bulletin-deploy 0.19.3 → 0.19.4

package/dist/{chunk-6MSHWNJT.js → chunk-D6BE3RAU.js}

@@ -1,53 +1,54 @@
+import {
+  preflightSssAllowance
+} from "./chunk-6J4WRFRL.js";
+import {
+  statementSigningAccount
+} from "./chunk-GRPLHUYC.js";
 import {
   subnameNestingLevels
 } from "./chunk-HNJWIY55.js";
 import {
   deriveProductSigner
 } from "./chunk-M5AKL3FL.js";
-import {
-  preflightSssAllowance
-} from "./chunk-6FQJLLEF.js";
-import {
-  statementSigningAccount
-} from "./chunk-GRPLHUYC.js";
 import {
   computeStats,
   renderSummary,
   telemetryAttributes
-} from "./chunk-IW3X2MJF.js";
+} from "./chunk-D3YME2EG.js";
 import {
   finaliseEmbeddedManifest,
   writeEmbeddedManifestPlaceholder
-} from "./chunk-LPTKBQII.js";
+} from "./chunk-7DDOVCV5.js";
 import {
   extractManifestFromCar,
   fetchPreviousManifest,
   writePersistentLocalManifest
-} from "./chunk-3MAIF2SF.js";
+} from "./chunk-F24S4EV5.js";
 import {
+  CONTENT_HASH_RE,
   MANIFEST_PATH,
   MANIFEST_VERSION,
   classifyFile,
   parseManifest
-} from "./chunk-WPC2PUCV.js";
+} from "./chunk-H44LXDQJ.js";
 import {
   setDeployContext
-} from "./chunk-QU5GJF6U.js";
+} from "./chunk-UFP2XWZ4.js";
 import {
   getBestBlockNumber,
   probeChunks,
   probeFinalityGap
-} from "./chunk-PSYA6E5M.js";
+} from "./chunk-2P4EZOFF.js";
 import {
   packSection
 } from "./chunk-C2TS5MER.js";
 import {
   resolveStorageSigner
-} from "./chunk-3ACNAWUD.js";
+} from "./chunk-JTH3ISLR.js";
 import {
   createSlotAccountSigner,
   requestResourceAllocation
-} from "./chunk-5FLTDWWP.js";
+} from "./chunk-H44NO63C.js";
 import {
   DEFAULT_TLD,
   DotNS,
@@ -59,7 +60,11 @@ import {
   parseDomainName,
   popStatusName,
   verifyNonceAdvanced
-} from "./chunk-RJDHC56V.js";
+} from "./chunk-ZZIOS4RG.js";
+import {
+  mnemonicConflictNotice,
+  resolveEffectiveMnemonic
+} from "./chunk-ZG3HAH5A.js";
 import {
   derivePoolAccounts,
   detectTestnet,
@@ -74,7 +79,7 @@ import {
   STALE_SESSION_MESSAGE,
   getPeopleChainEndpoints,
   hasPersistedSession
-} from "./chunk-ABMNC34K.js";
+} from "./chunk-U2QO5G35.js";
 import {
   CLI_NAME
 } from "./chunk-TSPERKUS.js";
@@ -84,13 +89,10 @@ import {
   getPopSelfServeConfig,
   loadEnvironments,
   resolveEndpoints
-} from "./chunk-NA3SXVY6.js";
-import {
-  NonRetryableError
-} from "./chunk-ZOC4GITL.js";
+} from "./chunk-3NR3T7US.js";
 import {
   ChainHealthSampler
-} from "./chunk-VBIFKNUS.js";
+} from "./chunk-CCIBF55X.js";
 import {
   VERSION,
   captureWarning,
@@ -104,7 +106,10 @@ import {
   truncateAddress,
   withDeploySpan,
   withSpan
-} from "./chunk-IP6ABIIC.js";
+} from "./chunk-BFK5UCUJ.js";
+import {
+  NonRetryableError
+} from "./chunk-SH2LG52Z.js";
 
