@parity/product-deploy 0.8.3-rc.0 → 0.8.3-rc.11

package/dist/{chunk-PV3N2XTC.js → chunk-4CZ4GIWK.js}

@@ -1,3 +1,8 @@
+import {
+  MirrorSkipped,
+  mirrorToGitHubPages,
+  pollMirrorFreshness
+} from "./chunk-HOTQDYHD.js";
 import {
   computeStats,
   renderSummary,
@@ -18,24 +23,30 @@ import {
   classifyFile,
   parseManifest
 } from "./chunk-S7EM5VMW.js";
+import {
+  DOT_DAPP_ID,
+  DOT_PRODUCT_ID,
+  hasPersistedSession
+} from "./chunk-YUSHBZBX.js";
 import {
   setDeployContext
-} from "./chunk-VRZXAB7J.js";
+} from "./chunk-AMGKEAOH.js";
 import {
   probeChunks
-} from "./chunk-Z6PRIHI7.js";
+} from "./chunk-X2Q5FPIQ.js";
 import {
   packSection
 } from "./chunk-C2TS5MER.js";
 import {
   DotNS,
+  PUBLISHER_ABI,
   PublisherNotSupportedError,
   TX_TIMEOUT_MS,
   fetchNonce,
   parseDomainName,
   popStatusName,
   verifyNonceAdvanced
-} from "./chunk-LJMYOXQV.js";
+} from "./chunk-4GX3KJPU.js";
 import {
   derivePoolAccounts,
   detectTestnet,
@@ -57,7 +68,7 @@ import {
   truncateAddress,
   withDeploySpan,
   withSpan
-} from "./chunk-YT2XCGZK.js";
+} from "./chunk-P2ZOBSCJ.js";
 import {
   DEFAULT_ENV_ID,
   getPopSelfServeConfig,
@@ -67,11 +78,6 @@ import {
 import {
   NonRetryableError
 } from "./chunk-ZOC4GITL.js";
-import {
-  MirrorSkipped,
-  mirrorToGitHubPages,
-  pollMirrorFreshness
-} from "./chunk-HOTQDYHD.js";
 
 // src/merkle.ts
 import * as fs2 from "fs";
@@ -91,19 +97,186 @@ import * as path from "path";
 import { execSync } from "child_process";
 import { sha256 } from "@noble/hashes/sha256";
 import { blake2b } from "@noble/hashes/blake2b";
-import { createClient as createPolkadotClient, Enum } from "polkadot-api";
-import { getWsProvider, WsEvent } from "polkadot-api/ws";
+import { createClient as createPolkadotClient2, Enum as Enum2 } from "polkadot-api";
+import { getWsProvider as getWsProvider2, WsEvent } from "polkadot-api/ws";
 import { CID } from "multiformats/cid";
 import { create as createMultihash } from "multiformats/hashes/digest";
 import { base32 } from "multiformats/bases/base32";
 import { base58btc } from "multiformats/bases/base58";
 import * as dagPB from "@ipld/dag-pb";
 import { UnixFS } from "ipfs-unixfs";
+import { keccak256, toBytes } from "viem";
 import { cryptoWaitReady } from "@polkadot/util-crypto";
-import { getPolkadotSigner } from "polkadot-api/signer";
-import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
-import { mnemonicToEntropy, entropyToMiniSecret, ss58Address } from "@polkadot-labs/hdkd-helpers";
+import { getPolkadotSigner as getPolkadotSigner2 } from "polkadot-api/signer";
+import { sr25519CreateDerive as sr25519CreateDerive2 } from "@polkadot-labs/hdkd";
+import { mnemonicToEntropy, entropyToMiniSecret, ss58Address as ss58Address2 } from "@polkadot-labs/hdkd-helpers";
 import { CarReader } from "@ipld/car/reader";
+
+// src/storage-signer.ts
+import { readFile, writeFile, mkdir } from "fs/promises";
+import { homedir } from "os";
+import { join, dirname } from "path";
+
+// node_modules/@polkadot-api/utils/dist/hex.js
+var HEX_STR = "0123456789abcdef";
+function toHex(bytes) {
+  const result = new Array(bytes.length + 1);
+  result[0] = "0x";
+  for (let i = 0; i < bytes.length; ) {
+    const b = bytes[i++];
+    result[i] = HEX_STR[b >> 4] + HEX_STR[b & 15];
+  }
+  return result.join("");
+}
+var HEX_MAP = {
+  0: 0,
+  1: 1,
+  2: 2,
+  3: 3,
+  4: 4,
+  5: 5,
+  6: 6,
+  7: 7,
+  8: 8,
+  9: 9,
+  a: 10,
+  b: 11,
+  c: 12,
+  d: 13,
+  e: 14,
+  f: 15,
+  A: 10,
+  B: 11,
+  C: 12,
+  D: 13,
+  E: 14,
+  F: 15
+};
+function fromHex(hexString) {
+  const isOdd = hexString.length % 2;
+  const base = (hexString[1] === "x" ? 2 : 0) + isOdd;
+  const nBytes = (hexString.length - base) / 2 + isOdd;
+  const bytes = new Uint8Array(nBytes);
+  if (isOdd) bytes[0] = 0 | HEX_MAP[hexString[2]];
+  for (let i = 0; i < nBytes; ) {
+    const idx = base + i * 2;
+    const a = HEX_MAP[hexString[idx]];
+    const b = HEX_MAP[hexString[idx + 1]];
+    bytes[isOdd + i++] = a << 4 | b;
+  }
+  return bytes;
+}
+
+// src/storage-signer.ts
+import { sr25519CreateDerive } from "@polkadot-labs/hdkd";
+import { sr25519, ss58Address } from "@polkadot-labs/hdkd-helpers";
+import { createClient as createPolkadotClient, Enum } from "polkadot-api";
+import { getPolkadotSigner } from "polkadot-api/signer";
+import { getWsProvider } from "polkadot-api/ws";
+function sanitize(appId) {
+  return appId.replace(/[^a-zA-Z0-9_.-]/g, "_");
+}
+function cacheFilePath(appId, storageDir) {
+  return join(storageDir ?? homedir(), ".polkadot-apps", `${sanitize(appId)}_AllowanceKeys.json`);
+}
+function normalizeSchnorrkelKey(key) {
+  if (key.length !== 64) return key;
+  const out = new Uint8Array(key);
+  let carry = 0;
+  for (let i = 0; i < 32; i++) {
+    const v = key[i] * 8 + carry;
+    out[i] = v & 255;
+    carry = v >> 8;
+  }
+  return out;
+}
+function signerFromSecret(secret) {
+  if (secret.length === 32) {
+    const kp = sr25519CreateDerive(secret)("");
+    return getPolkadotSigner(kp.publicKey, "Sr25519", async (d) => kp.sign(d));
+  }
+  if (secret.length === 64) {
+    const normalized = normalizeSchnorrkelKey(secret);
+    const pub = sr25519.getPublicKey(normalized);
+    return getPolkadotSigner(pub, "Sr25519", async (d) => sr25519.sign(d, normalized));
+  }
+  throw new Error(
+    `BulletInAllowance slot key: unexpected length ${secret.length} (expected 32 or 64)`
+  );
+}
+async function readBulletinSlotSigner(appId, storageDir) {
+  let raw;
+  try {
+    raw = await readFile(cacheFilePath(appId, storageDir), "utf-8");
+  } catch (e) {
+    if (e?.code === "ENOENT") return null;
+    throw e;
+  }
+  let cache;
+  try {
+    cache = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const entry = cache?.entries?.BulletInAllowance;
+  if (!entry?.slotAccountKey) return null;
+  let secret;
+  try {
+    secret = fromHex(entry.slotAccountKey);
+  } catch {
+    return null;
+  }
+  const signer = signerFromSecret(secret);
+  return { signer, ss58: ss58Address(signer.publicKey) };
+}
+async function writeBulletinSlotKey(appId, hexKey, storageDir) {
+  const path3 = cacheFilePath(appId, storageDir);
+  await mkdir(dirname(path3), { recursive: true, mode: 448 });
+  let existing = { version: 1, entries: {} };
+  try {
+    existing = JSON.parse(await readFile(path3, "utf-8"));
+  } catch {
+  }
+  existing.entries ??= {};
+  existing.entries.BulletInAllowance = { tag: "BulletInAllowance", slotAccountKey: hexKey };
+  await writeFile(path3, `${JSON.stringify(existing, null, 2)}
+`, { mode: 384 });
+}
+function extractBulletinSlotKey(outcomes) {
+  for (const outcome of outcomes) {
+    if (outcome.tag !== "Allocated") continue;
+    const allocated = outcome.value;
+    if (allocated?.tag !== "BulletInAllowance") continue;
+    const key = allocated.value?.slotAccountKey;
+    if (!(key instanceof Uint8Array)) continue;
+    return toHex(key);
+  }
+  return null;
+}
+async function getSlotSignerProvider(signer, ss58) {
+  const primary = BULLETIN_ENDPOINTS[0];
+  console.log(`   Connecting to Bulletin (slot signer): ${primary}`);
+  const client = createPolkadotClient(getWsProvider(
+    BULLETIN_ENDPOINTS,
+    { heartbeatTimeout: WS_HEARTBEAT_TIMEOUT_MS, onStatusChanged: makeBulletinStatusHandler(primary) }
+  ));
+  const unsafeApi = client.getUnsafeApi();
+  const [auth, currentBlock] = await Promise.all([
+    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+    client.getFinalizedBlock()
+  ]);
+  const now = currentBlock.number;
+  if (!auth || Number(auth.expiration ?? 0) <= now) {
+    client.destroy();
+    throw new Error(`Slot account ${ss58} not authorized on Bulletin`);
+  }
+  console.log(`   Using slot signer: ${ss58} (authorized until block ${Number(auth?.expiration ?? 0)})`);
