@parity/product-sdk 0.0.0-dev.312.0 → 0.0.0-dev.329.1

package/src/identity/dotns-addresses.ts

@@ -0,0 +1,320 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Where the DotNS contract addresses come from.
+ *
+ * Every entry point in `./dotns-registry.js` asks {@link resolveDotNsAddresses}
+ * rather than reaching for a constant, so "which address do I call?" has one
+ * answer and the gateway walk can plug in behind it without touching them.
+ */
+import {
+    type AbiEntry,
+    type ContractRuntime,
+    QUERY_FALLBACK_ORIGIN,
+    createContract,
+} from "@parity/product-sdk-contracts";
+import { type Result, err, ok } from "@parity/result";
+import {
+    DOTNS_ADDRESSES,
+    DOTNS_POP_CONTROLLER_ABI,
+    DOTNS_PROTOCOL_REGISTRY_ABI,
+    DOTNS_ROOT_GATEWAY_DISPATCHER_ABI,
+} from "./dotns-abis.js";
+import { DotNsError } from "./dotns-errors.js";
+import type { SS58String } from "polkadot-api";
+import type { DotNsClientOptions } from "./dotns-registry.js";
+
+type HexString = `0x${string}`;
+
+export interface DotNsAddresses {
+    registry: HexString;
+    reverseResolver: HexString;
+    resolver: HexString;
+    registrarController: HexString;
+    popRules: HexString;
+    protocolRegistry: HexString;
+}
+
+/**
+ * The `DotnsProtocolRegistry.get(bytes32)` key each role answers under, from
+ * `DotnsConstants`. Solidity's `bytes32("name")` is the UTF-8 bytes
+ * right-padded with zeros, which is what these literals are.
+ *
+ * Two are not the name you would guess, and guessing wrong is silent: `get`
+ * answers with a live address for the contract you did not want, and it
+ * surfaces much later as a revert. `registrarController` is the commit-reveal
+ * controller, key `controller` — `registrar` is the ERC-721 holding name
+ * ownership. `resolver` is the forward address resolver — `contentResolver`
+ * holds contenthash and text records, which nothing here calls.
+ *
+ * `protocolRegistry` has no key at all, so it cannot be looked up in the
+ * registry it is. The walk reaches it via `popController.protocolRegistry()`.
+ */
+export const DOTNS_REGISTRY_KEYS = {
+    registry: "0x7265676973747279000000000000000000000000000000000000000000000000",
+    registrarController: "0x636f6e74726f6c6c657200000000000000000000000000000000000000000000",
+    reverseResolver: "0x726576657273655265736f6c7665720000000000000000000000000000000000",
+    resolver: "0x7265736f6c766572000000000000000000000000000000000000000000000000",
+    popRules: "0x706f7052756c6573000000000000000000000000000000000000000000000000",
+} as const satisfies Record<Exclude<keyof DotNsAddresses, "protocolRegistry">, HexString>;
+
+export const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+
+export function isZero(addr: unknown): boolean {
+    return typeof addr === "string" && addr.toLowerCase() === ZERO_ADDRESS;
+}
+
+/** viem checksums every decoded `address`, so a read is EIP-55 whatever the chain sent. */
+export function sameAddress(a: unknown, b: unknown): boolean {
+    return typeof a === "string" && typeof b === "string" && a.toLowerCase() === b.toLowerCase();
+}
+
+/** A per-runtime, per-key cache of chain reads that cannot change under us. */
+export type RuntimeCache<T> = WeakMap<ContractRuntime, Map<string, Promise<Result<T, DotNsError>>>>;
+
+/**
+ * Read `key` once per runtime and hand every later caller the same answer.
+ *
+ * Stores the in-flight promise rather than the resolved value, so concurrent
+ * first calls share one read instead of racing. A failed read is dropped from
+ * the cache: those are usually the RPC blinking rather than the deployment
+ * moving, and keeping one would strand the client for the life of the runtime.
