bulletin-deploy 0.18.0 → 0.18.2-rc.1

package/bin/bulletin-deploy

@@ -585,8 +585,11 @@ try {
         console.error(`Manifest publish failed: ${err?.message ?? err}`);
         process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
       }
+    } else if (!loaded && !flags.noManifest) {
+      // Only the walk-up can come back empty: an explicit --config that is
+      // missing throws out of tryLoadProductConfig rather than returning null.
+      console.log(`No product config found from ${buildDirAbs} upward; content deployed, no manifest published.`);
     }
-    // No config (or --no-manifest) → the contenthash-only deploy above is the whole job; nothing else to do.
   }
 
   if (!flags.help && !flags.version) {

package/dist/auth-config.js

@@ -9,12 +9,12 @@ import {
   getPeopleChainEndpoints,
   hasPersistedSession,
   resolveBulletinEndpoints
-} from "./chunk-6WLVGBLQ.js";
+} from "./chunk-MMKZKXSS.js";
 import "./chunk-TSPERKUS.js";
 import "./chunk-HDGD5FYX.js";
 import "./chunk-ZOC4GITL.js";
-import "./chunk-3CES4RZG.js";
-import "./chunk-3TDAKT7Y.js";
+import "./chunk-NXZHFDRN.js";
+import "./chunk-S4ZROJ5B.js";
 export {
   DOT_DAPP_ID,
   DOT_DERIVATION_INDEX,

package/dist/bug-report.js

@@ -10,10 +10,10 @@ import {
   offerBugReport,
   scrubSecrets,
   setDeployContext
-} from "./chunk-UY2DR5V4.js";
-import "./chunk-F4OW5UVA.js";
-import "./chunk-3CES4RZG.js";
-import "./chunk-3TDAKT7Y.js";
+} from "./chunk-ZP4U7C3N.js";
+import "./chunk-WFFDZKW7.js";
+import "./chunk-NXZHFDRN.js";
+import "./chunk-S4ZROJ5B.js";
 export {
   buildCliFlagsSummary,
   buildLabels,

package/dist/chain-health.js

@@ -3,9 +3,9 @@ import {
   DEFAULT_WINDOW_BLOCKS,
   MAX_SPANS_PER_SAMPLER,
   endpointHost
-} from "./chunk-LZ7HCV4C.js";
-import "./chunk-3CES4RZG.js";
-import "./chunk-3TDAKT7Y.js";
+} from "./chunk-RDJSG2D3.js";
+import "./chunk-NXZHFDRN.js";
+import "./chunk-S4ZROJ5B.js";
 export {
   ChainHealthSampler,
   DEFAULT_WINDOW_BLOCKS,

package/dist/{chunk-A7GZZQ3Q.js → chunk-6EGOJ4VS.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-5FLTDWWP.js";
 import {
   DEFAULT_MNEMONIC
-} from "./chunk-RSAEMNX4.js";
+} from "./chunk-MG7JEKB7.js";
 import {
   DOT_PRODUCT_ID
-} from "./chunk-6WLVGBLQ.js";
+} from "./chunk-MMKZKXSS.js";
 
 // src/deploy-actors.ts
 var DEFAULT_WORKER_SURI = DEFAULT_MNEMONIC;

package/dist/{chunk-6LR7OM7F.js → chunk-AAJ7QAAM.js}

@@ -1,9 +1,12 @@
+import {
+  subnameNestingLevels
+} from "./chunk-HNJWIY55.js";
 import {
   deriveProductSigner
 } from "./chunk-M5AKL3FL.js";
 import {
   preflightSssAllowance
-} from "./chunk-6BIAW73W.js";
+} from "./chunk-QSE3WU2B.js";
 import {
   statementSigningAccount
 } from "./chunk-GRPLHUYC.js";
@@ -29,18 +32,18 @@ import {
 } from "./chunk-WPC2PUCV.js";
 import {
   setDeployContext
-} from "./chunk-UY2DR5V4.js";
+} from "./chunk-ZP4U7C3N.js";
 import {
   getBestBlockNumber,
   probeChunks,
   probeFinalityGap
-} from "./chunk-WYJX7OFF.js";
+} from "./chunk-D3NJT3DW.js";
 import {
   packSection
 } from "./chunk-C2TS5MER.js";
 import {
   resolveStorageSigner
-} from "./chunk-A7GZZQ3Q.js";
+} from "./chunk-6EGOJ4VS.js";
 import {
   createSlotAccountSigner,
   requestResourceAllocation
@@ -50,12 +53,13 @@ import {
   DotNS,
   TX_TIMEOUT_MS,
   classifyRegistrability,
+  computeDomainNode,
   fetchNonce,
   formatUnregistrableReason,
   parseDomainName,
   popStatusName,
   verifyNonceAdvanced
-} from "./chunk-RSAEMNX4.js";
+} from "./chunk-MG7JEKB7.js";
 import {
   derivePoolAccounts,
   detectTestnet,
@@ -69,7 +73,7 @@ import {
   STALE_SESSION_MESSAGE,
   getPeopleChainEndpoints,
   hasPersistedSession
-} from "./chunk-6WLVGBLQ.js";
+} from "./chunk-MMKZKXSS.js";
 import {
   CLI_NAME
 } from "./chunk-TSPERKUS.js";
@@ -84,7 +88,7 @@ import {
 } from "./chunk-ZOC4GITL.js";
 import {
   ChainHealthSampler
-} from "./chunk-LZ7HCV4C.js";
+} from "./chunk-RDJSG2D3.js";
 import {
   VERSION,
   captureWarning,
@@ -98,7 +102,7 @@ import {
   truncateAddress,
   withDeploySpan,
   withSpan
-} from "./chunk-3CES4RZG.js";
+} from "./chunk-NXZHFDRN.js";
 
