@parity/product-deploy 0.7.28-rc.0

package/dist/chunk-FZWJV5AD.js

@@ -0,0 +1,231 @@
+import {
+  MANIFEST_DIR,
+  MANIFEST_FILENAME,
+  parseManifest
+} from "./chunk-S7EM5VMW.js";
+
+// src/manifest-fetch.ts
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { CarReader } from "@ipld/car/reader";
+import * as dagPB from "@ipld/dag-pb";
+import { CID } from "multiformats/cid";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var SIDECAR_FILENAME = ".last_deploy_cid";
+var RANGE_TIERS = [
+  "bytes=0-4095",
+  "bytes=0-65535",
+  "bytes=0-1048575",
+  void 0
+  // full body
+];
+function getCacheDir() {
+  const override = process.env.BULLETIN_DEPLOY_CACHE_DIR;
+  if (override) return path.join(override, "manifests");
+  if (process.platform === "win32") return null;
+  const xdg = process.env.XDG_CACHE_HOME;
+  if (xdg) return path.join(xdg, "bulletin-deploy", "manifests");
+  return path.join(os.homedir(), ".cache", "bulletin-deploy", "manifests");
+}
+function readPersistentLocalManifest(domain, prevContenthash) {
+  if (!domain) return null;
+  const cacheDir = getCacheDir();
+  if (!cacheDir) return null;
+  const cidPath = path.join(cacheDir, `${domain}.cid`);
+  const manifestPath = path.join(cacheDir, `${domain}.json`);
+  let storedCid;
+  try {
+    storedCid = fs.readFileSync(cidPath, "utf8").trim();
+  } catch {
+    return null;
+  }
+  if (storedCid !== prevContenthash) return null;
+  let text;
+  try {
+    text = fs.readFileSync(manifestPath, "utf8");
+  } catch {
+    return null;
+  }
+  const parsed = parseManifest(text);
+  if (!parsed.ok) return null;
+  return {
+    source: "embedded",
+    manifest: parsed.manifest,
+    attempts: 0,
+    bytesDownloaded: text.length
+  };
+}
+function writePersistentLocalManifest(domain, storageCid, manifestJson) {
+  const cacheDir = getCacheDir();
+  if (!cacheDir) return;
+  try {
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const cidPath = path.join(cacheDir, `${domain}.cid`);
+    const manifestPath = path.join(cacheDir, `${domain}.json`);
+    const cidTmp = `${cidPath}.${process.pid}.tmp`;
+    const manifestTmp = `${manifestPath}.${process.pid}.tmp`;
+    fs.writeFileSync(cidTmp, storageCid);
+    fs.renameSync(cidTmp, cidPath);
+    fs.writeFileSync(manifestTmp, manifestJson);
+    fs.renameSync(manifestTmp, manifestPath);
+  } catch {
+  }
+}
+async function fetchAcrossTiers(url, budget, start) {
+  let lastReason = "unknown";
+  let attempts = 0;
+  let bytesDownloaded = 0;
+  for (let tier = 0; tier < RANGE_TIERS.length; tier++) {
+    if (Date.now() - start > budget) {
+      return { outcome: "retryable", reason: `budget exceeded: ${lastReason}`, attempts, bytesDownloaded };
+    }
+    attempts++;
+    const headers = {};
+    if (RANGE_TIERS[tier] !== void 0) headers.Range = RANGE_TIERS[tier];
+    let res;
+    try {
+      const ctrl = new AbortController();
+      const remaining = budget - (Date.now() - start);
+      const timer = setTimeout(() => ctrl.abort(), Math.max(100, remaining));
+      try {
+        res = await fetch(url, { headers, signal: ctrl.signal });
+      } finally {
+        clearTimeout(timer);
+      }
+    } catch (e) {
+      lastReason = `network error: ${e?.message ?? e}`;
+      continue;
+    }
+    if (res.status === 404) return { outcome: "404", attempts, bytesDownloaded };
+    if (res.status !== 200 && res.status !== 206) {
+      lastReason = `gateway HTTP ${res.status}`;
+      continue;
+    }
+    const isFullBody = res.status === 200;
+    let carBytes;
+    try {
+      const buf = await res.arrayBuffer();
+      carBytes = new Uint8Array(buf);
+      bytesDownloaded = carBytes.length;
+    } catch (e) {
