bulletin-deploy 0.7.27 → 0.7.28-rc.0

package/README.md

@@ -215,6 +215,16 @@ await deploy("./dist", "my-app00.dot", { jsMerkle: true });
 | `IPFS CLI not installed` | Install Kubo or switch to `--js-merkle`. |
 | Previous deploy did not exit cleanly / OOM hint | Retry with a larger Node heap, for example `NODE_OPTIONS='--max-old-space-size=8192'`. |
 
+## Contributing
+
+New to the codebase? Start with **[ONBOARDING.md](ONBOARDING.md)** — it covers install, the mental model, the first task, and the working conventions for this repo (worktree-per-branch, squash-merge policy, never-delete-tests, where the per-directory rules live).
+
+The team uses Claude Code as a primary tool. The repo ships team-shared Claude configuration: `.claude/skills/` (project-specific commands like `/e2e-local`, `/dotns-diagnose`, `/sentry-query`), `.claude/settings.json` (Bash allowlist), and per-directory `CLAUDE.md` files in `src/`, `sentry/`, `test/`, `tools/` that load on demand. Running `claude` inside this repo picks all of that up automatically.
+
+Already have Claude Code installed? Clone, `npm install`, open `ONBOARDING.md`. New to Claude Code itself? The same doc covers install.
+
+For maintainers and engineers familiar with the release flow, the canonical procedures live in the root [`CLAUDE.md`](CLAUDE.md): change workflow, dual-stage RC → stable release, post-release Sentry monitoring, and the squash-merge convention that satisfies branch protection without per-commit GPG signing.
+
 ## More Docs
 
 - [Bootstrap and operator setup](docs/bootstrap.md)

package/assets/environments.json

@@ -80,7 +80,8 @@
         "POP_RULES": "0x2002C1c15b88632Ad01c7770f6EbE1Ca05c8472E",
         "STORE_FACTORY": "0x0DE5De70d61cc6b44B45d6595afDe8dB9b55bc31",
         "LABEL_STORE_BEACON": "0xD033F7Ada687E8BC776928AB239505F9f0479Ce7",
-        "USER_STORE_BEACON": "0x7eD9b7D137Fa535965048F93b3B0248fEd2fcd32"
+        "USER_STORE_BEACON": "0x7eD9b7D137Fa535965048F93b3B0248fEd2fcd32",
+        "PUBLISHER": "0x1307fc02d308f879a16b1ae3a49b4927aed53649"
       }
     },
     {

package/bin/bulletin-deploy

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { deploy, DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE, NonRetryableError, EXIT_CODE_NO_RETRY, isConnectionError } from "../dist/deploy.js";
+import { deploy, DEFAULT_BULLETIN_RPC, DEFAULT_POOL_SIZE, NonRetryableError, EXIT_CODE_NO_RETRY, isConnectionError, unpublish } from "../dist/deploy.js";
 import { VERSION, setDeployAttribute, captureWarning, closeTelemetry, setRunStateActive, markRelaunchOomHintShown } from "../dist/telemetry.js";
 import { handleFailedDeploy, handlePreflightVersionCheck, fetchVersionInfo, preReleaseWarning, checkNodeVersion } from "../dist/version-check.js";
 import { setDeployContext, installLogCapture, buildCliFlagsSummary } from "../dist/bug-report.js";
@@ -36,19 +36,26 @@ for (let i = 0; i < args.length; i++) {
   else if (args[i] === "--js-merkle") { flags.jsMerkle = true; }
   else if (args[i] === "--input-car") { flags.inputCar = args[++i]; }
   else if (args[i] === "--tag") { flags.tag = args[++i]; }
-  else if (args[i] === "--name") { flags.name = args[++i]; }
-  else if (args[i] === "--description") { flags.description = args[++i]; }
+  else if (args[i] === "--config") { flags.config = args[++i]; }
   else if (args[i] === "--gh-pages-mirror") { flags.ghPagesMirror = true; }
   else if (args[i] === "--allow-large-deploy") { flags.allowLargeDeploy = true; }
   else if (args[i] === "--reproducible") { flags.reproducibleSource = "commit"; }
   else if (args[i].startsWith("--reproducible=")) { flags.reproducibleSource = args[i].slice("--reproducible=".length); }
   else if (args[i] === "--dump-car") { flags.dumpCar = true; }
   else if (args[i].startsWith("--dump-car=")) { flags.dumpCar = args[i].slice("--dump-car=".length); }
+  else if (args[i] === "--publish") { flags.publish = true; }
+  else if (args[i] === "--unpublish") { flags.unpublish = true; }
+  else if (args[i] === "--fail-on-publish-error") { flags.failOnPublishError = true; }
   else if (args[i] === "--version" || args[i] === "-V") { flags.version = true; }
   else if (args[i] === "--help" || args[i] === "-h") { flags.help = true; }
   else { positional.push(args[i]); }
 }
 
