe(false);
-  });
-
-  it("produces different keys for different derivation indices", () => {
-    const key1 = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    const key2 = deriveProductPublicKey(rootPublicKey, "myapp.dot", 1);
-    expect(Buffer.from(key1).equals(Buffer.from(key2))).toBe(false);
-  });
-
-  it("is deterministic", () => {
-    const key1 = deriveProductPublicKey(rootPublicKey, "test.dot", 5);
-    const key2 = deriveProductPublicKey(rootPublicKey, "test.dot", 5);
-    expect(Buffer.from(key1).equals(Buffer.from(key2))).toBe(true);
-  });
-
-  it("supports long preview product IDs", () => {
-    const derived = deriveProductPublicKey(
-      rootPublicKey,
-      "w-credentialless-staticblitz-com.local-credentialless.webcontainer-api.io",
-      0,
-    );
-    expect(derived).toBeInstanceOf(Uint8Array);
-    expect(derived.length).toBe(32);
-  });
-
-  it("derives different key from root (soft derivation changes output)", () => {
-    const derived = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    expect(Buffer.from(derived).equals(Buffer.from(rootPublicKey))).toBe(false);
-  });
-});
-
-describe("productPublicKeyToAddress", () => {
-  const seed = new Uint8Array(32);
-  seed[0] = 0x01;
-  const rootPublicKey = getPublicKey(secretFromSeed(seed));
-
-  it("round-trips with polkadot-api's AccountId() encoder", () => {
-    const address = productPublicKeyToAddress(rootPublicKey);
-    const reEncoded = AccountId().enc(address);
-    expect(Buffer.from(reEncoded).equals(Buffer.from(rootPublicKey))).toBe(
-      true,
-    );
-  });
-
-  it("uses the substrate-generic (42) ss58 prefix by default", () => {
-    // Prefix 42 always produces an SS58 string starting with '5' for 32-byte
-    // public keys (mathematical property of base58 encoding of the prefix).
-    const address = productPublicKeyToAddress(rootPublicKey);
-    expect(address.startsWith("5")).toBe(true);
-  });
-
-  it("is deterministic", () => {
-    const a = productPublicKeyToAddress(rootPublicKey);
-    const b = productPublicKeyToAddress(rootPublicKey);
-    expect(a).toBe(b);
-  });
-
-  it("produces distinct addresses for distinct keys", () => {
-    const derived = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    expect(productPublicKeyToAddress(derived)).not.toBe(
-      productPublicKeyToAddress(rootPublicKey),
-    );
-  });
-});
diff --git a/packages/auth/tests/shared-storage.test.ts b/packages/auth/tests/shared-storage.test.ts
deleted file mode 100644
index 49581fa..0000000
--- a/packages/auth/tests/shared-storage.test.ts
+++ /dev/null
@@ -1,163 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { createSharedAuthStorageAdapter } from "@dotli/auth/shared-storage";
-import {
-  clearSharedAuthStorage,
-  readSharedAuthStorage,
-  subscribeSharedAuthStorage,
-  writeSharedAuthStorage,
-  type SharedAuthStorageListener,
-} from "@dotli/protocol/client";
-
-vi.mock("@dotli/protocol/client", () => ({
-  readSharedAuthStorage: vi.fn(),
-  writeSharedAuthStorage: vi.fn(),
-  clearSharedAuthStorage: vi.fn(),
-  subscribeSharedAuthStorage: vi.fn(),
-}));
-
-describe("createSharedAuthStorageAdapter", () => {
-  beforeEach(() => {
-    vi.mocked(readSharedAuthStorage).mockReset();
-    vi.mocked(writeSharedAuthStorage).mockReset();
-    vi.mocked(clearSharedAuthStorage).mockReset();
-    vi.mocked(subscribeSharedAuthStorage).mockReset();
-    vi.mocked(subscribeSharedAuthStorage).mockReturnValue(() => {
-      /* noop unsubscribe */
-    });
-  });
-
-  it("reads from shared host storage for the requested site", async () => {
-    vi.mocked(readSharedAuthStorage).mockResolvedValue("stored-value");
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const result = await adapter.read("SsoSessions");
-
-    expect(readSharedAuthStorage).toHaveBeenCalledWith("dot.li", "SsoSessions");
-    expect(result.isOk()).toBe(true);
-    expect(result._unsafeUnwrap()).toBe("stored-value");
-  });
-
-  it("emits local subscribers after writes and clears", async () => {
-    vi.mocked(writeSharedAuthStorage).mockResolvedValue(undefined);
-    vi.mocked(clearSharedAuthStorage).mockResolvedValue(undefined);
-    // After write/clear, the adapter reads back through the iframe
-    // (the authoritative store) to reconcile same-tab listeners against
-    // the value that was actually persisted. Mock the read-back so the
-    // local subscriber sees the post-write value.
-    vi.mocked(readSharedAuthStorage)
-      .mockResolvedValueOnce("next-value")
-      .mockResolvedValueOnce(null)
-      .mockResolvedValue("ignored");
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const seen: (string | null)[] = [];
-    const unsubscribe = adapter.subscribe("SsoSessions", (value) => {
-      seen.push(value);
-    });
-
-    await adapter.write("SsoSessions", "next-value");
-    // Wait for the detached read-back chain scheduled by `.map()` to land
-    // its result in the subscriber. Polling on observable state is
-    // deterministic across event-loop schedulers. A fixed setTimeout(0)
-    // race-loses on slower JS engines.
-    await vi.waitFor(() => expect(seen).toContain("next-value"));
-    await adapter.clear("SsoSessions");
-    await vi.waitFor(() => expect(seen).toContain(null));
-    unsubscribe();
-    await adapter.write("SsoSessions", "ignored");
-    await vi.waitFor(() =>
-      expect(writeSharedAuthStorage).toHaveBeenCalledTimes(2),
-    );
-
-    expect(writeSharedAuthStorage).toHaveBeenNthCalledWith(
-      1,
-      "dot.li",
-      "SsoSessions",
-      "next-value",
-    );
-    expect(clearSharedAuthStorage).toHaveBeenCalledWith(
-      "dot.li",
-      "SsoSessions",
-    );
-    expect(seen).toEqual(["next-value", null]);
-  });
-
-  it("subscribes to cross-tab changes via the protocol client", () => {
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-
-    // No protocol-level subscription should happen until the adapter's
-    // subscribe() is called. We don't want to warm up the host iframe for
-    // read-only callers.
-    expect(subscribeSharedAuthStorage).not.toHaveBeenCalled();
-
-    adapter.subscribe("SsoSessions", () => {
-      /* noop */
-    });
-    adapter.subscribe("Other", () => {
-      /* noop */
-    });
-
-    // The adapter should only subscribe to the protocol client once. It
-    // multiplexes the single cross-tab listener across all key subscribers.
-    expect(subscribeSharedAuthStorage).toHaveBeenCalledTimes(1);
-  });
-
-  it("dispatches cross-tab changes to matching in-process subscribers", () => {
-    let relay: SharedAuthStorageListener | null = null;
-    vi.mocked(subscribeSharedAuthStorage).mockImplementation((listener) => {
-      relay = listener;
-      return () => {
-        relay = null;
-      };
-    });
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const seen: (string | null)[] = [];
-    adapter.subscribe("SsoSessions", (value) => {
-      seen.push(value);
-    });
-
-    if (relay === null) {
-      throw new Error("relay not captured");
-    }
-    // Simulate a sibling tab writing the same key
-    (relay as SharedAuthStorageListener)({
-      siteId: "dot.li",
-      key: "SsoSessions",
-      value: "from-other-tab",
-    });
-
-    expect(seen).toEqual(["from-other-tab"]);
-  });
-
-  it("ignores cross-tab changes for other siteIds", () => {
-    let relay: SharedAuthStorageListener | null = null;
-    vi.mocked(subscribeSharedAuthStorage).mockImplementation((listener) => {
-      relay = listener;
-      return () => {
-        relay = null;
-      };
-    });
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const seen: (string | null)[] = [];
-    adapter.subscribe("SsoSessions", (value) => {
-      seen.push(value);
-    });
-
-    if (relay === null) {
-      throw new Error("relay not captured");
-    }
-    // A broadcast scoped to a different root domain must not fire
-    (relay as SharedAuthStorageListener)({
-      siteId: "paseo.li",
-      key: "SsoSessions",
-      value: "leak",
-    });
-
-    expect(seen).toEqual([]);
-  });
-});
diff --git a/packages/auth/tsconfig.json b/packages/auth/tsconfig.json
deleted file mode 100644
index 0849d31..0000000
--- a/packages/auth/tsconfig.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "extends": [
-    "@dotli/typescript-config/base.json",
-    "@dotli/typescript-config/paths.json"
-  ],
-  "include": ["src"]
-}
diff --git a/packages/auth/vitest.config.ts b/packages/auth/vitest.config.ts
deleted file mode 100644
index e51b66d..0000000
--- a/packages/auth/vitest.config.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { defineConfig } from "vitest/config";
-import { resolve } from "node:path";
-
-export default defineConfig({
-  resolve: {
-    alias: {
-      "@dotli/auth": resolve(import.meta.dirname, "src"),
-      "@dotli/config": resolve(import.meta.dirname, "../config/src"),
-      "@dotli/protocol": resolve(import.meta.dirname, "../protocol/src"),
-      "@dotli/shared": resolve(import.meta.dirname, "../shared/src"),
-    },
-  },
-  test: {
-    include: ["tests/**/*.test.ts"],
-    environment: "happy-dom",
-    globals: false,
-  },
-  define: {
-    "import.meta.env.DEV": "false",
-    "import.meta.env.VITE_APP_DEBUG": '"true"',
-    // getEnabledNetworks() requires VITE_NETWORKS (no default by design); the
-    // test build supplies it the same way a deployment does.
-    "import.meta.env.VITE_NETWORKS": '"paseo-next-v2,previewnet"',
-  },
-});
diff --git a/packages/config/src/config.ts b/packages/config/src/config.ts
index ced8ad3..81b621b 100644
--- a/packages/config/src/config.ts
+++ b/packages/config/src/config.ts
@@ -79,6 +79,16 @@ export function isSandboxOrigin(origin: string): boolean {
 export const SS_RELAY_CHAIN: string | undefined =
   (import.meta.env.VITE_SS_RELAY_CHAIN as string | undefined) ?? undefined;
 
+/**
+ * Use the smoldot light client for the statement store chain.
+ *
+ * Set VITE_SS_USE_SMOLDOT=true to enable. Defaults to false until
+ * smoldot statement store support is production-ready, but can be
+ * enabled in development for testing and feedback.
+ */
+export const SS_USE_SMOLDOT =
+  (import.meta.env.VITE_SS_USE_SMOLDOT as string | undefined) === "true";
+
 // Allowlist polarity: DEBUG is ON only when VITE_APP_DEBUG === "true".
 export const DEBUG =
   (import.meta.env.VITE_APP_DEBUG as string | undefined) === "true";
@@ -89,9 +99,6 @@ export const SW_ARCHIVE_CACHE_MAX = 8;
 /** Max chain connections per origin on the protocol host. */
 export const MAX_CONNECTIONS_PER_ORIGIN = 10;
 
-/** Max nested container bridges per host shell. */
-export const MAX_NESTED_BRIDGES = 5;
-
 /** Drop scheduled notifications older than this many ms past `scheduledAt`. */
 export const SCHEDULED_NOTIFICATIONS_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 
diff --git a/packages/protocol/src/auth-storage.ts b/packages/protocol/src/auth-storage.ts
index 7a16fb1..cf89280 100644
--- a/packages/protocol/src/auth-storage.ts
+++ b/packages/protocol/src/auth-storage.ts
@@ -15,12 +15,13 @@ export type SharedModeRequestMethod =
   | "modeStorageWrite"
   | "modeStorageClear";
 
-export const SHARED_AUTH_SESSION_KEY = "SsoSessionsV3";
+export const SHARED_CORE_SESSION_KEY = "session";
+export const SHARED_AUTH_SESSION_KEY = SHARED_CORE_SESSION_KEY;
 
-// SCALE-encoded empty `Vec<Session>` from `@novasamatech/host-papp`, a single
-// length byte of 0. If host-papp ever changes the session list encoding (e.g.
-// wraps it in an `Option<>`), this sentinel must be updated or the probe will
-// return true for empty payloads and trigger `ensureAuth()` on every load.
+// Empty SCALE vec sentinel retained for older shared-auth probes. Rust core
+// persisted sessions use `SHARED_CORE_SESSION_KEY` and never encode an empty
+// session list, but this keeps the helper tolerant while the protocol method
+// remains in the wire surface.
 const EMPTY_SHARED_AUTH_SESSION_LIST = "0x00";
 
 // Both the shared-auth and shared-mode stores accept the same key shape, an
@@ -79,7 +80,10 @@ export function isValidSharedAuthKey(key: string): boolean {
 }
 
 export function buildSharedAuthStorageKey(siteId: SiteId, key: string): string {
-  return `PAPP_${siteId}_${key}`;
+  if (key === SHARED_CORE_SESSION_KEY) {
+    return `TRUAPI_SESSION_${siteId}`;
+  }
+  return `TRUAPI_${siteId}_${key}`;
 }
 
 /**
diff --git a/packages/protocol/src/client.ts b/packages/protocol/src/client.ts
index f5eed51..eb86366 100644
--- a/packages/protocol/src/client.ts
+++ b/packages/protocol/src/client.ts
@@ -492,6 +492,7 @@ const METHOD_TIMEOUTS: Partial<Record<ProtocolRequestMethod, number>> = {
   resolveOwner: 90_000,
   resolveExecutableManifest: 30_000,
   resolveRootManifest: 30_000,
+  bulletinSubmitPreimage: 150_000,
 };
 
 async function postRequest<M extends ProtocolRequestMethod>(
@@ -601,6 +602,10 @@ export async function resolveRootManifestRemote(
   })) as ManifestResult<RootManifest>;
 }
 
+export async function submitPreimageRemote(value: Uint8Array): Promise<void> {
+  await postRequest("bulletinSubmitPreimage", { value });
+}
+
 export async function hasSharedAuthSession(siteId: SiteId): Promise<boolean> {
   return (await postRequest("authHasSession", { siteId })) as boolean;
 }
diff --git a/packages/protocol/src/messages.ts b/packages/protocol/src/messages.ts
index e18859f..0158ccc 100644
--- a/packages/protocol/src/messages.ts
+++ b/packages/protocol/src/messages.ts
@@ -20,6 +20,7 @@ export interface ProtocolRequestMap {
   chainConnect: { genesisHash: string; connectionId: string };
   chainSend: { connectionId: string; message: string };
   chainDisconnect: { connectionId: string };
+  bulletinSubmitPreimage: { value: Uint8Array };
 }
 
 export type ProtocolRequestMethod = keyof ProtocolRequestMap;
diff --git a/packages/protocol/tests/auth-storage.test.ts b/packages/protocol/tests/auth-storage.test.ts
index ea1be5c..c3eeb34 100644
--- a/packages/protocol/tests/auth-storage.test.ts
+++ b/packages/protocol/tests/auth-storage.test.ts
@@ -10,6 +10,7 @@ import {
   isSharedAuthRequestMethod,
   isSharedAuthSiteId,
   isValidSharedAuthKey,
+  SHARED_CORE_SESSION_KEY,
 } from "@dotli/protocol/auth-storage";
 
 describe("shared auth storage helpers", () => {
@@ -69,11 +70,14 @@ describe("shared auth storage helpers", () => {
   });
 
   it("builds stable storage keys and detects empty session payloads", () => {
-    expect(buildSharedAuthStorageKey("dot.li", "SsoSessions")).toBe(
-      "PAPP_dot.li_SsoSessions",
+    expect(buildSharedAuthStorageKey("dot.li", SHARED_CORE_SESSION_KEY)).toBe(
+      "TRUAPI_SESSION_dot.li",
     );
-    expect(buildSharedAuthStorageKey("paseoli.dev", "SsoSessions")).toBe(
-      "PAPP_paseoli.dev_SsoSessions",
+    expect(
+      buildSharedAuthStorageKey("paseoli.dev", SHARED_CORE_SESSION_KEY),
+    ).toBe("TRUAPI_SESSION_paseoli.dev");
+    expect(buildSharedAuthStorageKey("dot.li", "UserSecrets")).toBe(
+      "TRUAPI_dot.li_UserSecrets",
     );
     expect(hasStoredSharedAuthSession(null)).toBe(false);
     expect(hasStoredSharedAuthSession("")).toBe(false);
diff --git a/packages/resolver/src/bulletin-rpc.ts b/packages/resolver/src/bulletin-rpc.ts
new file mode 100644
index 0000000..0dc69b9
--- /dev/null
+++ b/packages/resolver/src/bulletin-rpc.ts
@@ -0,0 +1,198 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+// Trusted-RPC Bulletin Paseo preimage submission.
+//
+// This is the rpc-gateway counterpart to `./bulletin`: it submits
+// TransactionStorage.store through configured WSS JSON-RPC endpoints and
+// intentionally does not import smoldot.
+
+import {
+  AccountId,
+  createClient,
+  Enum,
+  type PolkadotClient,
+} from "polkadot-api";
+import { getWsProvider } from "polkadot-api/ws";
+import { getPolkadotSigner } from "@polkadot-api/signer";
+import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
+import {
+  DEV_PHRASE,
+  entropyToMiniSecret,
+  mnemonicToEntropy,
+} from "@polkadot-labs/hdkd-helpers";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import { log } from "@dotli/shared/log";
+
+let bulletinRpcClient: PolkadotClient | null = null;
+let bulletinRpcClientPromise: Promise<PolkadotClient> | null = null;
+
+export async function ensureBulletinRpcClient(): Promise<PolkadotClient> {
+  if (bulletinRpcClient !== null) {
+    return bulletinRpcClient;
+  }
+  bulletinRpcClientPromise ??= (async () => {
+    const rpcs = getActiveServicesConfig().bulletin.rpcs;
+    if (rpcs.length === 0) {
+      throw new Error("No Bulletin RPC endpoints configured for this network");
+    }
+    const provider = getWsProvider([...rpcs], {
+      heartbeatTimeout: 120_000,
+    });
+    const candidate = createClient(provider);
+    try {
+      await candidate.getFinalizedBlock();
+    } catch (err) {
+      try {
+        candidate.destroy();
+        // eslint-disable-next-line no-restricted-syntax -- best-effort teardown; the original RPC sync error is rethrown below.
+      } catch {
+        /* already dead */
+      }
+      bulletinRpcClient = null;
+      bulletinRpcClientPromise = null;
+      throw err;
+    }
+    bulletinRpcClient = candidate;
+    log.warn("[dot.li bulletin-rpc] Client synced to finalized block");
+    return bulletinRpcClient;
+  })().catch((err: unknown) => {
+    bulletinRpcClientPromise = null;
+    throw err;
+  });
+  return bulletinRpcClientPromise;
+}
+
+export function getTestSigner(): ReturnType<typeof getPolkadotSigner> {
+  const entropy = mnemonicToEntropy(DEV_PHRASE);
+  const miniSecret = entropyToMiniSecret(entropy);
+  const derive = sr25519CreateDerive(miniSecret);
+  const alice = derive("//Alice");
+
+  return getPolkadotSigner(alice.publicKey, "Sr25519", (input: Uint8Array) =>
+    alice.sign(input),
+  );
+}
+
+const TX_TIMEOUT_MS = 120_000;
+const DEFAULT_AUTH_TRANSACTIONS = 100;
+const DEFAULT_AUTH_BYTES = 100 * 1024 * 1024;
+
+interface WatchedTransaction {
+  signSubmitAndWatch(signer: ReturnType<typeof getPolkadotSigner>): {
+    subscribe(observer: {
+      next(ev: {
+        type: string;
+        found?: boolean;
+        ok?: boolean;
+        dispatchError?: { type: string; value: unknown };
+      }): void;
+      error(e: unknown): void;
+    }): { unsubscribe(): void };
+  };
+}
+
+interface StorageAuthorization {
+  extent: {
+    transactions: number;
+    bytes: bigint;
+  };
+  expiration: number;
+}
+
+async function ensureStorageAuthorization(
+  client: PolkadotClient,
+  api: ReturnType<PolkadotClient["getUnsafeApi"]>,
+  signer: ReturnType<typeof getPolkadotSigner>,
+  dataLength: number,
+): Promise<void> {
+  const finalized = await client.getFinalizedBlock();
+  const signerAddress = AccountId().dec(signer.publicKey);
+  const authKey = Enum("Account", signerAddress);
+  const authorization =
+    (await api.query.TransactionStorage.Authorizations.getValue(authKey)) as
+      | StorageAuthorization
+      | undefined;
+
+  if (
+    authorization &&
+    authorization.expiration > finalized.number &&
+    authorization.extent.transactions > 0 &&
+    authorization.extent.bytes >= BigInt(dataLength)
+  ) {
+    return;
+  }
+
+  const tx = api.tx.TransactionStorage.authorize_account({
+    who: signerAddress,
+    transactions: DEFAULT_AUTH_TRANSACTIONS,
+    bytes: BigInt(DEFAULT_AUTH_BYTES),
+  });
+  await submitTransaction(tx, signer, "Bulletin RPC authorization tx failed");
+}
+
+export async function submitPreimageTransactionViaRpc(
+  data: Uint8Array,
+  signer: ReturnType<typeof getPolkadotSigner>,
+): Promise<void> {
+  const client = await ensureBulletinRpcClient();
+  const api = client.getUnsafeApi();
+  await ensureStorageAuthorization(client, api, signer, data.byteLength);
+  const tx = api.tx.TransactionStorage.store({ data });
+
+  await submitTransaction(tx, signer, "Bulletin RPC tx failed");
+}
+
+async function submitTransaction(
+  tx: WatchedTransaction,
+  signer: ReturnType<typeof getPolkadotSigner>,
+  failureMessage: string,
+): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    let resolved = false;
+
+    const subscription = tx.signSubmitAndWatch(signer).subscribe({
+      next: (ev: {
+        type: string;
+        found?: boolean;
+        ok?: boolean;
+        dispatchError?: { type: string; value: unknown };
+      }) => {
+        log.debug(`[dot.li bulletin-rpc] tx event`, { type: ev.type });
+        if (resolved || ev.type !== "txBestBlocksState" || ev.found !== true) {
+          return;
+        }
+        resolved = true;
+        clearTimeout(timeoutId);
+        subscription.unsubscribe();
+        if (ev.ok === false) {
+          reject(
+            new Error(
+              `TransactionStorage.store dispatch failed: ${ev.dispatchError?.type ?? "Unknown"}`,
+              { cause: ev.dispatchError },
+            ),
+          );
+          return;
+        }
+        resolve();
+      },
+      error: (e: unknown) => {
+        if (resolved) {
+          return;
+        }
+        resolved = true;
+        clearTimeout(timeoutId);
+        subscription.unsubscribe();
+        reject(new Error(failureMessage, { cause: e }));
+      },
+    });
+
+    const timeoutId = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        subscription.unsubscribe();
+        reject(new Error("Transaction timed out"));
+      }
+    }, TX_TIMEOUT_MS);
+  });
+}
diff --git a/packages/resolver/src/bulletin.ts b/packages/resolver/src/bulletin.ts
new file mode 100644
index 0000000..2d5e494
--- /dev/null
+++ b/packages/resolver/src/bulletin.ts
@@ -0,0 +1,195 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+// dot.li Bulletin Paseo chain connection for preimage operations.
+//
+// Provides a smoldot-backed polkadot-api client for the Bulletin Paseo
+// parachain, used to submit preimage data via TransactionStorage.store().
+// Uses Alice test signer (DEV_PHRASE) matching the browser host's current
+// implementation. TODO: replace with production signer.
+
+import {
+  AccountId,
+  createClient,
+  Enum,
+  type PolkadotClient,
+} from "polkadot-api";
+import { getSmProvider } from "polkadot-api/sm-provider";
+import { getPolkadotSigner } from "@polkadot-api/signer";
+import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
+import {
+  DEV_PHRASE,
+  entropyToMiniSecret,
+  mnemonicToEntropy,
+} from "@polkadot-labs/hdkd-helpers";
+import { log } from "@dotli/shared/log";
+import { getBulletinChain, makeNonRemovingChain } from "./smoldot";
+
+let bulletinClient: PolkadotClient | null = null;
+let bulletinClientPromise: Promise<PolkadotClient> | null = null;
+
+export async function ensureBulletinClient(): Promise<PolkadotClient> {
+  if (bulletinClient !== null) {
+    return bulletinClient;
+  }
+  bulletinClientPromise ??= (async () => {
+    const chain = await getBulletinChain();
+    const nonRemoving = makeNonRemovingChain(chain);
+    const provider = getSmProvider(() => nonRemoving);
+    const candidate = createClient(provider);
+    try {
+      await candidate.getFinalizedBlock();
+    } catch (err) {
+      try {
+        candidate.destroy();
+        // eslint-disable-next-line no-restricted-syntax -- best-effort teardown of a never-fully-initialised client; the real error is rethrown below.
+      } catch {
+        /* already dead */
+      }
+      bulletinClient = null;
+      bulletinClientPromise = null;
+      throw err;
+    }
+    bulletinClient = candidate;
+    log.warn("[dot.li bulletin] Client synced to finalized block");
+    return bulletinClient;
+  })().catch((err: unknown) => {
+    bulletinClientPromise = null;
+    throw err;
+  });
+  return bulletinClientPromise;
+}
+
+export function getTestSigner(): ReturnType<typeof getPolkadotSigner> {
+  const entropy = mnemonicToEntropy(DEV_PHRASE);
+  const miniSecret = entropyToMiniSecret(entropy);
+  const derive = sr25519CreateDerive(miniSecret);
+  const alice = derive("//Alice");
+
+  return getPolkadotSigner(alice.publicKey, "Sr25519", (input: Uint8Array) =>
+    alice.sign(input),
+  );
+}
+
+const TX_TIMEOUT_MS = 120_000;
+const DEFAULT_AUTH_TRANSACTIONS = 100;
+const DEFAULT_AUTH_BYTES = 100 * 1024 * 1024;
+
+interface WatchedTransaction {
+  signSubmitAndWatch(signer: ReturnType<typeof getPolkadotSigner>): {
+    subscribe(observer: {
+      next(ev: {
+        type: string;
+        found?: boolean;
+        ok?: boolean;
+        dispatchError?: { type: string; value: unknown };
+      }): void;
+      error(e: unknown): void;
+    }): { unsubscribe(): void };
+  };
+}
+
+interface StorageAuthorization {
+  extent: {
+    transactions: number;
+    bytes: bigint;
+  };
+  expiration: number;
+}
+
+async function ensureStorageAuthorization(
+  client: PolkadotClient,
+  api: ReturnType<PolkadotClient["getUnsafeApi"]>,
+  signer: ReturnType<typeof getPolkadotSigner>,
+  dataLength: number,
+): Promise<void> {
+  const finalized = await client.getFinalizedBlock();
+  const signerAddress = AccountId().dec(signer.publicKey);
+  const authKey = Enum("Account", signerAddress);
+  const authorization =
+    (await api.query.TransactionStorage.Authorizations.getValue(authKey)) as
+      | StorageAuthorization
+      | undefined;
+
+  if (
+    authorization &&
+    authorization.expiration > finalized.number &&
+    authorization.extent.transactions > 0 &&
+    authorization.extent.bytes >= BigInt(dataLength)
+  ) {
+    return;
+  }
+
+  const tx = api.tx.TransactionStorage.authorize_account({
+    who: signerAddress,
+    transactions: DEFAULT_AUTH_TRANSACTIONS,
+    bytes: BigInt(DEFAULT_AUTH_BYTES),
+  });
+  await submitTransaction(tx, signer, "Bulletin authorization tx failed");
+}
+
+export async function submitPreimageTransaction(
+  data: Uint8Array,
+  signer: ReturnType<typeof getPolkadotSigner>,
+): Promise<void> {
+  const client = await ensureBulletinClient();
+  const api = client.getUnsafeApi();
+  await ensureStorageAuthorization(client, api, signer, data.byteLength);
+  const tx = api.tx.TransactionStorage.store({ data });
+
+  await submitTransaction(tx, signer, "Bulletin tx failed");
+}
+
+async function submitTransaction(
+  tx: WatchedTransaction,
+  signer: ReturnType<typeof getPolkadotSigner>,
+  failureMessage: string,
+): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    let resolved = false;
+
+    const subscription = tx.signSubmitAndWatch(signer).subscribe({
+      next: (ev: {
+        type: string;
+        found?: boolean;
+        ok?: boolean;
+        dispatchError?: { type: string; value: unknown };
+      }) => {
+        log.debug("[dot.li bulletin] tx event", { type: ev.type });
+        if (resolved || ev.type !== "txBestBlocksState" || ev.found !== true) {
+          return;
+        }
+        resolved = true;
+        clearTimeout(timeoutId);
+        subscription.unsubscribe();
+        if (ev.ok === false) {
+          reject(
+            new Error(
+              `TransactionStorage.store dispatch failed: ${ev.dispatchError?.type ?? "Unknown"}`,
+              { cause: ev.dispatchError },
+            ),
+          );
+          return;
+        }
+        resolve();
+      },
+      error: (e: unknown) => {
+        if (resolved) {
+          return;
+        }
+        resolved = true;
+        clearTimeout(timeoutId);
+        subscription.unsubscribe();
+        reject(new Error(failureMessage, { cause: e }));
+      },
+    });
+
+    const timeoutId = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        subscription.unsubscribe();
+        reject(new Error("Transaction timed out"));
+      }
+    }, TX_TIMEOUT_MS);
+  });
+}
diff --git a/packages/resolver/tests/chains.test.ts b/packages/resolver/tests/chains.test.ts
new file mode 100644
index 0000000..1355544
--- /dev/null
+++ b/packages/resolver/tests/chains.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { getActiveSupportedGenesisHashes } from "@dotli/config/network";
+import { isChainSupported } from "@dotli/resolver/chains";
+
+describe("isChainSupported", () => {
+  it("accepts every chain the host runtime can expose", () => {
+    for (const genesisHash of getActiveSupportedGenesisHashes()) {
+      expect(isChainSupported(genesisHash)).toBe(true);
+    }
+  });
+
+  it("rejects unknown genesis hashes", () => {
+    expect(isChainSupported("0xdeadbeef")).toBe(false);
+  });
+});
diff --git a/packages/resolver/tests/rpc-chain.test.ts b/packages/resolver/tests/rpc-chain.test.ts
new file mode 100644
index 0000000..67269d9
--- /dev/null
+++ b/packages/resolver/tests/rpc-chain.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it, vi } from "vitest";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import {
+  createRpcChainProvider,
+  isRpcChainSupported,
+} from "@dotli/resolver/rpc-chain";
+
+const mocks = vi.hoisted(() => ({
+  getWsProvider: vi.fn(),
+}));
+
+vi.mock("polkadot-api/ws", () => ({
+  getWsProvider: mocks.getWsProvider,
+}));
+
+describe("rpc-chain", () => {
+  it("supports the active People chain when RPC endpoints are configured", () => {
+    const people = getActiveServicesConfig().people;
+
+    expect(isRpcChainSupported(people.genesis)).toBe(true);
+
+    const provider = {};
+    mocks.getWsProvider.mockReturnValueOnce(provider);
+
+    expect(createRpcChainProvider(people.genesis)).toBe(provider);
+    expect(mocks.getWsProvider).toHaveBeenCalledWith([...people.rpcs], {
+      heartbeatTimeout: 120_000,
+    });
+  });
+
+  it("rejects unknown genesis hashes", () => {
+    expect(isRpcChainSupported("0xdeadbeef")).toBe(false);
+    expect(createRpcChainProvider("0xdeadbeef")).toBeNull();
+  });
+});
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 6ace300..94728b7 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -22,6 +22,7 @@
     "vitest": "^4.1.8"
   },
   "dependencies": {
-    "@dotli/config": "workspace:*"
+    "@dotli/config": "workspace:*",
+    "@noble/hashes": "^2.2.0"
   }
 }
diff --git a/packages/shared/src/hex.ts b/packages/shared/src/hex.ts
new file mode 100644
index 0000000..342ddd7
--- /dev/null
+++ b/packages/shared/src/hex.ts
@@ -0,0 +1,12 @@
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
+
+export type HexString = `0x${string}`;
+
+export function toHex(bytes: Uint8Array): HexString {
+  return `0x${bytesToHex(bytes)}`;
+}
+
+export function fromHex(hex: string): Uint8Array {
+  const stripped = hex.startsWith("0x") ? hex.slice(2) : hex;
+  return hexToBytes(stripped);
+}
diff --git a/packages/storage/src/scheduled-notifications.ts b/packages/storage/src/scheduled-notifications.ts
index 1d3fb11..256bc0a 100644
--- a/packages/storage/src/scheduled-notifications.ts
+++ b/packages/storage/src/scheduled-notifications.ts
@@ -12,7 +12,7 @@
  * `scheduled_notifications` store (keyPath hostId, autoIncrement) holds
  * the records. The `notification_counters` store (keyPath productId)
  * holds the monotonic per-product `next` value, so each schedule returns
- * a stable, unique `perProductId` (the host-api NotificationId).
+ * a stable, unique `perProductId` for TrUAPI notification callbacks.
  */
 
 import { getDb } from "./db";
diff --git a/packages/truapi-debug/DEBUG_PANEL.md b/packages/truapi-debug/DEBUG_PANEL.md
index bbc4ede..87afe9b 100644
--- a/packages/truapi-debug/DEBUG_PANEL.md
+++ b/packages/truapi-debug/DEBUG_PANEL.md
@@ -100,31 +100,31 @@ aligned store.
 ### 1. TrUAPI — host ↔ product messages
 
 The postMessage protocol between the dotli host and product iframes,
-captured by `onHostApiDebugMessage` from `@novasamatech/host-container`.
-Every message is already decoded (no SCALE bytes). Categories:
+captured from the Rust-backed TrUAPI bridge. The producer currently decodes
+the transport envelope only: each event includes direction, request id, wire
+id, method tag, and raw SCALE payload bytes (`payload.value.bytes`). Method
+payload decoding is intentionally not duplicated in this package yet.
+Categories:
 
 - `host_*` — accounts, signing, scoped storage, chain connections,
   statement-store proxying, preimage submission, permissions prompts,
   push notifications.
 - `remote_chain_*` — chainHead, chainSpec, and transaction methods
   (one-to-one wrap of the new Substrate JSON-RPC spec).
-- Many more — anything in the `HostApiProtocol` enum.
+- Many more — anything in the generated TrUAPI wire table.
 
-### 2. host-papp — SSO / attestation / session
+### 2. SSO
 
-Semantic protocol flows that sit above the statement-store transport,
-captured by `onHostPappDebugMessage` from `@novasamatech/host-papp/debug`.
+Semantic login/pairing events emitted by the host and Rust core around the
+statement-store transport.
 
 - `sso:*` — QR-code pairing flow (`pairing_started`,
-  `deeplink_generated`, `awaiting_response`, `response_received`,
+  `deeplink_generated`, `awaiting_response`,
   `session_established`, `pairing_failed`).
-- `attestation:*` — on-chain guest identity registration
-  (`started`, `username_claimed`, `allowance_granted`,
-  `vrf_proof_generated`, `person_registered`, `completed`, `failed`).
-- `session:*` — post-pairing wallet ↔ host messages in both
-  directions (`peer_action_received/processed/failed`,
-  `host_action_sent/response_received/failed`, plus `opened` and
-  `terminated`).
+- `login_request_*` — topbar login request lifecycle from encode/send to the
+  typed Rust-core result.
+- `statement_store_*` — JSON-RPC connect/request/response taxonomy used by
+  the SSO pairing poller.
 
 ### 3. dotli — boot / resolve / render / bridge / failover
 
@@ -137,7 +137,9 @@ Dotli-internal host-side orchestration, captured by
 - `resolve:*` — `started`, `phase`, `storage_read`, `completed`,
   `failed`.
 - `render:*` — `iframe_begin`, `iframe_ready`.
-- `bridge:*` — `setup_begin`, `setup_ready`, `nested_detected`.
+- `bridge:*` — `sso_listeners_ready`, `setup_begin`, `setup_ready`,
+  `iframe_load`, `first_inbound`, `first_outbound`.
+- `sso:*` — current login, pairing, statement-store, and session events.
 - `failover:*` — `chain_backend` (user-triggered backend switch).
 
 ## Views
@@ -220,8 +222,7 @@ Click any row, box, or pill to pin it. The detail pane shows:
 
 ### For system events
 
-- **Core metadata**: time, source (`host-papp` or `dotli`), layer,
-  event, flowId.
+- **Core metadata**: time, source, layer, event, flowId.
 - **Summary** — the short sentence from `system-summary.ts`.
 - **"What is this?"** — a collapsible `<details>` block with a
   long-form paragraph explaining what the subsystem is doing at
@@ -263,11 +264,9 @@ In the Timeline:
 - A **box** represents a flow that has (or will have) a clear
   beginning and end. Examples: a TrUAPI request → response pair, a
   chainHead.body operation from request → terminal event on its
-  follow subscription, a whole SSO pairing flow, an attestation
-  sequence.
+  follow subscription, or a whole SSO pairing flow.
 - A **pill** represents a point-in-time event with no natural end —
-  `failover:chain_backend`, `bridge:nested_detected`, and single-
-  event system flows.
+  `failover:chain_backend` and single-event system flows.
 - **Pending boxes** have a dashed bottom edge. They grow downward
   as time advances; once the terminal event lands, the box snaps to
   its final height.
@@ -286,8 +285,8 @@ their own left-edge column — not boxes.
   (otherwise it'd clutter the view with one-off queries). The
   header shows the chain's friendly name when known (Paseo, Paseo
   Asset Hub, Paseo Bulletin) or a short hex hash otherwise.
-- **System swimlane** — everything from the `host-papp` and `dotli`
-  buses. Always present if any system event is visible.
+- **System swimlane** — everything from the system event buses. Always
+  present if any system event is visible.
 - **Other swimlane** — TrUAPI traffic that isn't chain-related
   (host API calls for signing, storage, accounts, statement store,
   etc.).
@@ -313,10 +312,9 @@ subsequent no-listener emits go back to being silent no-ops.
 This makes the captured boot sequence consistent regardless of
 browser cache warmth.
 
-The TrUAPI hook and the host-papp hook don't need the same
-mechanism in practice: TrUAPI traffic can't start before a product
-iframe is rendered (long after the panel is up), and SSO flows only
-begin on user interaction.
+The TrUAPI and SSO hooks don't need the same mechanism in practice:
+TrUAPI traffic can't start before a product iframe is rendered (long
+after the panel is up), and SSO flows only begin on user interaction.
 
 ### Keyed reconciliation
 
@@ -348,14 +346,15 @@ layer already being observed.
   calls into JSON-RPC over WebSocket. The TrUAPI hook already shows
   the semantic shape; the JSON-RPC layer is just the wire format.
 - **statement-store transport** (encrypt/decrypt, RPC adapter,
-  subscription multiplexer). Pure transport for SSO / session
-  messages; the SSO / session hooks capture the semantic protocol
-  on top.
+  subscription multiplexer). Pure transport for SSO messages; the
+  `sso:statement_store_*` hooks capture the host-visible protocol
+  taxonomy on top.
 - **smoldot internals** (raw log callback stream). Dependency
   chatter, not host logic. The resolver's decision outcomes are
   captured instead.
-- **host-container raw iframe postMessage**. Encoded form of TrUAPI
-  messages already observed in decoded form.
+- **Raw iframe postMessage**. The TrUAPI hook already captures the
+  transport envelope and payload bytes at the bridge boundary. Add
+  method-payload decoding there if the raw bytes become insufficient.
 - **handoff-service file chunking**. Transfer transport, not
   semantic protocol.
 - **Bulletin preimage submission**. Direct forward of the TrUAPI
@@ -367,22 +366,21 @@ bus and the panel subscribes to all of them.
 
 ## Adding a new hook
 
-1. **Pick the right bus.** If the event originates in the SDK
-   (host-api / host-container / host-papp / statement-store), it
-   belongs in the SDK's bus (and needs an upstream release in
-   `@novasamatech/*`). If it originates in dotli, use the dotli bus.
-2. **Add an event type.** Extend the relevant discriminated union
-   (`DotliDebugEvent`, `HostPappDebugEvent`) with a new variant
-   carrying `layer`, `event`, `flowId`, `timestamp`, and a typed
-   `payload`.
+1. **Pick the right bus.** If the event originates in dotli host
+   orchestration, use the dotli bus. If it originates in TrUAPI traffic
+   or SSO flow handling, use the matching TrUAPI/system bus.
+2. **Add an event type.** Extend the relevant discriminated union with
+   a new variant carrying `layer`, `event`, `flowId`, `timestamp`, and a
+   typed `payload`.
 3. **Add a summary.** Extend `system-summary.ts` (one-liner) and
    `system-explanations.ts` (long-form "What is this?").
 4. **Add a flow terminator if needed.** If the new event closes a
-   multi-step flow, add its suffix to `SYSTEM_TERMINATOR_SUFFIXES`
-   in `timeline-layout.ts` so pending-vs-complete is computed right.
-5. **Emit.** Call `emitDotliDebugEvent(...)` or
-   `emitHostPappDebugMessage(...)` at the decision point. Check
-   `hasDotliDebugListeners()` first if payload construction is
+   multi-step flow, add an exact `layer:event` entry to
+   `SYSTEM_TERMINATOR_EVENTS` or, for a true event family, a suffix to
+   `SYSTEM_TERMINATOR_SUFFIXES` in `timeline-layout.ts` so
+   pending-vs-complete is computed right.
+5. **Emit.** Call the matching debug-bus emitter at the decision point.
+   Check `hasDotliDebugListeners()` first if payload construction is
    expensive.
 
 No UI changes required — the filters, swimlanes, and detail pane
diff --git a/packages/truapi-debug/package.json b/packages/truapi-debug/package.json
index 111c272..6999f14 100644
--- a/packages/truapi-debug/package.json
+++ b/packages/truapi-debug/package.json
@@ -9,6 +9,7 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "lint": "bunx eslint src/"
   },
   "devDependencies": {
@@ -16,13 +17,12 @@
     "@dotli/typescript-config": "workspace:*",
     "eslint": "^10.5.0",
     "typescript": "~6.0.3",
-    "vite": "^8.0.16"
+    "vite": "^8.0.16",
+    "vitest": "^4.1.8"
   },
   "dependencies": {
+    "@dotli/config": "workspace:*",
     "@dotli/shared": "workspace:*",
-    "@novasamatech/host-api": "0.8.9",
-    "@novasamatech/host-container": "0.8.9",
-    "@novasamatech/host-papp": "0.8.9",
     "nanoevents": "^9.1.0"
   }
 }
diff --git a/packages/truapi-debug/src/chain-decode.ts b/packages/truapi-debug/src/chain-decode.ts
index 6663f28..413125f 100644
--- a/packages/truapi-debug/src/chain-decode.ts
+++ b/packages/truapi-debug/src/chain-decode.ts
@@ -4,19 +4,17 @@
 // TrUAPI chain message decoder
 //
 // Pure function that takes a TrUAPI payload tag (e.g.
-// `remote_chain_head_body_request`) plus its already-decoded value and
-// returns the JSON-RPC-level correlation keys the event carries:
-// `genesisHash`, `followSubscriptionId`, `operationId`, `blockHash`,
-// and (for follow receive events) the ChainHeadEvent variant tag.
+// `remote_chain_head_body_request`) plus an already-decoded value and returns
+// the JSON-RPC-level correlation keys the event carries: `genesisHash`,
+// `followSubscriptionId`, `operationId`, `blockHash`, and (for follow receive
+// events) the ChainHeadEvent variant tag.
 //
-// The hook in @novasamatech/host-container delivers payloads in
-// already-decoded form (scale-ts conventions: Hex becomes a hex string,
-// Option becomes T|undefined, Nullable becomes T|null, Enum becomes
-// {tag, value}, Result becomes {success, value}), so this module is a
-// shape-matching walk, not a SCALE decode.
+// Current dotli producers emit wire metadata plus raw SCALE bytes:
+// `{ wireId, bytes }`. Those raw payloads intentionally return null here.
+// The shape-matching decoder below is retained for any producer that opts into
+// method-payload decoding before insertion.
 //
-// Shapes mirror packages/host-api/src/protocol/v1/chainInteraction.ts
-// in the triangle-js-sdks repo.
+// Shapes mirror the TrUAPI chain callback payloads.
 
