bulletin-deploy 0.19.4 → 0.20.0-rc.2

package/bin/bulletin-deploy

@@ -6,15 +6,20 @@
 // SDK modules that trigger the "@parity/product-sdk-logger" localStorage warning.
 import "../dist/suppress-localstorage-warning.js";
 
-import { deploy, DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE, NonRetryableError, EXIT_CODE_NO_RETRY, isConnectionError, isBenignTeardownError, resolveEffectiveMnemonic, mnemonicConflictNotice, resolveEnvId, shouldPublishManifest, nonInteractivePhoneConfirmationError } from "../dist/deploy.js";
+import { deploy, DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE, NonRetryableError, EXIT_CODE_NO_RETRY, isConnectionError, isBenignTeardownError, resolveEffectiveMnemonic, mnemonicConflictNotice, resolveEnvId, shouldPublishManifest, nonInteractivePhoneConfirmationError, printDeploymentCompleteBanner } from "../dist/deploy.js";
 import { VERSION, setDeployAttribute, captureWarning, closeTelemetry, setRunStateActive, markRelaunchOomHintShown, setVersionFreshness } from "../dist/telemetry.js";
 import { handleFailedDeploy, handlePreflightVersionCheck, fetchVersionInfo, preReleaseWarning, checkNodeVersion, classifyVersionFreshness, isInteractive } from "../dist/version-check.js";
 import { setDeployContext, installLogCapture, buildCliFlagsSummary } from "../dist/bug-report.js";
 import { loadRunState, writeRunState, shouldSkipStaleWarning, shouldShowOomHint, probablyOomRssMb } from "../dist/run-state.js";
-import { loadEnvironments, listEnvironments, formatEnvironmentTable, DEFAULT_ENV_ID } from "../dist/environments.js";
+import { loadEnvironments, listEnvironments, formatEnvironmentTable, resolveEndpoints, DEFAULT_ENV_ID } from "../dist/environments.js";
+import { DEFAULT_TLD } from "../dist/dotns.js";
+import { GuardedWebSocket } from "../dist/ws.js";
 import * as fs from "fs";
 import * as readline from "readline";
 
+// The SSO SDKs build their own papi providers from the global WebSocket.
+globalThis.WebSocket = GuardedWebSocket;
+
 // Install early so anything printed during flag parsing / preflight is
 // available to the bug-report log tail.
 installLogCapture();
@@ -454,25 +459,68 @@ try {
   // #1163: --no-manifest (--content-only) skips this entirely — the deploy is
   // content-only regardless of any discoverable config, so there's nothing to
   // preflight.
+  //
+  // #1164: hoisted so the SAME loaded config (one filesystem walk-up + parse)
+  // can drive both the manifestPending banner decision below and the actual
+  // publishManifest() call further down — previously each of those three call
+  // sites (this preflight, the banner decision, the publish block) reloaded
+  // the config independently. resolveConfigPath resolves `cwd` via
+  // `path.resolve(options.cwd ?? process.cwd())` (src/manifest/config-load.ts),
+  // which is idempotent, so reusing this result (loaded with the raw
+  // `buildDir`) is identical to the publish block's old `buildDirAbs`-based
+  // reload.
+  let preflightedConfig = null;
   if (!flags.noManifest) {
     try {
-      const { preflightProductConfig } = await import("../dist/index.js");
+      const { preflightProductConfig, reconcileManifestDomain } = await import("../dist/index.js");
       // config-load resolves a relative cwd internally, so no node:path here
       // (it's only dynamically imported later, in the publish block).
-      await preflightProductConfig(
-        flags.config ? { path: flags.config } : { cwd: buildDir, walkUp: true },
-      );
+      // #1156: preflightProductConfig (config discovery/parse + icon/executable
+      // file checks) and loadEnvironments (a local environments.json read)
+      // have no data dependency on each other — run them concurrently rather
+      // than paying their I/O sequentially.
+      const [loadedConfig, { doc }] = await Promise.all([
+        preflightProductConfig(
+          flags.config ? { path: flags.config } : { cwd: buildDir, walkUp: true },
+        ),
+        // No options: flags.environmentFile was already copied into
+        // process.env.BULLETIN_DEPLOY_ENV_FILE above, which loadEnvironments
+        // reads as its own default — passing it again here would just be
+        // recomputing that same fallback.
+        loadEnvironments(),
+      ]);
+      preflightedConfig = loadedConfig;
+      // Reconcile the config's domain against the ACTUAL deploy target
+      // BEFORE deploy() runs at all — this is the real "nothing uploaded
+      // yet" gate; src/manifest/publish.ts's own call to the same helper
+      // (inside publishManifest) is only a backstop for a library caller
+      // that skips this CLI entirely. Same env/TLD resolution publishManifest
+      // itself uses (loadEnvironments + resolveEndpoints), so this sees the
+      // identical environment the deploy will target — no RPC call, both are
+      // local config reads.
+      if (loadedConfig) {
+        const resolved = resolveEndpoints(doc, effectiveEnvId ?? DEFAULT_ENV_ID);
+        const envTld = resolved.tld ?? DEFAULT_TLD;
+        reconcileManifestDomain(loadedConfig.config.domain, domain, envTld, loadedConfig.sourcePath);
+      }
     } catch (err) {
       console.error(`Error: ${err?.message ?? err}`);
       process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
     }
   }
 