+if (flags.publish && flags.unpublish) {
+  console.error("Error: --publish and --unpublish are mutually exclusive.");
+  process.exit(1);
+}
+
 if (flags.version) {
   console.log(`bulletin-deploy v${VERSION}`);
   process.exit(0);
@@ -72,7 +79,74 @@ if (flags.listEnvironments) {
   }
 }
 
+if (flags.unpublish) {
+  if (!flags.mnemonic && !process.env.MNEMONIC) {
+    console.error("Error: --unpublish requires --mnemonic (or MNEMONIC env var).");
+    process.exit(1);
+  }
+  const [domain] = positional;
+  if (!domain) {
+    console.error("Error: --unpublish requires a domain (e.g. my-app.dot)");
+    process.exit(1);
+  }
+  try {
+    const result = await unpublish(domain, {
+      mnemonic: flags.mnemonic,
+      derivationPath: flags.derivationPath,
+      rpc: flags.rpc,
+      env: flags.env,
+    });
+    console.log(`Domain: ${result.domainName}`);
+    console.log(`Status: ${result.status}`);
+    process.exit(0);
+  } catch (e) {
+    console.error(`Unpublish failed:`, e?.message ?? e);
+    process.exit(1);
+  }
+}
 
+// `product` subcommand. Only `validate` is wired today. `publish` and `resolve` arrive in later phases.
+if (positional[0] === "product") {
+  const verb = positional[1];
+  if (verb === "validate") {
+    try {
+      const { loadProductConfig, pessimisticSizePreflight, getTextRecordBudgetBytes } =
+        await import("../dist/index.js");
+      const explicitPath = positional[2];
+      const { config, sourcePath } = explicitPath
+        ? await loadProductConfig({ path: explicitPath })
+        : await loadProductConfig();
+      console.log(`✓ Loaded   ${sourcePath}`);
+      console.log(`✓ Schema   ${config.domain} (${config.executables.length} executable${config.executables.length === 1 ? "" : "s"})`);
+      const budget = getTextRecordBudgetBytes();
+      const report = pessimisticSizePreflight(config, budget);
+      for (const check of report.checks) {
+        const tag = check.ok ? "✓" : "✗";
+        console.log(`${tag} ${check.key.padEnd(40)} ${check.bytes} B / ${check.budget} B`);
+      }
+      if (!report.ok) {
+        console.error("Pessimistic size preflight failed — at least one manifest exceeds the dotNS text-record budget.");
+        process.exit(EXIT_CODE_NO_RETRY);
+      }
+      console.log("Validate complete.");
+      process.exit(0);
+    } catch (err) {
+      console.error(`Error: ${err?.message ?? err}`);
+      process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
+    }
+  }
+  if (verb === "publish" || verb === "resolve") {
+    console.error(`'product ${verb}' is not implemented yet (planned for a later phase).`);
+    process.exit(2);
+  }
+  console.error(`Unknown product subcommand: ${verb ?? "(none)"}. Try: bulletin-deploy product validate [<config-path>]`);
+  process.exit(2);
+}
+
+if (flags.publish && !flags.mnemonic && !process.env.MNEMONIC) {
+  console.error("Error: --publish requires --mnemonic (or MNEMONIC env var).");
+  process.exit(1);
+}
 
