bulletin-deploy 0.11.0 → 0.12.0-rc.1

package/bin/bulletin-bootstrap

@@ -4,7 +4,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE } from "../dist/deploy.js";
-import { bootstrapPool } from "../dist/pool.js";
+import { bootstrapPool, BULLETIN_BLOCKS_PER_DAY, isAutoReauthorizeAllowed } from "../dist/pool.js";
 import { VERSION } from "../dist/telemetry.js";
 
 const args = process.argv.slice(2);
@@ -16,6 +16,7 @@ for (let i = 0; i < args.length; i++) {
   else if (args[i] === "--authorizer") { flags.authorizer = args[++i]; }
   else if (args[i] === "--rpc") { flags.rpc = args[++i]; }
   else if (args[i] === "--env") { flags.env = args[++i]; }
+  else if (args[i] === "--pre-check") { flags.preCheck = true; }
   else if (args[i] === "--version" || args[i] === "-V") { flags.version = true; }
   else if (args[i] === "--help" || args[i] === "-h") { flags.help = true; }
   else {
@@ -52,11 +53,22 @@ Options:
   --rpc wss://...     Bulletin RPC endpoint (or set BULLETIN_RPC env var)
   --env <id>          Load environment by id from environments.json
   --pool-size N       Number of pool accounts to check/initialize (default: 10)
+  --pre-check         E2E pre-flight mode (#1059): renew any account expiring
+                      within 24h, not just already-expired ones. Requires
+                      --env, and is hard-gated to environments where
+                      environments.json has network != "mainnet" and
+                      bulletinAutoAuthorize: true — refuses to write
+                      otherwise, even with --authorizer supplied.
   --version           Show version
   --help              Show this help`);
   process.exit(0);
 }
 
+if (flags.preCheck && !flags.env) {
+  console.error("Error: --pre-check requires --env <id>");
+  process.exit(1);
+}
+
 let rpc = flags.rpc ?? process.env.BULLETIN_RPC ?? DEFAULT_BULLETIN_RPC;
 const poolSize = flags.poolSize ?? parseInt(process.env.BULLETIN_POOL_SIZE ?? String(DEFAULT_POOL_SIZE), 10);
 const mnemonic = flags.mnemonic ?? process.env.BULLETIN_POOL_MNEMONIC ?? process.env.MNEMONIC;
@@ -94,6 +106,16 @@ if (flags.env) {
   }
 
   bootstrapOpts.bulletinAuthorizeV2 = envEntry.bulletinAuthorizeV2 ?? false;
+
+  if (flags.preCheck) {
+    // #1059: widen the "needs authorization" threshold to 24h-before-expiry,
+    // and hard-gate the actual write to environments cleared for it. This is
+    // a config-driven (environments.json) gate, not a CLI flag override —
+    // --pre-check can never itself grant write access on an env that isn't
+    // eligible.
+    bootstrapOpts.reauthBufferBlocks = BULLETIN_BLOCKS_PER_DAY;
+    bootstrapOpts.allowAutoReauthorize = isAutoReauthorizeAllowed(envEntry);
+  }
 }
 
 await bootstrapPool(rpc, poolSize, mnemonic, bootstrapOpts);

package/dist/auth-config.js

@@ -9,10 +9,10 @@ import {
   getPeopleChainEndpoints,
   hasPersistedSession,
   resolveBulletinEndpoints
-} from "./chunk-D4C2PBRO.js";
+} from "./chunk-LBBCHLXD.js";
 import "./chunk-TSPERKUS.js";
-import "./chunk-EAB5STKF.js";
-import "./chunk-6C75PEHQ.js";
+import "./chunk-7SN7TQC2.js";
+import "./chunk-ZAGFZ73G.js";
 import "./chunk-JSYQ3JQS.js";
 import "./chunk-ZOC4GITL.js";
 export {