 /** High-level categorisation of a chain message. Direction (request vs
  *  response vs subscription start/receive) is already known from the
@@ -105,6 +103,9 @@ export function decodeChainAnnotations(
   tag: string,
   rawPayload: unknown,
 ): ChainAnnotations | null {
+  if (isRawWirePayload(rawPayload)) {
+    return null;
+  }
   const payload = peelVersion(rawPayload);
   switch (tag) {
     // chainHead.follow subscription
@@ -253,6 +254,18 @@ export function decodeChainAnnotations(
   }
 }
 
+function isRawWirePayload(payload: unknown): boolean {
+  const obj = asObj(payload);
+  return (
+    typeof obj?.wireId === "number" &&
+    (obj.bytes instanceof Uint8Array ||
+      (typeof obj.bytes === "object" &&
+        obj.bytes !== null &&
+        (obj.bytes as { constructor?: { name?: string } }).constructor?.name ===
+          "Uint8Array"))
+  );
+}
+
 /**
  * Human-readable label for a row, derived from the annotations. The
  * original TrUAPI method tag stays available on the event, so this label
@@ -408,12 +421,10 @@ function extractErrorReason(v: unknown): string | undefined {
   if (o === undefined) {
     return undefined;
   }
-  // `Err()` from @novasamatech/scale wraps struct data in an Error
-  // instance whose payload holds the struct, so `.payload.reason` is the
-  // canonical location. Top-level `.reason` is kept as a fallback in
-  // case a future error shape skips the Error wrapper, and the Error's
-  // `.message` is the last resort so we never render "err: ?" when
-  // there's a usable string somewhere on the value.
+  // Error-shaped decoded values can carry structured details in
+  // `.payload.reason`. Top-level `.reason` is kept as a fallback, and the
+  // Error's `.message` is the last resort so we never render "err: ?"
+  // when there's a usable string somewhere on the value.
   const payload = asObj(o.payload);
   const reason = asString(payload?.reason) ?? asString(o.reason);
   if (reason !== undefined) {
diff --git a/packages/truapi-debug/src/chain-summary.ts b/packages/truapi-debug/src/chain-summary.ts
index 2ffc3d9..ffe86c0 100644
--- a/packages/truapi-debug/src/chain-summary.ts
+++ b/packages/truapi-debug/src/chain-summary.ts
@@ -3,10 +3,10 @@
 
 // Human-readable summary of a chain-protocol message
 //
-// Translates the decoded payload of a `remote_chain_*` TrUAPI message
-// into a single-sentence description. Used in the detail pane so a
-// reader doesn't have to parse the JSON to understand what a message
-// is doing.
+// Translates an already-decoded `remote_chain_*` TrUAPI payload into a
+// single-sentence description. Current dotli wire-frame events carry raw SCALE
+// bytes, so this helper is only used by producers that decode method payloads
+// before inserting debug events.
 //
 // Returns `null` for non-chain messages or unknown shapes. The caller
 // omits the summary section when null.
diff --git a/packages/truapi-debug/src/dotli-debug-bus.ts b/packages/truapi-debug/src/dotli-debug-bus.ts
index b31b5e5..4ef7178 100644
--- a/packages/truapi-debug/src/dotli-debug-bus.ts
+++ b/packages/truapi-debug/src/dotli-debug-bus.ts
@@ -4,11 +4,9 @@
 // dotli-internal debug event bus
 //
 // Module-global pub/sub for boot / resolve / render / bridge / failover
-// events. Mirrors the lazy-subscription pattern used by
-// `onHostApiDebugMessage` and `onHostPappDebugMessage` so emit cost
-// stays near zero when no listener is attached (the primary code path
-// checks `hasDotliDebugListeners()` before constructing expensive
-// payloads).
+// events. The emit path stays near zero-cost when no listener is attached
+// because the primary code path checks `hasDotliDebugListeners()` before
+// constructing expensive payloads.
 //
 // Runtime gate: the bus stays `null` until `enableDotliDebugBuffering()`
 // flips it on. That call is made by `resolveTruapiDebugMode()` in
@@ -24,9 +22,12 @@
 import { createNanoEvents } from "nanoevents";
 
 import type { DotliDebugEvent } from "./dotli-debug-types.ts";
+import type { TruapiDebugMessageEvent } from "./event-store.ts";
+
+export type DotliDebugBusEvent = DotliDebugEvent | TruapiDebugMessageEvent;
 
 let bus: ReturnType<
-  typeof createNanoEvents<{ event: (e: DotliDebugEvent) => void }>
+  typeof createNanoEvents<{ event: (e: DotliDebugBusEvent) => void }>
 > | null = null;
 let listenerCount = 0;
 
@@ -46,7 +47,7 @@ let listenerCount = 0;
  */
 const BUFFER_MAX = 512;
 let bufferingEnabled = false;
-let bufferedEvents: DotliDebugEvent[] = [];
+let bufferedEvents: DotliDebugBusEvent[] = [];
 
 function noopUnsubscribe(): void {
   /* prod stub returned from `onDotliDebugEvent` when the bus is disabled */
@@ -58,13 +59,13 @@ function noopUnsubscribe(): void {
  * decision to enable the debug panel, before any emit site runs.
  */
 export function enableDotliDebugBuffering(): void {
-  bus ??= createNanoEvents<{ event: (e: DotliDebugEvent) => void }>();
+  bus ??= createNanoEvents<{ event: (e: DotliDebugBusEvent) => void }>();
   bufferingEnabled = true;
 }
 
 /** Emit a debug event. Silent no-op when no listener is attached
  *  AND buffering is off. */
-export function emitDotliDebugEvent(event: DotliDebugEvent): void {
+export function emitDotliDebugEvent(event: DotliDebugBusEvent): void {
   if (bus === null) {
     return;
   }
@@ -95,7 +96,7 @@ export function hasDotliDebugListeners(): boolean {
  * is a catch-up mechanism, not a persistent replay log).
  */
 export function onDotliDebugEvent(
-  callback: (event: DotliDebugEvent) => void,
+  callback: (event: DotliDebugBusEvent) => void,
 ): () => void {
   if (bus === null) {
     return noopUnsubscribe;
diff --git a/packages/truapi-debug/src/dotli-debug-types.ts b/packages/truapi-debug/src/dotli-debug-types.ts
index 8ccfb86..f483dfb 100644
--- a/packages/truapi-debug/src/dotli-debug-types.ts
+++ b/packages/truapi-debug/src/dotli-debug-types.ts
@@ -6,9 +6,8 @@
 // Events emitted by dotli host-side logic that is independent of the
 // TrUAPI transport: boot orchestration, resolver phases, render +
 // bridge-setup lifecycles, and backend failover decisions. These
-// complement the host-papp SSO/session events (which come from the
-// SDK) and the TrUAPI host-to-product message events (from
-// `@novasamatech/host-container`).
+// complement the TrUAPI host-to-product message events and Rust-core
+// SSO events.
 //
 // Events are point-in-time OR paired start/end. The consumer decides
 // rendering: multi-event flows (same `flowId`) become boxes, single-
@@ -19,6 +18,7 @@ export type DotliDebugEvent =
   | ResolveEvent
   | RenderEvent
   | BridgeEvent
+  | SsoEvent
   | FailoverEvent
   | MainEvent
   | SandboxEvent;
@@ -367,6 +367,13 @@ export type RenderEvent =
 
 /** Container bridge setup (TrUAPI bridge, per dApp iframe). */
 export type BridgeEvent =
+  | {
+      layer: "bridge";
+      event: "sso_listeners_ready";
+      flowId: string;
+      timestamp: number;
+      payload: Record<string, never>;
+    }
   | {
       layer: "bridge";
       event: "setup_begin";
@@ -417,16 +424,179 @@ export type BridgeEvent =
         label: string;
         productId: string;
       };
+    };
+
+/** SSO pairing lifecycle driven by host-owned login UI and Rust core. */
+export type SsoEvent =
+  | {
+      layer: "sso";
+      event: "login_event_received";
+      flowId: string;
+      timestamp: number;
+      payload: Record<string, never>;
     }
   | {
-      layer: "bridge";
-      event: "nested_detected";
+      layer: "sso";
+      event: "login_host_ready";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        host: "landing" | "product";
+      };
+    }
+  | {
+      layer: "sso";
+      event: "login_request_start" | "login_request_sent";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        requestId: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event:
+        | "login_request_encode_failed"
+        | "login_request_send_failed"
+        | "login_request_decode_failed";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        requestId: string;
+        reason: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "login_request_response";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        requestId: string;
+        result: "Success" | "AlreadyConnected" | "Rejected";
+      };
+    }
+  | {
+      layer: "sso";
+      event: "login_request_failed";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        requestId: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "present_pairing_callback";
       flowId: string;
       timestamp: number;
       payload: {
         label: string;
-        productId: string;
-        nestedIndex: number;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "pairing_started";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        label: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "deeplink_generated";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        label: string;
+        scheme: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "awaiting_response";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        label: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "statement_store_connecting";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        backend: string;
+        genesisHash: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "statement_store_connected";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        backend: string;
+        genesisHash: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "statement_store_connect_failed";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        backend: string;
+        genesisHash: string;
+        reason: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "statement_store_request";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        method: string;
+        requestId: string;
+        requestKind: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "statement_store_response";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        method: string;
+        requestId?: string;
+        requestKind: string;
+        remoteSubscriptionId?: string;
+        frameKind?: string;
+        eventName?: string;
+        statementCount?: number;
+        remaining?: number;
+        error?: string;
+      };
+    }
+  | {
+      layer: "sso";
+      event: "session_established";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        result: "Success" | "AlreadyConnected";
+      };
+    }
+  | {
+      layer: "sso";
+      event: "pairing_failed";
+      flowId: string;
+      timestamp: number;
+      payload: {
+        reason: string;
       };
     };
 
diff --git a/packages/truapi-debug/src/event-store.ts b/packages/truapi-debug/src/event-store.ts
index d50be4d..4bc0661 100644
--- a/packages/truapi-debug/src/event-store.ts
+++ b/packages/truapi-debug/src/event-store.ts
@@ -3,24 +3,21 @@
 
 // TrUAPI debug event store
 //
-// Ring buffer of debug events from three sources:
-//   - TrUAPI host-to-product messages (from @novasamatech/host-container).
-//   - Host-papp SSO/attestation/session events (from @novasamatech/host-papp).
-//   - dotli-internal boot/resolve/render/bridge/failover events (from
-//     @dotli/truapi-debug/dotli-debug-bus).
-//
-// All three sources store through the same ring and correlation index so
-// the panel treats them uniformly. A discriminated `kind` field keeps
-// the shape legible. `truapi` events carry a `requestId`, `system`
-// events (SDK plus dotli) carry a `flowId`. Both serve as the
-// correlation key used by `firstInGroup` and `eventsInGroup`.
+// Ring buffer of debug events from TrUAPI wire frames and dotli-internal
+// boot/resolve/render/bridge/failover/SSO sources.
 //
 // Events are never mutated after insertion.
 
-import type { HostApiDebugMessageEvent } from "@novasamatech/host-container";
-import type { HostPappDebugEvent } from "@novasamatech/host-papp/debug";
 import type { DotliDebugEvent } from "./dotli-debug-types.ts";
 
+export interface TruapiDebugMessageEvent {
+  kind: "truapi";
+  direction: "incoming" | "outgoing";
+  productId?: string;
+  requestId: string;
+  payload: { tag: string; value: unknown };
+}
+
 /** Monotonic sequence number assigned at insertion time. Stable, unique, and sortable. */
 export type EventSeq = number;
 
@@ -28,7 +25,7 @@ export interface StoredTruapiEvent {
   kind: "truapi";
   seq: EventSeq;
   receivedAt: number;
-  direction: HostApiDebugMessageEvent["direction"];
+  direction: TruapiDebugMessageEvent["direction"];
   productId: string | undefined;
   /** Correlation key for TrUAPI groups (request/response, subscription). */
   requestId: string;
@@ -40,8 +37,7 @@ export interface StoredSystemEvent {
   kind: "system";
   seq: EventSeq;
   receivedAt: number;
-  /** Which bus produced the event. `host-papp` for SDK-originated ones. */
-  source: "host-papp" | "dotli";
+  source: "dotli";
   layer: string;
   event: string;
   /** Correlation key for multi-event system flows (one flow = one box). */
@@ -102,11 +98,10 @@ export class EventStore {
   }
 
   /** Insert a TrUAPI host-to-product event. */
-  insertTruapi(ev: HostApiDebugMessageEvent): void {
+  insertTruapi(ev: TruapiDebugMessageEvent): void {
     if (this.paused) {
       return;
     }
-    const payload = ev.payload as { tag: string; value: unknown };
     const stored: StoredTruapiEvent = {
       kind: "truapi",
       seq: this.nextSeq++,
@@ -114,26 +109,8 @@ export class EventStore {
       direction: ev.direction,
       productId: ev.productId,
       requestId: ev.requestId,
-      tag: payload.tag,
-      payload: payload.value,
-    };
-    this.pushAndEvict(stored);
-  }
-
-  /** Insert a host-papp SDK-originated system event (SSO/session/attestation). */
-  insertHostPapp(ev: HostPappDebugEvent): void {
-    if (this.paused) {
-      return;
-    }
-    const stored: StoredSystemEvent = {
-      kind: "system",
-      seq: this.nextSeq++,
-      receivedAt: ev.timestamp,
-      source: "host-papp",
-      layer: ev.layer,
-      event: ev.event,
-      flowId: ev.flowId,
-      payload: ev.payload,
+      tag: ev.payload.tag,
+      payload: ev.payload.value,
     };
     this.pushAndEvict(stored);
   }
diff --git a/packages/truapi-debug/src/index.ts b/packages/truapi-debug/src/index.ts
index e8e3d57..f61a636 100644
--- a/packages/truapi-debug/src/index.ts
+++ b/packages/truapi-debug/src/index.ts
@@ -3,8 +3,7 @@
 
 // TrUAPI debug package public API.
 //
-// Host-side debug panel that listens to the experimental
-// `onHostApiDebugMessage` hook from `@novasamatech/host-container` and
-// renders every host <-> product message in a docked, filterable panel.
+// Host-side debug panel that renders dotli-internal events in a docked,
+// filterable panel.
 
 export { setupTruapiDebugPanel, type SetupOptions } from "./panel.ts";
diff --git a/packages/truapi-debug/src/panel.ts b/packages/truapi-debug/src/panel.ts
index 30e3e7d..65d47ca 100644
--- a/packages/truapi-debug/src/panel.ts
+++ b/packages/truapi-debug/src/panel.ts
@@ -3,18 +3,14 @@
 
 // TrUAPI debug panel DOM and interaction.
 //
-// A docked, resizable panel that lists every host <-> product message
-// observed via the experimental `onHostApiDebugMessage` hook from
-// `@novasamatech/host-container`. Intended for host-side debugging only;
-// gated behind a feature flag in `apps/host`.
+// A docked, resizable panel that lists dotli-internal debug events. Intended
+// for host-side debugging only; gated behind a feature flag in `apps/host`.
 //
 // All DOM is created lazily on `setupTruapiDebugPanel()` and torn down
 // by the returned dispose function. Stylesheet is injected once per
 // document, keyed by id.
 
 import { escapeHtml } from "@dotli/shared/html";
-import { onHostApiDebugMessage } from "@novasamatech/host-container";
-import { onHostPappDebugMessage } from "@novasamatech/host-papp/debug";
 import {
   decodeChainAnnotations,
   formatChainLabel,
@@ -32,6 +28,7 @@ import {
   type StoredTruapiEvent,
 } from "./event-store.ts";
 import { EventStore } from "./event-store.ts";
+import type { DotliDebugBusEvent } from "./dotli-debug-bus.ts";
 import {
   initialFilterState,
   matches,
@@ -54,6 +51,12 @@ const DEBUG_SESSION_KEY = "dotli:truapi-debug";
 
 type DockPosition = "bottom" | "right";
 
+function isTruapiDebugEvent(
+  ev: DotliDebugBusEvent,
+): ev is Extract<DotliDebugBusEvent, { kind: "truapi" }> {
+  return "kind" in ev && ev.kind === "truapi";
+}
+
 function readStoredDock(): DockPosition {
   try {
     const raw = localStorage.getItem(DOCK_STORAGE_KEY);
@@ -92,8 +95,8 @@ export interface SetupOptions {
  * Install the TrUAPI debug panel into the current document.
  *
  * Creates a single panel bound to the current page, subscribes once to
- * the global host-container debug bus, and returns a dispose function
- * that tears everything down (DOM + subscription).
+ * the dotli debug bus, and returns a dispose function that tears everything
+ * down (DOM + subscription).
  *
  * The panel mounts visible whenever debug mode is on. The header's `×`
  * button exits debug mode entirely (clears the session flag and
@@ -163,14 +166,12 @@ export function setupTruapiDebugPanel(options: SetupOptions = {}): () => void {
   };
 
   const unsubscribeStore = store.subscribe(scheduleRender);
-  const unsubscribeTruapi = onHostApiDebugMessage((ev) => {
-    store.insertTruapi(ev);
-  });
-  const unsubscribeHostPapp = onHostPappDebugMessage((ev) => {
-    store.insertHostPapp(ev);
-  });
   const unsubscribeDotli = onDotliDebugEvent((ev) => {
-    store.insertDotli(ev);
+    if (isTruapiDebugEvent(ev)) {
+      store.insertTruapi(ev);
+    } else {
+      store.insertDotli(ev);
+    }
   });
 
   // Initial render + iframe adjustment.
@@ -178,8 +179,6 @@ export function setupTruapiDebugPanel(options: SetupOptions = {}): () => void {
   adjustIframeForPanel(ui.panel, state);
 
   return () => {
-    unsubscribeTruapi();
-    unsubscribeHostPapp();
     unsubscribeDotli();
     unsubscribeStore();
     window.removeEventListener("dotli:product-loaded", onProductLoaded);
@@ -195,7 +194,7 @@ function adjustIframeForPanel(panel: HTMLElement, state: PanelState): void {
     return;
   }
   const hasTopbar = document.getElementById("topbar") !== null;
-  const topOffset = hasTopbar ? 40 : 0;
+  const topOffset = hasTopbar ? 56 : 0;
   if (state.dock === "right") {
     iframe.style.height = `calc(100vh - ${String(topOffset)}px)`;
     // When collapsed, the 32px header bar overlays the top-right corner
diff --git a/packages/truapi-debug/src/styles.css b/packages/truapi-debug/src/styles.css
index a65c2e7..a5368fd 100644
--- a/packages/truapi-debug/src/styles.css
+++ b/packages/truapi-debug/src/styles.css
@@ -66,16 +66,6 @@
   color: #2dd4bf;
   border-color: #0f766e;
 }
-.td-layer-attestation {
-  background: #1a121f;
-  color: #a78bfa;
-  border-color: #5b21b6;
-}
-.td-layer-session {
-  background: #040e20;
-  color: #7dd3fc;
-  border-color: #075985;
-}
 
 /* System row distinguisher — subtle left-border on rows */
 .td-row.system {
@@ -90,7 +80,6 @@
   --sw-accent: #2dd4bf;
 }
 
-
 .td-tooltip {
   position: absolute;
   z-index: 1000;
@@ -100,8 +89,8 @@
   border: 1px solid #3a3a3a;
   border-radius: 3px;
   padding: 4px 8px;
-  font-family: ui-monospace, "Cascadia Code", "Source Code Pro", Menlo,
-    Consolas, monospace;
+  font-family:
+    ui-monospace, "Cascadia Code", "Source Code Pro", Menlo, Consolas, monospace;
   font-size: 11px;
   white-space: nowrap;
   opacity: 0;
@@ -121,8 +110,8 @@
   color: #d4d4d4;
   border-top: 1px solid #1f1f1f;
   z-index: 950;
-  font-family: ui-monospace, "Cascadia Code", "Source Code Pro", Menlo,
-    Consolas, monospace;
+  font-family:
+    ui-monospace, "Cascadia Code", "Source Code Pro", Menlo, Consolas, monospace;
   font-size: 12px;
   display: grid;
   grid-template-rows: 5px 32px auto 1fr;
@@ -423,7 +412,7 @@
 }
 .td-row {
   display: grid;
-  grid-template-columns: 72px 16px 90px 58px 1fr;
+  grid-template-columns: 72px 16px 90px 58px minmax(0, 1fr);
   align-items: baseline;
   gap: 8px;
   padding: 3px 10px;
@@ -433,6 +422,12 @@
   overflow: hidden;
   text-overflow: ellipsis;
 }
+.td-row > * {
+  min-width: 0;
+}
+.td-row.system {
+  grid-template-columns: 72px max-content 90px minmax(0, 1fr);
+}
 .td-rid {
   font-size: 10.5px;
   font-weight: 600;
@@ -483,6 +478,9 @@
   overflow: hidden;
   text-overflow: ellipsis;
 }
+.td-row.system .td-tag-and-summary {
+  grid-column: auto;
+}
 .td-tag {
   color: #e0e0e0;
 }
diff --git a/packages/truapi-debug/src/system-explanations.ts b/packages/truapi-debug/src/system-explanations.ts
index d78df61..b1b0c2a 100644
--- a/packages/truapi-debug/src/system-explanations.ts
+++ b/packages/truapi-debug/src/system-explanations.ts
@@ -143,16 +143,19 @@ The iframe's \`sandbox\` and \`allow\` attributes are configured here based on t
 
   "render:iframe_ready": {
     title: "Product iframe ready",
-    body: `The iframe element is in the DOM and has started navigating to its URL. The product itself has not executed yet — that happens asynchronously as the browser loads the iframe content. Next up is the container bridge setup, which runs in parallel.`,
+    body: `The iframe element is in the DOM and has started navigating to its URL. The product itself has not executed yet — that happens asynchronously as the browser loads the iframe content. Next up is the TrUAPI bridge setup, which runs in parallel.`,
   },
 
   // bridge
 
+  "bridge:sso_listeners_ready": {
+    title: "SSO bridge listeners ready",
+    body: `The host has installed the window-level listeners that connect the topbar login/logout UI to the Rust-backed landing-auth core. After this point, a topbar login click can dispatch \`dotli:truapi-login-request\` and expect the bridge to create or reuse the host-global SSO core.`,
+  },
+
   "bridge:setup_begin": {
     title: "TrUAPI bridge wiring",
-    body: `Starting to wire the host-container postMessage bridge between the host and the product iframe. This bridge carries **all** TrUAPI traffic: account derivation, transaction signing, chain connections, scoped localStorage, statement-store subscriptions, preimage submission, permissions prompts, push notifications.
-
-A nested-bridge detector is also installed here — it watches for \`postMessage\` from windows other than the primary iframe and dynamically creates additional bridges for dApp-in-dApp compositions.`,
+    body: `Starting to wire the Rust-backed TrUAPI bridge between the host and the product iframe. This bridge carries **all** TrUAPI traffic: account derivation, transaction signing, chain connections, scoped localStorage, statement-store subscriptions, preimage submission, permissions prompts, push notifications.`,
   },
 
   "bridge:setup_ready": {
@@ -185,13 +188,106 @@ Gaps between \`setup_ready\` and \`first_inbound\` mean the product iframe wasn'
 Gaps between \`first_inbound\` and \`first_outbound\` imply a host-side problem (the handler wasn't registered, or the main thread was blocked). Under normal conditions these two events land in the same millisecond.`,
   },
 
-  "bridge:nested_detected": {
-    title: "Nested dApp detected",
-    body: `A product running inside the main iframe is itself embedding another product via a nested iframe. Because \`postMessage\` to \`window.top\` lets any descendant iframe reach the host, the host runs a nested-bridge detector that recognises these new sources and spins up a dedicated TrUAPI container for each.
+  // sso
+
+  "sso:login_event_received": {
+    title: "Topbar login requested",
+    body: `The topbar dispatched a host-global login request. The next step is to prepare the landing-auth Rust core, separate from any currently loaded product iframe, so pairing is scoped to the host SSO session rather than a product.`,
+  },
+
+  "sso:login_host_ready": {
+    title: "Landing auth core ready",
+    body: `The host-global SSO core is ready to receive the login request. This is an intermediate state, not a terminal event: the flow is still waiting for \`login_request_response\`, a failure event, or a later pairing/session event.`,
+  },
+
+  "sso:login_request_start": {
+    title: "Login request encoding started",
+    body: `The host is encoding an \`account.request_login\` frame for the Rust core. The request id in the payload is the correlation key for the request and response frames.`,
+  },
+
+  "sso:login_request_sent": {
+    title: "Login request sent",
+    body: `The encoded login request has been posted to the Rust core provider. From here the core may restore an existing session, present a QR pairing request, or fail while preparing the pairing transport.`,
+  },
+
+  "sso:login_request_response": {
+    title: "Login request completed",
+    body: `The Rust core returned a typed login result. \`Success\` and \`AlreadyConnected\` establish a connected session; \`Rejected\` is treated as user cancellation and should close the pending login state rather than showing a retry/error modal.`,
+  },
+
+  "sso:login_request_failed": {
+    title: "Login request rejected",
+    body: `The Rust core returned a typed domain error for the login request. This closes the request/response portion of the flow; the payload remains intentionally small because the typed error is also surfaced through the topbar login-error path.`,
+  },
+
+  "sso:login_request_encode_failed": {
+    title: "Login request encode failed",
+    body: `The host could not encode the login request frame. This is a host-side protocol bug or version mismatch and happens before anything is sent to the Rust core.`,
+  },
+
+  "sso:login_request_send_failed": {
+    title: "Login request send failed",
+    body: `The host encoded the request but failed while posting it to the core provider. Usual causes are a disposed provider, worker fault, or render/logout race that tore down the landing-auth core.`,
+  },
+
+  "sso:login_request_decode_failed": {
+    title: "Login response decode failed",
+    body: `A response arrived for the login request, but the host could not decode it as the expected \`account.request_login\` result. Treat this as a wire-version mismatch until proven otherwise.`,
+  },
 
-The inner product gets its own \`productId\` (\`parent:nested-N\`) and its own scoped storage prefix. Its traffic appears on the TrUAPI swimlane tagged with that productId.
+  "sso:present_pairing_callback": {
+    title: "Pairing QR requested",
+    body: `The Rust core asked the host to present a pairing deeplink. The topbar renders this as the Polkadot Mobile QR modal and receives a cancel callback that can abort the in-flight pairing request.`,
+  },
 
-There's a cap (\`MAX_NESTED_BRIDGES\` in config) to prevent runaway iframe trees from exhausting resources.`,
+  "sso:pairing_started": {
+    title: "SSO pairing started",
+    body: `A new SSO pairing attempt has started. The host has a deeplink label and is preparing the modal state; the core will subscribe to statement-store messages carrying the pairing response.`,
+  },
+
+  "sso:deeplink_generated": {
+    title: "Pairing deeplink generated",
+    body: `The QR/deeplink payload has been generated for Polkadot Mobile. Scanning it moves the flow to the mobile companion app; the desktop host waits for a matching statement-store response.`,
+  },
+
+  "sso:awaiting_response": {
+    title: "Waiting for mobile response",
+    body: `The QR is visible and the core is waiting for Polkadot Mobile to publish the SSO response statement. If this remains pending, inspect the nearby \`statement_store_*\` events to see whether subscription setup or query polling is failing.`,
+  },
+
+  "sso:statement_store_connecting": {
+    title: "Statement-store connecting",
+    body: `The host is opening the chain/RPC connection used by the Rust core's SSO statement-store transport. The backend and genesis hash identify which chain path is being used for pairing traffic.`,
+  },
+
+  "sso:statement_store_connected": {
+    title: "Statement-store connection ready",
+    body: `The statement-store transport wrapper is ready to accept JSON-RPC requests from the Rust core. Subsequent request/response events show the submit, subscribe, and unsubscribe calls moving through the host chain transport.`,
+  },
+
+  "sso:statement_store_connect_failed": {
+    title: "Statement-store connection failed",
+    body: `The host could not create the chain/RPC transport required for SSO pairing. Pairing cannot proceed until this path works; the reason field carries the thrown error text.`,
+  },
+
+  "sso:statement_store_request": {
+    title: "Statement-store request",
+    body: `The Rust core sent a statement-store JSON-RPC request through the host chain transport. The request id is an opaque JSON-RPC correlation key; the request kind comes from the method the host forwarded.`,
+  },
+
+  "sso:statement_store_response": {
+    title: "Statement-store response",
+    body: `The statement-store transport returned a response or subscription page to the Rust core. The payload classifies submit, subscribe, unsubscribe, errors, and statement counts when available.`,
+  },
+
+  "sso:session_established": {
+    title: "SSO session established",
+    body: `Pairing or session restore succeeded. The Rust core has persisted the session and emitted session UI state so the topbar can show the connected account/username.`,
+  },
+
+  "sso:pairing_failed": {
+    title: "SSO pairing failed",
+    body: `The SSO flow ended without a connected session. This may be a user cancellation, mobile rejection, expired pairing statement, statement-store failure, or worker/core fault; inspect the preceding events in the same flow for the concrete cause.`,
   },
 
   // failover
@@ -309,175 +405,6 @@ This **must** complete before \`document.write\` for multi-file archives — oth
     title: "Sandbox boot failed",
     body: `Something in the fetch / decrypt / store pipeline threw. The sandbox has captured the exception to Sentry with the relevant \`dependency\` tag (\`ipfs-gateway\` / \`helia-bulletin\` / \`unknown\`) and rendered its error UI with a retry button. \`reason\` is the error message from whichever stage threw.`,
   },
-
-  // SSO (host-papp)
-
-  "sso:pairing_started": {
-    title: "Wallet pairing started",
-    body: `\`createPappAdapter().sso.authenticate()\` was called, usually because the user clicked the sign-in button. A fresh sr25519 session account is being derived from a generated mnemonic (it exists only for this session — the real wallet stays on the mobile device).
-
-\`metadata\` is the product-identity string the host passed when instantiating the PappAdapter; the mobile wallet will show this to the user as part of the consent screen.`,
-  },
-
-  "sso:deeplink_generated": {
-    title: "QR code ready",
-    body: `The host has built the handshake payload (session's sr25519 public key + encrypt public key + product metadata + host metadata) and base64-encoded it into a \`polkadotapp://pair?handshake=<hex>\` URL. This URL is rendered as a QR code in the browser.
-
-The \`handshakeTopic\` is a derived statement-store topic. When the wallet scans the QR, decrypts the payload, and responds, it will post its response statement on this specific topic. The host has already subscribed to it by the time this event fires.`,
-  },
-
-  "sso:awaiting_response": {
-    title: "Waiting for wallet scan",
-    body: `The host is now blocked on the statement-store subscription, waiting for a matching response statement to land on the \`handshakeTopic\`. There's no timeout at this layer — the user might scan the QR in 5 seconds or walk away for 20 minutes.
-
-If the user cancels the pairing dialog, an \`AbortError\` propagates and ends the flow with \`sso:pairing_failed\`.`,
-  },
-
-  "sso:response_received": {
-    title: "Wallet response received",
-    body: `The wallet posted its response statement on the handshake topic. The host has decrypted the response sensitive data (using the ECDH-derived shared secret), extracted the wallet's encrypt public key and account id, and instantiated a \`StoredUserSession\` bound to both parties.
-
-The session isn't saved yet — that happens after attestation completes, so a failed attestation doesn't leave an orphaned session.`,
-  },
-
-  "sso:session_established": {
-    title: "Session established",
-    body: `The session has been persisted: session secrets in the \`UserSecretRepository\`, the session itself in the \`UserSessionRepository\`. The session manager's subscriber will pick up the new entry and emit \`session:opened\`.
-
-After this event, the product can obtain signed payloads, request ring-VRF aliases, and receive disconnect signals via the session.`,
-  },
-
-  "sso:pairing_failed": {
-    title: "Wallet pairing failed",
-    body: `The pairing flow terminated without a session. Possible causes:
-
-• User cancelled (AbortError): explicit cancel button on the QR modal.
-• Subscription failure: statement-store could not deliver the response.
-• Decrypt failure: response payload did not decrypt with the expected key — indicates a mismatched protocol version or a malicious response.
-• Attestation parallel failure: the concurrent attestation flow failed, which also aborts pairing.
-
-The UI shows the error message and resets so the user can try again.`,
-  },
-
-  // attestation (host-papp)
-
-  "attestation:started": {
-    title: "Guest identity attestation started",
-    body: `Attestation runs in parallel with SSO pairing. Its job is to register the session's candidate account as a *lite person* on People chain, so the session has a verified guest identity rather than being fully anonymous.
-
-The candidate is a session-scoped sr25519 account — different from the wallet's own identity. The verifier is the Sudo Alice key (in the current testnet setup; production will use a proper registrar).`,
-  },
-
-  "attestation:username_claimed": {
-    title: "Username generated",
-    body: `A random guest username of the form \`guest<4 letters>.<4-digit suffix>\` has been generated client-side. It's not yet on-chain — registration happens at \`person_registered\`. The prefix is what the session presents publicly; the numeric suffix is a disambiguator.`,
-  },
-
-  "attestation:allowance_granted": {
-    title: "Verifier allowance granted",
-    body: `A Sudo-wrapped \`PeopleLite.increase_attestation_allowance\` extrinsic has been submitted and reached best-block confirmation. This gives the verifier credits to vouch for up to N new guest identities (current setting: 10).
-
-This step is idempotent — if the verifier already has sufficient allowance, the call is skipped and this event still fires.`,
-  },
-
-  "attestation:vrf_proof_generated": {
-    title: "VRF ring-proof generated",
-    body: `A ring-VRF proof of membership has been computed via \`verifiablejs\` for the candidate's entropy. This is the cryptographic evidence that the candidate is a legitimate member of the guest ring.
-
-Ring-VRF is zero-knowledge: the proof does not reveal which ring member the candidate corresponds to — only that they are one of them.`,
-  },
-
-  "attestation:person_registered": {
-    title: "Person registered on-chain",
-    body: `The \`PeopleLite.attest\` extrinsic has been submitted (signed by the verifier) and landed at best-block or finalization. The candidate's identity is now live on People chain.
-
-The call bundles the candidate signature, the ring-VRF key + proof, and a \`consumer_registration\` struct that records the username and identifier key. Any future interaction using this session's identity keys will be recognised on-chain.`,
-  },
-
-  "attestation:completed": {
-    title: "Attestation complete",
-    body: `All three on-chain steps (allowance grant, VRF proof, person register) succeeded. The guest identity is live. The parallel SSO pairing flow can now finalise into a saved session.`,
-  },
-
-  "attestation:failed": {
-    title: "Attestation failed",
-    body: `One of the attestation sub-steps threw. Most common causes:
-
-• Allowance extrinsic reverted — verifier out of allowance and sudo-increase failed.
-• VRF proof generation exception — verifiablejs WASM init failed or the entropy was malformed.
-• \`PeopleLite.attest\` rejected — dispatch-error (e.g. duplicate username, invalid signature).
-
-The parallel pairing flow is torn down too. No session is stored.`,
-  },
-
-  // session (host-papp)
-
-  "session:opened": {
-    title: "Session opened",
-    body: `A \`UserSession\` object has been instantiated for a stored session (either a freshly paired one or one restored from storage at host boot). The session is now subscribed to its statement-store channel for peer-originated actions (signing requests, alias responses, disconnect signals).
-
-The session persists across page reloads until explicitly terminated. Multiple sessions can be active simultaneously — each gets its own \`session:opened\` event with a unique \`sessionId\`.`,
-  },
-
-  "session:peer_action_received": {
-    title: "Wallet-originated action arrived",
-    body: `The wallet posted an action on the session's statement-store channel. \`actionKind\` identifies it: \`SignResponse\` (response to a signing request the host initiated), \`RingVrfAliasResponse\`, \`Disconnected\` (user chose to disconnect in the wallet UI), etc.
-
-The host hasn't processed the action yet — the handler will run and emit either \`peer_action_processed\` or \`peer_action_failed\`. Already-processed messages are deduplicated by \`messageId\`.`,
-  },
-
-  "session:peer_action_processed": {
-    title: "Peer action handled",
-    body: `The session's action handler completed.
-
-• \`processed=true\` — the handler recognised the action and acted on it (e.g. a \`Disconnected\` peer-action triggered session removal).
-• \`processed=false\` — the handler didn't match or chose to ignore; the action was accepted but had no effect.`,
-  },
-
-  "session:peer_action_failed": {
-    title: "Peer action handling failed",
-    body: `The action handler threw. Common causes: decrypt failure on the statement data, response came in for a messageId the host doesn't remember, malformed payload. The error is logged; the session continues.`,
-  },
-
-  "session:host_action_sent": {
-    title: "Host-originated action sent",
-    body: `The host is initiating an action to the wallet. Kinds:
-
-• \`SignPayload\` — the wallet needs to sign an extrinsic SignedPayload (a transaction the product wants to submit).
-• \`SignRaw\` — the wallet needs to sign arbitrary bytes (common for off-chain auth, not transactions).
-• \`RingVrfAliasRequest\` — the wallet should derive a product-scoped alias via ring-VRF.
-• \`Disconnect\` — the host is tearing down the session and informing the wallet.
-
-The action is encrypted and posted on the session's channel. The host is now waiting for a matching response statement.`,
-  },
-
-  "session:host_action_response_received": {
-    title: "Wallet responded to host action",
-    body: `The wallet posted its response on the session's channel and the host decrypted it.
-
-• \`success=true\` — the wallet approved; the response carries the signature or alias (payload-dependent).
-• \`success=false\` — the wallet declined or errored; the response carries a failure reason. The caller (product) will see an error.
-
-Distinct from \`host_action_failed\`, which is a transport-level failure (no response at all).`,
-  },
-
-  "session:host_action_failed": {
-    title: "Host action transport failure",
-    body: `The statement-store request/await machinery errored before a response could arrive. Possible causes: the peer took too long and the host gave up, the session's channel was torn down mid-request, or the response decrypt failed (wrong key or corrupted payload).
-
-Different from \`host_action_response_received\` with \`success=false\`, which is a business-level decline by the wallet.`,
-  },
-
-  "session:terminated": {
-    title: "Session terminated",
-    body: `A session has been removed from the repository. This happens on:
-
-• Explicit host disconnect — \`sessionManager.disconnect(session)\`, typically from a log-out click.
-• Explicit peer disconnect — the wallet posted a \`Disconnected\` peer-action (user logged out on their phone).
-• Global clear — all sessions wiped (e.g. on a "full reset" flow).
-
-After this event, no further peer-actions or host-actions are delivered on this \`sessionId\`.`,
-  },
 };
 
 /**
diff --git a/packages/truapi-debug/src/system-summary.ts b/packages/truapi-debug/src/system-summary.ts
index 414240c..d123875 100644
--- a/packages/truapi-debug/src/system-summary.ts
+++ b/packages/truapi-debug/src/system-summary.ts
@@ -73,8 +73,42 @@ export function summariseSystemEvent(ev: StoredSystemEvent): string {
       return `First message from product received (productId=${str(p.productId)}).`;
     case "bridge:first_outbound":
       return `First message sent to product — bridge traffic established (productId=${str(p.productId)}).`;
-    case "bridge:nested_detected":
-      return `Nested dApp #${str(p.nestedIndex)} detected (productId=${str(p.productId)}).`;
+
+    // sso
+    case "sso:pairing_started":
+      return `SSO pairing started for ${str(p.label)}.`;
+    case "sso:deeplink_generated":
+      return `SSO deeplink generated (${str(p.scheme)}).`;
+    case "sso:awaiting_response":
+      return `Waiting for SSO pairing response for ${str(p.label)}.`;
+    case "sso:statement_store_connecting":
+      return `Connecting SSO statement-store channel (${str(p.backend)}, ${short(str(p.genesisHash))}).`;
+    case "sso:statement_store_connected":
+      return `SSO statement-store channel connected (${str(p.backend)}).`;
+    case "sso:statement_store_connect_failed":
+      return `SSO statement-store channel failed (${str(p.backend)}): ${str(p.reason)}.`;
+    case "sso:statement_store_request":
+      return `SSO statement-store ${str(p.requestKind)} request sent (${str(p.method)}, id=${str(p.requestId)}).`;
+    case "sso:statement_store_response": {
+      const count =
+        typeof p.statementCount === "number"
+          ? `, statements=${String(p.statementCount)}`
+          : "";
+      const remaining =
+        typeof p.remaining === "number"
+          ? `, remaining=${String(p.remaining)}`
+          : "";
+      const remote =
+        typeof p.remoteSubscriptionId === "string"
+          ? `, remote=${short(p.remoteSubscriptionId)}`
+          : "";
+      const error = typeof p.error === "string" ? `, error=${p.error}` : "";
+      return `SSO statement-store ${str(p.requestKind)} response (${str(p.method)}${remote}${count}${remaining}${error}).`;
+    }
+    case "sso:session_established":
+      return `SSO session established (${str(p.result)}).`;
+    case "sso:pairing_failed":
+      return `SSO pairing failed: ${str(p.reason)}.`;
 
     // failover
     case "failover:chain_backend":
@@ -119,54 +153,6 @@ export function summariseSystemEvent(ev: StoredSystemEvent): string {
     case "sandbox:failed":
       return `Sandbox failed: ${str(p.reason)}.`;
 
-    // SSO (host-papp)
-    case "sso:pairing_started":
-      return `Wallet pairing started (product metadata=${str(p.metadata)}).`;
-    case "sso:deeplink_generated":
-      return `Pairing deeplink generated. QR ready for scan.`;
-    case "sso:awaiting_response":
-      return "Waiting for wallet response on handshake topic.";
-    case "sso:response_received":
-      return `Wallet response received (identity account).`;
-    case "sso:session_established":
-      return `Session ${str(p.sessionId)} established.`;
-    case "sso:pairing_failed":
-      return `Wallet pairing failed: ${str(p.reason)}.`;
-
-    // attestation (host-papp)
-    case "attestation:started":
-      return `Starting guest identity attestation for candidate ${str(p.candidateAccountId)}.`;
-    case "attestation:username_claimed":
-      return `Username claimed: ${str(p.username)}.`;
-    case "attestation:allowance_granted":
-      return `Verifier allowance granted (${str(p.verifierAccountId)}).`;
-    case "attestation:vrf_proof_generated":
-      return "VRF ring-proof generated for candidate.";
-    case "attestation:person_registered":
-      return `Registered ${str(p.username)} on People chain.`;
-    case "attestation:completed":
-      return `Attestation complete for ${str(p.username)}.`;
-    case "attestation:failed":
-      return `Attestation failed: ${str(p.reason)}.`;
-
-    // session (host-papp)
-    case "session:opened":
-      return `Session ${str(p.sessionId)} opened.`;
-    case "session:peer_action_received":
-      return `Peer action received: ${str(p.actionKind)} (msg=${str(p.messageId)}).`;
-    case "session:peer_action_processed":
-      return `Peer action processed (msg=${str(p.messageId)}).`;
-    case "session:peer_action_failed":
-      return `Peer action failed (msg=${str(p.messageId)}): ${str(p.reason)}.`;
-    case "session:host_action_sent":
-      return `Host sent ${str(p.actionKind)} to wallet (msg=${str(p.messageId)}).`;
-    case "session:host_action_response_received":
-      return `Wallet responded to ${str(p.messageId)} (success=${String(p.success)}).`;
-    case "session:host_action_failed":
-      return `Host action failed (msg=${str(p.messageId)}): ${str(p.reason)}.`;
-    case "session:terminated":
-      return `Session ${str(p.sessionId)} terminated.`;
-
     default:
       return `${ev.layer}:${ev.event}`;
   }
@@ -182,6 +168,10 @@ function str(v: unknown): string {
   return "?";
 }
 
+function short(v: string): string {
+  return v.length > 14 ? `${v.slice(0, 10)}...` : v;
+}
+
 function numMs(v: unknown): string {
   if (typeof v !== "number" || !Number.isFinite(v)) {
     return "?";
diff --git a/packages/truapi-debug/src/timeline-layout.ts b/packages/truapi-debug/src/timeline-layout.ts
index 8238535..c56d27e 100644
--- a/packages/truapi-debug/src/timeline-layout.ts
+++ b/packages/truapi-debug/src/timeline-layout.ts
@@ -652,7 +652,7 @@ function segmentForGroup(
  * point-in-time system events (boot phases, failover decisions, etc.)
  * still occupy a lane position at the right Y. `pending` is true for
  * flows whose first event is a "start" kind without a matching end
- * event in the buffer. See SYSTEM_TERMINATOR_SUFFIXES.
+ * event in the buffer. See `isSystemFlowTerminator`.
  */
 function systemSegmentForGroup(
   group: StoredSystemEvent[],
@@ -688,24 +688,25 @@ function systemSegmentDetail(
   return `${first.layer}·${String(all.length)} step${all.length === 1 ? "" : "s"}`;
 }
 
-/** Events that close a multi-step system flow. Mirrors the pairs we
- *  document in the detail pane so visual pending state matches intent. */
+/** Exact layer:event names that close a multi-step system flow. */
+const SYSTEM_TERMINATOR_EVENTS: ReadonlySet<string> = new Set([
+  "boot:ready",
+  "boot:landing_page_shown",
+  "bridge:first_outbound",
+  "render:iframe_ready",
+  "sandbox:document_written",
+  "main:monitor_stopped",
+  "sso:login_request_response",
+  "sso:login_request_failed",
+  "sso:session_established",
+  "sso:pairing_failed",
+]);
+
+/** Suffixes that close error/completion families without listing every event. */
 const SYSTEM_TERMINATOR_SUFFIXES: readonly string[] = [
-  "ready",
   "failed",
-  "landing_page_shown",
   "completed",
-  "session_established",
-  "pairing_failed",
   "terminated",
-  "iframe_ready",
-  // `setup_ready` does not close the bridge flow. It only means the
-  // host is listening, and the product can stay silent for many seconds
-  // after that (iframe still loading, sandbox relay not ready). The
-  // bridge flow stays open until bidirectional traffic is observed via
-  // `first_outbound`.
-  "first_outbound",
-  "document_written",
   "peer_action_processed",
   "peer_action_failed",
   "host_action_response_received",
@@ -714,10 +715,13 @@ const SYSTEM_TERMINATOR_SUFFIXES: readonly string[] = [
   "resolve_failed",
 ];
 