 if (flags.help || positional.length === 0) {
   console.log(`bulletin-deploy v${VERSION}
@@ -97,10 +171,23 @@ Options:
   --dump-car[=<path>] Save the pre-upload CAR file to disk. Default path: <buildDir>.bulletin.car.
                       Override path with =<path>. Also settable via BULLETIN_DEPLOY_DUMP_CAR env var.
   --tag "..."         Label deploy in telemetry (or set DEPLOY_TAG env var); see Telemetry in README
-  --name "..."             Optional. Sets the "name" text record on the domain.
-  --description "..."      Optional. Sets the "description" text record (≤100 chars recommended).
+  --config <path>     Explicit path to a bulletin-deploy.config.ts (default: walk up from
+                      <build-dir> looking for bulletin-deploy.config.{ts,js,mjs}). When a
+                      config is found, deploy ALSO writes the manifest + executable text
+                      records on <domain> and its app/widget/worker subnames.
   --gh-pages-mirror   After deploy, push the CAR to the current repo's gh-pages branch
                       at bulletin/<domain>.dot.car (opt-in; also set GH_PAGES_MIRROR=1)
+  --publish           After deploy, list <domain> in the on-chain Publisher
+                      registry (Publisher.publish). Only takes effect on envs
+                      with a deployed Publisher (currently: paseo-next-v2).
+                      Requires --mnemonic (the signer must own the label).
+  --unpublish         Standalone mode: removes <domain> from the Publisher
+                      registry (Publisher.unpublish). Skips the deploy.
+                      Usage: bulletin-deploy --unpublish <domain.dot>
+                      Requires --mnemonic. Mutually exclusive with --publish.
+  --fail-on-publish-error
+                      Exit non-zero if --publish fails after a successful deploy.
+                      Default: non-fatal (warning logged, exit 0).
   --version           Show version
   --help              Show this help`);
   process.exit(0);
@@ -269,11 +356,11 @@ try {
     inputCar: flags.inputCar,
     tag: flags.tag,
     ghPagesMirror: flags.ghPagesMirror,
-    name: flags.name,
-    description: flags.description,
     allowLargeDeploy: flags.allowLargeDeploy,
     reproducibleSource: flags.reproducibleSource,
     dumpCar: flags.dumpCar,
+    publish: flags.publish,
+    failOnPublishError: flags.failOnPublishError,
   });
 
   const output = process.env.GITHUB_OUTPUT;
@@ -285,6 +372,48 @@ try {
   console.log(`CID: ${result.cid}`);
   console.log(`Domain: ${result.domainName}`);
 
+  // Opt-in manifest publish on top of the legacy contenthash deploy.
+  //
+  // Walks up from <build-dir> (or honours --config) looking for
+  // bulletin-deploy.config.{ts,js,mjs}. When found, writes the root + per-
+  // executable text records, otherwise the legacy flow returns unchanged.
+  {
+    const { tryLoadProductConfig, publishManifest } = await import("../dist/index.js");
+    const path = await import("node:path");
+    const buildDirAbs = path.resolve(buildDir);
+    const loaded = await tryLoadProductConfig(
+      flags.config ? { path: flags.config } : { cwd: buildDirAbs, walkUp: true },
+    );
+    if (loaded) {
+      try {
+        await publishManifest({
+          loaded,
+          domain,
+          buildDirCid: { absPath: buildDirAbs, cid: result.cid },
+          env: flags.env,
+          rpc: flags.rpc,
+          mnemonic: flags.mnemonic,
+          derivationPath: flags.derivationPath,
+        });
+      } catch (err) {
+        console.error(`Manifest publish failed: ${err?.message ?? err}`);
+        process.exit(err instanceof NonRetryableError ? EXIT_CODE_NO_RETRY : 1);
+      }
+    } else {
+      const where = flags.config
+        ? `--config ${flags.config}`
+        : `bulletin-deploy.config.{ts,js,mjs} via walking up from ${buildDirAbs}`;
+      console.log("");
+      console.log(`⚠  No bulletin-deploy.config.ts found (${where}).`);
+      console.log(`   ${domain} was published as legacy contenthash only.`);
+      console.log("   Add a bulletin-deploy.config.ts to enable the product manifest:");
+      console.log("     • product icon, displayName, description on the base name");
+      console.log("     • per-modality subnames (app.<id>.dot, widget.<id>.dot, worker.<id>.dot)");
+      console.log("     • each modality’s archive CID on its subname contenthash");
+      console.log("   See: https://github.com/paritytech/triangle-js-sdks (Product Manifest RFC)");
+    }
+  }
+
   if (!flags.help && !flags.version) {
     try { writeRunState({ status: "succeeded", endedAt: Date.now() }); } catch {}
   }