+ */
+export function cachedPerRuntime<T>(
+    cache: RuntimeCache<T>,
+    runtime: ContractRuntime,
+    key: string,
+    load: () => Promise<Result<T, DotNsError>>,
+): Promise<Result<T, DotNsError>> {
+    let byKey = cache.get(runtime);
+    if (!byKey) {
+        byKey = new Map();
+        cache.set(runtime, byKey);
+    }
+    const cached = byKey.get(key);
+    if (cached) return cached;
+
+    const pending = load();
+    byKey.set(key, pending);
+    pending.then((result) => {
+        if (!result.ok) byKey?.delete(key);
+    });
+    return pending;
+}
+
+function withOverrides(base: DotNsAddresses, opts: DotNsClientOptions): DotNsAddresses {
+    return {
+        registry: opts.registryAddress ?? base.registry,
+        reverseResolver: opts.reverseResolverAddress ?? base.reverseResolver,
+        resolver: opts.resolverAddress ?? base.resolver,
+        registrarController: opts.registrarControllerAddress ?? base.registrarController,
+        popRules: opts.popRulesAddress ?? base.popRules,
+        protocolRegistry: opts.protocolRegistryAddress ?? base.protocolRegistry,
+    };
+}
+
+/**
+ * Async because the discovered source reads the chain. The pinned source does
+ * no IO, so a caller that only validates a name still pays nothing for it.
+ */
+const walkCache: RuntimeCache<DotNsAddresses> = new WeakMap();
+
+/**
+ * Constant, unlike the TLD cache which keys on the protocol registry address.
+ * Nothing else selects the deployment: `gatewayApi` is required to describe the
+ * same chain as `runtime`, and the walk derives every address from there.
+ */
+const WALK_KEY = "discovered";
+
+export async function resolveDotNsAddresses(
+    opts: DotNsClientOptions,
+): Promise<Result<DotNsAddresses, DotNsError>> {
+    if (opts.addressSource !== "discovered") return ok(withOverrides(DOTNS_ADDRESSES, opts));
+
+    // Cache the walk, not the merged set: two callers differing only in their
+    // overrides must share one walk and still each get their own answer.
+    const walked = await cachedPerRuntime(walkCache, opts.runtime, WALK_KEY, () =>
+        discoverDotNsAddresses(opts),
+    );
+    return walked.ok ? ok(withOverrides(walked.value, opts)) : walked;
+}
+
+/**
+ * Reads `DotnsGateway.DispatcherAddress`, the pallet storage the walk starts
+ * from. Structural because `ContractRuntime` does not declare it.
+ */
+export type DotNsGatewayQueryApi = {
+    query: {
+        DotnsGateway: {
+            DispatcherAddress: {
+                getValue: () => Promise<{ asHex(): string } | string | undefined>;
+            };
+        };
+    };
+};
+
+const discoveryFailed = (step: string, cause?: unknown) =>
+    err(new DotNsError("AddressDiscovery", `DotNS address discovery failed: ${step}`, { cause }));
+
+/**
+ * `createContract` is generic over a typed ABI def; these minimal literal ABIs
+ * are called by name via `.query()`, so the handle is untyped by construction.
+ */
+export function contractOf(runtime: ContractRuntime, address: HexString, abi: AbiEntry[]) {
+    return createContract(runtime, address, abi as any) as any;
+}
+
+/**
+ * Origin for a read. Passing the fallback explicitly rather than letting the
+ * contracts layer substitute it keeps each query from logging a warning.
+ */
+export function readOrigin(opts: DotNsClientOptions): SS58String {
+    return opts.origin ?? QUERY_FALLBACK_ORIGIN;
+}
+
+async function readAddress(
+    contract: {
+        [m: string]: { query: (o: object) => Promise<{ success: boolean; value: unknown }> };
+    },
+    method: string,
+    origin: string,
+): Promise<Result<HexString, DotNsError>> {
+    const res = await contract[method].query({ origin });
+    if (!res.success) return discoveryFailed(`${method}() failed`, res.value);
+    const value = res.value;
+    if (typeof value !== "string" || isZero(value)) {
+        return discoveryFailed(`${method}() returned no address`);
+    }
+    return ok(value as HexString);
+}
+
+/** PAPI hands back H160 as a wrapper or a hex string depending on the major. */
+function asH160(value: unknown): HexString | null {
+    if (typeof value === "string") return value as HexString;
+    if (value && typeof (value as { asHex?: unknown }).asHex === "function") {
+        return (value as { asHex(): string }).asHex() as HexString;
+    }
+    return null;
+}
+
+function gatewayOf(opts: DotNsClientOptions): DotNsGatewayQueryApi | null {
+    if (opts.gatewayApi) return opts.gatewayApi;
+    const api = opts.runtime?.api as unknown as Partial<DotNsGatewayQueryApi> | undefined;
+    const getValue = api?.query?.DotnsGateway?.DispatcherAddress?.getValue;
+    return typeof getValue === "function" ? (api as DotNsGatewayQueryApi) : null;
+}
+
+/**
+ * Locate the live deployment from chain state, trusting nothing pinned here.