package/dist/bug-report.js

@@ -10,10 +10,10 @@ import {
   offerBugReport,
   scrubSecrets,
   setDeployContext
-} from "./chunk-BN4PKWRZ.js";
-import "./chunk-MBZFAQF4.js";
-import "./chunk-EAB5STKF.js";
-import "./chunk-6C75PEHQ.js";
+} from "./chunk-IYOS2XDE.js";
+import "./chunk-A3HTUQQC.js";
+import "./chunk-7SN7TQC2.js";
+import "./chunk-ZAGFZ73G.js";
 export {
   buildCliFlagsSummary,
   buildLabels,

package/dist/{chunk-VFPXDXIV.js → chunk-2PRHTUHE.js}

@@ -7,10 +7,10 @@ import {
   resolveDotnsConnectOptions,
   storeDirectory,
   storeFile
-} from "./chunk-ABX6QCX5.js";
+} from "./chunk-QKMMEOG7.js";
 import {
   DotNS
-} from "./chunk-WFO7E5CI.js";
+} from "./chunk-PPZ3P7AJ.js";
 import {
   getPopSelfServeConfig,
   loadEnvironments,

package/dist/{chunk-4CVD6CNN.js → chunk-75PLFYYJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GRPLHUYC.js";
 import {
   DOT_DAPP_ID
-} from "./chunk-D4C2PBRO.js";
+} from "./chunk-LBBCHLXD.js";
 
 // src/sss-allowance-cache.ts
 import { mkdir, readFile, writeFile, unlink } from "fs/promises";

package/dist/{chunk-EAB5STKF.js → chunk-7SN7TQC2.js}

@@ -1,7 +1,7 @@
 import {
   package_default,
   writeRunState
-} from "./chunk-6C75PEHQ.js";
+} from "./chunk-ZAGFZ73G.js";
 
 // src/memory-report.ts
 import * as fs2 from "fs";
@@ -241,7 +241,11 @@ var DEPLOY_SEED_STORAGE = {
 };
 var DEPLOY_SEED_PROBE = {
   "deploy.probe.finality_miss_count": 0,
-  "deploy.probe.finality_miss_reupload_count": 0
+  "deploy.probe.finality_miss_reupload_count": 0,
+  // #1049: chunks present at best-block but not yet at finalised head.
+  // These are NEVER re-uploaded — only tracked so we can see finality lag
+  // without conflating it with genuinely-dropped (re-uploaded) chunks.
+  "deploy.probe.finality_lagging_count": 0
 };
 var DEPLOY_SEED_POOL = {
   "deploy.pool.eligible_count": 0,
@@ -337,6 +341,12 @@ var ERROR_KIND_RULES = [
   [/requires ProofOfPersonhood(?:Full|Lite|Light),\s*but this signer is NoStatus/i, "naming.pop_required"],
   [/requires NoStatus,\s*but this signer is ProofOfPersonhood/i, "naming.nostatus_required"],
   [/Cannot decode zero data.*with ABI parameters/i, "naming.contract_unavailable"],
+  // Issue #1060: contractCall's own empty-`0x`-data guard (src/dotns.ts, #729) throws
+  // an actionable wrapper instead of letting the raw viem message above reach a
+  // caller. Same failure family (a DotNS contract read came back empty) — classify
+  // it the same way instead of letting it fall into 'unknown'.
+  [/No contract deployed at .+ returned empty success data/i, "naming.contract_unavailable"],
+  [/Contract call returned empty data — contract=/i, "naming.contract_unavailable"],
   [/Domain\s+\S+\.dot\s+is already owned by\s+0x[a-fA-F0-9]+/i, "naming.already_owned"],
   [/Cannot deploy\s+[\w.-]+\.dot:\s*parent\s+[\w.-]+\.dot\s+is owned by/i, "naming.subdomain_orphan"],
   [/Post-deploy verification failed for .+: on-chain contenthash is /i, "verify.contenthash_mismatch"],

package/dist/{chunk-MBZFAQF4.js → chunk-A3HTUQQC.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-EAB5STKF.js";
+} from "./chunk-7SN7TQC2.js";
 