+      if (isFullBody) return { outcome: "parse_error", reason: `body read error: ${e?.message ?? e}`, attempts, bytesDownloaded };
+      lastReason = `body read error: ${e?.message ?? e}`;
+      continue;
+    }
+    let manifestBytes;
+    try {
+      manifestBytes = await extractManifestFromCar(carBytes);
+    } catch (e) {
+      const msg = String(e?.message ?? e);
+      if (isFullBody) return { outcome: "parse_error", reason: `CAR parse error: ${msg}`, attempts, bytesDownloaded };
+      lastReason = `truncated at tier ${tier}: ${msg}`;
+      continue;
+    }
+    if (!manifestBytes) {
+      if (isFullBody) return { outcome: "parse_error", reason: "no .bulletin-deploy/manifest.json in deployed DAG", attempts, bytesDownloaded };
+      lastReason = `manifest not in slice tier ${tier}`;
+      continue;
+    }
+    const text = new TextDecoder().decode(manifestBytes);
+    const parsed = parseManifest(text);
+    if (parsed.ok) return { outcome: "success", manifest: parsed.manifest, attempts, bytesDownloaded };
+    return { outcome: "parse_error", reason: parsed.error, attempts, bytesDownloaded };
+  }
+  return { outcome: "retryable", reason: `tiers exhausted: ${lastReason}`, attempts, bytesDownloaded };
+}
+async function fetchPreviousManifest(prevContenthash, options = {}) {
+  if (prevContenthash === null) return { source: "none" };
+  const local = readPersistentLocalManifest(options.domain, prevContenthash);
+  if (local) return local;
+  const gatewayList = (options.gateways ?? (options.gateway ? [options.gateway] : [])).map((g) => g.replace(/\/$/, ""));
+  const budget = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const start = Date.now();
+  let lastReason = "unknown";
+  let totalAttempts = 0;
+  let bytesDownloaded = 0;
+  for (const gatewayRaw of gatewayList) {
+    const gateway = gatewayRaw.replace(/\/ipfs\/?$/, "");
+    const url = `${gateway}/ipfs/${prevContenthash}`;
+    const tierResult = await fetchAcrossTiers(url, budget, start);
+    if (tierResult.outcome === "success") {
+      return {
+        source: "embedded",
+        manifest: tierResult.manifest,
+        attempts: totalAttempts + tierResult.attempts,
+        bytesDownloaded: bytesDownloaded + tierResult.bytesDownloaded
+      };
+    }
+    if (tierResult.outcome === "404" || tierResult.outcome === "parse_error") {
+      return {
+        source: "heuristic_fallback",
+        reason: tierResult.outcome === "404" ? "gateway 404" : tierResult.reason,
+        attempts: totalAttempts + tierResult.attempts,
+        bytesDownloaded: bytesDownloaded + tierResult.bytesDownloaded
+      };
+    }
+    lastReason = tierResult.reason;
+    totalAttempts += tierResult.attempts;
+    bytesDownloaded += tierResult.bytesDownloaded;
+  }
+  return { source: "heuristic_fallback", reason: `all gateways exhausted: ${lastReason}`, attempts: totalAttempts, bytesDownloaded };
+}
+async function extractManifestFromCar(carBytes) {
+  const reader = await CarReader.fromBytes(carBytes);
+  const roots = await reader.getRoots();
+  if (roots.length === 0) return null;
+  const blocks = /* @__PURE__ */ new Map();
+  for await (const { cid, bytes } of reader.blocks()) {
+    blocks.set(cid.toString(), bytes);
+  }
+  return walkDagToManifest(blocks, roots[0].toString());
+}
+async function walkDagToManifest(blocks, rootCid) {
+  const rootBytes = blocks.get(rootCid);
+  if (!rootBytes) return null;
+  const rootNode = dagPB.decode(rootBytes);
+  const bdLink = (rootNode.Links ?? []).find((l) => l.Name === MANIFEST_DIR);
+  if (!bdLink) return null;
+  const bdBytes = blocks.get(bdLink.Hash.toString());
+  if (!bdBytes) return null;
+  const bdNode = dagPB.decode(bdBytes);
+  const manLink = (bdNode.Links ?? []).find((l) => l.Name === MANIFEST_FILENAME);