+  setDeployAttribute("deploy.signer.mode", "slot");
+  setDeployAttribute("deploy.signer.address", truncateAddress(ss58));
+  return { client, unsafeApi, signer, ss58 };
+}
+
+// src/deploy.ts
 function friendlyChainError(msg) {
   if (/"type":\s*"Invalid"[\s\S]*?"type":\s*"Payment"/i.test(msg)) {
     return "Bulletin quota exhausted (signed extension rejected the tx \u2014 signer is out of allowed txs or bytes; grant quota on-chain)";
@@ -166,10 +339,10 @@ var CID_CONFIG = { version: 1, codec: 85, hashCode: 18, hashLength: 32 };
 function deriveRootSigner(mnemonic, path3 = "") {
   const entropy = mnemonicToEntropy(mnemonic);
   const miniSecret = entropyToMiniSecret(entropy);
-  const derive = sr25519CreateDerive(miniSecret);
+  const derive = sr25519CreateDerive2(miniSecret);
   const keyPair = derive(path3);
-  const signer = getPolkadotSigner(keyPair.publicKey, "Sr25519", keyPair.sign);
-  return { signer, ss58: ss58Address(keyPair.publicKey) };
+  const signer = getPolkadotSigner2(keyPair.publicKey, "Sr25519", keyPair.sign);
+  return { signer, ss58: ss58Address2(keyPair.publicKey) };
 }
 function createCID(data, codec = CID_CONFIG.codec, hashCode = CID_CONFIG.hashCode) {
   let hash;
@@ -223,7 +396,7 @@ function toHashingEnum(mhCode) {
 async function getProvider() {
   const primary = BULLETIN_ENDPOINTS[0];
   console.log(`   Connecting to Bulletin: ${primary}`);
-  const client = createPolkadotClient(getWsProvider(
+  const client = createPolkadotClient2(getWsProvider2(
     BULLETIN_ENDPOINTS,
     { heartbeatTimeout: WS_HEARTBEAT_TIMEOUT_MS, onStatusChanged: makeBulletinStatusHandler(primary) }
   ));
@@ -251,7 +424,7 @@ async function getProvider() {
 async function getDirectProvider(mnemonic, derivationPath = "") {
   const primary = BULLETIN_ENDPOINTS[0];
   console.log(`   Connecting to Bulletin: ${primary}`);
-  const client = createPolkadotClient(getWsProvider(
+  const client = createPolkadotClient2(getWsProvider2(
     BULLETIN_ENDPOINTS,
     { heartbeatTimeout: WS_HEARTBEAT_TIMEOUT_MS, onStatusChanged: makeBulletinStatusHandler(primary) }
   ));
@@ -259,7 +432,7 @@ async function getDirectProvider(mnemonic, derivationPath = "") {
   const { signer, ss58 } = deriveRootSigner(mnemonic, derivationPath);
   console.log(`   Using direct signer: ${ss58}${derivationPath ? ` (path: ${derivationPath})` : ""}`);
   let [auth, currentBlock] = await Promise.all([
-    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum2("Account", ss58)),
     client.getFinalizedBlock()
   ]);
   let now = currentBlock.number;
@@ -267,7 +440,7 @@ async function getDirectProvider(mnemonic, derivationPath = "") {
     try {
       await ensureAuthorized(unsafeApi, ss58, "direct signer");
       [auth, currentBlock] = await Promise.all([
-        unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+        unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum2("Account", ss58)),
         client.getFinalizedBlock()
       ]);
       now = currentBlock.number;
@@ -284,14 +457,14 @@ async function getDirectProvider(mnemonic, derivationPath = "") {
 async function getSignerProvider(signer, ss58) {
   const primary = BULLETIN_ENDPOINTS[0];
   console.log(`   Connecting to Bulletin: ${primary}`);
-  const client = createPolkadotClient(getWsProvider(
+  const client = createPolkadotClient2(getWsProvider2(
     BULLETIN_ENDPOINTS,
     { heartbeatTimeout: WS_HEARTBEAT_TIMEOUT_MS, onStatusChanged: makeBulletinStatusHandler(primary) }
   ));
   const unsafeApi = client.getUnsafeApi();
   console.log(`   Using external signer: ${ss58}`);
   let [auth, currentBlock] = await Promise.all([
-    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum2("Account", ss58)),
     client.getFinalizedBlock()
   ]);
   let now = currentBlock.number;
@@ -299,7 +472,7 @@ async function getSignerProvider(signer, ss58) {
     try {
       await ensureAuthorized(unsafeApi, ss58, "external signer");
       [auth, currentBlock] = await Promise.all([
-        unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+        unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum2("Account", ss58)),
         client.getFinalizedBlock()
       ]);
       now = currentBlock.number;
@@ -314,19 +487,37 @@ async function getSignerProvider(signer, ss58) {
   return { client, unsafeApi, signer, ss58 };
 }
 function __selectStorageProviderModeForTest(options) {
+  if (options.storageSigner && options.storageSignerAddress) return "storageSigner";
   if (options.signer && options.signerAddress) return "signer";
   if (options.mnemonic) return "direct";
   return "pool";
 }
+function chooseSignerInput(opts) {
+  if (opts.mnemonic) return "mnemonic";
+  if (opts.hasInjectedSigner) return "injected";
+  if (opts.suri) return "resolve";
+  if (opts.hasSession) return "resolve";
+  return "pool";
+}
 function selectStorageReconnect(options) {
-  switch (__selectStorageProviderModeForTest(options)) {
-    case "signer":
-      return () => getSignerProvider(options.signer, options.signerAddress);
-    case "direct":
-      return () => getDirectProvider(options.mnemonic, options.derivationPath);
-    case "pool":
-      return () => getProvider();
+  if (options.storageSigner && options.storageSignerAddress) {
+    let useSlot = true;
+    return async () => {
+      if (!useSlot) return getProvider();
+      try {
+        return await getSlotSignerProvider(options.storageSigner, options.storageSignerAddress);
+      } catch {
+        useSlot = false;
+        setDeployAttribute("deploy.signer.mode", "pool-fallback");
+        return getProvider();
+      }
+    };
   }
+  if (options.signer && options.signerAddress)
+    return () => getSignerProvider(options.signer, options.signerAddress);
+  if (options.mnemonic)
+    return () => getDirectProvider(options.mnemonic, options.derivationPath);
+  return () => getProvider();
 }
 function watchTransaction(tx, signer, txOpts, onSuccess, { label = "transaction", rpc, senderSS58, expectedNonce, timeoutMs, fetchNonce: fetchNonceOverride } = {}) {
   const timeout = timeoutMs ?? TX_TIMEOUT_MS;
@@ -491,7 +682,7 @@ async function storeChunkedContent(chunks, { client: existingClient, unsafeApi:
     }
   }
   const readUploadAuthorization = () => Promise.all([
-    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum("Account", ss58)),
+    unsafeApi.query.TransactionStorage.Authorizations.getValue(Enum2("Account", ss58)),
     unsafeApi.query.System.Number.getValue()
   ]);
   let uploadAuth;
@@ -1120,7 +1311,7 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
     useKubo = hasIPFS();
   }
   const phaseA = await withSpan("deploy.merkleize", `1a. merkleize (${useKubo ? "kubo" : "js"}, stable)`, { "deploy.directory": dirBasename, "deploy.merkle": useKubo ? "kubo" : "js" }, async () => {
-    const r = await merkleizeWithStableOrder(directoryPath, prevManifest?.stableBlockOrder, { useKubo });
+    const r = await merkleizeWithStableOrder(directoryPath, prevManifest?.stableBlockOrder, { useKubo, phase: "Phase A" });
     sampleMemory("merkleize_end");
     return r;
   });
@@ -1239,7 +1430,7 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
   carChunksA.length = 0;
   phaseA.carBytes = new Uint8Array(0);
   const phaseB = await withSpan("deploy.merkleize", "1c. merkleize (js, finalise)", { "deploy.directory": dirBasename }, async () => {
-    const r = await merkleizeWithStableOrder(directoryPath, phaseA.stableOrder, { useKubo });
+    const r = await merkleizeWithStableOrder(directoryPath, phaseA.stableOrder, { useKubo, phase: "Phase B" });
     sampleMemory("merkleize_finalise_end");
     return r;
   });
@@ -1533,8 +1724,7 @@ async function publish(dotns, parsed, failOnError) {
     setDeployAttribute("deploy.publish.status", "failed");
