bulletin-deploy 0.13.2-rc.1 → 0.13.2-rc.3

package/bin/bulletin-deploy

@@ -6,7 +6,7 @@
 // SDK modules that trigger the "@parity/product-sdk-logger" localStorage warning.
 import "../dist/suppress-localstorage-warning.js";
 
-import { deploy, DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE, NonRetryableError, EXIT_CODE_NO_RETRY, isConnectionError, isBenignTeardownError, unpublish } from "../dist/deploy.js";
+import { deploy, DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE, NonRetryableError, EXIT_CODE_NO_RETRY, isConnectionError, isBenignTeardownError, unpublish, resolveEffectiveMnemonic, resolveEnvId, shouldPublishManifest, validateNoManifestFlags } from "../dist/deploy.js";
 import { VERSION, setDeployAttribute, captureWarning, closeTelemetry, setRunStateActive, markRelaunchOomHintShown } from "../dist/telemetry.js";
 import { handleFailedDeploy, handlePreflightVersionCheck, fetchVersionInfo, preReleaseWarning, checkNodeVersion } from "../dist/version-check.js";
 import { setDeployContext, installLogCapture, buildCliFlagsSummary } from "../dist/bug-report.js";
@@ -56,6 +56,7 @@ for (let i = 0; i < args.length; i++) {
   else if (args[i] === "--input-car") { flags.inputCar = args[++i]; }
   else if (args[i] === "--tag") { flags.tag = args[++i]; }
   else if (args[i] === "--config") { flags.config = args[++i]; }
+  else if (args[i] === "--no-manifest" || args[i] === "--content-only") { flags.noManifest = true; }
   else if (args[i] === "--gh-pages-mirror") { flags.ghPagesMirror = true; }
   else if (args[i] === "--allow-large-deploy") { flags.allowLargeDeploy = true; }
   else if (args[i] === "--reproducible") { flags.reproducibleSource = "commit"; }
@@ -78,6 +79,34 @@ if (flags.publish && flags.unpublish) {
   process.exit(1);
 }
 