 // src/merkle.ts
 import * as fs2 from "fs";
@@ -664,12 +669,17 @@ async function getSignerProvider(signer, ss58) {
 }
 function __selectStorageProviderModeForTest(options) {
   if (options.storageSigner && options.storageSignerAddress) return "storageSigner";
-  if (options.signer && options.signerAddress) return "signer";
+  if (options.signer && options.signerAddress && !options.sessionSigner) return "signer";
   if (options.mnemonic) return "direct";
   return "pool";
 }
-function resolveEffectiveMnemonic(opts) {
-  return opts.flagMnemonic ?? opts.envMnemonic ?? opts.envDotnsMnemonic;
+function deployActorsToSignerOptions(actors) {
+  return {
+    signer: actors.worker.signer,
+    signerAddress: actors.worker.address,
+    ...actors.recipientH160 ? { transferTo: actors.recipientH160 } : {},
+    sessionSigner: actors.worker.source === "session"
+  };
 }
 function resolveEnvId(opts) {
   return opts.flagEnv ?? opts.envVar;
@@ -724,7 +734,8 @@ function assertPoolFallbackAllowed(network, reason) {
   );
 }
 function selectStorageReconnect(options) {
-  if (options.storageSigner && options.storageSignerAddress) {
+  const mode = __selectStorageProviderModeForTest(options);
+  if (mode === "storageSigner") {
     let useSlot = true;
     return async () => {
       if (!useSlot) return getProvider();
@@ -745,9 +756,9 @@ function selectStorageReconnect(options) {
       }
     };
   }
-  if (options.signer && options.signerAddress)
+  if (mode === "signer")
     return () => getSignerProvider(options.signer, options.signerAddress);
-  if (options.mnemonic)
+  if (mode === "direct")
     return () => getDirectProvider(options.mnemonic, options.derivationPath);
   return () => getProvider();
 }
@@ -1517,7 +1528,7 @@ async function readPreviousContenthashSafe(dotns, domainName) {
     return null;
   }
 }
-function buildFilesMap(buildDir, fileCids = /* @__PURE__ */ new Map()) {
+function buildFilesMap(buildDir, fileCids = /* @__PURE__ */ new Map(), framework = null) {
   const map = {};
   function walk(dir, prefix = "") {
     const entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -1534,7 +1545,7 @@ function buildFilesMap(buildDir, fileCids = /* @__PURE__ */ new Map()) {
           size = fs.statSync(abs).size;
         } catch {
         }
-        const type = classifyFile(rel, { fileCid: fileCid || void 0 });
+        const type = classifyFile(rel, { fileCid: fileCid || void 0, framework });
         map[rel] = { cid: fileCid, type, size };
       }
     }
@@ -1542,6 +1553,40 @@ function buildFilesMap(buildDir, fileCids = /* @__PURE__ */ new Map()) {
   walk(buildDir);
   return map;
 }
+function computeClassificationPrecision(fileCids, filesMap, prevManifest, sampleCap = 10) {
+  let filesStableGroundTruth = 0;
+  let filesStablePacked = 0;
+  let heuristicAgreeStable = 0;
+  let heuristicAgreeVolatile = 0;
+  let heuristicFalseVolatile = 0;
+  let heuristicFalseStable = 0;
+  const sampleSeen = /* @__PURE__ */ new Set();
+  const unhashedStableSample = [];
+  for (const [p, cid] of fileCids.entries()) {
+    if (p === MANIFEST_PATH) continue;
+    const guess = filesMap[p]?.type ?? "volatile";
+    if (guess === "stable") filesStablePacked++;
+    const truth = classifyFile(p, { prevManifest, fileCid: cid });
+    if (truth === "stable") filesStableGroundTruth++;
+    const prevEntry = prevManifest?.files[p];
+    if (!prevEntry || !cid) continue;
+    if (truth === "stable" && guess === "stable") {
+      heuristicAgreeStable++;
+    } else if (truth === "volatile" && guess === "volatile") {
+      heuristicAgreeVolatile++;
+    } else if (truth === "stable" && guess === "volatile") {
+      heuristicFalseVolatile++;
+      const basename3 = p.split("/").pop() ?? p;
+      if (unhashedStableSample.length < sampleCap && !sampleSeen.has(basename3)) {
+        sampleSeen.add(basename3);
+        unhashedStableSample.push(basename3);
+      }
+    } else {
+      heuristicFalseStable++;
+    }
+  }
+  return { filesStableGroundTruth, filesStablePacked, heuristicAgreeStable, heuristicAgreeVolatile, heuristicFalseVolatile, heuristicFalseStable, unhashedStableSample };
+}
 async function readRetentionPeriodBlocks(unsafeApi) {
   try {
     const rp = await unsafeApi.query.TransactionStorage.RetentionPeriod.getValue();
@@ -1550,10 +1595,37 @@ async function readRetentionPeriodBlocks(unsafeApi) {
     return 0;
   }
 }
+var VITE_ASSET_HASH_RE = CONTENT_HASH_RE;
+function detectBuildMarkers(directoryPath) {
+  const markers = [];
+  try {
+    const manifestPath = path.join(directoryPath, "manifest.json");
+    const polkavmBinPath = path.join(directoryPath, "app.polkavm");
+    if (fs.existsSync(manifestPath) && fs.existsSync(polkavmBinPath)) {
