bulletin-deploy 0.19.3 → 0.19.4

package/dist/dotns.d.ts

@@ -187,7 +187,7 @@ interface DotnsPreflightResult {
         transferred: bigint;
     };
 }
-declare const MINIMUM_REGISTER_STORAGE_DEPOSIT = 2000000000000n;
+declare const MINIMUM_REGISTER_STORAGE_DEPOSIT = 50000000000n;
 declare function registerDepositWei(userStatus: number, startingPriceWei: bigint): bigint;
 declare function bufferedWeiToNative(weiValue: bigint, nativeToEthRatio: bigint): bigint;
 declare function weiToNative(feeWei: bigint, nativeToEthRatio: bigint): bigint;
@@ -204,6 +204,55 @@ type DotnsSuccessAction = Exclude<DotnsPreflightResult["plannedAction"], "abort"
  * so the floor can eventually come from measurement rather than the fixed 200 PAS.
  */
 declare function storageDepositLimitFor(estimate: bigint, floor?: bigint): bigint;
+/**
+ * The weight ceiling to declare on a Revive call, given the dry run's
+ * measured gasRequired. #1522: weight_limit used to be declared at exactly
+ * the dry-run estimate, with no margin — unlike storage_deposit_limit
+ * (storageDepositLimitFor, above), buffered 20% since #1518. A dry run
+ * measures the chain as it was; a write elsewhere between the estimate and
+ * inclusion (proof_size moves on ANY write to the same trie, not just this
+ * call's own) can push the real requirement above the declared limit and
+ * trap the call — see #1522's S9 incident for a measured replay.
+ *
+ * Same 20% factor as storageDepositLimitFor, applied to BOTH components:
+ * S9 shows ref_time and proof_size drifting independently, and buffering
+ * only one was not enough to clear the replay.
+ *
+ * Deliberately NO floor, unlike storageDepositLimitFor: the single-call path
+ * (dryRunReviveCall) always measures the exact call about to be submitted —
+ * no commit()-stands-in-for-register()-reveal substitution gap to floor
+ * against there. (submitBatchedContractCalls, below, only dry-runs the HEAD
+ * call and reuses that estimate for every sibling in the batch — pre-
+ * existing behavior this fix doesn't change, and its own gap to note if
+ * that ever needs tightening.) Over-buffering also isn't free insurance the
+ * way storage headroom is — pallet-revive declares a Revive.call's
+ * pre-dispatch weight from the declared gas_limit, so a large enough
+ * weight_limit gets the tx rejected outright with `Invalid/ExhaustsResources`
+ * before it reaches a block (verified live against paseo-next-v2).
+ *
+ * The buffer is not literally free, though: pallet-revive withholds the fee
+ * up front at the DECLARED weight before dispatch and refunds only the
+ * unused portion afterward (Substrate's standard weight-refund mechanism) —
+ * so the signer must briefly hold slightly more than the call's actual fee.
+ * Block 842020 (the S9 incident's own trapped extrinsic) shows the scale:
+ * Balances.Withdraw charged 170,935,081 plancks up front on A's stale,
+ * UNBUFFERED declaration, and Balances.Deposit refunded only 476,674 back
+ * (A's call trapped near its limit, so almost nothing was unused). A 20%
+ * buffer's extra up-front hold on a register-sized call is therefore on the
+ * order of 0.003-0.004 PAS — well under FEE_FLOOR_REGISTER's existing 0.1
+ * PAS margin. What it does NOT do is meaningfully raise the FINAL charged
+ * fee: two real, finalized commit() calls declaring 1.2x vs. 5x the
+ * measured weight cost 22,371,211 and 22,421,211 plancks respectively (0.22%
+ * apart) once refunded — confirming the pre-dispatch hold differs far more
+ * than the post-refund charge does.
+ */
+declare function weightLimitFor(gasRequired: {
+    referenceTime: bigint;
+    proofSize: bigint;
+}): {
+    ref_time: bigint;
+    proof_size: bigint;
+};
 declare function feeFloorFor(plannedAction: DotnsSuccessAction, storageDeposit?: bigint, rentPriceNative?: bigint, transferFeeNative?: bigint): bigint;
 declare const RPC_ENDPOINTS: string[];
 declare const CONTRACTS: {
@@ -446,6 +495,9 @@ declare function formatContractDryRunFailure(gasEstimate: {
     encodedData: string;
     args?: unknown[];
     contracts?: Record<string, string>;
+    /** #1518: the storage-deposit floor actually declared on this call, so the bare-revert
+     *  diagnostic below can name the real configured amount instead of a stale hardcoded one. */
+    registerStorageDeposit?: bigint;
 }): string;
 declare function __formatContractDryRunFailureForTest(gasEstimate: Parameters<typeof formatContractDryRunFailure>[0], context: Parameters<typeof formatContractDryRunFailure>[1]): string;
 declare function convertWeiToNative(weiValue: bigint): bigint;
@@ -517,7 +569,9 @@ declare class ReviveClientWrapper {
     };
     client: any;
     mappedAccounts: Set<string>;
+    private _storageDepositFloor;
     constructor(client: any);
+    setStorageDepositFloor(floor: bigint): void;
     getEvmAddress(substrateAddress: string): Promise<string>;
     performDryRunCall(originSubstrateAddress: string, contractAddress: string, value: bigint, encodedData: string): Promise<any>;
     estimateGasForCall(originSubstrateAddress: string, contractAddress: string, value: bigint, encodedData: string): Promise<any>;
@@ -1151,4 +1205,4 @@ declare class DotNS {
 }
 declare const dotns: DotNS;
 
