@parity/product-deploy 0.7.28-rc.0

package/dist/chunk-P6CHOMN3.js

@@ -0,0 +1,2368 @@
+import {
+  computeStats,
+  renderSummary,
+  telemetryAttributes
+} from "./chunk-KHVTYIIX.js";
+import {
+  finaliseEmbeddedManifest,
+  writeEmbeddedManifestPlaceholder
+} from "./chunk-KOSF5FDO.js";
+import {
+  extractManifestFromCar,
+  fetchPreviousManifest,
+  writePersistentLocalManifest
+} from "./chunk-FZWJV5AD.js";
+import {
+  MANIFEST_PATH,
+  MANIFEST_VERSION,
+  classifyFile,
+  parseManifest
+} from "./chunk-S7EM5VMW.js";
+import {
+  setDeployContext
+} from "./chunk-ADNBLFDP.js";
+import {
+  probeChunks
+} from "./chunk-QTZNULSH.js";
+import {
+  packSection
+} from "./chunk-C2TS5MER.js";
+import {
+  DotNS,
+  PublisherNotSupportedError,
+  TX_TIMEOUT_MS,
+  fetchNonce,
+  parseDomainName,
+  popStatusName,
+  verifyNonceAdvanced
+} from "./chunk-DNXH4QTI.js";
+import {
+  derivePoolAccounts,
+  detectTestnet,
+  ensureAuthorized,
+  fetchPoolAuthorizations,
+  selectAccount,
+  topUpBy
+} from "./chunk-QMYW3D6E.js";
+import {
+  VERSION,
+  captureWarning,
+  initTelemetry,
+  resolveRunner,
+  resolveRunnerType,
+  sampleMemory,
+  setDeployAttribute,
+  setDeployReportContext,
+  setDeploySentryTag,
+  truncateAddress,
+  withDeploySpan,
+  withSpan
+} from "./chunk-MFTODIIT.js";
+import {
+  DEFAULT_ENV_ID,
+  getPopSelfServeConfig,
+  loadEnvironments,
+  resolveEndpoints
+} from "./chunk-OITUIM2E.js";
+import {
+  NonRetryableError
+} from "./chunk-ZOC4GITL.js";
+import {
+  MirrorSkipped,
+  mirrorToGitHubPages,
+  pollMirrorFreshness
+} from "./chunk-HOTQDYHD.js";
+
+// src/merkle.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+import { execSync as execSync2 } from "child_process";
+import { importer } from "ipfs-unixfs-importer";
+import { CarReader as CarReader2 } from "@ipld/car/reader";
+import { CarWriter } from "@ipld/car/writer";
+import { CID as CID2 } from "multiformats/cid";
+import * as dagPB2 from "@ipld/dag-pb";
+import { UnixFS as UnixFS2 } from "ipfs-unixfs";
+
+// src/deploy.ts
+import { Buffer } from "buffer";
+import * as fs from "fs";
+import * as path from "path";
+import { execSync } from "child_process";
+import { sha256 } from "@noble/hashes/sha256";
+import { blake2b } from "@noble/hashes/blake2b";
+import { createClient as createPolkadotClient, Enum } from "polkadot-api";
+import { getWsProvider, WsEvent } from "polkadot-api/ws";
+import { CID } from "multiformats/cid";
+import { create as createMultihash } from "multiformats/hashes/digest";
+import { base32 } from "multiformats/bases/base32";
+import { base58btc } from "multiformats/bases/base58";
+import * as dagPB from "@ipld/dag-pb";
+import { UnixFS } from "ipfs-unixfs";
+import { cryptoWaitReady } from "@polkadot/util-crypto";
+import { getPolkadotSigner } from "polkadot-api/signer";
+import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
+import { mnemonicToEntropy, entropyToMiniSecret, ss58Address } from "@polkadot-labs/hdkd-helpers";
+import { CarReader } from "@ipld/car/reader";
+function friendlyChainError(msg) {
+  if (/"type":\s*"Invalid"[\s\S]*?"type":\s*"Payment"/i.test(msg)) {
+    return "Bulletin quota exhausted (signed extension rejected the tx \u2014 signer is out of allowed txs or bytes; grant quota on-chain)";
+  }
+  return msg;
+}
+var DEFAULT_BULLETIN_RPC = "wss://paseo-bulletin-rpc.polkadot.io";
+var DEFAULT_POOL_SIZE = 10;
+var BULLETIN_ENDPOINTS = [DEFAULT_BULLETIN_RPC];
+var POOL_SIZE = DEFAULT_POOL_SIZE;
+var _deployRpcFailedOver = false;
+var _onWsHalt = null;
+function setWsHaltCallback(cb) {
+  _onWsHalt = cb;
+}
+function makeBulletinStatusHandler(primary) {
+  return (s) => {
+    if (s.type === WsEvent.CONNECTED && s.uri !== primary) {
+      _deployRpcFailedOver = true;
+      setDeployAttribute("deploy.rpc.failed_over", "true");
+      captureWarning("Bulletin RPC failover", { from: primary, to: s.uri });
+    }
+    if (s.type === WsEvent.CLOSE || s.type === WsEvent.ERROR) {
+      try {
+        _onWsHalt?.();
+      } catch {
+      }
+    }
+  };
+}
+var CHUNK_SIZE = 2 * 1024 * 1024;
+var MAX_FILE_SIZE = 8 * 1024 * 1024;
+var MAX_RECONNECTIONS = parseInt(process.env.BULLETIN_MAX_RECONNECTIONS ?? "3", 10);
+var CHUNK_TIMEOUT_MS = parseInt(process.env.BULLETIN_CHUNK_TIMEOUT_MS ?? "180000", 10);
+var CHUNK_MORTALITY_PERIOD = (() => {
+  const v = parseInt(process.env.BULLETIN_CHUNK_MORTALITY_PERIOD ?? "", 10);
+  return Number.isFinite(v) && v > 0 ? v : 16;
+})();
+var RETRY_BASE_DELAY_MS = 2e3;
+var RETRY_MAX_DELAY_MS = 15e3;
+var WS_HEARTBEAT_TIMEOUT_MS = 3e5;
+var GRANDPA_NATURAL_WAIT_MS = parseInt(process.env.BULLETIN_GRANDPA_NATURAL_WAIT_MS ?? "90000", 10);
+var GRANDPA_REUPLOAD_POLL_MS = 5e3;
+var GRANDPA_REUPLOAD_TIMEOUT_MS = 12e4;
+var GRANDPA_REUPLOAD_MAX_ROUNDS = 3;
+var RETRY_BUDGET_MAX_EVENTS = parseInt(process.env.BULLETIN_RETRY_BUDGET_MAX ?? "5", 10);
+var RETRY_BUDGET_WINDOW_MS = parseInt(process.env.BULLETIN_RETRY_BUDGET_WINDOW_MS ?? "30000", 10);
+function retryBudgetExhausted(history, maxEvents, windowMs, now = Date.now()) {
+  let inWindow = 0;
+  for (const t of history) {
+    if (now - t <= windowMs) inWindow++;
+  }
+  return inWindow > maxEvents;
+}
+function isConnectionError(error) {
+  const msg = error?.message || String(error);
+  return /heartbeat timeout|WS halt|Unable to connect|ChainHead disjointed/i.test(msg);
+}
+var CID_CONFIG = { version: 1, codec: 85, hashCode: 18, hashLength: 32 };
+function deriveRootSigner(mnemonic, path3 = "") {
+  const entropy = mnemonicToEntropy(mnemonic);
+  const miniSecret = entropyToMiniSecret(entropy);
+  const derive = sr25519CreateDerive(miniSecret);
+  const keyPair = derive(path3);
+  const signer = getPolkadotSigner(keyPair.publicKey, "Sr25519", keyPair.sign);
+  return { signer, ss58: ss58Address(keyPair.publicKey) };
+}
+function createCID(data, codec = CID_CONFIG.codec, hashCode = CID_CONFIG.hashCode) {
+  let hash;
+  if (hashCode === 45600) hash = blake2b(data, { dkLen: CID_CONFIG.hashLength });
+  else if (hashCode === 18) hash = sha256(data);
+  else throw new Error(`Unsupported hash code: 0x${hashCode.toString(16)}`);
+  return CID.createV1(codec, createMultihash(hashCode, hash));
+}
+function encodeContenthash(cidString) {
+  const decoder = cidString.startsWith("Qm") ? base58btc : base32;
+  const cid = CID.parse(cidString, decoder);
+  const contenthash = new Uint8Array(cid.bytes.length + 2);
+  contenthash[0] = 227;
+  contenthash[1] = 1;
+  contenthash.set(cid.bytes, 2);
+  return Buffer.from(contenthash).toString("hex");
+}
+var ENCRYPT_MAGIC = new Uint8Array([68, 79, 84, 76, 73, 95, 69, 78, 67, 1]);
+var ENCRYPT_SALT_LEN = 16;
+var ENCRYPT_NONCE_LEN = 12;
+var ENCRYPT_TAG_LEN = 16;
+var ENCRYPT_KEY_LEN = 32;
+var ENCRYPT_PBKDF2_ITERATIONS = 1e5;
+async function encryptContent(data, password) {
+  const { webcrypto, createCipheriv } = await import("crypto");
+  const subtle = webcrypto.subtle;
+  const salt = webcrypto.getRandomValues(new Uint8Array(ENCRYPT_SALT_LEN));
+  const nonce = webcrypto.getRandomValues(new Uint8Array(ENCRYPT_NONCE_LEN));
+  const keyMaterial = await subtle.importKey("raw", Buffer.from(password, "utf-8"), "PBKDF2", false, ["deriveBits"]);
+  const keyBits = await subtle.deriveBits(
+    { name: "PBKDF2", salt, iterations: ENCRYPT_PBKDF2_ITERATIONS, hash: "SHA-256" },
+    keyMaterial,
+    ENCRYPT_KEY_LEN * 8
+  );
+  const cipher = createCipheriv("chacha20-poly1305", Buffer.from(keyBits), nonce, { authTagLength: ENCRYPT_TAG_LEN });
+  cipher.setAAD(ENCRYPT_MAGIC, { plaintextLength: data.length });
+  return Buffer.concat([ENCRYPT_MAGIC, salt, nonce, cipher.update(data), cipher.final(), cipher.getAuthTag()]);
+}
+function toHashingEnum(mhCode) {
+  switch (mhCode) {
+    case 45600:
+      return { type: "Blake2b256", value: void 0 };
+    case 18:
+      return { type: "Sha2_256", value: void 0 };
+    case 27:
+      return { type: "Keccak256", value: void 0 };
+    default:
+      throw new Error(`Unhandled multihash code: ${mhCode}`);
+  }
+}
+async function getProvider() {
+  const primary = BULLETIN_ENDPOINTS[0];
+  console.log(`   Connecting to Bulletin: ${primary}`);
+  const client = createPolkadotClient(getWsProvider(
+    BULLETIN_ENDPOINTS,
+    { heartbeatTimeout: WS_HEARTBEAT_TIMEOUT_MS, onStatusChanged: makeBulletinStatusHandler(primary) }
+  ));
+  const unsafeApi = client.getUnsafeApi();
+  try {
+    await cryptoWaitReady();
+    const poolMnemonic = process.env.BULLETIN_POOL_MNEMONIC || void 0;
+    const poolAccounts = derivePoolAccounts(POOL_SIZE, poolMnemonic);
+    const [authorizations, currentBlockForPool] = await Promise.all([
+      fetchPoolAuthorizations(unsafeApi, poolAccounts),
+      unsafeApi.query.System.Number.getValue()
+    ]);
+    const selectionResult = selectAccount(authorizations, Math.random, currentBlockForPool);
+    let selectedAccount;
+    let eligibleCount = 0;
+    if (!selectionResult) {
+      const best = authorizations.reduce((a, b) => a.transactions > b.transactions ? a : b);
+      console.log(`   All pool accounts low on capacity, auto-authorizing account ${best.index}...`);
+      await ensureAuthorized(unsafeApi, best.address, `pool account ${best.index}`);
+      selectedAccount = best;
+    } else {
+      selectedAccount = selectionResult.account;
+      eligibleCount = selectionResult.eligibleCount;
+      await ensureAuthorized(unsafeApi, selectedAccount.address, `pool account ${selectedAccount.index}`);
+    }
+    console.log(`   Using pool account ${selectedAccount.index}: ${selectedAccount.address}`);
+    setDeployAttribute("deploy.signer.mode", "pool");
+    setDeployAttribute("deploy.pool.account", truncateAddress(selectedAccount.address));
+    setDeployAttribute("deploy.pool.index", String(selectedAccount.index));
+    setDeployAttribute("deploy.pool.eligible_count", eligibleCount);
+    return { client, unsafeApi, signer: selectedAccount.signer, ss58: selectedAccount.address };
+  } catch (e) {
+    client.destroy();
+    throw e;
+  }
+}
+async function getDirectProvider(mnemonic, derivationPath = "", bulletinAuthorizeV2) {
+  const primary = BULLETIN_ENDPOINTS[0];
+  console.log(`   Connecting to Bulletin: ${primary}`);
+  const client = createPolkadotClient(getWsProvider(
+    BULLETIN_ENDPOINTS,
+    { heartbeatTimeout: WS_HEARTBEAT_TIMEOUT_MS, onStatusChanged: makeBulletinStatusHandler(primary) }
+  ));
+  const unsafeApi = client.getUnsafeApi();
+  const { signer, ss58 } = deriveRootSigner(mnemonic, derivationPath);
+  console.log(`   Using direct signer: ${ss58}${derivationPath ? ` (path: ${derivationPath})` : ""}`);
+  let [auth, currentBlock] = await Promise.all([
+    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+    client.getFinalizedBlock()
+  ]);
+  let now = currentBlock.number;
+  if (!auth || Number(auth.expiration ?? 0) <= now) {
+    try {
+      await ensureAuthorized(unsafeApi, ss58, "direct signer", bulletinAuthorizeV2);
+      [auth, currentBlock] = await Promise.all([
+        unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+        client.getFinalizedBlock()
+      ]);
+      now = currentBlock.number;
+    } catch (e) {
+      client.destroy();
+      throw new NonRetryableError(`Account ${ss58} is not authorized for Bulletin storage and auto-authorization failed: ${e.message}`);
+    }
+  }
+  console.log(`   Authorization: expires at block ${Number(auth?.expiration ?? 0)} (current: ${now})`);
+  setDeployAttribute("deploy.signer.mode", "direct");
+  setDeployAttribute("deploy.signer.address", truncateAddress(ss58));
+  return { client, unsafeApi, signer, ss58 };
+}
+function watchTransaction(tx, signer, txOpts, onSuccess, { label = "transaction", rpc, senderSS58, expectedNonce, timeoutMs, fetchNonce: fetchNonceOverride } = {}) {
+  const timeout = timeoutMs ?? TX_TIMEOUT_MS;
+  const _fetchNonce = fetchNonceOverride ?? fetchNonce;
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    let sub;
+    const settle = (fn) => (...args) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        sub?.unsubscribe();
+      } catch {
+      }
+      fn(...args);
+    };
+    const tryNonceFallback = async () => {
+      if (!rpc || !senderSS58 || expectedNonce == null) return false;
+      try {
+        const endpoints = Array.isArray(rpc) ? rpc : [rpc];
+        const verified = await verifyNonceAdvanced(endpoints, senderSS58, expectedNonce);
+        if (settled) return true;
+        if (verified.advanced) {
+          console.log(`      ${label}: nonce advanced past ${expectedNonce} (witnessed by ${verified.witnessRpc}), tx was included`);
+          settle(resolve2)({ value: onSuccess(), viaFallback: true });
+          return true;
+        }
+      } catch (e) {
+        if (settled) return true;
+        console.log(`      ${label}: nonce fallback failed: ${e.message?.slice(0, 80)}`);