 // src/merkle.ts
 import * as fs2 from "fs";
@@ -2025,11 +2029,18 @@ function assertSubdomainOwnerMatchesSigner(result, signerEvmAddress, sublabel, p
   }
 }
 function formatSubdomainParentError(fullName, parentLabel, parentOwner, selfAddress, tld = DEFAULT_TLD, profile = "poprules-startingPrice") {
-  if (parentOwner !== null) {
-    const transferBullet = selfAddress ? `  - ask the ${parentOwner} account to hand the parent to this signer, run BY that account: ${CLI_NAME} transfer ${parentLabel}.${tld} --to ${selfAddress} --mnemonic <the ${parentOwner} account's key>
+  const owner = parentOwner !== null && /^0x0{40}$/i.test(parentOwner) ? null : parentOwner;
+  const parentIsNested = parentLabel.includes(".");
+  if (owner === null && parentIsNested) {
+    return `Cannot deploy ${fullName}: parent ${parentLabel}.${tld} does not exist.
+
+It is itself a subname, so it cannot be registered directly \u2014 whoever owns ${parentLabel.slice(parentLabel.indexOf(".") + 1)}.${tld} has to create it first, then hand it to this signer (${selfAddress || "this account"}).`;
+  }
+  if (owner !== null) {
+    const transferBullet = selfAddress ? `  - ask the ${owner} account to hand the parent to this signer, run BY that account: ${CLI_NAME} transfer ${parentLabel}.${tld} --to ${selfAddress} --mnemonic <the ${owner} account's key>
 ` : "";
     const ownedParentBullet = `  - deploy the subdomain under a parent this signer already owns instead.`;
-    return `Cannot deploy ${fullName}: parent ${parentLabel}.${tld} is owned by ${parentOwner}, not by this signer.
+    return `Cannot deploy ${fullName}: parent ${parentLabel}.${tld} is owned by ${owner}, not by this signer.
 