-export { ATTR_TX_RESOLUTION_KIND, type AliasAccountClassification, type AliasAccountState, type AuthorizationResult, CONNECTION_TIMEOUT_MS, CONTENTHASH_VERIFY_ATTEMPTS, CONTRACTS, ContractDryRunRevertError, DECIMALS, DEFAULT_DOTNS_PROFILE, DEFAULT_MNEMONIC, DEFAULT_TLD, DOTNS_BEST_BLOCK_GRACE_MS, DOTNS_NONCE_CONTENTION_MAX_ATTEMPTS, DOTNS_TX_MAX_ATTEMPTS, type DomainLabelAlternative, DotNS, type DotNSConnectOptions, type DotnsPreflightResult, type DotnsSuccessAction, KNOWN_TLDS, MINIMUM_REGISTER_STORAGE_DEPOSIT, NATIVE_TO_ETH_RATIO, NONCE_ADVANCE_VERIFY_RETRIES, NONCE_ADVANCE_VERIFY_RETRY_INTERVAL_MS, OPERATION_TIMEOUT_MS, type OwnershipResult, PHONE_APPROVAL_MS, PHONE_SILENCE_MAX_REARMS, type ParsedDomainName, type PhoneSignatureStep, PhoneSilenceNonRetryableError, type PriceValidationResult, ProofOfPersonhoodStatus, REVIVE_ADDRESS_ATTEMPTS, RPC_ENDPOINTS, type Registrability, type RegistryDryRunResult, ReviveClientWrapper, TX_CHAIN_TIME_BUDGET_MS, TX_KIND_BEST_BLOCK, TX_KIND_HASH, TX_KIND_NONCE_ADVANCED, TX_KIND_SKIPPED, TX_NO_PROGRESS_MS, TX_TIMEOUT_MS, TX_WALL_CLOCK_CEILING_MS, type TxResolution, VERIFY_EFFECT_CHAIN_SECONDS, WS_HEARTBEAT_TIMEOUT_MS, WatcherSilentNoEventError, __formatContractDryRunFailureForTest, assertNotZeroRecipient, bufferedWeiToNative, buildLabelAlternatives, canRegister, checkTldNodeConsistency, classifyAliasAccountRow, classifyDotnsLabel, classifyRegistrability, classifyTxRetryDecision, classifyWatcherSilentFastFail, computeDomainNode, computeDomainTokenId, computeSubnodeIds, convertToHexString, convertWeiToNative, countTrailingDigits, decideRegistrabilityOutcome, dotns, dotnsRetryBackoffMs, feeFloorFor, fetchNonce, fmtPas, formatDispatchError, formatPersonhoodRemediation, formatPopShortfallReason, formatUnregistrableReason, isCommitmentMature, isCommitmentTimingBarerevert, isNonceContentionAmbiguous, makeRetryStatusFilter, nonceContentionBackoffMs, normalizeOnChainTld, parseDomainName, parseProofOfPersonhoodStatus, pickVerifyEndpoint, popStatusName, reacquireNonceOnContention, registerDepositWei, resolveTldFromRegistryResult, sanitizeDomainLabel, shortNamesClosedReason, shouldRegateBeforeResign, shouldRetryTxAttempt, shouldSkipTextWrite, soulboundTransferReason, storageDepositLimitFor, stripTldSuffix, stripTrailingDigits, validateDomainLabel, verifyEffectWithGrace, verifyNonceAdvanced, weiToNative, withRetry };