+  // #1164: determine up front whether a manifest publish will follow, so
+  // deploy() can defer the "DEPLOYMENT COMPLETE" banner until publishManifest
+  // actually succeeds. Reuses the SAME preflightedConfig loaded just above —
+  // no second config load.
+  const manifestWillPublish = shouldPublishManifest({ configFound: !!preflightedConfig, noManifest: !!flags.noManifest });
+
   const result = await deploy(buildDir, domain, {
     mnemonic: effectiveMnemonic,
     derivationPath: flags.derivationPath,
     productName: flags.productName,
     suri: flags.suri,
+    manifestPending: manifestWillPublish,
     rpc: flags.rpc,
     env: effectiveEnvId,
     poolSize: flags.poolSize,
@@ -569,16 +617,15 @@ try {
   //
   // #1163: --no-manifest (--content-only) skips manifest publishing even when
   // a config is present. shouldPublishManifest() is the single source of
-  // truth for that decision (config discovery still runs either way, so the
-  // "config found but --no-manifest set" case is exercised for real, not just
-  // in unit tests).
+  // truth for that decision.
+  //
+  // #1164: reuses `preflightedConfig` (loaded once, above) instead of a third
+  // independent tryLoadProductConfig call.
   {
-    const { tryLoadProductConfig, publishManifest } = await import("../dist/index.js");
+    const { publishManifest } = await import("../dist/index.js");
     const path = await import("node:path");
     const buildDirAbs = path.resolve(buildDir);
-    const loaded = await tryLoadProductConfig(
-      flags.config ? { path: flags.config } : { cwd: buildDirAbs, walkUp: true },
-    );
+    const loaded = preflightedConfig;
     if (shouldPublishManifest({ configFound: !!loaded, noManifest: !!flags.noManifest })) {
       try {
         await publishManifest({
@@ -596,6 +643,11 @@ try {
           storageSigner: result.storageSigner,
           storageSignerAddress: result.storageSignerAddress,
         });
+        // #1164: deploy() deferred the real completion banner (manifestPending
+        // was set above) — print it now that the manifest phase actually
+        // succeeded, so a manifest publish failure never leaves a false
+        // "DEPLOYMENT COMPLETE!" on screen.
+        printDeploymentCompleteBanner(result.fullDomain, result.browserUrl);
       } catch (err) {
         console.error(`Manifest publish failed: ${err?.message ?? err}`);
         process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);