package/dist/bug-report.js

@@ -9,10 +9,10 @@ import {
   offerBugReport,
   scrubSecrets,
   setDeployContext
-} from "./chunk-I7YT2IAO.js";
-import "./chunk-AXIJLJZK.js";
-import "./chunk-FW4HEUMH.js";
-import "./chunk-6TIWKKDS.js";
+} from "./chunk-2DFF7JON.js";
+import "./chunk-H7KX6PV6.js";
+import "./chunk-FLSEVRJH.js";
+import "./chunk-ITK6QMTD.js";
 export {
   buildCliFlagsSummary,
   buildLabels,

package/dist/{chunk-I7YT2IAO.js → chunk-2DFF7JON.js}

@@ -2,11 +2,11 @@ import {
   classifyErrorArea,
   isInteractive,
   promptYesNo
-} from "./chunk-AXIJLJZK.js";
+} from "./chunk-H7KX6PV6.js";
 import {
   VERSION,
   getCurrentSentryTraceId
-} from "./chunk-FW4HEUMH.js";
+} from "./chunk-FLSEVRJH.js";
 
 // src/bug-report.ts
 import { execSync, execFileSync } from "child_process";
@@ -76,6 +76,9 @@ function buildCliFlagsSummary(flags) {
   const parts = [];
   if (flags.jsMerkle) parts.push("--js-merkle");
   if (flags.ghPagesMirror) parts.push("--gh-pages-mirror");
+  if (flags.publish) parts.push("--publish");
+  if (flags.unpublish) parts.push("--unpublish");
+  if (flags.failOnPublishError) parts.push("--fail-on-publish-error");
   if (flags.poolSize != null) parts.push(`--pool-size ${String(flags.poolSize)}`);
   if (typeof flags.tag === "string" && flags.tag) parts.push(`--tag ${flags.tag}`);
   if (flags.mnemonic) parts.push("--mnemonic <set>");

package/dist/{chunk-FW4HEUMH.js → chunk-FLSEVRJH.js}

@@ -1,7 +1,7 @@
 import {
   package_default,
   writeRunState
-} from "./chunk-6TIWKKDS.js";
+} from "./chunk-ITK6QMTD.js";
 
 // src/memory-report.ts
 import * as fs2 from "fs";
@@ -299,7 +299,7 @@ function computeDeployOutcome(errorCategory, isSad, sadReason) {
 var ERROR_KIND_RULES = [
   [/Contract reverted|Contract execution would revert|revert(?:ed|ing)?\s*\(flags=[0-9]+\)/i, "contract-revert"],
   [/timed out after \d+s waiting for block|Transaction not included after \d+s|Transaction did not settle within/i, "chain-timeout"],
-  [/\bstale\b.*nonce|nonce.*\bstale\b|"type"\s*:\s*"Future"|Invalid::Future|tx rejected by pool/i, "nonce-stale"],
+  [/\bstale\b.*nonce|nonce.*\bstale\b|"type"\s*:\s*"(?:Future|Stale)"|Invalid::Future|tx rejected by pool/i, "nonce-stale"],
   [/heartbeat timeout|WS halt|Unable to connect|ChainHead disjointed|websocket.*closed|socket closed|disconnect/i, "connection"],
   [/requires ProofOfPersonhoodFull,\s*but this signer is NoStatus/i, "naming.pop_required"],
   [/Domain\s+\S+\.dot\s+is already owned by\s+0x[a-fA-F0-9]+/i, "naming.already_owned"],