     if (failOnError) throw e;
     const msg = e?.message ?? String(e);
-    console.error(`   Warning: publish failed (non-fatal): ${msg}`);
-    captureWarning("publish failed", { error: msg.slice(0, 200) });
+    console.log(`   Publish failed: ${msg}`);
   }
 }
 async function unpublish(domainName, options = {}) {
@@ -1654,359 +1844,478 @@ async function deploy(content, domainName = null, options = {}) {
   BULLETIN_ENDPOINTS = userRpc ? [userRpc, ...envBulletin.filter((e) => e !== userRpc)] : envBulletin;
   _deployRpcFailedOver = false;
   POOL_SIZE = options.poolSize ?? parseInt(process.env.BULLETIN_POOL_SIZE ?? String(DEFAULT_POOL_SIZE), 10);
+  let sessionCleanup;
+  const hasSession = hasPersistedSession();
+  const signerChoice = chooseSignerInput({
+    mnemonic: options.mnemonic,
+    suri: options.suri,
+    hasInjectedSigner: !!(options.signer && options.signerAddress),
+    hasSession
+  });
+  let resolvedUserSession = void 0;
+  if (signerChoice === "resolve") {
+    const { resolveSigner: resolveSignerFn } = await import("./auth/index.js");
+    const { getAuthClient } = await import("./auth-config.js");
+    const authClient = await getAuthClient(envId);
+    try {
+      const resolved = await resolveSignerFn(authClient, { suri: options.suri });
+      options = { ...options, signer: resolved.signer, signerAddress: resolved.address };
+      sessionCleanup = resolved.destroy.bind(resolved);
+      console.log(`   Using ${resolved.source} signer: ${resolved.address}`);
+      if (resolved.source === "session") resolvedUserSession = resolved;
+    } catch (e) {
+      if (options.suri) throw e;
+      if (e?.name === "SignerNotAvailableError") {
+        console.log(
+          "   Login session unavailable or expired \u2014 falling back to pool. Run `bulletin-deploy login` to use your identity."
+        );
+      } else {
+        throw e;
+      }
+    }
+  }
+  if (!options.storageSigner) {
+    try {
+      let slotResult = await readBulletinSlotSigner(DOT_DAPP_ID);
+      if (!slotResult && resolvedUserSession?.userSession) {
+        const { requestResourceAllocation } = await import("./auth/index.js");
+        console.log("Requesting Bulletin storage allowance \u2014 check your phone to approve");
+        const outcomes = await requestResourceAllocation(
+          resolvedUserSession.userSession,
+          DOT_PRODUCT_ID,
+          // StatementStoreAllowance is required for createTransaction (the session
+          // signer uses it to send signing requests to the phone). Include it here
+          // so a deploy without a prior `login` still works. onExisting:"Ignore"
+          // makes this a no-op if the allowance was already granted by login.
+          [
+            { tag: "BulletInAllowance", value: void 0 },
+            { tag: "StatementStoreAllowance", value: void 0 }
+          ]
+        );
+        const hexKey = extractBulletinSlotKey(outcomes);
+        if (hexKey) {
+          await writeBulletinSlotKey(DOT_DAPP_ID, hexKey);
+          slotResult = await readBulletinSlotSigner(DOT_DAPP_ID);
+        }
+      }
+      if (slotResult) {
+        options = { ...options, storageSigner: slotResult.signer, storageSignerAddress: slotResult.ss58 };
+      }
+    } catch {
+    }
+  }
   initTelemetry();
   const randomSuffix = Math.floor(Math.random() * 100).toString().padStart(2, "0");
   const parsed = domainName ? parseDomainName(domainName) : null;
   const name = parsed ? parsed.label : `test-domain-${Date.now().toString(36)}${randomSuffix}`;
-  return withDeploySpan(name, async () => {
-    const deployTag = options.tag ?? process.env.DEPLOY_TAG;
-    if (deployTag) {
-      setDeployAttribute("deploy.tag", deployTag);
-      setDeploySentryTag("deploy.tag", deployTag);
-    }
-    setDeployAttribute("deploy.env", envId);
-    setDeployAttribute("deploy.label", parsed?.label ?? name);
-    setDeployAttribute("deploy.subdomain", String(parsed?.isSubdomain ?? false));
-    if (envNetwork) setDeployAttribute("deploy.network", envNetwork);
-    if (envSource) setDeployAttribute("deploy.environments_source", envSource);
-    let cid;
-    let ipfsCid;
-    let mirrorPromise = Promise.resolve(null);
-    console.log("\n" + "=".repeat(60));
-    console.log(`DEPLOYING TO TESTNET                    v${VERSION}`);
-    console.log("=".repeat(60));
-    if (envName) console.log(`   Environment: ${envName}`);
-    console.log(`   Domain: ${name}.dot`);
-    if (deployTag) console.log(`   Tag: ${deployTag}`);
-    if (options.inputCar) console.log(`   Input CAR: ${path.resolve(options.inputCar)}`);
-    else if (typeof content === "string") console.log(`   Build dir: ${path.resolve(content)}`);
-    if (process.env.CI) console.log(`   Runner: ${resolveRunner()} (${resolveRunnerType()})`);
-    if (options.password) console.log(`   Encrypted: yes`);
-    let provider;
-    const reconnect = selectStorageReconnect(options);
-    let dotnsPreflight = null;
-    let previousContenthashCid = null;
-    try {
-      console.log("\n" + "=".repeat(60));
-      console.log("Preflight");
-      console.log("=".repeat(60));
-      const preflight = new DotNS();
-      await preflight.connect(resolveDotnsConnectOptions(options, envAssetHub, envAutoAccountMapping, envContracts, envNativeToEthRatio, envId, envPopSelfServe, envRegisterStorageDeposit));
-      if (parsed?.isSubdomain) {
-        try {
-          const subResult = await preflight.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
-          assertSubdomainOwnerMatchesSigner(subResult, preflight.evmAddress, parsed.sublabel, parsed.parentLabel);
-          if (!subResult.owned) {
-            const { owned: parentOwned, owner: parentOwner } = await preflight.checkOwnership(parsed.parentLabel);
-            if (!parentOwned) {
-              throw new NonRetryableError(
-                `Cannot deploy ${parsed.fullName}: parent ${parsed.parentLabel}.dot is owned by ${parentOwner ?? "no one"}, not by this signer.`
-              );
-            }
-          }
-          previousContenthashCid = await readPreviousContenthashSafe(preflight, parsed.fullName);
-          setDeployAttribute("deploy.incremental", previousContenthashCid ? "true" : "false");
-        } finally {
-          preflight.disconnect();
-        }
-        console.log(`   Mode: subdomain (parent ${parsed.parentLabel}.dot owned by signer)`);
-      } else {
-        try {
-          dotnsPreflight = await preflight.preflight(name);
-          previousContenthashCid = await readPreviousContenthashSafe(preflight, name);
-          setDeployAttribute("deploy.incremental", previousContenthashCid ? "true" : "false");
-        } finally {
-          preflight.disconnect();
-        }
-        if (dotnsPreflight) {
-          setDeployAttribute("deploy.dotns.preflight.action", dotnsPreflight.plannedAction);
-          setDeployAttribute("deploy.dotns.preflight.classification", popStatusName(dotnsPreflight.classification.status));
-        }
-        const alreadyOwned = dotnsPreflight.plannedAction === "already-owned-by-us";
-        const reqSuffix = alreadyOwned ? " (already owned, requirement not enforced)" : "";
-        console.log(`   DotNS: ${name}.dot requires ${popStatusName(dotnsPreflight.classification.status)}${reqSuffix}`);
-        if (dotnsPreflight.canProceed) {
-          const fromName = popStatusName(dotnsPreflight.userStatus);
-          console.log(`   Your PoP: ${fromName}`);
-          console.log(`   Domain: ${dotnsPreflight.plannedAction === "already-owned-by-us" ? "owned by you" : "available"}`);
-        }
-        if (!dotnsPreflight.canProceed) {
-          throw new NonRetryableError(
-            dotnsPreflight.reason ?? "DotNS preflight rejected the deploy; please check the label and signer."