+// #1163: --no-manifest (--content-only) skips manifest publishing even when a
+// bulletin-deploy.config.* is discoverable; --publish depends on those
+// manifest records (Publisher listing → Browse), so the combination is
+// rejected up front rather than silently publishing a domain with no manifest.
+const noManifestErr = validateNoManifestFlags({ noManifest: !!flags.noManifest, publish: !!flags.publish });
+if (noManifestErr) {
+  console.error(noManifestErr);
+  process.exit(1);
+}
+
+// #1107: the mnemonic actually used to sign — --mnemonic flag > MNEMONIC env
+// var > DOTNS_MNEMONIC env var. Used everywhere deploy/publish/unpublish need
+// a signer identity (existence guards below intentionally keep checking
+// flags.mnemonic / process.env.MNEMONIC directly — only the VALUE forwarded
+// to options.mnemonic changes here).
+const effectiveMnemonic = resolveEffectiveMnemonic({
+  flagMnemonic: flags.mnemonic,
+  envMnemonic: process.env.MNEMONIC,
+  envDotnsMnemonic: process.env.DOTNS_MNEMONIC,
+});
+
+// #1165: the env id actually targeted this session — --env flag >
+// BULLETIN_DEPLOY_ENV env var. `undefined` here still means "let
+// deploy()/the DEFAULT_ENV_ID fallback below decide" — this only resolves
+// the flag/env-var precedence so a session default doesn't require
+// repeating --env on every invocation.
+const effectiveEnvId = resolveEnvId({ flagEnv: flags.env, envVar: process.env.BULLETIN_DEPLOY_ENV });
+
 // --environment-file: propagate to the env var so all internal loadEnvironments()
 // call sites (deploy.ts, manifest/publish.ts, personhood) honor the override.
 if (flags.environmentFile) {
@@ -119,10 +148,10 @@ if (flags.unpublish) {
   }
   try {
     const result = await unpublish(domain, {
-      mnemonic: flags.mnemonic,
+      mnemonic: effectiveMnemonic,
       derivationPath: flags.derivationPath,
       rpc: flags.rpc,
-      env: flags.env,
+      env: effectiveEnvId,
     });
     console.log(`Domain: ${result.domainName}`);
     console.log(`Status: ${result.status}`);
@@ -148,7 +177,7 @@ function installSsoTeardownGuards() {
 {
   const sub = positional[0];
   if (sub === "login" || sub === "logout" || sub === "whoami") {
-    const envId = flags.env ?? DEFAULT_ENV_ID;
+    const envId = effectiveEnvId ?? DEFAULT_ENV_ID;
     installSsoTeardownGuards();
     try {
       const capSub = sub.charAt(0).toUpperCase() + sub.slice(1);
@@ -167,7 +196,7 @@ function installSsoTeardownGuards() {
 // (or --to). Stand-alone handover + recovery for a deploy whose transfer step
 // failed. Uses the SSO stack to resolve the session recipient.
 if (positional[0] === "transfer") {
-  const envId = flags.env ?? DEFAULT_ENV_ID;
+  const envId = effectiveEnvId ?? DEFAULT_ENV_ID;
   installSsoTeardownGuards();
   try {
     const { runTransfer } = await import("../dist/commands/transfer.js");
@@ -237,6 +266,9 @@ Options:
   --env <id>               Target environment from environments.json (default: paseo-next-v2).
                            Drives both the bulletin RPC and the asset-hub RPC used
                            by DotNS. See --list-environments for valid ids.