+      }
+      return false;
+    };
+    const timer = setTimeout(async () => {
+      if (settled) return;
+      if (await tryNonceFallback()) return;
+      settle(reject)(new Error(`${label} timed out after ${timeout / 1e3}s waiting for block confirmation`));
+    }, timeout);
+    sub = tx.signSubmitAndWatch(signer, txOpts).subscribe({
+      next: async (event) => {
+        if (event.type !== "txBestBlocksState") return;
+        if (event.found) {
+          if (event.ok) {
+            const receipt = event.block ? { txHash: String(event.txHash), blockHash: String(event.block.hash), blockNumber: Number(event.block.number) } : void 0;
+            settle(resolve2)({ value: onSuccess(event), viaFallback: false, receipt });
+          } else settle(reject)(new Error(`${label} dispatch error`));
+          return;
+        }
+        if (event.isValid === false) {
+          console.log(`      ${label}: tx rejected by pool (isValid:false), checking nonce fallback...`);
+          if (await tryNonceFallback()) return;
+          settle(reject)(new Error(`${label} tx rejected by pool (isValid:false)`));
+        }
+      },
+      error: (e) => {
+        const msg = e?.message || String(e).slice(0, 500);
+        settle(reject)(new Error(`${label} subscription error: ${friendlyChainError(msg)}`));
+      }
+    });
+  });
+}
+async function storeChunk(unsafeApi, signer, chunkBytes, nonce, ss58, opts = {}) {
+  const hashCode = 18;
+  const cid = createCID(chunkBytes, CID_CONFIG.codec, hashCode);
+  const tx = unsafeApi.tx.TransactionStorage.store_with_cid_config({ cid: { codec: BigInt(CID_CONFIG.codec), hashing: toHashingEnum(hashCode) }, data: chunkBytes });
+  const txOpts = { mortality: { mortal: true, period: CHUNK_MORTALITY_PERIOD }, nonce };
+  const { value, viaFallback, receipt } = await watchTransaction(tx, signer, txOpts, () => {
+    console.log(`      CID: ${cid.toString()}`);
+    return { cid, len: chunkBytes.length };
+  }, { label: `chunk(nonce:${nonce})`, rpc: BULLETIN_ENDPOINTS, senderSS58: ss58, expectedNonce: nonce, timeoutMs: CHUNK_TIMEOUT_MS, fetchNonce: opts.fetchNonce });
+  return { ...value, viaFallback, receipt };
+}
+async function storeFile(contentBytes, { client: existingClient, unsafeApi: existingApi, signer: existingSigner } = {}) {
+  console.log(`
+   Size: ${(contentBytes.length / 1024).toFixed(2)} KB`);
+  if (contentBytes.length > MAX_FILE_SIZE) throw new Error(`File exceeds 8MB limit. Use chunked deployment.`);
+  const hashCode = 18;
+  const cid = createCID(contentBytes, CID_CONFIG.codec, hashCode);
+  console.log(`   CID: ${cid.toString()}`);
+  let client, unsafeApi, signer;
+  if (existingClient) {
+    client = existingClient;
+    unsafeApi = existingApi;
+    signer = existingSigner;
+  } else {
+    const provider = await getProvider();
+    client = provider.client;
+    unsafeApi = provider.unsafeApi;
+    signer = provider.signer;
+  }
+  try {
+    const tx = unsafeApi.tx.TransactionStorage.store_with_cid_config({ cid: { codec: BigInt(CID_CONFIG.codec), hashing: toHashingEnum(hashCode) }, data: contentBytes });
+    const txOpts = { mortality: { mortal: true, period: 256 } };
+    console.log(`   Submitting...`);
+    const { value } = await watchTransaction(tx, signer, txOpts, (event) => {
+      console.log(`   Block: ${event?.block?.hash ?? "confirmed"}
+`);
+      return cid.toString();
+    }, { label: "storeFile" });
+    if (!existingClient) client.destroy();
+    return value;
+  } catch (e) {
+    if (!existingClient) client.destroy();
+    throw e;
+  }
+}
+function assignDenseNonces(stored, startNonce) {
+  const nonces = /* @__PURE__ */ new Map();
+  let counter = 0;
+  for (let i = 0; i < stored.length; i++) {
+    if (stored[i] === null) {
+      nonces.set(i, startNonce + counter);
+      counter++;
+    }
+  }
+  return nonces;
+}
+var __assignDenseNoncesForTest = assignDenseNonces;
+async function storeChunkedContent(chunks, { client: existingClient, unsafeApi: existingApi, signer: existingSigner, ss58: existingSS58, reconnect, fetchNonce: fetchNonceOverride, skipCids, probeFailedCids, gateway: providerGateway, bulletinAuthorizeV2, trustedCids, skipRootStore } = {}) {
+  const _fetchNonce = fetchNonceOverride ?? fetchNonce;
+  console.log(`
+   Chunks: ${chunks.length}`);
+  const totalBytes = chunks.reduce((s, c) => s + c.length, 0);
+  console.log(`   Total: ${(totalBytes / 1024).toFixed(2)} KB`);
+  let client, unsafeApi, signer, ss58;
+  let ownsClient = false;
+  if (existingClient) {
+    client = existingClient;
+    unsafeApi = existingApi;
+    signer = existingSigner;
+    ss58 = existingSS58;
+  } else {
+    const provider = await getProvider();
+    client = provider.client;
+    unsafeApi = provider.unsafeApi;
+    signer = provider.signer;
+    ss58 = provider.ss58;
+    ownsClient = true;
+  }
+  const refreshExistingClient = async (reason) => {
+    if (!reconnect) return false;
+    console.log(`
+   Connection lost (${reason}), reconnecting...`);
+    const fresh = await reconnect();
+    client = fresh.client;
+    unsafeApi = fresh.unsafeApi;
+    signer = fresh.signer;
+    ss58 = fresh.ss58;
+    ownsClient = true;
+    return true;
+  };
+  if (existingClient && reconnect) {
+    try {
+      await unsafeApi.query.System.Number.getValue();
+    } catch (e) {
+      if (isConnectionError(e)) {
+        await refreshExistingClient("stale client detected by pre-upload probe");
+      } else {
+        throw e;
+      }
+    }
+  }
+  const requiredTxs = BigInt(chunks.length + 1);
+  const requiredBytes = BigInt(totalBytes);
+  const readUploadAuthorization = () => Promise.all([
+    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+    unsafeApi.query.System.Number.getValue()
+  ]);
+  let uploadAuth;
+  let currentBlockNum;
+  try {
+    [uploadAuth, currentBlockNum] = await readUploadAuthorization();
+  } catch (e) {
+    if (existingClient && reconnect && isConnectionError(e)) {
+      await refreshExistingClient("authorization preflight hit a stale chainHead");
+      [uploadAuth, currentBlockNum] = await readUploadAuthorization();
+    } else {
+      throw e;
+    }
+  }
+  const txsRemaining = uploadAuth ? BigInt(uploadAuth.extent.transactions_allowance) - BigInt(uploadAuth.extent.transactions) : 0n;
+  const bytesRemaining = uploadAuth ? BigInt(uploadAuth.extent.bytes_allowance) - BigInt(uploadAuth.extent.bytes) : 0n;
+  const isAuthorized = uploadAuth !== void 0 && Number(uploadAuth.expiration ?? 0) > currentBlockNum;
+  if (!isAuthorized || txsRemaining < requiredTxs || bytesRemaining < requiredBytes) {
+    const txsRemainingDisplay = txsRemaining < 0n ? 0n : txsRemaining;
+    const bytesRemainingDisplay = bytesRemaining < 0n ? 0n : bytesRemaining;
+    console.log(`
+   Account needs re-authorization (authorized=${isAuthorized}, need ${requiredTxs} txs / ${(totalBytes / 1e6).toFixed(1)}MB, have ${txsRemainingDisplay} txs / ${(Number(bytesRemainingDisplay) / 1e6).toFixed(2)}MB)`);
+    console.log(`   Attempting to re-authorize with Alice...`);
+    try {
+      await ensureAuthorized(unsafeApi, ss58, void 0, bulletinAuthorizeV2, { txs: requiredTxs, bytes: requiredBytes });
+      console.log(`   Re-authorization successful`);
+    } catch (e) {
+      throw new NonRetryableError(`Account ${ss58} has insufficient Bulletin authorization and auto-authorization via Alice failed (${e.message}). Authorize the account on-chain.`);
+    }
+  }
+  let reconnectionsUsed = 0;
+  const recoveryHistory = [];
+  const recordRecoveryAndCheckBudget = (kind) => {
+    const now = Date.now();
+    recoveryHistory.push(now);
+    if (retryBudgetExhausted(recoveryHistory, RETRY_BUDGET_MAX_EVENTS, RETRY_BUDGET_WINDOW_MS, now)) {
+      captureWarning("Retry budget exhausted", {
+        kind,
+        events: recoveryHistory.length,
+        maxEvents: RETRY_BUDGET_MAX_EVENTS,
+        windowMs: RETRY_BUDGET_WINDOW_MS
+      });
+      throw new Error(
+        `Retry budget exhausted: more than ${RETRY_BUDGET_MAX_EVENTS} recovery attempts within ${Math.round(RETRY_BUDGET_WINDOW_MS / 1e3)}s. Chain RPC is unstable; bailing to bound peak memory.`
+      );
+    }
+  };
+  async function doReconnect() {
+    if (!reconnect || reconnectionsUsed >= MAX_RECONNECTIONS) {
+      throw new Error(`Connection lost and max reconnections (${MAX_RECONNECTIONS}) exhausted`);
+    }
+    recordRecoveryAndCheckBudget("reconnect");
+    reconnectionsUsed++;
+    setDeployAttribute("deploy.reconnects", reconnectionsUsed);
+    const delay = Math.min(RETRY_BASE_DELAY_MS * Math.pow(2, reconnectionsUsed - 1), RETRY_MAX_DELAY_MS);
+    console.log(`
+   Connection lost, reconnecting to Bulletin in ${(delay / 1e3).toFixed(0)}s (${reconnectionsUsed}/${MAX_RECONNECTIONS})...`);
+    captureWarning("WebSocket connection lost, reconnecting", { reconnection: reconnectionsUsed, maxReconnections: MAX_RECONNECTIONS });
+    sampleMemory(`reconnect_${reconnectionsUsed}_before`);
+    try {
+      client.destroy();
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, delay));
+    const fresh = await reconnect();
+    client = fresh.client;
+    unsafeApi = fresh.unsafeApi;
+    signer = fresh.signer;
+    ss58 = fresh.ss58;
+    wsHaltDetected = false;
+    ownsClient = true;
+    sampleMemory(`reconnect_${reconnectionsUsed}_after`);
+  }
+  let wsHaltDetected = false;
+  setWsHaltCallback(() => {
+    wsHaltDetected = true;
+    try {
+      client.destroy();
+    } catch {
+    }
+  });
+  try {
+    let startNonce = await _fetchNonce(BULLETIN_ENDPOINTS, ss58);
+    console.log(`   Starting nonce: ${startNonce}`);
+    const BATCH_SIZE_INITIAL = 2;
+    const BATCH_SIZE_RECOVERY = 1;
+    const MAX_CHUNK_RETRIES = 3;
+    const MAX_REPROBE_RETRIES = 3;
+    console.log(`
+   Submitting ${chunks.length} chunks in batches of up to ${BATCH_SIZE_INITIAL}...`);
+    const stored = new Array(chunks.length).fill(null);
+    let tier2Verified = 0;
+    let tier2Inconclusive = 0;
+    let tier2Fallback = 0;
+    const skipProbeResults = /* @__PURE__ */ new Map();
+    const chunkCidsComputed = new Array(chunks.length);
+    let trustedCount = 0;
+    const trustedIndices = [];
+    const skipCidsCandidates = [];
+    for (let i = 0; i < chunks.length; i++) {
+      const cid = createCID(chunks[i], CID_CONFIG.codec, 18);
+      chunkCidsComputed[i] = cid;
+      const cidStr = cid.toString();
+      if (trustedCids?.has(cidStr)) {
+        stored[i] = { cid, len: chunks[i].length, viaFallback: true };
+        trustedCount++;
+        trustedIndices.push(i);
+      } else if (skipCids?.has(cidStr)) {
+        skipCidsCandidates.push({ index: i, cid });
+      }
+    }
+    if (trustedCount > 0) {
+      const indicesStr = trustedIndices.length > 10 ? `${trustedIndices.slice(0, 5).join(", ")}, \u2026, ${trustedIndices.slice(-3).join(", ")}` : trustedIndices.join(", ");
+      console.log(`   Trusted: ${trustedCount} chunks skipped without re-probe (chunks ${indicesStr})`);
+    }
+    if (skipCidsCandidates.length > 0) {
+      const cidStrings = skipCidsCandidates.map((c) => c.cid.toString());
+      const probeResults = await probeChunks(cidStrings, { client });
+      const probeResultMap = new Map(probeResults.map((r) => [r.cid, r.present]));
+      for (const r of probeResults) skipProbeResults.set(r.cid, r.present);
+      let confirmedCount = 0;
+      for (const { index: i, cid } of skipCidsCandidates) {
+        const cidStr = cid.toString();
+        const present = probeResultMap.get(cidStr) ?? null;
+        if (present !== false) {
+          stored[i] = { cid, len: chunks[i].length, viaFallback: true };
+          confirmedCount++;
+          if (present === true) {
+            tier2Verified++;
+          } else {
+            tier2Inconclusive++;
+          }
+        } else {
+          tier2Fallback++;
+        }
+      }
+      console.log(`   Cache check: ${confirmedCount} confirmed, ${tier2Fallback} missing${tier2Fallback > 0 ? " (will upload)" : ""}`);
+    }
+    const assignedNonces = assignDenseNonces(stored, startNonce);
+    const uploadTotal = stored.filter((s) => s === null).length;
+    let uploadEmitted = 0;
+    const nonceAdvanceIndices = /* @__PURE__ */ new Set();
+    let b = 0;
+    while (b < chunks.length) {
+      if (wsHaltDetected && reconnect && reconnectionsUsed < MAX_RECONNECTIONS) {
+        wsHaltDetected = false;
+        await doReconnect();
+      }
+      const batchSize = reconnectionsUsed > 0 ? BATCH_SIZE_RECOVERY : BATCH_SIZE_INITIAL;
+      const batchIndices = [];
+      const batchChunks = [];
+      for (let j = 0; j < batchSize && b + j < chunks.length; j++) {
+        const i = b + j;
+        if (stored[i] === null) {
+          batchIndices.push(i);
+          batchChunks.push(chunks[i]);