-function isSystemFlowTerminator(ev: StoredSystemEvent): boolean {
+export function isSystemFlowTerminator(ev: StoredSystemEvent): boolean {
   const event = ev.event;
+  if (SYSTEM_TERMINATOR_EVENTS.has(`${ev.layer}:${event}`)) {
+    return true;
+  }
   return SYSTEM_TERMINATOR_SUFFIXES.some(
-    (suf) => event === suf || event.endsWith(`_${suf}`) || event === suf,
+    (suf) => event === suf || event.endsWith(`_${suf}`),
   );
 }
 
diff --git a/packages/truapi-debug/tests/timeline-layout.test.ts b/packages/truapi-debug/tests/timeline-layout.test.ts
new file mode 100644
index 0000000..5bf7732
--- /dev/null
+++ b/packages/truapi-debug/tests/timeline-layout.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+
+import { decodeChainAnnotations } from "../src/chain-decode";
+import { isSystemFlowTerminator } from "../src/timeline-layout";
+import type { StoredSystemEvent } from "../src/event-store";
+
+function systemEvent(layer: string, event: string): StoredSystemEvent {
+  return {
+    kind: "system",
+    seq: 0,
+    receivedAt: 0,
+    source: "dotli",
+    layer,
+    event,
+    flowId: "flow",
+    payload: {},
+  };
+}
+
+describe("debug timeline layout", () => {
+  it("does not treat login host readiness as a terminal SSO event", () => {
+    expect(isSystemFlowTerminator(systemEvent("sso", "login_host_ready"))).toBe(
+      false,
+    );
+    expect(
+      isSystemFlowTerminator(systemEvent("sso", "login_request_response")),
+    ).toBe(true);
+  });
+
+  it("does not infer chain annotations from raw wire payload bytes", () => {
+    const annotations = decodeChainAnnotations(
+      "remote_chain_head_follow_start",
+      { wireId: 1, bytes: new Uint8Array([1, 2, 3]) },
+    );
+
+    expect(annotations).toBeNull();
+  });
+});
diff --git a/packages/typescript-config/paths.json b/packages/typescript-config/paths.json
index 177ce79..5fea6f4 100644
--- a/packages/typescript-config/paths.json
+++ b/packages/typescript-config/paths.json
@@ -2,7 +2,6 @@
   "$schema": "https://json.schemastore.org/tsconfig",
   "compilerOptions": {
     "paths": {
-      "@dotli/auth/*": ["../auth/src/*"],
       "@dotli/config/*": ["../config/src/*"],
       "@dotli/content/*": ["../content/src/*"],
       "@dotli/metrics/*": ["../metrics/src/*"],
diff --git a/packages/ui/package.json b/packages/ui/package.json
index dba89f2..99644e9 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -32,24 +32,18 @@
     "@dotli/storage": "workspace:*",
     "@dotli/truapi-debug": "workspace:*",
     "@noble/hashes": "^2.2.0",
-    "@novasamatech/host-api": "0.8.9",
-    "@novasamatech/host-container": "0.8.9",
-    "@novasamatech/host-papp": "0.8.9",
-    "@novasamatech/sdk-statement": "^0.6.0",
-    "@novasamatech/statement-store": "0.8.9",
+    "@parity/truapi": "file:../../../../js/packages/truapi",
+    "@parity/truapi-host-wasm": "file:../../../../js/packages/truapi-host-wasm",
     "@polkadot-api/json-rpc-provider": "^0.2.0",
+    "@scure/base": "^2.2.0",
     "neverthrow": "^8.2.0",
     "polkadot-api": "^2.1.6",
     "qrcode": "^1.5.4"
   },
   "peerDependencies": {
-    "@dotli/auth": "workspace:*",
     "@dotli/resolver": "workspace:*"
   },
   "peerDependenciesMeta": {
-    "@dotli/auth": {
-      "optional": true
-    },
     "@dotli/resolver": {
       "optional": true
     }
diff --git a/packages/ui/src/allocation-modal.ts b/packages/ui/src/allocation-modal.ts
deleted file mode 100644
index 09afa99..0000000
--- a/packages/ui/src/allocation-modal.ts
+++ /dev/null
@@ -1,341 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Allowance request modal.
- *
- * Lists the resources a product wants pre-allocated and runs the wallet
- * round-trip on Allow. On error the modal stays open so the user can retry.
- */
-
-import type {
-  AllocatableResource,
-  AllocationOutcome,
-  CodecType,
-} from "@novasamatech/host-api";
-
-export type AllocatableResourceValue = CodecType<typeof AllocatableResource>;
-export type AllocationOutcomeValue = CodecType<typeof AllocationOutcome>;
-
-/** Optional dependencies for {@link showAllocationRequestModal}. */
-export interface AllocationModalOptions {
-  /**
-   * Resolve the SS58 address of the app account that auto-signs for a
-   * `SmartContractAllowance` at the given derivation index. When provided, the
-   * smart-contract line gets an info tooltip naming that account; when omitted
-   * (e.g. in unit tests) the tooltip is simply not rendered.
-   */
-  resolveContractAccount?: (index: number) => string;
-}
-
-// Feather-style glyphs, inlined to match the rest of the UI (see topbar.ts).
-const INFO_ICON_SVG =
-  '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg>';
-const COPY_ICON_SVG =
-  '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="9" y="9" width="13" height="13" rx="2" ry="2"/><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"/></svg>';
-const CHECK_ICON_SVG =
-  '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
-const CHEVRON_ICON_SVG =
-  '<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>';
-
-let tooltipSeq = 0;
-
-/**
- * A `setTimeout` wrapper whose `schedule()` (re)starts the timer, replacing any
- * pending run, and `cancel()` clears it — keeps the clear-then-set bookkeeping
- * in one place.
- */
-function resettableTimeout(
-  action: () => void,
-  delayMs: number,
-): { schedule: () => void; cancel: () => void } {
-  let id: ReturnType<typeof setTimeout> | undefined;
-  const cancel = (): void => {
-    if (id !== undefined) {
-      clearTimeout(id);
-      id = undefined;
-    }
-  };
-  return {
-    cancel,
-    schedule: () => {
-      cancel();
-      id = setTimeout(action, delayMs);
-    },
-  };
-}
-
-/**
- * Build the info icon + hover/focus tooltip naming the app account that will
- * auto-sign smart-contract calls. The tooltip is `position: fixed` (placed via
- * JS on reveal) so it escapes the `.signing-fields` overflow clip.
- */
-function buildContractAccountInfo(index: number, address: string): HTMLElement {
-  const wrap = document.createElement("span");
-  wrap.className = "allocation-info-wrap";
-
-  const tooltipId = `allocation-account-tip-${String(++tooltipSeq)}`;
-
-  const icon = document.createElement("span");
-  icon.className = "allocation-info-icon";
-  icon.tabIndex = 0;
-  icon.setAttribute("role", "button");
-  icon.setAttribute("aria-label", "Show signing account");
-  icon.setAttribute("aria-describedby", tooltipId);
-  icon.innerHTML = INFO_ICON_SVG;
-  wrap.appendChild(icon);
-
-  const tooltip = document.createElement("span");
-  tooltip.className = "allocation-tooltip";
-  tooltip.id = tooltipId;
-  tooltip.setAttribute("role", "tooltip");
-
-  const title = document.createElement("span");
-  title.className = "allocation-tooltip-title";
-  title.textContent =
-    "Following accounts will sign contract calls automatically:";
-  tooltip.appendChild(title);
-
-  // Keep the SS58 address tucked behind a native disclosure so the tooltip
-  // stays compact; the summary names the account, expanding reveals the
-  // address + copy button.
-  const details = document.createElement("details");
-  details.className = "allocation-account";
-
-  const summary = document.createElement("summary");
-  summary.className = "allocation-account-summary";
-
-  const accountLabel = document.createElement("span");
-  accountLabel.className = "allocation-account-label";
-  accountLabel.textContent = `App account with index ${String(index)}`;
-  summary.appendChild(accountLabel);
-
-  const chevron = document.createElement("span");
-  chevron.className = "allocation-account-chevron";
-  chevron.innerHTML = CHEVRON_ICON_SVG;
-  summary.appendChild(chevron);
-
-  details.appendChild(summary);
-
-  const body = document.createElement("div");
-  body.className = "allocation-account-body";
-
-  const addr = document.createElement("span");
-  addr.className = "allocation-account-address";
-  addr.textContent = address;
-  body.appendChild(addr);
-
-  const copyBtn = document.createElement("button");
-  copyBtn.type = "button";
-  copyBtn.className = "allocation-account-copy";
-  copyBtn.title = "Copy address";
-  copyBtn.setAttribute("aria-label", "Copy address");
-  copyBtn.innerHTML = COPY_ICON_SVG;
-  const resetCopied = resettableTimeout(() => {
-    copyBtn.classList.remove("copied");
-    copyBtn.innerHTML = COPY_ICON_SVG;
-  }, 1000);
-  copyBtn.addEventListener("click", (e) => {
-    // Don't let the click bubble to the backdrop (which dismisses the modal).
-    e.stopPropagation();
-    void navigator.clipboard.writeText(address).then(() => {
-      copyBtn.classList.add("copied");
-      copyBtn.innerHTML = CHECK_ICON_SVG;
-      resetCopied.schedule();
-    });
-  });
-  body.appendChild(copyBtn);
-
-  details.appendChild(body);
-  tooltip.appendChild(details);
-
-  wrap.appendChild(tooltip);
-
-  // Place the fixed tooltip just under the icon, flipping above / clamping to
-  // the viewport when it would overflow. Runs in the reveal handler (before
-  // paint) so there's no flash at the origin.
-  const place = (): void => {
-    const iconRect = icon.getBoundingClientRect();
-    const tipRect = tooltip.getBoundingClientRect();
-    const gap = 8;
-    let top = iconRect.bottom + gap;
-    if (top + tipRect.height > window.innerHeight - gap) {
-      top = Math.max(gap, iconRect.top - gap - tipRect.height);
-    }
-    let left = iconRect.left;
-    if (left + tipRect.width > window.innerWidth - gap) {
-      left = window.innerWidth - gap - tipRect.width;
-    }
-    tooltip.style.top = `${String(Math.round(top))}px`;
-    tooltip.style.left = `${String(Math.round(Math.max(gap, left)))}px`;
-  };
-  // Drive visibility from JS (via the `is-open` class) rather than pure CSS
-  // `:hover`, so we can keep the tooltip open for a beat after the pointer
-  // leaves. Otherwise crossing the gap between the icon and the fixed tooltip
-  // drops `:hover` and hides it before the user can reach it to expand.
-  const CLOSE_DELAY_MS = 300;
-  const closeTooltip = resettableTimeout(() => {
-    wrap.classList.remove("is-open");
-  }, CLOSE_DELAY_MS);
-  const open = (): void => {
-    closeTooltip.cancel();
-    wrap.classList.add("is-open");
-    place();
-  };
-  wrap.addEventListener("mouseenter", open);
-  wrap.addEventListener("mouseleave", closeTooltip.schedule);
-  wrap.addEventListener("focusin", open);
-  wrap.addEventListener("focusout", closeTooltip.schedule);
-  // Expanding/collapsing changes the tooltip height — re-anchor so it doesn't
-  // spill off-screen.
-  details.addEventListener("toggle", place);
-
-  return wrap;
-}
-
-function describeResource(resource: AllocatableResourceValue): string {
-  switch (resource.tag) {
-    case "StatementStoreAllowance":
-      return "Post statements on your behalf";
-    case "BulletinAllowance":
-      return "Publish bulletin posts on your behalf";
-    case "SmartContractAllowance":
-      return "Sign smart-contract calls automatically";
-    case "AutoSigning":
-      return "Sign transactions automatically";
-    default: {
-      const exhaustive: never = resource;
-      return exhaustive;
-    }
-  }
-}
-
-/** Show an allowance request modal and run `performAllocation` on confirm. */
-export function showAllocationRequestModal(
-  productLabel: string,
-  resources: AllocatableResourceValue[],
-  performAllocation: () => Promise<AllocationOutcomeValue[]>,
-  options: AllocationModalOptions = {},
-): Promise<AllocationOutcomeValue[]> {
-  return new Promise((resolve, reject) => {
-    const backdrop = document.createElement("div");
-    backdrop.className = "signing-modal-backdrop";
-
-    const modal = document.createElement("div");
-    modal.className = "signing-modal";
-
-    const heading = document.createElement("h2");
-    heading.textContent = "Allowance request";
-    modal.appendChild(heading);
-
-    const description = document.createElement("div");
-    description.className = "signing-fields";
-
-    const productField = document.createElement("div");
-    productField.className = "signing-field";
-
-    const productFieldLabel = document.createElement("div");
-    productFieldLabel.className = "signing-field-label";
-    productFieldLabel.textContent = "Application";
-    productField.appendChild(productFieldLabel);
-
-    const productFieldValue = document.createElement("div");
-    productFieldValue.className = "signing-field-value";
-    productFieldValue.textContent = productLabel;
-    productField.appendChild(productFieldValue);
-
-    description.appendChild(productField);
-
-    const resourcesField = document.createElement("div");
-    resourcesField.className = "signing-field";
-
-    const resourcesLabel = document.createElement("div");
-    resourcesLabel.className = "signing-field-label";
-    resourcesLabel.textContent = "Requested allowances";
-    resourcesField.appendChild(resourcesLabel);
-
-    const list = document.createElement("ul");
-    list.className = "allocation-modal-list";
-    for (const resource of resources) {
-      const item = document.createElement("li");
-      item.textContent = describeResource(resource);
-      if (
-        resource.tag === "SmartContractAllowance" &&
-        options.resolveContractAccount
-      ) {
-        const address = options.resolveContractAccount(resource.value);
-        item.appendChild(buildContractAccountInfo(resource.value, address));
-      }
-      list.appendChild(item);
-    }
-    resourcesField.appendChild(list);
-
-    description.appendChild(resourcesField);
-
-    const errorBox = document.createElement("div");
-    errorBox.className = "allocation-modal-error";
-    errorBox.style.display = "none";
-    description.appendChild(errorBox);
-
-    modal.appendChild(description);
-
-    const footer = document.createElement("div");
-    footer.className = "signing-modal-footer";
-
-    const cancelBtn = document.createElement("button");
-    cancelBtn.className = "signing-btn-cancel";
-    cancelBtn.textContent = "Cancel";
-    footer.appendChild(cancelBtn);
-
-    const allowBtn = document.createElement("button");
-    allowBtn.className = "signing-btn-sign";
-    allowBtn.textContent = "Allow";
-    footer.appendChild(allowBtn);
-
-    modal.appendChild(footer);
-    backdrop.appendChild(modal);
-    document.body.appendChild(backdrop);
-
-    function cleanup(): void {
-      backdrop.remove();
-    }
-
-    function setPending(pending: boolean): void {
-      cancelBtn.disabled = pending;
-      allowBtn.disabled = pending;
-      allowBtn.textContent = pending ? "Allocating..." : "Allow";
-    }
-
-    function showError(message: string): void {
-      errorBox.textContent = message;
-      errorBox.style.display = "";
-    }
-
-    cancelBtn.addEventListener("click", () => {
-      cleanup();
-      reject(new Error("User cancelled allowance request"));
-    });
-
-    allowBtn.addEventListener("click", () => {
-      errorBox.style.display = "none";
-      setPending(true);
-      performAllocation().then(
-        (outcomes) => {
-          cleanup();
-          resolve(outcomes);
-        },
-        (error: unknown) => {
-          setPending(false);
-          showError(error instanceof Error ? error.message : String(error));
-        },
-      );
-    });
-
-    backdrop.addEventListener("click", (e) => {
-      if (e.target === backdrop && !allowBtn.disabled) {
-        cleanup();
-        reject(new Error("User dismissed allowance request"));
-      }
-    });
-  });
-}
diff --git a/packages/ui/src/bridge.ts b/packages/ui/src/bridge.ts
index 8dc420e..fa42b58 100644
--- a/packages/ui/src/bridge.ts
+++ b/packages/ui/src/bridge.ts
@@ -1,13 +1,26 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// dot.li Host-container bridge
+// dot.li — TrUAPI host bridge
+//
+// Boots a WASM TrUAPI core instance and connects it to a sandboxed
+// product iframe via `@parity/truapi-host-wasm`. Each render swaps the running
+// runtime, so disposing the last host tears down both the iframe and
+// the core.
 //
-// Connects embedded dApps to host services (accounts, signing, chain
-// connections, scoped storage) via postMessage protocol.
-// Only imported by the host build, keeps smoldot and auth out of the
-// sandbox bundle.
+// Nested dApp-in-dApp composition is not modeled as separate Rust runtimes,
+// sessions, product identities, or storage namespaces. Any future nested
+// traffic must share the top-level core/provider context.
 
+import {
+  decodeWireMessage,
+  encodeWireMessage,
+  HostRequestLoginResponse,
+  scale,
+  VersionedHostRequestLoginError,
+  VersionedHostRequestLoginRequest,
+  type HostRequestLoginResponse as LoginResponse,
+  type WireProvider as Provider,
+  createMessagePortProvider,
+} from "@parity/truapi";
+import { ACCOUNT_REQUEST_LOGIN } from "@parity/truapi/wire-table";
 import { BASE_DOMAIN } from "@dotli/config/config";
 import {
   SANDBOX_CONTRACT_PARAMS,
@@ -17,53 +30,221 @@ import { getBackend, getCacheSettings } from "@dotli/config/mode";
 import { getNetwork } from "@dotli/config/network";
 import { m } from "@dotli/metrics/metrics";
 import * as S from "@dotli/metrics/spans";
-import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
-import { buildAllowAttribute } from "./permissions";
+import { log } from "@dotli/shared/log";
+import {
+  emitDotliDebugEvent,
+  hasDotliDebugListeners,
+} from "@dotli/truapi-debug/dotli-debug-bus";
+import type { TrUApiProductProvider } from "@parity/truapi-host-wasm";
+import type { PairingHostAdmin } from "@parity/truapi-host-wasm";
+import {
+  buildAllowAttribute,
+  registerPermissionAuthorizationProvider,
+} from "./permissions";
+import { createHostCallbacks } from "./host-callbacks/handlers";
+import { dispatchAuthState } from "./host-callbacks/AuthState";
+import { onStoredSessionChanged } from "./host-callbacks/SessionStore";
+import { LoginRequestError } from "./login-request-error";
+import {
+  emitSsoPairingFailed,
+  emitSsoSessionEstablished,
+} from "./host-callbacks/SsoDebug";
+import { createTruapiRuntimeConfig } from "./runtime-config";
+import { createWindowMessageProvider } from "./legacy-host-bridge";
 
-function newFlowId(prefix: string): string {
-  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
-    return crypto.randomUUID();
-  }
-  return `${prefix}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`;
-}
+// DEPRECATED: enables the legacy Nova host-api transport shim for products that
+// have not yet migrated to `@parity/truapi`. Remove once they have.
+const noop = (): void => undefined;
 
-// Eagerly load the container bridge chunk. Starts downloading when
-// this module is imported, so it's ready by the time we need it.
+// Eagerly load the iframe host chunk + worker constructor so they're ready
+// by the time we need them. The wasm core lives inside the worker; the host
+// shell only owns the postMessage bridge, keeping smoldot's CPU off the
+// main thread (no more `[Violation] 'message' handler took 150ms+`).
 const chunkLoadStart = performance.now();
-const containerChunkPromise = import("./container").then((mod) => {
+const runtimeChunkPromise = Promise.all([
+  import("@parity/truapi-host-wasm/web"),
+  import("@parity/truapi-host-wasm/worker-runtime?worker"),
+]).then(([web, workerMod]) => {
   m.measure(S.BRIDGE_CHUNK_LOAD, performance.now() - chunkLoadStart);
-  return mod;
+  return {
+    createWebWorkerPairingHostRuntime: web.createWebWorkerPairingHostRuntime,
+    createIframeHost: web.createIframeHost,
+    HostWorker: workerMod.default,
+  };
 });
-void containerChunkPromise.catch(() => {
+void runtimeChunkPromise.catch(() => {
   /* fire-and-forget */
 });
 
 const app = document.getElementById("app") ?? document.body;
 
-let currentDispose: (() => void) | null = null;
+interface ActiveHost {
+  iframe: HTMLIFrameElement;
+  requestLogin: (reason?: string) => Promise<LoginResponse>;
+  disconnect: () => Promise<void>;
+  dispose: () => void;
+}
+
+interface CoreHost {
+  requestLogin: (reason?: string) => Promise<LoginResponse>;
+  cancelLogin: () => void;
+  disconnect: () => Promise<void>;
+  dispose: () => void;
+}
+
+type CoreProviderBase = Provider &
+  Pick<
+    TrUApiProductProvider,
+    | "disconnectSession"
+    | "getPermissionAuthorizationStatus"
+    | "getPermissionAuthorizationStatuses"
+    | "setPermissionAuthorizationStatus"
+  >;
+type CoreProvider = CoreProviderBase & PairingHostAdmin;
+type PairingRuntimeControls = PairingHostAdmin & {
+  dispose(): void;
+};
+type CurrentProduct =
+  | {
+      mode: "iframe";
+      label: string;
+      url: string;
+      productId?: string;
+    }
+  | {
+      mode: "subdomain";
+      label: string;
+      cid: string;
+    };
+
+const LANDING_AUTH_LABEL = "dotli";
+const LANDING_AUTH_DISPLAY_LABEL = "Polkadot Web";
+
+let currentHost: ActiveHost | null = null;
+let landingAuthHostPromise: Promise<CoreHost> | null = null;
+let landingAuthGeneration = 0;
 let currentPanelDispose: (() => void) | null = null;
+let currentProduct: CurrentProduct | null = null;
+let renderGeneration = 0;
+const liveCoreProviders = new Set<CoreProvider>();
+let unsubscribeSessionStoreChanges: (() => void) | null = null;
+
+function ensureStoredSessionForwarder(): void {
+  if (unsubscribeSessionStoreChanges !== null) {
+    return;
+  }
+  unsubscribeSessionStoreChanges = onStoredSessionChanged(() => {
+    notifyLiveCoreProvidersSessionStoreChanged();
+  });
+}
+
+function trackCoreProvider(
+  provider: CoreProviderBase,
+  pairing: PairingRuntimeControls,
+): CoreProvider {
+  const tracked: CoreProvider = {
+    postMessage(message: Uint8Array): void {
+      provider.postMessage(message);
+    },
+    subscribe(callback) {
+      return provider.subscribe(callback);
+    },
+    subscribeClose(callback) {
+      return provider.subscribeClose?.(callback) ?? noop;
+    },
+    async disconnectSession() {
+      await provider.disconnectSession();
+    },
+    cancelPairing() {
+      pairing.cancelPairing();
+    },
+    notifySessionStoreChanged() {
+      pairing.notifySessionStoreChanged();
+    },
+    getPermissionAuthorizationStatus(request) {
+      return provider.getPermissionAuthorizationStatus(request);
+    },
+    getPermissionAuthorizationStatuses(requests) {
+      return provider.getPermissionAuthorizationStatuses(requests);
+    },
+    setPermissionAuthorizationStatus(request, status) {
+      return provider.setPermissionAuthorizationStatus(request, status);
+    },
+    dispose() {
+      provider.dispose();
+      pairing.dispose();
+    },
+  };
+  liveCoreProviders.add(tracked);
+  ensureStoredSessionForwarder();
+  let disposed = false;
+  queueMicrotask(() => {
+    if (!disposed) {
+      tracked.notifySessionStoreChanged();
+    }
+  });
+  return {
+    postMessage(message: Uint8Array): void {
+      tracked.postMessage(message);
+    },
+    subscribe(callback) {
+      return tracked.subscribe(callback);
+    },
+    subscribeClose(callback) {
+      return tracked.subscribeClose?.(callback) ?? noop;
+    },
+    async disconnectSession() {
+      await tracked.disconnectSession();
+    },
+    cancelPairing() {
+      tracked.cancelPairing();
+    },
+    notifySessionStoreChanged() {
+      tracked.notifySessionStoreChanged();
+    },
+    getPermissionAuthorizationStatus(request) {
+      return tracked.getPermissionAuthorizationStatus(request);
+    },
+    getPermissionAuthorizationStatuses(requests) {
+      return tracked.getPermissionAuthorizationStatuses(requests);
+    },
+    setPermissionAuthorizationStatus(request, status) {
+      return tracked.setPermissionAuthorizationStatus(request, status);
+    },
+    dispose() {
+      if (disposed) {
+        return;
+      }
+      disposed = true;
+      liveCoreProviders.delete(tracked);
+      if (
+        liveCoreProviders.size === 0 &&
+        unsubscribeSessionStoreChanges !== null
+      ) {
+        unsubscribeSessionStoreChanges();
+        unsubscribeSessionStoreChanges = null;
+      }
+      tracked.dispose();
+    },
+  };
+}
 
-// Track current product state for permission-grant reloads
-let currentRenderMode: "iframe" | "subdomain" | null = null;
-let currentLabel: string | null = null;
-let currentUrl: string | null = null;
-let currentCid: string | null = null;
+function notifyLiveCoreProvidersSessionStoreChanged(): void {
+  for (const provider of [...liveCoreProviders]) {
+    provider.notifySessionStoreChanged();
+  }
+}
 
-// Listen for device permission grants and reload the iframe so the
+// Listen for device permission grants — reload the iframe so the
 // updated `allow` attribute takes effect.
 window.addEventListener("dotli:device-permission-changed", () => {
-  if (
-    currentRenderMode === "iframe" &&
-    currentUrl !== null &&
-    currentLabel !== null
-  ) {
-    void renderIframe(currentUrl, currentLabel);
-  } else if (
-    currentRenderMode === "subdomain" &&
-    currentCid !== null &&
-    currentLabel !== null
-  ) {
-    void renderAppSubdomain(currentCid, currentLabel);
+  const product = currentProduct;
+  if (product?.mode === "iframe") {
+    void renderIframe(product.url, product.label, {
+      productId: product.productId,
+    });
+  } else if (product?.mode === "subdomain") {
+    void renderAppSubdomain(product.cid, product.label);
   }
 });
 
@@ -87,11 +268,10 @@ window.addEventListener("message", (event: MessageEvent) => {
   ) {
     return;
   }
+  const product = currentProduct;
   if (
-    currentRenderMode !== "subdomain" ||
-    currentCid === null ||
-    currentLabel === null ||
-    event.origin !== getAppOrigin(currentLabel)
+    product?.mode !== "subdomain" ||
+    event.origin !== getAppOrigin(product.label)
   ) {
     return;
   }
@@ -100,38 +280,631 @@ window.addEventListener("message", (event: MessageEvent) => {
     return;
   }
   lastRecoverAt = now;
-  void renderAppSubdomain(currentCid, currentLabel);
+  void renderAppSubdomain(product.cid, product.label);
 });
 
+let bridgeEventListenersInitialized = false;
+
+export function initBridgeEventListeners(): void {
+  if (bridgeEventListenersInitialized) {
+    return;
+  }
+  bridgeEventListenersInitialized = true;
+  (
+    window as typeof window & { __dotliTruapiBridgeReady?: boolean }
+  ).__dotliTruapiBridgeReady = true;
+  emitDotliDebugEvent({
+    layer: "bridge",
+    event: "sso_listeners_ready",
+    flowId: "bridge-sso-listeners",
+    timestamp: Date.now(),
+    payload: {},
+  });
+
+  window.addEventListener("dotli:truapi-disconnect-request", () => {
+    void disconnectTruapiHosts();
+  });
+
+  // User closed the pairing modal: cancel the in-flight login on the auth
+  // host. Only an already-booted host can have a login in flight.
+  window.addEventListener("dotli:truapi-cancel-login", () => {
+    void landingAuthHostPromise?.then(
+      (host) => {
+        host.cancelLogin();
+      },
+      () => {
+        /* a failed pending host has no login to cancel */
+      },
+    );
+  });
+
+  window.addEventListener("dotli:truapi-login-request", (event: Event) => {
+    const detail = (event as CustomEvent<{ reason?: string }>).detail;
+    const flowId = newFlowId("login");
+    emitDotliDebugEvent({
+      layer: "sso",
+      event: "login_event_received",
+      flowId,
+      timestamp: Date.now(),
+      payload: {},
+    });
+    void (async () => {
+      const host = await getLandingAuthHost();
+      emitDotliDebugEvent({
+        layer: "sso",
+        event: "login_host_ready",
+        flowId,
+        timestamp: Date.now(),
+        payload: { host: "landing" },
+      });
+      const result = await host.requestLogin(detail.reason);
+      // Topbar rendering is driven by the core's auth-state emissions; the
+      // call result only feeds the debug stream here.
+      if (result === "Success" || result === "AlreadyConnected") {
+        notifyLiveCoreProvidersSessionStoreChanged();
+        emitSsoSessionEstablished(result);
+      } else {
+        emitSsoPairingFailed(result);
+      }
+    })().catch((error: unknown) => {
+      const message = error instanceof Error ? error.message : String(error);
+      emitSsoPairingFailed(message);
+      // A `LoginRequestError` came back over the wire, so the core already
+      // rendered its own `LoginFailed` (or deliberately stayed silent, e.g.
+      // a second login while one is pairing). Synthesize a state only for
+      // failures the core never saw: host boot, encode, transport errors.
+      if (!(error instanceof LoginRequestError)) {
+        dispatchAuthState({ tag: "LoginFailed", reason: message });
+      }
+    });
+  });
+}
+
+initBridgeEventListeners();
+
+async function disconnectTruapiHosts(): Promise<void> {
+  const hosts = new Set<CoreHost | ActiveHost>();
+  if (currentHost !== null) {
+    hosts.add(currentHost);
+  }
+  if (landingAuthHostPromise !== null) {
+    try {
+      hosts.add(await landingAuthHostPromise);
+    } catch (err) {
+      log.warn("[dot.li] pending login host cleanup failed:", err);
+    }
+  }
+
+  if (hosts.size === 0) {
+    try {
+      hosts.add(await getLandingAuthHost());
+    } catch {
+      // If the auth runtime cannot boot, keep the UI responsive even though
+      // persisted core session state could not be cleared.
+      dispatchAuthState({ tag: "Disconnected" });
+      return;
+    }
+  }
+  await Promise.allSettled([...hosts].map((host) => host.disconnect()));
+}
+
 /**
  * Capture deep link path (pathname + search + hash) to forward into the iframe.
  */
 function getDeepPath(): string {
   const { pathname, search, hash } = window.location;
-  // Strip the deploy base path (e.g. a subpath deploy at /dotli/) so only the
-  // in-app route is forwarded to the iframe.
   let p = pathname;
   const base = import.meta.env.BASE_URL;
   if (base !== "/" && p.startsWith(base)) {
     p = "/" + p.slice(base.length);
   }
-  const isRoot = p === "" || p === "/";
+  const stripped = p.replace(/^\/[^/]+\.dot/, "");
+  const isRoot = stripped === "" || stripped === "/";
   if (isRoot) {
     return search || hash ? search + hash : "";
   }
-  return p + search + hash;
+  return stripped + search + hash;
+}
+
+function applyIframeStyling(
+  iframe: HTMLIFrameElement,
+  opts: { topbarOffset: boolean },
+): void {
+  iframe.style.cssText = opts.topbarOffset
+    ? "position:fixed;top:56px;left:0;width:100%;height:calc(100vh - 56px);border:none;margin:0;padding:0;"
+    : "position:fixed;top:0;left:0;width:100%;height:100vh;border:none;margin:0;padding:0;";
+  document.body.style.margin = "0";
+  document.body.style.overflow = "hidden";
+}
+
+function pipeProviders(
+  product: Provider,
+  core: Provider,
+  args: { flowId: string; label: string; productId: string },
+): () => void {
+  let sawInbound = false;
+  let sawOutbound = false;
+  const unsubs = [
+    product.subscribe((message) => {
+      if (!sawInbound) {
+        sawInbound = true;
+        emitDotliDebugEvent({
+          layer: "bridge",
+          event: "first_inbound",
+          flowId: args.flowId,
+          timestamp: Date.now(),
+          payload: { label: args.label, productId: args.productId },
+        });
+      }
+      core.postMessage(message);
+    }),
+    core.subscribe((message) => {
+      if (!sawOutbound) {
+        sawOutbound = true;
+        emitDotliDebugEvent({
+          layer: "bridge",
+          event: "first_outbound",
+          flowId: args.flowId,
+          timestamp: Date.now(),
+          payload: { label: args.label, productId: args.productId },
+        });
+        window.dispatchEvent(new Event("dotli:debug:bridge-ready"));
+      }
+      product.postMessage(message);
+    }),
+    product.subscribeClose?.(() => {
+      core.dispose();
+    }),
+    core.subscribeClose?.(() => {
+      product.dispose();
+    }),
+  ].filter((fn): fn is () => void => typeof fn === "function");
+
+  return () => {
+    for (const unsub of unsubs) {
+      try {
+        unsub();
+        // eslint-disable-next-line no-restricted-syntax -- provider teardown is best-effort; stale MessagePorts can already be closed while the next cleanup still must run.
+      } catch {
+        /* ignore teardown races */
+      }
+    }
+  };
+}
+
+function emitWireFrameDebug(
+  direction: "incoming" | "outgoing",
+  productId: string,
+  message: Uint8Array,
+): void {
+  if (!hasDotliDebugListeners()) {
+    return;
+  }
+  const decoded = decodeWireMessage(message);
+  if (decoded.isErr()) {
+    return;
+  }
+  const wireId = decoded.value.payload.id;
+  emitDotliDebugEvent({
+    kind: "truapi",
+    direction,
+    productId,
+    requestId: decoded.value.requestId,
+    payload: {
+      tag: `wire_${String(wireId)}`,
+      value: {
+        wireId,
+        bytes: decoded.value.payload.value,
+      },
+    },
+  });
+}
+
+function wrapCoreProviderForDebug(
+  provider: CoreProviderBase,
+  productId: string,
+): CoreProviderBase {
+  const listeners = new Set<(message: Uint8Array) => void>();
+  let disposed = false;
+  const unsubscribeCore = provider.subscribe((message) => {
+    if (disposed) {
+      return;
+    }
+    emitWireFrameDebug("outgoing", productId, message);
+    for (const listener of [...listeners]) {
+      listener(message);
+    }
+  });
+
+  return {
+    postMessage(message: Uint8Array): void {
+      if (disposed) {
+        return;
+      }
+      emitWireFrameDebug("incoming", productId, message);
+      provider.postMessage(message);
+    },
+    subscribe(callback) {
+      listeners.add(callback);
+      return () => {
+        listeners.delete(callback);
+      };
+    },
+    subscribeClose(callback) {
+      return provider.subscribeClose?.(callback) ?? noop;
+    },
+    async disconnectSession() {
+      await provider.disconnectSession();
+    },
+    getPermissionAuthorizationStatus(request) {
+      return provider.getPermissionAuthorizationStatus(request);
+    },
+    getPermissionAuthorizationStatuses(requests) {
+      return provider.getPermissionAuthorizationStatuses(requests);
+    },
+    setPermissionAuthorizationStatus(request, status) {
+      return provider.setPermissionAuthorizationStatus(request, status);
+    },
+    dispose() {
+      if (disposed) {
+        return;
+      }
+      disposed = true;
+      unsubscribeCore();
+      listeners.clear();
+      provider.dispose();
+    },
+  };
+}
+
+let topbarLoginRequestSeq = 0;
+
+export function requestCoreLogin(
+  core: Provider,
+  reason?: string,
+): Promise<LoginResponse> {
+  const requestId = `dotli:topbar-login:${String(++topbarLoginRequestSeq)}`;
+  const flowId = newFlowId("login");
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "login_request_start",
+    flowId,
+    timestamp: Date.now(),
+    payload: { requestId },
+  });
+  const responseCodec = scale.indexedTaggedUnion({
+    V1: [
+      0,
+      scale.Result(
+        HostRequestLoginResponse,
+        scale.CallError(VersionedHostRequestLoginError),
+      ),
+    ],
+  });
+  const frame = encodeWireMessage({
+    requestId,
+    payload: {
+      id: ACCOUNT_REQUEST_LOGIN.request,
+      value: VersionedHostRequestLoginRequest.enc({
+        tag: "V1",
+        value: { reason },
+      }),
+    },
+  });
+  if (frame.isErr()) {
+    emitDotliDebugEvent({
+      layer: "sso",
+      event: "login_request_encode_failed",
+      flowId,
+      timestamp: Date.now(),
+      payload: { requestId, reason: frame.error.message },
+    });
+    return Promise.reject(frame.error);
+  }
+
+  return new Promise<LoginResponse>((resolve, reject) => {
+    const unsubscribe = core.subscribe((message) => {
+      const decoded = decodeWireMessage(message);
+      if (decoded.isErr()) {
+        cleanup();
+        reject(decoded.error);
+        return;
+      }
+      if (
+        decoded.value.requestId !== requestId ||
+        decoded.value.payload.id !== ACCOUNT_REQUEST_LOGIN.response
+      ) {
+        return;
+      }
+      cleanup();
+      try {
+        const envelope = responseCodec.dec(decoded.value.payload.value);
+        const result = envelope.value;
+        if (result.success) {
+          emitDotliDebugEvent({
+            layer: "sso",
+            event: "login_request_response",
+            flowId,
+            timestamp: Date.now(),
+            payload: { requestId, result: result.value },
+          });
+          resolve(result.value);
+        } else {
+          emitDotliDebugEvent({
+            layer: "sso",
+            event: "login_request_failed",
+            flowId,
+            timestamp: Date.now(),
+            payload: { requestId },
+          });
+          if (result.value.tag === "Domain") {
+            reject(new LoginRequestError(result.value.value));
+          } else {
+            reject(new Error(JSON.stringify(result.value)));
+          }
+        }
+      } catch (error) {
+        emitDotliDebugEvent({
+          layer: "sso",
+          event: "login_request_decode_failed",
+          flowId,
+          timestamp: Date.now(),
+          payload: {
+            requestId,
+            reason: error instanceof Error ? error.message : String(error),
+          },
+        });
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    const cleanup = (): void => {
+      unsubscribe();
+    };
+
+    try {
+      core.postMessage(frame.value);
+      emitDotliDebugEvent({
+        layer: "sso",
+        event: "login_request_sent",
+        flowId,
+        timestamp: Date.now(),
+        payload: { requestId },
+      });
+    } catch (error) {
+      cleanup();
+      emitDotliDebugEvent({
+        layer: "sso",
+        event: "login_request_send_failed",
+        flowId,
+        timestamp: Date.now(),
+        payload: {
+          requestId,
+          reason: error instanceof Error ? error.message : String(error),
+        },
+      });
+      reject(error instanceof Error ? error : new Error(String(error)));
+    }
+  });
+}
+
+async function createHost(args: {
+  iframeUrl: string;
+  allowedOrigin: string;
+  sandbox: string;
+  label: string;
+  productId?: string;
+  container: HTMLElement;
+  debugFlowId: string;
+}): Promise<ActiveHost> {
+  const coreProvider = await createCoreProvider(args.label, {
+    productId: args.productId,
+  });
+  const unregisterPermissions = registerPermissionAuthorizationProvider(
+    args.label,
+    coreProvider,
+  );
+  const { createIframeHost } = await runtimeChunkPromise;
+  let productProvider: Provider | null = null;
+  let disposePipe: (() => void) | null = null;
+  let legacyProbeCleanup: (() => void) | null = null;
+  const pipeArgs = {
+    flowId: args.debugFlowId,
+    label: args.label,
+    productId: args.productId ?? args.label,
+  };
+  const cleanupProductSide = (): void => {
+    disposePipe?.();
+    productProvider?.dispose();
+    disposePipe = null;
+    productProvider = null;
+  };
+  try {
+    const allow = `${await buildAllowAttribute(args.label)}; cross-origin-isolated`;
+    const host = createIframeHost({
+      iframeUrl: args.iframeUrl,
+      allowedOrigin: args.allowedOrigin,
+      allow,
+      sandbox: args.sandbox,
+      container: args.container,
+      onPort: (port) => {
+        productProvider = createMessagePortProvider(port);
+        disposePipe = pipeProviders(productProvider, coreProvider, pipeArgs);
+      },
+    });
+
+    // DEPRECATED legacy host-API support. Modern products announce themselves
+    // with `{type:"truapi-ready"}` and use the MessagePort wired above. Products
+    // still on the Nova host-api SDK instead post raw SCALE frames (Uint8Array)
+    // to `window.parent`. Detect that first frame and re-pipe the core over a
+    // window-postMessage provider. Remove once products migrate.
+    let probeMode: "pending" | "modern" | "legacy" = "pending";
+    const onProbe = (event: MessageEvent): void => {
+      if (probeMode !== "pending") {
+        return;
+      }
+      const targetWindow = host.iframe.contentWindow;
+      if (!targetWindow || event.source !== targetWindow) {
+        return;
+      }
+      if (event.data instanceof Uint8Array) {
+        probeMode = "legacy";
+        legacyProbeCleanup?.();
+        // Drop the unused modern MessagePort pipe before rewiring.
+        cleanupProductSide();
+        const legacyProvider = createWindowMessageProvider(targetWindow);
+        productProvider = legacyProvider;
+        disposePipe = pipeProviders(legacyProvider, coreProvider, pipeArgs);
+        // Replay the handshake frame the probe just consumed.
+        legacyProvider.injectInbound(event.data);
+      } else if (
+        (event.data as { type?: unknown } | null)?.type === "truapi-ready"
+      ) {
+        probeMode = "modern";
+        legacyProbeCleanup?.();
+      }
+    };
+    window.addEventListener("message", onProbe);
+    legacyProbeCleanup = () => {
+      window.removeEventListener("message", onProbe);
+      legacyProbeCleanup = null;
+    };
+
+    return {
+      iframe: host.iframe,
+      requestLogin(reason) {
+        return requestCoreLogin(coreProvider, reason);
+      },
+      disconnect() {
+        return coreProvider.disconnectSession();
+      },
+      dispose() {
+        unregisterPermissions();
+        legacyProbeCleanup?.();
+        cleanupProductSide();
+        coreProvider.dispose();
+        host.dispose();
+      },
+    };
+  } catch (error) {
+    unregisterPermissions();
+    legacyProbeCleanup?.();
+    cleanupProductSide();
+    coreProvider.dispose();
+    throw error;
+  }
+}
+
+async function createCoreProvider(
+  label: string,
+  options: {
+    pairingLabel?: string;
+    pairingDotSuffix?: boolean;
+    pairingHostGlobal?: boolean;
+    productId?: string;
+  } = {},
+): Promise<CoreProvider> {
+  const { createWebWorkerPairingHostRuntime, HostWorker } = await runtimeChunkPromise;
+  const runtimeConfig = createTruapiRuntimeConfig(
+    label,
+    window.location,
+    options.productId,
+  );
+  const { productId, ...hostConfig } = runtimeConfig;
+  const runtime = await createWebWorkerPairingHostRuntime(
+    new HostWorker(),
+    createHostCallbacks({
+      label,
+      pairingLabel: options.pairingLabel,
+      pairingDotSuffix: options.pairingDotSuffix,
+      pairingHostGlobal: options.pairingHostGlobal,
+    }),
+    {
+      hostConfig,
+    },
+  );
+  const provider = await runtime.createProvider({ productId });
+  return trackCoreProvider(
+    wrapCoreProviderForDebug(provider, options.productId ?? label),
+    runtime,
+  );
+}
+
+async function getLandingAuthHost(): Promise<CoreHost> {
+  if (landingAuthHostPromise !== null) {
+    return landingAuthHostPromise;
+  }
+  const generation = landingAuthGeneration;
+  const promise = createLandingAuthHost()
+    .then((host) => {
+      if (
+        generation !== landingAuthGeneration ||
+        landingAuthHostPromise !== promise
+      ) {
+        host.dispose();
+        throw new Error(
+          "Landing auth host was disposed before it became ready",
+        );
+      }
+      return host;
+    })
+    .catch((error: unknown) => {
+      if (landingAuthHostPromise === promise) {
+        landingAuthHostPromise = null;
+      }
+      throw error;
+    });
+  landingAuthHostPromise = promise;
+  return promise;
+}
+
+async function createLandingAuthHost(): Promise<CoreHost> {
+  const coreProvider = await createCoreProvider(LANDING_AUTH_LABEL, {
+    pairingLabel: LANDING_AUTH_DISPLAY_LABEL,
+    pairingDotSuffix: false,
+    pairingHostGlobal: true,
+  });
+  return {
+    requestLogin(reason) {
+      return requestCoreLogin(coreProvider, reason);
+    },
+    cancelLogin() {
+      coreProvider.cancelPairing();
+    },
+    disconnect() {
+      return coreProvider.disconnectSession();
+    },
+    dispose() {
+      coreProvider.dispose();
+    },
+  };
+}
+
+function disposeLandingAuthHost(): void {
+  landingAuthGeneration++;
+  const pending = landingAuthHostPromise;
+  landingAuthHostPromise = null;
+  void pending?.then(
+    (host) => {
+      host.dispose();
+    },
+    () => {
+      /* failed pending host has nothing to dispose */
+    },
+  );
 }
 
 /**
- * Render an iframe with the host-container bridge.
- *
- * Unlike the base renderIframe, this sets up the postMessage bridge
- * between the host and the embedded dApp, enabling accounts, signing,
- * chain connections, and scoped storage.
+ * Render a dApp iframe backed by the TrUAPI host bridge.
  */
-export async function renderIframe(url: string, label: string): Promise<void> {
+export async function renderIframe(
+  url: string,
+  label: string,
+  options: { productId?: string } = {},
+): Promise<void> {
+  const myRenderGeneration = ++renderGeneration;
   const renderFlowId = newFlowId("render");
   const bridgeFlowId = newFlowId("bridge");
+  const productId = options.productId ?? label;
   emitDotliDebugEvent({
     layer: "render",
     event: "iframe_begin",
@@ -141,74 +914,74 @@ export async function renderIframe(url: string, label: string): Promise<void> {
   });
   const stopSetup = m.timer(S.BRIDGE_SETUP);
   cleanup();
+  disposeLandingAuthHost();
 
-  currentRenderMode = "iframe";
-  currentLabel = label;
-  currentUrl = url;
-  currentCid = null;
-
-  const hasTopbar = document.getElementById("topbar") !== null;
-  const iframeStyle = hasTopbar
-    ? "position:fixed;top:56px;left:0;width:100%;height:calc(100vh - 56px);border:none;margin:0;padding:0;"
-    : "position:fixed;top:0;left:0;width:100%;height:100vh;border:none;margin:0;padding:0;";
+  currentProduct = {
+    mode: "iframe",
+    label,
+    url,
+    productId: options.productId,
+  };
 
   app.innerHTML = "";
-  const iframe = document.createElement("iframe");
-  // TODO: Review sandbox default permissions
-  iframe.sandbox.add(
-    "allow-scripts",
-    "allow-same-origin",
-    "allow-forms",
-    "allow-pointer-lock",
-  );
-  iframe.allow = `${buildAllowAttribute(label)}; cross-origin-isolated`;
-  iframe.style.cssText = iframeStyle;
-  document.body.style.margin = "0";
-  document.body.style.overflow = "hidden";
-  app.appendChild(iframe);
-  iframe.addEventListener(
-    "load",
-    () => {
-      emitDotliDebugEvent({
-        layer: "bridge",
-        event: "iframe_load",
-        flowId: bridgeFlowId,
-        timestamp: Date.now(),
-        payload: { label, productId: label, mode: "iframe" },
-      });
-    },
-    { once: true },
-  );
 
-  const { setupContainer, setupNestedBridgeDetector } =
-    await containerChunkPromise;
+  const hasTopbar = document.getElementById("topbar") !== null;
+  const iframeUrl = new URL(url, window.location.href);
   emitDotliDebugEvent({
     layer: "bridge",
     event: "setup_begin",
     flowId: bridgeFlowId,
     timestamp: Date.now(),
-    payload: { label, productId: label },
+    payload: { label, productId },
   });
-  const disposePrimary = setupContainer(iframe, url, label, bridgeFlowId);
-  const disposeNested = setupNestedBridgeDetector(iframe, label);
-  currentDispose = () => {
-    disposePrimary();
-    disposeNested();
-  };
+  const host = await createHost({
+    iframeUrl: iframeUrl.href,
+    allowedOrigin: iframeUrl.origin,
+    // Keep parity with the current dotli product sandbox permissions.
+    sandbox: "allow-scripts allow-same-origin allow-forms allow-pointer-lock",
+    label,
+    productId: options.productId,
+    container: app,
+    debugFlowId: bridgeFlowId,
+  });
+  if (myRenderGeneration !== renderGeneration) {
+    host.dispose();
+    stopSetup();
+    return;
+  }
   emitDotliDebugEvent({
     layer: "bridge",
     event: "setup_ready",
     flowId: bridgeFlowId,
     timestamp: Date.now(),
-    payload: { label, productId: label },
+    payload: { label, productId },
   });
+  applyIframeStyling(host.iframe, { topbarOffset: hasTopbar });
+  currentHost = host;
+  host.iframe.addEventListener(
+    "load",
+    () => {
+      emitDotliDebugEvent({
+        layer: "bridge",
+        event: "iframe_load",
+        flowId: bridgeFlowId,
+        timestamp: Date.now(),
+        payload: { label, productId, mode: "iframe" },
+      });
+    },
+    { once: true },
+  );
 
   if (
     (import.meta.env.VITE_SANDBOX_CHECKER as string | undefined) !== undefined
   ) {
     const { setupViolationPanel } =
       await import("@dotli/sandbox-checker/sandbox-checker-ui");
-    currentPanelDispose = setupViolationPanel(iframe);
+    if (myRenderGeneration !== renderGeneration) {
+      stopSetup();
+      return;
+    }
+    currentPanelDispose = setupViolationPanel(host.iframe);
   }
 
   stopSetup();
@@ -227,43 +1000,33 @@ export async function renderIframe(url: string, label: string): Promise<void> {
 }
 
 /**
- * Render content in a cross-origin app subdomain iframe at
- * `<label>.app.dot.li`.
+ * Render content in a cross-origin app subdomain iframe (cid.app.dot.li).
+ * Used by the host build to delegate content fetching+rendering to the app context.
  *
- * The host build delegates content fetching and rendering to the app
- * context. The origin is the human dotns label. The host owns dotns
- * resolution and threads the resolved CID through the URL contract
- * (`?cid=`), since it is no longer in the origin. The sandbox does
- * not re-resolve.
- *
- * Sets up the container bridge targeting the app iframe. The app context
- * acts as a transparent postMessage relay between the host and the dApp
- * iframe.
+ * The app context acts as a transparent relay between the host and the dApp
+ * iframe. Only the app subdomain itself participates in the TrUAPI
+ * MessageChannel; any nested dApp iframe it loads is opaque to the host.
  */
 export async function renderAppSubdomain(
   cid: string,
   label: string,
 ): Promise<void> {
+  const myRenderGeneration = ++renderGeneration;
   const renderFlowId = newFlowId("render");
   const bridgeFlowId = newFlowId("bridge");
   const stopSetup = m.timer(S.BRIDGE_SETUP);
   cleanup();
+  disposeLandingAuthHost();
+
+  currentProduct = {
+    mode: "subdomain",
+    label,
+    cid,
+  };
 
-  currentRenderMode = "subdomain";
-  currentLabel = label;
-  currentCid = cid;
-  currentUrl = null;
-
-  // Propagate the two independent backend axes. The legacy `?mode=`
-  // preset param is no longer sent. Host and sandbox deploy together,
-  // there are no old sandbox builds in the wild, and the sandbox
-  // validator rejects unknown params so keeping it would guarantee a
-  // boot failure on the next deploy.
-  //
-  // The sandbox reads its own curated endpoint defaults from
-  // `@dotli/config/network` (same package, built into its bundle), so
-  // the host no longer threads RPC/gateway URLs across the origin.
-  // There are no user-overridable endpoints to preserve.
+  // Propagate the current sandbox contract. The `?mode=` preset param is no
+  // longer sent. Host and sandbox deploy together, and the sandbox validator
+  // rejects unknown params.
   const chainBackend = getBackend();
   const network = getNetwork();
   const cache = getCacheSettings();
@@ -281,13 +1044,11 @@ export async function renderAppSubdomain(
     }
     // eslint-disable-next-line no-restricted-syntax -- sessionStorage may be unavailable (Safari private mode); reset flag defaults to false which is the safe state.
   } catch {
-    /* sessionStorage unavailable: skip pending reset */
+    /* sessionStorage unavailable — skip pending reset */
   }
   let url = deepPath ? `${appOrigin}${deepPath}` : appOrigin;
   try {
     const parsed = new URL(url);
-    // CID is no longer in the origin, so the host hands the resolved CID to
-    // the sandbox here. `v` lets a stale sandbox reject a mismatched build.
     parsed.searchParams.set(SANDBOX_CONTRACT_PARAMS.cid, cid);
     parsed.searchParams.set(
       SANDBOX_CONTRACT_PARAMS.v,
@@ -313,43 +1074,23 @@ export async function renderAppSubdomain(
     }
   }
 