package/dist/auth/index.d.ts

@@ -1,7 +1,8 @@
-export { A as AuthClient, a as AuthConfig, C as ConnectResult, L as LoginHandle, b as LoginStatus, c as LogoutHandle, d as LogoutStatus, S as SessionAddresses, e as SessionHandle, f as createAuthClient } from '../auth-CA_YKtM2.js';
+export { AuthClient, ConnectResult, LoginHandle, LoginStatus, LogoutHandle, LogoutStatus, SessionAddresses, SessionHandle, createAuthClient } from './vendor/auth.js';
 export { renderQrCode } from '@parity/product-sdk-terminal';
-export { R as ResolvedSigner, S as SignerNotAvailableError, r as resolveSigner } from '../signer-Duup0hgQ.js';
-export { A as AllocatableResource, a as AllocationOutcome, b as AllocationSummary, B as BULLETIN_RESOURCE, D as DEFAULT_RESOURCES, c as createSlotAccountSigner, r as requestResourceAllocation, s as summarizeOutcomes } from '../allocations-CEPeZr6T.js';
-export { renderLoginStatus, renderLogoutStatus } from './vendor/ui/index.js';
+export { ResolvedSigner, SignerNotAvailableError, resolveSigner } from './vendor/signer.js';
+export { AllocatableResource, AllocationOutcome, AllocationSummary, BULLETIN_RESOURCE, DEFAULT_RESOURCES, createSlotAccountSigner, requestResourceAllocation, summarizeOutcomes } from './vendor/allocations.js';
+export { AuthConfig } from './vendor/types.js';
+export { renderLoginStatus, renderLogoutStatus } from './vendor/ui/status.js';
 import 'polkadot-api';
 import '@parity/product-sdk-tx';

package/dist/auth/index.js

@@ -1,21 +1,30 @@
 import "../chunk-JQKKMUCT.js";
+import "../chunk-DFKEG3WY.js";
 import {
-  renderLoginStatus,
-  renderLogoutStatus,
   renderQrCode
-} from "../chunk-RIRDBSBG.js";
+} from "../chunk-RPBMNTGZ.js";
+import {
+  renderLoginStatus,
+  renderLogoutStatus
+} from "../chunk-YP3LINCF.js";
+import "../chunk-NJKXXDDK.js";
+import {
+  createAuthClient
+} from "../chunk-G7EH3XIW.js";
 import {
   BULLETIN_RESOURCE,
   DEFAULT_RESOURCES,
-  SignerNotAvailableError,
-  createAuthClient,
   createSlotAccountSigner,
   requestResourceAllocation,
-  resolveSigner,
   summarizeOutcomes
-} from "../chunk-H44NO63C.js";
-import "../chunk-TSPERKUS.js";
+} from "../chunk-7SXO544V.js";
+import "../chunk-S6CPT2TU.js";
+import {
+  SignerNotAvailableError,
+  resolveSigner
+} from "../chunk-2C6SLLBI.js";
 import "../chunk-SH2LG52Z.js";
+import "../chunk-DNXE3Q5D.js";
 export {
   BULLETIN_RESOURCE,
   DEFAULT_RESOURCES,

package/dist/{allocations-CEPeZr6T.d.ts → auth/vendor/allocations.d.ts}

@@ -108,4 +108,4 @@ declare function summarizeOutcomes(outcomes: AllocationOutcome[], resources: All
  */
 declare function createSlotAccountSigner(adapter: TerminalAdapter, resource: AllocatableResource): Promise<polkadot_api.PolkadotSigner | null>;
 
-export { type AllocatableResource as A, BULLETIN_RESOURCE as B, DEFAULT_RESOURCES as D, type OnExistingAllowancePolicy as O, type ResourceTag as R, type AllocationOutcome as a, type AllocationSummary as b, createSlotAccountSigner as c, requestResourceAllocation as r, summarizeOutcomes as s };
+export { type AllocatableResource, type AllocationOutcome, type AllocationSummary, BULLETIN_RESOURCE, DEFAULT_RESOURCES, type OnExistingAllowancePolicy, type ResourceTag, createSlotAccountSigner, requestResourceAllocation, summarizeOutcomes };

package/dist/auth/vendor/allocations.js

@@ -0,0 +1,14 @@
+import {
+  BULLETIN_RESOURCE,
+  DEFAULT_RESOURCES,
+  createSlotAccountSigner,
+  requestResourceAllocation,
+  summarizeOutcomes
+} from "../../chunk-7SXO544V.js";
+export {
+  BULLETIN_RESOURCE,
+  DEFAULT_RESOURCES,
+  createSlotAccountSigner,
+  requestResourceAllocation,
+  summarizeOutcomes
+};