+                           Precedence: --env > BULLETIN_DEPLOY_ENV env var > paseo-next-v2.
+                           Set BULLETIN_DEPLOY_ENV to pick a session default without
+                           repeating --env on every invocation.
   --environment-file <path>
                            Path to a JSON file deep-merged over the bundled
                            environments.json. Override only the fields you need
@@ -274,6 +306,11 @@ Options:
                       <build-dir> looking for bulletin-deploy.config.{ts,js,mjs}). When a
                       config is found, deploy ALSO writes the manifest + executable text
                       records on <domain> and its app/widget/worker subnames.
+  --no-manifest, --content-only
+                      Skip manifest publishing entirely, even when a
+                      bulletin-deploy.config.* is discoverable — plain content
+                      deploy (storage + root contenthash), same as having no
+                      config at all. Mutually exclusive with --publish.
   --gh-pages-mirror   After deploy, push the CAR to the current repo's gh-pages branch
                       at bulletin/<domain>.dot.car (opt-in; also set GH_PAGES_MIRROR=1)
   --publish           After deploy, list <domain> in the on-chain Publisher
@@ -445,7 +482,7 @@ try {
     rpc: effectiveRpc,
     repo: process.env.GITHUB_REPOSITORY,
     branch: process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME,
-    signerMode: flags.mnemonic ? "direct" : "pool",
+    signerMode: effectiveMnemonic ? "direct" : "pool",
     deployTag,
     cliFlags: buildCliFlagsSummary(flags),
     ci,
@@ -460,24 +497,30 @@ try {
   // + its referenced icon/executable files BEFORE any storage or chain work, so
   // config errors fail fast up front instead of after merkleize + upload. No-op
   // (returns null) for contenthash-only deploys with no config.
-  try {
-    const { preflightProductConfig } = await import("../dist/index.js");
-    // config-load resolves a relative cwd internally, so no node:path here
-    // (it's only dynamically imported later, in the publish block).
-    await preflightProductConfig(
-      flags.config ? { path: flags.config } : { cwd: buildDir, walkUp: true },
-    );
-  } catch (err) {
-    console.error(`Error: ${err?.message ?? err}`);
-    process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
+  //
+  // #1163: --no-manifest (--content-only) skips this entirely — the deploy is
+  // content-only regardless of any discoverable config, so there's nothing to
+  // preflight.
+  if (!flags.noManifest) {
+    try {
+      const { preflightProductConfig } = await import("../dist/index.js");
+      // config-load resolves a relative cwd internally, so no node:path here
+      // (it's only dynamically imported later, in the publish block).
+      await preflightProductConfig(
+        flags.config ? { path: flags.config } : { cwd: buildDir, walkUp: true },
+      );
+    } catch (err) {
+      console.error(`Error: ${err?.message ?? err}`);
+      process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
+    }
   }
 