 ` + (transferBullet ? `Either:
 ${transferBullet}${ownedParentBullet}` : ownedParentBullet);
@@ -2158,6 +2169,10 @@ async function deploy(content, domainName = null, options = {}) {
   _deployRpcFailedOver = false;
   POOL_SIZE = options.poolSize ?? parseInt(process.env.BULLETIN_POOL_SIZE ?? String(DEFAULT_POOL_SIZE), 10);
   let parsed = domainName ? parseDomainName(domainName, envTld) : null;
+  if (parsed?.isSubdomain && parsed.parentLabel.includes(".")) {
+    const levels = subnameNestingLevels(1 + parsed.parentLabel.split(".").length);
+    console.log(`   NOTE: "${domainName}" parses as sublabel "${parsed.sublabel}" under parent path "${parsed.parentLabel}.${envTld}" (${levels} levels of subname nesting).`);
+  }
   let sessionCleanup;
   const hasSession = hasPersistedSession();
   const signerChoice = chooseSignerInput({
@@ -2264,6 +2279,9 @@ async function deploy(content, domainName = null, options = {}) {
       setDeployAttribute("deploy.env", envId);
       setDeployAttribute("deploy.label", parsed?.label ?? name);
       setDeployAttribute("deploy.subdomain", String(parsed?.isSubdomain ?? false));
+      if (parsed?.isSubdomain) {
+        setDeployAttribute("deploy.dotns.subname_levels", subnameNestingLevels(1 + parsed.parentLabel.split(".").length));
+      }
       if (envNetwork) setDeployAttribute("deploy.network", envNetwork);
       if (envSource) setDeployAttribute("deploy.environments_source", envSource);
       setDeployAttribute("deploy.transfer.enabled", options.transferTo ? "true" : "false");
@@ -2296,8 +2314,9 @@ async function deploy(content, domainName = null, options = {}) {
             const subResult = await preflight.checkSubdomainOwnership(parsed.sublabel, parsed.parentLabel);
             assertSubdomainOwnerMatchesSigner(subResult, preflight.evmAddress, parsed.sublabel, parsed.parentLabel, envTld);
             if (!subResult.owned) {
-              const { owned: parentOwned, owner: parentOwner } = await preflight.checkOwnership(parsed.parentLabel);
-              if (!parentOwned) {
+              const parentNode = computeDomainNode(parsed.parentLabel, envTld);
+              const { authorised: parentAuthorised, owner: parentOwner } = await preflight.checkNodeAuthorization(parentNode, preflight.evmAddress);
+              if (!parentAuthorised) {
                 throw new NonRetryableError(
                   formatSubdomainParentError(parsed.fullName, parsed.parentLabel, parentOwner ?? null, preflight.evmAddress ?? "", envTld, preflight.protocolVersion)
                 );
@@ -2554,8 +2573,9 @@ async function deploy(content, domainName = null, options = {}) {
             } else if (owner) {
               throw new Error(`Subdomain ${parsed.fullName} is owned by ${owner}, not ${dotns.evmAddress}`);
             } else {
-              const parentOwnership = await dotns.checkOwnership(parsed.parentLabel);
-              if (!parentOwnership.owned) throw new Error(`You must own ${parsed.parentLabel}.${envTld} to register subdomains under it`);
+              const parentNode = computeDomainNode(parsed.parentLabel, envTld);
+              const { authorised: parentAuthorised } = await dotns.checkNodeAuthorization(parentNode, dotns.evmAddress);
+              if (!parentAuthorised) throw new Error(`You must own (or be approved for) ${parsed.parentLabel}.${envTld} to register subdomains under it`);
               console.log(`   Status: Registering subdomain...`);
               await dotns.registerSubdomain(parsed.sublabel, parsed.parentLabel);
               registeredFresh = true;

package/dist/{chunk-WYJX7OFF.js → chunk-D3NJT3DW.js}

@@ -1,6 +1,6 @@
 import {
   captureWarning
-} from "./chunk-3CES4RZG.js";
+} from "./chunk-NXZHFDRN.js";
 
 // src/chunk-probe.ts
 import { Twox128, Blake2128Concat, decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";

package/dist/chunk-HNJWIY55.js

@@ -0,0 +1,8 @@
+// src/subname-depth.ts
+function subnameNestingLevels(labelsBeforeTld) {
+  return labelsBeforeTld - 1;
+}
+
+export {
+  subnameNestingLevels
+};

package/dist/{chunk-TIQ3TCK4.js → chunk-JBWL6PA4.js}

@@ -13,13 +13,13 @@ import {
   setBulletinEndpoints,
   storeDirectory,
   storeFile
-} from "./chunk-6LR7OM7F.js";
+} from "./chunk-AAJ7QAAM.js";
 import {
   DEFAULT_TLD,
   DotNS,
   TX_KIND_SKIPPED,
   stripTldSuffix
-} from "./chunk-RSAEMNX4.js";
+} from "./chunk-MG7JEKB7.js";
 import {
   DEFAULT_ENV_ID,
   getPopSelfServeConfig,
@@ -33,7 +33,7 @@ import {
   setDeployAttribute,
   withManifestSpan,
   withSpan
-} from "./chunk-3CES4RZG.js";
+} from "./chunk-NXZHFDRN.js";
 
 // src/manifest/publish.ts
 import * as fs2 from "fs/promises";