-          );
-        }
+  try {
+    return await withDeploySpan(name, async () => {
+      const deployTag = options.tag ?? process.env.DEPLOY_TAG;
+      if (deployTag) {
+        setDeployAttribute("deploy.tag", deployTag);
+        setDeploySentryTag("deploy.tag", deployTag);
       }
-      provider = await reconnect();
-      const providerWithReconnect = { ...provider, reconnect };
-      const isTestnet = await detectTestnet(provider.unsafeApi);
-      setDeployAttribute("deploy.is_testnet", isTestnet ? "true" : "false");
+      setDeployAttribute("deploy.env", envId);
+      setDeployAttribute("deploy.label", parsed?.label ?? name);
+      setDeployAttribute("deploy.subdomain", String(parsed?.isSubdomain ?? false));
+      if (envNetwork) setDeployAttribute("deploy.network", envNetwork);
+      if (envSource) setDeployAttribute("deploy.environments_source", envSource);
+      let cid;
+      let ipfsCid;
+      let mirrorPromise = Promise.resolve(null);
       console.log("\n" + "=".repeat(60));
-      console.log("Storage");
+      console.log(`DEPLOYING TO TESTNET                    v${VERSION}`);
       console.log("=".repeat(60));
-      setDeployAttribute("deploy.content_type", "unknown");
-      setDeployAttribute("deploy.encrypted", "false");
-      await withSpan("deploy.storage", "1. storage", {}, async () => {
-        if (options.inputCar) {
-          setDeployAttribute("deploy.content_type", "inputCar");
-          const carPath = path.resolve(options.inputCar);
-          if (!fs.existsSync(carPath)) throw new Error(`CAR file not found: ${carPath}`);
-          console.log(`
-   Mode: Pre-built CAR`);
-          console.log(`   Path: ${carPath}`);
-          let carContent = fs.readFileSync(carPath);
-          console.log(`   Size: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
-          const reader = await CarReader.fromBytes(carContent);
-          const roots = await reader.getRoots();
-          if (roots.length === 0) throw new Error("CAR file has no roots");
-          ipfsCid = roots[0].toString();
-          console.log(`   Root CID: ${ipfsCid}`);
-          if (options.password) {
-            setDeployAttribute("deploy.encrypted", "true");
-            console.log(`   Encrypting CAR file...`);
-            carContent = await encryptContent(carContent, options.password);
-            console.log(`   Encrypted: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
-          }
-          let carChunks;
-          if (options.password) {
-            carChunks = chunk(carContent, CHUNK_SIZE);
-          } else {
-            try {
-              let prevStableOrder = [];
-              const manifestBytes = await extractManifestFromCar(carContent);
-              if (manifestBytes) {
-                const parsed2 = parseManifest(Buffer.from(manifestBytes).toString("utf8"));
-                if (parsed2.ok) prevStableOrder = parsed2.manifest.stableBlockOrder;
+      if (envName) console.log(`   Environment: ${envName}`);
+      console.log(`   Domain: ${name}.dot`);
+      if (deployTag) console.log(`   Tag: ${deployTag}`);
+      if (options.inputCar) console.log(`   Input CAR: ${path.resolve(options.inputCar)}`);
+      else if (typeof content === "string") console.log(`   Build dir: ${path.resolve(content)}`);
+      if (process.env.CI) console.log(`   Runner: ${resolveRunner()} (${resolveRunnerType()})`);
+      if (options.password) console.log(`   Encrypted: yes`);
+      let provider;
+      const reconnect = selectStorageReconnect(options);
+      let dotnsPreflight = null;
+      let previousContenthashCid = null;
+      let preflightPublishNeeded = false;
+      try {
+        console.log("\n" + "=".repeat(60));
+        console.log("Preflight");
+        console.log("=".repeat(60));
+        const preflight = new DotNS();
+        await preflight.connect(resolveDotnsConnectOptions(options, envAssetHub, envAutoAccountMapping, envContracts, envNativeToEthRatio, envId, envPopSelfServe, envRegisterStorageDeposit));
+        if (parsed?.isSubdomain) {
+          try {
+            const subResult = await preflight.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
+            assertSubdomainOwnerMatchesSigner(subResult, preflight.evmAddress, parsed.sublabel, parsed.parentLabel);
+            if (!subResult.owned) {
+              const { owned: parentOwned, owner: parentOwner } = await preflight.checkOwnership(parsed.parentLabel);
+              if (!parentOwned) {
+                throw new NonRetryableError(
+                  `Cannot deploy ${parsed.fullName}: parent ${parsed.parentLabel}.dot is owned by ${parentOwner ?? "no one"}, not by this signer.`
+                );
               }
-              const rebuilt = await rebuildOrderedCarFromBytes(carContent, prevStableOrder);
-              if (Buffer.compare(Buffer.from(rebuilt.carBytes), Buffer.from(carContent)) === 0) {
-                carChunks = rebuilt.chunks;
+            }
+            previousContenthashCid = await readPreviousContenthashSafe(preflight, parsed.fullName);
+            setDeployAttribute("deploy.incremental", previousContenthashCid ? "true" : "false");
+          } finally {
+            preflight.disconnect();
+          }
+          console.log(`   Mode: subdomain (parent ${parsed.parentLabel}.dot owned by signer)`);
+        } else {
+          preflightPublishNeeded = false;
+          try {
+            dotnsPreflight = await preflight.preflight(name);
+            previousContenthashCid = await readPreviousContenthashSafe(preflight, name);
+            setDeployAttribute("deploy.incremental", previousContenthashCid ? "true" : "false");
+            if (options.publish && parsed && !parsed.isSubdomain) {
+              const publisher = preflight._contracts?.PUBLISHER;
+              const zeroAddr = "0x0000000000000000000000000000000000000000";
+              if (!publisher || publisher === zeroAddr) {
+                console.log(`   Publish: not supported on this environment \u2014 will be skipped`);
               } else {
-                captureWarning("input CAR ordered rechunk drift; falling back to size chunking", {
-                  rootCid: ipfsCid
-                });
-                carChunks = chunk(carContent, CHUNK_SIZE);
+                const labelhash = keccak256(toBytes(name));
+                try {
+                  const alreadyPublished = await preflight.contractCall(
+                    publisher,
+                    PUBLISHER_ABI,
+                    "isPublished",
+                    [labelhash]
+                  );
+                  preflightPublishNeeded = !alreadyPublished;
+                  if (!preflightPublishNeeded) {
+                    console.log(`   Publish: already published \u2014 will be skipped`);
+                  }
+                } catch {
+                  preflightPublishNeeded = true;
+                }
               }
-            } catch (err) {
-              captureWarning("input CAR ordered rechunk failed; falling back to size chunking", {
-                rootCid: ipfsCid,
-                reason: err?.message ?? String(err)
-              });
-              carChunks = chunk(carContent, CHUNK_SIZE);
             }
+          } finally {
+            preflight.disconnect();
+          }
+          if (dotnsPreflight) {
+            setDeployAttribute("deploy.dotns.preflight.action", dotnsPreflight.plannedAction);
+            setDeployAttribute("deploy.dotns.preflight.classification", popStatusName(dotnsPreflight.classification.status));
           }
-          const predictedStorageCid = computeStorageCid(carChunks);
-          if (options.ghPagesMirror) {
-            mirrorPromise = mirrorToGitHubPages({
-              domain: name,
-              carBytes: carContent,
-              cid: predictedStorageCid,
-              toolVersion: VERSION,
-              bulletinRpc: BULLETIN_ENDPOINTS[0],
-              encrypted: Boolean(options.password)
-            }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+          const alreadyOwned = dotnsPreflight.plannedAction === "already-owned-by-us";
+          const reqSuffix = alreadyOwned ? " (already owned, requirement not enforced)" : "";
+          console.log(`   DotNS: ${name}.dot requires ${popStatusName(dotnsPreflight.classification.status)}${reqSuffix}`);
+          if (dotnsPreflight.canProceed) {
+            const fromName = popStatusName(dotnsPreflight.userStatus);
+            console.log(`   Your PoP: ${fromName}`);