   const result = await deploy(buildDir, domain, {
-    mnemonic: flags.mnemonic,
+    mnemonic: effectiveMnemonic,
     derivationPath: flags.derivationPath,
     suri: flags.suri,
     rpc: flags.rpc,
-    env: flags.env,
+    env: effectiveEnvId,
     poolSize: flags.poolSize,
     password: flags.password,
     contracts: flags.contracts,
@@ -542,6 +585,12 @@ try {
   // Walks up from <build-dir> (or honours --config) looking for
   // bulletin-deploy.config.{ts,js,mjs}. When found, writes the root + per-
   // executable text records, otherwise the legacy flow returns unchanged.
+  //
+  // #1163: --no-manifest (--content-only) skips manifest publishing even when
+  // a config is present. shouldPublishManifest() is the single source of
+  // truth for that decision (config discovery still runs either way, so the
+  // "config found but --no-manifest set" case is exercised for real, not just
+  // in unit tests).
   {
     const { tryLoadProductConfig, publishManifest } = await import("../dist/index.js");
     const path = await import("node:path");
@@ -549,15 +598,15 @@ try {
     const loaded = await tryLoadProductConfig(
       flags.config ? { path: flags.config } : { cwd: buildDirAbs, walkUp: true },
     );
-    if (loaded) {
+    if (shouldPublishManifest({ configFound: !!loaded, noManifest: !!flags.noManifest })) {
       try {
         await publishManifest({
           loaded,
           domain,
           buildDirCid: { absPath: buildDirAbs, cid: result.cid },
-          env: flags.env,
+          env: effectiveEnvId,
           rpc: flags.rpc,
-          mnemonic: flags.mnemonic,
+          mnemonic: effectiveMnemonic,
           derivationPath: flags.derivationPath,
         });
       } catch (err) {
@@ -565,7 +614,7 @@ try {
         process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
       }
     }
-    // No config → the contenthash-only deploy above is the whole job; nothing else to do.
+    // No config (or --no-manifest) → the contenthash-only deploy above is the whole job; nothing else to do.
   }
 
   if (!flags.help && !flags.version) {

package/dist/auth-config.js

@@ -9,10 +9,10 @@ import {
   getPeopleChainEndpoints,
   hasPersistedSession,
   resolveBulletinEndpoints
-} from "./chunk-KCZSMYLV.js";
+} from "./chunk-TNFSFFA6.js";
 import "./chunk-TSPERKUS.js";
-import "./chunk-6FP4PGF5.js";
-import "./chunk-H3D57D5J.js";
+import "./chunk-P5WPSCTS.js";
+import "./chunk-ARFQU4A6.js";
 import "./chunk-3ZEMX4WD.js";
 import "./chunk-ZOC4GITL.js";
 export {

package/dist/bug-report.js

@@ -10,10 +10,10 @@ import {
   offerBugReport,
   scrubSecrets,
   setDeployContext
-} from "./chunk-CHE5D3OO.js";
-import "./chunk-PFVSY3YT.js";
-import "./chunk-6FP4PGF5.js";
-import "./chunk-H3D57D5J.js";
+} from "./chunk-S4D4ZCQF.js";
+import "./chunk-6IQHSWSZ.js";
+import "./chunk-P5WPSCTS.js";
+import "./chunk-ARFQU4A6.js";
 export {
   buildCliFlagsSummary,
   buildLabels,

package/dist/{chunk-PFVSY3YT.js → chunk-6IQHSWSZ.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-6FP4PGF5.js";
+} from "./chunk-P5WPSCTS.js";
 