-  const iframe = document.createElement("iframe");
-  iframe.sandbox.add(
-    "allow-scripts",
-    "allow-same-origin",
-    "allow-forms",
-    "allow-pointer-lock",
-    "allow-popups",
-  );
-  iframe.allow = buildAllowAttribute(label);
-  iframe.style.cssText =
-    "position:fixed;top:56px;left:0;width:100%;height:calc(100vh - 56px);border:none;margin:0;padding:0;";
-  document.body.style.margin = "0";
-  document.body.style.overflow = "hidden";
-
-  // Keep the loading overlay visible. The sandbox will post status
+  // Keep the loading overlay visible — the sandbox will post status
   // messages via dotli:loading-status and a final done=true to dismiss it.
-  // Only remove non-loading children from #app before appending the iframe.
+  // Only remove non-loading children from #app before handing it off.
   const loading = app.querySelector(".loading");
   app.innerHTML = "";
   if (loading) {
     app.appendChild(loading);
   }
-  app.appendChild(iframe);
-  iframe.addEventListener(
-    "load",
-    () => {
-      emitDotliDebugEvent({
-        layer: "bridge",
-        event: "iframe_load",
-        flowId: bridgeFlowId,
-        timestamp: Date.now(),
-        payload: { label, productId: label, mode: "subdomain" },
-      });
-    },
-    { once: true },
-  );
 
+  const iframeUrl = new URL(url);
+  emitDotliDebugEvent({
+    layer: "bridge",
+    event: "setup_begin",
+    flowId: bridgeFlowId,
+    timestamp: Date.now(),
+    payload: { label, productId: label },
+  });
   emitDotliDebugEvent({
     layer: "render",
     event: "iframe_begin",
@@ -357,22 +1098,20 @@ export async function renderAppSubdomain(
     timestamp: Date.now(),
     payload: { label, url, mode: "subdomain" },
   });
-
-  const { setupContainer, setupNestedBridgeDetector } =
-    await containerChunkPromise;
-  emitDotliDebugEvent({
-    layer: "bridge",
-    event: "setup_begin",
-    flowId: bridgeFlowId,
-    timestamp: Date.now(),
-    payload: { label, productId: label },
+  const host = await createHost({
+    iframeUrl: url,
+    allowedOrigin: iframeUrl.origin,
+    sandbox:
+      "allow-scripts allow-same-origin allow-forms allow-pointer-lock allow-popups",
+    label,
+    container: app,
+    debugFlowId: bridgeFlowId,
   });
-  const disposePrimary = setupContainer(iframe, url, label, bridgeFlowId);
-  const disposeNested = setupNestedBridgeDetector(iframe, label);
-  currentDispose = () => {
-    disposePrimary();
-    disposeNested();
-  };
+  if (myRenderGeneration !== renderGeneration) {
+    host.dispose();
+    stopSetup();
+    return;
+  }
   emitDotliDebugEvent({
     layer: "bridge",
     event: "setup_ready",
@@ -380,13 +1119,32 @@ export async function renderAppSubdomain(
     timestamp: Date.now(),
     payload: { label, productId: label },
   });
+  applyIframeStyling(host.iframe, { topbarOffset: true });
+  currentHost = host;
+  host.iframe.addEventListener(
+    "load",
+    () => {
+      emitDotliDebugEvent({
+        layer: "bridge",
+        event: "iframe_load",
+        flowId: bridgeFlowId,
+        timestamp: Date.now(),
+        payload: { label, productId: label, mode: "subdomain" },
+      });
+    },
+    { once: true },
+  );
 
   if (
     (import.meta.env.VITE_SANDBOX_CHECKER as string | undefined) !== undefined
   ) {
     const { setupViolationPanel } =
       await import("@dotli/sandbox-checker/sandbox-checker-ui");
-    currentPanelDispose = setupViolationPanel(iframe);
+    if (myRenderGeneration !== renderGeneration) {
+      stopSetup();
+      return;
+    }
+    currentPanelDispose = setupViolationPanel(host.iframe);
   }
 
   stopSetup();
@@ -404,8 +1162,6 @@ export async function renderAppSubdomain(
   });
 }
 
