- 60463f7: Add
dot logoutto sign out of the account paired viadot init— no morerm -rf ~/.polkadot-apps. Notifies the mobile app so the paired-connection entry is removed there too, with a best-effort local-only cleanup fallback when the network is unreachable.
-
20bdd11: Refresh remaining
@polkadot-apps/*direct dependencies to their current latest. PR #44 narrowly bumpedchain-client; this widens to pick up the siblings that the monorepo had already co-released via itsworkspace:*+ changesets patch cascade:@polkadot-apps/bulletin0.6.9 → 0.6.10@polkadot-apps/contracts0.3.2 → 0.4.0
Also eliminates the duplicate
chain-client@2.0.4that was being pulled transitively by the old bulletin — single resolved version now (2.0.5).
- 899ca18: Bump
@polkadot-apps/chain-clientto 2.0.5, which rotates the Paseo Asset Hub preset RPC list to live endpoints. Fixesdot inithanging on the funding step with repeated "Unable to connect to …" errors when both previously-configured endpoints (Dwellir,sys.ibp.network) were simultaneously unhealthy.
- b854eae: Upgrade
bulletin-deploypin to0.7.2. Fewer spurious upload failures now that the default chunk timeout covers Bulletin's 24s Aura slots, and a Bun-safe memory-report teardown upstream. No API changes on our side.
- f39d0aa:
dot initnow falls back to a dedicated testnet funder account if Alice is drained on Paseo Asset Hub — so new users aren't blocked the moment someone drains Alice. If both funders are low, the UI points users athttps://faucet.polkadot.io/prefilled with their own address so they can self-fund and move on.dot deploy --signer devgets the same fallback and, on exhaustion, guides the user to switch to the mobile signer instead. Adds a scheduled GitHub Actions workflow that files an issue when the dedicated funder needs topping up.
-
c6cdc06: Add optional contract deploy step to
dot deploy. When the project root contains afoundry.toml, ahardhat.config.*, or aCargo.tomlwith apvm_contractdep, the TUI now asks "deploy contracts?" (default no), anddot deploy --contractsruns it non-interactively. All three paths compile locally (foundry viaforge build --resolc, hardhat vianpx hardhat compile, cdm via@dotdm/contracts) and then hand the PolkaVM bytecode to cdm'sContractDeployer.deployBatch, which weight-aware-chunks the deploys intoUtility.batch_allextrinsics. No constructor args, no contract registry publish, no on-chain metadata in this first cut — they'll land in a follow-up.Contract extrinsics are signed by a persistent on-disk session key at
~/.polkadot/accounts.json, not the mobile signer — today's mobile flow can't handle the encoded size of a batched contract deploy, and the failure is miscategorised as a user-cancel. On first deploy the session key is funded by the user's main signer (one phone tap) or by Alice in pure dev mode; subsequent runs skip funding when the balance is already above the threshold.dot initgains afoundry (polkadot)dependency check that installsfoundryup-polkadot.
- 73ad29b: Fix
dot deploycrashing on Bun-compiled binaries withnode:v8 getHeapSpaceStatistics is not yet implemented in Bun.when running from an internal Parity repo. Move thebulletin-deploytelemetry opt-out into a dedicatedsrc/bootstrap.tsside-effect module imported before any other module, and additionally forceBULLETIN_DEPLOY_MEM_REPORT=0so bulletin-deploy's diagnostic memory-report path can never reach Bun's unimplementedv8.getHeapSpaceStatistics. ExplicitBULLETIN_DEPLOY_TELEMETRY=1/BULLETIN_DEPLOY_MEM_REPORT=1overrides are preserved.
- faae2ed:
dot deploy --playgroundnow inlines the project'sREADME.mdinto the playground metadata so published apps show a rendered readme on their detail page. Readmes up to 20 KB are included automatically; if the file is larger the confirm screen shows a warning ("readme will not be uploaded") and the deploy proceeds without it. No action required — this works for any repo that already has aREADME.mdat its root.
- e113540:
dot build(and the build phase ofdot deploy) now auto-installs the project's dependencies whennode_modules/is missing. The package manager is inferred from the lockfile (pnpm/yarn/bun), falling back tonpm. Previously, an uninstalled project fell through tonpx <framework> build, which ephemerally downloaded the framework binary but then failed with a confusingERR_MODULE_NOT_FOUNDwhile loading the project's own config file (e.g.vite.config.tsimportingvite).
- fdac80d: Bump
bulletin-deploypin from0.6.16to0.7.0. The only breaking change in 0.7.0 is the removal of the--playgroundCLI flag and theplayground?: booleanDeployOption; playground-cli already owns registry publishing via its ownpublishToPlayground()flow, so this is a no-op for the deploy path.