+            console.log(`   Domain: ${dotnsPreflight.plannedAction === "already-owned-by-us" ? "owned by you" : "available"}`);
           }
-          cid = (await storeChunkedContent(carChunks, providerWithReconnect)).storageCid;
-        } else if (process.env.IPFS_CID) {
-          setDeployAttribute("deploy.content_type", "ipfsCid");
-          if (options.password) {
-            throw new Error(
-              "IPFS_CID and --password are mutually exclusive: IPFS_CID skips the upload step, so there is nothing to encrypt. Either unset IPFS_CID to upload and encrypt fresh content, or remove --password to reuse the existing CID as-is."
+          if (!dotnsPreflight.canProceed) {
+            throw new NonRetryableError(
+              dotnsPreflight.reason ?? "DotNS preflight rejected the deploy; please check the label and signer."
             );
           }
-          cid = process.env.IPFS_CID;
-          ipfsCid = cid;
-          console.log(`
-   Using CID: ${cid}`);
-        } else if (Array.isArray(content)) {
-          setDeployAttribute("deploy.content_type", "multiChunk");
-          console.log(`
-   Mode: Multi-chunk (${content.length} chunks)`);
-          let contentChunks = content;
-          if (options.password) {
-            setDeployAttribute("deploy.encrypted", "true");
-            console.log(`   Encrypting...`);
-            const encrypted = await encryptContent(Buffer.concat(content), options.password);
-            console.log(`   Encrypted: ${(encrypted.length / 1024).toFixed(1)} KB`);
-            contentChunks = chunk(encrypted);
+        }
+        if (options.signer && options.signerAddress) {
+          const steps = computePhoneSigningSteps(dotnsPreflight, preflightPublishNeeded);
+          if (steps.length === 1) {
+            console.log(`
+\u{1F4F1} Have your phone ready \u2014 1 signature needed (${steps[0].toLowerCase()})`);
+          } else if (steps.length > 1) {
+            const display = steps.flatMap(
+              (s, i) => s === "Register" && steps[i - 1] === "Commitment" ? ["(wait)", s] : [s]
+            );
+            console.log(`
+\u{1F4F1} Have your phone ready \u2014 ${steps.length} signatures needed`);
+            console.log(`   ${display.map((s) => s.toLowerCase()).join(" \xB7 ")}`);
           }
-          cid = (await storeChunkedContent(contentChunks, providerWithReconnect)).storageCid;
-        } else if (typeof content === "string") {
-          setDeployAttribute("deploy.content_type", "path");
-          const contentPath = path.resolve(content);
-          if (!fs.existsSync(contentPath)) throw new Error(`Path not found: ${contentPath}`);
-          const stats = fs.statSync(contentPath);
-          if (stats.isDirectory()) {
-            setDeployAttribute("deploy.content_type", "directory");
+        }
+        provider = await reconnect();
+        const providerWithReconnect = { ...provider, reconnect };
+        const isTestnet = await detectTestnet(provider.unsafeApi);
+        setDeployAttribute("deploy.is_testnet", isTestnet ? "true" : "false");
+        console.log("\n" + "=".repeat(60));
+        console.log("Storage");
+        console.log("=".repeat(60));
+        setDeployAttribute("deploy.content_type", "unknown");
+        setDeployAttribute("deploy.encrypted", "false");
+        await withSpan("deploy.storage", "1. storage", {}, async () => {
+          if (options.inputCar) {
+            setDeployAttribute("deploy.content_type", "inputCar");
+            const carPath = path.resolve(options.inputCar);
+            if (!fs.existsSync(carPath)) throw new Error(`CAR file not found: ${carPath}`);
             console.log(`
-   Mode: Directory`);
-            console.log(`   Path: ${contentPath}`);
-            if (previousContenthashCid) console.log(`   Incremental: previous contenthash ${previousContenthashCid}`);
-            else console.log(`   Incremental: first deploy (no previous contenthash)`);
-            if (options.password) setDeployAttribute("deploy.encrypted", "true");
-            const storeFn = options.password ? storeDirectory : storeDirectoryV2;
-            const { storageCid: sCid, ipfsCid: iCid } = await storeFn(contentPath, {
-              provider: providerWithReconnect,
-              password: options.password,
-              jsMerkle: options.jsMerkle,
-              previousContenthash: previousContenthashCid,
-              allowLargeDeploy: options.allowLargeDeploy,
-              reproducibleSource: options.reproducibleSource,
-              domain: name,
-              gateway: envIpfs,
-              dumpCar: options.dumpCar,
-              onCarReady: (carBytes, predictedCid) => {
-                if (options.ghPagesMirror) {
-                  mirrorPromise = mirrorToGitHubPages({
-                    domain: name,
-                    carBytes,
-                    cid: predictedCid,
-                    toolVersion: VERSION,
-                    bulletinRpc: BULLETIN_ENDPOINTS[0],
-                    encrypted: Boolean(options.password)
-                  }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+   Mode: Pre-built CAR`);
+            console.log(`   Path: ${carPath}`);
+            let carContent = fs.readFileSync(carPath);
+            console.log(`   Size: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
+            const reader = await CarReader.fromBytes(carContent);
+            const roots = await reader.getRoots();
+            if (roots.length === 0) throw new Error("CAR file has no roots");
+            ipfsCid = roots[0].toString();
+            console.log(`   Root CID: ${ipfsCid}`);
+            if (options.password) {
+              setDeployAttribute("deploy.encrypted", "true");
+              console.log(`   Encrypting CAR file...`);
+              carContent = await encryptContent(carContent, options.password);
+              console.log(`   Encrypted: ${(carContent.length / 1024 / 1024).toFixed(2)} MB`);
+            }
+            let carChunks;
+            if (options.password) {
+              carChunks = chunk(carContent, CHUNK_SIZE);
+            } else {
+              try {
+                let prevStableOrder = [];
+                const manifestBytes = await extractManifestFromCar(carContent);
+                if (manifestBytes) {
+                  const parsed2 = parseManifest(Buffer.from(manifestBytes).toString("utf8"));
+                  if (parsed2.ok) prevStableOrder = parsed2.manifest.stableBlockOrder;
+                }
+                const rebuilt = await rebuildOrderedCarFromBytes(carContent, prevStableOrder);
+                if (Buffer.compare(Buffer.from(rebuilt.carBytes), Buffer.from(carContent)) === 0) {
+                  carChunks = rebuilt.chunks;
+                } else {
+                  captureWarning("input CAR ordered rechunk drift; falling back to size chunking", {
+                    rootCid: ipfsCid
+                  });
+                  carChunks = chunk(carContent, CHUNK_SIZE);
                 }
+              } catch (err) {
+                captureWarning("input CAR ordered rechunk failed; falling back to size chunking", {
+                  rootCid: ipfsCid,
+                  reason: err?.message ?? String(err)
+                });
+                carChunks = chunk(carContent, CHUNK_SIZE);
               }
-            });
-            cid = sCid;
-            ipfsCid = iCid;
-          } else {
-            setDeployAttribute("deploy.content_type", "file");
+            }
+            const predictedStorageCid = computeStorageCid(carChunks);
+            if (options.ghPagesMirror) {
+              mirrorPromise = mirrorToGitHubPages({
+                domain: name,
+                carBytes: carContent,
+                cid: predictedStorageCid,
+                toolVersion: VERSION,
+                bulletinRpc: BULLETIN_ENDPOINTS[0],
+                encrypted: Boolean(options.password)
+              }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+            }
+            cid = (await storeChunkedContent(carChunks, providerWithReconnect)).storageCid;
+          } else if (process.env.IPFS_CID) {
+            setDeployAttribute("deploy.content_type", "ipfsCid");
+            if (options.password) {
+              throw new Error(
+                "IPFS_CID and --password are mutually exclusive: IPFS_CID skips the upload step, so there is nothing to encrypt. Either unset IPFS_CID to upload and encrypt fresh content, or remove --password to reuse the existing CID as-is."