+  if (!manLink) return null;
+  const manCidStr = manLink.Hash.toString();
+  const manCid = CID.parse(manCidStr);
+  const manBytes = blocks.get(manCidStr);
+  if (!manBytes) return null;
+  if (manCid.code === 85) {
+    return manBytes;
+  }
+  if (manCid.code === 112) {
+    const node = dagPB.decode(manBytes);
+    const parts = [];
+    let total = 0;
+    for (const link of node.Links ?? []) {
+      const leafBytes = blocks.get(link.Hash.toString());
+      if (!leafBytes) return null;
+      parts.push(leafBytes);
+      total += leafBytes.length;
+    }
+    const out = new Uint8Array(total);
+    let pos = 0;
+    for (const part of parts) {
+      out.set(part, pos);
+      pos += part.length;
+    }
+    return out;
+  }
+  return null;
+}
+
+export {
+  DEFAULT_TIMEOUT_MS,
+  SIDECAR_FILENAME,
+  getCacheDir,
+  readPersistentLocalManifest,
+  writePersistentLocalManifest,
+  fetchPreviousManifest,
+  extractManifestFromCar,
+  walkDagToManifest
+};

package/dist/chunk-GZD2UFLR.js

@@ -0,0 +1,8 @@
+// src/manifest/types.ts
+function defineConfig(config) {
+  return config;
+}
+
+export {
+  defineConfig
+};

package/dist/chunk-HOTQDYHD.js

@@ -0,0 +1,219 @@
+// src/gh-pages-mirror.ts
+import { execSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+var GH_PAGES_MIRROR_MAX_BYTES = 100 * 1024 * 1024;
+var GH_PAGES_MIRROR_DIR = "bulletin";
+var GH_PAGES_MIRROR_BRANCH = "gh-pages";
+var MirrorSkipped = class extends Error {
+  constructor(reason) {
+    super(reason);
+    this.name = "MirrorSkipped";
+  }
+};
+async function pollMirrorFreshness(mirrorUrl2, expectedCid, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1e3;
+  const intervalMs = opts.intervalMs ?? 1e4;
+  const fetchFn = opts.fetchFn ?? fetch;
+  const manifestUrl = mirrorUrl2.replace(/\.car$/, ".json");
+  const started = Date.now();
+  const deadline = started + timeoutMs;
+  let attempts = 0;
+  let lastCid = null;
+  let lastStatus = 0;
+  while (Date.now() < deadline) {
+    attempts++;
+    try {
+      const res = await fetchFn(manifestUrl, { redirect: "follow", cache: "no-store" });
+      lastStatus = res.status;
+      if (res.status === 200) {
+        const m = await res.json();
+        if (m.cid === expectedCid) {
+          return { verified: true, attempts, durationMs: Date.now() - started, lastCid: m.cid, lastStatus };
+        }
+        lastCid = m.cid ?? null;
+      }
+    } catch {
+    }
+    if (Date.now() + intervalMs >= deadline) break;
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+  return { verified: false, attempts, durationMs: Date.now() - started, lastCid, lastStatus };
+}
+function parseGitRemoteUrl(url) {
+  const trimmed = url.trim();
+  const ssh = trimmed.match(/^git@[^:]+:([^/]+)\/(.+?)(?:\.git)?$/);
+  if (ssh) return { owner: ssh[1], repo: ssh[2] };
+  const https = trimmed.match(/^https?:\/\/(?:[^@]*@)?[^/]+\/([^/]+)\/(.+?)(?:\.git)?$/);
+  if (https) return { owner: https[1], repo: https[2] };
+  return null;
+}
+function resolveOwnerRepo(repoPath) {
+  const envRepo = process.env.GITHUB_REPOSITORY;
+  if (envRepo && envRepo.includes("/")) {
+    const [owner, repo] = envRepo.split("/");
+    if (owner && repo) return { owner, repo };
+  }
+  try {
+    const url = execSync("git config --get remote.origin.url", {
+      cwd: repoPath,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return parseGitRemoteUrl(url);
+  } catch {
+    return null;
+  }
+}
+function resolveSourceCommit(repoPath) {
+  if (process.env.GITHUB_SHA) return process.env.GITHUB_SHA;
+  try {
+    return execSync("git rev-parse HEAD", {
+      cwd: repoPath,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function normalizeDomainFilename(domain) {