+        }
+      }
+      if (batchIndices.length === 0) {
+        b += batchSize;
+        continue;
+      }
+      const batchPromises = batchChunks.map((chunkData, j) => {
+        const i = batchIndices[j];
+        const nonce = assignedNonces.get(i);
+        uploadEmitted++;
+        console.log(`   [${uploadEmitted}/${uploadTotal}] chunk ${i} \u2014 ${(chunkData.length / 1024 / 1024).toFixed(2)} MB (nonce: ${nonce})`);
+        return storeChunk(unsafeApi, signer, chunkData, nonce, ss58, { fetchNonce: fetchNonceOverride });
+      });
+      const results = await Promise.allSettled(batchPromises);
+      results.forEach((r, j) => {
+        if (r.status === "fulfilled") {
+          stored[batchIndices[j]] = r.value;
+          assignedNonces.delete(batchIndices[j]);
+          if (r.value.viaFallback) nonceAdvanceIndices.add(batchIndices[j]);
+        }
+      });
+      const failures = results.map((r, j) => r.status === "rejected" ? { index: batchIndices[j], chunkData: batchChunks[j], error: r.reason } : null).filter(Boolean);
+      const needsReconnect = failures.some((f) => isConnectionError(f.error));
+      if (needsReconnect && reconnect && reconnectionsUsed < MAX_RECONNECTIONS) {
+        await doReconnect();
+        const currentNonce = await _fetchNonce(BULLETIN_ENDPOINTS, ss58);
+        for (const idx of batchIndices) {
+          const chunkNonce = assignedNonces.get(idx);
+          if (chunkNonce !== void 0 && chunkNonce < currentNonce && stored[idx] === null) {
+            console.log(`   Chunk ${idx + 1}: nonce ${chunkNonce} consumed (current=${currentNonce}), treating as included`);
+            stored[idx] = { cid: createCID(chunks[idx], CID_CONFIG.codec, 18), len: chunks[idx].length, viaFallback: true };
+            nonceAdvanceIndices.add(idx);
+            assignedNonces.delete(idx);
+          }
+        }
+        startNonce = Math.max(startNonce, currentNonce);
+        if (failures.some((f) => stored[f.index] === null)) {
+          continue;
+        }
+      }
+      for (const fail of failures) {
+        if (stored[fail.index] !== null) {
+          continue;
+        }
+        const failCid = createCID(fail.chunkData, CID_CONFIG.codec, 18);
+        if (probeFailedCids && probeFailedCids.has(failCid.toString()) && fail.error?.message?.includes("isValid:false")) {
+          console.log(`   Chunk ${fail.index + 1}: isValid:false but CID was probe-failed \u2014 treating as already on chain`);
+          captureWarning("isValid:false treated as success (probe-failed backstop)", { chunkIndex: fail.index + 1, cid: failCid.toString() });
+          stored[fail.index] = { cid: failCid, len: fail.chunkData.length, viaFallback: true };
+          continue;
+        }
+        captureWarning("Chunk upload failed, retrying", { chunkIndex: fail.index + 1, maxRetries: MAX_CHUNK_RETRIES, error: fail.error?.message?.slice(0, 200) });
+        const isExpiryFailure = fail.error?.message?.includes("isValid:false");
+        if (isExpiryFailure) {
+          console.log(`   Chunk ${fail.index + 1}: tx rejected (isValid:false), likely mortal era expiry \u2014 reissuing with fresh nonce`);
+        }
+        let retried = false;
+        for (let attempt = 1; attempt <= MAX_CHUNK_RETRIES; attempt++) {
+          recordRecoveryAndCheckBudget("chunk_retry");
+          const retryDelay = Math.min(RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1), RETRY_MAX_DELAY_MS);
+          console.log(`   Retrying chunk ${fail.index + 1} (attempt ${attempt}/${MAX_CHUNK_RETRIES}) in ${(retryDelay / 1e3).toFixed(0)}s...`);
+          await new Promise((r) => setTimeout(r, retryDelay));
+          if (isConnectionError(fail.error) && reconnect && reconnectionsUsed < MAX_RECONNECTIONS) {
+            try {
+              await doReconnect();
+            } catch (reconnectErr) {
+              console.log(`   Reconnect failed: ${reconnectErr.message?.slice(0, 80)}`);
+              break;
+            }
+          }
+          try {
+            const currentNonce = await _fetchNonce(BULLETIN_ENDPOINTS, ss58);
+            const originalNonce = assignedNonces.get(fail.index);
+            if (originalNonce !== void 0 && originalNonce < currentNonce) {
+              console.log(`   Chunk ${fail.index + 1}: nonce ${originalNonce} consumed (current=${currentNonce}), treating as included`);
+              stored[fail.index] = { cid: createCID(fail.chunkData, CID_CONFIG.codec, 18), len: fail.chunkData.length, viaFallback: true };
+              nonceAdvanceIndices.add(fail.index);
+              assignedNonces.delete(fail.index);
+              retried = true;
+              break;
+            }
+            const retryNonce = originalNonce ?? currentNonce;
+            const result2 = await storeChunk(unsafeApi, signer, fail.chunkData, retryNonce, ss58, { fetchNonce: fetchNonceOverride });
+            stored[fail.index] = result2;
+            assignedNonces.delete(fail.index);
+            retried = true;
+            break;
+          } catch (e) {
+            if (probeFailedCids && probeFailedCids.has(failCid.toString()) && e?.message?.includes("isValid:false")) {
+              console.log(`   Chunk ${fail.index + 1}: retry isValid:false but CID was probe-failed \u2014 treating as already on chain`);
+              captureWarning("isValid:false retry treated as success (probe-failed backstop)", { chunkIndex: fail.index + 1, cid: failCid.toString(), attempt });
+              stored[fail.index] = { cid: failCid, len: fail.chunkData.length, viaFallback: true };
+              assignedNonces.delete(fail.index);
+              retried = true;
+              break;
+            }
+            captureWarning("Chunk retry failed", { chunkIndex: fail.index + 1, attempt, maxRetries: MAX_CHUNK_RETRIES, error: e.message?.slice(0, 200) });
+            console.log(`   Retry ${attempt} failed: ${e.message?.slice(0, 80)}`);
+            if (isConnectionError(e) && reconnect && reconnectionsUsed < MAX_RECONNECTIONS) {
+              try {
+                await doReconnect();
+              } catch {
+              }
+            }
+          }
+        }
+        if (!retried) {
+          if (isConnectionError(fail.error) && reconnectionsUsed >= MAX_RECONNECTIONS) {
+            throw new Error(`Connection lost and max reconnections (${MAX_RECONNECTIONS}) exhausted`);
+          }
+          throw new Error(`Chunk ${fail.index + 1} failed after ${MAX_CHUNK_RETRIES} retries: ${fail.error?.message?.slice(0, 100)}`);
+        }
+      }
+      b += batchSize;
+    }
+    if (nonceAdvanceIndices.size > 0) {
+      const cidToIndex = new Map([...nonceAdvanceIndices].map((i) => [stored[i].cid.toString(), i]));
+      setDeployAttribute("deploy.pool.nonce_collision_count", nonceAdvanceIndices.size);
+      const probeResults = await probeChunks([...cidToIndex.keys()], { client });
+      const missingResults = probeResults.filter((r) => r.present === false);
+      setDeployAttribute("deploy.pool.nonce_collision_missing", missingResults.length);
+      if (missingResults.length > 0) {
+        captureWarning("nonce-advance collision: re-uploading missing chunks", {
+          collision_count: missingResults.length
+        });
+      }
+      let reuploadCount = 0;
+      for (const m of missingResults) {
+        const idx = cidToIndex.get(m.cid);
+        for (let attempt = 1; attempt <= MAX_REPROBE_RETRIES; attempt++) {
+          console.log(`   Nonce-collision re-upload: chunk ${idx + 1} (attempt ${attempt}/${MAX_REPROBE_RETRIES})`);
+          try {
+            const freshNonce = await _fetchNonce(BULLETIN_ENDPOINTS, ss58);
+            const result2 = await storeChunk(unsafeApi, signer, chunks[idx], freshNonce, ss58, { fetchNonce: fetchNonceOverride });
+            stored[idx] = result2;
+            reuploadCount++;
+            break;
+          } catch (e) {
+            if (attempt === MAX_REPROBE_RETRIES) {
+              throw new Error(`Nonce-collision re-upload of chunk ${idx + 1} failed after ${MAX_REPROBE_RETRIES} attempts: ${e.message?.slice(0, 100)}`);
+            }
+          }
+        }
+      }
+      setDeployAttribute("deploy.pool.nonce_collision_reupload_count", reuploadCount);
+    }
+    setDeployAttribute("deploy.pool.account", truncateAddress(ss58));
+    const submittedCount = stored.filter((s) => !!s && !s.viaFallback).length;
+    console.log(submittedCount === 0 ? `
+   All ${chunks.length} chunks already on chain \u2014 nothing submitted` : `
+   All ${chunks.length} chunks included in block`);
+    console.log(`   Verifying chunk integrity...`);
+    const missing = stored.map((c, i) => c === null ? i + 1 : null).filter(Boolean);
+    if (missing.length > 0) {
+      throw new Error(`Chunk verification failed: missing chunks at positions ${missing.join(", ")}`);
+    }
+    const verifiedStored = stored;
+    for (let i = 0; i < chunks.length; i++) {
+      const expectedCid = createCID(chunks[i], CID_CONFIG.codec, 18);
+      if (verifiedStored[i].cid.toString() !== expectedCid.toString()) {
+        throw new Error(`Chunk verification failed: chunk ${i + 1} CID mismatch (expected ${expectedCid}, got ${verifiedStored[i].cid})`);
+      }
+    }
+    console.log(`   All ${chunks.length} chunks verified \u2713`);
+    console.log(`   Building DAG-PB...`);
+    const fileData = new UnixFS({ type: "file", blockSizes: verifiedStored.map((c) => BigInt(c.len)) });
+    const dagNode = dagPB.prepare({ Data: fileData.marshal(), Links: verifiedStored.map((c) => ({ Name: "", Tsize: c.len, Hash: c.cid })) });
+    const dagBytes = dagPB.encode(dagNode);
+    const hashCode = 18;
+    const rootCid = createCID(dagBytes, 112, hashCode);
+    const rssBeforeRootMb = Math.round(process.memoryUsage().rss / 1024 / 1024);
+    if (rssBeforeRootMb > 2048) {
+      captureWarning("high RSS before root node store \u2014 OOM risk", {
+        rss_mb: rssBeforeRootMb,
+        chunks: chunks.length
+      });
+    }
+    let rootSkipped = false;
+    if (skipRootStore) {
+      rootSkipped = true;
+    } else {
+      const rootProbeResult = await probeChunks([rootCid.toString()], { client });
+      if (rootProbeResult[0]?.present === true) {
+        console.log(`   Root node already on-chain (${rootCid.toString().slice(0, 20)}\u2026), skipping store.`);
+        rootSkipped = true;
+      }
+    }
+    let result;
+    let uploadReceipt;
+    if (rootSkipped) {
+      result = rootCid.toString();
+      uploadReceipt = stored.findLast((c) => c?.receipt)?.receipt;
+    } else {
+      const MAX_ROOT_RETRIES = 3;
+      for (let rootAttempt = 1; rootAttempt <= MAX_ROOT_RETRIES; rootAttempt++) {
+        const rootNonce = await _fetchNonce(BULLETIN_ENDPOINTS, ss58);
+        console.log(`   Storing root node (nonce: ${rootNonce})...`);
+        const rootTx = unsafeApi.tx.TransactionStorage.store_with_cid_config({ cid: { codec: BigInt(112), hashing: toHashingEnum(hashCode) }, data: dagBytes });
+        const rootTxOpts = { mortality: { mortal: true, period: 256 }, nonce: rootNonce };
+        try {
+          const watchResult = await watchTransaction(rootTx, signer, rootTxOpts, () => {
+            console.log(`   Root CID: ${rootCid.toString()}
+`);
+            return rootCid.toString();
+          }, { label: "root-node", rpc: BULLETIN_ENDPOINTS, senderSS58: ss58, expectedNonce: rootNonce, timeoutMs: CHUNK_TIMEOUT_MS, fetchNonce: fetchNonceOverride });
+          result = watchResult.value;
+          uploadReceipt = watchResult.receipt;
+          break;
+        } catch (e) {
+          if (reconnect && reconnectionsUsed < MAX_RECONNECTIONS) {
+            await doReconnect();
+            continue;
+          }
+          if (rootAttempt < MAX_ROOT_RETRIES) {
+            console.log(`   Root node attempt ${rootAttempt} failed: ${e.message?.slice(0, 80)}`);
+            await new Promise((r) => setTimeout(r, 6e3));
+            continue;
+          }
+          throw e;
+        }
+      }
+    }
+    if (uploadReceipt) {
+      setDeployAttribute("bulletin.upload.tx_hash", uploadReceipt.txHash);
+      setDeployAttribute("bulletin.upload.block_hash", uploadReceipt.blockHash);
+      setDeployAttribute("bulletin.upload.block_number", uploadReceipt.blockNumber);
+      console.log(`   Storage upload finalised @ block ${uploadReceipt.blockNumber} (tx ${uploadReceipt.txHash})`);
+    }
+    if (wsHaltDetected && reconnect && reconnectionsUsed < MAX_RECONNECTIONS) {
+      wsHaltDetected = false;
+      await doReconnect();
+      ownsClient = false;
+    }
+    if (ownsClient) client.destroy();
+    return { storageCid: result, tier2Verified, tier2Inconclusive, tier2Fallback, liveProvider: { client, unsafeApi, signer, ss58 }, skipProbeResults, rootSkipped };
+  } catch (e) {