+              );
+            }
+            cid = process.env.IPFS_CID;
+            ipfsCid = cid;
+            console.log(`
+   Using CID: ${cid}`);
+          } else if (Array.isArray(content)) {
+            setDeployAttribute("deploy.content_type", "multiChunk");
             console.log(`
+   Mode: Multi-chunk (${content.length} chunks)`);
+            let contentChunks = content;
+            if (options.password) {
+              setDeployAttribute("deploy.encrypted", "true");
+              console.log(`   Encrypting...`);
+              const encrypted = await encryptContent(Buffer.concat(content), options.password);
+              console.log(`   Encrypted: ${(encrypted.length / 1024).toFixed(1)} KB`);
+              contentChunks = chunk(encrypted);
+            }
+            cid = (await storeChunkedContent(contentChunks, providerWithReconnect)).storageCid;
+          } else if (typeof content === "string") {
+            setDeployAttribute("deploy.content_type", "path");
+            const contentPath = path.resolve(content);
+            if (!fs.existsSync(contentPath)) throw new Error(`Path not found: ${contentPath}`);
+            const stats = fs.statSync(contentPath);
+            if (stats.isDirectory()) {
+              setDeployAttribute("deploy.content_type", "directory");
+              console.log(`
+   Mode: Directory`);
+              console.log(`   Path: ${contentPath}`);
+              if (previousContenthashCid) console.log(`   Incremental: previous contenthash ${previousContenthashCid}`);
+              else console.log(`   Incremental: first deploy (no previous contenthash)`);
+              if (options.password) setDeployAttribute("deploy.encrypted", "true");
+              const storeFn = options.password ? storeDirectory : storeDirectoryV2;
+              const { storageCid: sCid, ipfsCid: iCid } = await storeFn(contentPath, {
+                provider: providerWithReconnect,
+                password: options.password,
+                jsMerkle: options.jsMerkle,
+                previousContenthash: previousContenthashCid,
+                allowLargeDeploy: options.allowLargeDeploy,
+                reproducibleSource: options.reproducibleSource,
+                domain: name,
+                gateway: envIpfs,
+                dumpCar: options.dumpCar,
+                onCarReady: (carBytes, predictedCid) => {
+                  if (options.ghPagesMirror) {
+                    mirrorPromise = mirrorToGitHubPages({
+                      domain: name,
+                      carBytes,
+                      cid: predictedCid,
+                      toolVersion: VERSION,
+                      bulletinRpc: BULLETIN_ENDPOINTS[0],
+                      encrypted: Boolean(options.password)
+                    }).catch((err) => err instanceof Error ? err : new Error(String(err)));
+                  }
+                }
+              });
+              cid = sCid;
+              ipfsCid = iCid;
+            } else {
+              setDeployAttribute("deploy.content_type", "file");
+              console.log(`
    Mode: File`);
-            console.log(`   Path: ${contentPath}`);
-            let fileContent = fs.readFileSync(contentPath);
+              console.log(`   Path: ${contentPath}`);
+              let fileContent = fs.readFileSync(contentPath);
+              if (options.password) {
+                setDeployAttribute("deploy.encrypted", "true");
+                console.log(`   Encrypting...`);
+                fileContent = await encryptContent(fileContent, options.password);
+                console.log(`   Encrypted: ${(fileContent.length / 1024).toFixed(1)} KB`);
+              }
+              if (fileContent.length > MAX_FILE_SIZE) {
+                console.log(`   Exceeds 8MB, chunking...`);
+                cid = (await storeChunkedContent(chunk(fileContent), providerWithReconnect)).storageCid;
+              } else {
+                cid = await storeFile(fileContent, providerWithReconnect);
+              }
+            }
+          } else if (content instanceof Uint8Array) {
+            setDeployAttribute("deploy.content_type", "multiChunk");
+            console.log(`
+   Mode: Bytes`);
+            let bytesContent = content;
             if (options.password) {
               setDeployAttribute("deploy.encrypted", "true");
               console.log(`   Encrypting...`);
-              fileContent = await encryptContent(fileContent, options.password);
-              console.log(`   Encrypted: ${(fileContent.length / 1024).toFixed(1)} KB`);
+              bytesContent = await encryptContent(bytesContent, options.password);
+              console.log(`   Encrypted: ${(bytesContent.length / 1024).toFixed(1)} KB`);
             }
-            if (fileContent.length > MAX_FILE_SIZE) {
+            if (bytesContent.length > MAX_FILE_SIZE) {
               console.log(`   Exceeds 8MB, chunking...`);
-              cid = (await storeChunkedContent(chunk(fileContent), providerWithReconnect)).storageCid;
+              cid = (await storeChunkedContent(chunk(bytesContent), providerWithReconnect)).storageCid;
             } else {
-              cid = await storeFile(fileContent, providerWithReconnect);
+              cid = await storeFile(bytesContent, providerWithReconnect);
             }
-          }
-        } else if (content instanceof Uint8Array) {
-          setDeployAttribute("deploy.content_type", "multiChunk");
-          console.log(`
-   Mode: Bytes`);
-          let bytesContent = content;
-          if (options.password) {
-            setDeployAttribute("deploy.encrypted", "true");
-            console.log(`   Encrypting...`);
-            bytesContent = await encryptContent(bytesContent, options.password);
-            console.log(`   Encrypted: ${(bytesContent.length / 1024).toFixed(1)} KB`);
-          }
-          if (bytesContent.length > MAX_FILE_SIZE) {
-            console.log(`   Exceeds 8MB, chunking...`);
-            cid = (await storeChunkedContent(chunk(bytesContent), providerWithReconnect)).storageCid;
-          } else {
-            cid = await storeFile(bytesContent, providerWithReconnect);
-          }
-        } else {
-          throw new Error("Invalid content: must be path, Uint8Array, or Array<Uint8Array>");
-        }
-      });
-      setDeployAttribute("deploy.cid", cid);
-      if (options.attributes) {
-        for (const [key, value] of Object.entries(options.attributes)) {
-          setDeployAttribute(key, value);
-        }
-      }
-      console.log("\n" + "=".repeat(60));
-      console.log("DotNS");
-      console.log("=".repeat(60));
-      await withSpan("deploy.dotns", "2. dotns", { "deploy.domain": name, "deploy.subdomain": String(parsed?.isSubdomain ?? false) }, async () => {
-        const dotns = new DotNS();
-        await dotns.connect(resolveDotnsConnectOptions(options, envAssetHub, envAutoAccountMapping, envContracts, envNativeToEthRatio, envId, envPopSelfServe, envRegisterStorageDeposit));
-        if (parsed?.isSubdomain) {