-
e77932d: Fix
dot deployreporting "already registered" on re-deploys made in dev mode when a phone session was also present.The domain-availability preflight was passing the logged-in user's SS58 address as the reference owner for the on-chain ownership check regardless of signer mode. In dev mode bulletin-deploy signs DotNS with its built-in
DEFAULT_MNEMONIC, so the domain is owned by the dev account — not the user — and the preflight incorrectly reported the re-deploy as taken by a different account. We now only pass the user's address when--signer phone(where bulletin-deploy actually uses the user's signer). In dev mode we skip the ownership check and let bulletin-deploy's own preflight classify the re-deploy with the right signer.
- 4cdf839:
dot deploynow asks whether to run the build step before deploying, defaulting to "yes" so the common case is still a single Enter press. Pass--no-buildto skip the build non-interactively (useful when you've already built the project and just want to re-upload existing artifacts frombuildDir). The confirm screen and headless summary both show whether the run will rebuild or reuse existing artifacts.
-
c9c4bcd: Bump
bulletin-deploypin from 0.6.9 → 0.6.16.Picks up a fix for
merkleizeJS(CIDs now preserve their codec so DAG-PB blocks are correctly indexed in the CAR body — the upstream bug ourjsMerkleworkaround was avoiding), on-chain verification after every DotNSsetContenthash, clearer preflight messages on sanitized-to-Reserved labels, chain-time commit-age waits, and an idempotent pooltopUpBy. No API changes required on our side.
- e27c1be: Suppress the cosmetic
UnsubscriptionError: Not connectedstack trace that appeared duringdot deploy's domain-availability check. It came from polkadot-api tearing down its chainHead follow subscription afterdotns.disconnect()had already closed the WebSocket — expected, benign, and surfaced as either anunhandledRejectionoruncaughtExceptiondepending on the runtime. The process now filters that specific rxjs error (UnsubscriptionError whose inner errors are all "Not connected") instead of logging a 40-line stack trace and tearing the deploy down. Unrelated rejections and exceptions still escalate as before; run withDOT_DEPLOY_VERBOSE=1to get a one-line note when a filter fires. Also adds a Troubleshooting section to the README pointing users atDOT_MEMORY_TRACE=1+DOT_DEPLOY_VERBOSE=1for memory / OOM bug reports.
- 440bd12:
dot modnow prompts for the fork repository name after you pick (or pass) an app, with the previously random-suffixed default prefilled — press Enter to keep it, or type your own. The prompt is skipped with--clone(the target is only a local directory anyway), with-y/--yes(non-interactive default), or when you pass--repo-name <name>(which also doubles as the scripted override). Supplied names are validated against GitHub's repository-name rules and against existing directories on disk.
-
13a6c4e: Harden the deploy memory watchdog, add diagnostic logging for freezes / runaway RSS, and fix the phone-signer approval counter when a PoP upgrade is required.
- Watchdog now runs in a
worker_threadsWorker, not asetIntervalon the main thread. Under heavy microtask load (polkadot-api block subscriptions, bulletin-deploy retry loops) the main thread's macrotask queue can be starved for long enough that RSS climbs to 10+ GB between samples — at which point macOS jetsam delivers SIGKILL and the user sees a mysteryzsh: killedwith no guidance. The worker has its own event loop that can't be starved by the main thread, so the 4 GB cap now actually fires with a clear abort message. Sampling rate is also tightened from 5 s → 1 s now that it's off the hot path. - New
DOT_DEPLOY_VERBOSE=1env var writes every bulletin-deploy log line (chunk progress, broadcast / included / finalized transitions, nonce traces, RPC reconnects) to stderr with a[+<seconds>s]timestamp. Previously the interceptor swallowed everything that wasn't a phase banner or[N/M]chunk line to keep the TUI clean; that made "deploy froze at chunk 2/6" reports diagnostically opaque. Pair withDOT_MEMORY_TRACE=1to correlate log events with RSS growth. - Asset Hub client is now destroyed immediately after preflight instead of lingering until deploy cleanup. Nothing in the deploy flow (build, bulletin-deploy's storage + DotNS, our playground publish) uses it between preflight and the publish step — and holding an idle polkadot-api client with a live best-block subscription for the full deploy window was measurable background pressure. Playground publish calls
getConnection()which auto-re-establishes a fresh client at that point. - Phone-signer approval count now matches reality. For a PoP-gated name registered with a signer below the required tier, bulletin-deploy submits an extra
setUserPopStatustx beforeregister()— sodot deploy --signer phone --playgroundactually fires 5 sigs, not 4. The summary card used to advertise "4 approvals" and the phone prompt later said "approve step 5 of 4". Fixed by predictingneedsPopUpgradeduring the availability check (viagetUserPopStatus+ mirroredsimulateUserStatuslogic) and threading that prediction intoresolveSignerSetup, so the approvals list (and the derived summary, and the signing-proxy labels) are variable-length. Added: a belt-and-braces clamp increateSigningCounterthat growstotalwhenstep > total, so even if our prediction mis-estimates for any reason the TUI never shows "step 5 of 4" again. - Re-deploy path now shows a minimal phone tap count. When the availability check reports the domain is already owned by the signer, bulletin-deploy skips
register()entirely and only firessetContenthash. The summary card and counter now reflect that (1 DotNS tap instead of 3).