+    if (ownsClient) client.destroy();
+    throw e;
+  } finally {
+    setWsHaltCallback(null);
+  }
+}
+function chunk(data, size = CHUNK_SIZE) {
+  const chunks = [];
+  let offset = 0;
+  while (offset < data.length) {
+    const end = Math.min(offset + size, data.length);
+    chunks.push(data.subarray(offset, end));
+    offset = end;
+  }
+  return chunks;
+}
+var _hasIPFS;
+function hasIPFS() {
+  if (_hasIPFS === void 0) {
+    try {
+      execSync("ipfs version", { stdio: "ignore" });
+      _hasIPFS = true;
+    } catch {
+      _hasIPFS = false;
+    }
+  }
+  return _hasIPFS;
+}
+async function merkleize(directoryPath, outputCarPath) {
+  if (!hasIPFS()) throw new Error("IPFS CLI not installed. Install from: https://docs.ipfs.tech/install/");
+  if (!fs.existsSync(directoryPath)) throw new Error(`Directory not found: ${directoryPath}`);
+  console.log(`   Merkleizing: ${directoryPath}`);
+  const cid = execSync(`ipfs add -Q -r --cid-version=1 --raw-leaves --pin=false "${directoryPath}"`, { encoding: "utf-8" }).trim();
+  if (!cid) throw new Error("Failed to get CID from IPFS");
+  execSync(`ipfs dag export ${cid} > "${outputCarPath}"`);
+  if (!fs.existsSync(outputCarPath)) throw new Error("Failed to create CAR file");
+  const size = fs.statSync(outputCarPath).size;
+  console.log(`   CAR: ${(size / 1024 / 1024).toFixed(2)} MB`);
+  return { carPath: outputCarPath, cid };
+}
+function computeStorageCid(chunks) {
+  const hashCode = 18;
+  const chunkInfo = chunks.map((c) => ({
+    cid: createCID(c, CID_CONFIG.codec, hashCode),
+    len: c.length
+  }));
+  const fileData = new UnixFS({ type: "file", blockSizes: chunkInfo.map((c) => BigInt(c.len)) });
+  const dagNode = dagPB.prepare({ Data: fileData.marshal(), Links: chunkInfo.map((c) => ({ Name: "", Tsize: c.len, Hash: c.cid })) });
+  const dagBytes = dagPB.encode(dagNode);
+  return createCID(dagBytes, 112, hashCode).toString();
+}
+async function storeDirectory(directoryPath, providerOrOptions = {}, password, jsMerkle) {
+  const opts = providerOrOptions && ("provider" in providerOrOptions || "onCarReady" in providerOrOptions || "password" in providerOrOptions || "jsMerkle" in providerOrOptions) ? providerOrOptions : { provider: providerOrOptions, password, jsMerkle };
+  const provider = opts.provider ?? {};
+  password = opts.password;
+  jsMerkle = opts.jsMerkle;
+  let carContent;
+  let ipfsCid;
+  const dirBasename = path.basename(directoryPath);
+  sampleMemory("storage_start");
+  if (jsMerkle) {
+    const result = await withSpan("deploy.merkleize", "1a. merkleize (js)", { "deploy.directory": dirBasename }, async () => {
+      const r = await merkleizeJS(directoryPath);
+      sampleMemory("merkleize_end");
+      return r;
+    });
+    carContent = result.carBytes;
+    ipfsCid = result.cid;
+  } else {
+    const carPath = path.join(path.dirname(directoryPath), `${path.basename(directoryPath)}.car`);
+    const { cid } = await withSpan("deploy.merkleize", "1a. merkleize", { "deploy.directory": dirBasename }, async () => {
+      const r = await merkleize(directoryPath, carPath);
+      sampleMemory("merkleize_end");
+      return r;
+    });
+    ipfsCid = cid;
+    carContent = fs.readFileSync(carPath);
+  }
+  if (password) {
+    console.log(`   Encrypting CAR file...`);
+    carContent = await encryptContent(carContent, password);
+    console.log(`   Encrypted: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
+  }
+  const carDumpEnv = process.env.BULLETIN_DEPLOY_DUMP_CAR;
+  const carDumpOpt = opts.dumpCar;
+  if (carDumpEnv !== void 0 || carDumpOpt) {
+    const dumpPath = typeof carDumpEnv === "string" && carDumpEnv ? carDumpEnv : typeof carDumpOpt === "string" && carDumpOpt ? carDumpOpt : path.join(path.dirname(directoryPath), `${path.basename(directoryPath)}.bulletin.car`);
+    fs.writeFileSync(dumpPath, carContent);
+    console.log(`   Pre-upload CAR saved to ${dumpPath} (${(carContent.length / 1024 / 1024).toFixed(2)} MB)`);
+  }
+  const carChunks = chunk(carContent, CHUNK_SIZE);
+  const predictedStorageCid = computeStorageCid(carChunks);
+  if (opts.onCarReady) await opts.onCarReady(carContent, predictedStorageCid);
+  setDeployReportContext({
+    jsMerkle: Boolean(jsMerkle),
+    chunkCount: carChunks.length,
+    carBytes: carContent.length,
+    outputDir: path.dirname(directoryPath)
+  });
+  setDeployContext({
+    chunkCount: carChunks.length,
+    totalSize: `${(carContent.length / 1024 / 1024).toFixed(2)} MB`
+  });
+  const carMb = String(Math.round(carContent.length / 1024 / 1024 * 100) / 100);
+  const storageCid = await withSpan("deploy.chunk-upload", "1b. chunk-upload", { "deploy.chunks.total": carChunks.length, "deploy.car.bytes": carContent.length, "deploy.car.mb": carMb }, async () => {
+    sampleMemory("chunk_upload_start");
+    const r = await storeChunkedContent(carChunks, provider);
+    sampleMemory("chunk_upload_end");
+    return r.storageCid;
+  });
+  if (storageCid !== predictedStorageCid) {
+    captureWarning("computeStorageCid drift vs storeChunkedContent", {
+      predicted: predictedStorageCid,
+      uploaded: storageCid
+    });
+  }
+  return { storageCid, ipfsCid, carBytes: carContent };
+}
+async function readPreviousContenthashSafe(dotns, domainName) {
+  try {
+    const hex = await dotns.getContenthash(domainName);
+    if (!hex || hex === "0x") return null;
+    const bytes = Buffer.from(hex.slice(2), "hex");
+    if (bytes[0] !== 227 || bytes.length < 4) return null;
+    return CID.decode(bytes.slice(2)).toString();
+  } catch {
+    return null;
+  }
+}
+function buildFilesMap(buildDir, fileCids = /* @__PURE__ */ new Map()) {
+  const map = {};
+  function walk(dir, prefix = "") {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+      const abs = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(abs, rel);
+      else if (entry.isFile()) {
+        if (rel === MANIFEST_PATH) continue;
+        const fileCid = fileCids.get(rel) ?? "";
+        let size = 0;
+        try {
+          size = fs.statSync(abs).size;
+        } catch {
+        }
+        const type = classifyFile(rel, { fileCid: fileCid || void 0 });
+        map[rel] = { cid: fileCid, type, size };
+      }
+    }
+  }
+  walk(buildDir);
+  return map;
+}
+async function readRetentionPeriodBlocks(unsafeApi) {
+  try {
+    const rp = await unsafeApi.query.TransactionStorage.RetentionPeriod.getValue();
+    return Number(rp);
+  } catch {
+    return 0;
+  }
+}
+function detectFramework(directoryPath) {
+  if (fs.existsSync(path.join(directoryPath, "_next"))) return "next";
+  if (fs.existsSync(path.join(directoryPath, "assets"))) return "vite";
+  return null;
+}
+var SIZE_WARN_BYTES = 50 * 1024 * 1024;
+var SIZE_ABORT_BYTES = 500 * 1024 * 1024;
+function checkDeploySize(carBytes, opts) {
+  if (carBytes >= SIZE_ABORT_BYTES && !opts.allowLargeDeploy) {
+    return { kind: "abort", message: `deploy exceeds 500 MiB (${(carBytes / 1024 / 1024).toFixed(1)} MiB). Re-run with --allow-large-deploy if intentional.` };
+  }
+  if (carBytes >= SIZE_WARN_BYTES) {
+    return { kind: "warn", message: `deploy exceeds 50 MiB (${(carBytes / 1024 / 1024).toFixed(1)} MiB). Continuing.` };
+  }
+  return { kind: "ok" };
+}
+function resolveReproducibleTimestamp(source) {
+  if (source === "commit") {
+    try {
+      const out = execSync("git log -1 --format=%cI", { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+      const d2 = new Date(out);
+      if (Number.isNaN(d2.getTime())) throw new Error("invalid git committer date");
+      return d2.toISOString();
+    } catch (e) {
+      throw new Error(`--reproducible=commit failed: ${e?.message ?? e}. Provide --reproducible=<ISO8601> instead.`);
+    }
+  }
+  if (source.startsWith("epoch:")) {
+    const n = Number(source.slice("epoch:".length));
+    if (!Number.isFinite(n)) throw new Error(`--reproducible=epoch:N requires a number; got ${source}`);
+    return new Date(n * 1e3).toISOString();
+  }
+  const d = new Date(source);
+  if (Number.isNaN(d.getTime())) throw new Error(`--reproducible=<source>: '${source}' is not a recognised timestamp`);
+  return d.toISOString();
+}
+function preWarmGateway(chunkCids, gateways) {
+  for (const cid of chunkCids) {
+    for (const gw of gateways) {
+      const url = `${gw.replace(/\/$/, "")}/ipfs/${cid}`;
+      fetch(url, { method: "HEAD" }).catch(() => {
+      });
+    }
+  }
+}
+function applyManifestFetchAttributes(fetched) {
+  setDeployAttribute("deploy.manifest.fetch_source", fetched.source);
+  setDeployAttribute("deploy.manifest.fetch_attempts", String(fetched.attempts ?? 0));
+  setDeployAttribute("deploy.manifest.bytes_downloaded", String(fetched.bytesDownloaded ?? 0));
+}
+async function storeDirectoryV2(directoryPath, opts = {}) {
+  if (opts.password) return storeDirectory(directoryPath, opts);
+  const provider = opts.provider ?? {};
+  const prevContenthash = opts.previousContenthash ?? null;
+  const gateway = opts.gateway;
+  const dirBasename = path.basename(directoryPath);
+  sampleMemory("storage_start");
+  const fetched = await fetchPreviousManifest(prevContenthash, {
+    gateway,
+    domain: opts.domain
+  });
+  const prevManifest = fetched.source === "embedded" ? fetched.manifest : null;
+  console.log(`   Manifest fetch: ${fetched.source}${fetched.source !== "none" ? ` (${fetched.attempts} attempt${fetched.attempts === 1 ? "" : "s"})` : ""}`);
+  applyManifestFetchAttributes(fetched);
+  const deployedAt = opts.reproducibleSource ? resolveReproducibleTimestamp(opts.reproducibleSource) : (/* @__PURE__ */ new Date()).toISOString();
+  writeEmbeddedManifestPlaceholder(directoryPath, {
+    version: MANIFEST_VERSION,
+    previousContenthash: prevContenthash,
+    deployedAt,
+    framework: null
+  });
+  let useKubo;
+  if (opts.jsMerkle === true) {
+    useKubo = false;
+  } else if (opts.jsMerkle === false) {
+    if (!hasIPFS()) {
+      throw new Error("jsMerkle:false requires the ipfs binary on PATH; install from https://docs.ipfs.tech/install/ or omit --js-merkle to fall back to JS.");
+    }
+    useKubo = true;
+  } else {
+    useKubo = hasIPFS();
+  }
+  const phaseA = await withSpan("deploy.merkleize", `1a. merkleize (${useKubo ? "kubo" : "js"}, stable)`, { "deploy.directory": dirBasename, "deploy.merkle": useKubo ? "kubo" : "js" }, async () => {
+    const r = await merkleizeWithStableOrder(directoryPath, prevManifest?.stableBlockOrder, { useKubo });
+    sampleMemory("merkleize_end");
+    return r;
+  });
+  const carChunksA = phaseA.chunks;
+  const carChunkCidsA = phaseA.chunkCids;
+  const s1Start = phaseA.sectionChunkCounts.section0;
+  const s1End = s1Start + phaseA.sectionChunkCounts.section1;
+  const phaseAUploadChunks = carChunksA.slice(s1Start, s1End);
+  const phaseAUploadCids = carChunkCidsA.slice(s1Start, s1End);
+  const trustedCidsA = /* @__PURE__ */ new Set();
+  if (prevManifest?.chunks) {
+    for (const cid of Object.keys(prevManifest.chunks)) {
+      trustedCidsA.add(cid);
+    }
+  }
+  const skipCidsA = new Set(phaseAUploadCids);
+  const probeFailedCidsA = /* @__PURE__ */ new Set();
+  const hasNewChunks = phaseAUploadCids.some((c) => !trustedCidsA.has(c));
+  setDeployAttribute("deploy.phase_a.chunks_trusted", trustedCidsA.size);
+  setDeployReportContext({
+    jsMerkle: true,
+    chunkCount: carChunksA.length,
+    carBytes: phaseA.carBytes.length,
+    outputDir: path.dirname(directoryPath)
+  });
+  setDeployContext({
+    chunkCount: carChunksA.length,
+    totalSize: `${(phaseA.carBytes.length / 1024 / 1024).toFixed(2)} MB`
+  });
+  const carMbA = String(Math.round(phaseA.carBytes.length / 1024 / 1024 * 100) / 100);
+  let phaseALiveProvider = provider;
+  let phaseASkipProbeResults = /* @__PURE__ */ new Map();
+  if (!hasNewChunks) {
+    console.log(`   Phase A: nothing to upload (all ${phaseAUploadCids.length} section-1 chunks trusted from prev manifest)`);
+    phaseASkipProbeResults = new Map(phaseAUploadCids.map((c) => [c, true]));
+  } else {
+    const trustedCount = phaseAUploadCids.length - skipCidsA.size;
+    if (trustedCount > 0) {
+      console.log(`   Phase A: ${skipCidsA.size} new chunks to upload, ${trustedCount} trusted from prev manifest`);
+    }
+    await withSpan("deploy.chunk-upload", "1b. chunk-upload (phase A)", {
+      "deploy.chunks.total": phaseAUploadChunks.length,
+      "deploy.car.bytes": phaseA.carBytes.length,
+      "deploy.car.mb": carMbA
+    }, async () => {
+      sampleMemory("chunk_upload_start");
+      const phaseAUpload = await storeChunkedContent(phaseAUploadChunks, { ...provider, gateway, skipCids: skipCidsA, trustedCids: trustedCidsA, skipRootStore: true });
+      phaseALiveProvider = { ...provider, ...phaseAUpload.liveProvider };
+      phaseASkipProbeResults = phaseAUpload.skipProbeResults;