+  const label = domain.endsWith(".dot") ? domain.slice(0, -4) : domain;
+  if (!/^[a-z0-9-]+$/.test(label)) {
+    throw new Error(`Invalid domain label for mirror filename: ${JSON.stringify(domain)}`);
+  }
+  return `${label}.dot`;
+}
+function mirrorUrl(owner, repo, domainFilename) {
+  return `https://${owner}.github.io/${repo}/${GH_PAGES_MIRROR_DIR}/${domainFilename}.car`;
+}
+function buildManifest(input) {
+  return {
+    domain: normalizeDomainFilename(input.domain),
+    cid: input.cid,
+    toolVersion: input.toolVersion,
+    deployedAt: input.deployedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    encrypted: input.encrypted,
+    bulletinRpc: input.bulletinRpc,
+    sourceRepo: input.sourceRepo,
+    sourceCommit: input.sourceCommit
+  };
+}
+function runGit(args, cwd, extraEnv = {}) {
+  return execSync(`git ${args.join(" ")}`, {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, ...extraEnv }
+  }).trim();
+}
+var MIRROR_BOT_GIT_OVERRIDES = [
+  "-c",
+  "user.email=bulletin-deploy@noreply.github.com",
+  "-c",
+  "user.name=bulletin-deploy",
+  "-c",
+  "commit.gpgsign=false"
+];
+function pushRemoteUrl(owner, repo, token) {
+  const authedOwner = token ? `x-access-token:${token}@github.com` : "github.com";
+  return `https://${authedOwner}/${owner}/${repo}.git`;
+}
+async function mirrorToGitHubPages(input) {
+  const repoPath = input.repoPath ?? process.cwd();
+  const ownerRepo = resolveOwnerRepo(repoPath);
+  if (!ownerRepo) {
+    throw new MirrorSkipped("no GitHub repo detected (GITHUB_REPOSITORY unset and no github.com remote)");
+  }
+  if (input.carBytes.length > GH_PAGES_MIRROR_MAX_BYTES) {
+    const mb = (input.carBytes.length / 1024 / 1024).toFixed(1);
+    throw new MirrorSkipped(`CAR is ${mb} MB, exceeds GitHub's 100 MB single-file soft limit. Pages can't host this CAR \u2014 the on-chain deploy still succeeds and hosts will fall back to Bulletin.`);
+  }
+  const domainFilename = normalizeDomainFilename(input.domain);
+  const { owner, repo } = ownerRepo;
+  const sourceCommit = input.sourceCommit ?? resolveSourceCommit(repoPath);
+  const sourceRepo = input.sourceRepo ?? `${owner}/${repo}`;
+  const manifest = buildManifest({ ...input, sourceCommit, sourceRepo });
+  const workTree = fs.mkdtempSync(path.join(os.tmpdir(), "bulletin-mirror-"));
+  const token = input.githubToken ?? process.env.GITHUB_TOKEN;
+  try {
+    let branchExists = false;
+    try {
+      execSync(`git ls-remote --exit-code --heads origin ${GH_PAGES_MIRROR_BRANCH}`, {
+        cwd: repoPath,
+        stdio: ["ignore", "ignore", "ignore"]
+      });
+      branchExists = true;
+    } catch {
+      branchExists = false;
+    }
+    if (branchExists) {
+      runGit(["fetch", "origin", GH_PAGES_MIRROR_BRANCH, "--depth=1"], repoPath);
+      runGit(["worktree", "add", "--detach", workTree, `origin/${GH_PAGES_MIRROR_BRANCH}`], repoPath);
+    } else {
+      runGit(["worktree", "add", "--detach", workTree, "HEAD"], repoPath);
+      runGit(["checkout", "--orphan", GH_PAGES_MIRROR_BRANCH], workTree);
+      runGit(["rm", "-rf", "--quiet", "."], workTree);
+    }
+    const mirrorDir = path.join(workTree, GH_PAGES_MIRROR_DIR);
+    fs.mkdirSync(mirrorDir, { recursive: true });
+    const carPath = path.join(mirrorDir, `${domainFilename}.car`);
+    const manifestPath = path.join(mirrorDir, `${domainFilename}.json`);
+    fs.writeFileSync(carPath, input.carBytes);
+    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+    runGit([...MIRROR_BOT_GIT_OVERRIDES, "add", GH_PAGES_MIRROR_DIR], workTree);
+    const status = runGit(["status", "--porcelain"], workTree);
+    if (status.length === 0) {
+      return {
+        url: mirrorUrl(owner, repo, domainFilename),
+        owner,