+      const obj = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+      if (obj && typeof obj === "object" && obj.runtime && obj.runtime.kind === "polkavm") {
+        markers.push("polkavm-app");
+      }
+    }
+  } catch {
+  }
+  if (fs.existsSync(path.join(directoryPath, "_next", "static"))) markers.push("next");
+  if (fs.existsSync(path.join(directoryPath, "_nuxt"))) markers.push("nuxt");
+  const assetsDir = path.join(directoryPath, "assets");
+  if (fs.existsSync(assetsDir)) {
+    try {
+      const entries = fs.readdirSync(assetsDir);
+      if (entries.some((name) => VITE_ASSET_HASH_RE.test(name))) markers.push("vite");
+    } catch {
+    }
+  }
+  return markers;
+}
+function frameworkFromMarkers(markers) {
+  return markers.length === 1 ? markers[0] : null;
+}
 function detectFramework(directoryPath) {
-  if (fs.existsSync(path.join(directoryPath, "_next"))) return "next";
-  if (fs.existsSync(path.join(directoryPath, "assets"))) return "vite";
-  return null;
+  return frameworkFromMarkers(detectBuildMarkers(directoryPath));
 }
 var SIZE_WARN_BYTES = 50 * 1024 * 1024;
 var SIZE_ABORT_BYTES = 500 * 1024 * 1024;
@@ -1615,6 +1687,8 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
   const prevManifest = fetched.source === "embedded" ? fetched.manifest : null;
   console.log(`   Manifest fetch: ${fetched.source}${fetched.source !== "none" ? ` (${fetched.attempts} attempt${fetched.attempts === 1 ? "" : "s"})` : ""}`);
   applyManifestFetchAttributes(fetched);
+  const buildMarkers = detectBuildMarkers(directoryPath);
+  const framework = frameworkFromMarkers(buildMarkers);
   const deployedAt = opts.reproducibleSource ? resolveReproducibleTimestamp(opts.reproducibleSource) : (/* @__PURE__ */ new Date()).toISOString();
   writeEmbeddedManifestPlaceholder(directoryPath, {
     version: MANIFEST_VERSION,
@@ -1634,7 +1708,7 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
     useKubo = hasIPFS();
   }
   const phaseA = await withSpan("deploy.merkleize", `1a. merkleize (${useKubo ? "kubo" : "js"}, stable)`, { "deploy.directory": dirBasename, "deploy.merkle": useKubo ? "kubo" : "js" }, async () => {
-    const r = await merkleizeWithStableOrder(directoryPath, prevManifest?.stableBlockOrder, { useKubo, phase: "Phase A" });
+    const r = await merkleizeWithStableOrder(directoryPath, prevManifest?.stableBlockOrder, { useKubo, phase: "Phase A", classifyFn: (p) => classifyFile(p, { framework }) });
     sampleMemory("merkleize_end");
     return r;
   });
@@ -1722,7 +1796,7 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
   setDeployAttribute("deploy.probe.failed", probeFailedCount);
   setDeployAttribute("deploy.phase_a.chunks_uploaded", probeAbsent);
   const phaseAKnownPresent = new Set(phaseAUploadCids);
-  const filesMap = buildFilesMap(directoryPath, phaseA.fileCids);
+  const filesMap = buildFilesMap(directoryPath, phaseA.fileCids, framework);
   const blocksList = [...phaseA.blocks.keys()];
   const chunksMap = {};
   for (let i = 0; i < phaseA.section1ChunkCids.length; i++) {
@@ -1743,7 +1817,7 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
     version: MANIFEST_VERSION,
     previousContenthash: prevContenthash,
     deployedAt,
-    framework: detectFramework(directoryPath),
+    framework,
     files: filesMap,
     stableBlockOrder: phaseA.stableOrder,
     blocks: blocksList,
@@ -1753,7 +1827,7 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
   carChunksA.length = 0;
   phaseA.carBytes = new Uint8Array(0);
   const phaseB = await withSpan("deploy.merkleize", "1c. merkleize (js, finalise)", { "deploy.directory": dirBasename }, async () => {
-    const r = await merkleizeWithStableOrder(directoryPath, phaseA.stableOrder, { useKubo, phase: "Phase B" });
+    const r = await merkleizeWithStableOrder(directoryPath, phaseA.stableOrder, { useKubo, phase: "Phase B", classifyFn: (p) => classifyFile(p, { framework }) });
     sampleMemory("merkleize_finalise_end");
     return r;
   });
@@ -1940,12 +2014,8 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
     preWarmGateway(newlyUploadedCids, [gateway]);
   }
   const retentionPeriodBlocks = await readRetentionPeriodBlocks(provider.unsafeApi);
-  const framework = detectFramework(directoryPath);
-  const filesStableCount = [...phaseA.fileCids.entries()].filter(([p, cid]) => {
-    if (p === MANIFEST_PATH) return false;
-    return classifyFile(p, { prevManifest, fileCid: cid, framework }) === "stable";
-  }).length;
   const filesTotalCount = phaseA.fileCids.size - (phaseA.fileCids.has(MANIFEST_PATH) ? 1 : 0);
+  const precision = computeClassificationPrecision(phaseA.fileCids, filesMap, prevManifest);
   const probeResultsForStats = carChunkCidsA.flatMap((cid) => {
     if (trustedCidsA.has(cid)) return [{ cid, present: true, block: 0, index: 0 }];