+export { ATTR_TX_RESOLUTION_KIND, type AliasAccountClassification, type AliasAccountState, type AuthorizationResult, CONNECTION_TIMEOUT_MS, CONTENTHASH_VERIFY_ATTEMPTS, CONTRACTS, ContractDryRunRevertError, DECIMALS, DEFAULT_DOTNS_PROFILE, DEFAULT_MNEMONIC, DEFAULT_TLD, DOTNS_BEST_BLOCK_GRACE_MS, DOTNS_NONCE_CONTENTION_MAX_ATTEMPTS, DOTNS_TX_MAX_ATTEMPTS, type DomainLabelAlternative, DotNS, type DotNSConnectOptions, type DotnsPreflightResult, type DotnsSuccessAction, KNOWN_TLDS, MINIMUM_REGISTER_STORAGE_DEPOSIT, NATIVE_TO_ETH_RATIO, NONCE_ADVANCE_VERIFY_RETRIES, NONCE_ADVANCE_VERIFY_RETRY_INTERVAL_MS, OPERATION_TIMEOUT_MS, type OwnershipResult, PHONE_APPROVAL_MS, PHONE_SILENCE_MAX_REARMS, type ParsedDomainName, type PhoneSignatureStep, PhoneSilenceNonRetryableError, type PriceValidationResult, ProofOfPersonhoodStatus, REVIVE_ADDRESS_ATTEMPTS, RPC_ENDPOINTS, type Registrability, type RegistryDryRunResult, ReviveClientWrapper, TX_CHAIN_TIME_BUDGET_MS, TX_KIND_BEST_BLOCK, TX_KIND_HASH, TX_KIND_NONCE_ADVANCED, TX_KIND_SKIPPED, TX_NO_PROGRESS_MS, TX_TIMEOUT_MS, TX_WALL_CLOCK_CEILING_MS, type TxResolution, VERIFY_EFFECT_CHAIN_SECONDS, WS_HEARTBEAT_TIMEOUT_MS, WatcherSilentNoEventError, __formatContractDryRunFailureForTest, assertNotZeroRecipient, bufferedWeiToNative, buildLabelAlternatives, canRegister, checkTldNodeConsistency, classifyAliasAccountRow, classifyDotnsLabel, classifyRegistrability, classifyTxRetryDecision, classifyWatcherSilentFastFail, computeDomainNode, computeDomainTokenId, computeSubnodeIds, convertToHexString, convertWeiToNative, countTrailingDigits, decideRegistrabilityOutcome, dotns, dotnsRetryBackoffMs, feeFloorFor, fetchNonce, fmtPas, formatDispatchError, formatPersonhoodRemediation, formatPopShortfallReason, formatUnregistrableReason, isCommitmentMature, isCommitmentTimingBarerevert, isNonceContentionAmbiguous, makeRetryStatusFilter, nonceContentionBackoffMs, normalizeOnChainTld, parseDomainName, parseProofOfPersonhoodStatus, pickVerifyEndpoint, popStatusName, reacquireNonceOnContention, registerDepositWei, resolveTldFromRegistryResult, sanitizeDomainLabel, shortNamesClosedReason, shouldRegateBeforeResign, shouldRetryTxAttempt, shouldSkipTextWrite, soulboundTransferReason, storageDepositLimitFor, stripTldSuffix, stripTrailingDigits, validateDomainLabel, verifyEffectWithGrace, verifyNonceAdvanced, weiToNative, weightLimitFor, withRetry };