-// Origin is the human dotns label (`<label>.app.<root>`), not the CID. Storage
-// and permissions stay stable across content (CID) updates of the same name.
 function getAppOrigin(label: string): string {
   const hostname = window.location.hostname;
   if (hostname.endsWith(".localhost") || hostname === "localhost") {
@@ -420,8 +1176,15 @@ function cleanup(): void {
     currentPanelDispose();
     currentPanelDispose = null;
   }
-  if (currentDispose) {
-    currentDispose();
-    currentDispose = null;
+  if (currentHost) {
+    currentHost.dispose();
+    currentHost = null;
+  }
+}
+
+function newFlowId(prefix: string): string {
+  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+    return crypto.randomUUID();
   }
+  return `${prefix}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`;
 }
diff --git a/packages/ui/src/container.ts b/packages/ui/src/container.ts
deleted file mode 100644
index 4dc1323..0000000
--- a/packages/ui/src/container.ts
+++ /dev/null
@@ -1,1584 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// dot.li Host container bridge
-//
-// Bridges the host (dot.li) and the SPA loaded in the iframe using
-// @novasamatech/host-container's postMessage-based protocol.
-//
-// Supports nested dApps: when a dApp embeds another dApp via iframe,
-// the nested bridge detector dynamically creates additional bridges
-// for each descendant dApp that sends protocol messages to window.top.
-
-import {
-  createDefaultLogger,
-  CreateTransactionErr,
-  DeriveEntropyErr,
-  GenericError,
-  GetUserIdErr,
-  LoginErr,
-  PaymentBalanceErr,
-  PaymentRequestErr,
-  PaymentStatusErr,
-  PaymentTopUpErr,
-  PreimageSubmitErr,
-  PushNotificationError,
-  RequestCredentialsErr,
-  ResourceAllocationErr,
-  SigningErr,
-  StatementProofErr,
-  StorageErr,
-  toHex,
-} from "@novasamatech/host-api";
-import type { Provider } from "@novasamatech/host-api";
-import {
-  createContainer,
-  createIframeProvider,
-  createRateLimiter,
-  deriveProductEntropyFromSource,
-} from "@novasamatech/host-container";
-import type { Container, RateLimiter } from "@novasamatech/host-container";
-import type { SignedStatement } from "@novasamatech/sdk-statement";
-import {
-  createSr25519Prover,
-  type StatementStoreAdapter,
-} from "@novasamatech/statement-store";
-import { errAsync, fromPromise, okAsync, type ResultAsync } from "neverthrow";
-import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
-import { isLocalhost, BASE_DOMAIN } from "@dotli/config/config";
-import {
-  getPermissionStatus,
-  isEnforceableDevicePermission,
-  setPermissionStatus,
-  type PermissionName,
-} from "./permissions";
-import { showPermissionRequestModal } from "./permission-modal";
-import { showAllocationRequestModal } from "./allocation-modal";
-import { queueWalletFlow } from "./wallet-queue";
-
-import type { UserSession } from "@novasamatech/host-papp";
-import {
-  getAllowanceService,
-  getAuthState,
-  getStatementStore,
-  onAuthStateChange,
-  onStatementStoreReady,
-  readSessionSecret,
-  requestLogin,
-  type AuthState,
-} from "@dotli/auth/auth";
-import {
-  showCreateTransactionLegacyModal,
-  showCreateTransactionModal,
-  showSignPayloadLegacyModal,
-  showSignPayloadModal,
-  showSignRawLegacyModal,
-  showSignRawModal,
-  type ContainerCreateTransactionLegacyPayload,
-} from "@dotli/auth/signing";
-import {
-  deriveProductPublicKey,
-  normalizeProductAccountId,
-  productAddressToPublicKey,
-  productPublicKeyToAddress,
-} from "@dotli/auth/account";
-import {
-  createRemoteChainProvider,
-  isRemoteChainSupported,
-} from "@dotli/protocol/client";
-import { MAX_NESTED_BRIDGES } from "@dotli/config/config";
-import { dotNsUrl } from "@dotli/shared/dotns-url";
-import { log } from "@dotli/shared/log";
-import { getBackend } from "@dotli/config/mode";
-import { computePreimageKey, hashToCid } from "@dotli/content/preimage";
-import { fetchFromIpfs } from "@dotli/content/ipfs";
-import { submitPreimageAsUser } from "./preimage-submit";
-import { showNotification } from "./notification";
-import {
-  cancelNotification,
-  scheduleNotification,
-} from "./scheduled-notifications";
-import { showAliasPermissionModal } from "./alias-permission-modal";
-import { showPreimageSubmitModal } from "./preimage-modal";
-import {
-  mapFromHostSignedStatement,
-  mapFromHostStatement,
-  mapSdkProof,
-  mapSdkSignedStatement,
-} from "./statement-store-mapping";
-
-function getSession(): UserSession | null {
-  const state = getAuthState();
-  return state.status === "authenticated" ? state.session : null;
-}
-
-function subscribeSession(
-  callback: (session: ReturnType<typeof getSession>) => void,
-): () => void {
-  callback(getSession());
-  return onAuthStateChange((state: AuthState) => {
-    callback(state.status === "authenticated" ? state.session : null);
-  });
-}
-
-// localhost proxy and webcontainer previews are developer affordances for
-// running a `.dot` app before it's deployed.
-function isDevPreviewLabel(label: string): boolean {
-  return (
-    label.startsWith("localhost:") || dotNsUrl.isWebcontainerPreviewHost(label)
-  );
-}
-
-/**
- * Derive the product-id from an iframe label.
- *
- * Dev previews (localhost proxy, webcontainer) keep the bare host label. dotNs
- * products get the `.dot` suffix appended. Same rule encoded in
- * `isProductAccountValid`.
- */
-function labelToProductIdentifier(label: string): string {
-  return isDevPreviewLabel(label) ? label : `${label}.dot`;
-}
-
-function labelAcceptsIdentifier(label: string, id: string): boolean {
-  return (
-    dotNsUrl.isProductIdentifier(id) || id === labelToProductIdentifier(label)
-  );
-}
-
-// Dev previews are permissive. A deployed `.dot` must sign as its own identifier.
-function isProductAccountValid(label: string, accountId: string): boolean {
-  if (isDevPreviewLabel(label)) {
-    return labelAcceptsIdentifier(label, accountId);
-  }
-  return accountId === labelToProductIdentifier(label);
-}
-
-/**
- * Resolve the product-account tuple a product is allowed to act as.
- */
-function resolveProductAccountId(
-  label: string,
-  reported: Parameters<typeof normalizeProductAccountId>[0],
-): ReturnType<typeof normalizeProductAccountId> {
-  const normalized = normalizeProductAccountId(reported);
-  return isDevPreviewLabel(label)
-    ? normalized
-    : [labelToProductIdentifier(label), normalized[1]];
-}
-
-function wireContainerHandlers(
-  container: Container,
-  label: string,
-  storagePrefix: string,
-): () => void {
-  // One queue-strategy limiter per call-site domain. Browser parity
-  // (browser/src/shared/rateLimiter/index.ts): 20 req/s, 100 queued.
-  // Each limiter owns a refill timer that must be released on teardown.
-
-  function makeLimiter(onDrop: () => unknown): RateLimiter {
-    return createRateLimiter({
-      strategy: "queue",
-      maxRequestsPerInterval: 20,
-      intervalMs: 1000,
-      maxQueuedRequests: 100,
-      onDrop,
-    });
-  }
-
-  const aliasLimiter = makeLimiter(
-    () => new RequestCredentialsErr.Unknown({ reason: "Rate limited" }),
-  );
-  const permissionLimiter = makeLimiter(
-    () => new GenericError({ reason: "Rate limited" }),
-  );
-  const submitLimiter = makeLimiter(
-    () => new GenericError({ reason: "Rate limited" }),
-  );
-  const preimageLimiter = makeLimiter(
-    () => new PreimageSubmitErr.Unknown({ reason: "Rate limited" }),
-  );
-
-  let chainConnectionWarned = false;
-
-  function warnOnRawChainConnection(genesisHash: string): void {
-    if (chainConnectionWarned) {
-      return;
-    }
-    chainConnectionWarned = true;
-
-    log.warn(
-      `[${label}] Raw chain connection requested (genesis=${genesisHash.slice(0, 10)}…, storage=${storagePrefix})`,
-    );
-
-    showNotification({
-      label: "Direct Chain Access",
-      text: "This app uses a direct chain connection instead of the recommended host API.",
-      dismissMs: 8000,
-      browserNotification: false,
-    });
-  }
-
-  container.handleFeatureSupported((params, { ok }) => {
-    switch (params.tag as string) {
-      case "Chain":
-        return ok(isRemoteChainSupported(params.value));
-      default:
-        return ok(false);
-    }
-  });
-
-  container.handleChainConnection((genesisHash) => {
-    warnOnRawChainConnection(genesisHash);
-    return createRemoteChainProvider(genesisHash);
-  });
-
-  container.handleAccountGet((rawProductAccountId, { ok, err }) => {
-    const session = getSession();
-    if (!session) {
-      return err(new RequestCredentialsErr.NotConnected(undefined));
-    }
-
-    const [dotNsIdentifier, derivationIndex] = resolveProductAccountId(
-      label,
-      rawProductAccountId,
-    );
-
-    if (!labelAcceptsIdentifier(label, dotNsIdentifier)) {
-      return err(new RequestCredentialsErr.DomainNotValid(undefined));
-    }
-
-    const publicKey = deriveProductPublicKey(
-      session.rootAccountId,
-      dotNsIdentifier,
-      derivationIndex,
-    );
-
-    return ok({ publicKey });
-  });
-
-  // The web host has no user-imported accounts,
-  // only HDKD-derived product accounts.
-  container.handleGetLegacyAccounts((_, { ok }) => ok([]));
-
-  // Return the user's DotNS username. Disclosing it requires consent, gated by
-  // the per-product `GetUserId` permission. Returns `NotConnected` if no
-  // account is signed in, and `PermissionDenied` if the permission has not been
-  // granted explicitly.
-  container.handleGetUserId((_, { ok, err }) => {
-    const state = getAuthState();
-    if (state.status !== "authenticated") {
-      return errAsync(new GetUserIdErr.NotConnected(undefined));
-    }
-    const primaryUsername =
-      state.identity?.fullUsername ?? state.identity?.liteUsername;
-    if (primaryUsername === undefined || primaryUsername === "") {
-      return errAsync(
-        new GetUserIdErr.Unknown({
-          reason: "No primary username for this session",
-        }),
-      );
-    }
-    return promptCachedSubmitPermission(label, "GetUserId").andThen(
-      (granted) =>
-        granted
-          ? ok({ primaryUsername })
-          : err(new GetUserIdErr.PermissionDenied(undefined)),
-    );
-  });
-
-  // Products can trigger the host login flow. `requestLogin` dispatches a DOM
-  // event that the topbar listens for (it owns the QR modal), and resolves once
-  // the auth state settles.
-  container.handleRequestLogin((reason, { ok }) => {
-    return fromPromise(
-      requestLogin(reason, label),
-      (e) =>
-        new LoginErr.Unknown({
-          reason: e instanceof Error ? e.message : "Login flow failed",
-        }),
-    ).andThen((result) => ok(result));
-  });
-
-  container.handleAccountConnectionStatusSubscribe((_, send) => {
-    return subscribeSession((session) => {
-      send(session ? "connected" : "disconnected");
-    });
-  });
-
-  container.handleAccountGetAlias((rawProductAccountId, { err }) =>
-    aliasLimiter.schedule(() => {
-      const session = getSession();
-      if (!session) {
-        return err(new RequestCredentialsErr.NotConnected(undefined));
-      }
-
-      // Derive the alias off the bare base name.
-      const productAccountId = normalizeProductAccountId(rawProductAccountId);
-
-      if (!labelAcceptsIdentifier(label, productAccountId[0])) {
-        return err(new RequestCredentialsErr.DomainNotValid(undefined));
-      }
-
-      const identifier = labelToProductIdentifier(label);
-      const isOwnDomain = identifier === productAccountId[0];
-
-      if (isOwnDomain) {
-        return session
-          .getRingVrfAlias(productAccountId, identifier)
-          .mapErr(
-            (error) =>
-              new RequestCredentialsErr.Unknown({ reason: error.message }),
-          );
-      }
-
-      return fromPromise(
-        showAliasPermissionModal(identifier, productAccountId[0]),
-        () => new RequestCredentialsErr.Rejected(undefined),
-      ).andThen(() =>
-        session
-          .getRingVrfAlias(productAccountId, identifier)
-          .mapErr(
-            (error) =>
-              new RequestCredentialsErr.Unknown({ reason: error.message }),
-          ),
-      );
-    }),
-  );
-
-  container.handleSignPayload((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      // Resolve to the host's own product id so the wallet signs with the same
-      // account handleAccountGet returns, never the sandbox-reported one.
-      const account = resolveProductAccountId(label, payload.account);
-      log.warn(`[${label}] handleSignPayload invoked:`, {
-        account,
-        genesisHash: payload.payload.genesisHash,
-        method: payload.payload.method.slice(0, 40) + "...",
-      });
-
-      if (!isProductAccountValid(label, account[0])) {
-        log.warn(
-          `[${label}] handleSignPayload — invalid account[0]=${account[0]}`,
-        );
-        return errAsync(new SigningErr.PermissionDenied(undefined));
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(`[${label}] handleSignPayload — ChainSubmit not granted`);
-            return err(new SigningErr.PermissionDenied(undefined));
-          }
-          const session = getSession();
-          if (!session) {
-            log.error(`[${label}] handleSignPayload — no session, rejecting`);
-            return err(new SigningErr.Rejected(undefined));
-          }
-
-          return fromPromise(
-            showSignPayloadModal(session, payload.payload, label, account),
-            (e) => e as never,
-          )
-            .andThen((result) => {
-              log.warn(`[${label}] handleSignPayload — resolved OK`);
-              return ok({
-                signature: result.signature,
-                signedTransaction: result.signedTransaction,
-              });
-            })
-            .orElse((e) => {
-              log.warn(`[${label}] handleSignPayload — rejected:`, e);
-              return err(e);
-            });
-        },
-      );
-    }),
-  );
-
-  container.handleSignRaw((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      // Resolve to the host's own product id (see handleAccountGet).
-      const account = resolveProductAccountId(label, payload.account);
-      log.warn(`[${label}] handleSignRaw invoked:`, {
-        account,
-        dataTag: payload.payload.tag,
-      });
-
-      if (!isProductAccountValid(label, account[0])) {
-        log.warn(`[${label}] handleSignRaw — invalid account[0]=${account[0]}`);
-        return errAsync(new SigningErr.PermissionDenied(undefined));
-      }
-
-      const session = getSession();
-      if (!session) {
-        log.error(`[${label}] handleSignRaw — no session, rejecting`);
-        return errAsync(new SigningErr.Rejected(undefined));
-      }
-
-      return fromPromise(
-        showSignRawModal(session, payload.payload, label, account),
-        (e) => e as never,
-      )
-        .andThen((result) => {
-          log.warn(`[${label}] handleSignRaw — resolved OK`);
-          return ok({
-            signature: result.signature,
-            signedTransaction: result.signedTransaction,
-          });
-        })
-        .orElse((e) => {
-          log.warn(`[${label}] handleSignRaw — rejected:`, e);
-          return err(e);
-        });
-    }),
-  );
-
-  // host-api 0.7.9 delegates extrinsic construction to the wallet via
-  // host_create_transaction. We forward the typed payload to the paired
-  // mobile app and return the signed extrinsic bytes the wallet builds.
-  container.handleCreateTransaction((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      // Resolve to the host's own product id (see handleAccountGet).
-      const signer = resolveProductAccountId(label, payload.signer);
-      const normalizedPayload = { ...payload, signer };
-      log.warn(`[${label}] handleCreateTransaction invoked:`, {
-        signer,
-        genesisHash: toHex(payload.genesisHash),
-        callDataLen: payload.callData.length,
-        extensions: payload.extensions.map((e) => e.id),
-        txExtVersion: payload.txExtVersion,
-      });
-
-      if (!isProductAccountValid(label, signer[0])) {
-        log.warn(
-          `[${label}] handleCreateTransaction — invalid signer[0]=${signer[0]}`,
-        );
-        return errAsync(new CreateTransactionErr.PermissionDenied());
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(
-              `[${label}] handleCreateTransaction — ChainSubmit not granted`,
-            );
-            return err(new CreateTransactionErr.PermissionDenied());
-          }
-          const session = getSession();
-          if (!session) {
-            log.error(
-              `[${label}] handleCreateTransaction — no session, rejecting`,
-            );
-            return err(new CreateTransactionErr.Rejected());
-          }
-
-          return fromPromise(
-            showCreateTransactionModal(session, normalizedPayload, label),
-            (e) => e as never,
-          )
-            .andThen((signedTx) => {
-              log.warn(`[${label}] handleCreateTransaction — resolved OK`);
-              return ok(signedTx);
-            })
-            .orElse((e) => {
-              log.warn(`[${label}] handleCreateTransaction — rejected:`, e);
-              return err(e);
-            });
-        },
-      );
-    }),
-  );
-
-  // Legacy-account signing wires. A `*WithLegacyAccount` request always targets
-  // a genuine imported account, so decode the supplied signer to its raw
-  // AccountId and relay to the wallet via host-papp's legacy SDK calls. The
-  // non-legacy handlers above own the product-account (derived) path. Mirrors
-  // polkadot-desktop#632.
-  //
-  // host-papp has no `signPayloadLegacy`, so signPayload is signed through
-  // `signRawLegacy` (Payload variant) — see `showSignPayloadLegacyModal`.
-  container.handleSignPayloadWithLegacyAccount((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleSignPayloadWithLegacyAccount invoked:`, {
-        signer: payload.signer,
-        genesisHash: payload.payload.genesisHash,
-        method: payload.payload.method.slice(0, 40) + "...",
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleSignPayloadWithLegacyAccount — no session, rejecting`,
-        );
-        return errAsync(new SigningErr.Rejected(undefined));
-      }
-
-      let account: Uint8Array;
-      try {
-        account = productAddressToPublicKey(payload.signer);
-      } catch {
-        return errAsync(
-          new SigningErr.Unknown({ reason: "Invalid legacy signer address" }),
-        );
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(
-              `[${label}] handleSignPayloadWithLegacyAccount — ChainSubmit not granted`,
-            );
-            return err(new SigningErr.PermissionDenied(undefined));
-          }
-          return fromPromise(
-            showSignPayloadLegacyModal(
-              session,
-              payload.payload,
-              label,
-              account,
-            ),
-            (e) => e as never,
-          )
-            .andThen((result) =>
-              ok({
-                signature: result.signature,
-                signedTransaction: result.signedTransaction,
-              }),
-            )
-            .orElse((e) => err(e));
-        },
-      );
-    }),
-  );
-
-  container.handleSignRawWithLegacyAccount((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleSignRawWithLegacyAccount invoked:`, {
-        signer: payload.signer,
-        dataTag: payload.payload.tag,
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleSignRawWithLegacyAccount — no session, rejecting`,
-        );
-        return errAsync(new SigningErr.Rejected(undefined));
-      }
-
-      let account: Uint8Array;
-      try {
-        account = productAddressToPublicKey(payload.signer);
-      } catch {
-        return errAsync(
-          new SigningErr.Unknown({ reason: "Invalid legacy signer address" }),
-        );
-      }
-
-      return fromPromise(
-        showSignRawLegacyModal(session, payload.payload, label, account),
-        (e) => e as never,
-      )
-        .andThen((result) =>
-          ok({
-            signature: result.signature,
-            signedTransaction: result.signedTransaction,
-          }),
-        )
-        .orElse((e) => err(e));
-    }),
-  );
-
-  // Legacy-account create-transaction: relay the raw 32-byte signer
-  // (`AccountId = Bytes(32)`) to the wallet via createTransactionLegacy.
-  container.handleCreateTransactionWithLegacyAccount((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleCreateTransactionWithLegacyAccount invoked:`, {
-        signerHex: toHex(payload.signer),
-        genesisHash: toHex(payload.genesisHash),
-        callDataLen: payload.callData.length,
-        extensions: payload.extensions.map((e) => e.id),
-        txExtVersion: payload.txExtVersion,
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleCreateTransactionWithLegacyAccount — no session, rejecting`,
-        );
-        return errAsync(new CreateTransactionErr.Rejected());
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(
-              `[${label}] handleCreateTransactionWithLegacyAccount — ChainSubmit not granted`,
-            );
-            return err(new CreateTransactionErr.PermissionDenied());
-          }
-          const legacyPayload: ContainerCreateTransactionLegacyPayload = {
-            signer: payload.signer,
-            genesisHash: payload.genesisHash,
-            callData: payload.callData,
-            extensions: payload.extensions,
-            txExtVersion: payload.txExtVersion,
-          };
-          return fromPromise(
-            showCreateTransactionLegacyModal(session, legacyPayload, label),
-            (e) => e as never,
-          )
-            .andThen((signedTx) => ok(signedTx))
-            .orElse((e) => err(e));
-        },
-      );
-    }),
-  );
-
-  container.handleRequestResourceAllocation((resources, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleRequestResourceAllocation invoked:`, {
-        resources: resources.map((r) => r.tag),
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleRequestResourceAllocation — no session, rejecting`,
-        );
-        return errAsync(
-          new ResourceAllocationErr.Unknown({ reason: "No active session" }),
-        );
-      }
-
-      return fromPromise(
-        showAllocationRequestModal(
-          label,
-          resources,
-          async () => {
-            const outcomes = await session
-              .requestResourceAllocation({
-                callingProductId: labelToProductIdentifier(label),
-                // The product-facing host-api protocol spells this variant
-                // `BulletinAllowance`, but papp's host-to-mobile resource
-                // allocation codec still uses the legacy `BulletInAllowance`.
-                // Translate on the way in so the scale codec finds the variant.
-                resources: resources.map((r) =>
-                  r.tag === "BulletinAllowance"
-                    ? { tag: "BulletInAllowance" as const, value: undefined }
-                    : r,
-                ),
-                onExisting: "Increase",
-              })
-              .match(
-                (o) => o,
-                (e) => {
-                  throw e;
-                },
-              );
-            // Strip secret payload from Allocated outcomes before returning to product.
-            return outcomes.map((o) =>
-              o.tag === "Allocated"
-                ? ({ tag: "Allocated", value: undefined } as const)
-                : o,
-            );
-          },
-          {
-            // `SmartContractAllowance.value` is the app account's derivation
-            // index; derive its SS58 address for the tooltip, mirroring the
-            // legacy-signing handlers above.
-            resolveContractAccount: (index) =>
-              productPublicKeyToAddress(
-                deriveProductPublicKey(
-                  session.rootAccountId,
-                  labelToProductIdentifier(label),
-                  index,
-                ),
-              ),
-          },
-        ),
-        (e) =>
-          new ResourceAllocationErr.Unknown({
-            reason: e instanceof Error ? e.message : String(e),
-          }),
-      )
-        .andThen((outcomes) => {
-          log.warn(`[${label}] handleRequestResourceAllocation — resolved OK`);
-          return ok(outcomes);
-        })
-        .orElse((e) => {
-          log.warn(`[${label}] handleRequestResourceAllocation — rejected:`, e);
-          return err(e);
-        });
-    }),
-  );
-
-  container.handleLocalStorageRead((key, { ok, err }) => {
-    try {
-      const raw = localStorage.getItem(storagePrefix + key);
-      if (raw === null) {
-        return ok(undefined);
-      }
-      const bytes = Uint8Array.from(atob(raw), (c) => c.charCodeAt(0));
-      return ok(bytes);
-    } catch {
-      return err(
-        new StorageErr.Unknown({ reason: "Failed to read from storage" }),
-      );
-    }
-  });
-
-  container.handleLocalStorageWrite(([key, value], { ok, err }) => {
-    try {
-      const b64 = btoa(String.fromCharCode(...value));
-      localStorage.setItem(storagePrefix + key, b64);
-      return ok(undefined);
-    } catch {
-      return err(
-        new StorageErr.Unknown({ reason: "Failed to write to storage" }),
-      );
-    }
-  });
-
-  container.handleLocalStorageClear((key, { ok, err }) => {
-    try {
-      localStorage.removeItem(storagePrefix + key);
-      return ok(undefined);
-    } catch {
-      return err(new StorageErr.Unknown({ reason: "Failed to clear storage" }));
-    }
-  });
-
-  // Deterministic 32-byte entropy scoped to the calling product and a
-  // caller-chosen key. Uses the wallet-provided `rootEntropySource` so the
-  // output stays stable across re-pairings instead of churning with each
-  // session's statement-account secret.
-  container.handleDeriveEntropy((key, { ok, err }) => {
-    const session = getSession();
-    if (!session) {
-      return err(new DeriveEntropyErr.Unknown({ reason: "Not connected" }));
-    }
-    try {
-      const entropy = deriveProductEntropyFromSource(
-        session.rootEntropySource,
-        `${label}.dot`,
-        key,
-      );
-      return ok(entropy);
-    } catch (e) {
-      return err(
-        new DeriveEntropyErr.Unknown({
-          reason: e instanceof Error ? e.message : String(e),
-        }),
-      );
-    }
-  });
-
-  container.handleNavigateTo((url, { ok }) => {
-    const dotUrl = dotNsUrl.parseDotNsDomain(url);
-
-    if (dotUrl && dotNsUrl.isDotDomain(dotUrl.identifier)) {
-      // .dot domain (including polkadot:// scheme)
-      window.open(
-        buildDotTargetUrl(
-          identifierToLabel(dotUrl.identifier),
-          dotUrl.pathname,
-        ),
-        "_blank",
-      );
-    } else {
-      const localhostUrl = dotNsUrl.parseLocalhostUrl(url);
-      if (localhostUrl) {
-        // localhost product: wrap in host URL
-        const suffix = localhostUrl.pathname ? "/" + localhostUrl.pathname : "";
-        window.open(
-          `${getHostOrigin()}/${localhostUrl.host}${suffix}`,
-          "_blank",
-        );
-      } else {
-        window.open(dotNsUrl.normalizeUrl(url), "_blank");
-      }
-    }
-
-    return ok(undefined);
-  });
-
-  container.handleDevicePermission((permission, { ok }) =>
-    permissionLimiter.schedule(() => {
-      // Notifications: tri-state, no iframe reload, silent on denied.
-      // (No Permissions Policy directive maps to Notifications, so granting
-      // it doesn't change the iframe `allow` attribute. And a denied user
-      // explicitly chose silence. Surfacing a "your notifications are
-      // blocked" toast would defeat the point.)
-      if (permission === "Notifications") {
-        const status = getPermissionStatus(label, "Notifications");
-        if (status === "granted") {
-          return ok(true);
-        }
-        if (status === "denied") {
-          return ok(false);
-        }
-
-        return fromPromise(
-          showPermissionRequestModal(label, "Notifications").then(() => {
-            setPermissionStatus(label, "Notifications", "granted");
-          }),
-          () => "denied" as const,
-        )
-          .map(() => true)
-          .orElse(() => {
-            setPermissionStatus(label, "Notifications", "denied");
-            return ok(false);
-          });
-      }
-
-      // OpenUrl has no host-level enforcement point on the web (cross-origin
-      // navigation happens via anchor or window.open). Auto-grant rather than
-      // show a modal whose "Deny" button can't be honoured.
-      if (!isEnforceableDevicePermission(permission)) {
-        return ok(true);
-      }
-
-      const status = getPermissionStatus(label, permission);
-
-      if (status === "granted") {
-        return ok(true);
-      }
-
-      if (status === "denied") {
-        showNotification({
-          label: `${label}.dot`,
-          text: `${permission} access is blocked. Use the permissions menu in the top bar to change this.`,
-          dismissMs: 6000,
-          browserNotification: false,
-        });
-        return ok(false);
-      }
-
-      // status === 'ask': show consent modal
-      return fromPromise(
-        showPermissionRequestModal(label, permission).then(() => {
-          setPermissionStatus(label, permission, "granted");
-          // Defer the reload to the next event loop tick so the
-          // container can finish sending the response before being
-          // disposed. Without this, cleanup() runs synchronously
-          // inside the dispatch, disposing the transport mid-response.
-          setTimeout(() => {
-            window.dispatchEvent(
-              new CustomEvent("dotli:device-permission-changed", {
-                detail: { label, permission },
-              }),
-            );
-          }, 0);
-        }),
-        () => "denied" as const,
-      )
-        .map(() => {
-          // User allowed, but the iframe reloads, so return false for now
-          return false;
-        })
-        .orElse(() => {
-          // User denied (rejected promise) or dialog dismissed
-          setPermissionStatus(label, permission, "denied");
-          return ok(false);
-        });
-    }),
-  );
-
-  container.handlePermission((request, { ok }) =>
-    permissionLimiter.schedule(() => {
-      log.warn(
-        `[${label}] remote_permission incoming: tag=${request.tag}, value=${JSON.stringify(request.value)}`,
-      );
-
-      if (request.tag in CACHED_SUBMIT_PERMISSIONS) {
-        return promptCachedSubmitPermission(
-          label,
-          request.tag as keyof typeof CACHED_SUBMIT_PERMISSIONS,
-        );
-      }
-
-      // Remote (HTTP/WS) and WebRTC are auto-granted: the browser can't
-      // reliably intercept fetch/XHR/WebSocket from inside an iframe, and
-      // WebRTC is already gated by the iframe `allow` attribute. Any
-      // future unknown wire tag lands here too and auto-grants.
-      log.warn(`[${label}] remote_permission ${request.tag} auto-granted`);
-      return ok(true);
-    }),
-  );
-
-  container.handlePushNotification(
-    ({ text, deeplink, scheduledAt }, { ok }) => {
-      log.warn(`[${label}] Push notification:`, {
-        text,
-        deeplink,
-        scheduledAt,
-      });
-      const scheduledAtMs =
-        scheduledAt === undefined ? null : Number(scheduledAt);
-      return fromPromise(
-        scheduleNotification({
-          productId: label,
-          title: label,
-          text,
-          deeplink: deeplink ?? null,
-          scheduledAt: scheduledAtMs,
-        }),
-        (e) =>
-          new PushNotificationError.Unknown({
-            reason: e instanceof Error ? e.message : String(e),
-          }),
-      ).andThen((result) => {
-        if (!result.ok) {
-          // The only failure the scheduler reports is the per-product cap.
-          return errAsync(new PushNotificationError.ScheduleLimitReached());
-        }
-        if (result.immediate) {
-          showNotification({
-            text,
-            deeplink: deeplink ?? undefined,
-            label,
-          });
-        }
-        return ok(result.id);
-      });
-    },
-  );
-
-  container.handlePushNotificationCancel((id, { ok }) =>
-    fromPromise(
-      cancelNotification(label, id),
-      (e) =>
-        new GenericError({
-          reason: e instanceof Error ? e.message : String(e),
-        }),
-    ).andThen(() => ok(undefined)),
-  );
-
-  //
-  // Handlers resolve getStatementStore() lazily (at call time, not setup time)
-  // because initAuth() is lazy-loaded and may not have run yet.
-
-  container.handleStatementStoreSubscribe((topicFilter, send) => {
-    let innerUnsub: (() => void) | null = null;
-    let cancelled = false;
-
-    function startSubscription(store: StatementStoreAdapter): void {
-      if (cancelled) {
-        return;
-      }
-      // Bridge the wire-side tagged union to the adapter's discriminator-free
-      // `{ matchAll }`/`{ matchAny }` shape.
-      const topics = topicFilter.value;
-      const filter =
-        topicFilter.tag === "MatchAny"
-          ? { matchAny: topics }
-          : { matchAll: topics };
-      log.warn(`[${label}] Statement store subscribe, topics:`, topics.length);
-      innerUnsub = store.subscribeStatements(filter, (page) => {
-        log.warn(
-          `[${label}] Statement store received ${String(page.statements.length)} statements (isComplete=${String(page.isComplete)})`,
-        );
-        const signed = page.statements.filter(
-          (s): s is SignedStatement => s.proof !== undefined,
-        );
-        if (signed.length > 0) {
-          send({
-            statements: signed.map(mapSdkSignedStatement),
-            isComplete: page.isComplete,
-          });
-        }
-      });
-    }
-
-    const store = getStatementStore();
-    if (store) {
-      startSubscription(store);
-    } else {
-      log.warn(
-        `[${label}] Statement store subscribe — store not ready, waiting…`,
-      );
-      void onStatementStoreReady().then(startSubscription);
-    }
-
-    return () => {
-      cancelled = true;
-      innerUnsub?.();
-    };
-  });
-
-  container.handleStatementStoreSubmit((statement) =>
-    submitLimiter.schedule(() => {
-      const store = getStatementStore();
-      if (!store) {
-        return errAsync(
-          new GenericError({ reason: "Statement store not initialized" }),
-        );
-      }
-      return store
-        .submitStatement(mapFromHostSignedStatement(statement))
-        .map(() => undefined)
-        .mapErr((e: Error) => new GenericError({ reason: e.message }));
-    }),
-  );
-
-  // ProductAccountId ([dotNsIdentifier, derivationIndex]) is intentionally
-  // unused. The proof is always signed with the root session key because only
-  // the session account has a network allowance (quota) on People Chain.
-  // Derived product accounts are not registered and cannot submit statements.
-  container.handleStatementStoreCreateProof(([, statement], { err }) => {
-    const session = getSession();
-    if (!session) {
-      return err(new StatementProofErr.UnableToSign());
-    }
-
-    return fromPromise(readSessionSecret(session.id), (e) =>
-      e instanceof Error ? e : new Error(String(e)),
-    )
-      .mapErr((e) => new StatementProofErr.Unknown({ reason: e.message }))
-      .andThen((secret) =>
-        secret
-          ? fromPromise(
-              Promise.resolve(createSr25519Prover(secret)),
-              () => new StatementProofErr.UnableToSign(),
-            )
-          : err(new StatementProofErr.UnableToSign()),
-      )
-      .andThen((prover) =>
-        prover
-          .generateMessageProof(mapFromHostStatement(statement))
-          .mapErr((e) => new StatementProofErr.Unknown({ reason: e.message })),
-      )
-      .map((signed) => mapSdkProof(signed.proof));
-  });
-
-  // Submit stores data on Bulletin via TransactionStorage.store(), signed
-  // with the user's wallet-authorized allowance slot account, and returns
-  // the Blake2b-256 hash key.
-  // Lookup retrieves data by hash via Helia P2P (IPFS gateway fallback).
-
-  const preimageCache = new Map<string, Uint8Array>();
-
-  container.handlePreimageSubmit((value) =>
-    preimageLimiter.schedule(() => {
-      log.warn(
-        `[${label}] Preimage submit request, size: ${String(value.byteLength)}`,
-      );
-
-      return fromPromise(showPreimageSubmitModal(value.byteLength), (e) =>
-        e instanceof Error ? e.message : "User denied preimage submit",
-      )
-        .andThen(() => {
-          const session = getSession();
-          if (!session) {
-            return errAsync("No active session");
-          }
-          const allowance = getAllowanceService();
-          if (!allowance) {
-            return errAsync("Allowance service not initialized");
-          }
-          // Slot-account keys are cached per (session, product, resource) in
-          // host-papp's AllowanceRepository, so only the first submit
-          // round-trips to the wallet.
-          return allowance
-            .getBulletinSigner(session.id, labelToProductIdentifier(label))
-            .mapErr((e) => e.message);
-        })
-        .andThen((signer) => {
-          const key = computePreimageKey(value);
-          return fromPromise(submitPreimageAsUser(value, signer), (e) =>
-            e instanceof Error ? e.message : String(e),
-          ).map(() => {
-            preimageCache.set(key, value);
-            log.warn(`[${label}] Preimage stored, key: ${key}`);
-            return key;
-          });
-        })
-        .mapErr((reason) => {
-          // Surface the real failure reason on the host console. The
-          // product-side only receives the opaque `PreimageSubmitErr.Unknown`
-          // class, so without this log there is no way to diagnose why a
-          // submit got rejected.
-          log.error(`[${label}] Preimage submit failed: ${reason}`);
-          return new PreimageSubmitErr.Unknown({ reason });
-        });
-    }),
-  );
-
-  // Preimage lookup subscribe contract:
-  //   - Caller (sandboxed app) requests a preimage by key. The lookup runs
-  //     against the user's chosen content backend exclusively, no crossover.
-  //   - We poll at POLL_INTERVAL_MS until cached or the caller drops the
-  //     subscription.
-  //   - A miss ("not found yet") and a backend throw (Helia/gateway error)
-  //     are both logged and polling continues. The subscription never
-  //     self-interrupts: the propagation time for a valid preimage can be
-  //     arbitrary, and cutting the subscription on "a few misses" made slow
-  //     but healthy chains look like transport failure to the caller.
-  //   - This is not a silent retry across providers. The user-selected
-  //     backend is the only backend dialed. Failures stay attributable.
-  container.handlePreimageLookupSubscribe((key, send, _interrupt) => {
-    log.warn(`[${label}] Preimage lookup subscribe, key: ${key}`);
-
-    let stopped = false;
-
-    // Check local cache first
-    const cached = preimageCache.get(key);
-    if (cached) {
-      send(cached);
-    } else {
-      send(null);
-    }
-
-    // Poll: use whichever content backend the user selected.
-    const poll = async (): Promise<void> => {
-      if (stopped) {
-        return;
-      }
-
-      // Re-check cache (may have been populated by a submit)
-      const cachedValue = preimageCache.get(key);
-      if (cachedValue) {
-        send(cachedValue);
-        return;
-      }
-
-      const cid = hashToCid(key);
-      const cidString = cid.toString();
-
-      // Honor the user's backend choice. No silent smoldot-to-gateway
-      // crossover. A bitswap lookup failure is a bitswap failure. A
-      // gateway failure is a gateway failure. We log and keep polling.
-      // The caller unsubscribes when it's done waiting.
-      const backend = getBackend();
-      try {
-        if (backend === "rpc-gateway") {
-          const result = await fetchFromIpfs(cidString);
-          if (result.data.length > 0) {
-            preimageCache.set(key, result.data);
-            send(result.data);
-            return;
-          }
-        } else {
-          // smoldot-direct or smoldot-shared-worker: fetch via the protocol
-          // iframe's smoldot using `bitswap_v1_get`. The host helper sends
-          // it through the existing chainConnect/chainSend bridge and
-          // handles the -32811/-32812 retry envelope.
-          const { bitswapGet } = await import("./bulletin-bitswap");
-          const data = await bitswapGet(cidString);
-          if (data.length > 0) {
-            preimageCache.set(key, data);
-            send(data);
-            return;
-          }
-        }
-      } catch (err) {
-        log.warn(`[${label}] preimage lookup via ${backend} failed:`, err);
-      }
-    };
-
-    const POLL_INTERVAL_MS = 10_000;
-    const intervalId = setInterval(() => void poll(), POLL_INTERVAL_MS);
-    const initialTimeoutId = setTimeout(() => void poll(), 1000);
-
-    return () => {
-      stopped = true;
-      clearInterval(intervalId);
-      clearTimeout(initialTimeoutId);
-    };
-  });
-
-  container.handleThemeSubscribe((_params, send) => {
-    const readTheme = () =>
-      ({
-        name: { tag: "Default", value: undefined },
-        variant:
-          document.documentElement.getAttribute("data-theme") === "light"
-            ? "Light"
-            : "Dark",
-      }) as const;
-
-    send(readTheme());
-
-    const listener = (): void => {
-      send(readTheme());
-    };
-    window.addEventListener("dotli:theme-changed", listener);
-
-    return () => {
-      window.removeEventListener("dotli:theme-changed", listener);
-    };
-  });
-
-  // dot.li does not own a payment rail yet. Register explicit
-  // "not implemented" responses so products see a specific reason
-  // rather than a generic transport error, and subscription starts
-  // fail fast via `interrupt` with a typed error.
-  container.handlePaymentBalanceSubscribe((_, _send, interrupt) => {
-    interrupt(new PaymentBalanceErr.PermissionDenied());
-    return NOOP;
-  });
-
-  container.handlePaymentTopUp((_, { err }) => {
-    return err(
-      new PaymentTopUpErr.Unknown({ reason: PAYMENTS_NOT_IMPLEMENTED }),
-    );
-  });
-
-  container.handlePaymentRequest((_, { err }) => {
-    return err(
-      new PaymentRequestErr.Unknown({ reason: PAYMENTS_NOT_IMPLEMENTED }),
-    );
-  });
-
-  container.handlePaymentStatusSubscribe((_, _send, interrupt) => {
-    interrupt(
-      new PaymentStatusErr.Unknown({ reason: PAYMENTS_NOT_IMPLEMENTED }),
-    );
-    return NOOP;
-  });
-
-  return () => {
-    aliasLimiter.destroy();
-    permissionLimiter.destroy();
-    submitLimiter.destroy();
-    preimageLimiter.destroy();
-  };
-}
-
-const PAYMENTS_NOT_IMPLEMENTED = "Payments are not supported in dot.li";
-const NOOP: VoidFunction = () => undefined;
-
-// Each submit-style wire tag caches a per-product decision in
-// localStorage under the `storageKey` below, prompting once via
-// `showPermissionRequestModal` when the cache is empty. `Remote`
-// intentionally prompts every call (the domain-pattern list is
-// dynamic). `WebRTC` is auto-granted (browser gates it via the
-// iframe `allow` attribute).
-
-const CACHED_SUBMIT_PERMISSIONS = {
-  ChainSubmit: { storageKey: "ChainSubmit", label: "Transaction signing" },
-  PreimageSubmit: { storageKey: "PreimageSubmit", label: "Preimage submit" },
-  StatementSubmit: { storageKey: "StatementSubmit", label: "Statement submit" },
-  GetUserId: { storageKey: "GetUserId", label: "Reveal Username" },
-} satisfies Record<string, { storageKey: PermissionName; label: string }>;
-
-function promptCachedSubmitPermission(
-  productLabel: string,
-  tag: keyof typeof CACHED_SUBMIT_PERMISSIONS,
-): ResultAsync<boolean, never> {
-  const { storageKey, label: humanLabel } = CACHED_SUBMIT_PERMISSIONS[tag];
-  const status = getPermissionStatus(productLabel, storageKey);
-  log.warn(`[${productLabel}] remote_permission ${tag}, status=${status}`);
-
-  if (status === "granted") {
-    return okAsync(true);
-  }
-
-  if (status === "denied") {
-    log.warn(
-      `[${productLabel}] ${tag} cached as denied — toggle the permission in the top-bar menu to re-prompt`,
-    );
-    showNotification({
-      label: `${productLabel}.dot`,
-      text: `${humanLabel} is blocked. Use the permissions menu in the top bar to change this.`,
-      dismissMs: 6000,
-      browserNotification: false,
-    });
-    return okAsync(false);
-  }
-
-  return fromPromise(
-    showPermissionRequestModal(productLabel, storageKey).then(() => {
-      setPermissionStatus(productLabel, storageKey, "granted");
-      window.dispatchEvent(
-        new CustomEvent("dotli:permission-changed", {
-          detail: { label: productLabel },
-        }),
-      );
-    }),
-    () => "denied" as const,
-  )
-    .map(() => true)
-    .orElse(() => {
-      setPermissionStatus(productLabel, storageKey, "denied");
-      return okAsync(false);
-    });
-}
-
-/** Strip the `.dot` suffix to get the bare label (e.g. "mytestapp.dot" becomes "mytestapp"). */
-function identifierToLabel(identifier: string): string {
-  return identifier.slice(0, -".dot".length);
-}
-
-/** Build a full URL for a .dot product on the current environment. */
-function buildDotTargetUrl(label: string, pathname: string): string {
-  const suffix = pathname ? "/" + pathname : "";
-  if (isLocalhost) {
-    return `http://${label}.localhost:${window.location.port}${suffix}`;
-  }
-  return `${window.location.protocol}//${label}.${BASE_DOMAIN}${suffix}`;
-}
-
-/** Bare host origin without any product subdomain (e.g. `http://localhost:5173` or `https://dot.li`). */
-function getHostOrigin(): string {
-  if (isLocalhost) {
-    return `http://localhost:${window.location.port}`;
-  }
-  return `${window.location.protocol}//${BASE_DOMAIN}`;
-}
-
-/** Check if a value is a Uint8Array (or cross-realm equivalent). */
-function isUint8ArrayLike(data: unknown): data is Uint8Array {
-  if (data instanceof Uint8Array) {
-    return true;
-  }
-  if (typeof data !== "object" || data === null) {
-    return false;
-  }
-  return (
-    (data as { constructor: { name: string } }).constructor.name ===
-    "Uint8Array"
-  );
-}
-
-// Implements the same Provider interface as createIframeProvider
-// but targets a captured Window reference (from event.source)
-// instead of an HTMLIFrameElement.
-
-function createWindowProvider(sourceWindow: Window): Provider {
-  let disposed = false;
-  const subscribers = new Set<(message: Uint8Array) => void>();
-
-  const messageHandler = (event: MessageEvent): void => {
-    if (disposed) {
-      return;
-    }
-    if (event.source !== sourceWindow) {
-      return;
-    }
-    if (!isUint8ArrayLike(event.data)) {
-      return;
-    }
-
-    for (const subscriber of subscribers) {
-      subscriber(event.data);
-    }
-  };
-
-  window.addEventListener("message", messageHandler);
-
-  return {
-    logger: createDefaultLogger(),
-
-    isCorrectEnvironment() {
-      return true;
-    },
-    postMessage(message) {
-      if (disposed) {
-        return;
-      }
-      sourceWindow.postMessage(message, "*", [message.buffer]);
-    },
-    subscribe(callback) {
-      subscribers.add(callback);
-      return () => {
-        subscribers.delete(callback);
-      };
-    },
-    dispose() {
-      disposed = true;
-      subscribers.clear();
-      window.removeEventListener("message", messageHandler);
-    },
-  };
-}
-
-// Listens for Uint8Array postMessage events from windows other
-// than the primary iframe. When a new source is detected, creates
-// a full bridge (Provider + Container + handlers) for that window.
-//
-// This enables nested dApps (dApp-in-dApp) to communicate with
-// the HOST, since all dApps send to window.top regardless of depth.
-
-export function setupNestedBridgeDetector(
-  primaryIframe: HTMLIFrameElement,
-  label: string,
-): () => void {
-  const knownWindows = new Set<MessageEventSource>();
-  const disposers: (() => void)[] = [];
-
-  function messageHandler(event: MessageEvent): void {
-    // Only handle protocol messages (Uint8Array)
-    if (!isUint8ArrayLike(event.data)) {
-      return;
-    }
-    // Skip messages from the primary iframe (handled by its own bridge)
-    if (event.source === primaryIframe.contentWindow) {
-      return;
-    }
-    // Skip messages from ourselves
-    if (event.source === window) {
-      return;
-    }
-    // Must have a source
-    if (event.source === null) {
-      return;
-    }
-    // Skip already-known nested windows
-    if (knownWindows.has(event.source)) {
-      return;
-    }
-
-    // Validate origin: only allow *.dot.li and *.localhost origins
-    try {
-      const url = new URL(event.origin);
-      const h = url.hostname;
-      const allowed =
-        h.endsWith(`.${BASE_DOMAIN}`) ||
-        h === BASE_DOMAIN ||
-        h === "localhost" ||
-        h.endsWith(".localhost");
-      if (!allowed) {
-        log.warn(
-          `[dot.li] Rejected nested bridge from disallowed origin: ${event.origin}`,
-        );
-        return;
-      }
-    } catch {
-      return;
-    }
-
-    // Cap the number of nested bridges
-    if (knownWindows.size >= MAX_NESTED_BRIDGES) {
-      log.warn(
-        `[dot.li] Nested bridge limit reached (max ${String(MAX_NESTED_BRIDGES)}), ignoring`,
-      );
-      return;
-    }
-
-    // New nested dApp detected
-    knownWindows.add(event.source);
-    const nestedId = String(knownWindows.size);
-    log.warn(`[dot.li] Nested dApp #${nestedId} detected, creating bridge`);
-
-    const provider = createWindowProvider(event.source as Window);
-    const productId = `${label}:nested-${nestedId}`;
-    emitDotliDebugEvent({
-      layer: "bridge",
-      event: "nested_detected",
-      flowId:
-        typeof crypto !== "undefined" && "randomUUID" in crypto
-          ? crypto.randomUUID()
-          : `bridge-${String(Date.now())}-${nestedId}`,
-      timestamp: Date.now(),
-      payload: { label, productId, nestedIndex: knownWindows.size },
-    });
-    const container = createContainer(provider, { productId });
-    const nestedPrefix = `dotli:${label}:nested-${nestedId}:`;
-    const teardown = wireContainerHandlers(container, label, nestedPrefix);
-
-    disposers.push(() => {
-      teardown();
-      container.dispose();
-    });
-  }
-
-  window.addEventListener("message", messageHandler);
-
-  return () => {
-    window.removeEventListener("message", messageHandler);
-    for (const dispose of disposers) {
-      dispose();
-    }
-    knownWindows.clear();
-    disposers.length = 0;
-  };
-}
-
-/**
- * Set up the host container for an iframe displaying a .dot SPA.
- *
- * Creates a postMessage-based provider, wires up all handlers
- * (accounts, signing, localStorage, etc.) and loads the URL in the iframe.
- *
- * Returns a dispose function to tear down the container.
- */
-export function setupContainer(
-  iframe: HTMLIFrameElement,
-  blobUrl: string,
-  label: string,
-  bridgeFlowId?: string,
-): () => void {
-  const baseProvider = createIframeProvider({ iframe, url: blobUrl });
-  const provider =
-    bridgeFlowId !== undefined
-      ? instrumentProvider(baseProvider, label, bridgeFlowId)
-      : baseProvider;
-  const container = createContainer(provider, { productId: label });
-  const storagePrefix = `dotli:${label}:`;
-  const teardown = wireContainerHandlers(container, label, storagePrefix);
-
-  return () => {
-    teardown();
-    container.dispose();
-  };
-}
-
-/**
- * Wrap a bridge Provider so the first inbound and first outbound
- * messages emit debug events. These anchor the often-long window
- * between `bridge:setup_ready` (handler registered) and the moment
- * the product iframe actually starts exchanging messages with the
- * host, during which the TrUAPI swimlane typically shows dozens to
- * hundreds of `host_handshake_request` retries with no corresponding
- * system-layer activity.
- */
-function instrumentProvider(
-  base: Provider,
-  label: string,
-  bridgeFlowId: string,
-): Provider {
-  let inboundEmitted = false;
-  let outboundEmitted = false;
-  return {
-    ...base,
-    postMessage(message) {
-      if (!outboundEmitted) {
-        outboundEmitted = true;
-        emitDotliDebugEvent({
-          layer: "bridge",
-          event: "first_outbound",
-          flowId: bridgeFlowId,
-          timestamp: Date.now(),
-          payload: { label, productId: label },
-        });
-        // Signal the main-thread monitor that it can stop. The
-        // bridge is fully established.
-        try {
-          window.dispatchEvent(new CustomEvent("dotli:debug:bridge-ready"));
-          // eslint-disable-next-line no-restricted-syntax -- dispatchEvent may throw in exotic environments; the debug monitor is best-effort.
-        } catch {
-          /* ignore: monitor just falls back to its duration cap */
-        }
-      }
-      base.postMessage(message);
-    },
-    subscribe(callback) {
-      return base.subscribe((message) => {
-        if (!inboundEmitted) {
-          inboundEmitted = true;
-          emitDotliDebugEvent({
-            layer: "bridge",
-            event: "first_inbound",
-            flowId: bridgeFlowId,
-            timestamp: Date.now(),
-            payload: { label, productId: label },
-          });
-        }
-        callback(message);
-      });
-    },
-  };
-}
diff --git a/packages/ui/src/host-callbacks/AuthState.ts b/packages/ui/src/host-callbacks/AuthState.ts
new file mode 100644
index 0000000..fc59494
--- /dev/null
+++ b/packages/ui/src/host-callbacks/AuthState.ts
@@ -0,0 +1,82 @@
+import type { AuthState, HostCallbacks } from "@parity/truapi-host-wasm";
+import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
+import { emitSsoPairingPresented } from "./SsoDebug";
+import {
+  toSessionUiState,
+  writeUiStateCache,
+  type TruapiSessionUiState,
+} from "./SessionStore";
+
+/**
+ * UI-level auth state dispatched on `dotli:truapi-auth-state`. Mirrors the
+ * core's `AuthState` with byte fields already converted for rendering, plus
+ * the pairing presentation context the topbar modal needs.
+ */
+export type DotliAuthState =
+  | { tag: "Disconnected" }
+  | {
+      tag: "Pairing";
+      deeplink: string;
+      label: string;
+      dotSuffix?: boolean;
+      hostGlobal?: boolean;
+    }
+  | { tag: "Connected"; session: TruapiSessionUiState }
+  | { tag: "LoginFailed"; reason: string };
+
+/** Dispatch a `dotli:truapi-auth-state` event for the topbar to render. */
+export function dispatchAuthState(state: DotliAuthState): void {
+  window.dispatchEvent(
+    new CustomEvent<DotliAuthState>("dotli:truapi-auth-state", {
+      detail: state,
+    }),
+  );
+}
+
+/**
+ * Build the `authStateChanged` host callback: converts the core's ordered
+ * auth states into `dotli:truapi-auth-state` events and maintains the
+ * boot-rehydration UI-state cache on connect/disconnect transitions.
+ */
+export function createAuthStateChanged(
+  label: string,
+  options: { dotSuffix?: boolean; hostGlobal?: boolean } = {},
+): Required<HostCallbacks>["authStateChanged"] {
+  return (state: AuthState) => {
+    switch (state.tag) {
+      case "Pairing": {
+        emitDotliDebugEvent({
+          layer: "sso",
+          event: "present_pairing_callback",
+          flowId: "sso-present-pairing",
+          timestamp: Date.now(),
+          payload: { label },
+        });
+        emitSsoPairingPresented({ label, deeplink: state.value.deeplink });
+        dispatchAuthState({
+          tag: "Pairing",
+          deeplink: state.value.deeplink,
+          label,
+          dotSuffix: options.dotSuffix,
+          hostGlobal: options.hostGlobal,
+        });
+        break;
+      }
+      case "Connected": {
+        const session = toSessionUiState(state.value);
+        void writeUiStateCache(session);
+        dispatchAuthState({ tag: "Connected", session });
+        break;
+      }
+      case "Disconnected": {
+        void writeUiStateCache({ connected: false });
+        dispatchAuthState({ tag: "Disconnected" });
+        break;
+      }
+      case "LoginFailed": {
+        dispatchAuthState({ tag: "LoginFailed", reason: state.value.reason });
+        break;
+      }
+    }
+  };
+}
diff --git a/packages/ui/src/host-callbacks/Chain.ts b/packages/ui/src/host-callbacks/Chain.ts
new file mode 100644
index 0000000..904d0e0
--- /dev/null
+++ b/packages/ui/src/host-callbacks/Chain.ts
@@ -0,0 +1,324 @@
+// dot.li — TrUAPI chain callback
+//
+// Routes product chain RPC traffic through whichever backend the user
+// has selected in the host shell ("Light Client" via smoldot, or
+// "RPC Node" via curated WSS endpoints).
+//
+// Without this callback, truapi-server would fall back to its own
+// bundled smoldot — which would ignore the toggle, double the
+// light-client footprint, and rebuild a fresh chain alongside the one
+// dotli's resolver already maintains. Routing through dotli's existing
+// providers reuses already-synced chains and respects the toggle.
+
+import { bytesToHex } from "@parity/truapi/scale";
+import type {
+  JsonRpcRequest,
+  JsonRpcProvider,
+} from "@polkadot-api/json-rpc-provider";
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import type { PlatformJsonRpcConnection } from "@parity/truapi-host-wasm";
+import { hasDotliDebugListeners } from "@dotli/truapi-debug/dotli-debug-bus";
+import { SS_USE_SMOLDOT } from "@dotli/config/config";
+import { getBackend } from "@dotli/config/mode";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import {
+  createChainProvider as createSmoldotChainProvider,
+  isChainSupported as isSmoldotChainSupported,
+} from "@dotli/resolver/chains";
+import {
+  createRpcChainProvider,
+  isRpcChainSupported,
+} from "@dotli/resolver/rpc-chain";
+import { log } from "@dotli/shared/log";
+import {
+  emitSsoStatementStoreConnected,
+  emitSsoStatementStoreConnecting,
+  emitSsoStatementStoreConnectFailed,
+  emitSsoStatementStoreRequest,
+  emitSsoStatementStoreResponse,
+} from "./SsoDebug";
+
+const STATEMENT_SUBMIT_METHOD = "statement_submit";
+const STATEMENT_SUBSCRIBE_METHOD = "statement_subscribeStatement";
+const STATEMENT_UNSUBSCRIBE_METHOD = "statement_unsubscribeStatement";
+
+interface StatementStoreDebugRequest {
+  method: string;
+  requestKind: string;
+}
+
+function isJsonRpcRequest(value: unknown): value is JsonRpcRequest<unknown> {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value as Record<string, unknown>;
+  const id = record.id;
+  return (
+    record.jsonrpc === "2.0" &&
+    typeof record.method === "string" &&
+    (id === undefined ||
+      id === null ||
+      typeof id === "string" ||
+      typeof id === "number")
+  );
+}
+
+function normalizeProviderRequest(
+  request: JsonRpcRequest<unknown>,
+): JsonRpcRequest<unknown> {
+  if (request.method === "chainHead_v1_unpin") {
+    const params = Array.isArray(request.params) ? request.params : [];
+    if (typeof params[1] === "string") {
+      return { ...request, params: [params[0], [params[1]]] };
+    }
+  }
+
+  if (request.params === undefined) {
+    return { ...request, params: [] };
+  }
+
+  return request;
+}
+
+function toConnection(
+  provider: JsonRpcProvider<unknown> | null,
+): PlatformJsonRpcConnection {
+  if (!provider) {
+    throw new Error("Chain provider unavailable");
+  }
+  const queue: string[] = [];
+  const debugRequests = new Map<string, StatementStoreDebugRequest>();
+  let wake: (() => void) | null = null;
+  let stopped = false;
+  let closed = false;
+  const conn = provider((message: unknown) => {
+    if (closed) {
+      return;
+    }
+    queue.push(JSON.stringify(message));
+    wake?.();
+    wake = null;
+  });
+  const close = (): void => {
+    if (closed) {
+      return;
+    }
+    stopped = true;
+    closed = true;
+    conn.disconnect();
+    wake?.();
+    wake = null;
+  };
+
+  return {
+    send(request: string): void {
+      const parsed: unknown = JSON.parse(request);
+      if (!isJsonRpcRequest(parsed)) {
+        throw new Error("Invalid JSON-RPC request");
+      }
+      emitStatementStoreRequest(parsed, debugRequests);
+      conn.send(normalizeProviderRequest(parsed));
+    },
+    async *responses(): AsyncIterable<string> {
+      try {
+        while (!stopped) {
+          while (queue.length > 0) {
+            const response = queue.shift();
+            if (response !== undefined) {
+              emitStatementStoreResponse(response, debugRequests);
+              yield response;
+            }
+          }
+          await new Promise<void>((resolve) => {
+            wake = resolve;
+          });
+        }
+      } finally {
+        close();
+      }
+    },
+    close,
+  };
+}
+
+function emitStatementStoreRequest(
+  request: JsonRpcRequest<unknown>,
+  debugRequests: Map<string, StatementStoreDebugRequest>,
+): void {
+  if (!hasDotliDebugListeners()) {
+    return;
+  }
+  const { method, id } = request;
+  const requestKind = statementRequestKind(method);
+  if (requestKind === null) {
+    return;
+  }
+  if (id === undefined || id === null) {
+    return;
+  }
+  const requestId = String(id);
+  debugRequests.set(requestId, { method, requestKind });
+  emitSsoStatementStoreRequest({
+    method,
+    requestId,
+    requestKind,
+  });
+}
+
+function emitStatementStoreResponse(
+  response: string,
+  debugRequests: Map<string, StatementStoreDebugRequest>,
+): void {
+  if (!hasDotliDebugListeners()) {
+    return;
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(response);
+  } catch {
+    return;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return;
+  }
+  const record = parsed as Record<string, unknown>;
+  const responseId = jsonRpcId(record.id);
+  if (responseId !== null) {
+    const request = debugRequests.get(responseId);
+    if (request === undefined) {
+      return;
+    }
+    debugRequests.delete(responseId);
+    const error = errorMessage(record.error);
+    emitSsoStatementStoreResponse({
+      method: request.method,
+      requestId: responseId,
+      requestKind: request.requestKind,
+      frameKind: error === undefined ? "ack" : "error",
+      ...(typeof record.result === "string"
+        ? { remoteSubscriptionId: record.result }
+        : {}),
+      ...(error !== undefined ? { error } : {}),
+    });
+    return;
+  }
+
+  if (record.method !== STATEMENT_SUBSCRIBE_METHOD) {
+    return;
+  }
+  const params =
+    typeof record.params === "object" && record.params !== null
+      ? (record.params as Record<string, unknown>)
+      : null;
+  const result =
+    typeof params?.result === "object" && params.result !== null
+      ? (params.result as Record<string, unknown>)
+      : null;
+  const data =
+    typeof result?.data === "object" && result.data !== null
+      ? (result.data as Record<string, unknown>)
+      : null;
+  const statements = Array.isArray(data?.statements) ? data.statements : [];
+  emitSsoStatementStoreResponse({
+    method: STATEMENT_SUBSCRIBE_METHOD,
+    requestKind: "page",
+    frameKind: result === null ? "malformed-page" : "page",
+    ...(typeof params?.subscription === "string"
+      ? { remoteSubscriptionId: params.subscription }
+      : {}),
+    ...(typeof result?.event === "string" ? { eventName: result.event } : {}),
+    statementCount: statements.length,
+    ...(typeof data?.remaining === "number"
+      ? { remaining: data.remaining }
+      : {}),
+  });
+}
+
+function statementRequestKind(method: string): string | null {
+  switch (method) {
+    case STATEMENT_SUBMIT_METHOD:
+      return "submit";
+    case STATEMENT_SUBSCRIBE_METHOD:
+      return "subscribe";
+    case STATEMENT_UNSUBSCRIBE_METHOD:
+      return "unsubscribe";
+    default:
+      return null;
+  }
+}
+
+function jsonRpcId(value: unknown): string | null {
+  if (typeof value === "string" || typeof value === "number") {
+    return String(value);
+  }
+  return null;
+}
+
+function errorMessage(error: unknown): string | undefined {
+  if (typeof error !== "object" || error === null) {
+    return undefined;
+  }
+  const message = (error as Record<string, unknown>).message;
+  return typeof message === "string" ? message : JSON.stringify(error);
+}
+
+export function createChainConnect(): HostCallbacks["connect"] {
+  return (genesisHashBytes) => {
+    const genesisHash = bytesToHex(genesisHashBytes);
+    const backend = backendForChain(genesisHash);
+    emitSsoStatementStoreConnecting({ backend, genesisHash });
+    if (backend === "rpc-gateway") {
+      if (!isRpcChainSupported(genesisHash)) {
+        log.warn(
+          `[dot.li truapi-chain] RPC backend doesn't support ${genesisHash}; product call will fail`,
+        );
+        emitSsoStatementStoreConnectFailed({
+          backend,
+          genesisHash,
+          reason: `Unsupported RPC chain: ${genesisHash}`,
+        });
+        throw new Error(`Unsupported RPC chain: ${genesisHash}`);
+      }
+      const connection = toConnection(createRpcChainProvider(genesisHash));
+      emitSsoStatementStoreConnected({ backend, genesisHash });
+      return Promise.resolve(connection);
+    }
+
+    if (!isSmoldotChainSupported(genesisHash)) {
+      log.warn(
+        `[dot.li truapi-chain] smoldot backend doesn't support ${genesisHash}; product call will fail`,
+      );
+      emitSsoStatementStoreConnectFailed({
+        backend,
+        genesisHash,
+        reason: `Unsupported smoldot chain: ${genesisHash}`,
+      });
+      throw new Error(`Unsupported smoldot chain: ${genesisHash}`);
+    }
+    try {
+      const connection = toConnection(createSmoldotChainProvider(genesisHash));
+      emitSsoStatementStoreConnected({ backend, genesisHash });
+      return Promise.resolve(connection);
+    } catch (error) {
+      emitSsoStatementStoreConnectFailed({
+        backend,
+        genesisHash,
+        reason: error instanceof Error ? error.message : String(error),
+      });
+      throw error;
+    }
+  };
+}
+
+function backendForChain(genesisHash: string): ReturnType<typeof getBackend> {
+  const backend = getBackend();
+  const peopleGenesis = getActiveServicesConfig().people.genesis.toLowerCase();
+  if (
+    !SS_USE_SMOLDOT &&
+    genesisHash.toLowerCase() === peopleGenesis &&
+    isRpcChainSupported(genesisHash)
+  ) {
+    return "rpc-gateway";
+  }
+  return backend;
+}
diff --git a/packages/ui/src/host-callbacks/FeatureSupported.ts b/packages/ui/src/host-callbacks/FeatureSupported.ts
new file mode 100644
index 0000000..d992944
--- /dev/null
+++ b/packages/ui/src/host-callbacks/FeatureSupported.ts
@@ -0,0 +1,14 @@
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { getBackend } from "@dotli/config/mode";
+import { isChainSupported as isSmoldotChainSupported } from "@dotli/resolver/chains";
+import { isRpcChainSupported } from "@dotli/resolver/rpc-chain";
+
+export function createFeatureSupported(): HostCallbacks["featureSupported"] {
+  return (request) => {
+    const supported =
+      getBackend() === "rpc-gateway"
+        ? isRpcChainSupported(request.value.genesisHash)
+        : isSmoldotChainSupported(request.value.genesisHash);
+    return Promise.resolve({ supported });
+  };
+}
diff --git a/packages/ui/src/host-callbacks/LocalStorage.ts b/packages/ui/src/host-callbacks/LocalStorage.ts
new file mode 100644
index 0000000..d93a9d1
--- /dev/null
+++ b/packages/ui/src/host-callbacks/LocalStorage.ts
@@ -0,0 +1,59 @@
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { base64 } from "@scure/base";
+
+const SSO_DEVICE_IDENTITY_KEY = "truapi:sso-device-identity:v1";
+
+export function createLocalStorageRead(): HostCallbacks["read"] {
+  return (key) => {
+    try {
+      const raw = localStorage.getItem(storageKey(key));
+      if (raw === null) {
+        return Promise.resolve(undefined);
+      }
+      return Promise.resolve(base64.decode(raw));
+    } catch (cause) {
+      return Promise.reject(
+        new Error("Failed to read from storage", { cause }),
+      );
+    }
+  };
+}
+
+export function createLocalStorageWrite(): HostCallbacks["write"] {
+  return (key, value) => {
+    try {
+      localStorage.setItem(storageKey(key), base64.encode(value));
+      return Promise.resolve();
+    } catch (cause) {
+      return Promise.reject(new Error("Failed to write to storage", { cause }));
+    }
+  };
+}
+
+export function createLocalStorageClear(): HostCallbacks["clear"] {
+  return (key) => {
+    try {
+      if (key === SSO_DEVICE_IDENTITY_KEY) {
+        clearSsoDeviceIdentities();
+      }
+      localStorage.removeItem(storageKey(key));
+      return Promise.resolve();
+    } catch (cause) {
+      return Promise.reject(new Error("Failed to clear storage", { cause }));
+    }
+  };
+}
+
+function storageKey(key: string): string {
+  return `dotli:${key}`;
+}
+
+function clearSsoDeviceIdentities(): void {
+  const suffix = `:${SSO_DEVICE_IDENTITY_KEY}`;
+  for (let index = localStorage.length - 1; index >= 0; index -= 1) {
+    const itemKey = localStorage.key(index);
+    if (itemKey?.startsWith("dotli:") === true && itemKey.endsWith(suffix)) {
+      localStorage.removeItem(itemKey);
+    }
+  }
+}
diff --git a/packages/ui/src/host-callbacks/OpenUrl.ts b/packages/ui/src/host-callbacks/OpenUrl.ts
new file mode 100644
index 0000000..f455015
--- /dev/null
+++ b/packages/ui/src/host-callbacks/OpenUrl.ts
@@ -0,0 +1,53 @@
+// Navigation callback. The Rust core pre-normalizes URLs, but dotli still
+// needs to classify the result so `.dot` domains land on the right host
+// subdomain and localhost products wrap into the configured host origin.
+
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { isLocalhost, BASE_DOMAIN } from "@dotli/config/config";
+import { dotNsUrl } from "@dotli/shared/dotns-url";
+
+function identifierToLabel(identifier: string): string {
+  return identifier.slice(0, -".dot".length);
+}
+
+function buildDotTargetUrl(label: string, pathname: string): string {
+  const suffix = pathname ? "/" + pathname : "";
+  if (isLocalhost) {
+    return `http://${label}.localhost:${window.location.port}${suffix}`;
+  }
+  return `${window.location.protocol}//${label}.${BASE_DOMAIN}${suffix}`;
+}
+
+function getHostOrigin(): string {
+  if (isLocalhost) {
+    return `http://localhost:${window.location.port}`;
+  }
+  return `${window.location.protocol}//${BASE_DOMAIN}`;
+}
+
+export function createNavigateTo(): HostCallbacks["navigateTo"] {
+  return (url) => {
+    const dotUrl = dotNsUrl.parseDotNsDomain(url);
+
+    if (dotUrl && dotNsUrl.isDotDomain(dotUrl.identifier)) {
+      window.open(
+        buildDotTargetUrl(
+          identifierToLabel(dotUrl.identifier),
+          dotUrl.pathname,
+        ),
+        "_blank",
+      );
+      return Promise.resolve(undefined);
+    }
+
+    const localhostUrl = dotNsUrl.parseLocalhostUrl(url);
+    if (localhostUrl) {
+      const suffix = localhostUrl.pathname ? "/" + localhostUrl.pathname : "";
+      window.open(`${getHostOrigin()}/${localhostUrl.host}${suffix}`, "_blank");
+      return Promise.resolve(undefined);
+    }
+
+    window.open(url, "_blank");
+    return Promise.resolve(undefined);
+  };
+}
diff --git a/packages/ui/src/host-callbacks/Preimage.ts b/packages/ui/src/host-callbacks/Preimage.ts
new file mode 100644
index 0000000..61a8e90
--- /dev/null
+++ b/packages/ui/src/host-callbacks/Preimage.ts
@@ -0,0 +1,122 @@
+// Preimage lookup adapter — polls the user-selected content backend
+// (Helia P2P or IPFS gateway) until the preimage is found or the
+// subscription is dropped.
+
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { computePreimageKey, hashToCid } from "@dotli/content/preimage";
+import { fetchFromIpfs } from "@dotli/content/ipfs";
+import { getBackend } from "@dotli/config/mode";
+import { submitPreimageRemote } from "@dotli/protocol/client";
+import { log } from "@dotli/shared/log";
+import { bitswapGet } from "../bulletin-bitswap";
+import { fromHex, toHex } from "@dotli/shared/hex";
+import { createResultStream } from "./result-stream";
+
+const POLL_INTERVAL_MS = 10_000;
+const INITIAL_POLL_DELAY_MS = 1000;
+const preimageCache = new Map<string, Uint8Array>();
+
+function noop(): void {
+  return;
+}
+
+function createPreimageSubmit(
+  label: string,
+): Required<HostCallbacks>["submitPreimage"] {
+  return async (value) => {
+    const key = computePreimageKey(value);
+    await submitPreimageRemote(value);
+    preimageCache.set(key, value);
+    log.warn(`[${label}] Preimage stored, key: ${key}`);
+    return fromHex(key);
+  };
+}
+
+function createPreimageLookupSubscribe(
+  label: string,
+): Required<HostCallbacks>["lookupPreimage"] {
+  return (request) => {
+    const key = toHex(request);
+    log.warn(`[${label}] Preimage lookup subscribe, key: ${key}`);
+
+    const cached = preimageCache.get(key);
+    if (cached) {
+      return createResultStream<Uint8Array | undefined>([cached], () => noop);
+    }
+
+    let stopped = false;
+    return createResultStream<Uint8Array | undefined>([undefined], (push) => {
+      let intervalId: ReturnType<typeof setInterval> | null = null;
+      let initialTimeoutId: ReturnType<typeof setTimeout> | null = null;
+      const stopPolling = (): void => {
+        stopped = true;
+        if (intervalId !== null) {
+          clearInterval(intervalId);
+          intervalId = null;
+        }
+        if (initialTimeoutId !== null) {
+          clearTimeout(initialTimeoutId);
+          initialTimeoutId = null;
+        }
+      };
+      const poll = async (): Promise<void> => {
+        if (stopped) {
+          return;
+        }
+
+        const cached = preimageCache.get(key);
+        if (cached) {
+          push(cached);
+          return;
+        }
+
+        const cid = hashToCid(key);
+        const cidString = cid.toString();
+        const backend = getBackend();
+        try {
+          if (backend !== "rpc-gateway") {
+            const data = await bitswapGet(cidString);
+            if (data.length > 0) {
+              preimageCache.set(key, data);
+              push(data);
+              stopPolling();
+              return;
+            }
+          } else {
+            const result = await fetchFromIpfs(cidString);
+            if (result.data.length > 0) {
+              preimageCache.set(key, result.data);
+              push(result.data);
+              stopPolling();
+              return;
+            }
+          }
+        } catch (err) {
+          log.warn(
+            `[${label}] preimage lookup via ${backend} failed:`,
+            err,
+          );
+        }
+      };
+
+      intervalId = setInterval(() => void poll(), POLL_INTERVAL_MS);
+      initialTimeoutId = setTimeout(
+        () => void poll(),
+        INITIAL_POLL_DELAY_MS,
+      );
+
+      return () => {
+        stopPolling();
+      };
+    });
+  };
+}
+
+export function createPreimageAdapters(
+  label: string,
+): Pick<Required<HostCallbacks>, "submitPreimage" | "lookupPreimage"> {
+  return {
+    submitPreimage: createPreimageSubmit(label),
+    lookupPreimage: createPreimageLookupSubscribe(label),
+  };
+}
diff --git a/packages/ui/src/host-callbacks/PromptPermission.ts b/packages/ui/src/host-callbacks/PromptPermission.ts
new file mode 100644
index 0000000..eb4e5e1
--- /dev/null
+++ b/packages/ui/src/host-callbacks/PromptPermission.ts
@@ -0,0 +1,129 @@
+// Permission prompt. The Rust core awaits the typed response before encoding
+// the product reply, so a slow modal blocks the product just as long as the
+// user takes to dismiss it. Device grants also schedule an iframe reload so
+// the browser sees the refreshed Permissions Policy `allow` attribute.
+
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import type { RemotePermission } from "@parity/truapi";
+import {
+  getPermissionStatus,
+  isEnforceableDevicePermission,
+  setPermissionStatus,
+  type EnforceablePermissionName,
+} from "../permissions";
+import { showPermissionRequestModal } from "../permission-modal";
+import { showNotification } from "../notification";
+import { createSubmitRateLimiter } from "./rate-limit";
+
+// Remote tags that don't reach a host enforcement point: WebRtc is gated
+// by the iframe `allow` attribute, and `Remote` (HTTP/WS) can't be
+// reliably intercepted from inside the sandbox. Auto-grant either.
+function gatedRemotePermissionName(
+  tag: RemotePermission["tag"],
+): EnforceablePermissionName | null {
+  switch (tag) {
+    case "ChainSubmit":
+    case "PreimageSubmit":
+    case "StatementSubmit":
+      return tag;
+    case "Remote":
+    case "WebRtc":
+      return null;
+  }
+}
+
+export function createPromptPermission(
+  label: string,
+): Pick<HostCallbacks, "devicePermission" | "remotePermission"> {
+  const limiter = createSubmitRateLimiter();
+  const devicePermission: HostCallbacks["devicePermission"] = async (tag) => {
+    // OpenUrl has no host-side enforcement point; auto-grant rather than show
+    // a modal whose deny button cannot block the underlying browser API.
+    if (!isEnforceableDevicePermission(tag)) {
+      return { granted: true };
+    }
+    return {
+      granted: await decidePromptPermission(label, tag, {
+        kind: "Device",
+        limiter,
+        reloadOnGrant: true,
+      }),
+    };
+  };
+
+  const remotePermission: HostCallbacks["remotePermission"] = async (
+    request,
+  ) => {
+    const name = gatedRemotePermissionName(request.permission.tag);
+    if (name === null) {
+      return { granted: true };
+    }
+    return {
+      granted: await decidePromptPermission(label, name, {
+        kind: "Remote",
+        limiter,
+      }),
+    };
+  };
+
+  return { devicePermission, remotePermission };
+}
+
+export async function decidePromptPermission(
+  label: string,
+  name: EnforceablePermissionName,
+  options: {
+    kind: "Device" | "Remote";
+    limiter: { allow: () => boolean };
+    reloadOnGrant?: boolean;
+  },
+): Promise<boolean> {
+  const { kind, limiter, reloadOnGrant = false } = options;
+  const status = await getPermissionStatus(label, name);
+  if (status === "granted") {
+    return true;
+  }
+  if (status === "denied") {
+    showNotification({
+      label: `${label}.dot`,
+      text:
+        kind === "Device"
+          ? `${name} access is blocked. Use the permissions menu in the top bar to change this.`
+          : "Transaction signing is blocked. Use the permissions menu in the top bar to change this.",
+      dismissMs: 6000,
+      browserNotification: false,
+    });
+    return false;
+  }
+  // status === "ask": show the modal and wait for the user.
+  if (!limiter.allow()) {
+    return false;
+  }
+  try {
+    await showPermissionRequestModal(label, name);
+  } catch {
+    await setPermissionStatus(label, name, "denied");
+    return false;
+  }
+  await setPermissionStatus(label, name, "granted");
+  if (kind === "Device" && reloadOnGrant) {
+    // Device permissions are also gated by the iframe `allow` attribute,
+    // which is fixed at iframe load time. Reload so the next attempt sees
+    // the updated attribute. Defer to the next tick so the prompt response
+    // can flush before the iframe is disposed.
+    setTimeout(() => {
+      window.dispatchEvent(
+        new CustomEvent("dotli:device-permission-changed", {
+          detail: { label, permission: name },
+        }),
+      );
+    }, 0);
+    return true;
+  }
+  // Remote permissions have no browser-level gate, so we can return the
+  // actual grant. The event keeps the topbar in sync.
+  window.dispatchEvent(
+    new CustomEvent("dotli:permission-changed", { detail: { label } }),
+  );
+  return true;
+}
diff --git a/packages/ui/src/host-callbacks/PushNotification.ts b/packages/ui/src/host-callbacks/PushNotification.ts
new file mode 100644
index 0000000..407b7f0
--- /dev/null
+++ b/packages/ui/src/host-callbacks/PushNotification.ts
@@ -0,0 +1,61 @@
+// Push-notification callback. The Rust core passes the typed request, and
+// this adapter returns a stable host-side id for cancel support.
+
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { log } from "@dotli/shared/log";
+import {
+  cancelNotification,
+  scheduleNotification,
+} from "../scheduled-notifications";
+import { showNotification } from "../notification";
+import { decidePromptPermission } from "./PromptPermission";
+import { createSubmitRateLimiter } from "./rate-limit";
+
+export function createNotificationAdapters(
+  label: string,
+): Pick<Required<HostCallbacks>, "pushNotification" | "cancelNotification"> {
+  const limiter = createSubmitRateLimiter();
+  const pushNotification: Required<HostCallbacks>["pushNotification"] = async ({
+    text,
+    deeplink,
+    scheduledAt,
+  }) => {
+    log.warn(`[${label}] Push notification:`, {
+      text,
+      deeplink,
+      scheduledAt,
+    });
+
+    const granted = await decidePromptPermission(label, "Notifications", {
+      kind: "Device",
+      limiter,
+    });
+    if (!granted) {
+      throw new Error("Notifications permission denied");
+    }
+
+    const result = await scheduleNotification({
+      productId: label,
+      title: label,
+      text,
+      deeplink: deeplink ?? null,
+      scheduledAt: scheduledAt === undefined ? null : Number(scheduledAt),
+    });
+    if (!result.ok) {
+      throw new Error("ScheduleLimitReached");
+    }
+
+    if (result.immediate) {
+      showNotification({ text, deeplink, label });
+    }
+    return { id: result.id };
+  };
+
+  const cancelPushNotification: Required<
+    HostCallbacks
+  >["cancelNotification"] = async (id) => {
+    await cancelNotification(label, id);
+  };
+
+  return { pushNotification, cancelNotification: cancelPushNotification };
+}
diff --git a/packages/ui/src/host-callbacks/SessionStore.ts b/packages/ui/src/host-callbacks/SessionStore.ts
new file mode 100644
index 0000000..c59f09b
--- /dev/null
+++ b/packages/ui/src/host-callbacks/SessionStore.ts
@@ -0,0 +1,222 @@
+import { SITE_ID } from "@dotli/config/config";
+import { bytesToHex, hexToBytes } from "@parity/truapi/scale";
+import { encodeCoreStorageKey } from "@parity/truapi-host-wasm";
+import type {
+  CoreStorageKey,
+  HostCallbacks,
+  SessionUiInfo,
+} from "@parity/truapi-host-wasm";
+import {
+  hasStoredSharedAuthSession,
+  SHARED_CORE_SESSION_KEY,
+} from "@dotli/protocol/auth-storage";
+import {
+  clearSharedAuthStorage,
+  readSharedAuthStorage,
+  subscribeSharedAuthStorage,
+  writeSharedAuthStorage,
+} from "@dotli/protocol/client";
+import { log } from "@dotli/shared/log";
+import { dispatchAuthState } from "./AuthState";
+
+const LOCAL_CHANGE_EVENT = "dotli:truapi-session-store-changed";
+const CORE_LOCAL_STORAGE_PREFIX = "dotli:core:";
+
+// JSON cache of the last connected UI state the core reported via
+// `authStateChanged`. Lives in shared auth storage next to the opaque
+// root-domain session blob so boot-time rehydration never has to decode the
+// blob itself.
+const UI_STATE_CACHE_KEY = `${SHARED_CORE_SESSION_KEY}:ui-state`;
+
+function emitLocalChange(): void {
+  window.dispatchEvent(new Event(LOCAL_CHANGE_EVENT));
+}
+
+export interface TruapiSessionUiState {
+  connected: boolean;
+  publicKey?: string;
+  identityAccountId?: string;
+  liteUsername?: string;
+  fullUsername?: string;
+  primaryUsername?: string;
+}
+
+/** Convert the core's decoded session fields into the rendering-friendly
+ * shape (hex-encoded keys) the topbar and UI-state cache use. */
+export function toSessionUiState(info: SessionUiInfo): TruapiSessionUiState {
+  const primaryUsername = info.fullUsername ?? info.liteUsername;
+  return {
+    connected: true,
+    publicKey: bytesToHex(info.publicKey),
+    ...(info.identityAccountId !== undefined
+      ? { identityAccountId: bytesToHex(info.identityAccountId) }
+      : {}),
+    ...(info.liteUsername !== undefined
+      ? { liteUsername: info.liteUsername }
+      : {}),
+    ...(info.fullUsername !== undefined
+      ? { fullUsername: info.fullUsername }
+      : {}),
+    ...(primaryUsername !== undefined ? { primaryUsername } : {}),
+  };
+}
+
+/** Persist (or clear, when disconnected) the boot-rehydration UI-state
+ * cache next to the opaque session blob. Best-effort. */
+export async function writeUiStateCache(
+  detail: TruapiSessionUiState,
+): Promise<void> {
+  try {
+    if (detail.connected) {
+      await writeSharedAuthStorage(
+        SITE_ID,
+        UI_STATE_CACHE_KEY,
+        JSON.stringify(detail),
+      );
+    } else {
+      await clearSharedAuthStorage(SITE_ID, UI_STATE_CACHE_KEY);
+    }
+  } catch (err) {
+    log.warn("[dot.li] session UI cache write failed:", err);
+  }
+}
+
+async function readUiStateCache(): Promise<TruapiSessionUiState | null> {
+  try {
+    const raw = await readSharedAuthStorage(SITE_ID, UI_STATE_CACHE_KEY);
+    if (raw === null) {
+      return null;
+    }
+    const parsed: unknown = JSON.parse(raw);
+    if (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      (parsed as TruapiSessionUiState).connected
+    ) {
+      return parsed as TruapiSessionUiState;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Re-emit the cached UI state for the persisted same-origin session, if any.
+ * Used at boot so a reload shows the logged-in badge before any core
+ * instance runs. Only emits when a persisted session blob actually exists;
+ * without a cached state it degrades to a bare `connected: true`.
+ */
+export function emitPersistedSessionUiState(): void {
+  void (async () => {
+    let raw: string | null;
+    try {
+      raw = await readSharedAuthStorage(SITE_ID, SHARED_CORE_SESSION_KEY);
+    } catch {
+      return;
+    }
+    if (raw === null || !hasStoredSharedAuthSession(raw)) {
+      return;
+    }
+    dispatchAuthState({
+      tag: "Connected",
+      session: (await readUiStateCache()) ?? { connected: true },
+    });
+  })();
+}
+
+export function createSessionStoreAdapters(): Pick<
+  HostCallbacks,
+  "readCoreStorage" | "writeCoreStorage" | "clearCoreStorage"
+> {
+  return {
+    async readCoreStorage(key) {
+      return readCoreStorageValue(key);
+    },
+    async writeCoreStorage(key, value) {
+      await writeCoreStorageValue(key, value);
+    },
+    async clearCoreStorage(key) {
+      await clearCoreStorageValue(key);
+    },
+  };
+}
+
+async function readCoreStorageValue(
+  key: CoreStorageKey,
+): Promise<Uint8Array | undefined> {
+  if (key.tag === "AuthSession") {
+    let raw: string | null;
+    try {
+      raw = await readSharedAuthStorage(SITE_ID, SHARED_CORE_SESSION_KEY);
+    } catch (err) {
+      log.warn("[dot.li] shared auth session read failed:", err);
+      return undefined;
+    }
+    if (raw === null || raw === "") {
+      return undefined;
+    }
+    return hexToBytes(raw);
+  }
+  const raw = localStorage.getItem(coreLocalStorageKey(key));
+  return raw === null ? undefined : hexToBytes(raw);
+}
+
+async function writeCoreStorageValue(
+  key: CoreStorageKey,
+  value: Uint8Array,
+): Promise<void> {
+  if (key.tag === "AuthSession") {
+    await writeSharedAuthStorage(
+      SITE_ID,
+      SHARED_CORE_SESSION_KEY,
+      bytesToHex(value),
+    );
+    emitLocalChange();
+    return;
+  }
+  localStorage.setItem(coreLocalStorageKey(key), bytesToHex(value));
+}
+
+async function clearCoreStorageValue(key: CoreStorageKey): Promise<void> {
+  if (key.tag === "AuthSession") {
+    await clearSharedAuthStorage(SITE_ID, SHARED_CORE_SESSION_KEY);
+    await writeUiStateCache({ connected: false });
+    emitLocalChange();
+    return;
+  }
+  localStorage.removeItem(coreLocalStorageKey(key));
+}
+
+function coreLocalStorageKey(key: CoreStorageKey): string {
+  switch (key.tag) {
+    case "PairingDeviceIdentity":
+      return `${CORE_LOCAL_STORAGE_PREFIX}pairing-device-identity`;
+    case "PermissionAuthorization":
+      return `${CORE_LOCAL_STORAGE_PREFIX}permission:${hexNoPrefix(
+        encodeCoreStorageKey(key),
+      )}`;
+    case "AuthSession":
+      return `${CORE_LOCAL_STORAGE_PREFIX}auth-session`;
+  }
+}
+
+function hexNoPrefix(bytes: Uint8Array): string {
+  return bytesToHex(bytes).slice(2);
+}
+
+export function onStoredSessionChanged(listener: () => void): () => void {
+  const onLocalChange = (): void => {
+    listener();
+  };
+  window.addEventListener(LOCAL_CHANGE_EVENT, onLocalChange);
+  const unsubscribeShared = subscribeSharedAuthStorage((change) => {
+    if (change.siteId === SITE_ID && change.key === SHARED_CORE_SESSION_KEY) {
+      listener();
+    }
+  });
+  return () => {
+    window.removeEventListener(LOCAL_CHANGE_EVENT, onLocalChange);
+    unsubscribeShared();
+  };
+}
diff --git a/packages/ui/src/host-callbacks/SsoDebug.ts b/packages/ui/src/host-callbacks/SsoDebug.ts
new file mode 100644
index 0000000..0a2ac66
--- /dev/null
+++ b/packages/ui/src/host-callbacks/SsoDebug.ts
@@ -0,0 +1,156 @@
+import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
+
+let activeSsoFlowId: string | null = null;
+
+function newFlowId(prefix: string): string {
+  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+    return crypto.randomUUID();
+  }
+  return `${prefix}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`;
+}
+
+function deeplinkScheme(deeplink: string): string {
+  try {
+    return new URL(deeplink).protocol.replace(/:$/, "");
+  } catch {
+    return "unknown";
+  }
+}
+
+function activeFlowId(): string {
+  return activeSsoFlowId ?? newFlowId("sso");
+}
+
+export function emitSsoStatementStoreConnecting(args: {
+  backend: string;
+  genesisHash: string;
+}): void {
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "statement_store_connecting",
+    flowId: activeFlowId(),
+    timestamp: Date.now(),
+    payload: args,
+  });
+}
+
+export function emitSsoStatementStoreConnected(args: {
+  backend: string;
+  genesisHash: string;
+}): void {
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "statement_store_connected",
+    flowId: activeFlowId(),
+    timestamp: Date.now(),
+    payload: args,
+  });
+}
+
+export function emitSsoStatementStoreConnectFailed(args: {
+  backend: string;
+  genesisHash: string;
+  reason: string;
+}): void {
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "statement_store_connect_failed",
+    flowId: activeFlowId(),
+    timestamp: Date.now(),
+    payload: args,
+  });
+}
+
+export function emitSsoStatementStoreRequest(args: {
+  method: string;
+  requestId: string;
+  requestKind: string;
+}): void {
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "statement_store_request",
+    flowId: activeFlowId(),
+    timestamp: Date.now(),
+    payload: args,
+  });
+}
+
+export function emitSsoStatementStoreResponse(args: {
+  method: string;
+  requestId?: string;
+  requestKind: string;
+  remoteSubscriptionId?: string;
+  frameKind?: string;
+  eventName?: string;
+  statementCount?: number;
+  remaining?: number;
+  error?: string;
+}): void {
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "statement_store_response",
+    flowId: activeFlowId(),
+    timestamp: Date.now(),
+    payload: args,
+  });
+}
+
+export function emitSsoPairingPresented(args: {
+  label: string;
+  deeplink: string;
+}): string {
+  const flowId = newFlowId("sso");
+  activeSsoFlowId = flowId;
+  const timestamp = Date.now();
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "pairing_started",
+    flowId,
+    timestamp,
+    payload: { label: args.label },
+  });
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "deeplink_generated",
+    flowId,
+    timestamp: Date.now(),
+    payload: {
+      label: args.label,
+      scheme: deeplinkScheme(args.deeplink),
+    },
+  });
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "awaiting_response",
+    flowId,
+    timestamp: Date.now(),
+    payload: { label: args.label },
+  });
+  return flowId;
+}
+
+export function emitSsoSessionEstablished(
+  result: "Success" | "AlreadyConnected",
+): void {
+  const flowId = activeSsoFlowId ?? newFlowId("sso");
+  activeSsoFlowId = null;
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "session_established",
+    flowId,
+    timestamp: Date.now(),
+    payload: { result },
+  });
+}
+
+export function emitSsoPairingFailed(reason: string): void {
+  const flowId = activeSsoFlowId ?? newFlowId("sso");
+  activeSsoFlowId = null;
+  emitDotliDebugEvent({
+    layer: "sso",
+    event: "pairing_failed",
+    flowId,
+    timestamp: Date.now(),
+    payload: { reason },
+  });
+}
diff --git a/packages/ui/src/host-callbacks/Theme.ts b/packages/ui/src/host-callbacks/Theme.ts
new file mode 100644
index 0000000..b4bb2a9
--- /dev/null
+++ b/packages/ui/src/host-callbacks/Theme.ts
@@ -0,0 +1,24 @@
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import type { ThemeVariant } from "@parity/truapi";
+import { createResultStream } from "./result-stream";
+
+function currentTheme(): ThemeVariant {
+  return document.documentElement.getAttribute("data-theme") === "light"
+    ? "Light"
+    : "Dark";
+}
+
+export function createThemeSubscribe(): Required<
+  HostCallbacks
+>["subscribeTheme"] {
+  return () =>
+    createResultStream<ThemeVariant>([currentTheme()], (push) => {
+      const onThemeChanged = (): void => {
+        push(currentTheme());
+      };
+      window.addEventListener("dotli:theme-changed", onThemeChanged);
+      return () => {
+        window.removeEventListener("dotli:theme-changed", onThemeChanged);
+      };
+    });
+}
diff --git a/packages/ui/src/host-callbacks/UserConfirmation.ts b/packages/ui/src/host-callbacks/UserConfirmation.ts
new file mode 100644
index 0000000..416530e
--- /dev/null
+++ b/packages/ui/src/host-callbacks/UserConfirmation.ts
@@ -0,0 +1,335 @@
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { showPreimageSubmitModal } from "../preimage-modal";
+
+interface ConfirmationCopy {
+  title: string;
+  action: string;
+  cancelAction?: string;
+}
+
+interface ConfirmationField {
+  label: string;
+  value: string;
+  mono?: boolean;
+}
+
+type UserConfirmationReview = Parameters<
+  Required<HostCallbacks>["confirmUserAction"]
+>[0];
+
+function showConfirmationModal(
+  label: string,
+  copy: ConfirmationCopy,
+  review: UserConfirmationReview,
+): Promise<boolean> {
+  return new Promise((resolve) => {
+    const display = confirmationDisplay(label, review);
+    const backdrop = document.createElement("div");
+    backdrop.className = "signing-modal-backdrop";
+
+    const modal = document.createElement("div");
+    modal.className = "signing-modal";
+
+    const heading = document.createElement("h2");
+    heading.textContent = copy.title;
+    modal.appendChild(heading);
+
+    const fields = document.createElement("div");
+    fields.className = "signing-fields";
+
+    for (const field of display.fields) {
+      fields.appendChild(createField(field));
+    }
+
+    modal.appendChild(fields);
+
+    const footer = document.createElement("div");
+    footer.className = "signing-modal-footer";
+
+    const cancelBtn = document.createElement("button");
+    cancelBtn.className = "signing-btn-cancel";
+    cancelBtn.textContent = copy.cancelAction ?? "Cancel";
+    footer.appendChild(cancelBtn);
+
+    const allowBtn = document.createElement("button");
+    allowBtn.className = "signing-btn-sign";
+    allowBtn.textContent = copy.action;
+    footer.appendChild(allowBtn);
+
+    modal.appendChild(footer);
+    backdrop.appendChild(modal);
+    document.body.appendChild(backdrop);
+
+    const cleanup = (): void => {
+      backdrop.remove();
+    };
+    const finish = (accepted: boolean): void => {
+      cleanup();
+      resolve(accepted);
+    };
+
+    cancelBtn.addEventListener("click", () => {
+      finish(false);
+    });
+    allowBtn.addEventListener("click", () => {
+      finish(true);
+    });
+    backdrop.addEventListener("click", (e) => {
+      if (e.target === backdrop) {
+        finish(false);
+      }
+    });
+  });
+}
+
+function createField(field: ConfirmationField): HTMLDivElement {
+  const group = document.createElement("div");
+  group.className = "signing-field";
+
+  const label = document.createElement("div");
+  label.className = "signing-field-label";
+  label.textContent = field.label;
+  group.appendChild(label);
+
+  const value = document.createElement("div");
+  value.className = "signing-field-value";
+  if (field.mono === true) {
+    value.classList.add("mono");
+  }
+  value.textContent = field.value;
+  group.appendChild(value);
+
+  return group;
+}
+
+function formatReview(review: unknown): string {
+  return JSON.stringify(
+    review,
+    (_key: string, value: unknown): unknown => {
+      if (typeof value === "bigint") {
+        return value.toString();
+      }
+      if (value instanceof Uint8Array) {
+        return `0x${Array.from(value, (byte) =>
+          byte.toString(16).padStart(2, "0"),
+        ).join("")}`;
+      }
+      return value;
+    },
+    2,
+  );
+}
+
+function confirmationDisplay(
+  label: string,
+  review: UserConfirmationReview,
+): { fields: ConfirmationField[] } {
+  if (review.tag === "SignPayload") {
+    return { fields: createSignPayloadFields(label, review.value) };
+  }
+  if (review.tag === "SignRaw") {
+    return { fields: createSignRawFields(label, review.value) };
+  }
+  if (review.tag === "CreateTransaction") {
+    return { fields: createTransactionFields(label, review.value) };
+  }
+  if (review.tag === "AccountAlias") {
+    return { fields: createAccountAliasFields(review.value) };
+  }
+  if (review.tag === "ResourceAllocation") {
+    return { fields: createResourceAllocationFields(review.value) };
+  }
+
+  const text = formatReview(review);
+  return {
+    fields: [
+      {
+        label: "Application",
+        value: label.startsWith("localhost:") ? label : `${label}.dot`,
+      },
+      {
+        label: "Request",
+        value: text.length > 180 ? `${text.slice(0, 180)}...` : text,
+      },
+    ],
+  };
+}
+
+function truncateHex(value: string): string {
+  return value.length > 80 ? `${value.slice(0, 80)}...` : value;
+}
+
+type SignRawPayload = Extract<
+  UserConfirmationReview,
+  { tag: "SignRaw" }
+>["value"]["value"]["payload"];
+
+function formatRawPayload(payload: SignRawPayload): string {
+  return truncateHex(
+    payload.tag === "Bytes" ? payload.value.bytes : payload.value.payload,
+  );
+}
+
+function formatProductAccount(account: {
+  dotNsIdentifier: string;
+  derivationIndex: number;
+}): string {
+  return `${account.dotNsIdentifier} / ${String(account.derivationIndex)}`;
+}
+
+type SignPayloadData = Extract<
+  UserConfirmationReview,
+  { tag: "SignPayload" }
+>["value"]["value"]["payload"];
+
+function createPayloadFields(
+  app: string,
+  signer: string,
+  payload: SignPayloadData,
+): ConfirmationField[] {
+  return [
+    { label: "App", value: app },
+    { label: "Signer", value: signer },
+    { label: "Genesis Hash", value: payload.genesisHash, mono: true },
+    { label: "Call Data", value: truncateHex(payload.method), mono: true },
+    { label: "Version", value: String(payload.version) },
+  ];
+}
+
+function createSignPayloadFields(
+  label: string,
+  review: Extract<UserConfirmationReview, { tag: "SignPayload" }>["value"],
+): ConfirmationField[] {
+  if (review.tag === "Product") {
+    return createPayloadFields(
+      label,
+      formatProductAccount(review.value.account),
+      review.value.payload,
+    );
+  }
+
+  return createPayloadFields(label, review.value.signer, review.value.payload);
+}
+
+function createSignRawFields(
+  label: string,
+  review: Extract<UserConfirmationReview, { tag: "SignRaw" }>["value"],
+): ConfirmationField[] {
+  if (review.tag === "Product") {
+    return [
+      { label: "App", value: label },
+      { label: "Signer", value: formatProductAccount(review.value.account) },
+      {
+        label: "Message",
+        value: formatRawPayload(review.value.payload),
+        mono: true,
+      },
+    ];
+  }
+
+  return [
+    { label: "App", value: label },
+    { label: "Signer", value: review.value.signer },
+    {
+      label: "Message",
+      value: formatRawPayload(review.value.payload),
+      mono: true,
+    },
+  ];
+}
+
+function createTransactionFields(
+  label: string,
+  review: Extract<UserConfirmationReview, { tag: "CreateTransaction" }>["value"],
+): ConfirmationField[] {
+  const payload = review.value;
+  const signer =
+    review.tag === "Product"
+      ? formatProductAccount(review.value.signer)
+      : review.value.signer;
+
+  return [
+    { label: "App", value: label },
+    { label: "Signer", value: signer },
+    { label: "Genesis Hash", value: payload.genesisHash, mono: true },
+    { label: "Call Data", value: truncateHex(payload.callData), mono: true },
+    { label: "Tx Ext Version", value: String(payload.txExtVersion) },
+  ];
+}
+
+function createAccountAliasFields(
+  review: Extract<UserConfirmationReview, { tag: "AccountAlias" }>["value"],
+): ConfirmationField[] {
+  return [
+    { label: "Requesting product", value: review.requestingProductId },
+    { label: "Requested context", value: review.targetProductId },
+  ];
+}
+
+function formatResource(
+  resource: Extract<
+    UserConfirmationReview,
+    { tag: "ResourceAllocation" }
+  >["value"]["resources"][number],
+): string {
+  return resource.tag === "SmartContractAllowance"
+    ? `SmartContractAllowance / ${String(resource.value)}`
+    : resource.tag;
+}
+
+function createResourceAllocationFields(
+  review: Extract<
+    UserConfirmationReview,
+    { tag: "ResourceAllocation" }
+  >["value"],
+): ConfirmationField[] {
+  return [
+    {
+      label: "Resources",
+      value: review.resources.map(formatResource).join(", "),
+    },
+  ];
+}
+
+function confirmationCopy(review: UserConfirmationReview): ConfirmationCopy {
+  switch (review.tag) {
+    case "SignPayload":
+      return { title: "Sign Transaction", action: "Sign" };
+    case "SignRaw":
+      return { title: "Sign Message", action: "Sign" };
+    case "CreateTransaction":
+      return { title: "Sign Transaction", action: "Sign" };
+    case "AccountAlias":
+      return {
+        title: "Alias Permission",
+        action: "Allow",
+        cancelAction: "Deny",
+      };
+    case "ResourceAllocation":
+      return { title: "Resource Allocation", action: "Allow" };
+    case "PreimageSubmit":
+      return { title: "Submit Preimage", action: "Allow" };
+  }
+}
+
+async function handlePreimageSubmitReview(
+  review: Extract<UserConfirmationReview, { tag: "PreimageSubmit" }>,
+): Promise<boolean> {
+  try {
+    await showPreimageSubmitModal(Number(review.value.size));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function createUserConfirmationAdapters(
+  label: string,
+): Pick<Required<HostCallbacks>, "confirmUserAction"> {
+  return {
+    confirmUserAction: (review) =>
+      review.tag === "PreimageSubmit"
+        ? handlePreimageSubmitReview(review)
+        : showConfirmationModal(label, confirmationCopy(review), review),
+  };
+}
diff --git a/packages/ui/src/host-callbacks/handlers.ts b/packages/ui/src/host-callbacks/handlers.ts
new file mode 100644
index 0000000..6c62b3e
--- /dev/null
+++ b/packages/ui/src/host-callbacks/handlers.ts
@@ -0,0 +1,61 @@
+// Composes the typed host callback surface consumed by
+// `createWasmRawCallbacks`. Each callback lives in its own file so the
+// dotli-specific UI and storage behavior stays outside the Rust core.
+//
+// Scoping:
+// - `label` identifies the dApp, used in topbar notifications, permission
+//   storage keys, and sign modal titles.
+// - product storage keys are opaque; Rust core owns product namespacing.
+//
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { createNavigateTo } from "./OpenUrl";
+import { createNotificationAdapters } from "./PushNotification";
+import { createPromptPermission } from "./PromptPermission";
+import {
+  createLocalStorageRead,
+  createLocalStorageWrite,
+  createLocalStorageClear,
+} from "./LocalStorage";
+import { createPreimageAdapters } from "./Preimage";
+import { createChainConnect } from "./Chain";
+import { createFeatureSupported } from "./FeatureSupported";
+import { createThemeSubscribe } from "./Theme";
+import { createAuthStateChanged } from "./AuthState";
+import { createSessionStoreAdapters } from "./SessionStore";
+import { createUserConfirmationAdapters } from "./UserConfirmation";
+
+export interface CreateHostCallbacksOptions {
+  label: string;
+  pairingLabel?: string;
+  pairingDotSuffix?: boolean;
+  pairingHostGlobal?: boolean;
+}
+
+export function createHostCallbacks(
+  options: CreateHostCallbacksOptions,
+): Required<HostCallbacks> {
+  const {
+    label,
+    pairingLabel,
+    pairingDotSuffix,
+    pairingHostGlobal,
+  } = options;
+  return {
+    navigateTo: createNavigateTo(),
+    ...createNotificationAdapters(label),
+    ...createPromptPermission(label),
+    featureSupported: createFeatureSupported(),
+    read: createLocalStorageRead(),
+    write: createLocalStorageWrite(),
+    clear: createLocalStorageClear(),
+    authStateChanged: createAuthStateChanged(pairingLabel ?? label, {
+      dotSuffix: pairingDotSuffix,
+      hostGlobal: pairingHostGlobal,
+    }),
+    ...createSessionStoreAdapters(),
+    ...createUserConfirmationAdapters(label),
+    ...createPreimageAdapters(label),
+    subscribeTheme: createThemeSubscribe(),
+    connect: createChainConnect(),
+  };
+}
diff --git a/packages/ui/src/host-callbacks/rate-limit.ts b/packages/ui/src/host-callbacks/rate-limit.ts
new file mode 100644
index 0000000..249daaf
--- /dev/null
+++ b/packages/ui/src/host-callbacks/rate-limit.ts
@@ -0,0 +1,21 @@
+// Sliding-window rate limiter shared across host callbacks.
+
+const SUBMIT_WINDOW_MS = 10_000;
+const SUBMIT_MAX_PER_WINDOW = 20;
+
+export function createSubmitRateLimiter(): { allow: () => boolean } {
+  const timestamps: number[] = [];
+  return {
+    allow() {
+      const now = Date.now();
+      while (timestamps.length > 0 && timestamps[0] <= now - SUBMIT_WINDOW_MS) {
+        timestamps.shift();
+      }
+      if (timestamps.length >= SUBMIT_MAX_PER_WINDOW) {
+        return false;
+      }
+      timestamps.push(now);
+      return true;
+    },
+  };
+}
diff --git a/packages/ui/src/host-callbacks/result-stream.ts b/packages/ui/src/host-callbacks/result-stream.ts
new file mode 100644
index 0000000..084a81a
--- /dev/null
+++ b/packages/ui/src/host-callbacks/result-stream.ts
@@ -0,0 +1,60 @@
+import type { GenericError, Result } from "@parity/truapi";
+import { ok } from "neverthrow";
+
+export function createResultStream<T>(
+  initial: T[],
+  start: (push: (value: T) => void) => () => void,
+): AsyncIterable<Result<T, GenericError>> {
+  return {
+    [Symbol.asyncIterator](): AsyncIterator<Result<T, GenericError>> {
+      const queue = initial.map((value) => ({ value }));
+      let stopped = false;
+      let resolve:
+        | ((result: IteratorResult<Result<T, GenericError>>) => void)
+        | null = null;
+
+      const complete = (): IteratorResult<Result<T, GenericError>> => ({
+        done: true,
+        value: undefined as never,
+      });
+      const push = (value: T): void => {
+        if (stopped) {
+          return;
+        }
+        if (resolve) {
+          const send = resolve;
+          resolve = null;
+          send({ done: false, value: ok(value) });
+          return;
+        }
+        queue.push({ value });
+      };
+      const cleanup = start(push);
+
+      return {
+        next(): Promise<IteratorResult<Result<T, GenericError>>> {
+          if (stopped) {
+            return Promise.resolve(complete());
+          }
+          const item = queue.shift();
+          if (item) {
+            return Promise.resolve({ done: false, value: ok(item.value) });
+          }
+          return new Promise((r) => {
+            resolve = r;
+          });
+        },
+        return(): Promise<IteratorResult<Result<T, GenericError>>> {
+          stopped = true;
+          cleanup();
+          if (resolve) {
+            const send = resolve;
+            resolve = null;
+            send(complete());
+          }
+          return Promise.resolve(complete());
+        },
+      };
+    },
+  };
+}
diff --git a/packages/ui/src/legacy-host-bridge.ts b/packages/ui/src/legacy-host-bridge.ts
new file mode 100644
index 0000000..9d67628
--- /dev/null
+++ b/packages/ui/src/legacy-host-bridge.ts
@@ -0,0 +1,67 @@
+// DEPRECATED — legacy host-API backward-compat transport shim.
+//
+// The TrUAPI host shuttles product frames over a transferred `MessagePort`.
+// Products built on the older Nova host-api stack (the `@novasamatech` packages;
+// e.g. apps still on `@parity/product-sdk`) instead shuttle the SAME wire bytes
+// the old way: raw `Uint8Array` frames to/from `window.parent`. Only the
+// transport differs, so this is a pure byte bridge — no per-method translation,
+// no `@novasamatech/*` dependency.
+//
+// Remove this file (and the probe in `bridge.ts`) once products migrate to
+// `@parity/truapi`.
+
+import type { WireProvider } from "@parity/truapi";
+
+/**
+ * A {@link WireProvider} over `window.postMessage`, matching the legacy Nova
+ * host-api iframe transport. Pipe it into the core with `pipeProviders` exactly
+ * like the MessagePort path.
+ */
+export interface WindowMessageProvider extends WireProvider {
+  /** Replay a frame already read off the `window` (the probe's detection frame). */
+  injectInbound(message: Uint8Array): void;
+}
+
+let warned = false;
+
+export function createWindowMessageProvider(
+  targetWindow: Window,
+): WindowMessageProvider {
+  if (!warned) {
+    warned = true;
+    console.warn(
+      "[dotli] legacy host-API transport bridge active — migrate this product to @parity/truapi.",
+    );
+  }
+
+  const subscribers = new Set<(message: Uint8Array) => void>();
+  const deliver = (message: Uint8Array): void => {
+    for (const callback of subscribers) {
+      callback(message);
+    }
+  };
+  const onMessage = (event: MessageEvent): void => {
+    if (event.source === targetWindow && event.data instanceof Uint8Array) {
+      deliver(event.data);
+    }
+  };
+  window.addEventListener("message", onMessage);
+
+  return {
+    // "*" matches the credentialless product iframe (its origin reports "null").
+    postMessage(message) {
+      targetWindow.postMessage(message, "*");
+    },
+    subscribe(callback) {
+      subscribers.add(callback);
+      return () => {
+        subscribers.delete(callback);
+      };
+    },
+    injectInbound: deliver,
+    dispose() {
+      window.removeEventListener("message", onMessage);
+      subscribers.clear();
+    },
+  };
+}
diff --git a/packages/ui/src/login-request-error.ts b/packages/ui/src/login-request-error.ts
new file mode 100644
index 0000000..9b256a3
--- /dev/null
+++ b/packages/ui/src/login-request-error.ts
@@ -0,0 +1,14 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { VersionedHostRequestLoginError } from "@parity/truapi";
+
+export class LoginRequestError extends Error {
+  readonly error: VersionedHostRequestLoginError;
+
+  constructor(error: VersionedHostRequestLoginError) {
+    super(JSON.stringify(error));
+    this.name = "LoginRequestError";
+    this.error = error;
+  }
+}
diff --git a/packages/ui/src/permission-modal.ts b/packages/ui/src/permission-modal.ts
index d99f53f..dc4fb03 100644
--- a/packages/ui/src/permission-modal.ts
+++ b/packages/ui/src/permission-modal.ts
@@ -33,7 +33,6 @@ export const PERMISSION_DESCRIPTIONS: Record<
   ChainSubmit: "Sign and submit on-chain transactions on your behalf",
   PreimageSubmit: "Store preimage data on-chain via the Bulletin network",
   StatementSubmit: "Submit signed statements to the statement store",
-  GetUserId: "Reveal your dotNS username to this app",
 };
 