+      setDeployAttribute("deploy.storage.phase_a.root_already_onchain", String(phaseAUpload.rootSkipped));
+      if (phaseAUpload.tier2Inconclusive > 0) {
+        captureWarning("Phase A chunk probe inconclusive \u2014 chain RPC returned null for some CIDs", {
+          tier2Inconclusive: phaseAUpload.tier2Inconclusive,
+          total: phaseAUploadChunks.length
+        });
+      }
+      sampleMemory("chunk_upload_end");
+    });
+  }
+  let probePresent = 0;
+  let probeAbsent = 0;
+  let bytesProbePresent = 0;
+  let bytesProbeAbsent = 0;
+  for (let i = 0; i < phaseAUploadCids.length; i++) {
+    const cid = phaseAUploadCids[i];
+    if (trustedCidsA.has(cid)) {
+      probePresent++;
+      bytesProbePresent += phaseAUploadChunks[i].length;
+      continue;
+    }
+    const present = phaseASkipProbeResults.get(cid);
+    if (present === true) {
+      probePresent++;
+      bytesProbePresent += phaseAUploadChunks[i].length;
+    } else if (present === false) {
+      probeAbsent++;
+      bytesProbeAbsent += phaseAUploadChunks[i].length;
+    } else if (present === null) {
+      probeFailedCidsA.add(cid);
+    }
+  }
+  const probeFailedCount = probeFailedCidsA.size;
+  setDeployAttribute("deploy.probe.present", probePresent);
+  setDeployAttribute("deploy.probe.absent", probeAbsent);
+  setDeployAttribute("deploy.probe.failed", probeFailedCount);
+  setDeployAttribute("deploy.phase_a.chunks_uploaded", probeAbsent);
+  const phaseAKnownPresent = new Set(phaseAUploadCids);
+  const filesMap = buildFilesMap(directoryPath, phaseA.fileCids);
+  const blocksList = [...phaseA.blocks.keys()];
+  const chunksMap = {};
+  for (let i = 0; i < phaseA.section1ChunkCids.length; i++) {
+    const cid = phaseA.section1ChunkCids[i];
+    const probePresence = phaseASkipProbeResults.get(cid);
+    const inheritFrom = prevManifest?.chunks?.[cid];
+    let deployedAtForChunk;
+    if ((probePresence === true || probePresence === null) && inheritFrom) {
+      deployedAtForChunk = inheritFrom.deployed_at;
+    } else {
+      deployedAtForChunk = deployedAt;
+    }
+    const probedIdx = phaseA.chunkCids.indexOf(cid);
+    const sizeBytes = phaseA.chunks[probedIdx]?.length ?? 0;
+    chunksMap[cid] = { size: sizeBytes, deployed_at: deployedAtForChunk };
+  }
+  finaliseEmbeddedManifest(directoryPath, {
+    version: MANIFEST_VERSION,
+    previousContenthash: prevContenthash,
+    deployedAt,
+    framework: detectFramework(directoryPath),
+    files: filesMap,
+    stableBlockOrder: phaseA.stableOrder,
+    blocks: blocksList,
+    chunks: chunksMap
+  });
+  phaseA.blocks.clear();
+  carChunksA.length = 0;
+  phaseA.carBytes = new Uint8Array(0);
+  const phaseB = await withSpan("deploy.merkleize", "1c. merkleize (js, finalise)", { "deploy.directory": dirBasename }, async () => {
+    const r = await merkleizeWithStableOrder(directoryPath, phaseA.stableOrder, { useKubo });
+    sampleMemory("merkleize_finalise_end");
+    return r;
+  });
+  const sizeDecision = checkDeploySize(phaseB.carBytes.length, { allowLargeDeploy: opts.allowLargeDeploy });
+  if (sizeDecision.kind === "abort") throw new Error(sizeDecision.message);
+  if (sizeDecision.kind === "warn") console.warn(`   \u26A0 ${sizeDecision.message}`);
+  const carDumpEnv = process.env.BULLETIN_DEPLOY_DUMP_CAR;
+  const carDumpOpt = opts.dumpCar;
+  if (carDumpEnv !== void 0 || carDumpOpt) {
+    const dumpPath = typeof carDumpEnv === "string" && carDumpEnv ? carDumpEnv : typeof carDumpOpt === "string" && carDumpOpt ? carDumpOpt : path.join(path.dirname(directoryPath), `${path.basename(directoryPath)}.bulletin.car`);
+    fs.writeFileSync(dumpPath, phaseB.carBytes);
+    console.log(`   Pre-upload CAR saved to ${dumpPath} (${(phaseB.carBytes.length / 1024 / 1024).toFixed(2)} MB)`);
+  }
+  const carChunksB = phaseB.chunks;
+  const carChunkCidsB = phaseB.chunkCids;
+  const trustedCidsB = new Set(phaseAKnownPresent);
+  let phaseBProbeHits = 0;
+  {
+    const phaseBUnknown = carChunkCidsB.filter((c) => !trustedCidsB.has(c));
+    if (phaseBUnknown.length > 0) {
+      const probeResults = await probeChunks(phaseBUnknown, { client: phaseALiveProvider.client });
+      for (const r of probeResults) {
+        if (r.present === true) {
+          trustedCidsB.add(r.cid);
+          phaseBProbeHits++;
+        }
+      }
+    }
+  }
+  const predictedStorageCid = computeStorageCid(carChunksB);
+  if (opts.onCarReady) await opts.onCarReady(phaseB.carBytes, predictedStorageCid);
+  const carMbB = String(Math.round(phaseB.carBytes.length / 1024 / 1024 * 100) / 100);
+  const newPhaseBChunks = carChunkCidsB.filter((c) => !trustedCidsB.has(c)).length;
+  const phaseBResult = await withSpan("deploy.chunk-upload", "1d. chunk-upload (phase B)", {
+    "deploy.chunks.total": carChunksB.length,
+    "deploy.chunks.phase_b_new": newPhaseBChunks,
+    "deploy.car.bytes": phaseB.carBytes.length,
+    "deploy.car.mb": carMbB
+  }, async () => {
+    sampleMemory("chunk_upload_b_start");
+    const r = await storeChunkedContent(carChunksB, { ...phaseALiveProvider, gateway, trustedCids: trustedCidsB, probeFailedCids: probeFailedCidsA });
+    sampleMemory("chunk_upload_b_end");
+    return r;
+  });
+  const storageCid = phaseBResult.storageCid;
+  setDeployAttribute("deploy.storage.phase_b.probe_hit_count", phaseBProbeHits);
+  {
+    const grandpaCids = [...phaseB.chunkCids, storageCid];
+    console.log(`   Finality check: probing ${grandpaCids.length} chunks at chain-finalised state (aka GRANDPA)...`);
+    const finalityResults = await probeChunks(grandpaCids, { client: phaseALiveProvider.client, atFinalized: true });
+    let missingCids = new Set(finalityResults.filter((r) => r.present === false).map((r) => r.cid));
+    setDeployAttribute("deploy.probe.finality_miss_count", missingCids.size);
+    let reuploadCount = 0;
+    if (missingCids.size === 0) {
+      console.log(`   \u2713 All ${grandpaCids.length} chunks finalised`);
+    } else {
+      console.log(`   ${missingCids.size} chunks not yet finalised \u2014 waiting up to ${GRANDPA_NATURAL_WAIT_MS / 1e3}s for natural finalisation`);
+      for (const cid of missingCids) console.log(`      ${cid.slice(0, 20)}\u2026`);
+      const waitStart = Date.now();
+      while (Date.now() - waitStart < GRANDPA_NATURAL_WAIT_MS && missingCids.size > 0) {
+        await new Promise((r) => setTimeout(r, GRANDPA_REUPLOAD_POLL_MS));
+        const poll = await probeChunks([...missingCids], { client: phaseALiveProvider.client, atFinalized: true });
+        for (const r of poll) {
+          if (r.present === true) missingCids.delete(r.cid);
+        }
+      }
+      if (missingCids.size === 0) {
+        const elapsed = Math.round((Date.now() - waitStart) / 1e3);
+        console.log(`   \u2713 All ${grandpaCids.length} chunks finalised (waited ${elapsed}s)`);
+      } else {
+        const rootHashCode = 18;
+        const rootChunkLinks = phaseB.chunks.map((c) => ({
+          cid: createCID(c, CID_CONFIG.codec, rootHashCode),
+          len: c.length
+        }));
+        const rootFileData = new UnixFS({ type: "file", blockSizes: rootChunkLinks.map((c) => BigInt(c.len)) });
+        const rootDagNode = dagPB.prepare({ Data: rootFileData.marshal(), Links: rootChunkLinks.map((c) => ({ Name: "", Tsize: c.len, Hash: c.cid })) });
+        const rootDagBytes = dagPB.encode(rootDagNode);
+        const phaseBChunkByCid = /* @__PURE__ */ new Map();
+        for (let i = 0; i < phaseB.chunkCids.length; i++) {
+          phaseBChunkByCid.set(phaseB.chunkCids[i], phaseB.chunks[i]);
+        }
+        const fetchNonceFn = phaseALiveProvider.fetchNonce ?? fetchNonce;
+        for (let round = 1; round <= GRANDPA_REUPLOAD_MAX_ROUNDS && missingCids.size > 0; round++) {
+          const roundSuffix = round > 1 ? ` (round ${round}/${GRANDPA_REUPLOAD_MAX_ROUNDS}, retry after fork)` : "";
+          console.log(`   ${missingCids.size} chunks still missing after wait \u2014 re-uploading${roundSuffix}`);
+          const reuploadList = [...missingCids];
+          for (let i = 0; i < reuploadList.length; i++) {
+            const cid = reuploadList[i];
+            const freshNonce = await fetchNonceFn(BULLETIN_ENDPOINTS, phaseALiveProvider.ss58);
+            if (cid === storageCid) {
+              const rootTx = phaseALiveProvider.unsafeApi.tx.TransactionStorage.store_with_cid_config({
+                cid: { codec: BigInt(112), hashing: toHashingEnum(rootHashCode) },
+                data: rootDagBytes
+              });
+              await watchTransaction(rootTx, phaseALiveProvider.signer, { mortality: { mortal: true, period: 256 }, nonce: freshNonce }, () => storageCid, {
+                label: "root-reupload",
+                rpc: BULLETIN_ENDPOINTS,
+                senderSS58: phaseALiveProvider.ss58,
+                expectedNonce: freshNonce,
+                timeoutMs: CHUNK_TIMEOUT_MS,
+                fetchNonce: phaseALiveProvider.fetchNonce
+              });
+            } else {
+              const chunkBytes = phaseBChunkByCid.get(cid);
+              if (!chunkBytes) {
+                throw new Error(
+                  `Deploy verification failed: chunk ${cid.slice(0, 20)}\u2026 missing at finalised head and its bytes are not in phaseB.chunks (cannot re-upload). This indicates an internal state issue.`
+                );
+              }
+              await storeChunk(phaseALiveProvider.unsafeApi, phaseALiveProvider.signer, chunkBytes, freshNonce, phaseALiveProvider.ss58, { fetchNonce: phaseALiveProvider.fetchNonce });
+            }
+            reuploadCount++;
+            console.log(`      [${i + 1}/${reuploadList.length}] re-uploaded ${cid.slice(0, 20)}\u2026 (nonce ${freshNonce})`);
+          }
+          const reuploadStart = Date.now();
+          while (Date.now() - reuploadStart < GRANDPA_REUPLOAD_TIMEOUT_MS && missingCids.size > 0) {
+            await new Promise((r) => setTimeout(r, GRANDPA_REUPLOAD_POLL_MS));
+            const poll = await probeChunks([...missingCids], { client: phaseALiveProvider.client, atFinalized: true });
+            for (const r of poll) {
+              if (r.present === true) missingCids.delete(r.cid);
+            }
+          }
+        }
+        if (missingCids.size > 0) {
+          const stuck = [...missingCids][0];
+          throw new Error(
+            `Deploy verification failed: ${missingCids.size} chunk(s) not finalised after ${GRANDPA_REUPLOAD_MAX_ROUNDS} re-upload round(s) (first: ${stuck.slice(0, 20)}\u2026). The chain may have dropped chunks due to a persistent fork. Re-run deploy.`
+          );
+        }
+        console.log(`   \u2713 All ${grandpaCids.length} chunks finalised after re-upload`);
+      }
+    }
+    setDeployAttribute("deploy.probe.finality_miss_reupload_count", reuploadCount);
+  }
+  if (opts.domain) {
+    try {
+      const manifestText = fs.readFileSync(path.join(directoryPath, MANIFEST_PATH), "utf8");
+      writePersistentLocalManifest(opts.domain, storageCid, manifestText);
+    } catch {
+    }
+  }
+  if (storageCid !== predictedStorageCid) {
+    captureWarning("computeStorageCid drift vs storeChunkedContent (v2)", {
+      predicted: predictedStorageCid,
+      uploaded: storageCid
+    });
+  }
+  const newlyUploadedCids = carChunkCidsB.filter((c) => !trustedCidsB.has(c));
+  if (newlyUploadedCids.length > 0 && gateway) {
+    preWarmGateway(newlyUploadedCids, [gateway]);
+  }
+  const retentionPeriodBlocks = await readRetentionPeriodBlocks(provider.unsafeApi);
+  const framework = detectFramework(directoryPath);
+  const filesStableCount = [...phaseA.fileCids.entries()].filter(([p, cid]) => {
+    if (p === MANIFEST_PATH) return false;
+    return classifyFile(p, { prevManifest, fileCid: cid, framework }) === "stable";
+  }).length;
+  const filesTotalCount = phaseA.fileCids.size - (phaseA.fileCids.has(MANIFEST_PATH) ? 1 : 0);
+  const probeResultsForStats = carChunkCidsA.flatMap((cid) => {
+    if (trustedCidsA.has(cid)) return [{ cid, present: true, block: 0, index: 0 }];
+    if (!phaseASkipProbeResults.has(cid)) return [];
+    const present = phaseASkipProbeResults.get(cid);
+    if (present === true) return [{ cid, present: true, block: 0, index: 0 }];
+    if (present === false) return [{ cid, present: false }];
+    return [{ cid, present: null, failureReason: "rpc_error" }];
+  });
+  let phaseBChunksUploaded = 0;
+  let phaseBBytesUploaded = 0;
+  for (let i = 0; i < phaseB.chunks.length; i++) {
+    if (!trustedCidsB.has(phaseB.chunkCids[i])) {
+      phaseBChunksUploaded++;
+      phaseBBytesUploaded += phaseB.chunks[i].length;
+    }
+  }
+  const chunksUploadedTotal = probeAbsent + phaseBChunksUploaded;
+  const bytesUploadedTotal = bytesProbeAbsent + phaseBBytesUploaded;
+  const chunksSkippedTotal = phaseB.chunks.length - chunksUploadedTotal;