package/dist/{chunk-RSAEMNX4.js → chunk-MG7JEKB7.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-ZOC4GITL.js";
 import {
   ChainHealthSampler
-} from "./chunk-LZ7HCV4C.js";
+} from "./chunk-RDJSG2D3.js";
 import {
   captureWarning,
   markCodePath,
@@ -21,7 +21,7 @@ import {
   setDeploySentryTag,
   truncateAddress,
   withSpan
-} from "./chunk-3CES4RZG.js";
+} from "./chunk-NXZHFDRN.js";
 import {
   POP_CONTROLLER_PROBE_ABI,
   PROTOCOL_PROBE_LABEL,
@@ -411,7 +411,21 @@ var DOTNS_REGISTRY_ABI = [
   { inputs: [{ name: "record", type: "tuple", components: [{ name: "parentNode", type: "bytes32" }, { name: "subLabel", type: "string" }, { name: "parentLabel", type: "string" }, { name: "owner", type: "address" }] }], name: "setSubnodeOwner", outputs: [{ name: "subnode", type: "bytes32" }], stateMutability: "nonpayable", type: "function" },
   { inputs: [{ name: "node", type: "bytes32" }, { name: "newResolver", type: "address" }], name: "setResolver", outputs: [], stateMutability: "nonpayable", type: "function" },
   { inputs: [{ name: "node", type: "bytes32" }], name: "owner", outputs: [{ name: "", type: "address" }], stateMutability: "view", type: "function" },
-  { inputs: [{ name: "node", type: "bytes32" }], name: "resolver", outputs: [{ name: "", type: "address" }], stateMutability: "view", type: "function" }
+  { inputs: [{ name: "node", type: "bytes32" }], name: "resolver", outputs: [{ name: "", type: "address" }], stateMutability: "view", type: "function" },
+  // #1435-adjacent: DotnsRegistry.isAuthorised(node, account) — verified against
+  // upstream IDotnsRegistry.sol at v0.7.0. The contract's own doc comment calls
+  // this "the canonical authorisation check the registry enforces on
+  // owner-gated entry points" and "the single source of truth" _authorised/
+  // isAuthorised both delegate to: a non-zero stored subnode owner must equal
+  // account; otherwise, for a tokenised node, the registrar's ERC-721 owner,
+  // an operator-for-all delegate, or a single-token approval all qualify.
+  // Strictly wider than a raw owner()-equality test. See
+  // checkNodeAuthorization below, which prefers this and falls back to
+  // owner()-equality only when this accessor is absent (a bare revert).
+  { inputs: [{ name: "node", type: "bytes32" }, { name: "account", type: "address" }], name: "isAuthorised", outputs: [{ name: "authorisedFlag", type: "bool" }], stateMutability: "view", type: "function" }
+];
+var DOTNS_REGISTRY_SET_SUBNODE_OWNER_ABI_V07 = [
+  { inputs: [{ name: "record", type: "tuple", components: [{ name: "parentNode", type: "bytes32" }, { name: "subLabel", type: "string" }, { name: "parentLabel", type: "string" }, { name: "owner", type: "address" }, { name: "persist", type: "bool" }] }], name: "setSubnodeOwner", outputs: [{ name: "subnode", type: "bytes32" }], stateMutability: "nonpayable", type: "function" }
 ];
 var DOTNS_CONTENT_RESOLVER_ABI = [
   { inputs: [{ name: "node", type: "bytes32" }, { name: "hash", type: "bytes" }], name: "setContenthash", outputs: [], stateMutability: "nonpayable", type: "function" },
@@ -482,6 +496,9 @@ function dotnsContractName(address, contracts = CONTRACTS) {
 function stringifyDebugValue(value) {
   return JSON.stringify(value, (_key, nested) => typeof nested === "bigint" ? nested.toString() : nested);
 }
+function isBareRevertResult(revertData, revertFlags) {
+  return (revertData === void 0 || revertData.trim() === "0x") && revertFlags === 1n;
+}
 function dotnsTxDebugEnabled() {
   return process.env.BULLETIN_DEPLOY_DOTNS_DEBUG === "1" || process.env.DOTNS_DEBUG === "1";
 }
@@ -510,8 +527,7 @@ function formatContractDryRunFailure(gasEstimate, context) {
     lines.push(`  calldata: ${context.encodedData}`);
     if (context.args) lines.push(`  args: ${stringifyDebugValue(context.args)}`);
   }
-  const revertData = gasEstimate.revertData;
-  const isBareRevert = (revertData === void 0 || revertData.trim() === "0x") && gasEstimate.revertFlags === 1n;
+  const isBareRevert = isBareRevertResult(gasEstimate.revertData, gasEstimate.revertFlags);
   if (isBareRevert && BARE_REVERT_DIAGNOSTIC_FUNCTIONS.has(functionName)) {
     if (functionName === "register") {
       lines.push(
@@ -814,13 +830,11 @@ function parseDomainName(input, tld = DEFAULT_TLD) {
     const sanitized = validateDomainLabel(parts[0]);
     return { isSubdomain: false, label: sanitized, sublabel: null, parentLabel: null, fullName: `${sanitized}.${tld}` };
   }
-  if (parts.length === 2) {
-    const sanitizedSub = validateDomainLabel(parts[0]);