 const PERMISSION_ICONS: Record<EnforceablePermissionName, string> = {
@@ -87,10 +86,6 @@ const PERMISSION_ICONS: Record<EnforceablePermissionName, string> = {
     '<polyline points="14 2 14 8 20 8"/>' +
     '<line x1="8" y1="13" x2="16" y2="13"/>' +
     '<line x1="8" y1="17" x2="14" y2="17"/></svg>',
-  GetUserId:
-    '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
-    '<path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/>' +
-    '<circle cx="12" cy="7" r="4"/></svg>',
 };
 
 /**
diff --git a/packages/ui/src/permissions.ts b/packages/ui/src/permissions.ts
index 5dff44a..45e0715 100644
--- a/packages/ui/src/permissions.ts
+++ b/packages/ui/src/permissions.ts
@@ -1,26 +1,31 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-// dot.li Permission storage
+// dot.li Permission authorization
 //
-// Persists host-level permission decisions per product in localStorage.
+// Permission authorization is owned by the Rust core and persisted through
+// CoreStorage. Web dotli only maps authorized device permissions to browser
+// iframe policy directives.
 // Device permissions that map to a Permissions Policy directive also
 // gate the iframe `allow` attribute (granting or revoking reloads the
 // iframe). Variants without a directive are policy-only.
 //
 // Permission status: 'ask' (default), 'granted', or 'denied'.
 
-import type { CodecType } from "@novasamatech/host-api";
-import type { DevicePermission as DevicePermissionCodec } from "@novasamatech/host-api";
+import type { HostDevicePermissionRequest } from "@parity/truapi";
+import type {
+  PermissionAuthorizationRequest,
+  PermissionAuthorizationStatus,
+  TrUApiProductProvider,
+} from "@parity/truapi-host-wasm";
 
-export type DevicePermissionName = CodecType<typeof DevicePermissionCodec>;
+export type DevicePermissionName = HostDevicePermissionRequest;
 
 export type PermissionName =
   | DevicePermissionName
   | "ChainSubmit"
   | "PreimageSubmit"
-  | "StatementSubmit"
-  | "GetUserId";
+  | "StatementSubmit";
 
 /** Device permissions the host can't actually gate (see AUTO_GRANT_DEVICE_PERMISSIONS). */
 export type AutoGrantDevicePermission = "OpenUrl";
@@ -42,9 +47,9 @@ export type PermissionStatus = "ask" | "granted" | "denied";
 /**
  * Map from Host API device permission names to Permissions Policy directives.
  *
- * Only variants with a browser-level enforcement point are listed. Granting
- * a variant absent from this map is still recorded in localStorage but
- * does not alter the iframe `allow` attribute.
+ * Only variants with a browser-level enforcement point are listed. Authorizing
+ * a variant absent from this map is still persisted by the core but does not
+ * alter the iframe `allow` attribute.
  */
 export const DEVICE_PERMISSION_POLICY: Partial<
   Record<DevicePermissionName, string>
@@ -100,7 +105,6 @@ export const ALL_PERMISSIONS: readonly {
   { name: "ChainSubmit", label: "Sign Transactions" },
   { name: "PreimageSubmit", label: "Submit Preimages" },
   { name: "StatementSubmit", label: "Submit Statements" },
-  { name: "GetUserId", label: "Reveal Username" },
 ];
 
 /** Returns true if the permission name maps to an iframe `allow` directive. */
@@ -108,72 +112,137 @@ export function isDevicePermission(name: string): boolean {
   return name in DEVICE_PERMISSION_POLICY;
 }
 
-const STORAGE_PREFIX = "dotli:permissions:";
+type PermissionAuthorizationProvider = Pick<
+  TrUApiProductProvider,
+  "getPermissionAuthorizationStatuses" | "setPermissionAuthorizationStatus"
+>;
+
+const permissionProviders = new Map<string, PermissionAuthorizationProvider>();
 
-type StoredPermissions = Record<string, PermissionStatus>;
+export function registerPermissionAuthorizationProvider(
+  label: string,
+  provider: PermissionAuthorizationProvider,
+): () => void {
+  permissionProviders.set(label, provider);
+  return () => {
+    if (permissionProviders.get(label) === provider) {
+      permissionProviders.delete(label);
+    }
+  };
+}
 
-function storageKey(label: string): string {
-  return STORAGE_PREFIX + label;
+function providerFor(label: string): PermissionAuthorizationProvider | null {
+  return permissionProviders.get(label) ?? null;
 }
 
-function readStored(label: string): StoredPermissions {
-  try {
-    const raw = localStorage.getItem(storageKey(label));
-    if (raw === null) {
-      return {};
-    }
-    return JSON.parse(raw) as StoredPermissions;
-  } catch {
-    return {};
+function authorizationRequest(
+  permission: PermissionName,
+): PermissionAuthorizationRequest {
+  if (
+    permission === "ChainSubmit" ||
+    permission === "PreimageSubmit" ||
+    permission === "StatementSubmit"
+  ) {
+    return {
+      tag: "Remote",
+      value: { permission: { tag: permission } },
+    };
   }
+  return { tag: "Device", value: permission };
 }
 
-function writeStored(label: string, data: StoredPermissions): void {
-  localStorage.setItem(storageKey(label), JSON.stringify(data));
+function fromAuthorizationStatus(
+  status: PermissionAuthorizationStatus,
+): PermissionStatus {
+  switch (status) {
+    case "Authorized":
+      return "granted";
+    case "Denied":
+      return "denied";
+    case "NotDetermined":
+      return "ask";
+  }
 }
 
-export function getPermissionStatus(
+function toAuthorizationStatus(
+  status: PermissionStatus,
+): PermissionAuthorizationStatus {
+  switch (status) {
+    case "granted":
+      return "Authorized";
+    case "denied":
+      return "Denied";
+    case "ask":
+      return "NotDetermined";
+  }
+}
+
+export async function getPermissionStatus(
   label: string,
   permission: PermissionName,
-): PermissionStatus {
-  return readStored(label)[permission] ?? "ask";
+): Promise<PermissionStatus> {
+  const [status] = await getPermissionStatuses(label, [permission]);
+  return status;
+}
+
+export async function getPermissionStatuses(
+  label: string,
+  permissions: readonly PermissionName[],
+): Promise<PermissionStatus[]> {
+  const provider = providerFor(label);
+  if (provider === null) {
+    return permissions.map(() => "ask");
+  }
+  const statuses = await provider.getPermissionAuthorizationStatuses(
+    permissions.map(authorizationRequest),
+  );
+  return statuses.map(fromAuthorizationStatus);
 }
 
-export function setPermissionStatus(
+export async function setPermissionStatus(
   label: string,
   permission: PermissionName,
   status: PermissionStatus,
-): void {
-  const data = readStored(label);
-  data[permission] = status;
-  writeStored(label, data);
+): Promise<void> {
+  const provider = providerFor(label);
+  if (provider === null) {
+    return;
+  }
+  await provider.setPermissionAuthorizationStatus(
+    authorizationRequest(permission),
+    toAuthorizationStatus(status),
+  );
 }
 
-export function resetPermission(
+export async function resetPermission(
   label: string,
   permission: PermissionName,
-): void {
-  const data = readStored(label);
-  const { [permission]: _, ...rest } = data;
-  writeStored(label, rest);
+): Promise<void> {
+  await setPermissionStatus(label, permission, "ask");
 }
 
 /** Returns the list of device permission names that have been granted. */
-export function getGrantedDevicePermissions(
+export async function getGrantedDevicePermissions(
   label: string,
-): DevicePermissionName[] {
-  const data = readStored(label);
-  return Object.entries(data)
-    .filter(
-      ([name, status]) => status === "granted" && isDevicePermission(name),
-    )
-    .map(([name]) => name as DevicePermissionName);
+): Promise<DevicePermissionName[]> {
+  const granted: DevicePermissionName[] = [];
+  const names = Object.keys(DEVICE_PERMISSION_POLICY) as DevicePermissionName[];
+  const statuses = await getPermissionStatuses(label, names);
+  for (const [index, name] of names.entries()) {
+    if (statuses[index] === "granted") {
+      granted.push(name);
+    }
+  }
+  return granted;
 }
 
 /** Returns true if any permission (device or remote) is granted. */
-export function hasAnyGrant(label: string): boolean {
-  const data = readStored(label);
-  return Object.values(data).some((status) => status === "granted");
+export async function hasAnyGrant(label: string): Promise<boolean> {
+  const statuses = await getPermissionStatuses(
+    label,
+    ALL_PERMISSIONS.map(({ name }) => name),
+  );
+  return statuses.some((status) => status === "granted");
 }
 
 /**
@@ -181,9 +250,9 @@ export function hasAnyGrant(label: string): boolean {
  * Always includes `clipboard-write`; adds Permissions Policy directives
  * for each granted device permission.
  */
-export function buildAllowAttribute(label: string): string {
+export async function buildAllowAttribute(label: string): Promise<string> {
   const policies = ["clipboard-write"];
-  for (const name of getGrantedDevicePermissions(label)) {
+  for (const name of await getGrantedDevicePermissions(label)) {
     const directive = DEVICE_PERMISSION_POLICY[name];
     if (directive !== undefined) {
       policies.push(directive);
diff --git a/packages/ui/src/runtime-config.ts b/packages/ui/src/runtime-config.ts
new file mode 100644
index 0000000..9f34eb3
--- /dev/null
+++ b/packages/ui/src/runtime-config.ts
@@ -0,0 +1,50 @@
+import { getActiveServicesConfig } from "@dotli/config/network";
+import type { ProductRuntimeConfig } from "@parity/truapi-host-wasm";
+
+type RuntimeLocation = Pick<Location, "origin">;
+
+declare const __DOTLI_VERSION__: string | undefined;
+
+export function labelToProductId(label: string): string {
+  return label.startsWith("localhost:") ? label : `${label}.dot`;
+}
+
+function getPlatformType(userAgent: string = navigator.userAgent): string {
+  if (userAgent.includes("Win")) {
+    return "Windows";
+  }
+  if (userAgent.includes("Mac")) {
+    return "macOS";
+  }
+  if (userAgent.includes("Linux")) {
+    return "Linux";
+  }
+  return "Unknown";
+}
+
+export function createTruapiRuntimeConfig(
+  label: string,
+  location: RuntimeLocation = window.location,
+  productId: string = labelToProductId(label),
+): ProductRuntimeConfig {
+  void location;
+  return {
+    productId,
+    host: {
+      name: "Polkadot Web",
+      icon: undefined,
+      version:
+        typeof __DOTLI_VERSION__ === "string" ? __DOTLI_VERSION__ : undefined,
+    },
+    platform: {
+      type: getPlatformType(),
+      version: undefined,
+    },
+    people: {
+      genesisHash: getActiveServicesConfig().people.genesis,
+    },
+    pairing: {
+      deeplinkScheme: "polkadotapp",
+    },
+  };
+}
diff --git a/packages/ui/src/scheduled-notifications.ts b/packages/ui/src/scheduled-notifications.ts
index dd3ad93..cca11ab 100644
--- a/packages/ui/src/scheduled-notifications.ts
+++ b/packages/ui/src/scheduled-notifications.ts
@@ -7,7 +7,7 @@
  * @dotli/storage/scheduled-notifications.
  *
  * Runs in the product origin's top frame (for example acme.dot.li).
- * A guest dapp schedules via host-api 0.7, the record lands in IDB, and
+ * A guest dapp schedules via TrUAPI, the record lands in IDB, and
  * any tab on this origin fires it once it is past due.
  *
  * Two mechanisms keep sibling same-origin tabs from firing the same
@@ -108,8 +108,7 @@ export function initScheduledNotifications(opts: InitOpts): void {
 }
 
 /**
- * Schedule a notification, called by the host-api `handlePushNotification`
- * handler.
+ * Schedule a notification, called by the push-notification handler.
  *
  * An immediate fire (null or past `scheduledAt`) only bumps the counter to
  * allocate an id. Everything else is persisted to IDB.
@@ -149,8 +148,8 @@ export async function scheduleNotification(req: {
 }
 
 /**
- * Cancel a pending notification, called by the host-api
- * `handlePushNotificationCancel` handler.
+ * Cancel a pending notification, called by the push-notification cancel
+ * handler.
  *
  * Idempotent. Returns true if a pending record was removed, false if it
  * had already fired or never existed.
diff --git a/packages/ui/src/statement-store-mapping.ts b/packages/ui/src/statement-store-mapping.ts
deleted file mode 100644
index ecf77bc..0000000
--- a/packages/ui/src/statement-store-mapping.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Statement store type mapping between Host API and SDK formats.
-//
-// Host API uses SCALE codec types (PascalCase tags, Uint8Array fields).
-// SDK uses substrate-bindings types (camelCase types, hex string fields).
-// Cherry-picked from browser/src/widgets/ProductContainerBinding/integrations/statementStore.ts
-
-import {
-  type CodecType,
-  type SignedStatement as HostSignedStatement,
-  type Statement as HostStatement,
-  fromHex,
-  toHex,
-} from "@novasamatech/host-api";
-import type {
-  Proof,
-  SignedStatement,
-  Statement,
-} from "@novasamatech/sdk-statement";
-
-export function mapHostProof(
-  proof: CodecType<typeof HostSignedStatement>["proof"],
-): Proof {
-  switch (proof.tag) {
-    case "Ecdsa":
-      return {
-        type: "ecdsa",
-        value: {
-          signature: toHex(proof.value.signature),
-          signer: toHex(proof.value.signer),
-        },
-      };
-    case "Ed25519":
-      return {
-        type: "ed25519",
-        value: {
-          signature: toHex(proof.value.signature),
-          signer: toHex(proof.value.signer),
-        },
-      };
-    case "Sr25519":
-      return {
-        type: "sr25519",
-        value: {
-          signature: toHex(proof.value.signature),
-          signer: toHex(proof.value.signer),
-        },
-      };
-    case "OnChain":
-      return {
-        type: "onChain",
-        value: {
-          who: toHex(proof.value.who),
-          blockHash: toHex(proof.value.blockHash),
-          event: proof.value.event,
-        },
-      };
-  }
-}
-
-export function mapFromHostSignedStatement(
-  statement: CodecType<typeof HostSignedStatement>,
-): SignedStatement {
-  const result: SignedStatement = {
-    proof: mapHostProof(statement.proof),
-    topics: statement.topics.map(toHex),
-  };
-  if (statement.expiry !== undefined) {
-    result.expiry = statement.expiry;
-  }
-  if (statement.channel) {
-    result.channel = toHex(statement.channel);
-  }
-  if (statement.data) {
-    result.data = statement.data;
-  }
-  /* eslint-disable @typescript-eslint/no-deprecated */
-  if (statement.decryptionKey) {
-    result.decryptionKey = toHex(statement.decryptionKey);
-  }
-  /* eslint-enable @typescript-eslint/no-deprecated */
-  return result;
-}
-
-export function mapFromHostStatement(
-  statement: CodecType<typeof HostStatement>,
-): Statement {
-  // Only include fields that have values. The SDK's SCALE codec iterates
-  // object keys and crashes on `proof: undefined` (reads `proof.type`).
-  const result: Statement = {
-    topics: statement.topics.map(toHex),
-  };
-  if (statement.proof) {
-    result.proof = mapHostProof(statement.proof);
-  }
-  if (statement.expiry !== undefined) {
-    result.expiry = statement.expiry;
-  }
-  if (statement.channel) {
-    result.channel = toHex(statement.channel);
-  }
-  if (statement.data) {
-    result.data = statement.data;
-  }
-  /* eslint-disable @typescript-eslint/no-deprecated */
-  if (statement.decryptionKey) {
-    result.decryptionKey = toHex(statement.decryptionKey);
-  }
-  /* eslint-enable @typescript-eslint/no-deprecated */
-  return result;
-}
-
-export function mapSdkSignedStatement(
-  statement: SignedStatement,
-): CodecType<typeof HostSignedStatement> {
-  const result: Record<string, unknown> = {
-    proof: mapSdkProof(statement.proof),
-    topics: (statement.topics ?? []).map((t) => fromHex(t)),
-  };
-  if (statement.expiry !== undefined) {
-    result.expiry = statement.expiry;
-  }
-  if (statement.channel) {
-    result.channel = fromHex(statement.channel);
-  }
-  if (statement.data) {
-    result.data = statement.data;
-  }
-  /* eslint-disable @typescript-eslint/no-deprecated */
-  if (statement.decryptionKey) {
-    result.decryptionKey = fromHex(statement.decryptionKey);
-  }
-  /* eslint-enable @typescript-eslint/no-deprecated */
-  return result as CodecType<typeof HostSignedStatement>;
-}
-
-export function mapSdkProof(
-  proof: Proof,
-): CodecType<typeof HostSignedStatement>["proof"] {
-  switch (proof.type) {
-    case "ecdsa":
-      return {
-        tag: "Ecdsa",
-        value: {
-          signature: fromHex(proof.value.signature),
-          signer: fromHex(proof.value.signer),
-        },
-      };
-    case "ed25519":
-      return {
-        tag: "Ed25519",
-        value: {
-          signature: fromHex(proof.value.signature),
-          signer: fromHex(proof.value.signer),
-        },
-      };
-    case "sr25519":
-      return {
-        tag: "Sr25519",
-        value: {
-          signature: fromHex(proof.value.signature),
-          signer: fromHex(proof.value.signer),
-        },
-      };
-    case "onChain":
-      return {
-        tag: "OnChain",
-        value: {
-          who: fromHex(proof.value.who),
-          blockHash: fromHex(proof.value.blockHash),
-          event: proof.value.event,
-        },
-      };
-  }
-}
diff --git a/packages/ui/src/styles/topbar.css b/packages/ui/src/styles/topbar.css
index b7983c1..14c8380 100644
--- a/packages/ui/src/styles/topbar.css
+++ b/packages/ui/src/styles/topbar.css
@@ -308,6 +308,15 @@
   border-color: rgba(255, 255, 255, 0.08);
   color: #fff;
 }
+.topbar-btn:disabled {
+  cursor: default;
+  opacity: 0.45;
+}
+.topbar-btn:disabled:hover {
+  background: transparent;
+  border-color: transparent;
+  color: rgba(255, 255, 255, 0.65);
+}
 .topbar-btn:active {
   background: rgba(255, 255, 255, 0.11);
 }
diff --git a/packages/ui/src/topbar.ts b/packages/ui/src/topbar.ts
index c78dc5f..120dd63 100644
--- a/packages/ui/src/topbar.ts
+++ b/packages/ui/src/topbar.ts
@@ -6,12 +6,6 @@
 // Manages the auth button, QR pairing modal, and user popover.
 // All plain DOM manipulation, no framework.
 //
-// Auth module is lazy-loaded. The heavy host-papp, statement-store, and
-// polkadot-api WS deps only load when a persisted session exists or the
-// user clicks the auth button.
-
-import type { AuthState } from "@dotli/auth/auth";
-import type { Identity } from "@novasamatech/host-papp";
 import { log } from "@dotli/shared/log";
 import { escapeHtml } from "@dotli/shared/html";
 import { isMobileDevice } from "@dotli/shared/device";
@@ -20,10 +14,8 @@ import {
   getActiveAppManifest,
   getActiveRootManifest,
 } from "@dotli/shared/active-manifest";
-import { SITE_ID } from "@dotli/config/config";
 import {
   createRemoteChainProvider,
-  hasSharedAuthSession,
   isRemoteChainSupported,
 } from "@dotli/protocol/client";
 import {
@@ -48,13 +40,18 @@ import { getActiveServicesConfig } from "@dotli/config/network";
 import { writeSettingsToSearch } from "@dotli/config/url-settings";
 import {
   ALL_PERMISSIONS,
-  getPermissionStatus,
+  getPermissionStatuses,
   hasAnyGrant,
   isDevicePermission,
   resetPermission,
   setPermissionStatus,
   type PermissionStatus,
 } from "./permissions";
+import type { DotliAuthState } from "./host-callbacks/AuthState";
+import {
+  emitPersistedSessionUiState,
+  type TruapiSessionUiState,
+} from "./host-callbacks/SessionStore";
 
 function getElement(id: string): HTMLElement {
   const el = document.getElementById(id);
@@ -98,33 +95,7 @@ const USER_SVG = `<svg width="12" height="12" viewBox="0 0 24 24" fill="none" st
 
 // Track the current QR payload to prevent stale canvas appends
 let currentQrPayload: string | null = null;
-
-interface AuthModule {
-  initAuth: () => Promise<void>;
-  getAuthState: () => AuthState;
-  onAuthStateChange: (fn: (state: AuthState) => void) => () => void;
-  startPairing: () => void;
-  abortPairing: () => void;
-  disconnect: () => Promise<void>;
-  shortenName: (identity: Identity) => string;
-}
-
-let authMod: AuthModule | null = null;
-
-/**
- * Lazy-load and initialize the auth module. Subsequent calls return
- * the cached module immediately (initAuth is idempotent).
- */
-async function ensureAuth(): Promise<AuthModule> {
-  if (authMod) {
-    return authMod;
-  }
-  authMod = await import("@dotli/auth/auth");
-  await authMod.initAuth();
-  authMod.onAuthStateChange(renderAuthState);
-  renderAuthState(authMod.getAuthState());
-  return authMod;
-}
+let truapiSessionConnected = false;
 
 function getStoredTheme(): "light" | "dark" {
   const stored = localStorage.getItem("dotli-theme");
@@ -139,7 +110,7 @@ function getStoredTheme(): "light" | "dark" {
 
 function applyTheme(theme: "light" | "dark"): void {
   document.documentElement.setAttribute("data-theme", theme);
-  // Notify the container bridge (container.ts) to forward the new theme to the
+  // Notify the Rust bridge to forward the new theme to the
   // embedded dApp.
   window.dispatchEvent(new Event("dotli:theme-changed"));
 }
@@ -172,9 +143,12 @@ export function initTopBar(): void {
 
   // Auth button: opens modal (logged out) or popover (logged in)
   authButton.addEventListener("click", handleAuthButtonClick);
+  authButton.removeAttribute("disabled");
 
   // Modal close button
-  modalClose.addEventListener("click", closeModal);
+  modalClose.addEventListener("click", () => {
+    closeModal();
+  });
 
   // Clicking backdrop (outside modal) closes modal
   modalBackdrop.addEventListener("click", (e) => {
@@ -186,26 +160,19 @@ export function initTopBar(): void {
   // Disconnect button
   userPopoverDisconnect.addEventListener("click", handleDisconnect);
 
-  // Products can trigger the login flow via `handleRequestLogin`.
-  // `requestLogin()` in @dotli/auth dispatches this event after checking
-  // the already-connected fast path. The topbar owns the QR modal so we
-  // open it here and kick off pairing.
   window.addEventListener("dotli:request-login", (e: Event) => {
     const detail = (e as CustomEvent<{ reason?: string; label?: string }>)
       .detail;
     openModal(detail.reason, detail.label);
-    void ensureAuth().then(() => {
-      // Skip if the flow advanced between dispatch and here.
-      const state = authMod?.getAuthState();
-      if (
-        state &&
-        state.status !== "authenticated" &&
-        state.status !== "pairing" &&
-        state.status !== "attesting"
-      ) {
-        authMod?.startPairing();
-      }
-    });
+    requestTruapiLogin(detail.reason);
+  });
+
+  // Single ordered auth-state stream owned by the Rust core (plus the boot
+  // rehydration and bridge transport-failure synthetics). The modal closes
+  // only on `Connected` or explicit user action; a `Disconnected` can never
+  // tear down an in-flight pairing presentation.
+  window.addEventListener("dotli:truapi-auth-state", (e: Event) => {
+    renderAuthState((e as CustomEvent<DotliAuthState>).detail);
   });
 
   // Mobile-only "more" menu: collapses Permissions / Theme / Settings into a
@@ -300,40 +267,50 @@ export function initTopBar(): void {
   // Show default logged-out state
   renderLoggedOut();
 
-  // Probe the shared auth storage on host.dot.li. Sessions now live on the
-  // shared host origin so sibling host shells can rehydrate after a
-  // cross-subdomain navigation without eagerly loading the auth bundle for
-  // every visitor.
-  requestIdleCallback(() => {
-    void (async () => {
-      try {
-        if (await hasSharedAuthSession(SITE_ID)) {
-          await ensureAuth();
-        }
-      } catch (error) {
-        log.warn("[dot.li auth] Shared session probe failed:", error);
-      }
-    })();
+  // Rehydrate the persisted same-origin session on idle so a reload shows
+  // the logged-in badge before any core instance boots.
+  scheduleIdle(() => {
+    emitPersistedSessionUiState();
   });
 }
 
-function renderAuthState(state: AuthState): void {
-  switch (state.status) {
-    case "idle":
+function scheduleIdle(callback: () => void): void {
+  if (typeof requestIdleCallback === "function") {
+    requestIdleCallback(() => {
+      callback();
+    });
+  } else {
+    window.setTimeout(callback, 0);
+  }
+}
+
+/**
+ * Render one auth state. The modal lifecycle is state-driven: `Pairing`
+ * opens it with the QR, `Connected` closes it, `LoginFailed` shows a
+ * retryable error, and `Disconnected` only updates the badge so an
+ * unrelated disconnect signal can never close an active pairing modal.
+ */
+function renderAuthState(state: DotliAuthState): void {
+  truapiSessionConnected = state.tag === "Connected";
+  switch (state.tag) {
+    case "Disconnected":
       renderLoggedOut();
       break;
-    case "pairing":
-      renderPairing(state.payload);
+    case "Pairing":
+      openModal(
+        undefined,
+        state.hostGlobal === true ? undefined : state.label,
+        { dotSuffix: state.dotSuffix },
+      );
+      renderPairing(state.deeplink);
       break;
-    case "attesting":
-      renderAttesting();
+    case "Connected":
+      closeModal({ skipTruapiCancel: true });
+      renderTruapiLoggedIn(state.session);
       break;
-    case "authenticated":
-      renderLoggedIn(state);
-      closeModal();
-      break;
-    case "error":
-      renderError(state.message);
+    case "LoginFailed":
+      openModal();
+      renderError(state.reason);
       break;
   }
 }
@@ -344,30 +321,47 @@ function renderLoggedOut(): void {
   window.dispatchEvent(new Event("dotli:logged-out"));
 }
 
-function renderLoggedIn(state: AuthState & { status: "authenticated" }): void {
-  const initials =
-    state.identity && authMod ? authMod.shortenName(state.identity) : "??";
-  authButton.innerHTML = `<div class="user-badge">${escapeHtml(initials)}</div>`;
+function renderTruapiLoggedIn(state: TruapiSessionUiState): void {
+  authButton.innerHTML = `<div class="user-badge">${escapeHtml(
+    shortenTruapiSessionName(state),
+  )}</div>`;
   authButton.title = "Account";
+  userPopoverUsername.textContent =
+    state.primaryUsername ??
+    state.fullUsername ??
+    state.liteUsername ??
+    shortenAccount(state.identityAccountId ?? state.publicKey) ??
+    "Connected with Polkadot Mobile";
   window.dispatchEvent(new Event("dotli:authenticated"));
+}
 