 // src/version-check.ts
 import { execSync, execFileSync } from "child_process";

package/dist/{chunk-Y3WDLLDM.js → chunk-HL5275I7.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-5FLTDWWP.js";
 import {
   DOT_PRODUCT_ID
-} from "./chunk-D4C2PBRO.js";
+} from "./chunk-LBBCHLXD.js";
 import {
   DEFAULT_MNEMONIC
-} from "./chunk-WFO7E5CI.js";
+} from "./chunk-PPZ3P7AJ.js";
 
 // src/deploy-actors.ts
 var DEFAULT_WORKER_SURI = DEFAULT_MNEMONIC;

package/dist/{chunk-BN4PKWRZ.js → chunk-IYOS2XDE.js}

@@ -2,15 +2,15 @@ import {
   classifyErrorArea,
   isInteractive,
   promptYesNo
-} from "./chunk-MBZFAQF4.js";
+} from "./chunk-A3HTUQQC.js";
 import {
   VERSION,
   getCurrentSentryTraceId,
   resolveIssueRepoSlug
-} from "./chunk-EAB5STKF.js";
+} from "./chunk-7SN7TQC2.js";
 import {
   package_default
-} from "./chunk-6C75PEHQ.js";
+} from "./chunk-ZAGFZ73G.js";
 
 // src/bug-report.ts
 import { execSync, execFileSync } from "child_process";

package/dist/{chunk-D4C2PBRO.js → chunk-LBBCHLXD.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TSPERKUS.js";
 import {
   VERSION
-} from "./chunk-EAB5STKF.js";
+} from "./chunk-7SN7TQC2.js";
 import {
   loadEnvironments
 } from "./chunk-JSYQ3JQS.js";

package/dist/{chunk-QVAZ3P7Q.js → chunk-O5TFXD3J.js}

@@ -1,6 +1,6 @@
 import {
   captureWarning
-} from "./chunk-EAB5STKF.js";
+} from "./chunk-7SN7TQC2.js";
 
 // src/chunk-probe.ts
 import { Twox128, Blake2128Concat, decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";
@@ -166,6 +166,40 @@ async function probeChunks(cids, options) {
   }
   return results;
 }
+function classifyFinalityGap(missingAtFinalized, bestBlockResults) {
+  const presentAtBest = new Set(
+    bestBlockResults.filter((r) => r.present === true).map((r) => r.cid)
+  );
+  const lagging = [];
+  const reallyMissing = [];
+  for (const cid of missingAtFinalized) {
+    if (presentAtBest.has(cid)) lagging.push(cid);
+    else reallyMissing.push(cid);
+  }
+  return { reallyMissing, lagging };
+}
+async function probeFinalityGap(missingAtFinalized, options) {
+  if (missingAtFinalized.length === 0) return { reallyMissing: [], lagging: [] };
+  let bestBlockResults = await probeChunks(missingAtFinalized, { ...options, atFinalized: false });
+  const indeterminate = bestBlockResults.filter((r) => r.present === null).map((r) => r.cid);
+  if (indeterminate.length > 0) {
+    const retry = await probeChunks(indeterminate, { ...options, atFinalized: false });
+    const retryByCid = new Map(retry.map((r) => [r.cid, r]));
+    bestBlockResults = bestBlockResults.map((r) => r.present === null ? retryByCid.get(r.cid) ?? r : r);
+  }
+  return classifyFinalityGap(missingAtFinalized, bestBlockResults);
+}
+async function getBestBlockNumber(client) {
+  try {
+    const header = await client._request("chain_getHeader", []);
+    const hex = header?.number;
+    if (typeof hex !== "string") return null;
+    const n = parseInt(hex, 16);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
 function _resetProbeSession() {
   _metadataChecked = false;
   _crossValidated = false;
@@ -180,6 +214,9 @@ export {
   ChainProbeCrossValidationError,
   _decodeStorageValue,
   probeChunks,
+  classifyFinalityGap,
+  probeFinalityGap,
+  getBestBlockNumber,
   _resetProbeSession,
   _bypassMetadataCheckForTest
 };