package/dist/chunk-GZD2UFLR.js

@@ -0,0 +1,8 @@
+// src/manifest/types.ts
+function defineConfig(config) {
+  return config;
+}
+
+export {
+  defineConfig
+};

package/dist/{chunk-AXIJLJZK.js → chunk-H7KX6PV6.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-FW4HEUMH.js";
+} from "./chunk-FLSEVRJH.js";
 
 // src/version-check.ts
 import { execSync, execFileSync } from "child_process";

package/dist/{chunk-6TIWKKDS.js → chunk-ITK6QMTD.js}

@@ -6,7 +6,7 @@ import * as path from "path";
 // package.json
 var package_default = {
   name: "bulletin-deploy",
-  version: "0.7.27",
+  version: "0.7.28-rc.0",
   private: false,
   repository: {
     type: "git",
@@ -45,11 +45,11 @@ var package_default = {
     "tools/release-retry-wrapper.mjs"
   ],
   scripts: {
-    build: "tsup src/index.ts src/deploy.ts src/dotns.ts src/pool.ts src/telemetry.ts src/memory-report.ts src/merkle.ts src/gh-pages-mirror.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/reprove.ts src/personhood/bind-personal-id.ts src/personhood/claim-pgas.ts src/personhood/bind-paid-alias.ts src/personhood/bootstrap.ts --format esm --dts --clean --target node22",
+    build: "tsup src/index.ts src/deploy.ts src/dotns.ts src/pool.ts src/telemetry.ts src/memory-report.ts src/merkle.ts src/gh-pages-mirror.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/reprove.ts src/personhood/bind-personal-id.ts src/personhood/claim-pgas.ts src/personhood/bind-paid-alias.ts src/personhood/bootstrap.ts src/manifest/types.ts src/manifest/schema.ts src/manifest/byte-budget.ts src/manifest/config-load.ts src/manifest/publish.ts --format esm --dts --clean --target node22",
     "refresh-environments": "node scripts/refresh-environments.mjs",
     "check:watched-dependencies": "node tools/check-watched-dependencies.mjs",
     prepare: "npm run build",
-    test: "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/environments.test.js test/refresh-environments.test.js test/watched-dependencies.test.js test/chunk-sharing-report.test.js",
+    test: "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/environments.test.js test/refresh-environments.test.js test/watched-dependencies.test.js test/chunk-sharing-report.test.js test/product-manifest.test.js",
     "test:e2e": "npm run build && node --test test/e2e.test.js",
     "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",
     "test:e2e:pr": "bash scripts/e2e-pass.sh pr",
@@ -69,6 +69,7 @@ var package_default = {
     "@sentry/node": "^9.14.0",
     "ipfs-unixfs": "^11.2.0",
     "ipfs-unixfs-importer": "^16.1.4",
+    jiti: "^2.4.2",
     multiformats: "^13.4.1",
     "polkadot-api": "^2.1.3",
     verifiablejs: "^1.2.0",