+        repo,
+        carPath: path.posix.join(GH_PAGES_MIRROR_DIR, `${domainFilename}.car`),
+        manifestPath: path.posix.join(GH_PAGES_MIRROR_DIR, `${domainFilename}.json`)
+      };
+    }
+    runGit(
+      [
+        ...MIRROR_BOT_GIT_OVERRIDES,
+        "commit",
+        "-m",
+        `"mirror(bulletin): ${domainFilename} @ ${input.cid.slice(0, 12)}"`
+      ],
+      workTree
+    );
+    runGit(["push", pushRemoteUrl(owner, repo, token), `HEAD:${GH_PAGES_MIRROR_BRANCH}`], workTree);
+    return {
+      url: mirrorUrl(owner, repo, domainFilename),
+      owner,
+      repo,
+      carPath: path.posix.join(GH_PAGES_MIRROR_DIR, `${domainFilename}.car`),
+      manifestPath: path.posix.join(GH_PAGES_MIRROR_DIR, `${domainFilename}.json`)
+    };
+  } finally {
+    try {
+      runGit(["worktree", "remove", "--force", workTree], repoPath);
+    } catch {
+    }
+    try {
+      fs.rmSync(workTree, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+
+export {
+  GH_PAGES_MIRROR_MAX_BYTES,
+  GH_PAGES_MIRROR_DIR,
+  GH_PAGES_MIRROR_BRANCH,
+  MirrorSkipped,
+  pollMirrorFreshness,
+  parseGitRemoteUrl,
+  resolveOwnerRepo,
+  resolveSourceCommit,
+  normalizeDomainFilename,
+  mirrorUrl,
+  buildManifest,
+  MIRROR_BOT_GIT_OVERRIDES,
+  mirrorToGitHubPages
+};

package/dist/chunk-IDYGYIMH.js

@@ -0,0 +1,207 @@
+import {
+  BANDERSNATCH_SIGNATURE_BYTES
+} from "./chunk-T7EEVWNU.js";
+import {
+  buildImplicationMessage,
+  buildV5GeneralExtrinsic,
+  bytesToHex,
+  hexToBytes,
+  readExtensionOrder,
+  toHex
+} from "./chunk-ZYVGHDMU.js";
+
+// src/personhood/bind-personal-id.ts
+import { Enum } from "polkadot-api";
+var AS_PERSON_IDENTIFIER = "AsPerson";
+var VERIFY_MULTI_SIGNATURE_IDENTIFIER = "VerifyMultiSignature";
+var IMPLICATION_EXCLUDE = /* @__PURE__ */ new Set([
+  "VerifyMultiSignature",
+  AS_PERSON_IDENTIFIER,
+  "AuthorizeCall",
+  "StorageWeightReclaim"
+]);
+var PersonalIdBindingError = class extends Error {
+  dispatchError;
+  kind;
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "PersonalIdBindingError";
+    this.kind = options.kind ?? "unknown";
+    this.dispatchError = options.dispatchError;
+  }
+};
+function buildAsPersonExtensionValue(signature, personalId) {
+  return Enum("AsPersonalIdentityWithProof", [bytesToHex(signature), personalId]);
+}
+var bindPersonalIdToAccount = async ({
+  typedApi,
+  client,
+  personalId,
+  account,
+  signMember,
+  callValidAt,
+  progress
+}) => {
+  const api = typedApi;
+  if (typeof api.tx?.People?.set_personal_id_account !== "function") {
+    throw new PersonalIdBindingError(
+      "typedApi does not expose People.set_personal_id_account \u2014 wrong chain or stale descriptors",
+      { kind: "client_error" }
+    );
+  }
+  const block = callValidAt ?? await api.query.System.Number.getValue();
+  const innerTx = api.tx.People.set_personal_id_account({
+    account,
+    call_valid_at: block
+  });
+  const callBytes = await innerTx.getEncodedData();
+  const passEmpty = await capturePass({
+    innerTx,
+    asPersonValue: new Uint8Array()
+  });
+  const msgHash = buildImplicationMessage(
+    callBytes,
+    passEmpty.extensions,
+    IMPLICATION_EXCLUDE
+  );
+  const signature = await Promise.resolve(signMember(msgHash));
+  if (signature.length !== BANDERSNATCH_SIGNATURE_BYTES) {
+    throw new PersonalIdBindingError(
+      `Bandersnatch signature must be ${BANDERSNATCH_SIGNATURE_BYTES} bytes, got ${signature.length}`,
+      { kind: "client_error" }
+    );
+  }
+  const asPersonProof = Enum("AsPersonalIdentityWithProof", [bytesToHex(signature), personalId]);
+  const passProof = await capturePass({
+    innerTx,
+    asPersonValue: asPersonProof
+  });