package/dist/{chunk-WFO7E5CI.js → chunk-PPZ3P7AJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SI2ZUOYD.js";
 import {
   isTestnetSpecName
-} from "./chunk-MRQPJLPS.js";
+} from "./chunk-XVQICFTB.js";
 import {
   captureWarning,
   markCodePath,
@@ -11,7 +11,7 @@ import {
   setDeploySentryTag,
   truncateAddress,
   withSpan
-} from "./chunk-EAB5STKF.js";
+} from "./chunk-7SN7TQC2.js";
 import {
   validateContractAddresses
 } from "./chunk-JSYQ3JQS.js";
@@ -50,6 +50,11 @@ var CODE_PATHS = {
   // true  → automated mapping via EVM key derivation
   // false → standard check (already-mapped or manually register)
   DOTNS_AUTO_MAPPING: "dotns.auto-mapping",
+  // NOTE (issue #706): marked "exempt" in tools/check-code-path-coverage.py's
+  // CODE_PATHS mirror — it's a real fallback for external DotNS library
+  // callers, but Parity-internal telemetry never sees that population, so
+  // it always reads 0 hits here regardless of real-world usage. Confirmed
+  // non-dead in PR #756 and again for #706; keep the branch and the ID.
   DOTNS_MANUAL_MAPPING: "dotns.manual-mapping"
 };
 