+  const bytesSkippedTotal = phaseB.carBytes.length - bytesUploadedTotal;
+  const stats = computeStats({
+    manifestSource: fetched.source,
+    manifestFetchAttempts: fetched.source === "none" ? 0 : fetched.attempts ?? 0,
+    manifestBytes: fetched.source === "embedded" ? fetched.bytesDownloaded ?? 0 : 0,
+    framework,
+    filesTotal: filesTotalCount,
+    filesStable: filesStableCount,
+    filesVolatile: filesTotalCount - filesStableCount,
+    probeResults: probeResultsForStats,
+    prevChunks: prevManifest?.chunks ?? {},
+    retentionPeriodBlocks,
+    bytesProbePresent,
+    bytesProbeAbsent,
+    bytesSkipped: bytesSkippedTotal,
+    bytesUploaded: bytesUploadedTotal,
+    chunksTotal: phaseB.chunks.length,
+    chunksUploaded: chunksUploadedTotal,
+    chunksSkipped: chunksSkippedTotal,
+    carBytes: phaseB.carBytes.length,
+    sectionSizes: phaseB.sectionSizes,
+    tier2VerifiedCount: phaseBResult.tier2Verified,
+    tier2InconclusiveCount: phaseBResult.tier2Inconclusive,
+    tier2FallbackCount: phaseBResult.tier2Fallback
+  });
+  for (const [k, v] of Object.entries(telemetryAttributes(stats))) {
+    setDeployAttribute(k, v);
+  }
+  console.log("\n" + renderSummary(stats));
+  console.log(`   Final root check: ${storageCid}`);
+  const rootProbe = await probeChunks([storageCid], { client: phaseALiveProvider.client, atFinalized: true });
+  if (rootProbe[0]?.present === false) {
+    throw new Error(
+      `Deploy verification failed: DAG-PB root ${storageCid.slice(0, 20)}\u2026 not finalised. The chain may have evicted the root extrinsic. Re-run deploy.`
+    );
+  }
+  if (rootProbe[0]?.present === true) {
+    console.log(`   \u2713 Root finalised on chain`);
+  } else {
+    console.log(`   Root re-check inconclusive (RPC error) \u2014 GRANDPA probe above already verified; continuing.`);
+  }
+  return { storageCid, ipfsCid: phaseB.cid, carBytes: phaseB.carBytes };
+}
+function resolveDotnsConnectOptions(options, assetHubEndpoints, autoAccountMapping, contracts, nativeToEthRatio, environmentId, popSelfServe, registerStorageDeposit) {
+  const tail = assetHubEndpoints && assetHubEndpoints.length > 0 ? { assetHubEndpoints } : {};
+  const mappingTail = autoAccountMapping ? { autoAccountMapping } : {};
+  const contractsTail = contracts && Object.keys(contracts).length > 0 ? { contracts } : {};
+  const ratioTail = nativeToEthRatio ? { nativeToEthRatio } : {};
+  const envTail = environmentId ? { environmentId } : {};
+  const popTail = popSelfServe !== void 0 ? { popSelfServe } : {};
+  const storageTail = registerStorageDeposit !== void 0 ? { registerStorageDeposit } : {};
+  if (options.signer && options.signerAddress) {
+    return { signer: options.signer, signerAddress: options.signerAddress, ...tail, ...mappingTail, ...contractsTail, ...ratioTail, ...envTail, ...popTail, ...storageTail };
+  }
+  return { mnemonic: options.mnemonic, derivationPath: options.derivationPath, ...tail, ...mappingTail, ...contractsTail, ...ratioTail, ...envTail, ...popTail, ...storageTail };
+}
+async function estimateUploadBytes(content) {
+  try {
+    if (Array.isArray(content)) {
+      return content.reduce((s, c) => s + c.length, 0);
+    }
+    if (content instanceof Uint8Array) {
+      return content.length;
+    }
+    const resolved = path.resolve(content);
+    if (!fs.existsSync(resolved)) return null;
+    const st = fs.statSync(resolved);
+    if (st.isFile()) return st.size;
+    let total = 0;
+    const walk = (dir) => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const child = path.join(dir, entry.name);
+        if (entry.isDirectory()) walk(child);
+        else if (entry.isFile()) total += fs.statSync(child).size;
+      }
+    };
+    walk(resolved);
+    return total;
+  } catch {
+    return null;
+  }
+}
+function assertSubdomainOwnerMatchesSigner(result, signerEvmAddress, sublabel, parentLabel) {
+  if (result.owned && result.owner?.toLowerCase() !== signerEvmAddress?.toLowerCase()) {
+    throw new NonRetryableError(
+      `Subdomain ${sublabel}.${parentLabel}.dot is already owned by ${result.owner} (signer is ${signerEvmAddress}). Use a fresh subdomain label, or release the existing registration.`
+    );
+  }
+}
+async function publish(dotns, parsed, failOnError) {
+  console.log("\n" + "=".repeat(60));
+  console.log("Publish");
+  console.log("=".repeat(60));
+  if (parsed.isSubdomain) {
+    console.log(`   Subdomains are not supported by the Publisher registry \u2014 skipping.`);
+    return;
+  }
+  try {
+    const result = await dotns.publishLabel(parsed.label);
+    setDeployAttribute("deploy.publish.status", result.status);
+    if (result.txHash) setDeployAttribute("deploy.publish.tx", result.txHash);
+    console.log(`   Status: ${result.status}`);
+  } catch (e) {
+    if (e instanceof PublisherNotSupportedError) {
+      console.log(`   Skipped: ${e.message}`);
+      return;
+    }
+    setDeployAttribute("deploy.publish.status", "failed");
+    if (failOnError) throw e;
+    const msg = e?.message ?? String(e);
+    console.error(`   Warning: publish failed (non-fatal): ${msg}`);
+    captureWarning("publish failed", { error: msg.slice(0, 200) });
+  }
+}
+async function unpublish(domainName, options = {}) {
+  const envId = options.env ?? DEFAULT_ENV_ID;
+  const { doc } = await loadEnvironments();
+  const resolved = resolveEndpoints(doc, envId);
+  const popSelfServe = getPopSelfServeConfig(doc, envId);
+  const parsed = parseDomainName(domainName);
+  if (parsed.isSubdomain) {
+    throw new Error(`Subdomains are not supported by the Publisher registry. To unpublish ${parsed.parentLabel}.dot (which controls ${domainName}), pass that label directly.`);
+  }
+  const label = parsed.label;
+  const dotns = new DotNS();
+  try {
+    await dotns.connect(resolveDotnsConnectOptions(
+      { mnemonic: options.mnemonic, derivationPath: options.derivationPath },
+      resolved.assetHub,
+      resolved.autoAccountMapping,
+      resolved.contracts,
+      resolved.nativeToEthRatio,
+      envId,
+      popSelfServe,
+      resolved.registerStorageDeposit
+    ));
+    const result = await dotns.unpublishLabel(label);
+    return { domainName: `${label}.dot`, status: result.status, txHash: result.txHash };
+  } finally {
+    try {
+      dotns.disconnect();
+    } catch {
+    }
+  }
+}
+async function deploy(content, domainName = null, options = {}) {
+  const envId = options.env ?? DEFAULT_ENV_ID;
+  let envBulletin = [DEFAULT_BULLETIN_RPC];
+  let envAssetHub;
+  let envSource;
+  let envNetwork;
+  let envName;
+  let envIpfs;
+  let envAutoAccountMapping = false;
+  let envContracts = {};
+  let envBulletinAuthorizeV2 = false;
+  let envNativeToEthRatio;
+  let envRegisterStorageDeposit;
+  let envPopSelfServe = null;
+  if (options.bulletinEndpoints && options.bulletinEndpoints.length > 0) {
+    envBulletin = options.bulletinEndpoints;
+    envAssetHub = options.assetHubEndpoints;
+  } else {
+    try {
+      const { doc, source } = await loadEnvironments();
+      const resolved = resolveEndpoints(doc, envId);
+      envBulletin = resolved.bulletin;
+      envAssetHub = options.assetHubEndpoints ?? resolved.assetHub;
+      envSource = source;
+      envNetwork = resolved.network;
+      envName = resolved.envName;
+      envIpfs = resolved.ipfs;
+      envAutoAccountMapping = resolved.autoAccountMapping;
+      envContracts = resolved.contracts;
+      envBulletinAuthorizeV2 = resolved.bulletinAuthorizeV2;
+      envNativeToEthRatio = resolved.nativeToEthRatio;
+      envRegisterStorageDeposit = resolved.registerStorageDeposit;
+      envPopSelfServe = getPopSelfServeConfig(doc, envId);
+    } catch (e) {
+      if (e instanceof NonRetryableError) throw e;
+      if (options.env !== void 0) throw e;
+      captureWarning(`environments load failed: ${e?.message ?? e}`);
+    }
+  }
+  const userRpc = options.rpc ?? process.env.BULLETIN_RPC;
+  BULLETIN_ENDPOINTS = userRpc ? [userRpc, ...envBulletin.filter((e) => e !== userRpc)] : envBulletin;
+  _deployRpcFailedOver = false;
+  POOL_SIZE = options.poolSize ?? parseInt(process.env.BULLETIN_POOL_SIZE ?? String(DEFAULT_POOL_SIZE), 10);
+  initTelemetry();
+  const randomSuffix = Math.floor(Math.random() * 100).toString().padStart(2, "0");
+  const parsed = domainName ? parseDomainName(domainName) : null;
+  const name = parsed ? parsed.label : `test-domain-${Date.now().toString(36)}${randomSuffix}`;
+  return withDeploySpan(name, async () => {
+    const deployTag = options.tag ?? process.env.DEPLOY_TAG;
+    if (deployTag) {
+      setDeployAttribute("deploy.tag", deployTag);
+      setDeploySentryTag("deploy.tag", deployTag);
+    }
+    setDeployAttribute("deploy.env", envId);
+    setDeployAttribute("deploy.label", parsed?.label ?? name);
+    setDeployAttribute("deploy.subdomain", String(parsed?.isSubdomain ?? false));
+    if (envNetwork) setDeployAttribute("deploy.network", envNetwork);
+    if (envSource) setDeployAttribute("deploy.environments_source", envSource);
+    let cid;
+    let ipfsCid;
+    let mirrorPromise = Promise.resolve(null);
+    console.log("\n" + "=".repeat(60));
+    console.log(`DEPLOYING TO TESTNET                    v${VERSION}`);
+    console.log("=".repeat(60));
+    if (envName) console.log(`   Environment: ${envName}`);
+    console.log(`   Domain: ${name}.dot`);
+    if (deployTag) console.log(`   Tag: ${deployTag}`);
+    if (options.inputCar) console.log(`   Input CAR: ${path.resolve(options.inputCar)}`);
+    else if (typeof content === "string") console.log(`   Build dir: ${path.resolve(content)}`);
+    if (process.env.CI) console.log(`   Runner: ${resolveRunner()} (${resolveRunnerType()})`);
+    if (options.password) console.log(`   Encrypted: yes`);
+    let provider;
+    const reconnect = options.mnemonic ? () => getDirectProvider(options.mnemonic, options.derivationPath, envBulletinAuthorizeV2) : () => getProvider();
+    let dotnsPreflight = null;
+    let previousContenthashCid = null;
+    try {
+      console.log("\n" + "=".repeat(60));
+      console.log("Preflight");
+      console.log("=".repeat(60));
+      const preflight = new DotNS();
+      await preflight.connect(resolveDotnsConnectOptions(options, envAssetHub, envAutoAccountMapping, envContracts, envNativeToEthRatio, envId, envPopSelfServe, envRegisterStorageDeposit));
+      if (parsed?.isSubdomain) {
+        try {
+          const subResult = await preflight.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
+          assertSubdomainOwnerMatchesSigner(subResult, preflight.evmAddress, parsed.sublabel, parsed.parentLabel);
+          if (!subResult.owned) {
+            const { owned: parentOwned, owner: parentOwner } = await preflight.checkOwnership(parsed.parentLabel);
+            if (!parentOwned) {
+              throw new NonRetryableError(
+                `Cannot deploy ${parsed.fullName}: parent ${parsed.parentLabel}.dot is owned by ${parentOwner ?? "no one"}, not by this signer.`
+              );
+            }
+          }
+          previousContenthashCid = await readPreviousContenthashSafe(preflight, parsed.fullName);
+          setDeployAttribute("deploy.incremental", previousContenthashCid ? "true" : "false");
+        } finally {
+          preflight.disconnect();
+        }
+        console.log(`   Mode: subdomain (parent ${parsed.parentLabel}.dot owned by signer)`);
+      } else {
+        try {
+          dotnsPreflight = await preflight.preflight(name);
+          previousContenthashCid = await readPreviousContenthashSafe(preflight, name);
+          setDeployAttribute("deploy.incremental", previousContenthashCid ? "true" : "false");
+        } finally {
+          preflight.disconnect();
+        }
+        if (dotnsPreflight) {
+          setDeployAttribute("deploy.dotns.preflight.action", dotnsPreflight.plannedAction);
+          setDeployAttribute("deploy.dotns.preflight.classification", popStatusName(dotnsPreflight.classification.status));
+        }
+        const alreadyOwned = dotnsPreflight.plannedAction === "already-owned-by-us";
+        const reqSuffix = alreadyOwned ? " (already owned, requirement not enforced)" : "";
+        console.log(`   DotNS: ${name}.dot requires ${popStatusName(dotnsPreflight.classification.status)}${reqSuffix}`);
+        if (dotnsPreflight.canProceed) {
+          const fromName = popStatusName(dotnsPreflight.userStatus);
+          console.log(`   Your PoP: ${fromName}`);
+          console.log(`   Domain: ${dotnsPreflight.plannedAction === "already-owned-by-us" ? "owned by you" : "available"}`);
+        }
+        if (!dotnsPreflight.canProceed) {
+          throw new NonRetryableError(
+            dotnsPreflight.reason ?? "DotNS preflight rejected the deploy; please check the label and signer."
