bulletin-deploy 0.22.0-rc.1 → 0.22.0-rc.2

package/dist/auth/index.js

@@ -8,6 +8,10 @@ import {
   renderLogoutStatus
 } from "../chunk-YP3LINCF.js";
 import "../chunk-NJKXXDDK.js";
+import {
+  SignerNotAvailableError,
+  resolveSigner
+} from "../chunk-2C6SLLBI.js";
 import {
   createAuthClient
 } from "../chunk-PN5JKONF.js";
@@ -21,10 +25,6 @@ import {
 import {
   SESSION_EXPIRED_MESSAGE
 } from "../chunk-IMCDXJ4G.js";
-import {
-  SignerNotAvailableError,
-  resolveSigner
-} from "../chunk-2C6SLLBI.js";
 import "../chunk-SH2LG52Z.js";
 import "../chunk-DNXE3Q5D.js";
 export {

package/dist/auth/vendor/index.js

@@ -1,4 +1,9 @@
 import "../../chunk-NJKXXDDK.js";
+import {
+  SignerNotAvailableError,
+  parseDevAccountName,
+  resolveSigner
+} from "../../chunk-2C6SLLBI.js";
 import {
   createAuthClient
 } from "../../chunk-PN5JKONF.js";
@@ -16,11 +21,6 @@ import {
   deriveProductPublicKey,
   sessionRootPublicKey
 } from "../../chunk-IMCDXJ4G.js";
-import {
-  SignerNotAvailableError,
-  parseDevAccountName,
-  resolveSigner
-} from "../../chunk-2C6SLLBI.js";
 import "../../chunk-SH2LG52Z.js";
 import "../../chunk-DNXE3Q5D.js";
 export {

package/dist/auth-config.js

@@ -10,10 +10,10 @@ import {
   hasPersistedSession,
   readNetworkSuffix,
   resolveBulletinEndpoints
-} from "./chunk-KDVHMIKK.js";
+} from "./chunk-ZTXHG3LV.js";
 import "./chunk-3NR3T7US.js";
-import "./chunk-KXYSKT5U.js";
-import "./chunk-BMUDRQYV.js";
+import "./chunk-7JM6FJM3.js";
+import "./chunk-WM4BQ7YJ.js";
 import "./chunk-SH2LG52Z.js";
 import "./chunk-DNXE3Q5D.js";
 export {

package/dist/bug-report.js

@@ -10,10 +10,10 @@ import {
   offerBugReport,
   scrubSecrets,
   setDeployContext
-} from "./chunk-RMO7G7X2.js";
-import "./chunk-S2N25SYI.js";
-import "./chunk-KXYSKT5U.js";
-import "./chunk-BMUDRQYV.js";
+} from "./chunk-PY4R353E.js";
+import "./chunk-PZA33HNQ.js";
+import "./chunk-7JM6FJM3.js";
+import "./chunk-WM4BQ7YJ.js";
 import "./chunk-SH2LG52Z.js";
 export {
   buildCliFlagsSummary,

package/dist/chain-health.js

@@ -3,9 +3,9 @@ import {
   DEFAULT_WINDOW_BLOCKS,
   MAX_SPANS_PER_SAMPLER,
   endpointHost
-} from "./chunk-NTJRL6TA.js";
-import "./chunk-KXYSKT5U.js";
-import "./chunk-BMUDRQYV.js";
+} from "./chunk-UWTR5Z27.js";
+import "./chunk-7JM6FJM3.js";
+import "./chunk-WM4BQ7YJ.js";
 import "./chunk-SH2LG52Z.js";
 export {
   ChainHealthSampler,

package/dist/chunk-6DDB5QOM.js

@@ -0,0 +1,40 @@
+// src/e2e-nonce-barrier.ts
+import * as fs from "fs";
+import * as path from "path";
+var NONCE_SEED_BARRIER_ENV = "BULLETIN_DEPLOY_E2E_NONCE_SEED_BARRIER";
+async function awaitNonceSeedBarrier(opts) {
+  const parties = opts.parties ?? 2;
+  const deadline = Date.now() + (opts.timeoutMs ?? 12e4);
+  const pollMs = opts.pollMs ?? 200;
+  fs.mkdirSync(opts.dir, { recursive: true });
+  fs.writeFileSync(path.join(opts.dir, `${opts.id ?? process.pid}.seed`), String(opts.seed));
+  const seedFiles = () => fs.readdirSync(opts.dir).filter((f) => f.endsWith(".seed"));
+  const readSeeds = (files) => files.map((f) => Number(fs.readFileSync(path.join(opts.dir, f), "utf8"))).sort((a, b) => a - b);
+  for (; ; ) {
+    const files = seedFiles();
+    if (files.length >= parties) return { met: true, seeds: readSeeds(files) };
+    if (Date.now() >= deadline) return { met: false, seeds: readSeeds(files) };
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+}
+var used = false;
+async function e2eNonceSeedBarrier(seed, env = process.env) {
+  const dir = env[NONCE_SEED_BARRIER_ENV];
+  if (!dir || used) return;
+  used = true;
+  const parties = Number(env[`${NONCE_SEED_BARRIER_ENV}_PARTIES`] || 2);
+  const timeoutMs = Number(env[`${NONCE_SEED_BARRIER_ENV}_TIMEOUT_MS`] || 12e4);
+  console.log(`   E2E nonce-seed barrier: seed ${seed}, waiting for ${parties} parties`);
+  const r = await awaitNonceSeedBarrier({ dir, seed, parties, timeoutMs });
+  console.log(r.met ? `   E2E nonce-seed barrier met: seeds [${r.seeds.join(", ")}]` : `   E2E nonce-seed barrier timed out after ${timeoutMs}ms: seeds [${r.seeds.join(", ")}]`);
+}
+function __resetNonceSeedBarrierForTest() {
+  used = false;
+}
+
+export {
+  NONCE_SEED_BARRIER_ENV,
+  awaitNonceSeedBarrier,
+  e2eNonceSeedBarrier,
+  __resetNonceSeedBarrierForTest
+};