package/dist/dotns.js

@@ -89,15 +89,17 @@ import {
   verifyEffectWithGrace,
   verifyNonceAdvanced,
   weiToNative,
+  weightLimitFor,
   withRetry
-} from "./chunk-RJDHC56V.js";
+} from "./chunk-ZZIOS4RG.js";
 import "./chunk-SI2ZUOYD.js";
+import "./chunk-ZG3HAH5A.js";
 import "./chunk-FWJQAIVO.js";
-import "./chunk-NA3SXVY6.js";
-import "./chunk-ZOC4GITL.js";
-import "./chunk-VBIFKNUS.js";
-import "./chunk-IP6ABIIC.js";
-import "./chunk-KTKFHROI.js";
+import "./chunk-3NR3T7US.js";
+import "./chunk-CCIBF55X.js";
+import "./chunk-BFK5UCUJ.js";
+import "./chunk-OONQPYHM.js";
+import "./chunk-SH2LG52Z.js";
 import "./chunk-K5SP4OUC.js";
 export {
   ATTR_TX_RESOLUTION_KIND,
@@ -190,5 +192,6 @@ export {
   verifyEffectWithGrace,
   verifyNonceAdvanced,
   weiToNative,
+  weightLimitFor,
   withRetry
 };

package/dist/environments.d.ts

@@ -66,6 +66,12 @@ interface LoadResult {
     source: EnvironmentsSource;
     /** Set when source is "file": the path that was read. */
     userFilePath?: string;
+    /**
+     * Set when source is "file": per environment id, the contract keys that file
+     * actually declared. The merge is key-by-key, so every other key in the
+     * resolved map still came from the shipped config.
+     */
+    userFileContractKeys?: Record<string, string[]>;
 }
 interface LoadOptions {
     bundledPath?: string;
@@ -111,7 +117,7 @@ declare function isValidContractAddress(addr: unknown): boolean;
  * @param envId      The environment ID, used in the error message.
  */
 declare function validateContractAddresses(contracts: Record<string, string>, envId: string, sources?: Record<string, string>): void;
-declare function describeContractSources(envContracts: Record<string, string>, cliContracts: Record<string, string> | undefined, source: string | undefined, userFilePath: string | undefined, envId: string | undefined): Record<string, string>;
+declare function describeContractSources(envContracts: Record<string, string>, cliContracts: Record<string, string> | undefined, source: string | undefined, userFilePath: string | undefined, envId: string | undefined, userFileKeys: readonly string[] | undefined): Record<string, string>;
 /**
  * Deep-merges a user-supplied partial EnvironmentsDoc over a base doc.
  *

package/dist/environments.js

@@ -10,8 +10,8 @@ import {
   loadEnvironments,
   resolveEndpoints,
   validateContractAddresses
-} from "./chunk-NA3SXVY6.js";
-import "./chunk-ZOC4GITL.js";
+} from "./chunk-3NR3T7US.js";
+import "./chunk-SH2LG52Z.js";
 export {
   DEFAULT_ENV_ID,
   deepMergeEnvironments,

package/dist/errors.d.ts

@@ -2,5 +2,9 @@ declare class NonRetryableError extends Error {
     constructor(message: string);
 }
 declare const EXIT_CODE_NO_RETRY = 78;
+/** How describeContractSources names an address that came from a config we
+ *  ship. Shared so the classifier cannot drift from the wording it matches. */
+declare const SHIPPED_CONFIG_ORIGIN = "assets/environments.json shipped with bulletin-deploy";
+declare const FALLBACK_CONFIG_ORIGIN = "the built-in fallback for";
 
-export { EXIT_CODE_NO_RETRY, NonRetryableError };
+export { EXIT_CODE_NO_RETRY, FALLBACK_CONFIG_ORIGIN, NonRetryableError, SHIPPED_CONFIG_ORIGIN };

package/dist/errors.js

@@ -1,8 +1,12 @@
 import {
   EXIT_CODE_NO_RETRY,
-  NonRetryableError
-} from "./chunk-ZOC4GITL.js";
+  FALLBACK_CONFIG_ORIGIN,
+  NonRetryableError,
+  SHIPPED_CONFIG_ORIGIN
+} from "./chunk-SH2LG52Z.js";
 export {
   EXIT_CODE_NO_RETRY,
-  NonRetryableError
+  FALLBACK_CONFIG_ORIGIN,
+  NonRetryableError,
+  SHIPPED_CONFIG_ORIGIN
 };

package/dist/incremental-stats.d.ts

@@ -10,6 +10,13 @@ interface IncrementalStats {
     filesTotal: number;
     filesStable: number;
     filesVolatile: number;
+    filesStablePacked: number;
+    heuristicAgreeStable: number;
+    heuristicAgreeVolatile: number;
+    heuristicFalseVolatile: number;
+    heuristicFalseStable: number;
+    buildMarkers: string[];
+    unhashedStableSample: string[];
     probedTotal: number;
     probePresent: number;
     probeAbsent: number;
@@ -44,6 +51,13 @@ interface ComputeStatsInput {
     filesTotal: number;
     filesStable: number;
     filesVolatile: number;
+    filesStablePacked?: number;
+    heuristicAgreeStable?: number;
+    heuristicAgreeVolatile?: number;
+    heuristicFalseVolatile?: number;
+    heuristicFalseStable?: number;
+    buildMarkers?: string[];
+    unhashedStableSample?: string[];
     probeResults: ChunkProbeResult[];
     prevChunks: Record<string, ManifestChunkEntry>;
     retentionPeriodBlocks: number;

package/dist/incremental-stats.js

@@ -2,7 +2,7 @@ import {
   computeStats,
   renderSummary,
   telemetryAttributes
-} from "./chunk-IW3X2MJF.js";
+} from "./chunk-D3YME2EG.js";
 export {
   computeStats,
   renderSummary,

package/dist/index.d.ts

@@ -21,6 +21,7 @@ import 'multiformats/cid';
 import './dotns-protocol.js';
 import 'polkadot-api';
 import './errors.js';
+import './mnemonic.js';
 import './personhood/bootstrap.js';
 import './personhood/bind-personal-id.js';
 import './personhood/claim-pgas.js';