- Watchdog now runs in a
-
a289cb9: New editorial TUI: every screen now renders through a single theme plug (
src/utils/ui/theme/) — swap that folder to reskin the CLI, stub it to strip styling, zero styling leaks into commands.dot initnow surfaces bulletin attestation status on every run — even for already-signed-in users — showing how long your upload quota is valid for in human-readable form (e.g.~13d 4h · #14,582,331), with warning color when expiry drops under 24 h.Bonus: the terminal tab title updates during long deploys, so
dot deployshows build / upload / publish / ✓ in your tab strip while you tab away to the browser.
-
8944350: Bump
bulletin-deployfrom0.6.9-rc.6to0.6.9(stable). Upstream changes:- fix(dotns) — Lite signers are now correctly rejected on
NoStatuslabels, matching the on-chainPopRulescontract (upstream #101). Previously the check was missing the requirement clause and could let a Lite user through the classifier, only to have the register tx revert later. - feat(dotns) — bulletin-deploy now runs its own
DotNS.preflight(label)before any Bulletin upload (upstream #102). Deploys that were going to fail DotNS registration (wrong label class, reserved base name, domain owned by someone else, unresolvable PoP gate) now abort with zero Bulletin bytes paid, saving users a failed multi-MB upload. A new publicDotNS.preflight()view-only method andsimulateUserStatus()/popStatusName()helpers are also exported.
Our code surface (the
deploy()entrypoint +DotNS.connect/classifyName/checkOwnership/disconnect) is unchanged, so the bump is drop-in. 147/147 tests pass. - fix(dotns) — Lite signers are now correctly rejected on
- dede259: - New
dot buildcommand — auto-detects pnpm/yarn/bun/npm from the project's lockfile and runs thebuildscript. Falls back to direct vite/next/tsc invocation when no build script is defined.- New interactive
dot deployflow. Prompts in order: signer (devdefault /phone), build directory (defaultdist/), domain, and publish-to-playground (y/n). After inputs are chosen the TUI shows a dynamic summary card announcing exactly how many phone approvals will be requested and what each one is for. - Two signer modes for deploy:
--signer dev—0phone approvals if you don't publish to Playground,1if you do. Upload and DotNS are done with shared dev keys.--signer phone—3approvals (DotNS commitment, finalize, setContenthash) +1for Playground publish if enabled.
- Flags:
--signer,--domain,--buildDir,--playground,--suri,--env. Passing all four of--signer,--domain,--buildDir, and--playgroundruns non-interactively. - Publishing to the Playground registry is always signed by the user, so the contract records their address as the app owner. This is what drives the playground-app "my apps" view.