package/dist/chunk-LZJMVPYW.js

@@ -0,0 +1,156 @@
+// src/manifest/schema.ts
+var ICON_FORMATS = ["jpeg", "png"];
+var KIND_APP = "app";
+var KIND_WIDGET = "widget";
+var KIND_WORKER = "worker";
+var EXECUTABLE_KINDS = [KIND_APP, KIND_WIDGET, KIND_WORKER];
+var LABEL = String.raw`(?!-)[a-z0-9-]{1,63}(?<!-)`;
+var DOMAIN_RE = new RegExp(`^${LABEL}(\\.${LABEL})*\\.dot$`, "i");
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isAppVersion(value) {
+  if (!Array.isArray(value)) return false;
+  if (value.length !== 3 && value.length !== 4) return false;
+  if (!value.slice(0, 3).every((n) => typeof n === "number" && Number.isFinite(n) && n >= 0)) {
+    return false;
+  }
+  if (value.length === 4 && typeof value[3] !== "string") return false;
+  return true;
+}
+function validateWidgetFields(input, p) {
+  const errors = [];
+  if ("description" in input && input.description !== void 0 && typeof input.description !== "string") {
+    errors.push(`${p}description must be a string when present`);
+  }
+  if (!isPlainObject(input.dimensions)) {
+    errors.push(`${p}dimensions must be an object`);
+    return errors;
+  }
+  const dims = input.dimensions;
+  if (!Array.isArray(dims.height) || dims.height.length === 0 || !dims.height.every((h) => typeof h === "number" && Number.isInteger(h) && h > 0)) {
+    errors.push(`${p}dimensions.height must be a non-empty array of positive integers`);
+  }
+  if ("width" in dims && dims.width !== void 0 && !(typeof dims.width === "number" && Number.isInteger(dims.width) && dims.width > 0)) {
+    errors.push(`${p}dimensions.width must be a positive integer when present`);
+  }
+  return errors;
+}
+function validateWorkerFields(input, p) {
+  const errors = [];
+  if (!isNonEmptyString(input.entrypoint)) {
+    errors.push(`${p}entrypoint must be a non-empty string`);
+  } else if (input.entrypoint.startsWith("/") || input.entrypoint.split("/").includes("..")) {
+    errors.push(`${p}entrypoint must be a relative path with no '..' segments`);
+  }
+  if (!isPlainObject(input.includes)) {
+    errors.push(`${p}includes must be an object`);
+    return errors;
+  }
+  const inc = input.includes;
+  if (typeof inc.chat !== "boolean") errors.push(`${p}includes.chat must be a boolean`);
+  if (typeof inc.pocket !== "boolean") errors.push(`${p}includes.pocket must be a boolean`);
+  if (inc.chat === false && inc.pocket === false) {
+    errors.push(`${p}includes must have at least one of chat / pocket = true`);
+  }
+  return errors;
+}
+function validateRootManifest(input) {
+  const errors = [];
+  if (!isPlainObject(input)) {
+    return { ok: false, errors: ["root manifest must be an object"] };
+  }
+  if (input.$v !== 1) errors.push(`root manifest $v must be 1 (got ${JSON.stringify(input.$v)})`);
+  if (!isNonEmptyString(input.displayName)) errors.push("root manifest displayName must be a non-empty string");
+  if (typeof input.description !== "string") errors.push("root manifest description must be a string");
+  if (!isPlainObject(input.icon)) {
+    errors.push("root manifest icon must be an object");
+  } else {
+    if (!isNonEmptyString(input.icon.cid)) errors.push("root manifest icon.cid must be a non-empty string");
+    if (!ICON_FORMATS.includes(input.icon.format)) {
+      errors.push(`root manifest icon.format must be one of ${ICON_FORMATS.join(", ")} (got ${JSON.stringify(input.icon.format)})`);
+    }
+  }
+  return errors.length === 0 ? { ok: true, value: input } : { ok: false, errors };