+  const extrinsicBytes = buildV5GeneralExtrinsic(callBytes, passProof.extensions);
+  const extrinsicHex = toHex(extrinsicBytes);
+  const blockHash = await submitExtrinsic(client, extrinsicHex, progress);
+  return { extrinsicHex, blockHash };
+};
+var capturePass = async ({
+  innerTx,
+  asPersonValue
+}) => {
+  let captured = null;
+  const sentinel = new Error("__personhood_capture_sentinel__");
+  const signer = {
+    publicKey: new Uint8Array(32),
+    signTx: async (callData, signedExtensions, metadata) => {
+      const order = await readExtensionOrder(metadata);
+      const byIdentifier = {};
+      for (const id of order) {
+        const ext = signedExtensions[id];
+        if (!ext) {
+          throw new PersonalIdBindingError(
+            `papi did not produce signed extension '${id}'`
+          );
+        }
+        byIdentifier[id] = {
+          value: ext.value,
+          additionalSigned: ext.additionalSigned
+        };
+      }
+      captured = { callData, extensions: { order, byIdentifier } };
+      throw sentinel;
+    },
+    signBytes: async () => new Uint8Array(64)
+  };
+  try {
+    await innerTx.sign(signer, {
+      customSignedExtensions: {
+        [AS_PERSON_IDENTIFIER]: {
+          value: asPersonValue,
+          additionalSigned: new Uint8Array()
+        },
+        [VERIFY_MULTI_SIGNATURE_IDENTIFIER]: {
+          value: Enum("Disabled")
+        },
+        RestrictOrigins: {
+          value: new Uint8Array([1]),
+          additionalSigned: new Uint8Array()
+        }
+      }
+    });
+  } catch (err) {
+    if (err !== sentinel) throw err;
+  }
+  if (!captured) {
+    throw new PersonalIdBindingError(
+      "extension capture failed \u2014 papi never invoked signTx",
+      { kind: "client_error" }
+    );
+  }
+  return captured;
+};
+var submitExtrinsic = (client, extrinsicHex, progress) => {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      reject(err);
+    };
+    const succeed = (blockHash) => {
+      if (settled) return;
+      settled = true;
+      resolve(blockHash);
+    };
+    client.submitAndWatch(hexToBytes(extrinsicHex)).subscribe({
+      next: (event) => {
+        if (settled) return;
+        if (event.type === "broadcasted") {
+          progress?.onBroadcasted?.();
+          return;
+        }
+        if (event.type === "txBestBlocksState" && event.found) {
+          if (event.ok === false) {
+            fail(
+              new PersonalIdBindingError(
+                "set_personal_id_account dispatched but failed in-block",
+                {
+                  kind: "dispatch_error",
+                  dispatchError: event.dispatchError
+                }
+              )
+            );
+            return;
+          }
+          progress?.onBestBlock?.(event.block.hash);
+          return;
+        }
+        if (event.type === "finalized") {
+          if (event.ok === false) {
+            fail(
+              new PersonalIdBindingError(
+                "set_personal_id_account dispatch failed at finalization",
+                {
+                  kind: "dispatch_error",
+                  dispatchError: event.dispatchError
+                }
+              )
+            );
+            return;
+          }
+          succeed(event.block.hash);
+        }
+      },
+      error: (err) => {
+        fail(
+          err instanceof PersonalIdBindingError ? err : new PersonalIdBindingError(
+            err instanceof Error ? `RPC rejected extrinsic: ${err.message}` : "RPC error during submitAndWatch",
+            { cause: err, kind: "rpc_error" }
+          )
+        );
+      }
+    });
+  });
+};
+
+export {
+  PersonalIdBindingError,
+  buildAsPersonExtensionValue,
+  bindPersonalIdToAccount
+};