-    const sanitizedParent = validateDomainLabel(parts[1]);
-    const fullLabel = `${sanitizedSub}.${sanitizedParent}`;
-    return { isSubdomain: true, label: fullLabel, sublabel: sanitizedSub, parentLabel: sanitizedParent, fullName: `${fullLabel}.${tld}` };
-  }
-  throw new Error(`Invalid domain: only one level of subdomains supported (got ${parts.length} labels)`);
+  const restParts = parts.slice(1);
+  const sanitizedSub = validateDomainLabel(parts[0]);
+  const sanitizedParent = restParts.map((p) => validateDomainLabel(p)).join(".");
+  const fullLabel = `${sanitizedSub}.${sanitizedParent}`;
+  return { isSubdomain: true, label: fullLabel, sublabel: sanitizedSub, parentLabel: sanitizedParent, fullName: `${fullLabel}.${tld}` };
 }
 function parseProofOfPersonhoodStatus(status) {
   const s = (status ?? "none").toLowerCase();
@@ -1322,6 +1336,22 @@ var DotNS = class _DotNS {
   // this into a throw-if-unset without re-checking both of those.
   _protocolVersion = DEFAULT_DOTNS_PROFILE;
   _adapter = getAdapter(DEFAULT_DOTNS_PROFILE);
+  // #1435: which setSubnodeOwner tuple shape this connection's chain accepts
+  // — "legacy" (4-field, pre-v0.7) or "v07" (5-field + persist). `null` means
+  // "not yet probed"; resolveSubnodeOwnerShape resolves it lazily on the
+  // FIRST subname write per connection (register or transfer, whichever runs
+  // first) and caches the verdict here for the rest of that connection's
+  // life. Defaults to "legacy" (NOT null) for the exact same reason
+  // _protocolVersion defaults to DEFAULT_DOTNS_PROFILE above: every existing
+  // test/library caller that constructs a DotNS instance and stubs
+  // contractTransaction/submitBatchedContractCalls directly WITHOUT ever
+  // calling connect() must keep today's exact pre-#1435 4-field behaviour,
+  // with no probe attempted at all (there is no clientWrapper to probe
+  // against in that case). connect() resets this to null so a real
+  // connection always re-probes on its first subname write rather than
+  // trusting this default or a previous connection's stale verdict — see
+  // the reset next to detectProtocolVersion() below.
+  _subnodeOwnerShape = "legacy";
   _onPhoneSigningRequired = void 0;
   _confirmPhoneReady = void 0;
   /** Total phone-signature count for this DotNS session (drives the `total` field passed to confirmPhoneReady). */
@@ -1359,6 +1389,10 @@ var DotNS = class _DotNS {
     this._protocolVersion = profile;
     this._adapter = getAdapter(profile);
   }
+  /** #1435 test-only: pin the setSubnodeOwner shape cache directly ("legacy", "v07", or null to force resolveSubnodeOwnerShape to re-probe), bypassing the live dry-run probe — for unit tests that stub the probe or exercise the fallback/caching logic itself. */
+  __setSubnodeOwnerShapeForTest(shape) {
+    this._subnodeOwnerShape = shape;
+  }
   constructor() {
     this.client = null;
     this.clientWrapper = null;
@@ -1540,6 +1574,7 @@ var DotNS = class _DotNS {
       this.connected = true;
       await this.resolveAndVerifyTld(options.tld);
       await this.detectProtocolVersion();
+      this._subnodeOwnerShape = null;
       if (options.dotnsProtocol && options.dotnsProtocol !== this._protocolVersion) {
         this.connected = false;
         throw new Error(
@@ -1932,8 +1967,13 @@ var DotNS = class _DotNS {
    * v0.5.8-rc1 (pricingVersion answers on both), and classifyProtocolVersion
    * already only consults it when pricingVersionOk is true, so gating it
    * behind that result resolving first would just add a serialized
-   * round-trip for no benefit — worse once v0.6.0 is live everywhere (#1410),
-   * since that "no benefit" case becomes the common one. Resolves to `null`
+   * round-trip for no benefit — worse as v0.6.0 spreads (#1410), since that
+   * "no benefit" case becomes the common one. The discarded-probe cost does
+   * NOT self-liquidate the moment v0.6.0 ships: it persists on every
+   * environment still running an older generation (dotns-protocol.ts's
+   * profile comment owns per-generation status — this one does not restate
+   * it). Parallel regardless: one discarded read beats a serialized
+   * round-trip on every connect. Resolves to `null`
    * immediately (no RPC at all) when DOTNS_POP_CONTROLLER has no configured
    * address.
    */
@@ -2086,6 +2126,92 @@ var DotNS = class _DotNS {
     }
     throw new Error("contractTransaction: unreachable \u2014 phone-silence re-arm loop exited without resolving");
   }