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   publishManifest,
   verifyEmbeddedAppManifests,
   writeEmbeddedAppManifests
-} from "./chunk-H4OZ6PTA.js";
+} from "./chunk-C437RTTU.js";
 import {
   DEFAULT_TEXT_RECORD_BUDGET_BYTES,
   PLACEHOLDER_CID,
@@ -20,33 +20,33 @@ import {
   formatConfigLoadError,
   loadProductConfig,
   tryLoadProductConfig
-} from "./chunk-NKDGBZBP.js";
+} from "./chunk-O56KLG7Z.js";
 import {
   validateExecutableManifest,
   validateProductConfig,
   validateRootManifest
-} from "./chunk-I5PNPQZO.js";
+} from "./chunk-ANX3RZAS.js";
 import {
   deploy,
   merkleizeJS,
   merkleizeWithStableOrder
-} from "./chunk-6MSHWNJT.js";
+} from "./chunk-D6BE3RAU.js";
+import "./chunk-6J4WRFRL.js";
+import "./chunk-GRPLHUYC.js";
 import "./chunk-HNJWIY55.js";
 import "./chunk-M5AKL3FL.js";
-import "./chunk-6FQJLLEF.js";
-import "./chunk-GRPLHUYC.js";
 import {
   computeStats,
   renderSummary,
   telemetryAttributes
-} from "./chunk-IW3X2MJF.js";
+} from "./chunk-D3YME2EG.js";
 import {
   finaliseEmbeddedManifest,
   writeEmbeddedManifestPlaceholder
-} from "./chunk-LPTKBQII.js";
+} from "./chunk-7DDOVCV5.js";
 import {
   fetchPreviousManifest
-} from "./chunk-3MAIF2SF.js";
+} from "./chunk-F24S4EV5.js";
 import {
   MANIFEST_DIR,
   MANIFEST_FILENAME,
@@ -55,24 +55,25 @@ import {
   classifyFile,
   isVolatilePath,
   parseManifest
-} from "./chunk-WPC2PUCV.js";
-import "./chunk-QU5GJF6U.js";
-import "./chunk-SNFGJOR2.js";
+} from "./chunk-H44LXDQJ.js";
+import "./chunk-UFP2XWZ4.js";
+import "./chunk-R3BXRRKE.js";
 import {
   probeChunks
-} from "./chunk-PSYA6E5M.js";
+} from "./chunk-2P4EZOFF.js";
 import "./chunk-C2TS5MER.js";
-import "./chunk-3ACNAWUD.js";
+import "./chunk-JTH3ISLR.js";
 import "./chunk-JQKKMUCT.js";
-import "./chunk-5FLTDWWP.js";
 import "./chunk-RIRDBSBG.js";
+import "./chunk-H44NO63C.js";
 import {
   DEFAULT_MNEMONIC,
   DotNS,
   parseDomainName,
   sanitizeDomainLabel
-} from "./chunk-RJDHC56V.js";
+} from "./chunk-ZZIOS4RG.js";
 import "./chunk-SI2ZUOYD.js";
+import "./chunk-ZG3HAH5A.js";
 import {
   BULLETIN_BLOCKS_PER_DAY,
   DEPLOY_PATH_PREFIX,
@@ -87,7 +88,7 @@ import {
   poolAccountDerivationPath,
   selectAccount
 } from "./chunk-FWJQAIVO.js";
-import "./chunk-ABMNC34K.js";
+import "./chunk-U2QO5G35.js";
 import "./chunk-TSPERKUS.js";
 import {
   DEFAULT_ENV_ID,
@@ -99,10 +100,9 @@ import {
   loadEnvironments,
   resolveEndpoints,
   validateContractAddresses
-} from "./chunk-NA3SXVY6.js";
-import "./chunk-ZOC4GITL.js";
-import "./chunk-VBIFKNUS.js";
-import "./chunk-IP6ABIIC.js";
+} from "./chunk-3NR3T7US.js";
+import "./chunk-CCIBF55X.js";
+import "./chunk-BFK5UCUJ.js";
 import {
   VERSION,
   loadRunState,
@@ -112,7 +112,8 @@ import {
   shouldSkipStaleWarning,
   stateFilePath,
   writeRunState
-} from "./chunk-KTKFHROI.js";
+} from "./chunk-OONQPYHM.js";
+import "./chunk-SH2LG52Z.js";
 import "./chunk-K5SP4OUC.js";
 export {
   BULLETIN_BLOCKS_PER_DAY,