package/dist/{auth-CA_YKtM2.d.ts → auth/vendor/auth.d.ts}

@@ -1,30 +1,7 @@
 import { TerminalAdapter, UserSession } from '@parity/product-sdk-terminal';
 import { PolkadotSigner } from 'polkadot-api';
-import { A as AllocatableResource, O as OnExistingAllowancePolicy, a as AllocationOutcome } from './allocations-CEPeZr6T.js';
-
-/**
- * Per-product configuration injected into `createAuthClient`. Lifting the
- * sign-in glue out of playground-cli (issue #411) means the env-specific
- * constants playground hard-coded in its `config.ts` (DAPP_ID, product id,
- * metadata URL, People-chain endpoints) become consumer-supplied so the same
- * package serves `playground` and `dot` (and future products) unchanged.
- */
-interface AuthConfig {
-    /** The dApp identity string. Scopes the on-disk session namespace
-     *  (`~/.polkadot-apps/${dappId}_*`) and the SSO pairing — each product
-     *  gets its own, independently-revocable session. */
-    dappId: string;
-    /** Product id used to derive the product account (`/product/{productId}/{index}`). */
-    productId: string;
-    /** Derivation index of the product account (0 = default). */
-    derivationIndex: number;
-    /** Wallet-facing app name shown on the Sign-In screen (sent inline at pairing). */
-    hostName: string;
-    /** Host app version sent inline at pairing. */
-    hostVersion: string;
-    /** People-parachain RPC endpoints the terminal adapter connects to. */
-    peopleEndpoints: string[];
-}
+import { AllocatableResource, OnExistingAllowancePolicy, AllocationOutcome } from './allocations.js';
+import { AuthConfig } from './types.js';
 
 /**
  * The three addresses we surface from a paired session.
@@ -125,4 +102,4 @@ interface AuthClient {
  */
 declare function createAuthClient(config: AuthConfig): AuthClient;
 
-export { type AuthClient as A, type ConnectResult as C, type LoginHandle as L, type SessionAddresses as S, type AuthConfig as a, type LoginStatus as b, type LogoutHandle as c, type LogoutStatus as d, type SessionHandle as e, createAuthClient as f };
+export { type AuthClient, type ConnectResult, type LoginHandle, type LoginStatus, type LogoutHandle, type LogoutStatus, type SessionAddresses, type SessionHandle, createAuthClient };

package/dist/auth/vendor/auth.js

@@ -0,0 +1,10 @@
+import {
+  createAuthClient
+} from "../../chunk-G7EH3XIW.js";
+import "../../chunk-7SXO544V.js";
+import "../../chunk-S6CPT2TU.js";
+import "../../chunk-SH2LG52Z.js";
+import "../../chunk-DNXE3Q5D.js";
+export {
+  createAuthClient
+};