     if (!phaseASkipProbeResults.has(cid)) return [];
@@ -1973,8 +2043,15 @@ async function storeDirectoryV2(directoryPath, opts = {}) {
     manifestBytes: fetched.source === "embedded" ? fetched.bytesDownloaded ?? 0 : 0,
     framework,
     filesTotal: filesTotalCount,
-    filesStable: filesStableCount,
-    filesVolatile: filesTotalCount - filesStableCount,
+    filesStable: precision.filesStableGroundTruth,
+    filesVolatile: filesTotalCount - precision.filesStableGroundTruth,
+    filesStablePacked: precision.filesStablePacked,
+    heuristicAgreeStable: precision.heuristicAgreeStable,
+    heuristicAgreeVolatile: precision.heuristicAgreeVolatile,
+    heuristicFalseVolatile: precision.heuristicFalseVolatile,
+    heuristicFalseStable: precision.heuristicFalseStable,
+    buildMarkers,
+    unhashedStableSample: precision.unhashedStableSample,
     probeResults: probeResultsForStats,
     prevChunks: prevManifest?.chunks ?? {},
     retentionPeriodBlocks,
@@ -2017,6 +2094,10 @@ function resolveProductSigner(options) {
   if (options.signer || options.signerAddress || options.suri || options.derivationPath) {
     throw new NonRetryableError("--product-name derives the signer itself; it cannot be combined with --suri, --derivation-path, or an external signer.");
   }
+  if (!options.mnemonic) {
+    const notice = mnemonicConflictNotice({ envMnemonic: process.env.MNEMONIC, envDotnsMnemonic: process.env.DOTNS_MNEMONIC });
+    if (notice) console.error(notice);
+  }
   const productMnemonic = resolveEffectiveMnemonic({
     flagMnemonic: options.mnemonic,
     envMnemonic: process.env.MNEMONIC,
@@ -2154,6 +2235,7 @@ async function deploy(content, domainName = null, options = {}) {
   let envAssetHub;
   let envSource;
   let envUserFilePath;
+  let envUserFileKeys;
   let envNetwork;
   let envName;
   let envIpfs;
@@ -2173,12 +2255,13 @@ async function deploy(content, domainName = null, options = {}) {
     envAssetHub = options.assetHubEndpoints;
   } else {
     try {
-      const { doc, source, userFilePath } = await loadEnvironments();
+      const { doc, source, userFilePath, userFileContractKeys } = await loadEnvironments();
       const resolved = resolveEndpoints(doc, envId);
       envBulletin = resolved.bulletin;
       envAssetHub = options.assetHubEndpoints ?? resolved.assetHub;
       envSource = source;
       envUserFilePath = userFilePath;
+      envUserFileKeys = userFileContractKeys?.[envId];
       envNetwork = resolved.network ?? "unknown";
       envName = resolved.envName;
       envIpfs = resolved.ipfs;
@@ -2199,7 +2282,7 @@ async function deploy(content, domainName = null, options = {}) {
       captureWarning(`environments load failed: ${e?.message ?? e}`);
     }
   }
-  const contractSources = describeContractSources(envContracts, options.contracts, envSource, envUserFilePath, envId);
+  const contractSources = describeContractSources(envContracts, options.contracts, envSource, envUserFilePath, envId, envUserFileKeys);
   if (options.contracts && Object.keys(options.contracts).length > 0) {
     envContracts = { ...envContracts, ...options.contracts };
   }
@@ -2236,12 +2319,7 @@ async function deploy(content, domainName = null, options = {}) {
         isTestnet: isTestnetEnv,
         sessionPresent: hasSession
       });
-      options = {
-        ...options,
-        signer: actors.worker.signer,
-        signerAddress: actors.worker.address,
-        ...actors.recipientH160 ? { transferTo: actors.recipientH160 } : {}
-      };
+      options = { ...options, ...deployActorsToSignerOptions(actors) };
       sessionCleanup = actors.worker.destroy.bind(actors.worker);
       if (actors.worker.source === "session") resolvedUserSession = actors.worker;
       if (actors.recipientH160) {
@@ -2973,7 +3051,11 @@ async function buildOrderedCar(options) {
   newStable.sort(
     (a, b) => b.size - a.size || (a.fileCid < b.fileCid ? -1 : a.fileCid > b.fileCid ? 1 : 0)
   );
-  for (const f of newStable) section1Files.push(f);
+  for (const f of newStable) {
+    if (placed.has(f.fileCid)) continue;
+    section1Files.push(f);
+    placed.add(f.fileCid);
+  }
   volatileFiles.sort(
     (a, b) => b.size - a.size || (a.fileCid < b.fileCid ? -1 : a.fileCid > b.fileCid ? 1 : 0)
   );
@@ -3148,7 +3230,7 @@ export {
   ENCRYPT_PBKDF2_ITERATIONS,
   encryptContent,
   __selectStorageProviderModeForTest,
-  resolveEffectiveMnemonic,
+  deployActorsToSignerOptions,
   resolveEnvId,
   shouldPublishManifest,
   chooseSignerInput,
@@ -3176,6 +3258,8 @@ export {
   computeStorageCid,
   storeDirectory,
   buildFilesMap,
+  computeClassificationPrecision,
+  detectBuildMarkers,
   detectFramework,
   checkDeploySize,
   resolveReproducibleTimestamp,