package/dist/manifest/config-load.js

@@ -2,9 +2,9 @@ import {
   formatConfigLoadError,
   loadProductConfig,
   tryLoadProductConfig
-} from "../chunk-NKDGBZBP.js";
-import "../chunk-I5PNPQZO.js";
-import "../chunk-ZOC4GITL.js";
+} from "../chunk-O56KLG7Z.js";
+import "../chunk-ANX3RZAS.js";
+import "../chunk-SH2LG52Z.js";
 export {
   formatConfigLoadError,
   loadProductConfig,

package/dist/manifest/publish.d.ts

@@ -8,6 +8,7 @@ import '../manifest.js';
 import '../dotns-protocol.js';
 import '../environments.js';
 import '../errors.js';
+import '../mnemonic.js';
 import '../personhood/bootstrap.js';
 import '../personhood/bind-personal-id.js';
 import '../personhood/claim-pgas.js';

package/dist/manifest/publish.js

@@ -3,38 +3,39 @@ import {
   manifestSignerOptions,
   publishManifest,
   registerOrEnsureResolver
-} from "../chunk-H4OZ6PTA.js";
+} from "../chunk-C437RTTU.js";
 import "../chunk-YTRNJMI4.js";
 import "../chunk-DMNLTQGA.js";
-import "../chunk-NKDGBZBP.js";
-import "../chunk-I5PNPQZO.js";
-import "../chunk-6MSHWNJT.js";
+import "../chunk-O56KLG7Z.js";
+import "../chunk-ANX3RZAS.js";
+import "../chunk-D6BE3RAU.js";
+import "../chunk-6J4WRFRL.js";
+import "../chunk-GRPLHUYC.js";
 import "../chunk-HNJWIY55.js";
 import "../chunk-M5AKL3FL.js";
-import "../chunk-6FQJLLEF.js";
-import "../chunk-GRPLHUYC.js";
-import "../chunk-IW3X2MJF.js";
-import "../chunk-LPTKBQII.js";
-import "../chunk-3MAIF2SF.js";
-import "../chunk-WPC2PUCV.js";
-import "../chunk-QU5GJF6U.js";
-import "../chunk-SNFGJOR2.js";
-import "../chunk-PSYA6E5M.js";
+import "../chunk-D3YME2EG.js";
+import "../chunk-7DDOVCV5.js";
+import "../chunk-F24S4EV5.js";
+import "../chunk-H44LXDQJ.js";
+import "../chunk-UFP2XWZ4.js";
+import "../chunk-R3BXRRKE.js";
+import "../chunk-2P4EZOFF.js";
 import "../chunk-C2TS5MER.js";
-import "../chunk-3ACNAWUD.js";
+import "../chunk-JTH3ISLR.js";
 import "../chunk-JQKKMUCT.js";
-import "../chunk-5FLTDWWP.js";
 import "../chunk-RIRDBSBG.js";
-import "../chunk-RJDHC56V.js";
+import "../chunk-H44NO63C.js";
+import "../chunk-ZZIOS4RG.js";
 import "../chunk-SI2ZUOYD.js";
+import "../chunk-ZG3HAH5A.js";
 import "../chunk-FWJQAIVO.js";
-import "../chunk-ABMNC34K.js";
+import "../chunk-U2QO5G35.js";
 import "../chunk-TSPERKUS.js";
-import "../chunk-NA3SXVY6.js";
-import "../chunk-ZOC4GITL.js";
-import "../chunk-VBIFKNUS.js";
-import "../chunk-IP6ABIIC.js";
-import "../chunk-KTKFHROI.js";
+import "../chunk-3NR3T7US.js";
+import "../chunk-CCIBF55X.js";
+import "../chunk-BFK5UCUJ.js";
+import "../chunk-OONQPYHM.js";
+import "../chunk-SH2LG52Z.js";
 import "../chunk-K5SP4OUC.js";
 export {
   domainMatchesEnvTld,

package/dist/manifest/schema.js

@@ -2,7 +2,7 @@ import {
   validateExecutableManifest,
   validateProductConfig,
   validateRootManifest
-} from "../chunk-I5PNPQZO.js";
+} from "../chunk-ANX3RZAS.js";
 export {
   validateExecutableManifest,
   validateProductConfig,