- Domain availability preflight — after you type a domain we hit DotNS's
classifyName+checkOwnership(view calls, no phone taps) so names reserved for governance or already registered by a different account are caught BEFORE we build and upload. Headless mode fails fast with the reason; interactive mode shows the reason inline and lets you type a different name without restarting. - Re-deploying the same domain now works. The availability check used to fall back to bulletin-deploy's default dev mnemonic for the ownership comparison, so a domain owned by the user's own phone signer came back as
taken— blocking every legitimate content update. The caller now passes their SS58 address, we derive the H160 via@polkadot-apps/address::ss58ToH160, andcheckOwnership(label, userH160)returnsowned: truewhen the user is the owner → we surface it as anavailablewith the note "Already owned by you — will update the existing deployment.". - All chain URLs, contract addresses, and the
testnet/mainnetswitch consolidated into a singlesrc/config.ts. - Deploy SDK is importable from
src/utils/deploywithout pulling in React/Ink so WebContainer consumers (RevX) can drive their own UI off the same event stream. - Workaround for Bun compiled-binary TTY stdin bug that prevented
useInput-driven TUIs from receiving keystrokes or Ctrl+C. A no-opreadablelistener is attached at CLI entry as a warm-up. - Bumped
bulletin-deployfrom 0.6.7 to 0.6.9-rc.4. FixesWS halt (3)during chunk upload (heartbeat bumped from 40s to 300s to exceed the 60s chunk timeout) and eliminates nonce-hopping on retries that used to duplicate chunk storage and trigger txpool readiness timeouts. Pin is deliberately on the RC tag — thelatestnpm tag still points at the broken 0.6.8. - Fixed runaway memory use (observed 20+ GB) during long deploys. The TUI was calling
setStateon every build-log and bulletin-deploy console line; verbose frameworks and retry storms produced enough React update backpressure to balloon the process. Info updates are now coalesced to ≤10/sec and capped at 160 chars. - Fixed
Contract execution would revertfailure in the Playground publish step. The metadata-JSON upload was routed throughbulletin-deploy.deploy(), which unconditionally runs a second DotNSregister()+setContenthash()on a randomly generatedtest-domain-<id>label — that's what was reverting. We now upload the metadata via@polkadot-apps/bulletin::upload()(pureTransactionStorage.store, no DotNS) and only invoke DotNS for the user's real domain. The user's phone signer is now correctly driven whenregistry.publish()fires, so the "Check your phone" panel appears as expected. - Fixed
WS halt (3)recurrence after switching the metadata upload to@polkadot-apps/bulletin. That path went through the shared@polkadot-apps/chain-clientBulletin WS, which uses polkadot-api's 40 s default heartbeat — shorter than a singleTransactionStorage.storesubmission. The upload now uses a dedicated Bulletin client built withheartbeatTimeout: 300 sand destroyed immediately after (same valuebulletin-deployuses for its own clients). - Added a multi-layer process-guard (
src/utils/process-guard.ts) to eliminate zombiedotprocesses that had been observed accumulating to 25+ GB of RSS and triggering OS swap-death. (1) SIGINT/SIGTERM/SIGHUP andunhandledRejectionall run cleanup hooks and force-exit within 3 s; (2) after the deploy's main flow returns, anunref'd hard-exit timer kills the process if a leaked WebSocket keeps the event loop alive past a grace period; (3) a 4 GB absolute RSS watchdog aborts the deploy before the machine swaps to death; (4)BULLETIN_DEPLOY_TELEMETRYis defaulted to"0"so Sentry can no longer buffer breadcrumbs; (5) the stdin warmup listener isunref'd so it doesn't hold the loop open on exit. SetDOT_MEMORY_TRACE=1to stream per-sample memory stats (RSS / heap / external) when diagnosing a real leak. - Bumped
bulletin-deployfrom 0.6.9-rc.4 to 0.6.9-rc.6 (picks up DotNS commit-reveal + commitment-age fixes). - Cut the log-event firehose:
DeployLogParsernow only emits events for phase banners and[N/M]chunk progress — NOT for every info prose line bulletin-deploy prints. Previously every line allocated an event object + traversed the orchestrator→TUI pipeline, compounding heap pressure during long chunk uploads. - Fixed deployed sites returning
{"message":"404: Not found"}in Polkadot Desktop. Bulletin-deploy's pure-JS merkleizer (jsMerkle: truepath) produces CARs containing only the raw leaf blocks — the DAG-PB directory/file structural nodes are silently dropped byblockstore-core/memory'sgetAll()iterator. Desktop fetches the CAR, sees the declared root CID, finds no block for it in the CAR, parses zero files, renders 404. We now leavejsMerkleoff so bulletin-deploy uses the Kubo binary path (ipfs add -r ...) which produces a complete, parseable CAR.dot initinstallsipfs, so this works out of the box. Note: this temporarily regresses the RevX WebContainer story for the main storage upload — we'll flipjsMerkle: trueback on once the upstream merkleizer is fixed to collect all blocks, not just leaves.
- New interactive
- ba4f091: -
dot initnow runs account setup after QR login + toolchain install: funds the account from Alice (testnet), signsRevive.map_accountvia the mobile wallet, and grants bulletin allowance.- New
dot updatecommand — self-updates from GitHub releases with atomic write-then-rename, safe to run over the live binary. - Session signer now routes transactions through
signPayloadto avoid the mobile's<Bytes>wrap that producedBadProofon-chain. - Connection singleton with a 30 s timeout and preserved
Error.causefor debugging. install.shpropagates the exit code of the auto-rundot init.- Introduced a vitest suite (73 tests across 9 files).
- New
- 23abf79: Scaffold init, mod, build, and deploy commands
- 8a0e3cc: Initial CLI setup