package/dist/{chunk-KXYSKT5U.js → chunk-7JM6FJM3.js}

@@ -1,7 +1,7 @@
 import {
   package_default,
   writeRunState
-} from "./chunk-BMUDRQYV.js";
+} from "./chunk-WM4BQ7YJ.js";
 import {
   FALLBACK_CONFIG_ORIGIN,
   SHIPPED_CONFIG_ORIGIN
@@ -352,6 +352,10 @@ function getDeployAttributes(domain) {
     "deploy.tool_version": VERSION,
     "deploy.runner": resolveRunner(),
     "deploy.runner_type": resolveRunnerType(),
+    // #1646: the telemetry verifier scopes its Sentry query to the current CI run
+    // with these (strings, present on every span: both-values rule).
+    "deploy.ci_run_id": process.env.GITHUB_RUN_ID || "none",
+    "deploy.ci_run_attempt": process.env.GITHUB_RUN_ATTEMPT || "none",
     // Present on every span so a dashboard can compute count_if(deploy.version_status,
     // "outdated") / count() — see classifyVersionFreshness in version-check.ts.
     "deploy.version_status": versionFreshness,
@@ -428,6 +432,16 @@ var ERROR_KIND_RULES = [
   // (2026-08-06 telemetry sweep: this was the largest live `unknown` bucket —
   // 31 spans, 30 of them env=preview, from the per-env authorizer gap #1209.)
   [/is not authorized for Bulletin storage/i, "storage.rejected"],
+  // The three chunk-inclusion / stuck-queue messages (src/deploy.ts
+  // ChunkInclusionUnverifiedError, src/pool.ts stuckQueueMessage). Ahead of the
+  // generic infra rules: the unverified message interpolates the probe's failure
+  // reason, which routinely reads "timed out" / "websocket closed" and would be
+  // claimed by chain-timeout or connection; the stuck-queue message says "every
+  // chunk would time out", and both inclusion messages end up before the broader
+  // /chunk.*failed after.*retr/ and /not finalised after/ fallbacks.
+  [/Could not verify that chunk .+ is stored on-chain/i, "chain.chunk_unverified"],
+  [/still absent at the best block after \d+ re-upload rounds/i, "chain.chunk_not_included"],
+  [/has a stuck pending-tx queue/i, "chain.queue_stuck"],
   // Revive surfaces the personhood gate as a bare revert reason rather than the
   // "requires ProofOfPersonhoodX, but this signer is NoStatus" prose matched
   // further down — same user-actionable cause, so it shares that kind. Ordered
@@ -620,6 +634,12 @@ var ERROR_KIND_CATEGORY = {
   "chain.quota_exhausted": "user",
   "chain.bad_proof": "environment",
   "chain.chunk_failed": "environment",
+  "chain.chunk_unverified": "environment",
+  "chain.chunk_not_included": "environment",
+  // Always the node's pool state, not the operator's: a pinned index is only the
+  // remedy (unset/pick another), the stuck queue is the cause, and the same
+  // message is also thrown for a direct signer that pinned nothing.
+  "chain.queue_stuck": "environment",
   "chain.tx_dropped": "environment",
   "chain.tx_invalid": "environment",
   "chain.not_finalised": "environment",

package/dist/{chunk-DKTKQS2N.js → chunk-C75KFENW.js}

@@ -1,6 +1,6 @@
 import {
   captureWarning
-} from "./chunk-KXYSKT5U.js";
+} from "./chunk-7JM6FJM3.js";
 