package/dist/manifest-embed.js

@@ -1,8 +1,8 @@
 import {
   finaliseEmbeddedManifest,
   writeEmbeddedManifestPlaceholder
-} from "./chunk-LPTKBQII.js";
-import "./chunk-WPC2PUCV.js";
+} from "./chunk-7DDOVCV5.js";
+import "./chunk-H44LXDQJ.js";
 export {
   finaliseEmbeddedManifest,
   writeEmbeddedManifestPlaceholder

package/dist/manifest-fetch.js

@@ -10,8 +10,8 @@ import {
   readPersistentLocalManifest,
   walkDagToManifest,
   writePersistentLocalManifest
-} from "./chunk-3MAIF2SF.js";
-import "./chunk-WPC2PUCV.js";
+} from "./chunk-F24S4EV5.js";
+import "./chunk-H44LXDQJ.js";
 export {
   CHAIN_TIER_TIMEOUT_MS,
   DEFAULT_TIMEOUT_MS,

package/dist/manifest-roundtrip.js

@@ -1,7 +1,7 @@
 import {
   extractManifestFromCar
-} from "./chunk-3MAIF2SF.js";
-import "./chunk-WPC2PUCV.js";
+} from "./chunk-F24S4EV5.js";
+import "./chunk-H44LXDQJ.js";
 
 // src/manifest-roundtrip.ts
 async function fetchManifestRoundtrip(cid, options) {

package/dist/manifest.d.ts

@@ -24,6 +24,19 @@ interface EmbeddedManifest {
     blocks: string[];
     chunks: Record<string, ManifestChunkEntry>;
 }
+declare const CONTENT_HASH_RE: RegExp;
+type FrameworkRules = {
+    /** Prefixes the bundler content-addresses wholesale — every file under them is stable. */
+    stablePrefixes?: readonly string[];
+    /** A hash shape accepted ONLY under the given prefix. */
+    scopedHashRe?: readonly {
+        prefix: string;
+        re: RegExp;
+    }[];
+    /** Basenames that stay volatile even inside a stablePrefix. */
+    volatileExact?: readonly string[];
+};
+declare const FRAMEWORK_RULES: Record<string, FrameworkRules>;
 declare function isVolatilePath(p: string): boolean;
 type ClassifyContext = {
     prevManifest?: EmbeddedManifest | null;
@@ -41,4 +54,4 @@ type ParseResult = {
 };
 declare function parseManifest(raw: string): ParseResult;
 
-export { type ClassifyContext, type EmbeddedManifest, type FileType, MANIFEST_DIR, MANIFEST_FILENAME, MANIFEST_PATH, MANIFEST_VERSION, type ManifestChunkEntry, type ManifestFileEntry, type ParseResult, classifyFile, classifyFileHeuristic, isVolatilePath, parseManifest };
+export { CONTENT_HASH_RE, type ClassifyContext, type EmbeddedManifest, FRAMEWORK_RULES, type FileType, type FrameworkRules, MANIFEST_DIR, MANIFEST_FILENAME, MANIFEST_PATH, MANIFEST_VERSION, type ManifestChunkEntry, type ManifestFileEntry, type ParseResult, classifyFile, classifyFileHeuristic, isVolatilePath, parseManifest };

package/dist/manifest.js

@@ -1,4 +1,6 @@
 import {
+  CONTENT_HASH_RE,
+  FRAMEWORK_RULES,
   MANIFEST_DIR,
   MANIFEST_FILENAME,
   MANIFEST_PATH,
@@ -7,8 +9,10 @@ import {
   classifyFileHeuristic,
   isVolatilePath,
   parseManifest
-} from "./chunk-WPC2PUCV.js";
+} from "./chunk-H44LXDQJ.js";
 export {
+  CONTENT_HASH_RE,
+  FRAMEWORK_RULES,
   MANIFEST_DIR,
   MANIFEST_FILENAME,
   MANIFEST_PATH,

package/dist/memory-report.js

@@ -5,8 +5,9 @@ import {
   maybeWriteMemoryReport,
   safeHeap,
   sampleFromBytes
-} from "./chunk-IP6ABIIC.js";
-import "./chunk-KTKFHROI.js";
+} from "./chunk-BFK5UCUJ.js";
+import "./chunk-OONQPYHM.js";
+import "./chunk-SH2LG52Z.js";
 export {
   DEFAULT_THRESHOLD_MB,
   buildMemoryReport,