+ *
+ * Pallet -> `dispatcher.TARGET()` -> `popController.protocolRegistry()` ->
+ * `get(key)` per role. The first three are sequential because each answer is
+ * the next call's address; the role reads are not, so they go together.
+ *
+ * A failed or zero read is always an error: falling back to the pinned table
+ * would recreate the situation this exists to detect, and hide it better.
+ */
+export async function discoverDotNsAddresses(
+    opts: DotNsClientOptions,
+): Promise<Result<DotNsAddresses, DotNsError>> {
+    try {
+        const gateway = gatewayOf(opts);
+        if (!gateway) {
+            return discoveryFailed(
+                "no DotnsGateway.DispatcherAddress storage on this runtime; pass opts.gatewayApi",
+            );
+        }
+        const dispatcher = asH160(await gateway.query.DotnsGateway.DispatcherAddress.getValue());
+        if (!dispatcher || isZero(dispatcher)) {
+            return discoveryFailed("DotnsGateway.DispatcherAddress is unset");
+        }
+
+        const origin = readOrigin(opts);
+        const target = await readAddress(
+            contractOf(opts.runtime, dispatcher, DOTNS_ROOT_GATEWAY_DISPATCHER_ABI),
+            "TARGET",
+            origin,
+        );
+        if (!target.ok) return target;
+
+        const protocolRegistry = await readAddress(
+            contractOf(opts.runtime, target.value, DOTNS_POP_CONTROLLER_ABI),
+            "protocolRegistry",
+            origin,
+        );
+        if (!protocolRegistry.ok) return protocolRegistry;
+
+        const registry = contractOf(
+            opts.runtime,
+            protocolRegistry.value,
+            DOTNS_PROTOCOL_REGISTRY_ABI,
+        );
+        const roles = Object.entries(DOTNS_REGISTRY_KEYS) as [
+            keyof typeof DOTNS_REGISTRY_KEYS,
+            HexString,
+        ][];
+        // Not readAddress: that calls the method with no arguments, and these
+        // need the role name in the error rather than the method name, since
+        // every one of them is the same `get`.
+        const found = await Promise.all(
+            roles.map(async ([role, key]) => {
+                const res = await registry.get.query(key, { origin });
+                if (!res.success) return discoveryFailed(`get(${role}) failed`, res.value);
+                const value = res.value;
+                // A wrong key is not an error on chain: it returns address(0),
+                // so the role name is the only clue the caller gets.
+                if (typeof value !== "string" || isZero(value)) {
+                    return discoveryFailed(`${role} is unset on the protocol registry`);
+                }
+                return ok([role, value as HexString] as const);
+            }),
+        );
+        const failed = found.find((r) => !r.ok);
+        if (failed && !failed.ok) return failed;
+
+        const byRole = Object.fromEntries(found.flatMap((r) => (r.ok ? [r.value] : []))) as Omit<
+            DotNsAddresses,
+            "protocolRegistry"
+        >;
+        return ok({ ...byRole, protocolRegistry: protocolRegistry.value });
+    } catch (cause) {
+        return discoveryFailed("unexpected error", cause);
+    }
+}
+
+/**
+ * Walk the gateway and report every role whose live address differs from the
+ * one this client would call. Meant for startup: it fails loudly once, rather
+ * than making every later read pay for the check.
+ */
+export async function verifyDotNsAddresses(
+    opts: DotNsClientOptions,
+): Promise<Result<DotNsAddresses, DotNsError>> {
+    // Through the cache, so verifying at startup and then using the client is
+    // one walk rather than two.
+    const discovered = await cachedPerRuntime(walkCache, opts.runtime, WALK_KEY, () =>
+        discoverDotNsAddresses(opts),
+    );
+    if (!discovered.ok) return discovered;
+
+    // Compare what this client actually calls, which is the pinned table or the
+    // walk depending on the source, with the caller's overrides on top either
+    // way. A discovered client can still drift, through an override that
+    // disagrees with the chain; it is only the pinned base that cannot apply.