package/dist/{chunk-3MAIF2SF.js → chunk-F24S4EV5.js}

@@ -2,7 +2,7 @@ import {
   MANIFEST_DIR,
   MANIFEST_FILENAME,
   parseManifest
-} from "./chunk-WPC2PUCV.js";
+} from "./chunk-H44LXDQJ.js";
 
 // src/manifest-fetch.ts
 import * as fs from "fs";
@@ -267,6 +267,16 @@ async function fetchManifestFromChain(client, rootCid, timeoutMs) {
     return null;
   }
 }
+function manifestFetchAttributes(params) {
+  return {
+    "manifest.fetch.gateway": params.gateway,
+    "manifest.fetch.cid": params.cid,
+    "manifest.fetch.outcome": params.outcome,
+    "manifest.fetch.attempts": String(params.attempts),
+    "manifest.fetch.bytes": String(params.bytes),
+    "manifest.fetch.elapsed_ms": String(params.elapsedMs)
+  };
+}
 async function fetchPreviousManifest(prevContenthash, options = {}) {
   if (prevContenthash === null) return { source: "none" };
   const local = readPersistentLocalManifest(options.domain, prevContenthash);
@@ -302,6 +312,31 @@ async function fetchPreviousManifest(prevContenthash, options = {}) {
     }
   }
   const gatewayList = (options.gateways ?? (options.gateway ? [options.gateway] : [])).map((g) => g.replace(/\/$/, ""));
+  if (gatewayList.length === 0) {
+    const cid = prevContenthash.slice(0, 12);
+    Sentry.startSpan(
+      {
+        op: "manifest.fetch",
+        name: `manifest fetch ${cid} (no gateway)`,
+        attributes: manifestFetchAttributes({
+          gateway: "",
+          cid,
+          outcome: "no_gateway_configured",
+          attempts: 0,
+          bytes: 0,
+          elapsedMs: 0
+        })
+      },
+      () => {
+      }
+    );
+    return {
+      source: "heuristic_fallback",
+      reason: "no gateway configured",
+      attempts: 0,
+      bytesDownloaded: 0
+    };
+  }
   const budget = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const start = Date.now();
   let lastReason = "unknown";
@@ -311,22 +346,29 @@ async function fetchPreviousManifest(prevContenthash, options = {}) {
     const gateway = gatewayRaw.replace(/\/ipfs\/?$/, "");
     const url = `${gateway}/ipfs/${prevContenthash}`;
     const gatewayStart = Date.now();
+    const cid = prevContenthash.slice(0, 12);
     const tierResult = await Sentry.startSpan(
       {
         op: "manifest.fetch",
-        name: `manifest fetch ${prevContenthash.slice(0, 12)}`,
+        name: `manifest fetch ${cid}`,
         attributes: {
           "manifest.fetch.gateway": gateway,
-          "manifest.fetch.cid": prevContenthash.slice(0, 12),
+          "manifest.fetch.cid": cid,
           "manifest.fetch.budget_ms": String(budget)
         }
       },
       async (span) => {
         const result = await fetchAcrossTiers(url, budget, start);
-        span.setAttribute("manifest.fetch.outcome", result.outcome);
-        span.setAttribute("manifest.fetch.attempts", String(result.attempts));
-        span.setAttribute("manifest.fetch.bytes", String(result.bytesDownloaded));
-        span.setAttribute("manifest.fetch.elapsed_ms", String(Date.now() - gatewayStart));
+        span.setAttributes(
+          manifestFetchAttributes({
+            gateway,
+            cid,
+            outcome: result.outcome,
+            attempts: result.attempts,
+            bytes: result.bytesDownloaded,
+            elapsedMs: Date.now() - gatewayStart
+          })
+        );
         return result;
       }
     );