@@ -126,7 +131,23 @@ var TX_WALL_CLOCK_CEILING_MS = 24e4;
 var TX_NO_PROGRESS_MS = 9e4;
 var WS_HEARTBEAT_TIMEOUT_MS = 3e5;
 var DOTNS_TX_MAX_ATTEMPTS = 3;
+var WatcherSilentNoEventError = class extends Error {
+  constructor(silentMs) {
+    super(`transaction watcher silent for ${Math.floor(silentMs / 1e3)}s \u2014 no response received (did you approve on your phone?)`);
+    this.name = "WatcherSilentNoEventError";
+  }
+};
 var VERIFY_EFFECT_CHAIN_SECONDS = 60;
+var NONCE_ADVANCE_VERIFY_RETRIES = 3;
+var NONCE_ADVANCE_VERIFY_RETRY_INTERVAL_MS = 2e3;
+async function verifyEffectWithGrace(verifyEffect, { retries = NONCE_ADVANCE_VERIFY_RETRIES, intervalMs = NONCE_ADVANCE_VERIFY_RETRY_INTERVAL_MS } = {}) {
+  if (await verifyEffect()) return true;
+  for (let attempt = 0; attempt < retries; attempt++) {
+    await new Promise((r) => setTimeout(r, intervalMs));
+    if (await verifyEffect()) return true;
+  }
+  return false;
+}
 function classifyTxRetryDecision(err) {
   const msg = err instanceof Error ? err.message : String(err);
   const lower = msg.toLowerCase();
@@ -138,6 +159,12 @@ function classifyTxRetryDecision(err) {
   if (lower.includes("transaction watcher silent")) return "retry";
   return "abort";
 }
+function classifyWatcherSilentFastFail(err, isPhoneSigner) {
+  if (err instanceof WatcherSilentNoEventError && isPhoneSigner === true) {
+    return new NonRetryableError("No signature received from the phone \u2014 re-run when you can approve on your phone.");
+  }
+  return null;
+}
 var DOTNS_RETRY_BASE_MS = 400;
 var DOTNS_RETRY_MAX_MS = 6e3;
 function dotnsRetryBackoffMs(attempt, rand = Math.random) {
@@ -696,7 +723,7 @@ var ReviveClientWrapper = class _ReviveClientWrapper {
             if (nonce.advanced) {
               if (opts.verifyEffect) {
                 statusCallback("verifying");
-                const observed = await opts.verifyEffect();
+                const observed = await verifyEffectWithGrace(opts.verifyEffect);
                 if (!observed) {
                   statusCallback("failed");
                   finish(reject)(new Error(`nonce-advance fallback: nonce moved past ${opts.nonceFallback.expectedNonce} but expected on-chain effect not observable (likely a different tx of ours consumed the nonce, or our tx was reorged out)`));
@@ -724,7 +751,11 @@ var ReviveClientWrapper = class _ReviveClientWrapper {
           const silentMs = Date.now() - lastEventAt;
           if (silentMs > TX_NO_PROGRESS_MS) {
             statusCallback("failed");
-            finish(reject)(new Error(`transaction watcher silent for ${Math.floor(silentMs / 1e3)}s after ${lastEventType}`));
+            if (lastEventType === "(none)") {
+              finish(reject)(new WatcherSilentNoEventError(silentMs));
+            } else {
+              finish(reject)(new Error(`transaction watcher silent for ${Math.floor(silentMs / 1e3)}s after ${lastEventType}`));
+            }
             return;
           }
         } catch {
@@ -794,6 +825,11 @@ var ReviveClientWrapper = class _ReviveClientWrapper {
         return await this.signAndSubmitExtrinsic(buildExtrinsic(), signer, filter.callback, opts);
       } catch (e) {
         lastError = e;
+        const fastFail = classifyWatcherSilentFastFail(e, opts.isPhoneSigner);
+        if (fastFail) {
+          filter.flush();
+          throw fastFail;
+        }
         const decision = classifyTxRetryDecision(e);
         const msg = e?.message ?? String(e);
         if (!shouldRetryTxAttempt(attempt, DOTNS_TX_MAX_ATTEMPTS, decision)) {
@@ -1430,18 +1466,19 @@ var DotNS = class {
     if (rawData.length <= 2) {
       const hasCode = await this.clientWrapper.hasContractCode(contractAddress);
       const name = dotnsContractName(contractAddress, this._contracts);
+      const env = this._environmentId ?? "(unset)";
       if (hasCode === false) {
         throw new Error(
-          `No contract deployed at ${contractAddress} (${name}) \u2014 the dry-run call to ${functionName} returned empty success data, which on pallet-revive means the target address has no contract code. Check environments.json / --contract config for this network.`
+          `No contract deployed at ${contractAddress} (${name}) env=${env} \u2014 the dry-run call to ${functionName} returned empty success data, which on pallet-revive means the target address has no contract code. Check environments.json / --contract config for this network.`
         );
       }
       if (hasCode === null) {
         throw new Error(