-          const { owned, owner } = await dotns.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
-          if (owned) {
-            console.log(`   Status: Already owned`);
-          } else if (owner) {
-            throw new Error(`Subdomain ${parsed.fullName} is owned by ${owner}, not ${dotns.evmAddress}`);
           } else {
-            const parentOwnership = await dotns.checkOwnership(parsed.parentLabel);
-            if (!parentOwnership.owned) throw new Error(`You must own ${parsed.parentLabel}.dot to register subdomains under it`);
-            console.log(`   Status: Registering subdomain...`);
-            await dotns.registerSubdomain(parsed.sublabel, parsed.parentLabel);
+            throw new Error("Invalid content: must be path, Uint8Array, or Array<Uint8Array>");
           }
-        } else {
-          const { owned } = await dotns.checkOwnership(name);
-          if (owned) {
-            console.log(`   Status: Already owned`);
-          } else {
-            console.log(`   Status: Registering...`);
-            await dotns.register(name);
+        });
+        setDeployAttribute("deploy.cid", cid);
+        if (options.attributes) {
+          for (const [key, value] of Object.entries(options.attributes)) {
+            setDeployAttribute(key, value);
           }
         }
-        const contenthashHex = `0x${encodeContenthash(cid)}`;
-        await dotns.setContenthash(name, contenthashHex);
-        if (options.publish && parsed) {
-          await publish(dotns, parsed, options.failOnPublishError);
-        }
-        dotns.disconnect();
-      });
-      await withSpan("deploy.p2p-check", "3. p2p-check", { "deploy.domain": name }, async () => {
-        const probe = await probeP2pRetrieval(provider.client, cid);
-        setDeployAttribute("deploy.p2p.retrievable", probe.retrievable ? "true" : "false");
-        setDeployAttribute("deploy.p2p.check_ms", String(probe.durationMs));
-        setDeployAttribute("deploy.p2p.error_variant", probe.errorVariant);
-        if (probe.retrievable) {
-          console.log(`   P2P retrieval: \u2713 (${probe.durationMs}ms)`);
-        } else {
-          console.log(`   P2P retrieval: \u26A0 not yet retrievable (${probe.errorVariant}, ${probe.durationMs}ms)`);
-        }
-      });
-      if (options.ghPagesMirror) {
         console.log("\n" + "=".repeat(60));
-        console.log("Final checks");
+        console.log("DotNS");
         console.log("=".repeat(60));
-        await withSpan("deploy.gh-pages-mirror", "4. gh-pages-mirror", { "deploy.domain": name }, async () => {
-          const mirror = await mirrorPromise;
-          if (mirror === null) {
-            console.log("   GitHub Pages mirror: skipped (only directory deploys produce a CAR suitable for mirroring).");
-            return;
-          }
-          if (mirror instanceof MirrorSkipped) {
-            console.log(`   GitHub Pages mirror: skipped \u2014 ${mirror.message}`);
-            return;
+        await withSpan("deploy.dotns", "2. dotns", { "deploy.domain": name, "deploy.subdomain": String(parsed?.isSubdomain ?? false) }, async () => {
+          const dotns = new DotNS();
+          await dotns.connect({
+            ...resolveDotnsConnectOptions(options, envAssetHub, envAutoAccountMapping, envContracts, envNativeToEthRatio, envId, envPopSelfServe, envRegisterStorageDeposit),
+            ...options.signer && options.signerAddress ? { onPhoneSigningRequired: (label) => console.log(`
+   Check your phone \u2192 ${label}`) } : {}
+          });
+          if (parsed?.isSubdomain) {
+            const { owned, owner } = await dotns.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
+            if (owned) {
+              console.log(`   Status: Already owned`);
+            } else if (owner) {
+              throw new Error(`Subdomain ${parsed.fullName} is owned by ${owner}, not ${dotns.evmAddress}`);
+            } else {
+              const parentOwnership = await dotns.checkOwnership(parsed.parentLabel);
+              if (!parentOwnership.owned) throw new Error(`You must own ${parsed.parentLabel}.dot to register subdomains under it`);
+              console.log(`   Status: Registering subdomain...`);
+              await dotns.registerSubdomain(parsed.sublabel, parsed.parentLabel);
+            }
+          } else {
+            const { owned } = await dotns.checkOwnership(name);
+            if (owned) {
+              console.log(`   Status: Already owned`);
+            } else {
+              console.log(`   Status: Registering...`);
+              await dotns.register(name);
+            }
           }
-          if (mirror instanceof Error) {
-            console.log(`   GitHub Pages mirror: failed (non-fatal) \u2014 ${mirror.message}`);
-            captureWarning("gh-pages mirror failed", { error: mirror.message.slice(0, 200) });
-            return;
+          const contenthashHex = `0x${encodeContenthash(cid)}`;
+          await dotns.setContenthash(name, contenthashHex);
+          if (options.publish && parsed) {
+            if (preflightPublishNeeded !== false) {
+              await publish(dotns, parsed, options.failOnPublishError);
+            }
           }
-          console.log(`   Mirror: ${mirror.url}`);
-          console.log(`   Manifest: https://${mirror.owner}.github.io/${mirror.repo}/${mirror.manifestPath}`);
-          setDeployAttribute("deploy.gh_pages_url", mirror.url);
-          process.stdout.write("   Verifying Pages serves this deploy's CAR... ");
-          const freshness = await pollMirrorFreshness(mirror.url, cid, { timeoutMs: 3 * 60 * 1e3, intervalMs: 1e4 });
-          if (freshness.verified) {
-            console.log(`ok (${freshness.attempts} attempt${freshness.attempts === 1 ? "" : "s"}, ${(freshness.durationMs / 1e3).toFixed(0)}s).`);
-            setDeployAttribute("deploy.gh_pages_freshness_verified", "true");
+          dotns.disconnect();
+        });
+        await withSpan("deploy.p2p-check", "3. p2p-check", { "deploy.domain": name }, async () => {
+          const probe = await probeP2pRetrieval(provider.client, cid);
+          setDeployAttribute("deploy.p2p.retrievable", probe.retrievable ? "true" : "false");
+          setDeployAttribute("deploy.p2p.check_ms", String(probe.durationMs));
+          setDeployAttribute("deploy.p2p.error_variant", probe.errorVariant);
+          if (probe.retrievable) {
+            console.log(`   P2P retrieval: \u2713 (${probe.durationMs}ms)`);
           } else {
-            console.log(`timed out.`);
-            console.log(`   GitHub Pages last served cid=${freshness.lastCid ?? "n/a"} (expected ${cid}); it should catch up shortly. Non-fatal.`);
-            setDeployAttribute("deploy.gh_pages_freshness_verified", "false");
+            console.log(`   P2P retrieval: \u26A0 not yet retrievable (${probe.errorVariant}, ${probe.durationMs}ms)`);
           }
         });
+        if (options.ghPagesMirror) {
+          console.log("\n" + "=".repeat(60));
+          console.log("Final checks");
+          console.log("=".repeat(60));