package/dist/{chunk-WPC2PUCV.js → chunk-H44LXDQJ.js}

@@ -24,21 +24,54 @@ var STABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   "ogg",
   "pdf"
 ]);
-var CONTENT_HASH_RE = /[-.](?:[a-f0-9]{6,16}|[A-Za-z0-9_-]{6,16})\.[a-zA-Z0-9]+$/;
+var CONTENT_HASH_RE = /[-.](?:[a-f0-9]{6,32}|[A-Za-z0-9_-]{6,20})\.[a-zA-Z0-9]+$/;
+var NUXT_HASH_RE = /(?:^|\/)[A-Za-z0-9_-]{8,20}\.[a-zA-Z0-9]+$/;
+var FRAMEWORK_RULES = {
+  // Next.js self-hosting docs: static assets under _next/static/ carry an
+  // immutable Cache-Control because "these immutable files contain a
+  // SHA-hash in the file name" — but _buildManifest.js and _ssgManifest.js
+  // sit under a build-id directory and carry no hash of their own. Their
+  // path is unique only while the build id is (Next keeps it constant when
+  // `deploymentId` is set), so with a fixed build id they are a stable path
+  // with mutable content — the C2 expensive error — unless excluded.
+  next: {
+    stablePrefixes: ["_next/static/"],
+    volatileExact: ["_buildManifest.js", "_ssgManifest.js"]
+  },
+  // Nuxt's app manifest writes _nuxt/builds/latest.json — re-read on every
+  // page load to detect a new deployment, so it has a fixed filename and
+  // changes content every build. A blanket `_nuxt/` stablePrefix would put
+  // it in section 1, so the rule is scoped to the hash shape instead of the
+  // prefix. _nuxt/builds/meta/<buildId>.json IS stable: that name is unique
+  // per build, so its content never changes under it.
+  nuxt: { scopedHashRe: [{ prefix: "_nuxt/", re: NUXT_HASH_RE }] },
+  // A PolkaVM app bundle. Nothing here is content-addressed, so the rules
+  // are about what the bundle means, not what its filenames look like: the
+  // payload directories never change, the executable and its manifest
+  // change every release. Measured on polkavm-app-kit: one deploy shipped
+  // 52.17 MB volatile against 3.73 MB stable, another 17.65 MB across 8
+  // files at 99.9% volatile. `game/` and `LICENSES/` are generic enough to
+  // be someone else's mutable content, so they are earned entirely by the
+  // detection marker (a parsed manifest.json field) being specific.
+  "polkavm-app": {
+    stablePrefixes: ["game/", "LICENSES/"],
+    volatileExact: ["app.polkavm", "manifest.json"]
+  }
+};
 function isVolatilePath(p) {
   return p.startsWith(`${MANIFEST_DIR}/`) || p === MANIFEST_DIR;
 }
 function classifyFileHeuristic(filePath, framework) {
   if (isVolatilePath(filePath)) return "volatile";
-  if (CONTENT_HASH_RE.test(filePath)) return "stable";
+  const rules = framework ? FRAMEWORK_RULES[framework] : void 0;
+  if (rules) {
+    if (rules.volatileExact && rules.volatileExact.includes(filePath.split("/").pop() ?? filePath)) return "volatile";
+    if (rules.stablePrefixes?.some((prefix) => filePath.startsWith(prefix))) return "stable";
+    if (rules.scopedHashRe?.some(({ prefix, re }) => filePath.startsWith(prefix) && re.test(filePath))) return "stable";
+  }
   const ext = filePath.split(".").pop()?.toLowerCase();
   if (ext && STABLE_EXTENSIONS.has(ext)) return "stable";
-  if (framework === "next") {
-    if (filePath.startsWith("_next/static/")) return "stable";
-  }
-  if (framework === "vite") {
-    if (filePath.startsWith("assets/") && CONTENT_HASH_RE.test(filePath)) return "stable";
-  }
+  if (CONTENT_HASH_RE.test(filePath)) return "stable";
   return "volatile";
 }
 function classifyFile(filePath, ctx = {}) {
@@ -101,6 +134,8 @@ export {
   MANIFEST_DIR,
   MANIFEST_FILENAME,
   MANIFEST_PATH,
+  CONTENT_HASH_RE,
+  FRAMEWORK_RULES,
   isVolatilePath,
   classifyFileHeuristic,
   classifyFile,