package/dist/merkle.js

@@ -6,33 +6,34 @@ import {
   merkleizeKuboBackend,
   merkleizeWithStableOrder,
   rebuildOrderedCarFromBytes
-} from "./chunk-6MSHWNJT.js";
+} from "./chunk-D6BE3RAU.js";
+import "./chunk-6J4WRFRL.js";
+import "./chunk-GRPLHUYC.js";
 import "./chunk-HNJWIY55.js";
 import "./chunk-M5AKL3FL.js";
-import "./chunk-6FQJLLEF.js";
-import "./chunk-GRPLHUYC.js";
-import "./chunk-IW3X2MJF.js";
-import "./chunk-LPTKBQII.js";
-import "./chunk-3MAIF2SF.js";
-import "./chunk-WPC2PUCV.js";
-import "./chunk-QU5GJF6U.js";
-import "./chunk-SNFGJOR2.js";
-import "./chunk-PSYA6E5M.js";
+import "./chunk-D3YME2EG.js";
+import "./chunk-7DDOVCV5.js";
+import "./chunk-F24S4EV5.js";
+import "./chunk-H44LXDQJ.js";
+import "./chunk-UFP2XWZ4.js";
+import "./chunk-R3BXRRKE.js";
+import "./chunk-2P4EZOFF.js";
 import "./chunk-C2TS5MER.js";
-import "./chunk-3ACNAWUD.js";
+import "./chunk-JTH3ISLR.js";
 import "./chunk-JQKKMUCT.js";
-import "./chunk-5FLTDWWP.js";
 import "./chunk-RIRDBSBG.js";
-import "./chunk-RJDHC56V.js";
+import "./chunk-H44NO63C.js";
+import "./chunk-ZZIOS4RG.js";
 import "./chunk-SI2ZUOYD.js";
+import "./chunk-ZG3HAH5A.js";
 import "./chunk-FWJQAIVO.js";
-import "./chunk-ABMNC34K.js";
+import "./chunk-U2QO5G35.js";
 import "./chunk-TSPERKUS.js";
-import "./chunk-NA3SXVY6.js";
-import "./chunk-ZOC4GITL.js";
-import "./chunk-VBIFKNUS.js";
-import "./chunk-IP6ABIIC.js";
-import "./chunk-KTKFHROI.js";
+import "./chunk-3NR3T7US.js";
+import "./chunk-CCIBF55X.js";
+import "./chunk-BFK5UCUJ.js";
+import "./chunk-OONQPYHM.js";
+import "./chunk-SH2LG52Z.js";
 import "./chunk-K5SP4OUC.js";
 export {
   buildOrderedCar,

package/dist/mnemonic.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Resolve the mnemonic that should be used to sign, in precedence order:
+ * `--mnemonic` flag / caller-supplied value > `MNEMONIC` env var >
+ * `DOTNS_MNEMONIC` env var.
+ *
+ * `MNEMONIC` is the documented primary (README, `--help`, error messages
+ * all name it first); `DOTNS_MNEMONIC` is the DotNS-scoped legacy alias.
+ *
+ * Empty-string / whitespace-only values are treated as unset rather than as
+ * a valid (empty) mnemonic. Without this, a declared-but-blank env var (e.g.
+ * a GitHub Actions `MNEMONIC: ${{ secrets.X }}` step where the secret was
+ * never set, which resolves to `""`) would win over a real lower-precedence
+ * value, or fall all the way through to DotNS's own dev-key default —
+ * silently signing with the wrong key instead of falling back correctly.
+ */
+declare function resolveEffectiveMnemonic(opts: {
+    flagMnemonic: string | undefined;
+    envMnemonic: string | undefined;
+    envDotnsMnemonic: string | undefined;
+}): string | undefined;
+/**
+ * Pure notice for when `MNEMONIC` and `DOTNS_MNEMONIC` are both set to
+ * different values, so the choice `resolveEffectiveMnemonic` makes between
+ * them is observable rather than silent (#1461). Returns `null` when there
+ * is nothing ambiguous to report (either is unset/blank, or they agree).
+ *
+ * Never includes either mnemonic's value — only the two env var names — so
+ * this is safe to print to stdout/stderr without leaking key material.
+ */
+declare function mnemonicConflictNotice(opts: {
+    envMnemonic: string | undefined;
+    envDotnsMnemonic: string | undefined;
+}): string | null;
+
+export { mnemonicConflictNotice, resolveEffectiveMnemonic };

package/dist/mnemonic.js

@@ -0,0 +1,8 @@
+import {
+  mnemonicConflictNotice,
+  resolveEffectiveMnemonic
+} from "./chunk-ZG3HAH5A.js";
+export {
+  mnemonicConflictNotice,
+  resolveEffectiveMnemonic
+};