+  /**
+   * #1435: resolve — once per connection — which `setSubnodeOwner` tuple
+   * shape this chain's DOTNS_REGISTRY accepts, and cache the verdict on
+   * `_subnodeOwnerShape` for the rest of this connection's life. Called by
+   * buildSetSubnodeOwnerCall on the first subname write (register or
+   * transfer, whichever runs first); every subsequent subname write in the
+   * same connection reuses the cached shape with no further chain I/O.
+   *
+   * There is no read-only capability probe for this (see
+   * DOTNS_REGISTRY_SET_SUBNODE_OWNER_ABI_V07's comment — v0.7 adds no new
+   * function/contract to probe), so this probes the WRITE itself: dry-run
+   * the v0.7 (5-field, `persist: false`) encoding against `sampleRecord`
+   * first (a dry run commits no state, so this never spends a fee or
+   * mutates the registry). Three outcomes:
+   *
+   *   - The dry run succeeds → this chain is on v0.7+; cache "v07".
+   *   - The dry run bare-reverts (empty `0x` data, flags=1 — i.e. no
+   *     function matches this selector at all) → this chain predates v0.7;
+   *     cache "legacy" and fall back to the 4-field encoding.
+   *   - The dry run reverts WITH data → the 5-field function EXISTS and
+   *     rejected the call for a real reason (bad parent, not authorised,
+   *     etc.) — that is a genuine failure of the caller's actual write, not
+   *     a shape mismatch, so it propagates immediately rather than being
+   *     swallowed into a fallback attempt. Conflating the two here would
+   *     turn a real authorization failure into a confusing shape-probe
+   *     loop, retrying the legacy shape (which will ALSO fail, just with a
+   *     less informative bare-revert-style error) instead of surfacing the
+   *     real cause.
+   *
+   * `sampleRecord` is the actual record the caller is about to write (not a
+   * throwaway probe payload) — probing with real args means a v0.7 chain
+   * that genuinely rejects this specific write (e.g. the signer doesn't own
+   * the parent) reports that real reason here, on the first (probe) dry
+   * run, rather than surfacing a second time once the real submission's own
+   * internal dry run repeats the same call.
+   */
+  async resolveSubnodeOwnerShape(sampleRecord) {
+    if (this._subnodeOwnerShape !== null) return this._subnodeOwnerShape;
+    this.ensureConnected();
+    if (!this.clientWrapper) throw new Error("resolveSubnodeOwnerShape: polkadot-api client not available");
+    const contractAddress = this._contracts.DOTNS_REGISTRY;
+    const v07Abi = DOTNS_REGISTRY_SET_SUBNODE_OWNER_ABI_V07;
+    const v07Args = [{ ...sampleRecord, persist: false }];
+    const encodedCallData = encodeFunctionData({ abi: v07Abi, functionName: "setSubnodeOwner", args: v07Args });
+    const callResult = await this.clientWrapper.performDryRunCall(this.substrateAddress, contractAddress, 0n, encodedCallData);
+    if (callResult.result.isOk) {
+      this._subnodeOwnerShape = "v07";
+      return "v07";
+    }
+    const errorData = callResult.result.value;
+    const revertData = errorData?.data;
+    const revertFlags = errorData?.flags;
+    if (!isBareRevertResult(revertData, revertFlags)) {
+      throw new Error(formatContractDryRunFailure({
+        revertData,
+        revertFlags,
+        gasConsumed: callResult.gasConsumed,
+        gasRequired: callResult.gasRequired,
+        storageDeposit: callResult.storageDeposit?.value
+      }, {
+        contractAddress,
+        functionName: "setSubnodeOwner",
+        signerSubstrateAddress: this.substrateAddress,
+        signerEvmAddress: this.evmAddress ?? void 0,
+        value: 0n,
+        encodedData: encodedCallData,
+        args: v07Args,
+        contracts: this._contracts
+      }));
+    }
+    this._subnodeOwnerShape = "legacy";
+    return "legacy";
+  }
+  /**
+   * Build the `{ abi, args }` pair a setSubnodeOwner call site should submit,
+   * after resolving (and caching) this connection's accepted tuple shape —
+   * see resolveSubnodeOwnerShape. `record` carries the 4 fields common to
+   * both shapes; the v0.7 shape appends `persist: false` (per #1435, this
+   * only gates the LabelStore write, which is restricted to protocol store
+   * writers — the ownership/resolver record itself is written either way).
+   */
+  async buildSetSubnodeOwnerCall(record) {
+    const shape = await this.resolveSubnodeOwnerShape(record);
+    if (shape === "v07") return { abi: DOTNS_REGISTRY_SET_SUBNODE_OWNER_ABI_V07, args: [{ ...record, persist: false }] };