package/dist/{chunk-5FLTDWWP.js → chunk-H44NO63C.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TSPERKUS.js";
 import {
   NonRetryableError
-} from "./chunk-ZOC4GITL.js";
+} from "./chunk-SH2LG52Z.js";
 
 // src/auth/vendor/auth.ts
 import { readdir, unlink } from "fs/promises";

package/dist/{chunk-3ACNAWUD.js → chunk-JTH3ISLR.js}

@@ -1,13 +1,13 @@
 import {
   BULLETIN_RESOURCE,
   resolveSigner
-} from "./chunk-5FLTDWWP.js";
+} from "./chunk-H44NO63C.js";
 import {
   DEFAULT_MNEMONIC
-} from "./chunk-RJDHC56V.js";
+} from "./chunk-ZZIOS4RG.js";
 import {
   DOT_PRODUCT_ID
-} from "./chunk-ABMNC34K.js";
+} from "./chunk-U2QO5G35.js";
 
 // src/deploy-actors.ts
 var DEFAULT_WORKER_SURI = DEFAULT_MNEMONIC;

package/dist/{chunk-NKDGBZBP.js → chunk-O56KLG7Z.js}

@@ -1,9 +1,9 @@
 import {
   validateProductConfig
-} from "./chunk-I5PNPQZO.js";
+} from "./chunk-ANX3RZAS.js";
 import {
   NonRetryableError
-} from "./chunk-ZOC4GITL.js";
+} from "./chunk-SH2LG52Z.js";
 
 // src/manifest/config-load.ts
 import * as fs from "fs/promises";