+}
+function validateExecutableManifest(input) {
+  const errors = [];
+  if (!isPlainObject(input)) {
+    return { ok: false, errors: ["executable manifest must be an object"] };
+  }
+  if (input.$v !== 1) errors.push(`executable manifest $v must be 1 (got ${JSON.stringify(input.$v)})`);
+  if (!isAppVersion(input.appVersion)) {
+    errors.push("executable manifest appVersion must be [major, minor, patch] or [major, minor, patch, build]");
+  }
+  const kind = input.kind;
+  const p = "executable manifest ";
+  if (kind === KIND_APP) {
+  } else if (kind === KIND_WIDGET) {
+    errors.push(...validateWidgetFields(input, p));
+  } else if (kind === KIND_WORKER) {
+    errors.push(...validateWorkerFields(input, p));
+  } else {
+    errors.push(`${p}kind must be one of ${EXECUTABLE_KINDS.join(", ")} (got ${JSON.stringify(kind)})`);
+  }
+  return errors.length === 0 ? { ok: true, value: input } : { ok: false, errors };
+}
+function validateProductConfig(input) {
+  const errors = [];
+  if (!isPlainObject(input)) {
+    return { ok: false, errors: ["product config must be an object (did you forget `export default`?)"] };
+  }
+  if (!isNonEmptyString(input.domain) || !DOMAIN_RE.test(input.domain)) {
+    errors.push("product config domain must be a non-empty dotNS name ending in .dot");
+  }
+  if (!isNonEmptyString(input.displayName)) errors.push("product config displayName must be a non-empty string");
+  if (typeof input.description !== "string") errors.push("product config description must be a string");
+  if (!isPlainObject(input.icon)) {
+    errors.push("product config icon must be an object");
+  } else {
+    if (!isNonEmptyString(input.icon.path)) errors.push("product config icon.path must be a non-empty string");
+    if (!ICON_FORMATS.includes(input.icon.format)) {
+      errors.push(`product config icon.format must be one of ${ICON_FORMATS.join(", ")}`);
+    }
+  }
+  if (!Array.isArray(input.executables) || input.executables.length === 0) {
+    errors.push("product config executables must be a non-empty array");
+  } else {
+    const seenKinds = /* @__PURE__ */ new Set();
+    input.executables.forEach((exec, index) => {
+      errors.push(...validateExecutableConfig(exec, index));
+      if (isPlainObject(exec) && typeof exec.kind === "string") {
+        if (seenKinds.has(exec.kind)) errors.push(`executables[${index}]: duplicate kind '${exec.kind}'`);
+        seenKinds.add(exec.kind);
+      }
+    });
+  }
+  return errors.length === 0 ? { ok: true, value: input } : { ok: false, errors };
+}
+function validateExecutableConfig(input, index) {
+  const p = `executables[${index}].`;
+  if (!isPlainObject(input)) return [`executables[${index}] must be an object`];
+  const errors = [];
+  if (!isNonEmptyString(input.path)) errors.push(`${p}path must be a non-empty string`);
+  if (!isAppVersion(input.appVersion)) {
+    errors.push(`${p}appVersion must be [major, minor, patch] or [major, minor, patch, build]`);
+  }
+  const kind = input.kind;
+  if (kind === KIND_APP) {
+  } else if (kind === KIND_WIDGET) {
+    errors.push(...validateWidgetFields(input, p));
+  } else if (kind === KIND_WORKER) {
+    errors.push(...validateWorkerFields(input, p));
+  } else {
+    errors.push(`${p}kind must be one of ${EXECUTABLE_KINDS.join(", ")} (got ${JSON.stringify(kind)})`);
+  }
+  return errors;
+}
+
+export {
+  validateRootManifest,
+  validateExecutableManifest,
+  validateProductConfig
+};