 // src/version-check.ts
 import { execSync, execFileSync } from "child_process";

package/dist/{chunk-H3D57D5J.js → chunk-ARFQU4A6.js}

@@ -6,7 +6,7 @@ import * as path from "path";
 // package.json
 var package_default = {
   name: "bulletin-deploy",
-  version: "0.13.2-rc.1",
+  version: "0.13.2-rc.3",
   private: false,
   repository: {
     type: "git",
@@ -48,14 +48,15 @@ var package_default = {
     "assets",
     "patches",
     "DEPLOYMENT.md",
-    "tools/release-retry-wrapper.mjs"
+    "tools/release-retry-wrapper.mjs",
+    "tools/verify-baked-dsn.mjs"
   ],
   scripts: {
     build: "tsup src/suppress-localstorage-warning.ts src/index.ts src/deploy.ts src/dotns.ts src/pool.ts src/telemetry.ts src/memory-report.ts src/merkle.ts src/gh-pages-mirror.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/proof-validity.ts src/personhood/reprove.ts src/personhood/bind-personal-id.ts src/personhood/claim-pgas.ts src/personhood/bind-paid-alias.ts src/personhood/bootstrap.ts src/personhood/chain-prereqs.ts src/manifest/types.ts src/manifest/schema.ts src/manifest/byte-budget.ts src/manifest/config-load.ts src/manifest/publish.ts src/auth/index.ts src/auth/vendor/index.ts src/auth/vendor/ui/index.ts src/auth-config.ts src/commands/login.ts src/commands/logout.ts src/commands/whoami.ts src/commands/transfer.ts src/storage-signer.ts src/spinner.ts src/sss-allowance.ts src/sss-allowance-cache.ts src/deploy-actors.ts --format esm --dts --clean --target node22",
     "refresh-environments": "node scripts/refresh-environments.mjs",
     postinstall: "patch-package || true",
     prepare: "npm run build",
-    test: "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/environments.test.js test/refresh-environments.test.js test/chunk-sharing-report.test.js test/product-manifest.test.js test/cache-savings-totals.test.js test/error-pattern-signature.test.js test/exit-codes.test.js test/probe-env-health.test.js test/e2e-chain-calls.test.js test/auth-config.test.js test/whoami.test.js test/login.test.js test/logout.test.js test/auth-resolve.test.js test/storage-signer.test.js test/spinner.test.js test/sss-allowance.test.js test/sss-allowance-cache.test.js test/dotns-transfer.test.js test/deploy-actors.test.js test/transfer-command.test.js test/dotns-register-fee.test.js test/deploy-label-ordering.test.js test/benign-teardown.test.js && npm run test:vendor",
+    test: "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/environments.test.js test/refresh-environments.test.js test/chunk-sharing-report.test.js test/product-manifest.test.js test/cache-savings-totals.test.js test/error-pattern-signature.test.js test/exit-codes.test.js test/probe-env-health.test.js test/e2e-chain-calls.test.js test/auth-config.test.js test/whoami.test.js test/login.test.js test/logout.test.js test/auth-resolve.test.js test/storage-signer.test.js test/spinner.test.js test/sss-allowance.test.js test/sss-allowance-cache.test.js test/dotns-transfer.test.js test/deploy-actors.test.js test/transfer-command.test.js test/dotns-register-fee.test.js test/deploy-label-ordering.test.js test/benign-teardown.test.js test/verify-baked-dsn.test.js && npm run test:vendor",
     "test:e2e": "npm run build && node --test test/e2e.test.js",
     "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",
     "test:e2e:pr": "bash scripts/e2e-pass.sh pr",