-  // Update popover with identity name or truncated account address
-  let username: string;
-  const fullName = state.identity?.fullUsername;
-  const liteName = state.identity?.liteUsername;
-  if (
-    (fullName !== undefined && fullName !== "") ||
-    (liteName !== undefined && liteName !== "")
-  ) {
-    username = fullName ?? liteName ?? "";
-  } else {
-    // Fallback to truncated account address
-    const id = Array.from(state.session.remoteAccount.accountId)
-      .map((b) => b.toString(16).padStart(2, "0"))
-      .join("");
-    username = `0x${id.slice(0, 6)}...${id.slice(-4)}`;
+function shortenTruapiSessionName(state: TruapiSessionUiState): string {
+  const fullName = state.fullUsername;
+  if (fullName !== undefined && fullName.length > 0) {
+    const parts = fullName.split(" ").filter((part) => part.length > 0);
+    if (parts.length === 1) {
+      return parts[0].slice(0, 2).toUpperCase();
+    }
+    if (parts.length > 1) {
+      return `${parts[0].charAt(0)}${parts[1].charAt(0)}`.toUpperCase();
+    }
+  }
+  const liteName = state.liteUsername;
+  if (liteName !== undefined && liteName.length > 0) {
+    return liteName.slice(0, 2).toUpperCase();
+  }
+  const account = state.identityAccountId ?? state.publicKey;
+  if (account !== undefined && account.length >= 4) {
+    return account.slice(2, 4).toUpperCase();
   }
-  userPopoverUsername.textContent = username;
+  return "??";
+}
+
+function shortenAccount(account: string | undefined): string | undefined {
+  if (account === undefined || account.length < 12) {
+    return undefined;
+  }
+  return `${account.slice(0, 8)}...${account.slice(-4)}`;
 }
 
 function renderPairing(payload: string): void {
@@ -381,6 +375,7 @@ function renderPairing(payload: string): void {
 
   // Render QR code (lazy-load qrcode lib, guard against stale appends)
   const canvas = document.createElement("canvas");
+  canvas.dataset.qrPayload = payload;
   const capturedPayload = payload;
   void import("qrcode")
     .then((QRCode) =>
@@ -437,15 +432,6 @@ function renderPairing(payload: string): void {
     });
 }
 
-function renderAttesting(): void {
-  modalQr.innerHTML = `
-    <div class="attesting">
-      <div class="spinner"></div>
-      <p>Logging in...</p>
-    </div>
-  `;
-}
-
 // Clock glyph for the "account still being set up" state.
 const PENDING_ICON_SVG =
   '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="9"/><path d="M12 7v5l3 2"/></svg>';
@@ -497,7 +483,8 @@ function renderError(message: string): void {
   retry.className = "auth-modal-retry";
   retry.textContent = "Retry";
   retry.addEventListener("click", () => {
-    authMod?.startPairing();
+    openModal();
+    requestTruapiLogin();
   });
   container.appendChild(retry);
 
@@ -506,34 +493,31 @@ function renderError(message: string): void {
 }
 
 function handleAuthButtonClick(): void {
-  if (authMod) {
-    const state = authMod.getAuthState();
-
-    if (state.status === "authenticated") {
-      // Toggle user popover
-      userPopover.classList.toggle("open");
-    } else if (state.status === "attesting") {
-      // Attestation still running in background, just reshow the modal
-      modalBackdrop.classList.add("open");
-    } else {
-      // Open modal and start pairing
-      openModal();
-      authMod.startPairing();
-    }
+  if (truapiSessionConnected) {
+    userPopover.classList.toggle("open");
   } else {
-    // Auth not loaded yet, load it and start pairing
     openModal();
-    void ensureAuth().then(() => {
-      authMod?.startPairing();
-    });
+    requestTruapiLogin();
   }
 }
 
 function handleDisconnect(): void {
   userPopover.classList.remove("open");
-  if (authMod) {
-    void authMod.disconnect();
-  }
+  requestTruapiDisconnect();
+}
+
+export function requestTruapiDisconnect(): void {
+  window.dispatchEvent(new Event("dotli:truapi-disconnect-request"));
+}
+
+function requestTruapiLogin(reason?: string): void {
+  window.dispatchEvent(
+    new CustomEvent("dotli:truapi-login-request", {
+      detail: {
+        reason,
+      },
+    }),
+  );
 }
 
 const PERM_ICONS: Record<string, string> = {
@@ -560,8 +544,6 @@ const PERM_ICONS: Record<string, string> = {
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>',
   StatementSubmit:
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="8" y1="13" x2="16" y2="13"/><line x1="8" y1="17" x2="14" y2="17"/></svg>',
-  GetUserId:
-    '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>',
 };
 
 function initPermissions(): void {
@@ -625,14 +607,21 @@ function initPermissions(): void {
 
 /** Update the shield icon to reflect whether any permissions are active. */
 function updatePermissionsButtonState(): void {
-  if (currentProductLabel === null) {
+  const productLabel = currentProductLabel;
+  if (productLabel === null) {
     permissionsButton.classList.remove("has-grants");
     return;
   }
-  permissionsButton.classList.toggle(
-    "has-grants",
-    hasAnyGrant(currentProductLabel),
-  );
+  void (async () => {
+    const hasGrant = await hasAnyGrant(productLabel);
+    if (currentProductLabel === productLabel) {
+      permissionsButton.classList.toggle("has-grants", hasGrant);
+    }
+  })().catch(() => {
+    if (currentProductLabel === productLabel) {
+      permissionsButton.classList.remove("has-grants");
+    }
+  });
 }
 
 const STATUS_LABELS: Record<PermissionStatus, string> = {
@@ -644,6 +633,7 @@ const STATUS_LABELS: Record<PermissionStatus, string> = {
 const STATUS_ORDER: readonly PermissionStatus[] = ["ask", "granted", "denied"];
 
 let openDropdownCleanup: (() => void) | null = null;
+let permissionsRenderToken = 0;
 
 function closeOpenDropdown(): void {
   openDropdownCleanup?.();
@@ -651,10 +641,25 @@ function closeOpenDropdown(): void {
 }
 
 function renderPermissionsPopover(): void {
+  const token = ++permissionsRenderToken;
+  void renderPermissionsPopoverAsync(token).catch(() => {
+    if (token !== permissionsRenderToken) {
+      return;
+    }
+    permissionsPopoverList.innerHTML = "";
+    const hint = document.createElement("div");
+    hint.className = "permissions-popover-footer";
+    hint.textContent = "Permissions are unavailable for this app.";
+    permissionsPopoverList.appendChild(hint);
+  });
+}
+
+async function renderPermissionsPopoverAsync(token: number): Promise<void> {
   closeOpenDropdown();
   permissionsPopoverList.innerHTML = "";
 
-  if (currentProductLabel === null) {
+  const productLabel = currentProductLabel;
+  if (productLabel === null) {
     const hint = document.createElement("div");
     hint.className = "permissions-popover-footer";
     hint.textContent = productErrored
@@ -664,9 +669,19 @@ function renderPermissionsPopover(): void {
     return;
   }
 
-  for (const perm of ALL_PERMISSIONS) {
-    const productLabel = currentProductLabel;
-    const status = getPermissionStatus(productLabel, perm.name);
+  const statuses = await getPermissionStatuses(
+    productLabel,
+    ALL_PERMISSIONS.map(({ name }) => name),
+  );
+
+  for (const [index, perm] of ALL_PERMISSIONS.entries()) {
+    const status = statuses[index] ?? "ask";
+    if (
+      token !== permissionsRenderToken ||
+      currentProductLabel !== productLabel
+    ) {
+      return;
+    }
 
     const row = document.createElement("div");
     row.className = "permissions-popover-row";
@@ -683,22 +698,26 @@ function renderPermissionsPopover(): void {
 
     row.appendChild(
       createPermissionDropdown(status, (next) => {
-        if (next === "ask") {
-          resetPermission(productLabel, perm.name);
-        } else {
-          setPermissionStatus(productLabel, perm.name, next);
-        }
-        // Device permissions need iframe reload (allow attribute changes).
-        // Non-device permissions just update the UI.
-        const event = isDevicePermission(perm.name)
-          ? "dotli:device-permission-changed"
-          : "dotli:permission-changed";
-        window.dispatchEvent(
-          new CustomEvent(event, {
-            detail: { label: productLabel, permission: perm.name },
-          }),
-        );
-        renderPermissionsPopover();
+        void (async () => {
+          if (next === "ask") {
+            await resetPermission(productLabel, perm.name);
+          } else {
+            await setPermissionStatus(productLabel, perm.name, next);
+          }
+          // Device permissions need iframe reload (allow attribute changes).
+          // Non-device permissions just update the UI.
+          const event = isDevicePermission(perm.name)
+            ? "dotli:device-permission-changed"
+            : "dotli:permission-changed";
+          window.dispatchEvent(
+            new CustomEvent(event, {
+              detail: { label: productLabel, permission: perm.name },
+            }),
+          );
+          renderPermissionsPopover();
+        })().catch(() => {
+          renderPermissionsPopover();
+        });
       }),
     );
 
@@ -1318,7 +1337,7 @@ declare const __POLKADOT_API_VERSION__: string | undefined;
 declare const __POLKADOT_API_VERSIONS__:
   | { name: string; version: string }[]
   | undefined;
-declare const __NOVASAMATECH_VERSIONS__:
+declare const __PARITY_TRUAPI_VERSIONS__:
   | { name: string; version: string }[]
   | undefined;
 
@@ -1432,19 +1451,10 @@ function renderDiagnostics(parent: HTMLElement): void {
     polkadotApi.push(...__POLKADOT_API_VERSIONS__);
   }
 
-  // @novasamatech/* versions move in lockstep, so showing every single
-  // package is noise. Keep only the two that are independently meaningful:
-  // host-api (the host runtime) and sdk-statement (the statement store
-  // client). Everything else in the scope tracks host-api's version.
-  const NOVASAMATECH_ALLOWLIST = new Set([
-    "@novasamatech/host-api",
-    "@novasamatech/sdk-statement",
-  ]);
-  const novasamatech = (
-    typeof __NOVASAMATECH_VERSIONS__ === "undefined"
+  const parityTruapi =
+    typeof __PARITY_TRUAPI_VERSIONS__ === "undefined"
       ? []
-      : __NOVASAMATECH_VERSIONS__
-  ).filter((p) => NOVASAMATECH_ALLOWLIST.has(p.name));
+      : __PARITY_TRUAPI_VERSIONS__;
 
   if (polkadotApi.length > 0) {
     appendSectionHeader(parent, "@polkadot-api");
@@ -1452,9 +1462,9 @@ function renderDiagnostics(parent: HTMLElement): void {
       renderInfoRow(parent, pkg.name, pkg.version);
     }
   }
-  if (novasamatech.length > 0) {
-    appendSectionHeader(parent, "@triangle-sdk");
-    for (const pkg of novasamatech) {
+  if (parityTruapi.length > 0) {
+    appendSectionHeader(parent, "@parity/truapi");
+    for (const pkg of parityTruapi) {
       renderInfoRow(parent, pkg.name, pkg.version);
     }
   }
@@ -1469,24 +1479,26 @@ function renderDiagnostics(parent: HTMLElement): void {
   shareBtn.title =
     "Open a new issue on paritytech/dotli pre-filled with these diagnostics";
   shareBtn.addEventListener("click", () => {
-    const report = formatDiagnosticsReport(
-      base,
-      smoldotInfo,
-      polkadotApi,
-      novasamatech,
-    );
-    const body = [
-      "<!-- Describe the issue above this line; the diagnostics below are auto-filled. -->",
-      "",
-      "## Diagnostics",
-      "",
-      "```",
-      report,
-      "```",
-    ].join("\n");
-    const url = new URL("https://github.com/paritytech/dotli/issues/new");
-    url.searchParams.set("body", body);
-    window.open(url.toString(), "_blank", "noopener,noreferrer");
+    void (async () => {
+      const report = await formatDiagnosticsReport(
+        base,
+        smoldotInfo,
+        polkadotApi,
+        parityTruapi,
+      );
+      const body = [
+        "<!-- Describe the issue above this line; the diagnostics below are auto-filled. -->",
+        "",
+        "## Diagnostics",
+        "",
+        "```",
+        report,
+        "```",
+      ].join("\n");
+      const url = new URL("https://github.com/paritytech/dotli/issues/new");
+      url.searchParams.set("body", body);
+      window.open(url.toString(), "_blank", "noopener,noreferrer");
+    })();
   });
 
   const debugOn = isTruapiDebugEnabled();
@@ -1527,16 +1539,16 @@ function isTruapiDebugEnabled(): boolean {
  *              so the snapshot matches what's actually live right now.
  *    3. Permissions: per-product, omitted on landing where we don't have
  *                    a scoped label to query.
- *    4. Packages: flat list of smoldot, polkadot-api, and novasamatech. The
+ *    4. Packages: flat list of smoldot, polkadot-api, and @parity/truapi. The
  *                 live block heights from the @smoldot popover section
  *                 aren't included here because they're noise in a bug
  *                 report. The popover already shows them live. */
-function formatDiagnosticsReport(
+async function formatDiagnosticsReport(
   base: [label: string, value: string][],
   smoldot: SmoldotInfo,
   polkadotApi: { name: string; version: string }[],
-  novasamatech: { name: string; version: string }[],
-): string {
+  parityTruapi: { name: string; version: string }[],
+): Promise<string> {
   const lines: string[] = [];
   for (const [k, v] of base) {
     lines.push(`${k}: ${v}`);
@@ -1553,10 +1565,15 @@ function formatDiagnosticsReport(
   );
 
   // Permissions, only when we know which product label to scope against.
-  if (currentProductLabel !== null) {
+  const productLabel = currentProductLabel;
+  if (productLabel !== null) {
     lines.push("", "Permissions:");
-    for (const perm of ALL_PERMISSIONS) {
-      const status = getPermissionStatus(currentProductLabel, perm.name);
+    const statuses = await getPermissionStatuses(
+      productLabel,
+      ALL_PERMISSIONS.map(({ name }) => name),
+    );
+    for (const [index, perm] of ALL_PERMISSIONS.entries()) {
+      const status = statuses[index] ?? "ask";
       lines.push(`  ${perm.label}: ${status === "granted" ? "on" : "off"}`);
     }
   }
@@ -1567,7 +1584,7 @@ function formatDiagnosticsReport(
   for (const p of polkadotApi) {
     lines.push(`  ${p.name}: ${p.version}`);
   }
-  for (const p of novasamatech) {
+  for (const p of parityTruapi) {
     lines.push(`  ${p.name}: ${p.version}`);
   }
   return lines.join("\n");
@@ -1959,7 +1976,11 @@ function renderCacheToggle(
   parent.appendChild(row);
 }
 
-function openModal(reason?: string, label?: string): void {
+function openModal(
+  reason?: string,
+  label?: string,
+  options: { dotSuffix?: boolean } = {},
+): void {
   modalQr.innerHTML = `<div class="spinner"></div>`;
   // Mobile leads with the deeplink button. The QR toggle swaps this copy later.
   modalHint.textContent = isMobileDevice()
@@ -1972,7 +1993,10 @@ function openModal(reason?: string, label?: string): void {
   // label and get the ".dot" suffix.
   let productLabel = "";
   if (label !== undefined && label.length > 0) {
-    productLabel = label.startsWith("localhost:") ? label : `${label}.dot`;
+    productLabel =
+      label.startsWith("localhost:") || options.dotSuffix === false
+        ? label
+        : `${label}.dot`;
   }
   modalTitle.innerHTML =
     productLabel.length > 0
@@ -1988,14 +2012,14 @@ function openModal(reason?: string, label?: string): void {
   modalBackdrop.classList.add("open");
 }
 
-function closeModal(): void {
+function closeModal(opts: { skipTruapiCancel?: boolean } = {}): void {
   modalBackdrop.classList.remove("open");
+  currentQrPayload = null;
+  modalQr.innerHTML = "";
 
-  if (authMod) {
-    const state = authMod.getAuthState();
-    // Only abort during pairing or error. Let attestation continue in background
-    if (state.status === "pairing" || state.status === "error") {
-      authMod.abortPairing();
-    }
+  if (opts.skipTruapiCancel !== true) {
+    // User-initiated close: cancel any in-flight login in the core so the
+    // pairing flow stops polling and resolves as Rejected.
+    window.dispatchEvent(new Event("dotli:truapi-cancel-login"));
   }
 }
diff --git a/packages/ui/src/wallet-queue.ts b/packages/ui/src/wallet-queue.ts
deleted file mode 100644
index b065cc4..0000000
--- a/packages/ui/src/wallet-queue.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Single-slot FIFO queue serializing host-side wallet-flow modals.
- *
- * host-papp already serializes the SSO wire internally, but each call also
- * opens a host modal that must not stack with another wallet flow.
- */
-
-import { ResultAsync, type Result } from "neverthrow";
-
-export type WalletFlowQueue = <T, E>(
-  fn: () => ResultAsync<T, E>,
-) => ResultAsync<T, E>;
-
-export function createWalletFlowQueue(): WalletFlowQueue {
-  let chain: Promise<unknown> = Promise.resolve();
-
-  function enqueue<T, E>(fn: () => ResultAsync<T, E>): ResultAsync<T, E> {
-    // Both then branches run fn so a previous rejection cannot stall the queue.
-    const run = (): ResultAsync<T, E> => fn();
-    const next: Promise<Result<T, E>> = chain.then(run, run);
-    chain = next;
-    return ResultAsync.fromSafePromise(next).andThen((r) => r);
-  }
-
-  return enqueue;
-}
-
-export const queueWalletFlow: WalletFlowQueue = createWalletFlowQueue();
diff --git a/packages/ui/tests/allocation-modal.test.ts b/packages/ui/tests/allocation-modal.test.ts
deleted file mode 100644
index de86199..0000000
--- a/packages/ui/tests/allocation-modal.test.ts
+++ /dev/null
@@ -1,181 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { afterEach, describe, expect, it } from "vitest";
-import {
-  showAllocationRequestModal,
-  type AllocatableResourceValue,
-  type AllocationOutcomeValue,
-} from "@dotli/ui/allocation-modal";
-
-afterEach(() => {
-  document.body.innerHTML = "";
-});
-
-function findModal(): HTMLElement {
-  const modal = document.querySelector(".signing-modal");
-  if (!(modal instanceof HTMLElement)) {
-    throw new Error("modal not mounted");
-  }
-  return modal;
-}
-
-function clickButton(text: string): void {
-  const buttons = Array.from(document.querySelectorAll("button"));
-  const button = buttons.find((b) => b.textContent === text);
-  if (!button) throw new Error(`button "${text}" not found`);
-  button.click();
-}
-
-const flush = (): Promise<void> => new Promise((r) => setTimeout(r, 0));
-
-describe("showAllocationRequestModal", () => {
-  const allowed: AllocationOutcomeValue[] = [
-    { tag: "Allocated", value: undefined },
-  ];
-
-  it("renders one item per resource with the expected label", () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "StatementStoreAllowance", value: undefined },
-      { tag: "BulletinAllowance", value: undefined },
-      { tag: "SmartContractAllowance", value: 5 },
-      { tag: "AutoSigning", value: undefined },
-    ];
-
-    void showAllocationRequestModal("myapp", resources, async () => allowed);
-
-    const items = Array.from(
-      findModal().querySelectorAll(".allocation-modal-list li"),
-    ).map((li) => li.textContent);
-
-    expect(items).toEqual([
-      "Post statements on your behalf",
-      "Publish bulletin posts on your behalf",
-      "Sign smart-contract calls automatically",
-      "Sign transactions automatically",
-    ]);
-  });
-
-  it("adds a signing-account tooltip for smart-contract allowances when a resolver is given", () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "SmartContractAllowance", value: 0 },
-    ];
-
-    void showAllocationRequestModal("myapp", resources, async () => allowed, {
-      resolveContractAccount: (index) => `5Addr${String(index)}`,
-    });
-
-    const modal = findModal();
-    expect(modal.querySelector(".allocation-tooltip-title")?.textContent).toBe(
-      "Following accounts will sign contract calls automatically:",
-    );
-
-    // The account label is the disclosure summary; the SS58 address is tucked
-    // inside the collapsible <details>.
-    const summary = modal.querySelector("summary.allocation-account-summary");
-    expect(
-      summary?.querySelector(".allocation-account-label")?.textContent,
-    ).toBe("App account with index 0");
-
-    const details = modal.querySelector("details.allocation-account");
-    expect(details).not.toBeNull();
-    expect(
-      details?.querySelector(".allocation-account-address")?.textContent,
-    ).toBe("5Addr0");
-  });
-
-  it("omits the tooltip when no resolver is provided", () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "SmartContractAllowance", value: 0 },
-    ];
-
-    void showAllocationRequestModal("myapp", resources, async () => allowed);
-
-    expect(findModal().querySelector(".allocation-tooltip")).toBeNull();
-  });
-
-  it("resolves with the wallet outcomes on Allow", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "StatementStoreAllowance", value: undefined },
-    ];
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      async () => allowed,
-    );
-
-    clickButton("Allow");
-    await expect(promise).resolves.toEqual(allowed);
-    expect(document.querySelector(".signing-modal")).toBeNull();
-  });
-
-  it("rejects on Cancel and removes the modal", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "BulletinAllowance", value: undefined },
-    ];
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      async () => allowed,
-    );
-
-    clickButton("Cancel");
-    await expect(promise).rejects.toThrow();
-    expect(document.querySelector(".signing-modal")).toBeNull();
-  });
-
-  it("rejects on backdrop click while not pending", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "AutoSigning", value: undefined },
-    ];
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      async () => allowed,
-    );
-
-    const backdrop = document.querySelector(".signing-modal-backdrop");
-    if (!(backdrop instanceof HTMLElement)) {
-      throw new Error("backdrop not mounted");
-    }
-    backdrop.click();
-    await expect(promise).rejects.toThrow();
-    expect(document.querySelector(".signing-modal")).toBeNull();
-  });
-
-  it("keeps the modal open and shows the error when performAllocation rejects", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "StatementStoreAllowance", value: undefined },
-    ];
-    let attempts = 0;
-    const performAllocation = async (): Promise<AllocationOutcomeValue[]> => {
-      attempts += 1;
-      if (attempts === 1) throw new Error("phone unreachable");
-      return allowed;
-    };
-
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      performAllocation,
-    );
-
-    clickButton("Allow");
-    await flush();
-    await flush();
-
-    const errorBox = document.querySelector(".allocation-modal-error");
-    expect(errorBox?.textContent).toBe("phone unreachable");
-    expect(document.querySelector(".signing-modal")).not.toBeNull();
-
-    const allow = Array.from(document.querySelectorAll("button")).find(
-      (b) => b.textContent === "Allow",
-    );
-    expect(allow?.disabled).toBe(false);
-
-    // Retry path settles the original promise.
-    clickButton("Allow");
-    await expect(promise).resolves.toEqual(allowed);
-    expect(attempts).toBe(2);
-  });
-});
diff --git a/packages/ui/tests/bridge.test.ts b/packages/ui/tests/bridge.test.ts
new file mode 100644
index 0000000..1ef1607
--- /dev/null
+++ b/packages/ui/tests/bridge.test.ts
@@ -0,0 +1,369 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  HostRequestLoginResponse,
+  VersionedHostRequestLoginError,
+  decodeWireMessage,
+  encodeWireMessage,
+  scale,
+} from "@parity/truapi";
+import { ACCOUNT_REQUEST_LOGIN } from "@parity/truapi/wire-table";
+
+type Deferred<T> = {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (error: unknown) => void;
+};
+
+type MockProvider = {
+  postMessage: ReturnType<typeof vi.fn>;
+  subscribe: ReturnType<typeof vi.fn>;
+  subscribeClose: ReturnType<typeof vi.fn>;
+  disconnectSession: ReturnType<typeof vi.fn>;
+  getPermissionAuthorizationStatus: ReturnType<typeof vi.fn>;
+  getPermissionAuthorizationStatuses: ReturnType<typeof vi.fn>;
+  setPermissionAuthorizationStatus: ReturnType<typeof vi.fn>;
+  disconnect: ReturnType<typeof vi.fn>;
+  dispose: ReturnType<typeof vi.fn>;
+};
+
+type MockRuntime = {
+  createProvider: ReturnType<typeof vi.fn>;
+  cancelPairing: ReturnType<typeof vi.fn>;
+  notifySessionStoreChanged: ReturnType<typeof vi.fn>;
+  dispose: ReturnType<typeof vi.fn>;
+};
+
+type ProviderListener = (message: Uint8Array) => void;
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  let reject!: (error: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+const mocks = vi.hoisted(() => ({
+  coreProviders: [] as MockProvider[],
+  coreProviderDefers: [] as Deferred<MockProvider>[],
+  coreRuntimes: [] as MockRuntime[],
+  iframeHosts: [] as {
+    iframeUrl: string;
+    iframe: HTMLIFrameElement;
+    dispose: ReturnType<typeof vi.fn>;
+  }[],
+  createWebWorkerPairingHostRuntime: vi.fn(),
+  createIframeHost: vi.fn(),
+  createWasmRawCallbacks: vi.fn((callbacks: unknown) => callbacks),
+  timerStop: vi.fn(),
+  HostWorker: vi.fn(),
+}));
+
+vi.mock("@parity/truapi-host-wasm", () => ({
+  createWasmRawCallbacks: mocks.createWasmRawCallbacks,
+}));
+
+vi.mock("@parity/truapi-host-wasm/web", () => ({
+  createWebWorkerPairingHostRuntime: mocks.createWebWorkerPairingHostRuntime,
+  createIframeHost: mocks.createIframeHost,
+}));
+
+vi.mock("@parity/truapi-host-wasm/worker-runtime?worker", () => ({
+  default: mocks.HostWorker,
+}));
+
+vi.mock("@dotli/metrics/metrics", () => ({
+  m: {
+    measure: vi.fn(),
+    timer: vi.fn(() => mocks.timerStop),
+  },
+}));
+
+function makeProvider(): MockProvider {
+  const provider = {
+    postMessage: vi.fn(),
+    subscribe: vi.fn(() => () => {}),
+    subscribeClose: vi.fn(() => () => {}),
+    disconnectSession: vi.fn(async () => {}),
+    getPermissionAuthorizationStatus: vi.fn(async () => "NotDetermined"),
+    getPermissionAuthorizationStatuses: vi.fn(async (requests: unknown[]) =>
+      requests.map(() => "NotDetermined"),
+    ),
+    setPermissionAuthorizationStatus: vi.fn(async () => {}),
+    disconnect: vi.fn(async () => {}),
+    dispose: vi.fn(),
+  };
+  mocks.coreProviders.push(provider);
+  return provider;
+}
+
+function makeLoginProvider(options: {
+  onPostMessage?: (message: Uint8Array) => void;
+}): MockProvider & { listener: ProviderListener | null } {
+  const provider = {
+    listener: null as ProviderListener | null,
+    postMessage: vi.fn((message: Uint8Array) => {
+      options.onPostMessage?.(message);
+    }),
+    subscribe: vi.fn((callback: ProviderListener) => {
+      provider.listener = callback;
+      return () => {
+        provider.listener = null;
+      };
+    }),
+    subscribeClose: vi.fn(() => () => {}),
+    disconnectSession: vi.fn(async () => {}),
+    getPermissionAuthorizationStatus: vi.fn(async () => "NotDetermined"),
+    getPermissionAuthorizationStatuses: vi.fn(async (requests: unknown[]) =>
+      requests.map(() => "NotDetermined"),
+    ),
+    setPermissionAuthorizationStatus: vi.fn(async () => {}),
+    disconnect: vi.fn(async () => {}),
+    dispose: vi.fn(),
+  };
+  return provider;
+}
+
+function makeRuntime(): MockRuntime {
+  const runtime = {
+    createProvider: vi.fn(() => {
+      const item = deferred<MockProvider>();
+      mocks.coreProviderDefers.push(item);
+      return item.promise;
+    }),
+    cancelPairing: vi.fn(),
+    notifySessionStoreChanged: vi.fn(),
+    dispose: vi.fn(),
+  };
+  mocks.coreRuntimes.push(runtime);
+  return runtime;
+}
+
+function loginResponseFrame(
+  requestId: string,
+  result:
+    | { success: true; value: "Success" | "AlreadyConnected" | "Rejected" }
+    | { success: false; reason: string },
+): Uint8Array {
+  const responseCodec = scale.indexedTaggedUnion({
+    V1: [
+      0,
+      scale.Result(
+        HostRequestLoginResponse,
+        scale.CallError(VersionedHostRequestLoginError),
+      ),
+    ] as const,
+  });
+  const value = responseCodec.enc({
+    tag: "V1",
+    value: result.success
+      ? { success: true, value: result.value }
+      : {
+          success: false,
+          value: {
+            tag: "Domain",
+            value: {
+              tag: "V1",
+              value: {
+                tag: "Unknown",
+                value: { reason: result.reason },
+              },
+            },
+          },
+        },
+  });
+  const frame = encodeWireMessage({
+    requestId,
+    payload: {
+      id: ACCOUNT_REQUEST_LOGIN.response,
+      value,
+    },
+  });
+  if (frame.isErr()) {
+    throw frame.error;
+  }
+  return frame.value;
+}
+
+function requestIdFromFrame(message: Uint8Array): string {
+  const decoded = decodeWireMessage(message);
+  if (decoded.isErr()) {
+    throw decoded.error;
+  }
+  return decoded.value.requestId;
+}
+
+async function flushMicrotasks(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+async function waitForProviderRequests(count: number): Promise<void> {
+  for (let i = 0; i < 20; i += 1) {
+    if (mocks.coreProviderDefers.length >= count) {
+      return;
+    }
+    await flushMicrotasks();
+  }
+  throw new Error(`expected ${count} provider request(s)`);
+}
+
+async function waitForMockCalls(
+  mock: ReturnType<typeof vi.fn>,
+  count: number,
+): Promise<void> {
+  for (let i = 0; i < 20; i += 1) {
+    if (mock.mock.calls.length >= count) {
+      return;
+    }
+    await flushMicrotasks();
+  }
+  throw new Error(`expected ${count} mock call(s)`);
+}
+
+describe("bridge render lifecycle", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    mocks.coreProviders.length = 0;
+    mocks.coreProviderDefers.length = 0;
+    mocks.coreRuntimes.length = 0;
+    mocks.iframeHosts.length = 0;
+    document.body.innerHTML = `<div id="app"></div>`;
+    mocks.createWebWorkerPairingHostRuntime.mockImplementation(() =>
+      Promise.resolve(makeRuntime()),
+    );
+    mocks.createIframeHost.mockImplementation(
+      (args: { iframeUrl: string; container: HTMLElement }) => {
+        const iframe = document.createElement("iframe");
+        iframe.dataset.src = args.iframeUrl;
+        args.container.appendChild(iframe);
+        const dispose = vi.fn(() => {
+          iframe.remove();
+        });
+        const host = { iframeUrl: args.iframeUrl, iframe, dispose };
+        mocks.iframeHosts.push(host);
+        return { iframe, dispose };
+      },
+    );
+  });
+
+  it("disposes a host that resolves after a newer render has started", async () => {
+    const { renderIframe } = await import("@dotli/ui/bridge");
+
+    const first = renderIframe("https://first.example/app", "first");
+    await waitForProviderRequests(1);
+    const second = renderIframe("https://second.example/app", "second");
+    await waitForProviderRequests(2);
+
+    const secondProvider = makeProvider();
+    mocks.coreProviderDefers[1].resolve(secondProvider);
+    await second;
+    expect(document.querySelector("iframe")?.dataset.src).toBe(
+      "https://second.example/app",
+    );
+
+    const firstProvider = makeProvider();
+    mocks.coreProviderDefers[0].resolve(firstProvider);
+    await first;
+
+    expect(mocks.iframeHosts).toHaveLength(2);
+    const firstHost = mocks.iframeHosts.find(
+      (host) => host.iframeUrl === "https://first.example/app",
+    );
+    expect(firstHost?.dispose).toHaveBeenCalledTimes(1);
+    expect(firstProvider.dispose).toHaveBeenCalledTimes(1);
+    expect(secondProvider.dispose).not.toHaveBeenCalled();
+    expect(document.querySelector("iframe")?.dataset.src).toBe(
+      "https://second.example/app",
+    );
+  });
+
+  it("boots the landing auth core to disconnect a stored session without a product", async () => {
+    await import("@dotli/ui/bridge");
+
+    window.dispatchEvent(new Event("dotli:truapi-disconnect-request"));
+    await waitForProviderRequests(1);
+
+    const provider = makeProvider();
+    mocks.coreProviderDefers[0].resolve(provider);
+    await waitForMockCalls(provider.disconnectSession, 1);
+
+    expect(provider.disconnectSession).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("requestCoreLogin", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    document.body.innerHTML = `<div id="app"></div>`;
+  });
+
+  it("resolves successful login responses", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage(message) {
+        provider.listener?.(
+          loginResponseFrame(requestIdFromFrame(message), {
+            success: true,
+            value: "Success",
+          }),
+        );
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).resolves.toBe("Success");
+    expect(provider.subscribe).toHaveBeenCalledTimes(1);
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects typed login errors as LoginRequestError", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage(message) {
+        provider.listener?.(
+          loginResponseFrame(requestIdFromFrame(message), {
+            success: false,
+            reason: "Rejected",
+          }),
+        );
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).rejects.toMatchObject({
+      name: "LoginRequestError",
+      error: {
+        tag: "V1",
+        value: { tag: "Unknown", value: { reason: "Rejected" } },
+      },
+    });
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects malformed response frames and unsubscribes", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage() {
+        provider.listener?.(new Uint8Array([0xff, 0x00]));
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).rejects.toThrow();
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects send failures and unsubscribes", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage() {
+        throw new Error("send failed");
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).rejects.toThrow("send failed");
+    expect(provider.listener).toBeNull();
+  });
+});
diff --git a/packages/ui/tests/chain-callback.test.ts b/packages/ui/tests/chain-callback.test.ts
new file mode 100644
index 0000000..7e2771e
--- /dev/null
+++ b/packages/ui/tests/chain-callback.test.ts
@@ -0,0 +1,269 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import { createChainConnect } from "@dotli/ui/host-callbacks/Chain";
+
+const mocks = vi.hoisted(() => ({
+  backend: "smoldot-shared-worker",
+  smoldotProvider: vi.fn(),
+  rpcProvider: vi.fn(),
+  createSmoldotChainProvider: vi.fn(),
+  createRpcChainProvider: vi.fn(),
+  isSmoldotChainSupported: vi.fn(),
+  isRpcChainSupported: vi.fn(),
+  hasDotliDebugListeners: vi.fn(),
+  emitSsoStatementStoreConnected: vi.fn(),
+  emitSsoStatementStoreConnecting: vi.fn(),
+  emitSsoStatementStoreConnectFailed: vi.fn(),
+  emitSsoStatementStoreRequest: vi.fn(),
+  emitSsoStatementStoreResponse: vi.fn(),
+}));
+
+vi.mock("@dotli/config/config", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@dotli/config/config")>();
+  return {
+    ...actual,
+    SS_USE_SMOLDOT: false,
+  };
+});
+
+vi.mock("@dotli/config/mode", () => ({
+  getBackend: () => mocks.backend,
+}));
+
+vi.mock("@dotli/resolver/chains", () => ({
+  createChainProvider: mocks.createSmoldotChainProvider,
+  isChainSupported: mocks.isSmoldotChainSupported,
+}));
+
+vi.mock("@dotli/resolver/rpc-chain", () => ({
+  createRpcChainProvider: mocks.createRpcChainProvider,
+  isRpcChainSupported: mocks.isRpcChainSupported,
+}));
+
+vi.mock("@dotli/truapi-debug/dotli-debug-bus", () => ({
+  hasDotliDebugListeners: mocks.hasDotliDebugListeners,
+}));
+
+vi.mock("@dotli/ui/host-callbacks/SsoDebug", () => ({
+  emitSsoStatementStoreConnected: mocks.emitSsoStatementStoreConnected,
+  emitSsoStatementStoreConnecting: mocks.emitSsoStatementStoreConnecting,
+  emitSsoStatementStoreConnectFailed: mocks.emitSsoStatementStoreConnectFailed,
+  emitSsoStatementStoreRequest: mocks.emitSsoStatementStoreRequest,
+  emitSsoStatementStoreResponse: mocks.emitSsoStatementStoreResponse,
+}));
+
+function hexBytes(hex: string): Uint8Array {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+describe("createChainConnect", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.backend = "smoldot-shared-worker";
+    mocks.smoldotProvider.mockReturnValue({
+      send: vi.fn(),
+      disconnect: vi.fn(),
+    });
+    mocks.rpcProvider.mockReturnValue({
+      send: vi.fn(),
+      disconnect: vi.fn(),
+    });
+    mocks.createSmoldotChainProvider.mockReturnValue(mocks.smoldotProvider);
+    mocks.createRpcChainProvider.mockReturnValue(mocks.rpcProvider);
+    mocks.isSmoldotChainSupported.mockReturnValue(true);
+    mocks.isRpcChainSupported.mockReturnValue(true);
+    mocks.hasDotliDebugListeners.mockReturnValue(false);
+  });
+
+  it("routes People-chain statement-store connections through RPC by default", async () => {
+    const peopleGenesis = getActiveServicesConfig().people.genesis;
+
+    await createChainConnect()(hexBytes(peopleGenesis));
+
+    expect(mocks.createRpcChainProvider).toHaveBeenCalledWith(peopleGenesis);
+    expect(mocks.createSmoldotChainProvider).not.toHaveBeenCalled();
+  });
+
+  it("keeps non-People chain connections on the selected smoldot backend", async () => {
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+
+    await createChainConnect()(hexBytes(assetHubGenesis));
+
+    expect(mocks.createSmoldotChainProvider).toHaveBeenCalledWith(
+      assetHubGenesis,
+    );
+    expect(mocks.createRpcChainProvider).not.toHaveBeenCalled();
+  });
+
+  it("passes statement-store traffic through untouched", async () => {
+    let onMessage: ((message: unknown) => void) | undefined;
+    const sent: unknown[] = [];
+    mocks.smoldotProvider.mockImplementation(
+      (handler: (message: unknown) => void) => {
+        onMessage = handler;
+        return {
+          send: (request: unknown) => {
+            sent.push(request);
+          },
+          disconnect: vi.fn(),
+        };
+      },
+    );
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+
+    const connection = await createChainConnect()(hexBytes(assetHubGenesis));
+    const query = {
+      jsonrpc: "2.0",
+      id: "opaque-query-request",
+      method: "statement_subscribeStatement",
+      params: [{ matchAll: [] }],
+    };
+    connection.send(JSON.stringify(query));
+    expect(sent).toEqual([query]);
+
+    const ack = {
+      jsonrpc: "2.0",
+      id: "opaque-query-request",
+      result: "remote-sub",
+    };
+    onMessage?.(ack);
+    const responses = connection.responses()[Symbol.asyncIterator]();
+    expect(JSON.parse((await responses.next()).value)).toEqual(ack);
+    await responses.return?.();
+  });
+
+  it("skips statement-store debug events when no debug listener is attached", async () => {
+    let onMessage: ((message: unknown) => void) | undefined;
+    const sent: unknown[] = [];
+    mocks.smoldotProvider.mockImplementation(
+      (handler: (message: unknown) => void) => {
+        onMessage = handler;
+        return {
+          send: (request: unknown) => {
+            sent.push(request);
+          },
+          disconnect: vi.fn(),
+        };
+      },
+    );
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+    const connection = await createChainConnect()(hexBytes(assetHubGenesis));
+
+    connection.send(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        id: "opaque-subscribe",
+        method: "statement_subscribeStatement",
+        params: [{ matchAll: [] }],
+      }),
+    );
+    onMessage?.({
+      jsonrpc: "2.0",
+      id: "opaque-subscribe",
+      result: "remote-sub",
+    });
+    const responses = connection.responses()[Symbol.asyncIterator]();
+    await responses.next();
+    await responses.return?.();
+
+    expect(sent).toHaveLength(1);
+    expect(mocks.emitSsoStatementStoreRequest).not.toHaveBeenCalled();
+    expect(mocks.emitSsoStatementStoreResponse).not.toHaveBeenCalled();
+  });
+
+  it("emits statement-store debug events by correlating opaque request ids", async () => {
+    mocks.hasDotliDebugListeners.mockReturnValue(true);
+    let onMessage: ((message: unknown) => void) | undefined;
+    mocks.smoldotProvider.mockImplementation(
+      (handler: (message: unknown) => void) => {
+        onMessage = handler;
+        return {
+          send: vi.fn(),
+          disconnect: vi.fn(),
+        };
+      },
+    );
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+    const connection = await createChainConnect()(hexBytes(assetHubGenesis));
+
+    connection.send(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        id: "opaque-subscribe",
+        method: "statement_subscribeStatement",
+        params: [{ matchAll: [] }],
+      }),
+    );
+    onMessage?.({
+      jsonrpc: "2.0",
+      id: "opaque-subscribe",
+      result: "remote-sub",
+    });
+    const responses = connection.responses()[Symbol.asyncIterator]();
+    await responses.next();
+    await responses.return?.();
+
+    expect(mocks.emitSsoStatementStoreRequest).toHaveBeenCalledWith({
+      method: "statement_subscribeStatement",
+      requestId: "opaque-subscribe",
+      requestKind: "subscribe",
+    });
+    expect(mocks.emitSsoStatementStoreResponse).toHaveBeenCalledWith({
+      method: "statement_subscribeStatement",
+      requestId: "opaque-subscribe",
+      requestKind: "subscribe",
+      frameKind: "ack",
+      remoteSubscriptionId: "remote-sub",
+    });
+  });
+
+  it("uses the outgoing request map for unsubscribe response metadata", async () => {
+    mocks.hasDotliDebugListeners.mockReturnValue(true);
+    let onMessage: ((message: unknown) => void) | undefined;
+    mocks.smoldotProvider.mockImplementation(
+      (handler: (message: unknown) => void) => {
+        onMessage = handler;
+        return {
+          send: vi.fn(),
+          disconnect: vi.fn(),
+        };
+      },
+    );
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+    const connection = await createChainConnect()(hexBytes(assetHubGenesis));
+
+    connection.send(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        id: "opaque-cleanup",
+        method: "statement_unsubscribeStatement",
+        params: ["remote-sub"],
+      }),
+    );
+    onMessage?.({
+      jsonrpc: "2.0",
+      id: "opaque-cleanup",
+      result: true,
+    });
+    const responses = connection.responses()[Symbol.asyncIterator]();
+    await responses.next();
+    await responses.return?.();
+
+    expect(mocks.emitSsoStatementStoreRequest).toHaveBeenCalledWith({
+      method: "statement_unsubscribeStatement",
+      requestId: "opaque-cleanup",
+      requestKind: "unsubscribe",
+    });
+    expect(mocks.emitSsoStatementStoreResponse).toHaveBeenCalledWith({
+      method: "statement_unsubscribeStatement",
+      requestId: "opaque-cleanup",
+      requestKind: "unsubscribe",
+      frameKind: "ack",
+    });
+  });
+});
diff --git a/packages/ui/tests/local-storage.test.ts b/packages/ui/tests/local-storage.test.ts
new file mode 100644
index 0000000..77592f4
--- /dev/null
+++ b/packages/ui/tests/local-storage.test.ts
@@ -0,0 +1,71 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  createLocalStorageClear,
+  createLocalStorageRead,
+  createLocalStorageWrite,
+} from "@dotli/ui/host-callbacks/LocalStorage";
+
+describe("local-storage host callbacks", () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it("round-trips product-scoped bytes", async () => {
+    const read = createLocalStorageRead();
+    const write = createLocalStorageWrite();
+    const clear = createLocalStorageClear();
+
+    await write(
+      "truapi:product-storage:v1:9:myapp.dot:key",
+      new Uint8Array([0, 1, 2, 253, 254, 255]),
+    );
+
+    expect(
+      localStorage.getItem("dotli:truapi:product-storage:v1:9:myapp.dot:key"),
+    ).toBe("AAEC/f7/");
+    expect(
+      Array.from(
+        (await read("truapi:product-storage:v1:9:myapp.dot:key")) ?? [],
+      ),
+    ).toEqual([0, 1, 2, 253, 254, 255]);
+
+    await clear("truapi:product-storage:v1:9:myapp.dot:key");
+    expect(await read("truapi:product-storage:v1:9:myapp.dot:key")).toBeUndefined();
+  });
+
+  it("rotates SSO device identity across host runtime prefixes", async () => {
+    const clear = createLocalStorageClear();
+    localStorage.setItem("dotli:dotli:truapi:sso-device-identity:v1", "old");
+    localStorage.setItem(
+      "dotli:localhost:3000:truapi:sso-device-identity:v1",
+      "old",
+    );
+    localStorage.setItem("dotli:myapp:other", "keep");
+
+    await clear("truapi:sso-device-identity:v1");
+
+    expect(
+      localStorage.getItem("dotli:dotli:truapi:sso-device-identity:v1"),
+    ).toBeNull();
+    expect(
+      localStorage.getItem(
+        "dotli:localhost:3000:truapi:sso-device-identity:v1",
+      ),
+    ).toBeNull();
+    expect(localStorage.getItem("dotli:myapp:other")).toBe("keep");
+  });
+
+  it("writes values larger than a single argument-spread chunk", async () => {
+    const read = createLocalStorageRead();
+    const write = createLocalStorageWrite();
+    const value = Uint8Array.from({ length: 70_000 }, (_, index) => index % 256);
+
+    await write("truapi:product-storage:v1:9:myapp.dot:large", value);
+
+    expect(
+      Array.from(
+        (await read("truapi:product-storage:v1:9:myapp.dot:large")) ?? [],
+      ),
+    ).toEqual(Array.from(value));
+  });
+});
diff --git a/packages/ui/tests/login-request-error.test.ts b/packages/ui/tests/login-request-error.test.ts
new file mode 100644
index 0000000..722a2f6
--- /dev/null
+++ b/packages/ui/tests/login-request-error.test.ts
@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { LoginRequestError } from "@dotli/ui/login-request-error";
+
+describe("LoginRequestError", () => {
+  it("carries the versioned error and a JSON message", () => {
+    const versioned = {
+      tag: "V1",
+      value: { tag: "Unknown", value: { reason: "Host failure: boom" } },
+    } as const;
+    const error = new LoginRequestError(versioned);
+
+    expect(error).toBeInstanceOf(Error);
+    expect(error.error).toEqual(versioned);
+    expect(error.message).toBe(JSON.stringify(versioned));
+  });
+});
diff --git a/packages/ui/tests/notification.test.ts b/packages/ui/tests/notification.test.ts
new file mode 100644
index 0000000..66489c0
--- /dev/null
+++ b/packages/ui/tests/notification.test.ts
@@ -0,0 +1,150 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  scheduleNotification: vi.fn(),
+  cancelNotification: vi.fn(),
+  showPermissionRequestModal: vi.fn(),
+}));
+
+vi.mock("@dotli/ui/scheduled-notifications", () => ({
+  scheduleNotification: mocks.scheduleNotification,
+  cancelNotification: mocks.cancelNotification,
+}));
+
+vi.mock("@dotli/ui/permission-modal", () => ({
+  showPermissionRequestModal: mocks.showPermissionRequestModal,
+}));
+
+async function registerNotificationAuthorization(
+  initialStatus: "NotDetermined" | "Denied" | "Authorized" = "NotDetermined",
+): Promise<{ status: "NotDetermined" | "Denied" | "Authorized" }> {
+  const state = { status: initialStatus };
+  const { registerPermissionAuthorizationProvider } =
+    await import("@dotli/ui/permissions");
+  registerPermissionAuthorizationProvider("myapp", {
+    async getPermissionAuthorizationStatuses(requests) {
+      return requests.map((request) =>
+        request.tag === "Device" && request.value === "Notifications"
+          ? state.status
+          : "NotDetermined",
+      );
+    },
+    async setPermissionAuthorizationStatus(request, status) {
+      if (request.tag === "Device" && request.value === "Notifications") {
+        state.status = status;
+      }
+    },
+  });
+  return state;
+}
+
+describe("notification host callbacks", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    localStorage.clear();
+    document.body.innerHTML = "";
+    mocks.scheduleNotification.mockResolvedValue({
+      ok: true,
+      id: 7,
+      immediate: true,
+    });
+    mocks.cancelNotification.mockResolvedValue(true);
+    mocks.showPermissionRequestModal.mockResolvedValue(undefined);
+  });
+
+  it("prompts for notification permission, schedules, fires immediate notifications, and returns ids", async () => {
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    const response = await pushNotification({
+      text: "hello",
+      deeplink: undefined,
+      scheduledAt: undefined,
+    });
+
+    expect(response).toEqual({ id: 7 });
+    expect(mocks.showPermissionRequestModal).toHaveBeenCalledWith(
+      "myapp",
+      "Notifications",
+    );
+    expect(mocks.scheduleNotification).toHaveBeenCalledWith({
+      productId: "myapp",
+      title: "myapp",
+      text: "hello",
+      deeplink: null,
+      scheduledAt: null,
+    });
+    expect(
+      [...document.querySelectorAll(".notif-body")].map((node) =>
+        node.textContent?.trim(),
+      ),
+    ).toEqual(["hello"]);
+  });
+
+  it("reuses granted permission and cancels through the shared scheduler", async () => {
+    await registerNotificationAuthorization("Authorized");
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification, cancelNotification } =
+      createNotificationAdapters("myapp");
+
+    await pushNotification({
+      text: "later",
+      deeplink: "dot://open",
+      scheduledAt: 123n,
+    });
+    await cancelNotification(7);
+
+    expect(mocks.showPermissionRequestModal).not.toHaveBeenCalled();
+    expect(mocks.scheduleNotification).toHaveBeenCalledWith({
+      productId: "myapp",
+      title: "myapp",
+      text: "later",
+      deeplink: "dot://open",
+      scheduledAt: 123,
+    });
+    expect(mocks.cancelNotification).toHaveBeenCalledWith("myapp", 7);
+  });
+
+  it("rejects when notification permission is denied", async () => {
+    const authorization = await registerNotificationAuthorization();
+    mocks.showPermissionRequestModal.mockRejectedValue(new Error("denied"));
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    await expect(
+      pushNotification({
+        text: "hello",
+        deeplink: undefined,
+        scheduledAt: undefined,
+      }),
+    ).rejects.toThrow("Notifications permission denied");
+
+    expect(mocks.scheduleNotification).not.toHaveBeenCalled();
+    expect(authorization.status).toBe("Denied");
+  });
+
+  it("reuses the shared blocked-permission path for stored notification denials", async () => {
+    await registerNotificationAuthorization("Denied");
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    await expect(
+      pushNotification({
+        text: "hello",
+        deeplink: undefined,
+        scheduledAt: undefined,
+      }),
+    ).rejects.toThrow("Notifications permission denied");
+
+    expect(mocks.showPermissionRequestModal).not.toHaveBeenCalled();
+    expect(mocks.scheduleNotification).not.toHaveBeenCalled();
+    expect(document.body.textContent).toContain(
+      "Notifications access is blocked. Use the permissions menu in the top bar to change this.",
+    );
+  });
+});
diff --git a/packages/ui/tests/nova-removal.test.ts b/packages/ui/tests/nova-removal.test.ts
new file mode 100644
index 0000000..9994dcb
--- /dev/null
+++ b/packages/ui/tests/nova-removal.test.ts
@@ -0,0 +1,70 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const repoRoot = resolve(import.meta.dirname, "../../..");
+const forbiddenPackages = [
+  "@novasamatech/host-api",
+  "@novasamatech/host-container",
+  "@novasamatech/host-papp",
+  "@novasamatech/scale",
+  "@novasamatech/sdk-statement",
+  "@novasamatech/statement-store",
+  "@novasamatech/storage-adapter",
+  "@novasamatech/substrate-slot-sr25519-wasm",
+] as const;
+
+async function collectFiles(
+  root: string,
+  shouldInclude: (path: string) => boolean,
+): Promise<string[]> {
+  const entries = await readdir(root, { withFileTypes: true });
+  const files = await Promise.all(
+    entries.map(async (entry) => {
+      const path = join(root, entry.name);
+      if (entry.isDirectory()) {
+        if (
+          entry.name === "dist" ||
+          entry.name === "node_modules" ||
+          entry.name === ".turbo" ||
+          entry.name === ".git"
+        ) {
+          return [];
+        }
+        return collectFiles(path, shouldInclude);
+      }
+      return shouldInclude(path) ? [path] : [];
+    }),
+  );
+
+  return files.flat();
+}
+
+describe("Nova host dependency removal", () => {
+  it("keeps runtime manifests, lockfile, and source free of Nova packages", async () => {
+    const manifestFiles = await collectFiles(repoRoot, (path) =>
+      path.endsWith("package.json"),
+    );
+    const sourceFiles = await collectFiles(repoRoot, (path) =>
+      /\/(apps|packages)\/[^/]+\/src\/.*\.[cm]?tsx?$/.test(path),
+    );
+    const files = [
+      ...manifestFiles,
+      join(repoRoot, "bun.lock"),
+      join(repoRoot, "THIRD_PARTY_NOTICES.md"),
+      ...sourceFiles,
+    ];
+
+    const violations: string[] = [];
+    for (const file of files) {
+      const content = await readFile(file, "utf8");
+      for (const packageName of forbiddenPackages) {
+        if (content.includes(packageName)) {
+          violations.push(`${relative(repoRoot, file)} imports ${packageName}`);
+        }
+      }
+    }
+
+    expect(violations).toEqual([]);
+  });
+});
diff --git a/packages/ui/tests/permissions.test.ts b/packages/ui/tests/permissions.test.ts
index 5c454c0..831013f 100644
--- a/packages/ui/tests/permissions.test.ts
+++ b/packages/ui/tests/permissions.test.ts
@@ -1,106 +1,158 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import {
   ALL_PERMISSIONS,
   AUTO_GRANT_DEVICE_PERMISSIONS,
   DEVICE_PERMISSION_POLICY,
   buildAllowAttribute,
   getGrantedDevicePermissions,
+  getPermissionStatuses,
   getPermissionStatus,
   hasAnyGrant,
   isDevicePermission,
   isEnforceableDevicePermission,
+  registerPermissionAuthorizationProvider,
   resetPermission,
   setPermissionStatus,
 } from "@dotli/ui/permissions";
+import type {
+  PermissionAuthorizationRequest,
+  PermissionAuthorizationStatus,
+} from "@parity/truapi-host-wasm";
+
+type Store = Map<string, PermissionAuthorizationStatus>;
+
+let unregisterMyapp: (() => void) | null = null;
+let myappStore: Store;
+let myappBatchReads = 0;
 
 beforeEach(() => {
-  localStorage.clear();
+  myappStore = new Map();
+  myappBatchReads = 0;
+  unregisterMyapp = registerTestProvider("myapp", myappStore);
 });
 