+    const inUse = withOverrides(
+        opts.addressSource === "discovered" ? discovered.value : DOTNS_ADDRESSES,
+        opts,
+    );
+    const drift = (Object.keys(inUse) as (keyof DotNsAddresses)[])
+        .filter((role) => !sameAddress(inUse[role], discovered.value[role]))
+        .map((role) => `${role}: using ${inUse[role]}, chain says ${discovered.value[role]}`);
+
+    return drift.length
+        ? err(
+              new DotNsError(
+                  "AddressMismatch",
+                  `DotNS addresses disagree with the deployment — ${drift.join("; ")}`,
+              ),
+          )
+        : ok(inUse);
+}

package/src/identity/dotns-errors.ts

@@ -18,6 +18,8 @@ export type DotNsErrorReason =
     | "NameUnavailable" // already registered
     | "NameReserved" // governance-held, or a base stem held by another user
     | "OwnerStatusInsufficient" // the owner lacks the personhood tier the label requires
+    | "AddressDiscovery" // the gateway walk could not locate the deployment
+    | "AddressMismatch" // a discovered address disagrees with the one in use
     | "RegistryCall" // the on-chain contract call failed
     | "Decode"; // the contract returned something we couldn't decode
 

package/src/identity/dotns-namehash.ts

@@ -13,8 +13,8 @@
  *   node("bob.alice.paseo") = node(node(tldNode, "alice"), "bob")
  *
  * The root is **per network**, not a constant. `DotnsProtocolRegistry.initialize`
- * fixes it once from a deploy-time label — `.dot` on Paseo Asset Hub Previewnet,
- * `.paseo` on Next V2 — and publishes it as `tld()` / `tldNode()`. Hashing under
+ * fixes it once from a deploy-time label — `.paseo` on Paseo Asset Hub Next V2,
+ * `.test` on Previewnet — and publishes it as `tld()` / `tldNode()`. Hashing under
  * the wrong root yields a node the chain has never written to, so every lookup
  * reports "unregistered" with no error anywhere. That is why {@link namehash}
  * takes the root rather than assuming one; `resolveTld` in `./dotns-registry.js`

package/src/identity/dotns-registry.test.ts

@@ -14,6 +14,7 @@ import { ss58ToH160 } from "@parity/product-sdk-address";
 import type { SS58String } from "polkadot-api";
 import { describe, expect, test } from "vitest";
 import {
+    DOTNS_POP_CONTROLLER_ABI,
     DOTNS_POP_RULES_ABI,
     DOTNS_PROTOCOL_REGISTRY_ABI,
     DOTNS_REGISTRAR_CONTROLLER_ABI,
@@ -21,9 +22,11 @@ import {
     DOTNS_RESOLVER_ABI,
     DOTNS_RESOLVER_WRITE_ABI,
     DOTNS_REVERSE_RESOLVER_ABI,
+    DOTNS_ROOT_GATEWAY_DISPATCHER_ABI,
     DOTNS_ADDRESSES,
     POP_STATUS,
 } from "./dotns-abis.js";
+import { DOTNS_REGISTRY_KEYS, type DotNsGatewayQueryApi } from "./dotns-addresses.js";
 import { DotNsError } from "./dotns-errors.js";
 import {
     isDotNsAvailable,
@@ -854,7 +857,7 @@ describe("resolveTld", () => {
 
     test("an absent getter falls back to .dot, because that TLD was compiled in", async () => {
         // Pre-b4096968 deployments had no tld() and no way to be anything but
-        // `.dot`. Verified against Paseo Asset Hub Previewnet.
+        // `.dot`. No live deployment is known to still be one.
         const runtime = registryRuntime({ tld: NO_GETTER, tldNode: NO_GETTER });
         expect(await resolveTld({ runtime })).toEqual({ ok: true, value: DOT_TLD });
     });
@@ -1052,8 +1055,8 @@ describe("the deployment's TLD reaches every entry point", () => {
     });
 
     test("a legacy deployment with no tld() getter still resolves .dot names", async () => {
-        // Paseo Asset Hub Previewnet: both getters revert empty, and `dim2` is
-        // owned there under the `.dot` root. The fix must not break it.