package/dist/auth/vendor/index.d.ts

@@ -1,32 +1,8 @@
-export { A as AuthClient, a as AuthConfig, C as ConnectResult, L as LoginHandle, b as LoginStatus, c as LogoutHandle, d as LogoutStatus, S as SessionAddresses, e as SessionHandle, f as createAuthClient } from '../../auth-CA_YKtM2.js';
-import { UserSession } from '@parity/product-sdk-terminal';
-import { PolkadotSigner } from 'polkadot-api';
-export { R as ResolvedSigner, S as SignerNotAvailableError, a as SignerOptions, b as SignerSource, p as parseDevAccountName, r as resolveSigner } from '../../signer-Duup0hgQ.js';
-export { A as AllocatableResource, a as AllocationOutcome, b as AllocationSummary, B as BULLETIN_RESOURCE, D as DEFAULT_RESOURCES, O as OnExistingAllowancePolicy, R as ResourceTag, c as createSlotAccountSigner, r as requestResourceAllocation, s as summarizeOutcomes } from '../../allocations-CEPeZr6T.js';
+export { AuthClient, ConnectResult, LoginHandle, LoginStatus, LogoutHandle, LogoutStatus, SessionAddresses, SessionHandle, createAuthClient } from './auth.js';
+export { INCOMPLETE_SESSION_MESSAGE, ProductAccountRef, createSessionSigner, deriveProductPublicKey, sessionRootPublicKey } from './sessionSigner.js';
+export { ResolvedSigner, SignerNotAvailableError, SignerOptions, SignerSource, parseDevAccountName, resolveSigner } from './signer.js';
+export { AllocatableResource, AllocationOutcome, AllocationSummary, BULLETIN_RESOURCE, DEFAULT_RESOURCES, OnExistingAllowancePolicy, ResourceTag, createSlotAccountSigner, requestResourceAllocation, summarizeOutcomes } from './allocations.js';
+export { AuthConfig } from './types.js';
+import '@parity/product-sdk-terminal';
+import 'polkadot-api';
 import '@parity/product-sdk-tx';
-
-interface ProductAccountRef {
-    productId: string;
-    derivationIndex: number;
-}
-declare const INCOMPLETE_SESSION_MESSAGE = "Stored login session is missing the root account public key. Run \"logout\" and then \"login\" to pair again.";
-declare function sessionRootPublicKey(session: UserSession): Uint8Array;
-/**
- * Soft-derive the product account public key off a wallet root.
- *
- * This is the single source of truth for product-account math. Both
- * `createSessionSigner` (which builds the signer used to actually sign
- * on-chain) and `deriveSessionAddresses` (which builds the display triple)
- * go through here so a future change to derivation params can't silently
- * desync the signer from what we print.
- *
- * sr25519 soft derivation is composable on public keys alone, so deriving
- * from `rootAccountId` locally produces the SAME public key the mobile
- * derives privately via `mnemonic + "/product/...{idx}"`. Algorithm parity
- * with mobile/desktop is locked by the frozen vectors in
- * `@parity/product-sdk-keys`'s `product-account.test.ts`.
- */
-declare function deriveProductPublicKey(rootAccountId: Uint8Array, ref: ProductAccountRef): Uint8Array;
-declare function createSessionSigner(session: UserSession, ref: ProductAccountRef): PolkadotSigner;
-
-export { INCOMPLETE_SESSION_MESSAGE, type ProductAccountRef, createSessionSigner, deriveProductPublicKey, sessionRootPublicKey };

package/dist/auth/vendor/index.js

@@ -1,20 +1,27 @@
+import "../../chunk-NJKXXDDK.js";
+import {
+  createAuthClient
+} from "../../chunk-G7EH3XIW.js";
 import {
   BULLETIN_RESOURCE,
   DEFAULT_RESOURCES,
+  createSlotAccountSigner,
+  requestResourceAllocation,
+  summarizeOutcomes
+} from "../../chunk-7SXO544V.js";
+import {
   INCOMPLETE_SESSION_MESSAGE,
-  SignerNotAvailableError,
-  createAuthClient,
   createSessionSigner,
-  createSlotAccountSigner,
   deriveProductPublicKey,
+  sessionRootPublicKey
+} from "../../chunk-S6CPT2TU.js";
+import {
+  SignerNotAvailableError,
   parseDevAccountName,
-  requestResourceAllocation,
-  resolveSigner,
-  sessionRootPublicKey,
-  summarizeOutcomes
-} from "../../chunk-H44NO63C.js";
-import "../../chunk-TSPERKUS.js";
+  resolveSigner
+} from "../../chunk-2C6SLLBI.js";
 import "../../chunk-SH2LG52Z.js";
+import "../../chunk-DNXE3Q5D.js";
 export {
   BULLETIN_RESOURCE,
   DEFAULT_RESOURCES,