+          );
+        }
+      }
+      provider = await reconnect();
+      const providerWithReconnect = { ...provider, reconnect, bulletinAuthorizeV2: envBulletinAuthorizeV2 };
+      const [isTestnet, estimated] = await Promise.all([
+        detectTestnet(provider.unsafeApi),
+        estimateUploadBytes(content)
+      ]);
+      setDeployAttribute("deploy.is_testnet", isTestnet ? "true" : "false");
+      if (isTestnet && estimated != null) {
+        const uploadBytes = Math.ceil(estimated * 1.2);
+        const chunksNeeded = Math.max(1, Math.ceil(uploadBytes / CHUNK_SIZE));
+        const needs = { txs: BigInt(chunksNeeded + 2), bytes: BigInt(uploadBytes) };
+        await topUpBy(provider.unsafeApi, provider.ss58, needs, "uploader", envBulletinAuthorizeV2);
+      }
+      console.log("\n" + "=".repeat(60));
+      console.log("Storage");
+      console.log("=".repeat(60));
+      setDeployAttribute("deploy.content_type", "unknown");
+      setDeployAttribute("deploy.encrypted", "false");
+      await withSpan("deploy.storage", "1. storage", {}, async () => {
+        if (options.inputCar) {
+          setDeployAttribute("deploy.content_type", "inputCar");
+          const carPath = path.resolve(options.inputCar);
+          if (!fs.existsSync(carPath)) throw new Error(`CAR file not found: ${carPath}`);
+          console.log(`
+   Mode: Pre-built CAR`);
+          console.log(`   Path: ${carPath}`);
+          let carContent = fs.readFileSync(carPath);
+          console.log(`   Size: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
+          const reader = await CarReader.fromBytes(carContent);
+          const roots = await reader.getRoots();
+          if (roots.length === 0) throw new Error("CAR file has no roots");
+          ipfsCid = roots[0].toString();
+          console.log(`   Root CID: ${ipfsCid}`);
+          if (options.password) {
+            setDeployAttribute("deploy.encrypted", "true");
+            console.log(`   Encrypting CAR file...`);
+            carContent = await encryptContent(carContent, options.password);
+            console.log(`   Encrypted: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
+          }
+          let carChunks;
+          if (options.password) {
+            carChunks = chunk(carContent, CHUNK_SIZE);
+          } else {
+            try {
+              let prevStableOrder = [];
+              const manifestBytes = await extractManifestFromCar(carContent);
+              if (manifestBytes) {
+                const parsed2 = parseManifest(Buffer.from(manifestBytes).toString("utf8"));
+                if (parsed2.ok) prevStableOrder = parsed2.manifest.stableBlockOrder;
+              }
+              const rebuilt = await rebuildOrderedCarFromBytes(carContent, prevStableOrder);
+              if (Buffer.compare(Buffer.from(rebuilt.carBytes), Buffer.from(carContent)) === 0) {
+                carChunks = rebuilt.chunks;
+              } else {
+                captureWarning("input CAR ordered rechunk drift; falling back to size chunking", {
+                  rootCid: ipfsCid
+                });
+                carChunks = chunk(carContent, CHUNK_SIZE);
+              }
+            } catch (err) {
+              captureWarning("input CAR ordered rechunk failed; falling back to size chunking", {
+                rootCid: ipfsCid,
+                reason: err?.message ?? String(err)
+              });
+              carChunks = chunk(carContent, CHUNK_SIZE);
+            }
+          }
+          const predictedStorageCid = computeStorageCid(carChunks);
+          if (options.ghPagesMirror) {
+            mirrorPromise = mirrorToGitHubPages({
+              domain: name,
+              carBytes: carContent,
+              cid: predictedStorageCid,
+              toolVersion: VERSION,
+              bulletinRpc: BULLETIN_ENDPOINTS[0],
+              encrypted: Boolean(options.password)
+            }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+          }
+          cid = (await storeChunkedContent(carChunks, providerWithReconnect)).storageCid;
+        } else if (process.env.IPFS_CID) {
+          setDeployAttribute("deploy.content_type", "ipfsCid");
+          if (options.password) {
+            throw new Error(
+              "IPFS_CID and --password are mutually exclusive: IPFS_CID skips the upload step, so there is nothing to encrypt. Either unset IPFS_CID to upload and encrypt fresh content, or remove --password to reuse the existing CID as-is."
+            );
+          }
+          cid = process.env.IPFS_CID;
+          ipfsCid = cid;
+          console.log(`
+   Using CID: ${cid}`);
+        } else if (Array.isArray(content)) {
+          setDeployAttribute("deploy.content_type", "multiChunk");
+          console.log(`
+   Mode: Multi-chunk (${content.length} chunks)`);
+          let contentChunks = content;
+          if (options.password) {
+            setDeployAttribute("deploy.encrypted", "true");
+            console.log(`   Encrypting...`);
+            const encrypted = await encryptContent(Buffer.concat(content), options.password);
+            console.log(`   Encrypted: ${(encrypted.length / 1024).toFixed(1)} KB`);
+            contentChunks = chunk(encrypted);
+          }
+          cid = (await storeChunkedContent(contentChunks, providerWithReconnect)).storageCid;
+        } else if (typeof content === "string") {
+          setDeployAttribute("deploy.content_type", "path");
+          const contentPath = path.resolve(content);
+          if (!fs.existsSync(contentPath)) throw new Error(`Path not found: ${contentPath}`);
+          const stats = fs.statSync(contentPath);
+          if (stats.isDirectory()) {
+            setDeployAttribute("deploy.content_type", "directory");
+            console.log(`
+   Mode: Directory`);
+            console.log(`   Path: ${contentPath}`);
+            if (previousContenthashCid) console.log(`   Incremental: previous contenthash ${previousContenthashCid}`);
+            else console.log(`   Incremental: first deploy (no previous contenthash)`);
+            if (options.password) setDeployAttribute("deploy.encrypted", "true");
+            const storeFn = options.password ? storeDirectory : storeDirectoryV2;
+            const { storageCid: sCid, ipfsCid: iCid } = await storeFn(contentPath, {
+              provider: providerWithReconnect,
+              password: options.password,
+              jsMerkle: options.jsMerkle,
+              previousContenthash: previousContenthashCid,
+              allowLargeDeploy: options.allowLargeDeploy,
+              reproducibleSource: options.reproducibleSource,
+              domain: name,
+              gateway: envIpfs,
+              dumpCar: options.dumpCar,
+              onCarReady: (carBytes, predictedCid) => {
+                if (options.ghPagesMirror) {
+                  mirrorPromise = mirrorToGitHubPages({
+                    domain: name,
+                    carBytes,
+                    cid: predictedCid,
+                    toolVersion: VERSION,
+                    bulletinRpc: BULLETIN_ENDPOINTS[0],
+                    encrypted: Boolean(options.password)
+                  }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+                }
+              }
+            });
+            cid = sCid;
+            ipfsCid = iCid;
+          } else {
+            setDeployAttribute("deploy.content_type", "file");
+            console.log(`
+   Mode: File`);
+            console.log(`   Path: ${contentPath}`);
+            let fileContent = fs.readFileSync(contentPath);
+            if (options.password) {
+              setDeployAttribute("deploy.encrypted", "true");
+              console.log(`   Encrypting...`);
+              fileContent = await encryptContent(fileContent, options.password);
+              console.log(`   Encrypted: ${(fileContent.length / 1024).toFixed(1)} KB`);
+            }
+            if (fileContent.length > MAX_FILE_SIZE) {
+              console.log(`   Exceeds 8MB, chunking...`);
+              cid = (await storeChunkedContent(chunk(fileContent), providerWithReconnect)).storageCid;
+            } else {
+              cid = await storeFile(fileContent, providerWithReconnect);
+            }
+          }
+        } else if (content instanceof Uint8Array) {
+          setDeployAttribute("deploy.content_type", "multiChunk");
+          console.log(`
+   Mode: Bytes`);
+          let bytesContent = content;
+          if (options.password) {
+            setDeployAttribute("deploy.encrypted", "true");
+            console.log(`   Encrypting...`);
+            bytesContent = await encryptContent(bytesContent, options.password);
+            console.log(`   Encrypted: ${(bytesContent.length / 1024).toFixed(1)} KB`);
+          }
+          if (bytesContent.length > MAX_FILE_SIZE) {
+            console.log(`   Exceeds 8MB, chunking...`);
+            cid = (await storeChunkedContent(chunk(bytesContent), providerWithReconnect)).storageCid;
+          } else {
+            cid = await storeFile(bytesContent, providerWithReconnect);
+          }
+        } else {
+          throw new Error("Invalid content: must be path, Uint8Array, or Array<Uint8Array>");
+        }
+      });
+      setDeployAttribute("deploy.cid", cid);
+      if (options.attributes) {
+        for (const [key, value] of Object.entries(options.attributes)) {
+          setDeployAttribute(key, value);
+        }
+      }
+      console.log("\n" + "=".repeat(60));
+      console.log("DotNS");
+      console.log("=".repeat(60));
+      await withSpan("deploy.dotns", "2. dotns", { "deploy.domain": name, "deploy.subdomain": String(parsed?.isSubdomain ?? false) }, async () => {
+        const dotns = new DotNS();
+        await dotns.connect(resolveDotnsConnectOptions(options, envAssetHub, envAutoAccountMapping, envContracts, envNativeToEthRatio, envId, envPopSelfServe, envRegisterStorageDeposit));
+        if (parsed?.isSubdomain) {
+          const { owned, owner } = await dotns.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
+          if (owned) {
+            console.log(`   Status: Already owned`);
+          } else if (owner) {
+            throw new Error(`Subdomain ${parsed.fullName} is owned by ${owner}, not ${dotns.evmAddress}`);
+          } else {
+            const parentOwnership = await dotns.checkOwnership(parsed.parentLabel);
+            if (!parentOwnership.owned) throw new Error(`You must own ${parsed.parentLabel}.dot to register subdomains under it`);
+            console.log(`   Status: Registering subdomain...`);
+            await dotns.registerSubdomain(parsed.sublabel, parsed.parentLabel);
+          }
+        } else {
+          const { owned } = await dotns.checkOwnership(name);
+          if (owned) {
+            console.log(`   Status: Already owned`);
+          } else {
+            console.log(`   Status: Registering...`);
+            await dotns.register(name);
+          }
+        }
+        const contenthashHex = `0x${encodeContenthash(cid)}`;
+        await dotns.setContenthash(name, contenthashHex);
+        if (options.publish && parsed) {
+          await publish(dotns, parsed, options.failOnPublishError);
+        }
+        dotns.disconnect();
+      });
+      if (options.ghPagesMirror) {
+        console.log("\n" + "=".repeat(60));
+        console.log("Final checks");
+        console.log("=".repeat(60));
+        await withSpan("deploy.gh-pages-mirror", "4. gh-pages-mirror", { "deploy.domain": name }, async () => {
+          const mirror = await mirrorPromise;
+          if (mirror === null) {
+            console.log("   GitHub Pages mirror: skipped (only directory deploys produce a CAR suitable for mirroring).");
+            return;
+          }
+          if (mirror instanceof MirrorSkipped) {
+            console.log(`   GitHub Pages mirror: skipped \u2014 ${mirror.message}`);
+            return;
+          }
+          if (mirror instanceof Error) {
+            console.log(`   GitHub Pages mirror: failed (non-fatal) \u2014 ${mirror.message}`);
+            captureWarning("gh-pages mirror failed", { error: mirror.message.slice(0, 200) });
+            return;
+          }
+          console.log(`   Mirror: ${mirror.url}`);
+          console.log(`   Manifest: https://${mirror.owner}.github.io/${mirror.repo}/${mirror.manifestPath}`);
+          setDeployAttribute("deploy.gh_pages_url", mirror.url);
+          process.stdout.write("   Verifying Pages serves this deploy's CAR... ");
+          const freshness = await pollMirrorFreshness(mirror.url, cid, { timeoutMs: 3 * 60 * 1e3, intervalMs: 1e4 });
+          if (freshness.verified) {
+            console.log(`ok (${freshness.attempts} attempt${freshness.attempts === 1 ? "" : "s"}, ${(freshness.durationMs / 1e3).toFixed(0)}s).`);
+            setDeployAttribute("deploy.gh_pages_freshness_verified", "true");
+          } else {
+            console.log(`timed out.`);
+            console.log(`   GitHub Pages last served cid=${freshness.lastCid ?? "n/a"} (expected ${cid}); it should catch up shortly. Non-fatal.`);
+            setDeployAttribute("deploy.gh_pages_freshness_verified", "false");
+          }
+        });
+      }
+      console.log("\n" + "=".repeat(60));
+      console.log("DEPLOYMENT COMPLETE!");
+      console.log("=".repeat(60));
+      console.log("\n\u{1F53A} Polkadot Triangle");
+      console.log(`   - Polkadot Desktop: ${name}.dot`);
+      console.log(`   - Polkadot Browser: https://${name}.dot.li`);
+      console.log("\n" + "=".repeat(60) + "\n");
+      return { domainName: name, fullDomain: `${name}.dot`, cid, ipfsCid };
+    } finally {
+      if (_deployRpcFailedOver) setDeployAttribute("deploy.rpc.failed_over", "true");
+      provider?.client.destroy();
+    }
+  });
+}
+
+// src/merkle.ts
+var CidPreservingBlockstore = class {
+  data = /* @__PURE__ */ new Map();
+  async put(cid, bytes) {
+    this.data.set(cid.toString(), { cid, bytes });
+    return cid;
+  }
+  *all() {
+    yield* this.data.values();
+  }
+  clear() {
+    this.data.clear();
+  }
+};
+function* walkDirectoryLazy(dirPath, prefix = "") {
+  let dirents;
+  try {
+    dirents = fs2.readdirSync(dirPath, { withFileTypes: true });
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") throw new Error(`Directory not found: ${dirPath}`);