-describe("getPermissionStatus / setPermissionStatus", () => {
-  it("returns 'ask' by default", () => {
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("ask");
-  });
+afterEach(() => {
+  unregisterMyapp?.();
+  unregisterMyapp = null;
+});
 
-  it("round-trips a granted status", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("granted");
+function registerTestProvider(label: string, store: Store): () => void {
+  return registerPermissionAuthorizationProvider(label, {
+    async getPermissionAuthorizationStatuses(requests) {
+      if (label === "myapp") {
+        myappBatchReads += 1;
+      }
+      return requests.map(
+        (request) => store.get(requestKey(request)) ?? "NotDetermined",
+      );
+    },
+    async setPermissionAuthorizationStatus(request, status) {
+      const key = requestKey(request);
+      if (status === "NotDetermined") {
+        store.delete(key);
+      } else {
+        store.set(key, status);
+      }
+    },
   });
+}
 
-  it("round-trips a denied status", () => {
-    setPermissionStatus("myapp", "ChainSubmit", "denied");
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("denied");
+function requestKey(request: PermissionAuthorizationRequest): string {
+  switch (request.tag) {
+    case "Device":
+      return `Device:${request.value}`;
+    case "Remote":
+      return `Remote:${request.value.permission.tag}`;
+  }
+}
+
+describe("getPermissionStatus / setPermissionStatus", () => {
+  it("returns 'ask' by default", async () => {
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("ask");
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("ask");
   });
 
-  it("persists across a reload (raw localStorage shape)", () => {
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
-    setPermissionStatus("myapp", "Camera", "denied");
+  it("round-trips a granted status", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("granted");
+  });
 
-    // What a reloaded tab would observe directly in localStorage.
-    const raw = localStorage.getItem("dotli:permissions:myapp");
-    expect(raw).not.toBeNull();
-    expect(JSON.parse(raw as string)).toEqual({
-      ChainSubmit: "granted",
-      Camera: "denied",
-    });
+  it("round-trips a denied status", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "denied");
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("denied");
+  });
 
-    // And the public API surfaces those values without any priming.
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("denied");
+  it("uses the core-backed authorization store", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "Camera", "denied");
+
+    expect(myappStore).toEqual(
+      new Map([
+        ["Remote:ChainSubmit", "Authorized"],
+        ["Device:Camera", "Denied"],
+      ]),
+    );
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("denied");
   });
 
-  it("isolates grants per product label", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    expect(getPermissionStatus("otherapp", "Camera")).toBe("ask");
+  it("reads multiple statuses in one provider call", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "Camera", "denied");
+    const callsBeforeRead = myappBatchReads;
+
+    await expect(
+      getPermissionStatuses("myapp", ["ChainSubmit", "Camera", "Microphone"]),
+    ).resolves.toEqual(["granted", "denied", "ask"]);
+    expect(myappBatchReads - callsBeforeRead).toBe(1);
   });
 
-  it("falls back to 'ask' when localStorage holds malformed JSON", () => {
-    localStorage.setItem("dotli:permissions:myapp", "{ not json");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
+  it("isolates grants per product label", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    expect(await getPermissionStatus("otherapp", "Camera")).toBe("ask");
   });
 });
 
 describe("resetPermission", () => {
-  it("removes one entry without affecting others on the same label", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
+  it("removes one entry without affecting others on the same label", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
 
-    resetPermission("myapp", "Camera");
+    await resetPermission("myapp", "Camera");
 
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("ask");
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
   });
 
-  it("is a no-op for unknown entries", () => {
-    resetPermission("myapp", "Camera");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
+  it("is a no-op for unknown entries", async () => {
+    await resetPermission("myapp", "Camera");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("ask");
   });
 });
 
 describe("hasAnyGrant", () => {
-  it("returns false for a fresh label", () => {
-    expect(hasAnyGrant("myapp")).toBe(false);
+  it("returns false for a fresh label", async () => {
+    expect(await hasAnyGrant("myapp")).toBe(false);
   });
 
-  it("returns true after any grant", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    expect(hasAnyGrant("myapp")).toBe(true);
+  it("returns true after any grant", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    expect(await hasAnyGrant("myapp")).toBe(true);
   });
 
-  it("returns false when only denials exist", () => {
-    setPermissionStatus("myapp", "Camera", "denied");
-    setPermissionStatus("myapp", "ChainSubmit", "denied");
-    expect(hasAnyGrant("myapp")).toBe(false);
+  it("returns false when only denials exist", async () => {
+    await setPermissionStatus("myapp", "Camera", "denied");
+    await setPermissionStatus("myapp", "ChainSubmit", "denied");
+    expect(await hasAnyGrant("myapp")).toBe(false);
   });
 
-  it("returns false again after the only grant is reset", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    resetPermission("myapp", "Camera");
-    expect(hasAnyGrant("myapp")).toBe(false);
+  it("returns false again after the only grant is reset", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await resetPermission("myapp", "Camera");
+    expect(await hasAnyGrant("myapp")).toBe(false);
   });
 });
 
@@ -135,6 +187,7 @@ describe("isEnforceableDevicePermission", () => {
   });
 
   it("accepts gateable device permissions", () => {
+    expect(isEnforceableDevicePermission("Notifications")).toBe(true);
     expect(isEnforceableDevicePermission("Camera")).toBe(true);
     expect(isEnforceableDevicePermission("Microphone")).toBe(true);
     expect(isEnforceableDevicePermission("Notifications")).toBe(true);
@@ -142,39 +195,39 @@ describe("isEnforceableDevicePermission", () => {
 });
 
 describe("getGrantedDevicePermissions", () => {
-  it("returns only granted device permissions, ignoring submit-style grants", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    setPermissionStatus("myapp", "Microphone", "denied");
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
+  it("returns only granted device permissions, ignoring submit-style grants", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await setPermissionStatus("myapp", "Microphone", "denied");
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
 
-    expect(getGrantedDevicePermissions("myapp")).toEqual(["Camera"]);
+    expect(await getGrantedDevicePermissions("myapp")).toEqual(["Camera"]);
   });
 
-  it("returns an empty array when only submit-style grants exist", () => {
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
-    setPermissionStatus("myapp", "PreimageSubmit", "granted");
-    expect(getGrantedDevicePermissions("myapp")).toEqual([]);
+  it("returns an empty array when only submit-style grants exist", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "PreimageSubmit", "granted");
+    expect(await getGrantedDevicePermissions("myapp")).toEqual([]);
   });
 });
 
 describe("buildAllowAttribute", () => {
-  it("always includes clipboard-write", () => {
-    expect(buildAllowAttribute("myapp")).toBe("clipboard-write");
+  it("always includes clipboard-write", async () => {
+    expect(await buildAllowAttribute("myapp")).toBe("clipboard-write");
   });
 
-  it("appends Permissions Policy directives for granted device permissions", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    setPermissionStatus("myapp", "Microphone", "granted");
+  it("appends Permissions Policy directives for granted device permissions", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await setPermissionStatus("myapp", "Microphone", "granted");
 
     // Order follows JSON insertion order, so assert on the directive set.
-    const directives = buildAllowAttribute("myapp").split("; ").sort();
+    const directives = (await buildAllowAttribute("myapp")).split("; ").sort();
     expect(directives).toEqual(["camera", "clipboard-write", "microphone"]);
   });
 
-  it("excludes denied device permissions and submit-style grants", () => {
-    setPermissionStatus("myapp", "Camera", "denied");
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
-    expect(buildAllowAttribute("myapp")).toBe("clipboard-write");
+  it("excludes denied device permissions and submit-style grants", async () => {
+    await setPermissionStatus("myapp", "Camera", "denied");
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    expect(await buildAllowAttribute("myapp")).toBe("clipboard-write");
   });
 });
 
@@ -190,32 +243,9 @@ describe("ALL_PERMISSIONS (data invariants)", () => {
     expect(names).toContain("ChainSubmit");
     expect(names).toContain("PreimageSubmit");
     expect(names).toContain("StatementSubmit");
+    expect(names).toContain("Notifications");
     expect(names).not.toContain("TransactionSubmit");
   });
-
-  it("exposes the GetUserId gate with its display label", () => {
-    expect(ALL_PERMISSIONS).toContainEqual({
-      name: "GetUserId",
-      label: "Reveal Username",
-    });
-  });
-});
-
-describe("GetUserId permission (RFC-0015 username disclosure gate)", () => {
-  it("defaults to 'ask' and round-trips granted/denied", () => {
-    expect(getPermissionStatus("myapp", "GetUserId")).toBe("ask");
-    setPermissionStatus("myapp", "GetUserId", "granted");
-    expect(getPermissionStatus("myapp", "GetUserId")).toBe("granted");
-    setPermissionStatus("myapp", "GetUserId", "denied");
-    expect(getPermissionStatus("myapp", "GetUserId")).toBe("denied");
-  });
-
-  it("is not a device permission and never alters the iframe allow attribute", () => {
-    expect(isDevicePermission("GetUserId")).toBe(false);
-    setPermissionStatus("myapp", "GetUserId", "granted");
-    expect(getGrantedDevicePermissions("myapp")).toEqual([]);
-    expect(buildAllowAttribute("myapp")).toBe("clipboard-write");
-  });
 });
 
 describe("DEVICE_PERMISSION_POLICY (sanity)", () => {
diff --git a/packages/ui/tests/preimage.test.ts b/packages/ui/tests/preimage.test.ts
new file mode 100644
index 0000000..1e61873
--- /dev/null
+++ b/packages/ui/tests/preimage.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it, vi } from "vitest";
+import { createPreimageAdapters } from "@dotli/ui/host-callbacks/Preimage";
+import { submitPreimageRemote } from "@dotli/protocol/client";
+
+vi.mock("@dotli/protocol/client", () => ({
+  submitPreimageRemote: vi.fn(async () => undefined),
+}));
+
+describe("preimage host callbacks", () => {
+  it("emits a miss immediately for an uncached lookup", async () => {
+    const { lookupPreimage } = createPreimageAdapters("myapp");
+    const missingKey = new Uint8Array(32);
+
+    const iterator = lookupPreimage(missingKey)[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    await iterator.return?.();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(first.value._unsafeUnwrap()).toBeUndefined();
+  });
+
+  it("emits a cached preimage immediately after submit", async () => {
+    const { submitPreimage, lookupPreimage } = createPreimageAdapters("myapp");
+    const preimage = new Uint8Array([1, 2, 3, 4]);
+
+    const key = await submitPreimage(preimage);
+
+    expect(submitPreimageRemote).toHaveBeenCalledWith(preimage);
+
+    const iterator = lookupPreimage(key)[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    await iterator.return?.();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(Array.from(first.value._unsafeUnwrap() ?? [])).toEqual([
+      1, 2, 3, 4,
+    ]);
+  });
+});
diff --git a/packages/ui/tests/runtime-config.test.ts b/packages/ui/tests/runtime-config.test.ts
new file mode 100644
index 0000000..5c45795
--- /dev/null
+++ b/packages/ui/tests/runtime-config.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vitest";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import {
+  createTruapiRuntimeConfig,
+  labelToProductId,
+} from "@dotli/ui/runtime-config";
+
+describe("labelToProductId", () => {
+  it("maps dotli labels to .dot product ids", () => {
+    expect(labelToProductId("acme")).toBe("acme.dot");
+  });
+
+  it("keeps localhost labels stable", () => {
+    expect(labelToProductId("localhost:5174")).toBe("localhost:5174");
+  });
+});
+
+describe("createTruapiRuntimeConfig", () => {
+  it("accepts an explicit product id for local previews", () => {
+    expect(
+      createTruapiRuntimeConfig(
+        "localhost:3000",
+        {
+          origin: "http://localhost:5173",
+        } as Location,
+        "truapi-playground.dot",
+      ).productId,
+    ).toBe("truapi-playground.dot");
+  });
+
+  it("passes the full host runtime contract to the WASM core", () => {
+    expect(
+      createTruapiRuntimeConfig("acme", {
+        hostname: "host.dot.li",
+        origin: "https://host.dot.li",
+      } as Location),
+    ).toEqual({
+      productId: "acme.dot",
+      host: {
+        name: "Polkadot Web",
+        icon: undefined,
+        version: undefined,
+      },
+      platform: {
+        type: expect.any(String),
+        version: undefined,
+      },
+      people: {
+        genesisHash: getActiveServicesConfig().people.genesis,
+      },
+      pairing: {
+        deeplinkScheme: "polkadotapp",
+      },
+    });
+  });
+
+  it("leaves host icon unset when the host runs on localhost", () => {
+    expect(
+      createTruapiRuntimeConfig("localhost:3000", {
+        origin: "http://localhost:5173",
+      } as Location).host.icon,
+    ).toBeUndefined();
+  });
+});
diff --git a/packages/ui/tests/session-store.test.ts b/packages/ui/tests/session-store.test.ts
new file mode 100644
index 0000000..976ce8d
--- /dev/null
+++ b/packages/ui/tests/session-store.test.ts
@@ -0,0 +1,294 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { SHARED_CORE_SESSION_KEY } from "@dotli/protocol/auth-storage";
+import { SITE_ID } from "@dotli/config/config";
+import {
+  createSessionStoreAdapters,
+  emitPersistedSessionUiState,
+  onStoredSessionChanged,
+} from "@dotli/ui/host-callbacks/SessionStore";
+import { createAuthStateChanged } from "@dotli/ui/host-callbacks/AuthState";
+import type { CoreStorageKey } from "@parity/truapi-host-wasm";
+
+const sharedAuth = vi.hoisted(() => ({
+  storage: new Map<string, string>(),
+  listeners: new Set<
+    (change: { siteId: string; key: string; value: string | null }) => void
+  >(),
+}));
+
+vi.mock("@dotli/protocol/client", () => ({
+  readSharedAuthStorage: async (siteId: string, key: string) => {
+    return sharedAuth.storage.get(`${siteId}:${key}`) ?? null;
+  },
+  writeSharedAuthStorage: async (
+    siteId: string,
+    key: string,
+    value: string,
+  ) => {
+    sharedAuth.storage.set(`${siteId}:${key}`, value);
+  },
+  clearSharedAuthStorage: async (siteId: string, key: string) => {
+    sharedAuth.storage.delete(`${siteId}:${key}`);
+  },
+  subscribeSharedAuthStorage: (
+    listener: (change: {
+      siteId: string;
+      key: string;
+      value: string | null;
+    }) => void,
+  ) => {
+    sharedAuth.listeners.add(listener);
+    return () => {
+      sharedAuth.listeners.delete(listener);
+    };
+  },
+}));
+
+const STORAGE_KEY = `${SITE_ID}:${SHARED_CORE_SESSION_KEY}`;
+const UI_STATE_CACHE_KEY = `${SITE_ID}:${SHARED_CORE_SESSION_KEY}:ui-state`;
+const AUTH_SESSION_KEY = { tag: "AuthSession" as const };
+
+async function flushMicrotasks(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+function connectedSessionUiInfo() {
+  return {
+    publicKey: new Uint8Array(Array.from({ length: 32 }, (_, i) => i)),
+    identityAccountId: new Uint8Array(
+      Array.from({ length: 32 }, (_, i) => 0xa0 + i),
+    ),
+    liteUsername: "pgherveou.04",
+  };
+}
+
+const CONNECTED_DETAIL = {
+  connected: true,
+  publicKey:
+    "0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+  identityAccountId:
+    "0xa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebf",
+  liteUsername: "pgherveou.04",
+  primaryUsername: "pgherveou.04",
+};
+
+describe("session-store host callbacks", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    sharedAuth.storage.clear();
+    sharedAuth.listeners.clear();
+    vi.restoreAllMocks();
+  });
+
+  it("round-trips the host core session blob", async () => {
+    const { readCoreStorage, writeCoreStorage, clearCoreStorage } =
+      createSessionStoreAdapters();
+
+    expect(await readCoreStorage(AUTH_SESSION_KEY)).toBeUndefined();
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([1, 2, 3]));
+    expect(sharedAuth.storage.get(STORAGE_KEY)).toBe("0x010203");
+    expect(localStorage.length).toBe(0);
+    expect(Array.from((await readCoreStorage(AUTH_SESSION_KEY)) ?? [])).toEqual(
+      [1, 2, 3],
+    );
+
+    await clearCoreStorage(AUTH_SESSION_KEY);
+    expect(sharedAuth.storage.get(STORAGE_KEY)).toBeUndefined();
+    expect(await readCoreStorage(AUTH_SESSION_KEY)).toBeUndefined();
+  });
+
+  it("round-trips permission authorization slots from typed core keys", async () => {
+    const { readCoreStorage, writeCoreStorage, clearCoreStorage } =
+      createSessionStoreAdapters();
+    const key = {
+      tag: "PermissionAuthorization",
+      value: {
+        productId: "My App",
+        request: { tag: "Device", value: "OpenUrl" },
+      },
+    } satisfies CoreStorageKey;
+
+    await writeCoreStorage(key, new Uint8Array([4]));
+
+    expect(localStorage.length).toBe(1);
+    const storageKey = localStorage.key(0);
+    expect(storageKey).toMatch(/^dotli:core:permission:[0-9a-f]+$/);
+    expect(storageKey).not.toContain("open-url");
+    expect(localStorage.getItem(storageKey ?? "")).toBe("0x04");
+    expect(Array.from((await readCoreStorage(key)) ?? [])).toEqual([4]);
+
+    await clearCoreStorage(key);
+    expect(await readCoreStorage(key)).toBeUndefined();
+  });
+
+  it("keeps remote permission authorization keys opaque", async () => {
+    const { readCoreStorage, writeCoreStorage } = createSessionStoreAdapters();
+    const key = {
+      tag: "PermissionAuthorization",
+      value: {
+        productId: "myapp",
+        request: {
+          tag: "Remote",
+          value: {
+            permission: {
+              tag: "Remote",
+              value: { domains: ["B.example", "a.example", "b.example"] },
+            },
+          },
+        },
+      },
+    } satisfies CoreStorageKey;
+
+    await writeCoreStorage(key, new Uint8Array([7]));
+
+    const storageKey = localStorage.key(0);
+    expect(storageKey).toMatch(/^dotli:core:permission:[0-9a-f]+$/);
+    expect(storageKey).not.toContain("example");
+    expect(Array.from((await readCoreStorage(key)) ?? [])).toEqual([7]);
+    expect(localStorage.length).toBe(1);
+  });
+
+  it("emits the typed session identity details from a connected auth state", () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+
+    expect(events).toEqual([{ tag: "Connected", session: CONNECTED_DETAIL }]);
+  });
+
+  it("dispatches the pairing presentation with its host context", () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web", {
+      dotSuffix: false,
+      hostGlobal: true,
+    });
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    authStateChanged?.({
+      tag: "Pairing",
+      value: { deeplink: "polkadotapp://pair?handshake=test" },
+    });
+
+    expect(events).toEqual([
+      {
+        tag: "Pairing",
+        deeplink: "polkadotapp://pair?handshake=test",
+        label: "Polkadot Web",
+        dotSuffix: false,
+        hostGlobal: true,
+      },
+    ]);
+  });
+
+  it("caches the connected UI state and clears it with the session", async () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+    const { clearCoreStorage } = createSessionStoreAdapters();
+
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+    await flushMicrotasks();
+    expect(
+      JSON.parse(sharedAuth.storage.get(UI_STATE_CACHE_KEY) ?? ""),
+    ).toEqual(CONNECTED_DETAIL);
+
+    await clearCoreStorage(AUTH_SESSION_KEY);
+    expect(sharedAuth.storage.get(UI_STATE_CACHE_KEY)).toBeUndefined();
+  });
+
+  it("clears the cached UI state on a disconnected auth state", async () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+    await flushMicrotasks();
+    expect(sharedAuth.storage.get(UI_STATE_CACHE_KEY)).toBeDefined();
+
+    authStateChanged?.({ tag: "Disconnected" });
+    await flushMicrotasks();
+    expect(sharedAuth.storage.get(UI_STATE_CACHE_KEY)).toBeUndefined();
+  });
+
+  it("rehydrates the cached session UI state", async () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+    const { writeCoreStorage } = createSessionStoreAdapters();
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    // Nothing persisted: nothing emitted, even with a stale cache entry.
+    sharedAuth.storage.set(
+      UI_STATE_CACHE_KEY,
+      JSON.stringify(CONNECTED_DETAIL),
+    );
+    emitPersistedSessionUiState();
+    await flushMicrotasks();
+    expect(events).toEqual([]);
+    sharedAuth.storage.delete(UI_STATE_CACHE_KEY);
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([1, 2, 3]));
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+    await flushMicrotasks();
+    events.length = 0;
+
+    emitPersistedSessionUiState();
+    await flushMicrotasks();
+    expect(events).toEqual([{ tag: "Connected", session: CONNECTED_DETAIL }]);
+  });
+
+  it("rehydrates a bare connected state when no cache exists", async () => {
+    const { writeCoreStorage } = createSessionStoreAdapters();
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([1, 2, 3]));
+    emitPersistedSessionUiState();
+    await flushMicrotasks();
+
+    expect(events).toEqual([
+      { tag: "Connected", session: { connected: true } },
+    ]);
+  });
+
+  it("notifies local and matching storage changes", async () => {
+    const { writeCoreStorage } = createSessionStoreAdapters();
+    const listener = vi.fn();
+    const unsubscribe = onStoredSessionChanged(listener);
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([9]));
+    expect(listener).toHaveBeenCalledTimes(1);
+
+    for (const sharedListener of sharedAuth.listeners) {
+      sharedListener({
+        siteId: SITE_ID,
+        key: SHARED_CORE_SESSION_KEY,
+        value: "0x09",
+      });
+    }
+    expect(listener).toHaveBeenCalledTimes(2);
+
+    unsubscribe();
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([8]));
+    expect(listener).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/packages/ui/tests/theme.test.ts b/packages/ui/tests/theme.test.ts
new file mode 100644
index 0000000..b3c9933
--- /dev/null
+++ b/packages/ui/tests/theme.test.ts
@@ -0,0 +1,45 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { createThemeSubscribe } from "@dotli/ui/host-callbacks/Theme";
+
+describe("theme host callbacks", () => {
+  beforeEach(() => {
+    document.documentElement.removeAttribute("data-theme");
+  });
+
+  it("emits the current theme immediately", async () => {
+    document.documentElement.setAttribute("data-theme", "light");
+    const subscribeTheme = createThemeSubscribe();
+
+    const iterator = subscribeTheme()[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    await iterator.return?.();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(first.value._unsafeUnwrap()).toBe("Light");
+  });
+
+  it("emits theme changes until unsubscribed", async () => {
+    document.documentElement.setAttribute("data-theme", "dark");
+    const subscribeTheme = createThemeSubscribe();
+
+    const iterator = subscribeTheme()[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    const next = iterator.next();
+
+    document.documentElement.setAttribute("data-theme", "light");
+    window.dispatchEvent(new Event("dotli:theme-changed"));
+    const changed = await next;
+
+    await iterator.return?.();
+    const afterReturn = await iterator.next();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(first.value._unsafeUnwrap()).toBe("Dark");
+    expect(changed.done).toBe(false);
+    expect(changed.value.isOk()).toBe(true);
+    expect(changed.value._unsafeUnwrap()).toBe("Light");
+    expect(afterReturn.done).toBe(true);
+  });
+});
diff --git a/packages/ui/tests/topbar.test.ts b/packages/ui/tests/topbar.test.ts
new file mode 100644
index 0000000..ac2f584
--- /dev/null
+++ b/packages/ui/tests/topbar.test.ts
@@ -0,0 +1,441 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const sharedAuth = vi.hoisted(() => ({
+  storage: new Map<string, string>(),
+  listeners: new Set<
+    (change: { siteId: string; key: string; value: string | null }) => void
+  >(),
+}));
+
+vi.mock("@dotli/protocol/client", () => ({
+  readSharedAuthStorage: async (siteId: string, key: string) => {
+    return sharedAuth.storage.get(`${siteId}:${key}`) ?? null;
+  },
+  writeSharedAuthStorage: async (
+    siteId: string,
+    key: string,
+    value: string,
+  ) => {
+    sharedAuth.storage.set(`${siteId}:${key}`, value);
+  },
+  clearSharedAuthStorage: async (siteId: string, key: string) => {
+    sharedAuth.storage.delete(`${siteId}:${key}`);
+  },
+  subscribeSharedAuthStorage: (
+    listener: (change: {
+      siteId: string;
+      key: string;
+      value: string | null;
+    }) => void,
+  ) => {
+    sharedAuth.listeners.add(listener);
+    return () => {
+      sharedAuth.listeners.delete(listener);
+    };
+  },
+}));
+
+async function flushMicrotasks(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+function installTopbarDom(): void {
+  document.body.innerHTML = `
+    <a id="topbar-home"></a>
+    <button id="auth-button" disabled></button>
+    <div id="auth-modal-backdrop">
+      <div id="auth-modal-title"></div>
+      <div id="auth-modal-qr"></div>
+      <div id="auth-modal-reason"></div>
+      <div id="auth-modal-hint"></div>
+      <button id="auth-modal-close"></button>
+    </div>
+    <div id="user-popover">
+      <span id="user-popover-username"></span>
+      <button id="user-popover-disconnect"></button>
+    </div>
+    <button id="theme-toggle"></button>
+    <span id="theme-icon-sun"></span>
+    <span id="theme-icon-moon"></span>
+    <button id="mode-button"></button>
+    <div id="mode-popover"><div id="mode-popover-content"></div></div>
+    <div id="mode-popover-backdrop"></div>
+    <button id="permissions-button"></button>
+    <div id="permissions-popover"><div id="permissions-popover-list"></div></div>
+    <div id="permissions-popover-backdrop"></div>
+  `;
+}
+
+beforeEach(() => {
+  vi.resetModules();
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+  localStorage.clear();
+  sharedAuth.storage.clear();
+  sharedAuth.listeners.clear();
+  document.body.innerHTML = "";
+});
+
+describe("topbar disconnect", () => {
+  it("emits the Rust-core disconnect request", async () => {
+    const { requestTruapiDisconnect } = await import("@dotli/ui/topbar");
+    let requests = 0;
+    window.addEventListener(
+      "dotli:truapi-disconnect-request",
+      () => {
+        requests += 1;
+      },
+      { once: true },
+    );
+
+    requestTruapiDisconnect();
+
+    expect(requests).toBe(1);
+  });
+
+  it("routes the disconnect button through the Rust-core event path", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    let requests = 0;
+    window.addEventListener("dotli:truapi-disconnect-request", () => {
+      requests += 1;
+    });
+
+    initTopBar();
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: { tag: "Connected", session: { connected: true } },
+      }),
+    );
+
+    document.getElementById("auth-button")?.click();
+    expect(
+      document.getElementById("user-popover")?.classList.contains("open"),
+    ).toBe(true);
+
+    document.getElementById("user-popover-disconnect")?.click();
+
+    expect(requests).toBe(1);
+    expect(
+      document.getElementById("user-popover")?.classList.contains("open"),
+    ).toBe(false);
+  });
+
+  it("renders the connected username from the Rust-core auth state", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Connected",
+          session: {
+            connected: true,
+            publicKey:
+              "0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+            liteUsername: "pgherveou.04",
+            primaryUsername: "pgherveou.04",
+          },
+        },
+      }),
+    );
+
+    expect(document.getElementById("auth-button")?.textContent).toBe("PG");
+    expect(document.getElementById("user-popover-username")?.textContent).toBe(
+      "pgherveou.04",
+    );
+  });
+});
+
+describe("topbar login cancellation", () => {
+  it("opens host-global login from the topbar even when a product is loaded", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    const loginRequests: unknown[] = [];
+    window.addEventListener("dotli:truapi-login-request", (event) => {
+      loginRequests.push((event as CustomEvent).detail);
+    });
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:product-loaded", {
+        detail: { label: "localhost:3000" },
+      }),
+    );
+    document.getElementById("auth-button")?.click();
+
+    expect(document.getElementById("auth-modal-title")?.textContent).toBe(
+      "Login with Polkadot Mobile",
+    );
+    expect(loginRequests).toEqual([{ reason: undefined }]);
+  });
+
+  it("emits a login request on the first auth button click", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    const loginRequests: unknown[] = [];
+    window.addEventListener("dotli:truapi-login-request", (event) => {
+      loginRequests.push((event as CustomEvent).detail);
+    });
+    initTopBar();
+
+    (
+      window as typeof window & { __dotliTruapiBridgeReady?: boolean }
+    ).__dotliTruapiBridgeReady = true;
+    expect(
+      document.getElementById("auth-button")?.hasAttribute("disabled"),
+    ).toBe(false);
+    document.getElementById("auth-button")?.click();
+
+    expect(loginRequests).toEqual([{ reason: undefined }]);
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(true);
+  });
+
+  it("keeps the pairing modal open through an unrelated disconnected state", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "Polkadot Web",
+          dotSuffix: false,
+          hostGlobal: true,
+        },
+      }),
+    );
+    // A bare disconnected state (e.g. a product core clearing its session)
+    // must only update the badge, never tear down the pairing modal.
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: { tag: "Disconnected" },
+      }),
+    );
+
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(true);
+  });
+
+  it("keeps landing pairing presentation host-global", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "Polkadot Web",
+          dotSuffix: false,
+          hostGlobal: true,
+        },
+      }),
+    );
+
+    expect(document.getElementById("auth-modal-title")?.textContent).toBe(
+      "Login with Polkadot Mobile",
+    );
+  });
+
+  it("cancels the in-flight login when the user closes the pairing modal", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+    let cancels = 0;
+    window.addEventListener("dotli:truapi-cancel-login", () => {
+      cancels += 1;
+    });
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "localhost:3000",
+        },
+      }),
+    );
+    document.getElementById("auth-modal-close")?.click();
+
+    expect(cancels).toBe(1);
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(false);
+    expect(document.getElementById("auth-modal-qr")?.children).toHaveLength(0);
+  });
+
+  it("closes the pairing modal when the session connects", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+    let cancels = 0;
+    window.addEventListener("dotli:truapi-cancel-login", () => {
+      cancels += 1;
+    });
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "localhost:3000",
+        },
+      }),
+    );
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Connected",
+          session: { connected: true, liteUsername: "pgherveou.04" },
+        },
+      }),
+    );
+
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(false);
+    expect(cancels).toBe(0);
+    expect(document.getElementById("auth-button")?.textContent).toBe("PG");
+  });
+
+  it("keeps the retry view for login failures", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:product-loaded", {
+        detail: { label: "localhost:3000" },
+      }),
+    );
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: { tag: "LoginFailed", reason: "Host failure" },
+      }),
+    );
+
+    expect(document.getElementById("auth-modal-title")?.textContent).toBe(
+      "Login with Polkadot Mobile",
+    );
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(true);
+    expect(document.getElementById("auth-modal-qr")?.textContent).toContain(
+      "Retry",
+    );
+  });
+});
+
+describe("topbar boot rehydration", () => {
+  it("renders the persisted session badge on idle after init", async () => {
+    installTopbarDom();
+    vi.stubGlobal("requestIdleCallback", (callback: () => void): number => {
+      callback();
+      return 0;
+    });
+
+    const { SHARED_CORE_SESSION_KEY } =
+      await import("@dotli/protocol/auth-storage");
+    const { SITE_ID } = await import("@dotli/config/config");
+    // Opaque session blob plus the JSON UI-state cache the core-driven
+    // authStateChanged callback persists alongside it in shared auth storage.
+    sharedAuth.storage.set(`${SITE_ID}:${SHARED_CORE_SESSION_KEY}`, "0x0102");
+    sharedAuth.storage.set(
+      `${SITE_ID}:${SHARED_CORE_SESSION_KEY}:ui-state`,
+      JSON.stringify({
+        connected: true,
+        publicKey:
+          "0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+        liteUsername: "pgherveou.04",
+        primaryUsername: "pgherveou.04",
+      }),
+    );
+
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+    await flushMicrotasks();
+
+    expect(document.getElementById("auth-button")?.textContent).toBe("PG");
+    expect(document.getElementById("user-popover-username")?.textContent).toBe(
+      "pgherveou.04",
+    );
+  });
+
+  it("stays logged out when no session is persisted", async () => {
+    installTopbarDom();
+    vi.stubGlobal("requestIdleCallback", (callback: () => void): number => {
+      callback();
+      return 0;
+    });
+
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    expect(
+      document.getElementById("auth-button")?.querySelector(".user-badge"),
+    ).toBeNull();
+  });
+});
+
+describe("settings dependency list", () => {
+  it("lists current runtime packages without Novasama dependencies", async () => {
+    installTopbarDom();
+    vi.stubGlobal("__DOTLI_VERSION__", "0.5.0");
+    vi.stubGlobal("__SMOLDOT_VERSION__", "3.2.0");
+    vi.stubGlobal("__SMOLDOT_COMMIT__", "abcdef1234567890");
+    vi.stubGlobal("__POLKADOT_API_VERSION__", "2.1.6");
+    vi.stubGlobal("__POLKADOT_API_VERSIONS__", [
+      { name: "@polkadot-api/json-rpc-provider", version: "0.2.0" },
+    ]);
+    vi.stubGlobal("__PARITY_TRUAPI_VERSIONS__", [
+      { name: "@parity/truapi", version: "0.3.0" },
+      { name: "@parity/truapi-host-wasm", version: "0.1.0" },
+    ]);
+
+    const opened: string[] = [];
+    vi.spyOn(window, "open").mockImplementation((url?: string | URL) => {
+      opened.push(String(url));
+      return null;
+    });
+
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    document.getElementById("mode-button")?.click();
+
+    const content = document.getElementById("mode-popover-content");
+    expect(content?.textContent).toContain("@parity/truapi");
+    expect(content?.textContent).toContain("@parity/truapi-host-wasm");
+    expect(content?.textContent).not.toContain("@novasamatech");
+
+    Array.from(document.querySelectorAll("button"))
+      .find((button) => button.textContent === "Share diagnostic")
+      ?.click();
+    await flushMicrotasks();
+
+    expect(opened).toHaveLength(1);
+    const body = new URL(opened[0]!).searchParams.get("body") ?? "";
+    expect(body).toContain("@parity/truapi");
+    expect(body).toContain("@parity/truapi-host-wasm");
+    expect(body).not.toContain("@novasamatech");
+  });
+});
diff --git a/packages/ui/tests/user-confirmation.test.ts b/packages/ui/tests/user-confirmation.test.ts
new file mode 100644
index 0000000..9ee0464
--- /dev/null
+++ b/packages/ui/tests/user-confirmation.test.ts
@@ -0,0 +1,172 @@
+import type { HostCallbacks } from "@parity/truapi-host-wasm";
+import { afterEach, describe, expect, it } from "vitest";
+import { createUserConfirmationAdapters } from "@dotli/ui/host-callbacks/UserConfirmation";
+
+type UserConfirmationReview = Parameters<
+  Required<HostCallbacks>["confirmUserAction"]
+>[0];
+
+afterEach(() => {
+  document.body.replaceChildren();
+});
+
+function modalFields(): Record<string, string> {
+  return Object.fromEntries(
+    Array.from(document.querySelectorAll(".signing-field")).map((field) => {
+      const label = field.querySelector(".signing-field-label")?.textContent;
+      const value = field.querySelector(".signing-field-value")?.textContent;
+      return [label ?? "", value ?? ""];
+    }),
+  );
+}
+
+describe("user confirmation modal", () => {
+  it("renders legacy payload signing as structured transaction fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "SignPayload",
+      value: {
+        tag: "LegacyAccount",
+        value: {
+          signer:
+            "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+          payload: {
+            blockHash:
+              "0xd6eec26135305a8ad257a20d003357284c8aa03d0bdb2b357ab0a22371e11ef2",
+            blockNumber: "0x00000000",
+            era: "0x00",
+            genesisHash:
+              "0xbf0488dbe9daa1de1c08c5f743e26fdc2a4ecd74cf87dd1b4b1eeb99ae4ef19f",
+            method: "0x0000",
+            nonce: "0x00000000",
+            signedExtensions: [],
+            specVersion: "0x00000000",
+            tip: "0x00000000000000000000000000000000",
+            transactionVersion: "0x00000000",
+            version: 4,
+          },
+        },
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Sign Transaction",
+    );
+    expect(modalFields()).toEqual({
+      App: "localhost:3000",
+      Signer:
+        "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+      "Genesis Hash":
+        "0xbf0488dbe9daa1de1c08c5f743e26fdc2a4ecd74cf87dd1b4b1eeb99ae4ef19f",
+      "Call Data": "0x0000",
+      Version: "4",
+    });
+    expect(document.body.textContent).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders legacy raw signing as structured sign-message fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "SignRaw",
+      value: {
+        tag: "LegacyAccount",
+        value: {
+          signer:
+            "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+          payload: {
+            tag: "Bytes",
+            value: { bytes: "0x48656c6c6f2c20776f726c6421" },
+          },
+        },
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Sign Message",
+    );
+    expect(modalFields()).toEqual({
+      App: "localhost:3000",
+      Signer:
+        "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+      Message: "0x48656c6c6f2c20776f726c6421",
+    });
+    expect(document.body.textContent).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders resource allocation as structured resource fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "ResourceAllocation",
+      value: {
+        resources: [
+          { tag: "StatementStoreAllowance" },
+          { tag: "AutoSigning" },
+        ],
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Resource Allocation",
+    );
+    const fields = modalFields();
+    expect(fields).toEqual({
+      Resources: "StatementStoreAllowance, AutoSigning",
+    });
+    expect(Object.keys(fields)).not.toContain("Application");
+    expect(Object.keys(fields)).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders account alias permission as structured product fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "AccountAlias",
+      value: {
+        requestingProductId: "truapi-playground.dot",
+        targetProductId: "truapix-playground.dot",
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Alias Permission",
+    );
+    const fields = modalFields();
+    expect(fields).toEqual({
+      "Requesting product": "truapi-playground.dot",
+      "Requested context": "truapix-playground.dot",
+    });
+    expect(
+      document.querySelector<HTMLButtonElement>(".signing-btn-cancel")
+        ?.textContent,
+    ).toBe("Deny");
+    expect(Object.keys(fields)).not.toContain("Application");
+    expect(Object.keys(fields)).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+});
diff --git a/packages/ui/tests/wallet-queue.test.ts b/packages/ui/tests/wallet-queue.test.ts
deleted file mode 100644
index f1069a6..0000000
--- a/packages/ui/tests/wallet-queue.test.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { describe, expect, it } from "vitest";
-import { errAsync, okAsync } from "neverthrow";
-import { createWalletFlowQueue } from "@dotli/ui/wallet-queue";
-
-const wait = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-describe("createWalletFlowQueue", () => {
-  it("preserves call order even when later thunks resolve faster", async () => {
-    const queue = createWalletFlowQueue();
-    const order: string[] = [];
-
-    const first = queue<string, never>(() =>
-      okAsync(undefined).map(async () => {
-        await wait(30);
-        order.push("first");
-        return "first";
-      }),
-    );
-    const second = queue<string, never>(() =>
-      okAsync(undefined).map(() => {
-        order.push("second");
-        return "second";
-      }),
-    );
-
-    const [r1, r2] = await Promise.all([first, second]);
-    expect(r1.isOk() && r1.value).toBe("first");
-    expect(r2.isOk() && r2.value).toBe("second");
-    expect(order).toEqual(["first", "second"]);
-  });
-
-  it("does not break the chain when a thunk returns errAsync", async () => {
-    const queue = createWalletFlowQueue();
-    const order: string[] = [];
-
-    const failing = queue<string, string>(() => {
-      order.push("failing");
-      return errAsync("boom");
-    });
-    const followUp = queue<string, never>(() => {
-      order.push("followUp");
-      return okAsync("ok");
-    });
-
-    const r1 = await failing;
-    const r2 = await followUp;
-
-    expect(r1.isErr() && r1.error).toBe("boom");
-    expect(r2.isOk() && r2.value).toBe("ok");
-    expect(order).toEqual(["failing", "followUp"]);
-  });
-
-  it("surfaces the original error type to the caller", async () => {
-    const queue = createWalletFlowQueue();
-    type MyErr = { kind: "my-err"; reason: string };
-    const myErr: MyErr = { kind: "my-err", reason: "nope" };
-
-    const r = await queue<never, MyErr>(() => errAsync(myErr));
-    expect(r.isErr()).toBe(true);
-    if (r.isErr()) {
-      expect(r.error).toEqual(myErr);
-    }
-  });
-
-  it("serializes many concurrent calls in FIFO order", async () => {
-    const queue = createWalletFlowQueue();
-    const order: number[] = [];
-
-    const tasks = Array.from({ length: 5 }, (_, i) =>
-      queue<number, never>(() =>
-        okAsync(undefined).map(async () => {
-          // Earlier tasks wait longer so a non-serialized impl would reorder.
-          await wait(20 - i * 3);
-          order.push(i);
-          return i;
-        }),
-      ),
-    );
-
-    const results = await Promise.all(tasks);
-    expect(results.map((r) => r.isOk() && r.value)).toEqual([0, 1, 2, 3, 4]);
-    expect(order).toEqual([0, 1, 2, 3, 4]);
-  });
-
-  it("isolates state across queue instances", async () => {
-    const a = createWalletFlowQueue();
-    const b = createWalletFlowQueue();
-    const order: string[] = [];
-
-    const slowOnA = a<string, never>(() =>
-      okAsync(undefined).map(async () => {
-        await wait(20);
-        order.push("a");
-        return "a";
-      }),
-    );
-    const fastOnB = b<string, never>(() =>
-      okAsync(undefined).map(() => {
-        order.push("b");
-        return "b";
-      }),
-    );
-
-    await Promise.all([slowOnA, fastOnB]);
-    // Independent queues, so fast B finishes before slow A despite later call.
-    expect(order).toEqual(["b", "a"]);
-  });
-});