package/dist/auth/vendor/sessionSigner.d.ts

@@ -0,0 +1,28 @@
+import { UserSession } from '@parity/product-sdk-terminal';
+import { PolkadotSigner } from 'polkadot-api';
+
+interface ProductAccountRef {
+    productId: string;
+    derivationIndex: number;
+}
+declare const INCOMPLETE_SESSION_MESSAGE = "Stored login session is missing the root account public key. Run \"logout\" and then \"login\" to pair again.";
+declare function sessionRootPublicKey(session: UserSession): Uint8Array;
+/**
+ * Soft-derive the product account public key off a wallet root.
+ *
+ * This is the single source of truth for product-account math. Both
+ * `createSessionSigner` (which builds the signer used to actually sign
+ * on-chain) and `deriveSessionAddresses` (which builds the display triple)
+ * go through here so a future change to derivation params can't silently
+ * desync the signer from what we print.
+ *
+ * sr25519 soft derivation is composable on public keys alone, so deriving
+ * from `rootAccountId` locally produces the SAME public key the mobile
+ * derives privately via `mnemonic + "/product/...{idx}"`. Algorithm parity
+ * with mobile/desktop is locked by the frozen vectors in
+ * `@parity/product-sdk-keys`'s `product-account.test.ts`.
+ */
+declare function deriveProductPublicKey(rootAccountId: Uint8Array, ref: ProductAccountRef): Uint8Array;
+declare function createSessionSigner(session: UserSession, ref: ProductAccountRef): PolkadotSigner;
+
+export { INCOMPLETE_SESSION_MESSAGE, type ProductAccountRef, createSessionSigner, deriveProductPublicKey, sessionRootPublicKey };

package/dist/auth/vendor/sessionSigner.js

@@ -0,0 +1,14 @@
+import {
+  INCOMPLETE_SESSION_MESSAGE,
+  createSessionSigner,
+  deriveProductPublicKey,
+  sessionRootPublicKey
+} from "../../chunk-S6CPT2TU.js";
+import "../../chunk-SH2LG52Z.js";
+import "../../chunk-DNXE3Q5D.js";
+export {
+  INCOMPLETE_SESSION_MESSAGE,
+  createSessionSigner,
+  deriveProductPublicKey,
+  sessionRootPublicKey
+};

package/dist/{signer-Duup0hgQ.d.ts → auth/vendor/signer.d.ts}

@@ -1,6 +1,9 @@
 import { DevAccountName } from '@parity/product-sdk-tx';
 import { PolkadotSigner } from 'polkadot-api';
-import { e as SessionHandle, S as SessionAddresses, A as AuthClient } from './auth-CA_YKtM2.js';
+import { SessionHandle, SessionAddresses, AuthClient } from './auth.js';
+import '@parity/product-sdk-terminal';
+import './allocations.js';
+import './types.js';
 
 type SignerSource = "dev" | "session";
 interface ResolvedSigner {
@@ -32,4 +35,4 @@ declare function parseDevAccountName(suri: string): DevAccountName | null;
  */
 declare function resolveSigner(authClient: AuthClient, options?: SignerOptions): Promise<ResolvedSigner>;
 
-export { type ResolvedSigner as R, SignerNotAvailableError as S, type SignerOptions as a, type SignerSource as b, parseDevAccountName as p, resolveSigner as r };
+export { type ResolvedSigner, SignerNotAvailableError, type SignerOptions, type SignerSource, parseDevAccountName, resolveSigner };

package/dist/auth/vendor/signer.js

@@ -0,0 +1,10 @@
+import {
+  SignerNotAvailableError,
+  parseDevAccountName,
+  resolveSigner
+} from "../../chunk-2C6SLLBI.js";
+export {
+  SignerNotAvailableError,
+  parseDevAccountName,
+  resolveSigner
+};

package/dist/auth/vendor/types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Per-product configuration injected into `createAuthClient`. Lifting the
+ * sign-in glue out of playground-cli (issue #411) means the env-specific
+ * constants playground hard-coded in its `config.ts` (DAPP_ID, product id,
+ * metadata URL, People-chain endpoints) become consumer-supplied so the same
+ * package serves `playground` and `dot` (and future products) unchanged.
+ */
+interface AuthConfig {
+    /** The dApp identity string. Scopes the on-disk session namespace
+     *  (`~/.polkadot-apps/${dappId}_*`) and the SSO pairing — each product
+     *  gets its own, independently-revocable session. */
+    dappId: string;
+    /** Product id used to derive the product account (`/product/{productId}/{index}`). */
+    productId: string;
+    /** Derivation index of the product account (0 = default). */
+    derivationIndex: number;
+    /** Wallet-facing app name shown on the Sign-In screen (sent inline at pairing). */
+    hostName: string;
+    /** Host app version sent inline at pairing. */
+    hostVersion: string;
+    /** People-parachain RPC endpoints the terminal adapter connects to. */
+    peopleEndpoints: string[];
+}
+
+export type { AuthConfig };