+    if (code === "ENOTDIR") throw new Error(`Not a directory: ${dirPath}`);
+    throw err;
+  }
+  dirents.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  for (const entry of dirents) {
+    const fullPath = path2.join(dirPath, entry.name);
+    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      yield* walkDirectoryLazy(fullPath, relativePath);
+    } else if (entry.isFile()) {
+      yield { path: relativePath, absolutePath: fullPath };
+    }
+  }
+}
+async function collectBytes(iter) {
+  const parts = [];
+  let totalLength = 0;
+  for await (const chunk2 of iter) {
+    parts.push(chunk2);
+    totalLength += chunk2.length;
+  }
+  const result = new Uint8Array(totalLength);
+  let offset = 0;
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i];
+    result.set(part, offset);
+    offset += part.length;
+    parts[i] = void 0;
+  }
+  return result;
+}
+function walkFileBlocks(rootCidStr, blocks) {
+  const fileBlocks = /* @__PURE__ */ new Map();
+  const fileCids = /* @__PURE__ */ new Map();
+  const rootBlockCids = [];
+  const subdirCids = [];
+  const subdirSeen = /* @__PURE__ */ new Set();
+  walkNode(rootCidStr, "", "", blocks, fileBlocks, fileCids, rootBlockCids, subdirCids, subdirSeen, true);
+  return { fileBlocks, fileCids, rootBlockCids, subdirCids };
+}
+function walkNode(cidStr, pathSoFar, fullDirPath, blocks, fileBlocks, fileCids, intermediates, subdirCids, subdirSeen, isRoot) {
+  const cid = CID2.parse(cidStr);
+  if (cid.code === 85) {
+    if (pathSoFar) {
+      fileBlocks.set(pathSoFar, [cidStr]);
+      fileCids.set(pathSoFar, cidStr);
+    }
+    return;
+  }
+  if (cid.code !== 112) {
+    if (pathSoFar) {
+      fileBlocks.set(pathSoFar, [cidStr]);
+      fileCids.set(pathSoFar, cidStr);
+    }
+    return;
+  }
+  const bytes = blocks.get(cidStr);
+  if (!bytes) throw new Error(`block ${cidStr} not in block source`);
+  intermediates.push(cidStr);
+  const node = dagPB2.decode(bytes);
+  let unixfs;
+  if (node.Data) {
+    try {
+      unixfs = UnixFS2.unmarshal(node.Data);
+    } catch {
+      unixfs = void 0;
+    }
+  }
+  if (unixfs && unixfs.isDirectory()) {
+    if (!isRoot && !subdirSeen.has(cidStr)) {
+      subdirCids.push(cidStr);
+      subdirSeen.add(cidStr);
+    }
+    for (const link of node.Links ?? []) {
+      const childName = link.Name ?? "";
+      const childCid = link.Hash.toString();
+      const childPath = pathSoFar ? `${pathSoFar}/${childName}` : childName;
+      walkNode(childCid, childPath, childPath, blocks, fileBlocks, fileCids, intermediates, subdirCids, subdirSeen, false);
+    }
+  } else {
+    const fileBlockList = [cidStr];
+    for (const link of node.Links ?? []) {
+      collectFileBlocks(link.Hash.toString(), blocks, fileBlockList);
+    }
+    if (pathSoFar) {
+      fileBlocks.set(pathSoFar, fileBlockList);
+      fileCids.set(pathSoFar, cidStr);
+    }
+  }
+}
+function collectFileBlocks(cidStr, blocks, fileBlockList) {
+  const cid = CID2.parse(cidStr);
+  if (cid.code === 85) {
+    fileBlockList.push(cidStr);
+    return;
+  }
+  if (cid.code !== 112) {
+    fileBlockList.push(cidStr);
+    return;
+  }
+  fileBlockList.push(cidStr);
+  const bytes = blocks.get(cidStr);
+  if (!bytes) return;
+  const node = dagPB2.decode(bytes);
+  for (const link of node.Links ?? []) {
+    collectFileBlocks(link.Hash.toString(), blocks, fileBlockList);
+  }
+}
+async function merkleizeJSBackend(directoryPath) {
+  const blockstore = new CidPreservingBlockstore();
+  const source = (function* () {
+    for (const file of walkDirectoryLazy(directoryPath)) {
+      yield {
+        path: file.path,
+        content: (async function* () {
+          yield fs2.readFileSync(file.absolutePath);
+        })()
+      };
+    }
+  })();
+  let rootCid;
+  for await (const entry of importer(source, blockstore, {
+    cidVersion: 1,
+    rawLeaves: true,
+    wrapWithDirectory: true
+  })) {
+    rootCid = entry.cid;
+  }
+  if (!rootCid) throw new Error("Merkleization produced no root CID");
+  const blocks = /* @__PURE__ */ new Map();
+  for (const { cid, bytes } of blockstore.all()) {
+    blocks.set(cid.toString(), bytes);
+  }
+  blockstore.clear();
+  const { fileBlocks, fileCids, rootBlockCids, subdirCids } = walkFileBlocks(rootCid.toString(), blocks);
+  return { rootCid: rootCid.toString(), blocks, fileBlocks, fileCids, rootBlockCids, subdirCids };
+}
+async function merkleizeKuboBackend(directoryPath) {
+  const carPath = path2.join(path2.dirname(directoryPath), `${path2.basename(directoryPath)}.car`);
+  const cidStr = execSync2(
+    `ipfs add -Q -r --hidden --cid-version=1 --raw-leaves --pin=false "${directoryPath}"`,
+    { encoding: "utf-8" }
+  ).trim();
+  execSync2(`ipfs dag export ${cidStr} > "${carPath}"`);
+  const carBytes = fs2.readFileSync(carPath);
+  const reader = await CarReader2.fromBytes(carBytes);
+  const blocks = /* @__PURE__ */ new Map();
+  for await (const { cid, bytes } of reader.blocks()) {
+    blocks.set(cid.toString(), bytes);
+  }
+  const { fileBlocks, fileCids, rootBlockCids, subdirCids } = walkFileBlocks(cidStr, blocks);
+  return { rootCid: cidStr, blocks, fileBlocks, fileCids, rootBlockCids, subdirCids };
+}
+async function merkleizeBackend(directoryPath, useKubo) {
+  if (useKubo) {
+    console.log(`   Merkleizing (Kubo): ${directoryPath}`);
+    return merkleizeKuboBackend(directoryPath);
+  }
+  console.log(`   Merkleizing (JS): ${directoryPath}`);
+  return merkleizeJSBackend(directoryPath);
+}
+function encodeCarFrame(cid, payload) {
+  const cidBytes = cid.bytes;
+  const innerLen = cidBytes.length + payload.length;
+  const lenBytes = encodeVarint(innerLen);
+  const out = new Uint8Array(lenBytes.length + cidBytes.length + payload.length);
+  out.set(lenBytes, 0);
+  out.set(cidBytes, lenBytes.length);
+  out.set(payload, lenBytes.length + cidBytes.length);
+  return out;
+}
+function encodeVarint(n) {
+  const out = [];
+  while (n > 127) {
+    out.push(n & 127 | 128);
+    n >>>= 7;
+  }
+  out.push(n & 127);
+  return new Uint8Array(out);
+}
+function concatBytes(parts) {
+  let total = 0;
+  for (const p of parts) total += p.length;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+async function encodeCarHeader(root) {
+  const { writer, out } = CarWriter.create([root]);
+  const headerPromise = collectBytes(out);
+  await writer.close();
+  return await headerPromise;
+}
+function frameBlockCid(frame) {
+  let offset = 0;
+  while (offset < frame.length && frame[offset] & 128) offset++;
+  offset++;
+  const [cid] = CID2.decodeFirst(frame.slice(offset));
+  return cid.toString();
+}
+async function buildOrderedCar(options) {
+  const { output, prevStableOrder = [] } = options;
+  const clsFn = options.classifyFn ?? ((p) => classifyFile(p));
+  const MANIFEST_PATH_LITERAL = ".bulletin-deploy/manifest.json";
+  const stableFiles = [];
+  const volatileFiles = [];
+  for (const [filePath, fileBlockCids] of output.fileBlocks) {
+    if (filePath === MANIFEST_PATH_LITERAL) continue;
+    const fileCid = output.fileCids.get(filePath);
+    const frames = [];
+    for (const blockCid of fileBlockCids) {
+      const blockBytes = output.blocks.get(blockCid);
+      if (!blockBytes) throw new Error(`buildOrderedCar: block ${blockCid} missing`);
+      frames.push(encodeCarFrame(CID2.parse(blockCid), blockBytes));
+    }
+    const size = frames.reduce((s, b) => s + b.length, 0);
+    const cls = clsFn(filePath, fileCid);
+    (cls === "stable" ? stableFiles : volatileFiles).push({ path: filePath, fileCid, blocks: frames, size });
+  }
+  const fileByCid = new Map(stableFiles.map((f) => [f.fileCid, f]));
+  const placed = /* @__PURE__ */ new Set();
+  const section1Files = [];
+  for (const cid of prevStableOrder) {
+    const f = fileByCid.get(cid);
+    if (f && !placed.has(cid)) {
+      section1Files.push(f);
+      placed.add(cid);
+    }
+  }
+  const newStable = stableFiles.filter((f) => !placed.has(f.fileCid));
+  newStable.sort(
+    (a, b) => b.size - a.size || (a.fileCid < b.fileCid ? -1 : a.fileCid > b.fileCid ? 1 : 0)
+  );
+  for (const f of newStable) section1Files.push(f);
+  volatileFiles.sort(
+    (a, b) => b.size - a.size || (a.fileCid < b.fileCid ? -1 : a.fileCid > b.fileCid ? 1 : 0)
+  );
+  const rootCidParsed = CID2.parse(output.rootCid);
+  const headerBytes = await encodeCarHeader(rootCidParsed);
+  const section0Frames = [headerBytes];
+  const manifestBlockCids = output.fileBlocks.get(MANIFEST_PATH_LITERAL) ?? [];
+  if (manifestBlockCids.length > 0) {
+    for (const blockCid of manifestBlockCids) {
+      const blockBytes = output.blocks.get(blockCid);
+      if (!blockBytes) throw new Error(`buildOrderedCar: manifest block ${blockCid} missing`);
+      section0Frames.push(encodeCarFrame(CID2.parse(blockCid), blockBytes));
+    }
+  }
+  const section0Bytes = concatBytes(section0Frames);
+  const rootDirBytes = output.blocks.get(output.rootCid);
+  if (!rootDirBytes) throw new Error(`buildOrderedCar: root block ${output.rootCid} missing`);
+  const section2LeadFrames = [encodeCarFrame(rootCidParsed, rootDirBytes)];
+  for (const cid of output.subdirCids) {
+    const bytes = output.blocks.get(cid);
+    if (!bytes) continue;
+    section2LeadFrames.push(encodeCarFrame(CID2.parse(cid), bytes));
+  }
+  const section1SectionFiles = section1Files.map((f) => ({ blocks: f.blocks }));
+  const section2SectionFiles = [
+    { blocks: section2LeadFrames },
+    ...volatileFiles.map((f) => ({ blocks: f.blocks }))
+  ];
+  const section1Chunks = packSection(section1SectionFiles);
+  const section2Chunks = packSection(section2SectionFiles);
+  const section0Chunks = section0Bytes.length > 0 ? [section0Bytes] : [];
+  const allChunks = [...section0Chunks, ...section1Chunks, ...section2Chunks];
+  const carBytes = concatBytes(allChunks);
+  const chunkCids = allChunks.map((b) => createCID(b).toString());
+  const section1ChunkCids = section1Chunks.map((b) => createCID(b).toString());
+  const blockOrder = [];
+  const collectFrameCids = (frames) => {
+    for (const frame of frames) {
+      if (frame === headerBytes) continue;
+      try {
+        blockOrder.push(frameBlockCid(frame));
+      } catch {
+      }
+    }
+  };
+  collectFrameCids(section0Frames);
+  for (const f of section1Files) collectFrameCids(f.blocks);
+  collectFrameCids(section2LeadFrames);
+  for (const f of volatileFiles) collectFrameCids(f.blocks);
+  const stableOrder = section1Files.map((f) => f.fileCid);
+  const s1Bytes = section1Chunks.reduce((s, b) => s + b.length, 0);
+  const s2Bytes = section2Chunks.reduce((s, b) => s + b.length, 0);
+  console.log(
+    `   CAR (3-section): ${(carBytes.length / 1024 / 1024).toFixed(2)} MB (s0=${section0Bytes.length}B s1=${s1Bytes}B s2=${s2Bytes}B), ${allChunks.length} chunks (${section0Chunks.length}+${section1Chunks.length}+${section2Chunks.length})`
+  );
+  return {
+    carBytes,
+    cid: output.rootCid,
+    blockOrder,
+    stableOrder,
+    chunks: allChunks,
+    chunkCids,
+    section1ChunkCids,
+    sectionSizes: {
+      section0: section0Bytes.length,
+      section1: s1Bytes,
+      section2: s2Bytes
+    },
+    sectionChunkCounts: { section0: section0Chunks.length, section1: section1Chunks.length, section2: section2Chunks.length },
+    blocks: output.blocks,
+    fileCids: output.fileCids
+  };
+}
+async function rebuildOrderedCarFromBytes(carBytes, prevStableOrder = []) {
+  const reader = await CarReader2.fromBytes(carBytes);
+  const roots = await reader.getRoots();
+  if (roots.length === 0) throw new Error("CAR file has no roots");
+  const blocks = /* @__PURE__ */ new Map();
+  for await (const { cid, bytes } of reader.blocks()) {
+    blocks.set(cid.toString(), bytes);
+  }
+  const rootCid = roots[0].toString();
+  const { fileBlocks, fileCids, rootBlockCids, subdirCids } = walkFileBlocks(rootCid, blocks);
+  return buildOrderedCar({
+    output: { rootCid, blocks, fileBlocks, fileCids, rootBlockCids, subdirCids },
+    prevStableOrder
+  });
+}
+async function merkleizeWithStableOrder(directoryPath, prevStableOrder, options) {
+  const useKubo = options?.useKubo ?? false;
+  const output = await merkleizeBackend(directoryPath, useKubo);
+  return buildOrderedCar({ output, classifyFn: options?.classifyFn, prevStableOrder });
+}
+async function merkleizeJS(directoryPath) {
+  console.log(`   Merkleizing (JS): ${directoryPath}`);
+  const blockstore = new CidPreservingBlockstore();
+  const source = (function* () {
+    for (const file of walkDirectoryLazy(directoryPath)) {
+      yield {
+        path: file.path,
+        content: (async function* () {
+          yield fs2.readFileSync(file.absolutePath);
+        })()
+      };
+    }
+  })();
+  let rootCid;
+  for await (const entry of importer(source, blockstore, {
+    cidVersion: 1,
+    rawLeaves: true,
+    wrapWithDirectory: true
+  })) {
+    rootCid = entry.cid;
+  }
+  if (!rootCid) throw new Error("Merkleization produced no root CID");
+  const { writer, out } = CarWriter.create([rootCid]);
+  const collectPromise = collectBytes(out);
+  for (const { cid, bytes } of blockstore.all()) {
+    await writer.put({ cid, bytes });
+  }
+  await writer.close();
+  const carBytes = await collectPromise;
+  blockstore.clear();
+  console.log(`   CAR (JS): ${(carBytes.length / 1024 / 1024).toFixed(2)} MB`);
+  return { carBytes, cid: rootCid.toString() };
+}
+
+export {
+  merkleizeJSBackend,
+  merkleizeKuboBackend,
+  merkleizeBackend,
+  buildOrderedCar,
+  rebuildOrderedCarFromBytes,
+  merkleizeWithStableOrder,
+  merkleizeJS,
+  friendlyChainError,
+  DEFAULT_BULLETIN_RPC,
+  DEFAULT_POOL_SIZE,
+  setWsHaltCallback,
+  CHUNK_MORTALITY_PERIOD,
+  retryBudgetExhausted,
+  isConnectionError,
+  deriveRootSigner,
+  createCID,
+  encodeContenthash,
+  ENCRYPT_MAGIC,
+  ENCRYPT_SALT_LEN,
+  ENCRYPT_NONCE_LEN,
+  ENCRYPT_TAG_LEN,
+  ENCRYPT_KEY_LEN,
+  ENCRYPT_PBKDF2_ITERATIONS,
+  encryptContent,
+  storeFile,
+  __assignDenseNoncesForTest,
+  storeChunkedContent,
+  chunk,
+  hasIPFS,
+  merkleize,
+  computeStorageCid,
+  storeDirectory,
+  buildFilesMap,
+  detectFramework,
+  checkDeploySize,
+  resolveReproducibleTimestamp,
+  applyManifestFetchAttributes,
+  storeDirectoryV2,
+  resolveDotnsConnectOptions,
+  estimateUploadBytes,
+  assertSubdomainOwnerMatchesSigner,
+  unpublish,
+  deploy
+};