+          await withSpan("deploy.gh-pages-mirror", "4. gh-pages-mirror", { "deploy.domain": name }, async () => {
+            const mirror = await mirrorPromise;
+            if (mirror === null) {
+              console.log("   GitHub Pages mirror: skipped (only directory deploys produce a CAR suitable for mirroring).");
+              return;
+            }
+            if (mirror instanceof MirrorSkipped) {
+              console.log(`   GitHub Pages mirror: skipped \u2014 ${mirror.message}`);
+              return;
+            }
+            if (mirror instanceof Error) {
+              console.log(`   GitHub Pages mirror: failed (non-fatal) \u2014 ${mirror.message}`);
+              captureWarning("gh-pages mirror failed", { error: mirror.message.slice(0, 200) });
+              return;
+            }
+            console.log(`   Mirror: ${mirror.url}`);
+            console.log(`   Manifest: https://${mirror.owner}.github.io/${mirror.repo}/${mirror.manifestPath}`);
+            setDeployAttribute("deploy.gh_pages_url", mirror.url);
+            process.stdout.write("   Verifying Pages serves this deploy's CAR... ");
+            const freshness = await pollMirrorFreshness(mirror.url, cid, { timeoutMs: 3 * 60 * 1e3, intervalMs: 1e4 });
+            if (freshness.verified) {
+              console.log(`ok (${freshness.attempts} attempt${freshness.attempts === 1 ? "" : "s"}, ${(freshness.durationMs / 1e3).toFixed(0)}s).`);
+              setDeployAttribute("deploy.gh_pages_freshness_verified", "true");
+            } else {
+              console.log(`timed out.`);
+              console.log(`   GitHub Pages last served cid=${freshness.lastCid ?? "n/a"} (expected ${cid}); it should catch up shortly. Non-fatal.`);
+              setDeployAttribute("deploy.gh_pages_freshness_verified", "false");
+            }
+          });
+        }
+        console.log("\n" + "=".repeat(60));
+        console.log("DEPLOYMENT COMPLETE!");
+        console.log("=".repeat(60));
+        console.log("\n\u{1F53A} Polkadot Triangle");
+        console.log(`   - Polkadot Desktop: ${name}.dot`);
+        console.log(`   - Polkadot Browser: ${browserUrlFor(name, envId)}`);
+        console.log("\n" + "=".repeat(60) + "\n");
+        return { domainName: name, fullDomain: `${name}.dot`, cid, ipfsCid };
+      } finally {
+        if (_deployRpcFailedOver) setDeployAttribute("deploy.rpc.failed_over", "true");
+        provider?.client.destroy();
       }
-      console.log("\n" + "=".repeat(60));
-      console.log("DEPLOYMENT COMPLETE!");
-      console.log("=".repeat(60));
-      console.log("\n\u{1F53A} Polkadot Triangle");
-      console.log(`   - Polkadot Desktop: ${name}.dot`);
-      console.log(`   - Polkadot Browser: ${browserUrlFor(name, envId)}`);
-      console.log("\n" + "=".repeat(60) + "\n");
-      return { domainName: name, fullDomain: `${name}.dot`, cid, ipfsCid };
-    } finally {
-      if (_deployRpcFailedOver) setDeployAttribute("deploy.rpc.failed_over", "true");
-      provider?.client.destroy();
-    }
-  });
+    });
+  } finally {
+    sessionCleanup?.();
+  }
+}
+function computePhoneSigningSteps(dotnsPreflight, publishNeeded) {
+  if (!dotnsPreflight || dotnsPreflight.plannedAction === "abort") return [];
+  const steps = [];
+  if (dotnsPreflight.plannedAction === "register") {
+    steps.push("Commitment", "Register");
+  }
+  steps.push("Link content");
+  if (publishNeeded) steps.push("Publish to registry");
+  return steps;
 }
 
 // src/merkle.ts
@@ -2183,12 +2492,13 @@ async function merkleizeKuboBackend(directoryPath) {
   const { fileBlocks, fileCids, rootBlockCids, subdirCids } = walkFileBlocks(cidStr, blocks);
   return { rootCid: cidStr, blocks, fileBlocks, fileCids, rootBlockCids, subdirCids };
 }
-async function merkleizeBackend(directoryPath, useKubo) {
+async function merkleizeBackend(directoryPath, useKubo, phase) {
+  const tag = phase ? ` \u2014 ${phase}` : "";
   if (useKubo) {
-    console.log(`   Merkleizing (Kubo): ${directoryPath}`);
+    console.log(`   Merkleizing (Kubo${tag}): ${directoryPath}`);
     return merkleizeKuboBackend(directoryPath);
   }
-  console.log(`   Merkleizing (JS): ${directoryPath}`);
+  console.log(`   Merkleizing (JS${tag}): ${directoryPath}`);
   return merkleizeJSBackend(directoryPath);
 }
 function encodeCarFrame(cid, payload) {
@@ -2237,6 +2547,7 @@ function frameBlockCid(frame) {
 async function buildOrderedCar(options) {
   const { output, prevStableOrder = [] } = options;
   const clsFn = options.classifyFn ?? ((p) => classifyFile(p));
+  const tag = options.phase ? ` \u2014 ${options.phase}` : "";
   const MANIFEST_PATH_LITERAL = ".bulletin-deploy/manifest.json";
   const stableFiles = [];
   const volatileFiles = [];
@@ -2321,7 +2632,7 @@ async function buildOrderedCar(options) {
   const s1Bytes = section1Chunks.reduce((s, b) => s + b.length, 0);
   const s2Bytes = section2Chunks.reduce((s, b) => s + b.length, 0);
   console.log(
-    `   CAR (3-section): ${(carBytes.length / 1024 / 1024).toFixed(2)} MB (s0=${section0Bytes.length}B s1=${s1Bytes}B s2=${s2Bytes}B), ${allChunks.length} frames (${section0Chunks.length} header + ${section1Chunks.length} data + ${section2Chunks.length} manifest)`
+    `   CAR (3-section${tag}): ${(carBytes.length / 1024 / 1024).toFixed(2)} MB (s0=${section0Bytes.length}B s1=${s1Bytes}B s2=${s2Bytes}B), ${allChunks.length} frames (${section0Chunks.length} header + ${section1Chunks.length} data + ${section2Chunks.length} manifest)`
   );
   return {
     carBytes,
@@ -2358,8 +2669,9 @@ async function rebuildOrderedCarFromBytes(carBytes, prevStableOrder = []) {
 }
 async function merkleizeWithStableOrder(directoryPath, prevStableOrder, options) {
   const useKubo = options?.useKubo ?? false;
-  const output = await merkleizeBackend(directoryPath, useKubo);
-  return buildOrderedCar({ output, classifyFn: options?.classifyFn, prevStableOrder });
+  const phase = options?.phase;
+  const output = await merkleizeBackend(directoryPath, useKubo, phase);
+  return buildOrderedCar({ output, classifyFn: options?.classifyFn, prevStableOrder, phase });
 }
 async function merkleizeJS(directoryPath) {
   console.log(`   Merkleizing (JS): ${directoryPath}`);
@@ -2403,11 +2715,18 @@ export {
   rebuildOrderedCarFromBytes,
   merkleizeWithStableOrder,
   merkleizeJS,
+  readBulletinSlotSigner,
+  writeBulletinSlotKey,
+  extractBulletinSlotKey,
+  getSlotSignerProvider,
   friendlyChainError,
   DEFAULT_BULLETIN_RPC,
   DEFAULT_POOL_SIZE,
+  BULLETIN_ENDPOINTS,
   setWsHaltCallback,
+  makeBulletinStatusHandler,
   CHUNK_MORTALITY_PERIOD,
+  WS_HEARTBEAT_TIMEOUT_MS,
   retryBudgetExhausted,
   isConnectionError,
   deriveRootSigner,
@@ -2421,6 +2740,7 @@ export {
   ENCRYPT_PBKDF2_ITERATIONS,
   encryptContent,
   __selectStorageProviderModeForTest,
+  chooseSignerInput,
   storeFile,
   __assignDenseNoncesForTest,
   storeChunkedContent,
@@ -2442,5 +2762,6 @@ export {
   browserUrlFor,
   interpretBitswapResult,
   probeP2pRetrieval,
-  deploy
+  deploy,
+  computePhoneSigningSteps
 };