package/dist/auth/vendor/ui/index.d.ts

@@ -1,15 +1,6 @@
 export { renderQrCode } from '@parity/product-sdk-terminal';
-import { b as LoginStatus, d as LogoutStatus } from '../../../auth-CA_YKtM2.js';
+export { renderLoginStatus, renderLogoutStatus } from './status.js';
+import '../auth.js';
 import 'polkadot-api';
-import '../../../allocations-CEPeZr6T.js';
-
-/**
- * Pure formatters that map the `LoginStatus` / `LogoutStatus` streams to
- * one-line terminal messages. No I/O, no terminal deps — `import type` only,
- * so this module stays unit-testable without the SSO stack.
- */
-
-declare function renderLoginStatus(status: LoginStatus): string;
-declare function renderLogoutStatus(status: LogoutStatus): string;
-
-export { renderLoginStatus, renderLogoutStatus };
+import '../allocations.js';
+import '../types.js';

package/dist/auth/vendor/ui/index.js

@@ -1,8 +1,11 @@
+import "../../../chunk-DFKEG3WY.js";
 import {
-  renderLoginStatus,
-  renderLogoutStatus,
   renderQrCode
-} from "../../../chunk-RIRDBSBG.js";
+} from "../../../chunk-RPBMNTGZ.js";
+import {
+  renderLoginStatus,
+  renderLogoutStatus
+} from "../../../chunk-YP3LINCF.js";
 export {
   renderLoginStatus,
   renderLogoutStatus,

package/dist/auth/vendor/ui/qr.d.ts

@@ -0,0 +1 @@
+export { renderQrCode } from '@parity/product-sdk-terminal';

package/dist/auth/vendor/ui/qr.js

@@ -0,0 +1,6 @@
+import {
+  renderQrCode
+} from "../../../chunk-RPBMNTGZ.js";
+export {
+  renderQrCode
+};

package/dist/auth/vendor/ui/status.d.ts

@@ -0,0 +1,16 @@
+import '@parity/product-sdk-terminal';
+import { LoginStatus, LogoutStatus } from '../auth.js';
+import 'polkadot-api';
+import '../allocations.js';
+import '../types.js';
+
+/**
+ * Pure formatters that map the `LoginStatus` / `LogoutStatus` streams to
+ * one-line terminal messages. No I/O, no terminal deps — `import type` only,
+ * so this module stays unit-testable without the SSO stack.
+ */
+
+declare function renderLoginStatus(status: LoginStatus): string;
+declare function renderLogoutStatus(status: LogoutStatus): string;
+
+export { renderLoginStatus, renderLogoutStatus };

package/dist/auth/vendor/ui/status.js

@@ -0,0 +1,8 @@
+import {
+  renderLoginStatus,
+  renderLogoutStatus
+} from "../../../chunk-YP3LINCF.js";
+export {
+  renderLoginStatus,
+  renderLogoutStatus
+};

package/dist/auth-config.d.ts

@@ -1,8 +1,9 @@
-import { a as AuthConfig, A as AuthClient } from './auth-CA_YKtM2.js';
+import { AuthClient } from './auth/vendor/auth.js';
+import { AuthConfig } from './auth/vendor/types.js';
 import { EnvironmentsDoc } from './environments.js';
 import '@parity/product-sdk-terminal';
 import 'polkadot-api';
-import './allocations-CEPeZr6T.js';
+import './auth/vendor/allocations.js';
 