package/dist/{chunk-JIKWTM5P.js → chunk-MEPT7ICD.js}

@@ -20,21 +20,22 @@ import {
 } from "./chunk-S7EM5VMW.js";
 import {
   setDeployContext
-} from "./chunk-I7YT2IAO.js";
+} from "./chunk-2DFF7JON.js";
 import {
   probeChunks
-} from "./chunk-W4R7HNRX.js";
+} from "./chunk-X6YLSXNW.js";
 import {
   packSection
 } from "./chunk-C2TS5MER.js";
 import {
   DotNS,
+  PublisherNotSupportedError,
   TX_TIMEOUT_MS,
   fetchNonce,
   parseDomainName,
   popStatusName,
   verifyNonceAdvanced
-} from "./chunk-TILLNN33.js";
+} from "./chunk-TFG4YBCU.js";
 import {
   derivePoolAccounts,
   detectTestnet,
@@ -56,13 +57,13 @@ import {
   truncateAddress,
   withDeploySpan,
   withSpan
-} from "./chunk-FW4HEUMH.js";
+} from "./chunk-FLSEVRJH.js";
 import {
   DEFAULT_ENV_ID,
   getPopSelfServeConfig,
   loadEnvironments,
   resolveEndpoints
-} from "./chunk-MGU5I7H5.js";
+} from "./chunk-OITUIM2E.js";
 import {
   NonRetryableError
 } from "./chunk-ZOC4GITL.js";
@@ -1482,6 +1483,62 @@ function assertSubdomainOwnerMatchesSigner(result, signerEvmAddress, sublabel, p
     );
   }
 }
+async function publish(dotns, parsed, failOnError) {
+  console.log("\n" + "=".repeat(60));
+  console.log("Publish");
+  console.log("=".repeat(60));
+  if (parsed.isSubdomain) {
+    console.log(`   Subdomains are not supported by the Publisher registry \u2014 skipping.`);
+    return;
+  }
+  try {
+    const result = await dotns.publishLabel(parsed.label);
+    setDeployAttribute("deploy.publish.status", result.status);
+    if (result.txHash) setDeployAttribute("deploy.publish.tx", result.txHash);
+    console.log(`   Status: ${result.status}`);
+  } catch (e) {
+    if (e instanceof PublisherNotSupportedError) {
+      console.log(`   Skipped: ${e.message}`);
+      return;
+    }
+    setDeployAttribute("deploy.publish.status", "failed");
+    if (failOnError) throw e;
+    const msg = e?.message ?? String(e);
+    console.error(`   Warning: publish failed (non-fatal): ${msg}`);
+    captureWarning("publish failed", { error: msg.slice(0, 200) });
+  }
+}
+async function unpublish(domainName, options = {}) {
+  const envId = options.env ?? DEFAULT_ENV_ID;
+  const { doc } = await loadEnvironments();
+  const resolved = resolveEndpoints(doc, envId);
+  const popSelfServe = getPopSelfServeConfig(doc, envId);
+  const parsed = parseDomainName(domainName);
+  if (parsed.isSubdomain) {
+    throw new Error(`Subdomains are not supported by the Publisher registry. To unpublish ${parsed.parentLabel}.dot (which controls ${domainName}), pass that label directly.`);
+  }
+  const label = parsed.label;
+  const dotns = new DotNS();
+  try {
+    await dotns.connect(resolveDotnsConnectOptions(
+      { mnemonic: options.mnemonic, derivationPath: options.derivationPath },
+      resolved.assetHub,
+      resolved.autoAccountMapping,
+      resolved.contracts,
+      resolved.nativeToEthRatio,
+      envId,
+      popSelfServe,
+      resolved.registerStorageDeposit
+    ));
+    const result = await dotns.unpublishLabel(label);
+    return { domainName: `${label}.dot`, status: result.status, txHash: result.txHash };
+  } finally {
+    try {
+      dotns.disconnect();
+    } catch {
+    }
+  }
+}
 async function deploy(content, domainName = null, options = {}) {
   const envId = options.env ?? DEFAULT_ENV_ID;
   let envBulletin = [DEFAULT_BULLETIN_RPC];
@@ -1824,9 +1881,9 @@ async function deploy(content, domainName = null, options = {}) {
         }
         const contenthashHex = `0x${encodeContenthash(cid)}`;
         await dotns.setContenthash(name, contenthashHex);
-        const textRecordTarget = parsed?.isSubdomain && parsed.sublabel && parsed.parentLabel ? `${parsed.sublabel}.${parsed.parentLabel}` : name;
-        if (options.name !== void 0) await dotns.setTextRecord(textRecordTarget, "name", options.name);
-        if (options.description !== void 0) await dotns.setTextRecord(textRecordTarget, "description", options.description);
+        if (options.publish && parsed) {
+          await publish(dotns, parsed, options.failOnPublishError);
+        }
         dotns.disconnect();
       });
       if (options.ghPagesMirror) {
@@ -2306,5 +2363,6 @@ export {
   resolveDotnsConnectOptions,
   estimateUploadBytes,
   assertSubdomainOwnerMatchesSigner,
+  unpublish,
   deploy
 };