Skip to content

Migrate CLI to product-sdk#148

Open
charlesHetterich wants to merge 8 commits intomainfrom
migrate-to-product-sdk
Open

Migrate CLI to product-sdk#148
charlesHetterich wants to merge 8 commits intomainfrom
migrate-to-product-sdk

Conversation

@charlesHetterich
Copy link
Copy Markdown
Collaborator

@charlesHetterich charlesHetterich commented May 8, 2026

closes #144
closes #145

Summary

  • migrate direct @polkadot-apps/* dependencies/imports to @parity/product-sdk-*
  • use terminal product-account signing for playground.dot while preserving the dot-cli session namespace
  • update PAPI v2 chain access, Bulletin metadata upload/gateway reads, and remove the old session signer patch

Verification

  • pnpm install
  • npx tsc --noEmit
  • pnpm test
  • pnpm format:check
  • pnpm build
  • pnpm cli:install
  • bun run src/index.ts deploy --help
  • bun run src/index.ts logout --help
  • bun run src/index.ts init --help
  • ~/.polkadot/bin/dot --help

Notes

  • pnpm-lock.yaml still contains transitive @polkadot-apps/* entries through @dotdm/contracts@1.0.1; direct app/runtime imports are migrated.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 8, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​polkadot-api/​sdk-ink@​0.7.0821007593100
Updatednpm/​bulletin-deploy@​0.7.12 ⏵ 0.7.1378 +1100100 +196 +1100
Updatednpm/​polkadot-api@​2.0.2 ⏵ 2.1.288 +110094 +198 +1100

View full report

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

Dev build ready — try this branch:

curl -fsSL https://raw.githubusercontent.com/paritytech/playground-cli/main/install.sh | VERSION=dev/migrate-to-product-sdk bash

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 8, 2026

E2E Test Pass · ❌ FAIL

Tag: e2e-ci-pr · Branch: migrate-to-product-sdk · Commit: 8af44d8 · Run logs

Cell Result Time
pr-deploy-cdm ❌ FAIL 3m36s
pr-deploy-foundry ❌ FAIL 2m24s
pr-init-session ✅ PASS 1m45s
pr-deploy-frontend ✅ PASS 11m01s
pr-install ✅ PASS 0m52s
pr-preflight ✅ PASS 2m30s
pr-mod ✅ PASS 1m41s
${{ matrix.cell }} ⏭️ SKIP 0m00s
${{ matrix.cell }} ⏭️ SKIP 0m00s

Sentry traces: view spans for this run

@charlesHetterich charlesHetterich force-pushed the migrate-to-product-sdk branch from 1d9f7ef to 0b5960c Compare May 8, 2026 03:42
charlesHetterich and others added 7 commits May 8, 2026 00:27
…dProof

The published @parity/product-sdk-terminal@0.1.0 funnels every signing op
through session.signRaw, which the mobile wallet wraps with <Bytes>...</Bytes>
(anti-phishing envelope, see polkadot-app-android-v2's
MessageSigningContext.kt::generalUntrustedMessage). For tx payloads that
produces a signature the chain rejects as BadProof.

Mirror the upstream fix (paritytech/product-sdk a33edf3) locally in
auth.ts: build a PJS signer with split callbacks — tx via session.signPayload
(no envelope), bytes via session.signRaw (envelope correct for free-form
data). Drop back to createSessionSignerForAccount once the upstream fix
ships on npm.

Also: pin @parity/product-sdk-* to exact versions (pre-1.0 SDK; carets
let patch bumps silently flip wire shape), bump changeset to minor (the
PR is a runtime SDK swap), refresh CLAUDE.md and README.md to reflect
the product-sdk surface and the still-load-bearing <Bytes> invariant.
…, tests

- AGENTS.md: refresh dependency rules (drop stale @polkadot-apps/chain-client
  reference, document the @dotdm/contracts/PAPI-1.x blocker), update the
  metadata-upload rule to point at calculateCid + direct PAPI submit, and
  add a Runtime Safety entry for the still-load-bearing <Bytes> mobile-wrap
  invariant + the createPlaygroundSigner workaround.
- tools/list-registry-apps.ts: drop the inline fetchJsonFromGateway (own
  goal in commit ac4aaaa) and reuse src/utils/bulletinGateway.ts, which
  reads the gateway URL from getChainConfig() instead of hardcoding paseo.
- src/utils/auth.ts: mark makeSignPayloadCallback / makeSignRawCallback
  @internal, mirroring the existing clearLocalAppStorage convention so
  the test seams aren't mistaken for a public API.
- src/utils/bulletinGateway.test.ts: cover URL composition, 2xx/non-2xx
  paths, abort-on-timeout, and JSON parsing — 8 new tests, all passing.
… logout

@parity/product-sdk-terminal@0.1.0::destroy() tears down the underlying
polkadot-api client without awaiting in-flight statement-subscription
unsubscribes. PAPI's raw-client disconnect() then errors every pending
request with `new DestroyedError("Client destroyed")`
(@polkadot-api/raw-client/dist/esm/createClient.mjs:58 —
`responses.forEach((r) => r.onError(new DestroyedError()))`), which
surfaces as an unhandled promise rejection right above our "✓ signed
out" line.

The error is benign: the actual logout already succeeded, this fires
purely as a teardown-race artifact. DestroyedError is exclusive to
PAPI's raw-client teardown path (only `disconnect()` constructs and
throws this class), so matching the bare error name in our existing
benign-unsubscription filter is safe.

Same family as the UnsubscriptionError / Not connected and DisjointError
shapes we already suppress for `dot deploy`. Real upstream fix is for
product-sdk-terminal's destroy() to drain statement-subscription
teardowns before disconnecting the lazy client; tracking that
separately.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Playground-CLI to the new terminal package in product SDK dot init is failing when logged out with: innerDecoder is not a function (v0.19.3)

2 participants