Port the dot.li web host to the shared TrUAPI Rust core

MIGRATION.md

@@ -0,0 +1,106 @@
+# dotli host layer migration to TrUAPI
+
+This document records the current dotli host cutover state. The old
+`@novasamatech/*` host-container path is no longer part of the runtime design:
+dotli launches products through the Rust-backed TrUAPI host bridge and keeps
+only its own `.dot` resolution/smoldot protocol outside that boundary.
+
+## Current integration
+
+dotli still has two protocol layers:
+
+1. Host-product API frames, handled by TrUAPI.
+2. dotli's internal host-smoldot protocol in `packages/protocol/`, which owns
+   `.dot` resolution and is not replaced by TrUAPI.
+
+The active launch path is `packages/ui/src/bridge.ts`:
+
+- imports `@parity/truapi-host-wasm/web` and
+  `@parity/truapi-host-wasm/worker-runtime?worker`;
+- starts a Web Worker that owns the `truapi-server` WASM core;
+- adapts typed dotli callbacks with `createWasmRawCallbacks(...)`;
+- calls `createWebWorkerProvider(new HostWorker(), rawCallbacks, { runtimeConfig })`;
+- supplies callbacks from `packages/ui/src/host-callbacks/handlers.ts`;
+- calls `createIframeHost(...)` with the product URL, sandbox policy, allowed
+  origin, and the worker-backed provider.
+
+Product frames enter the Rust core through the iframe `MessageChannel`.
+Account, signing, statement-store, SSO pairing, restore, and logout are
+core-owned and do not cross the JS host callback boundary as Nova-specific
+routes.
+
+## dotli callback boundary
+
+dotli still supplies platform primitives that are host policy or browser UI:
+
+| Area                      | Files                                                                                  |
+| ------------------------- | -------------------------------------------------------------------------------------- |
+| navigation                | `packages/ui/src/host-callbacks/OpenUrl.ts`                                            |
+| notifications             | `packages/ui/src/host-callbacks/PushNotification.ts`                                   |
+| device/remote permissions | `packages/ui/src/host-callbacks/PromptPermission.ts`, `packages/ui/src/permissions.ts` |
+| feature support           | `packages/ui/src/host-callbacks/FeatureSupported.ts`                                   |
+| product storage           | `packages/ui/src/host-callbacks/LocalStorage.ts`                                       |
+| session persistence       | `packages/ui/src/host-callbacks/SessionStore.ts`                                       |
+| pairing presentation      | `packages/ui/src/host-callbacks/Pairing.ts`                                            |
+| user confirmations        | `packages/ui/src/host-callbacks/UserConfirmation.ts`                                   |
+| preimage lookup UI        | `packages/ui/src/host-callbacks/Preimage.ts`                                           |
+| theme subscription        | `packages/ui/src/host-callbacks/Theme.ts`                                              |
+| chain backend connection  | `packages/ui/src/host-callbacks/Chain.ts`                                              |
+
+These callbacks must remain generic host primitives. They should not re-add
+Nova package imports, wallet-specific JS channels, or statement-store request
+routing that belongs inside the Rust core.
+
+## Dependencies
+
+`packages/ui/package.json` depends on the local TrUAPI packages:
+
+```jsonc
+"@parity/truapi": "file:../../../../js/packages/truapi",
+"@parity/truapi-host-wasm": "file:../../../../js/packages/truapi-host-wasm"
+```
+
+> **TODO(packaging):** the `file:../../../../` links resolve only when dotli
+> lives at `hosts/dotli/` inside the TrUAPI monorepo. A standalone dotli
+> checkout (including dotli's own CI, which runs `bun install
+> --frozen-lockfile` without the parent repo) cannot install these packages.
+> Before this branch lands on dotli `main`, decide between publishing the
+> `@parity/truapi*` packages to a registry, vendoring tarballs, or retiring
+> dotli's standalone CI. Carry this note into the dotli PR description.
+
+The runtime manifests and source must not depend on or import the removed
+`@novasamatech/*` runtime packages. The canonical forbidden-package list lives
+in `packages/ui/tests/nova-removal.test.ts`; keep that guard broad rather than
+duplicating a package list in this document.
+
+`packages/ui/tests/nova-removal.test.ts` guards this invariant across dotli
+manifests, `bun.lock`, `THIRD_PARTY_NOTICES.md`, `apps/*/src`, and
+`packages/*/src`.
+
+## Nested dApps
+
+The old `setupNestedBridgeDetector` path created extra JS bridges for nested
+iframe sources. TrUAPI v1 does not create separate nested Rust runtimes,
+sessions, product identities, or storage namespaces. If nested traffic is
+forwarded later, it must use the shared top-level Rust core/provider context.
+
+The future usefulness of independent nested-product semantics is tracked in the
+parent TrUAPI design note `docs/design/host-contract-and-core-impl/I -
+nested-dapps.md`.
+
+## Non-TrUAPI dotli layers
+
+These areas remain dotli-owned and are intentionally outside the host-product
+replacement:
+
+- `apps/host/src/main.ts`: landing shell, `.dot` resolution, iframe mounting.
+- `apps/sandbox/src/main.ts`: content renderer.
+- `packages/protocol/`: smoldot protocol client/broker/session plumbing.
+- `packages/resolver/`: `.dot` name resolution.
+- `packages/content/` and `packages/storage/`: archive fetch and cache.
+- `packages/config/`, `packages/metrics/`, and `packages/shared/`: support
+  libraries.
+
+When auditing the migration, treat Nova runtime imports/dependencies as a
+regression, but do not confuse dotli's internal `packages/protocol/` with the
+removed host-product protocol.