-          `Contract call returned empty data \u2014 contract=${name} (${contractAddress}) functionName=${functionName}. Could not verify whether contract code exists at this address (runtime code-presence query failed); investigate the contract/ABI or the configured address.`
+          `Contract call returned empty data \u2014 contract=${name} (${contractAddress}) env=${env} functionName=${functionName}. Could not verify whether contract code exists at this address (runtime code-presence query failed); investigate the contract/ABI or the configured address.`
         );
       }
       throw new Error(
-        `Contract call returned empty data \u2014 contract=${name} (${contractAddress}) functionName=${functionName}. The address has contract code but the call returned no bytes, which is unexpected for this read. Investigate the contract/ABI rather than masking it with a default.`
+        `Contract call returned empty data \u2014 contract=${name} (${contractAddress}) env=${env} functionName=${functionName}. The address has contract code but the call returned no bytes, which is unexpected for this read. Investigate the contract/ABI rather than masking it with a default.`
       );
     }
     return decodeFunctionResult({ abi: contractAbi, functionName, data: rawData });
@@ -1819,7 +1856,7 @@ var DotNS = class {
     const target = this._contracts.DOTNS_CONTENT_RESOLVER;
     let current = null;
     try {
-      current = await this.contractCall(this._contracts.DOTNS_REGISTRY, DOTNS_REGISTRY_ABI, "resolver", [node]);
+      current = await this.contractCallNullable(this._contracts.DOTNS_REGISTRY, DOTNS_REGISTRY_ABI, "resolver", [node]);
     } catch {
     }
     if (typeof current === "string" && current.toLowerCase() === target.toLowerCase()) {
@@ -1833,7 +1870,7 @@ var DotNS = class {
   async getTextRecord(domainName, key) {
     this.ensureConnected();
     const node = namehash(`${domainName}.dot`);
-    const result = await this.contractCall(
+    const result = await this.contractCallNullable(
       this._contracts.DOTNS_CONTENT_RESOLVER,
       DOTNS_TEXT_RESOLVER_ABI,
       "text",
@@ -1880,7 +1917,7 @@ var DotNS = class {
       let onChainValue = "";
       let lastPrintedElapsed = -1;
       while (true) {
-        const onChain = await withTimeout(this.contractCall(this._contracts.DOTNS_CONTENT_RESOLVER, DOTNS_TEXT_RESOLVER_ABI, "text", [node, key]), 3e4, "text");
+        const onChain = await withTimeout(this.contractCallNullable(this._contracts.DOTNS_CONTENT_RESOLVER, DOTNS_TEXT_RESOLVER_ABI, "text", [node, key]), 3e4, "text");
         onChainValue = onChain ?? "";
         if (onChainValue === value) break;
         const nowChainMs = Number(await this.clientWrapper.client.query.Timestamp.Now.getValue());
@@ -1937,7 +1974,7 @@ var DotNS = class {
       const startChainMs = Number(await this.clientWrapper.client.query.Timestamp.Now.getValue());
       let lastResults = [];
       while (true) {
-        lastResults = await Promise.all(entries.map((e) => withTimeout(this.contractCall(this._contracts.DOTNS_CONTENT_RESOLVER, DOTNS_TEXT_RESOLVER_ABI, "text", [node, e.key]), 3e4, "text").then((onChain) => ({ key: e.key, expected: e.value, onChain: onChain ?? "" }))));
+        lastResults = await Promise.all(entries.map((e) => withTimeout(this.contractCallNullable(this._contracts.DOTNS_CONTENT_RESOLVER, DOTNS_TEXT_RESOLVER_ABI, "text", [node, e.key]), 3e4, "text").then((onChain) => ({ key: e.key, expected: e.value, onChain: onChain ?? "" }))));
         if (lastResults.every((v) => v.onChain === v.expected)) break;
         const nowChainMs = Number(await this.clientWrapper.client.query.Timestamp.Now.getValue());
         const chainElapsed = (nowChainMs - startChainMs) / 1e3;
@@ -2102,10 +2139,11 @@ var DotNS = class {
     this.ensureConnected();
     const node = namehash(`${domainName}.dot`);
     const result = await withTimeout(
-      this.contractCall(this._contracts.DOTNS_CONTENT_RESOLVER, DOTNS_CONTENT_RESOLVER_ABI, "contenthash", [node]),
+      this.contractCallNullable(this._contracts.DOTNS_CONTENT_RESOLVER, DOTNS_CONTENT_RESOLVER_ABI, "contenthash", [node]),
       3e4,
       "contenthash"
     );
+    if (result === null) return "0x";
     return typeof result === "string" ? result : result?.toString?.() ?? String(result);
   }
   async classifyName(label) {
@@ -2759,8 +2797,13 @@ export {
   TX_NO_PROGRESS_MS,
   WS_HEARTBEAT_TIMEOUT_MS,
   DOTNS_TX_MAX_ATTEMPTS,
+  WatcherSilentNoEventError,
   VERIFY_EFFECT_CHAIN_SECONDS,
+  NONCE_ADVANCE_VERIFY_RETRIES,
+  NONCE_ADVANCE_VERIFY_RETRY_INTERVAL_MS,
+  verifyEffectWithGrace,
   classifyTxRetryDecision,
+  classifyWatcherSilentFastFail,
   dotnsRetryBackoffMs,
   shouldRetryTxAttempt,
   shouldRegateBeforeResign,