package/dist/{chunk-Z6RQSZNM.js → chunk-G3KVQUCG.js}

@@ -11,7 +11,7 @@ import {
   setDeploySentryTag,
   truncateAddress,
   withSpan
-} from "./chunk-6FP4PGF5.js";
+} from "./chunk-P5WPSCTS.js";
 import {
   validateContractAddresses
 } from "./chunk-3ZEMX4WD.js";
@@ -63,6 +63,10 @@ var TX_KIND_HASH = "hash";
 var TX_KIND_NONCE_ADVANCED = "nonce-advanced";
 var TX_KIND_BEST_BLOCK = "best-block";
 var ATTR_TX_RESOLUTION_KIND = "deploy.dotns.tx_resolution_kind";
+var TX_KIND_SKIPPED = "skipped";
+function shouldSkipTextWrite(current, target) {
+  return current === target;
+}
 var ONE_PAS = 10000000000n;
 var FEE_FLOOR_OWNED = ONE_PAS / 100n;
 var FEE_FLOOR_REGISTER = ONE_PAS / 10n;
@@ -274,6 +278,42 @@ async function verifyNonceAdvanced(endpoints, ss58Address, originalNonce) {
   }
   return { advanced: false };
 }
+var NONCE_CONTENTION_BACKOFF_BASE_MS = 250;
+var NONCE_CONTENTION_BACKOFF_MAX_MS = 2e3;
+function nonceContentionBackoffMs(attempt, rand = Math.random) {
+  const base = Math.min(NONCE_CONTENTION_BACKOFF_BASE_MS * 2 ** (attempt - 1), NONCE_CONTENTION_BACKOFF_MAX_MS);
+  const jitter = (rand() * 2 - 1) * NONCE_CONTENTION_BACKOFF_BASE_MS;
+  return Math.max(0, Math.round(base + jitter));
+}
+var DOTNS_NONCE_CONTENTION_MAX_ATTEMPTS = 5;
+function isNonceContentionAmbiguous(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return msg.startsWith("nonce-advance fallback:");
+}
+async function reacquireNonceOnContention(resubmit, nonceFallback, label, opts = {}) {
+  const fetchNonceFn = opts.fetchNonce ?? fetchNonce;
+  const sleepFn = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const backoffFn = opts.backoffMs ?? nonceContentionBackoffMs;
+  const maxAttempts = opts.maxAttempts ?? DOTNS_NONCE_CONTENTION_MAX_ATTEMPTS;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    setDeployAttribute("deploy.dotns.nonce_contention_retries", attempt);
+    const ms = backoffFn(attempt);
+    console.log(`   ${label}: nonce contention (attempt ${attempt}/${maxAttempts}) \u2014 re-acquiring nonce and resubmitting in ${ms}ms\u2026`);
+    await sleepFn(ms);
+    try {
+      nonceFallback.expectedNonce = await fetchNonceFn(nonceFallback.rpcs, nonceFallback.senderSS58);
+    } catch {
+    }
+    try {
+      return await resubmit();
+    } catch (e) {
+      if (!isNonceContentionAmbiguous(e)) throw e;
+    }
+  }
+  throw new NonRetryableError(
+    `DotNS write could not acquire a nonce slot after ${maxAttempts} attempts \u2014 the shared signer (${nonceFallback.senderSS58}) is under nonce contention; pass your own --mnemonic for an isolated nonce space.`
+  );
+}
 var ProofOfPersonhoodStatus = {
   NoStatus: 0,
   ProofOfPersonhoodLite: 1,
@@ -875,6 +915,19 @@ var ReviveClientWrapper = class _ReviveClientWrapper {
           filter.flush();
           throw fastFail;
         }
+        if (opts.nonceFallback && isNonceContentionAmbiguous(e)) {
+          try {
+            return await reacquireNonceOnContention(
+              () => this.signAndSubmitExtrinsic(buildExtrinsic(), signer, filter.callback, opts),
+              opts.nonceFallback,
+              label,
+              { fetchNonce: opts.fetchNonce, sleep: opts.sleep, backoffMs: opts.nonceContentionBackoffMs }
+            );
+          } catch (contentionErr) {
+            filter.flush();
+            throw contentionErr;
+          }
+        }
         const decision = classifyTxRetryDecision(e);
         const msg = e?.message ?? String(e);
         if (!shouldRetryTxAttempt(attempt, DOTNS_TX_MAX_ATTEMPTS, decision)) {
@@ -1982,6 +2035,16 @@ var DotNS = class {
       this.ensureConnected();
       console.log(`   Setting text[${key}]: ${value}`);
       const node = namehash(`${domainName}.dot`);
+      try {
+        const current = await this.getTextRecord(domainName, key);
+        if (shouldSkipTextWrite(current, value)) {
+          console.log(`   text[${key}] already set \u2014 skipping tx`);
+          setDeployAttribute("deploy.dotns.text_unchanged", "true");
+          return { value, txHash: TX_KIND_SKIPPED };
+        }
+      } catch (_) {
+      }
+      setDeployAttribute("deploy.dotns.text_unchanged", "false");
       const MAX_VERIFY_CHAIN_SECONDS = VERIFY_EFFECT_CHAIN_SECONDS;
       const TEXT_POLL_INTERVAL_MS = 2e3;
       const verifyEffect = async () => {
@@ -2899,6 +2962,8 @@ export {
   TX_KIND_NONCE_ADVANCED,
   TX_KIND_BEST_BLOCK,
   ATTR_TX_RESOLUTION_KIND,
+  TX_KIND_SKIPPED,
+  shouldSkipTextWrite,
   MINIMUM_REGISTER_STORAGE_DEPOSIT,
   registerDepositWei,
   bufferedWeiToNative,
@@ -2936,6 +3001,10 @@ export {
   DEFAULT_MNEMONIC,
   fetchNonce,
   verifyNonceAdvanced,
+  nonceContentionBackoffMs,
+  DOTNS_NONCE_CONTENTION_MAX_ATTEMPTS,
+  isNonceContentionAmbiguous,
+  reacquireNonceOnContention,
   ProofOfPersonhoodStatus,
   PUBLISHER_ABI,
   PublisherNotSupportedError,