package/dist/{chunk-KTKFHROI.js → chunk-OONQPYHM.js}

@@ -6,7 +6,7 @@ import * as path from "path";
 // package.json
 var package_default = {
   name: "bulletin-deploy",
-  version: "0.19.3",
+  version: "0.19.4",
   private: false,
   repository: {
     type: "git",
@@ -52,11 +52,11 @@ var package_default = {
     "tools/verify-baked-dsn.mjs"
   ],
   scripts: {
-    build: "tsup src/suppress-localstorage-warning.ts src/index.ts src/deploy.ts src/dotns.ts src/dotns-protocol.ts src/pool.ts src/telemetry.ts src/chain-health.ts src/memory-report.ts src/merkle.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/subname-depth.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/proof-validity.ts src/personhood/ring-proof.ts src/personhood/reprove.ts src/personhood/bind-personal-id.ts src/personhood/claim-pgas.ts src/personhood/bind-paid-alias.ts src/personhood/bootstrap.ts src/personhood/chain-prereqs.ts src/manifest/types.ts src/manifest/schema.ts src/manifest/byte-budget.ts src/manifest/compose.ts src/manifest/config-load.ts src/manifest/publish.ts src/auth/index.ts src/auth/vendor/index.ts src/auth/vendor/ui/index.ts src/auth-config.ts src/commands/login.ts src/commands/logout.ts src/commands/whoami.ts src/commands/transfer.ts src/storage-signer.ts src/spinner.ts src/sss-allowance.ts src/sss-allowance-cache.ts src/deploy-actors.ts src/product-account.ts --format esm --dts --clean --target node22",
+    build: "tsup src/suppress-localstorage-warning.ts src/index.ts src/deploy.ts src/dotns.ts src/mnemonic.ts src/dotns-protocol.ts src/pool.ts src/telemetry.ts src/chain-health.ts src/memory-report.ts src/merkle.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/subname-depth.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/proof-validity.ts src/personhood/ring-proof.ts src/personhood/reprove.ts src/personhood/bind-personal-id.ts src/personhood/claim-pgas.ts src/personhood/bind-paid-alias.ts src/personhood/bootstrap.ts src/personhood/chain-prereqs.ts src/manifest/types.ts src/manifest/schema.ts src/manifest/byte-budget.ts src/manifest/compose.ts src/manifest/config-load.ts src/manifest/publish.ts src/auth/index.ts src/auth/vendor/index.ts src/auth/vendor/ui/index.ts src/auth-config.ts src/commands/login.ts src/commands/logout.ts src/commands/whoami.ts src/commands/transfer.ts src/storage-signer.ts src/spinner.ts src/sss-allowance.ts src/sss-allowance-cache.ts src/deploy-actors.ts src/product-account.ts --format esm --dts --clean --target node22",
     "refresh-environments": "node scripts/refresh-environments.mjs",
     postinstall: "patch-package || true",
     prepare: "npm run build",
-    test: "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/helpers/e2e-exit-guard.test.js test/environments.test.js test/refresh-environments.test.js test/chunk-sharing-report.test.js test/dotns-deployments-parser.test.js test/dotns-token-id.test.js test/dotns-subnode-id.test.js test/dotns-protocol.test.js test/product-manifest.test.js test/manifest-trusted-products.test.js test/cache-savings-totals.test.js test/error-pattern-signature.test.js test/exit-codes.test.js test/probe-env-health.test.js test/chunk-probe-timeout.test.js test/e2e-chain-calls.test.js test/auth-config.test.js test/whoami.test.js test/login.test.js test/logout.test.js test/auth-resolve.test.js test/storage-signer.test.js test/spinner.test.js test/sss-allowance.test.js test/sss-allowance-cache.test.js test/dotns-transfer.test.js test/deploy-actors.test.js test/transfer-command.test.js test/dotns-register-fee.test.js test/deploy-label-ordering.test.js test/benign-teardown.test.js test/verify-baked-dsn.test.js test/product-account.test.js test/post-release-monitor-skill.test.js test/test-release-retry-wrapper.js test/reprove-alias-tool.test.js test/bootstrap-env.test.js test/check-chain-identity.test.js && npm run test:vendor",
+    test: "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/helpers/e2e-exit-guard.test.js test/environments.test.js test/refresh-environments.test.js test/chunk-sharing-report.test.js test/car-section1-dedup.test.js test/dotns-deployments-parser.test.js test/dotns-token-id.test.js test/dotns-subnode-id.test.js test/dotns-protocol.test.js test/product-manifest.test.js test/manifest-trusted-products.test.js test/cache-savings-totals.test.js test/error-pattern-signature.test.js test/exit-codes.test.js test/probe-env-health.test.js test/chunk-probe-timeout.test.js test/e2e-chain-calls.test.js test/auth-config.test.js test/whoami.test.js test/login.test.js test/logout.test.js test/auth-resolve.test.js test/storage-signer.test.js test/spinner.test.js test/sss-allowance.test.js test/sss-allowance-cache.test.js test/dotns-transfer.test.js test/deploy-actors.test.js test/transfer-command.test.js test/dotns-register-fee.test.js test/deploy-label-ordering.test.js test/benign-teardown.test.js test/verify-baked-dsn.test.js test/product-account.test.js test/post-release-monitor-skill.test.js test/test-release-retry-wrapper.js test/reprove-alias-tool.test.js test/bootstrap-env.test.js test/check-chain-identity.test.js && npm run test:vendor",
     "test:e2e": "npm run build && node --test test/e2e.test.js",
     "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",
     "test:e2e:pr": "bash scripts/e2e-pass.sh pr",
@@ -94,7 +94,7 @@ var package_default = {
     "@types/ws": "^8.18.1",
     tsup: "^8.5.0",
     typescript: "^5.9.3",
-    vitest: "^4.1.0"
+    vitest: "^4.1.11"
   },
   overrides: {
     "@polkadot-api/json-rpc-provider": "^0.2.0"

package/dist/{chunk-SNFGJOR2.js → chunk-R3BXRRKE.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-IP6ABIIC.js";
+} from "./chunk-BFK5UCUJ.js";
 
 // src/version-check.ts
 import { execSync, execFileSync } from "child_process";