+        // Guards the pre-b4096968 shape, which Previewnet was thought to have
+        // until it reported `.test`. Kept: nothing proves the shape is extinct.
         const runtime = createFakeContractRuntime({
             abi: [...ALL_ABIS, ...DOTNS_PROTOCOL_REGISTRY_ABI],
             onQuery: ({ functionName }) => {
@@ -1152,3 +1155,155 @@ describe("the resolver pointer is an allowlist, not a denylist", () => {
         expect(r).toEqual({ ok: true, value: { address: TARGET, name: "dim2.dot", owner: OWNER } });
     });
 });
+
+describe("the discovered addresses reach every entry point", () => {
+    // The wiring these tests exist for: a client asking for discovery must not
+    // then read the TLD, or any name, from the pinned table. Reading one from
+    // each source is the same mismatch the issue is about, one layer down.
+    const DISPATCHER = `0x${"b1".repeat(20)}`;
+    const POP_CONTROLLER = `0x${"b2".repeat(20)}`;
+    const D_REGISTRY = `0x${"a1".repeat(20)}`;
+    const D_RESOLVER = `0x${"a3".repeat(20)}`;
+    const D_CONTROLLER = `0x${"a4".repeat(20)}`;
+    const D_POP_RULES = `0x${"a5".repeat(20)}`;
+    const D_PROTOCOL_REGISTRY = `0x${"a6".repeat(20)}`;
+    const D_REVERSE = `0x${"a2".repeat(20)}`;
+
+    const DISCOVERED: Record<string, string> = {
+        [DOTNS_REGISTRY_KEYS.registry]: D_REGISTRY,
+        [DOTNS_REGISTRY_KEYS.reverseResolver]: D_REVERSE,
+        [DOTNS_REGISTRY_KEYS.resolver]: D_RESOLVER,
+        [DOTNS_REGISTRY_KEYS.registrarController]: D_CONTROLLER,
+        [DOTNS_REGISTRY_KEYS.popRules]: D_POP_RULES,
+    };
+
+    const gatewayApi = {
+        query: { DotnsGateway: { DispatcherAddress: { getValue: async () => DISPATCHER } } },
+    } as DotNsGatewayQueryApi;
+
+    /**
+     * A chain where the discovered contracts answer and the pinned ones stay
+     * silent, so anything still calling a pinned address reads `undefined`.
+     */
+    function discoveringRuntime(answers: Record<string, unknown> = {}) {
+        return createFakeContractRuntime({
+            abi: [
+                ...ALL_ABIS,
+                ...DOTNS_PROTOCOL_REGISTRY_ABI,
+                ...DOTNS_ROOT_GATEWAY_DISPATCHER_ABI,
+                ...DOTNS_POP_CONTROLLER_ABI,
+            ],
+            onQuery: ({ dest, functionName, args }) => {
+                const at = dest.toLowerCase();
+                if (functionName === "TARGET") return POP_CONTROLLER;
+                if (functionName === "protocolRegistry") return D_PROTOCOL_REGISTRY;
+                if (functionName === "get") return DISCOVERED[String(args?.[0])] ?? ZERO;
+                if (at !== D_PROTOCOL_REGISTRY.toLowerCase() && functionName === "tld") {
+                    return undefined; // only the discovered registry knows the TLD
+                }
+                if (functionName === "tld" || functionName === "tldNode") {
+                    return functionName === "tld" ? ".paseo" : dotNsTld(".paseo").node;
+                }
+                if (functionName && functionName in answers) return answers[functionName];
+                return undefined;
+            },
+        });
+    }
+
+    const destsFor = (runtime: ReturnType<typeof discoveringRuntime>, fn: string) =>
+        runtime.calls.filter((c) => c.functionName === fn).map((c) => c.dest.toLowerCase());
+
+    test("resolveTld reads the TLD from the discovered protocol registry", async () => {
+        const runtime = discoveringRuntime();
+        const r = await resolveTld({ runtime, gatewayApi, addressSource: "discovered" });
+        expect(r).toEqual({ ok: true, value: dotNsTld(".paseo") });
+        expect(destsFor(runtime, "tld")).toEqual([D_PROTOCOL_REGISTRY.toLowerCase()]);
+        expect(destsFor(runtime, "tld")).not.toContain(
+            DOTNS_ADDRESSES.protocolRegistry.toLowerCase(),
+        );
+    });
+