package/dist/{chunk-LLNSFXHF.js → chunk-P2TGLW2B.js}

@@ -1,6 +1,6 @@
 import {
   captureWarning
-} from "./chunk-6FP4PGF5.js";
+} from "./chunk-P5WPSCTS.js";
 
 // src/chunk-probe.ts
 import { Twox128, Blake2128Concat, decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";

package/dist/{chunk-6FP4PGF5.js → chunk-P5WPSCTS.js}

@@ -1,7 +1,7 @@
 import {
   package_default,
   writeRunState
-} from "./chunk-H3D57D5J.js";
+} from "./chunk-ARFQU4A6.js";
 
 // src/memory-report.ts
 import * as fs2 from "fs";
@@ -134,7 +134,7 @@ function initTelemetry() {
   if (process.env.BULLETIN_DEPLOY_USE_AMBIENT_SENTRY === "1") {
     return;
   }
-  const dsn = process.env.SENTRY_DSN || (true ? "" : "");
+  const dsn = process.env.SENTRY_DSN || (true ? "https://e021c025d79c4c3ade2862a11f13c40b@o4511059872841728.ingest.de.sentry.io/4511093597405264" : "");
   if (!dsn) return;
   Sentry.init({
     dsn,
@@ -334,13 +334,13 @@ function computeDeployOutcome(errorCategory, isSad, sadReason) {
   return "clean";
 }
 var ERROR_KIND_RULES = [
-  [/Contract reverted|Contract execution would revert|revert(?:ed|ing)?\s*\(flags=[0-9]+\)/i, "contract-revert"],
+  [/Contract reverted|Contract execution would revert|revert(?:ed|ing)?\s*\(flags=[0-9]+\)|"type"\s*:\s*"ContractReverted"/i, "contract-revert"],
   [/timed out after \d+s waiting for block|Transaction not included after \d+s|Transaction did not settle within/i, "chain-timeout"],
   [/\bstale\b.*nonce|nonce.*\bstale\b|"type"\s*:\s*"(?:Future|Stale)"|Invalid::Future|tx rejected by pool/i, "nonce-stale"],
   [/heartbeat timeout|WS halt|Unable to connect|ChainHead disjointed|websocket.*closed|socket closed|disconnect/i, "connection"],
   [/requires ProofOfPersonhood(?:Full|Lite|Light),\s*but this signer is NoStatus/i, "naming.pop_required"],
   [/requires NoStatus,\s*but this signer is ProofOfPersonhood/i, "naming.nostatus_required"],
-  [/Cannot decode zero data.*with ABI parameters/i, "naming.contract_unavailable"],
+  [/Cannot decode zero data.*with ABI parameters/i, "dotns.abi_decode_empty"],
   // Issue #1060: contractCall's own empty-`0x`-data guard (src/dotns.ts, #729) throws
   // an actionable wrapper instead of letting the raw viem message above reach a
   // caller. Same failure family (a DotNS contract read came back empty) — classify
@@ -368,6 +368,13 @@ function classifyErrorKind(msg) {
   }
   return "unknown";
 }
+function classifyErrorForSpan(msg) {
+  return {
+    kind: classifyErrorKind(msg),
+    message: sanitizeErrorMessage(msg),
+    pattern: analyseErrorPattern(msg)
+  };
+}
 function sanitizeErrorMessage(msg) {
   return scrubPaths(msg.slice(0, 500));
 }
@@ -398,10 +405,11 @@ async function withSpan(op, description, attributes, fn) {
       return await fn();
     } catch (error) {
       const msg = error.message ?? String(error);
+      const { kind, message, pattern } = classifyErrorForSpan(msg);
       span.setAttribute("error.message", msg);
-      span.setAttribute("deploy.error_kind", classifyErrorKind(msg));
-      span.setAttribute("deploy.error_message", sanitizeErrorMessage(msg));
-      span.setAttribute("deploy.error_pattern_signature", analyseErrorPattern(msg));
+      span.setAttribute("deploy.error_kind", kind);
+      span.setAttribute("deploy.error_message", message);
+      span.setAttribute("deploy.error_pattern_signature", pattern);
       span.setStatus({ code: 2, message: "internal_error" });
       throw error;
     }
@@ -496,12 +504,9 @@ async function withDeploySpan(domain, fn) {
       } catch (error) {
         const msg = error.message ?? String(error);
         span.setAttribute("deploy.status", "error");
-        span.setAttribute("deploy.error", msg.slice(0, 500));
+        setDeployErrorOnSpan(span, msg);
         const errorCategory = classifyDeployError(msg);
         span.setAttribute("deploy.error_category", errorCategory);
-        span.setAttribute("deploy.error_kind", classifyErrorKind(msg));
-        span.setAttribute("deploy.error_message", sanitizeErrorMessage(msg));
-        span.setAttribute("deploy.error_pattern_signature", analyseErrorPattern(msg));
         currentErrorCategory = errorCategory;
         const isExpected = isExpectedError(msg);
         span.setAttribute("deploy.expected", isExpected ? "true" : "false");
@@ -578,6 +583,17 @@ function setDeployAttribute(key, value) {
   if (!deployRootSpan) return;
   deployRootSpan.setAttribute(key, value);
 }
+function setDeployErrorOnSpan(span, msg) {
+  const { kind, message, pattern } = classifyErrorForSpan(msg);
+  span.setAttribute("deploy.error", msg.slice(0, 500));
+  span.setAttribute("deploy.error_kind", kind);
+  span.setAttribute("deploy.error_message", message);
+  span.setAttribute("deploy.error_pattern_signature", pattern);
+}
+function setDeployError(msg) {
+  if (!deployRootSpan) return;
+  setDeployErrorOnSpan(deployRootSpan, msg);
+}
 function __setDeployRootSpanForTest(span) {
   deployRootSpan = span;
 }
@@ -774,6 +790,7 @@ export {
   withDeploySpan,
   setDeployReportContext,
   setDeployAttribute,
+  setDeployError,
   __setDeployRootSpanForTest,
   __setSentryForTest,
   getCurrentSentryTraceId,