+    return { abi: DOTNS_REGISTRY_ABI, args: [record] };
+  }
   async checkOwnership(label, ownerAddress = null) {
     this.ensureConnected();
     const checkAddress = (ownerAddress || this.evmAddress).toLowerCase();
@@ -2099,6 +2225,82 @@ var DotNS = class _DotNS {
       return { owned: false, owner: null };
     }
   }
+  /**
+   * Raw probe for DotnsRegistry.isAuthorised(node, account) — returns the
+   * decoded bool when the accessor exists, or `null` when it is absent from
+   * this registry deployment (a bare selector-not-found revert). Shares the
+   * bare-revert-vs-real-revert discrimination (isBareRevertResult) with
+   * resolveSubnodeOwnerShape's v0.7 shape probe above: a revert WITH data
+   * means the function exists and the on-chain call itself is a normal view
+   * read that should never revert for a real reason (see _isAuthorised in
+   * DotnsRegistry.sol — it only ever returns a bool), so that branch
+   * propagates as an unexpected failure rather than being folded into
+   * "absent".
+   */
+  async probeIsAuthorised(node, account) {
+    this.ensureConnected();
+    if (!this.clientWrapper) throw new Error("probeIsAuthorised: polkadot-api client not available");
+    const contractAddress = this._contracts.DOTNS_REGISTRY;
+    const isAuthorisedAbi = DOTNS_REGISTRY_ABI;
+    const isAuthorisedArgs = [node, account];
+    const encodedCallData = encodeFunctionData({ abi: isAuthorisedAbi, functionName: "isAuthorised", args: isAuthorisedArgs });
+    const callResult = await this.clientWrapper.performDryRunCall(this.substrateAddress, contractAddress, 0n, encodedCallData);
+    if (callResult.result.isOk) {
+      const rawData = callResult.result.value.data ?? "0x";
+      if (rawData.length > 2) {
+        return decodeFunctionResult({ abi: DOTNS_REGISTRY_ABI, functionName: "isAuthorised", data: rawData });
+      }
+      return null;
+    }
+    const errorData = callResult.result.value;
+    const revertData = errorData?.data;
+    const revertFlags = errorData?.flags;
+    if (isBareRevertResult(revertData, revertFlags)) return null;
+    throw new Error(formatContractDryRunFailure({
+      revertData,
+      revertFlags,
+      gasConsumed: callResult.gasConsumed,
+      gasRequired: callResult.gasRequired,
+      storageDeposit: callResult.storageDeposit?.value
+    }, {
+      contractAddress,
+      functionName: "isAuthorised",
+      signerSubstrateAddress: this.substrateAddress,
+      signerEvmAddress: this.evmAddress ?? void 0,
+      value: 0n,
+      encodedData: encodedCallData,
+      args: [node, account],
+      contracts: this._contracts
+    }));
+  }
+  /**
+   * Ask the registry who may write `node`, per DotnsRegistry.isAuthorised —
+   * the contract's own "single source of truth" for owner-gated entry
+   * points (setSubnodeOwner, setSubnodeResolver, setResolver): a non-zero
+   * stored subnode owner must equal `account`; otherwise, for a tokenised
+   * node, the registrar's ERC-721 owner, an operator-for-all delegate, or a
+   * single-token approval all qualify. Strictly wider than a raw
+   * owner()-equality test, which refuses an approved/operator delegate the
+   * chain would accept — the contract's own comment calls operator-for-all
+   * "the common marketplace / escrow delegation path".
+   *
+   * Falls back to owner()-equality when isAuthorised is absent from this
+   * registry deployment (a bare revert on the probe) so a missing accessor
+   * never turns into a refusal. `owner` is always the node's registry-read
+   * owner (for informative messaging), independent of which path decided
+   * `authorised`.
+   */
+  async checkNodeAuthorization(node, account) {
+    this.ensureConnected();
+    const owner = await withTimeout(
+      this.contractCallNullable(this._contracts.DOTNS_REGISTRY, DOTNS_REGISTRY_ABI, "owner", [node]),
+      3e4,
+      "owner"
+    );
+    const authorised = await this.probeIsAuthorised(node, account);
+    if (authorised !== null) return { authorised, owner };
+    return { authorised: owner !== null && owner.toLowerCase() === account.toLowerCase(), owner };
+  }
   /** Live transfer-fee quote. transferFloor is a pure PopRules view — it
    *  classifies the label and reads both tiers, so it works BEFORE the name is
    *  registered (unlike quoteTransferFee, which reverts on an unregistered token). */
@@ -2149,9 +2351,12 @@ var DotNS = class _DotNS {
    *  transferName/transferFrom — the registrar has no token for them. Instead