+    test("resolveDotNs reads the discovered registry", async () => {
+        const runtime = discoveringRuntime({ owner: OWNER, resolver: ZERO });
+        const r = await resolveDotNs("dim2.paseo", {
+            runtime,
+            gatewayApi,
+            addressSource: "discovered",
+        });
+        expect(r).toEqual({ ok: true, value: { name: "dim2.paseo", owner: OWNER } });
+        expect(destsFor(runtime, "owner")).toEqual([D_REGISTRY.toLowerCase()]);
+    });
+
+    test("resolveDotNs asks the discovered forward resolver", async () => {
+        const runtime = discoveringRuntime({
+            owner: OWNER,
+            resolver: D_RESOLVER,
+            addressOf: TARGET,
+        });
+        const r = await resolveDotNs("dim2.paseo", {
+            runtime,
+            gatewayApi,
+            addressSource: "discovered",
+        });
+        expect(r).toEqual({
+            ok: true,
+            value: { address: TARGET, name: "dim2.paseo", owner: OWNER },
+        });
+        expect(destsFor(runtime, "addressOf")).toEqual([D_RESOLVER.toLowerCase()]);
+    });
+
+    test("reverseDotNs reads the discovered reverse resolver", async () => {
+        const runtime = discoveringRuntime({ nameOf: "dim2.paseo" });
+        const r = await reverseDotNs(OWNER, { runtime, gatewayApi, addressSource: "discovered" });
+        expect(r).toEqual({ ok: true, value: "dim2.paseo" });
+        expect(destsFor(runtime, "nameOf")).toEqual([D_REVERSE.toLowerCase()]);
+    });
+
+    test("isDotNsAvailable reads the discovered controller and pop rules", async () => {
+        const runtime = discoveringRuntime({ available: true, classifyName: OPEN });
+        const r = await isDotNsAvailable("dim2.paseo", {
+            runtime,
+            gatewayApi,
+            addressSource: "discovered",
+        });
+        expect(r).toEqual({ ok: true, value: true });
+        expect(destsFor(runtime, "available")).toEqual([D_CONTROLLER.toLowerCase()]);
+        expect(destsFor(runtime, "classifyName")).toEqual([D_POP_RULES.toLowerCase()]);
+    });
+
+    test("setDotNsRecord writes through the discovered registry and resolver", async () => {
+        const runtime = discoveringRuntime({ resolver: ZERO });
+        const r = await setDotNsRecord(
+            { name: "dim2.paseo", address: TARGET },
+            { runtime, gatewayApi, addressSource: "discovered", origin: SIGNER },
+        );
+        expect(r.ok).toBe(true);
+        expect(destsFor(runtime, "resolver")).toEqual([D_REGISTRY.toLowerCase()]);
+    });
+
+    test("prepareDotNsRegistration reads the discovered controller", async () => {
+        const runtime = discoveringRuntime({
+            available: true,
+            makeCommitment: `0x${"ab".repeat(32)}`,
+            priceWithoutCheck: [1n, POP_STATUS.NoStatus, POP_STATUS.PopFull, ""],
+            transferFloor: 0n,
+            minCommitmentAge: 60n,
+            maxCommitmentAge: 86400n,
+        });
+        const r = await prepareDotNsRegistration(
+            { name: "dim2.paseo", owner: OWNER },
+            { runtime, gatewayApi, addressSource: "discovered", origin: SIGNER },
+        );
+        expect(r.ok).toBe(true);
+        expect(destsFor(runtime, "available")).toEqual([D_CONTROLLER.toLowerCase()]);
+        expect(destsFor(runtime, "priceWithoutCheck")).toEqual([D_POP_RULES.toLowerCase()]);
+    });
+
+    test("the walk runs once, no matter how many entry points are called", async () => {
+        const runtime = discoveringRuntime({ owner: OWNER, resolver: ZERO, nameOf: "dim2.paseo" });
+        const opts = { runtime, gatewayApi, addressSource: "discovered" } as const;
+        await resolveDotNs("dim2.paseo", opts);
+        await reverseDotNs(OWNER, opts);
+        expect(runtime.calls.filter((c) => c.functionName === "TARGET")).toHaveLength(1);
+    });
+});