package/dist/{chunk-FH7SSPPT.js → chunk-PWMX6QIS.js}

@@ -4,14 +4,17 @@ import {
 import {
   BLAKE2B_256_MULTIHASH_CODE,
   encodeContenthash,
+  resolveBulletinEndpoints,
   resolveDotnsConnectOptions,
+  setBulletinEndpoints,
   storeDirectory,
   storeFile
-} from "./chunk-HMJN4XJD.js";
+} from "./chunk-SJEB4RKY.js";
 import {
   DotNS
-} from "./chunk-Z6RQSZNM.js";
+} from "./chunk-G3KVQUCG.js";
 import {
+  DEFAULT_ENV_ID,
   getPopSelfServeConfig,
   loadEnvironments,
   resolveEndpoints
@@ -38,6 +41,11 @@ async function publishManifest(opts) {
     );
   }
   const configDir = path.dirname(sourcePath);
+  const envId = opts.env ?? DEFAULT_ENV_ID;
+  const { doc } = await loadEnvironments();
+  const resolved = resolveEndpoints(doc, envId);
+  const popSelfServe = getPopSelfServeConfig(doc, envId);
+  setBulletinEndpoints(resolveBulletinEndpoints(resolved.bulletin, opts.rpc));
   const iconAbs = path.resolve(configDir, config.icon.path);
   const iconBytes = await readFileOrThrow(iconAbs, "icon");
   console.log(`
@@ -59,7 +67,7 @@ Manifest publish \u2014 ${config.domain}`);
     console.log(`  Executable [${exec.kind}] CID: ${storageCid}`);
     executableCids[exec.kind] = storageCid;
   }
-  const dotns = await connectDotNS(opts);
+  const dotns = await connectDotNS(opts, resolved, popSelfServe, envId);
   try {
     const baseLabel = stripDotSuffix(config.domain);
     await dotns.ensureContentResolver(baseLabel);
@@ -104,11 +112,7 @@ async function readFileOrThrow(p, label) {
     throw new NonRetryableError(`Cannot read ${label} at ${p}: ${err.message}`);
   }
 }
-async function connectDotNS(opts) {
-  const envId = opts.env ?? "paseo-next-v2";
-  const { doc } = await loadEnvironments();
-  const resolved = resolveEndpoints(doc, envId);
-  const popSelfServe = getPopSelfServeConfig(doc, envId);
+async function connectDotNS(opts, resolved, popSelfServe, envId) {
   const deployOptsShim = {
     mnemonic: opts.mnemonic,
     derivationPath: opts.derivationPath

package/dist/{chunk-CHE5D3OO.js → chunk-S4D4ZCQF.js}

@@ -2,15 +2,15 @@ import {
   classifyErrorArea,
   isInteractive,
   promptYesNo
-} from "./chunk-PFVSY3YT.js";
+} from "./chunk-6IQHSWSZ.js";
 import {
   VERSION,
   getCurrentSentryTraceId,
   resolveIssueRepoSlug
-} from "./chunk-6FP4PGF5.js";
+} from "./chunk-P5WPSCTS.js";
 import {
   package_default
-} from "./chunk-H3D57D5J.js";
+} from "./chunk-ARFQU4A6.js";
 
 // src/bug-report.ts
 import { execSync, execFileSync } from "child_process";

package/dist/{chunk-NNRJLXFB.js → chunk-SBXZ4GDM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GRPLHUYC.js";
 import {
   DOT_DAPP_ID
-} from "./chunk-KCZSMYLV.js";
+} from "./chunk-TNFSFFA6.js";
 
 // src/sss-allowance-cache.ts
 import { mkdir, readFile, writeFile, unlink } from "fs/promises";