    *  the *parent-domain* owner reassigns a subname via the registry's
    *  setSubnodeOwner (the same call registerSubdomain uses to create it).
-   *  Authorisation is on parent ownership, not on the subname's current owner,
-   *  so the connected signer must own `${parentLabel}.${this._tld}`. Idempotent:
-   *  a no-op when the recipient already owns it.
+   *  Authorisation is on the parent node, not on the subname's current owner —
+   *  checked via the registry's own isAuthorised(parentNode, account)
+   *  (checkNodeAuthorization), so the connected signer may be the parent's
+   *  owner OR an operator-for-all/single-token approval on it, matching what
+   *  the chain itself allows on setSubnodeOwner. Idempotent: a no-op when the
+   *  recipient already owns it.
    *
    *  Every node here is derived via computeSubnodeIds, which routes through the
    *  single ensNode() primitive (#1304, see the comment above ensNode) — the
@@ -2167,17 +2372,13 @@ var DotNS = class _DotNS {
     const fullName = `${sublabel}.${parentLabel}.${this._tld}`;
     assertNotZeroRecipient(toH160, fullName);
     const { parentNode, subnode } = computeSubnodeIds(sublabel, parentLabel, this._tld);
-    const parentOwner = await withTimeout(
-      this.contractCallNullable(this._contracts.DOTNS_REGISTRY, DOTNS_REGISTRY_ABI, "owner", [parentNode]),
-      3e4,
-      "owner"
-    );
+    const { authorised: parentAuthorised, owner: parentOwner } = await this.checkNodeAuthorization(parentNode, this.evmAddress);
     if (!parentOwner || parentOwner === zeroAddress) {
       throw new Error(`Cannot transfer ${fullName}: parent ${parentLabel}.${this._tld} is not registered.`);
     }
-    if (parentOwner.toLowerCase() !== this.evmAddress.toLowerCase()) {
+    if (!parentAuthorised) {
       throw new Error(
-        `Cannot transfer ${fullName}: it is a subname, which only the owner of the parent ${parentLabel}.${this._tld} can reassign (subnames are not transferable tokens). Parent is owned by ${parentOwner}, but the signer is ${this.evmAddress}. Sign as the parent owner (e.g. pass its --mnemonic).`
+        `Cannot transfer ${fullName}: it is a subname, which only the owner of the parent ${parentLabel}.${this._tld} (or an account it has approved) can reassign (subnames are not transferable tokens). Parent is owned by ${parentOwner}, but the signer is ${this.evmAddress} and is not approved. Sign as the parent owner, or as an approved account (e.g. pass its --mnemonic).`
       );
     }
     const current = await withTimeout(
@@ -2190,12 +2391,13 @@ var DotNS = class _DotNS {
       return { status: "skipped-already-owned" };
     }
     const subnodeRecord = { parentNode, subLabel: sublabel, parentLabel, owner: toH160 };
+    const { abi: setSubnodeOwnerAbi, args: setSubnodeOwnerArgs } = await this.buildSetSubnodeOwnerCall(subnodeRecord);
     const txRes = await this.contractTransaction(
       this._contracts.DOTNS_REGISTRY,
       0n,
-      DOTNS_REGISTRY_ABI,
+      setSubnodeOwnerAbi,
       "setSubnodeOwner",
-      [subnodeRecord],
+      setSubnodeOwnerArgs,
       statusCallback
     );
     const after = await withTimeout(
@@ -2274,9 +2476,10 @@ var DotNS = class _DotNS {
           await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
         }
       };
+      const { abi: setSubnodeOwnerAbi, args: setSubnodeOwnerArgs } = await this.buildSetSubnodeOwnerCall(subnodeRecord);
       const txResolution = await this.submitBatchedContractCalls(
         [
-          { contractAddress: this._contracts.DOTNS_REGISTRY, abi: DOTNS_REGISTRY_ABI, functionName: "setSubnodeOwner", args: [subnodeRecord] },
+          { contractAddress: this._contracts.DOTNS_REGISTRY, abi: setSubnodeOwnerAbi, functionName: "setSubnodeOwner", args: setSubnodeOwnerArgs },
           { contractAddress: this._contracts.DOTNS_REGISTRY, abi: DOTNS_REGISTRY_ABI, functionName: "setResolver", args: [subnodeNode, this._contracts.DOTNS_CONTENT_RESOLVER] }
         ],
         (s) => console.log(`      ${s}`),

package/dist/{chunk-6WLVGBLQ.js → chunk-MMKZKXSS.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-HDGD5FYX.js";
 import {
   VERSION
-} from "./chunk-3CES4RZG.js";
+} from "./chunk-NXZHFDRN.js";
 
 // src/auth-config.ts
 import { existsSync, readdirSync } from "fs";

package/dist/{chunk-3CES4RZG.js → chunk-NXZHFDRN.js}

@@ -1,7 +1,7 @@
 import {
   package_default,
   writeRunState
-} from "./chunk-3TDAKT7Y.js";
+} from "./chunk-S4ZROJ5B.js";
 
 // src/memory-report.ts
 import * as fs2 from "fs";