 /** dApp identity: scopes the SSO session namespace + terminal allowance cache on disk
  *  and the wallet pairing product. Aligned to the app's dedicated id "polkadot-app-deploy". */
@@ -24,6 +25,14 @@ declare const DOT_HOST_NAME = "polkadot-app-deploy";
  * The adapter silently returns [] in this case; we surface the cause and recovery steps.
  */
 declare const STALE_SESSION_MESSAGE: string;
+/**
+ * Deploy-specific variant of STALE_SESSION_MESSAGE. See src/deploy-actors.ts's
+ * resolveDeployActors for the full rationale (issue #234) — in short, `deploy`
+ * has a remedy `whoami` doesn't: an explicit `--mnemonic` / `MNEMONIC` signer,
+ * which wins even when the persisted session can't be read. Naming it here
+ * means the fail-fast error doesn't just point at re-pairing.
+ */
+declare const STALE_SESSION_DEPLOY_MESSAGE = "Stored login session could not be read \u2014 it may have been written by an older version. Run \"bulletin-deploy logout\", then \"bulletin-deploy login\" to pair again. Or pass --mnemonic explicitly to sign with a different key.";
 /**
  * Returns true if there is a persisted SSO session file on disk.
  * Does NOT load the SSO stack — uses only node fs/os/path.
@@ -63,4 +72,4 @@ declare function getPeopleChainEndpoints(envId: string): Promise<string[]>;
  */
 declare function getAuthClient(envId: string): Promise<AuthClient>;
 
-export { DOT_DAPP_ID, DOT_DERIVATION_INDEX, DOT_HOST_NAME, DOT_PRODUCT_ID, STALE_SESSION_MESSAGE, buildAuthConfig, getAuthClient, getPeopleChainEndpoints, hasPersistedSession, resolveBulletinEndpoints };
+export { DOT_DAPP_ID, DOT_DERIVATION_INDEX, DOT_HOST_NAME, DOT_PRODUCT_ID, STALE_SESSION_DEPLOY_MESSAGE, STALE_SESSION_MESSAGE, buildAuthConfig, getAuthClient, getPeopleChainEndpoints, hasPersistedSession, resolveBulletinEndpoints };

package/dist/auth-config.js

@@ -3,23 +3,25 @@ import {
   DOT_DERIVATION_INDEX,
   DOT_HOST_NAME,
   DOT_PRODUCT_ID,
+  STALE_SESSION_DEPLOY_MESSAGE,
   STALE_SESSION_MESSAGE,
   buildAuthConfig,
   getAuthClient,
   getPeopleChainEndpoints,
   hasPersistedSession,
   resolveBulletinEndpoints
-} from "./chunk-U2QO5G35.js";
-import "./chunk-TSPERKUS.js";
+} from "./chunk-PH65V5GG.js";
 import "./chunk-3NR3T7US.js";
-import "./chunk-BFK5UCUJ.js";
-import "./chunk-OONQPYHM.js";
+import "./chunk-KJGXS3AY.js";
+import "./chunk-DDSBHHGU.js";
 import "./chunk-SH2LG52Z.js";
+import "./chunk-DNXE3Q5D.js";
 export {
   DOT_DAPP_ID,
   DOT_DERIVATION_INDEX,
   DOT_HOST_NAME,
   DOT_PRODUCT_ID,
+  STALE_SESSION_DEPLOY_MESSAGE,
   STALE_SESSION_MESSAGE,
   buildAuthConfig,
   getAuthClient,

package/dist/bug-report.js

@@ -10,10 +10,10 @@ import {
   offerBugReport,
   scrubSecrets,
   setDeployContext
-} from "./chunk-UFP2XWZ4.js";
-import "./chunk-R3BXRRKE.js";
-import "./chunk-BFK5UCUJ.js";
-import "./chunk-OONQPYHM.js";
+} from "./chunk-UEAWWSKI.js";
+import "./chunk-KHASCR2I.js";
+import "./chunk-KJGXS3AY.js";
+import "./chunk-DDSBHHGU.js";
 import "./chunk-SH2LG52Z.js";
 export {
   buildCliFlagsSummary,

package/dist/chain-health.js

@@ -3,9 +3,9 @@ import {
   DEFAULT_WINDOW_BLOCKS,
   MAX_SPANS_PER_SAMPLER,
   endpointHost
-} from "./chunk-CCIBF55X.js";
-import "./chunk-BFK5UCUJ.js";
-import "./chunk-OONQPYHM.js";
+} from "./chunk-ZN7PPHMX.js";
+import "./chunk-KJGXS3AY.js";
+import "./chunk-DDSBHHGU.js";
 import "./chunk-SH2LG52Z.js";
 export {
   ChainHealthSampler,