 // src/chunk-probe.ts
 import { Twox128, Blake2128Concat, decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";

package/dist/{chunk-6RQY4VPG.js → chunk-CFSMENKV.js}

@@ -1,6 +1,6 @@
 import {
   verifyEmbeddedAppManifests
-} from "./chunk-EHAL4CJM.js";
+} from "./chunk-DBDOISNQ.js";
 import {
   pessimisticSizePreflight
 } from "./chunk-YTRNJMI4.js";
@@ -19,13 +19,13 @@ import {
   setBulletinEndpoints,
   storeDirectory,
   storeFile
-} from "./chunk-LTUECTW2.js";
+} from "./chunk-YQF5Y2HS.js";
 import {
   DEFAULT_TLD,
   DotNS,
   parseDomainName,
   stripTldSuffix
-} from "./chunk-4FAL7DFB.js";
+} from "./chunk-PR52KVWQ.js";
 import {
   DEFAULT_ENV_ID,
   getPopSelfServeConfig,
@@ -36,7 +36,7 @@ import {
   setDeployAttribute,
   withManifestSpan,
   withSpan
-} from "./chunk-KXYSKT5U.js";
+} from "./chunk-7JM6FJM3.js";
 import {
   NonRetryableError
 } from "./chunk-SH2LG52Z.js";

package/dist/{chunk-FUU5U5GB.js → chunk-HE6CD5SW.js}

@@ -1,9 +1,9 @@
 import {
   endpointHost
-} from "./chunk-NTJRL6TA.js";
+} from "./chunk-UWTR5Z27.js";
 import {
   captureWarning
-} from "./chunk-KXYSKT5U.js";
+} from "./chunk-7JM6FJM3.js";
 
 // src/ws.ts
 import { getWsProvider as papiGetWsProvider } from "polkadot-api/ws";

package/dist/{chunk-OFR4K7P3.js → chunk-L6TCHNO6.js}

@@ -1,6 +1,6 @@
 import {
   getWsProvider
-} from "./chunk-FUU5U5GB.js";
+} from "./chunk-HE6CD5SW.js";
 import {
   NonRetryableError
 } from "./chunk-SH2LG52Z.js";
@@ -132,6 +132,7 @@ var STUCK_NONCE_GAP_THRESHOLD = 8;
 var NONCE_HEALTH_SAMPLES = 8;
 var NONCE_HEALTH_TIMEOUT_MS = 1e4;
 var NONCE_HEALTH_CONFIRM_DELAY_MS = 2 * BULLETIN_BLOCK_TIME_SECS * 1e3;
+var NONCE_HEALTH_CONFIRM_READS = 5;
 function nonceGapVerdict(onchain, nextIndex, threshold = STUCK_NONCE_GAP_THRESHOLD) {
   return nextIndex - onchain > threshold ? "stuck" : "healthy";
 }
@@ -163,15 +164,28 @@ async function checkPoolAccountNonceHealth(address, deps) {
   const nextIndex = Math.max(...got);
   const result = { verdict: nonceGapVerdict(onchain, nextIndex, deps.threshold), onchain, nextIndex, gap: nextIndex - onchain, samples: got };
   if (result.verdict !== "stuck") return result;
+  result.backendLocal = nonceGapVerdict(onchain, Math.min(...got), deps.threshold) === "healthy";
+  if (!result.backendLocal) {
+    return {
+      ...result,
+      verdict: "unknown",
+      reason: `gap ${result.gap} on every nextIndex sample (a gossiped queue): a busy account, not a backend-local stuck queue`
+    };
+  }
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  await sleep(deps.confirmDelayMs ?? NONCE_HEALTH_CONFIRM_DELAY_MS);
-  try {
-    const later = Number(await withTimeout(() => deps.readOnchainNonce(address), timeoutMs, "on-chain nonce re-read"));
+  const delayMs = deps.confirmDelayMs ?? NONCE_HEALTH_CONFIRM_DELAY_MS;
+  const reads = deps.confirmReads ?? NONCE_HEALTH_CONFIRM_READS;
+  for (let i = 0; i < reads; i++) {
+    await sleep(delayMs);
+    let later;
+    try {
+      later = Number(await withTimeout(() => deps.readOnchainNonce(address), timeoutMs, "on-chain nonce re-read"));
+    } catch (e) {
+      return { ...result, verdict: "unknown", reason: `on-chain nonce re-read: ${e?.message ?? e}` };
+    }
     if (later > onchain) return { ...result, verdict: "healthy", onchain: later, gap: nextIndex - later };
-    return result;
-  } catch (e) {
-    return { ...result, verdict: "unknown", reason: `on-chain nonce re-read: ${e?.message ?? e}` };
   }
+  return result;
 }
 var StuckPoolAccountError = class extends NonRetryableError {
   constructor(message, skippedStuck) {
@@ -524,6 +538,7 @@ export {
   STUCK_NONCE_GAP_THRESHOLD,
   NONCE_HEALTH_SAMPLES,
   nonceGapVerdict,
+  withTimeout,
   checkPoolAccountNonceHealth,
   StuckPoolAccountError,
   stuckQueueMessage,