README.md

@@ -61,7 +61,7 @@ Each product gets its own `<label>.app.paseo.li` origin, so versions of the same
 
 1. **Resolves** `.dot` names via an in-browser [smoldot](https://github.com/paritytech/smoldot) light client connected to Asset Hub Paseo, querying dotNS contracts.
 2. **Fetches** content from the [Bulletin Chain](https://github.com/paritytech/polkadot-bulletin-chain) via smoldot `bitswap_v1_get` JSON-RPC or an IPFS gateway.
-3. **Renders** the content in a sandboxed iframe with a full host-container bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
+3. **Renders** the content in a sandboxed iframe with the Rust-backed TrUAPI bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
 
 ```
 host-playground.paseo.li
@@ -116,26 +116,24 @@ On repeat visits, content renders instantly from the cache while it is resolved
 
 If a background re-resolution finds the on-chain CID has changed, dotli shows a **New version available** notification with a **Reload** action rather than swapping content silently.
 
-## Host-container bridge
+## TrUAPI bridge
 
 Loaded SPAs communicate with dotli through a postMessage-based protocol. The bridge exposes:
 
 | Handler                        | What it does                                                           |
 | ------------------------------ | ---------------------------------------------------------------------- |
 | `accountGet`                   | Derives a per-app public key via HDKD soft derivation                  |
 | `getLegacyAccounts`            | Returns non-derived (imported) accounts — always empty on the web host |
-| `signPayload` / `signRaw`      | Shows signing modals, delegates to host-papp session                   |
+| `signPayload` / `signRaw`      | Shows signing modals and routes signing through the active session     |
 | `chainConnection`              | Returns a smoldot-backed JsonRpcProvider for supported chains          |
 | `localStorageRead/Write/Clear` | Scoped `localStorage` per `.dot` domain                                |
 | `navigateTo`                   | Opens URLs in new tabs                                                 |
 | `featureSupported`             | Reports whether a feature is supported (e.g. a chain's genesis hash)   |
 | `connectionStatus`             | Streams auth state changes to the SPA                                  |
 
-### Nested dApp support
+### App iframe model
 
-dApps can embed other dApps via iframes (e.g. a marketplace app embedding a payments app). The host automatically detects nested dApps and creates separate bridges for each one, regardless of nesting depth.
-
-When the host receives a protocol message from an unknown iframe window, it dynamically creates a new container bridge targeting that window. The dApp SDK always sends to `window.top`, so all nested dApps communicate directly with the host — no relay needed.
+The host creates one TrUAPI bridge for the rendered product iframe. dApp-in-dApp iframes are opaque to the host and must use the top-level product's shared Rust core/provider context rather than separate host-created bridges.
 
 The app context uses `document.write()` to eliminate extra iframe nesting: when loaded inside a host iframe, the app replaces its own document with the dApp content so the dApp occupies the iframe directly.
 
@@ -174,7 +172,7 @@ The published tag on the [Releases page](https://github.com/paritytech/dotli/rel
 
 ## Debug panel
 
-dotli ships a TrUAPI debug panel that aggregates host-side activity (boot/resolve/render/bridge events, TrUAPI host↔product messages, host-papp SSO/session events) into one time-aligned inspector. The panel chunk is dynamically imported, so users who never see it pay no download cost.
+dot.li ships a TrUAPI debug panel that aggregates host-side activity (boot/resolve/render/bridge events, TrUAPI host↔product messages, SSO/session events) into one time-aligned inspector. The panel chunk is dynamically imported, so users who never see it pay no download cost.
 
 In builds compiled with `VITE_APP_DEBUG=true` (local `bun run preview:debug`, and the staging dev deploys at `paseoli.dev` / `dotli.dev`) the panel auto-mounts collapsed. In staging/production it's off until you click **Open in debug mode** in the host Settings menu (or append `?debug=true` to any URL). The choice is sessionStorage-scoped — closing the tab clears it. Use `?debug=off` to silence it explicitly within the same session.