feat(auth): fix QR pairing and sign as the RFC-0022 product account (product-sdk-terminal 0.10.0)

.changeset/bulletin-deploy-0200.md

@@ -0,0 +1,22 @@
+---
+"playground-cli": patch
+---
+
+Update `bulletin-deploy` to 0.20.0.
+
+Fixes two crashes that ended a deploy after the content was already uploaded.
+One of them is a crash we hit in practice: `JSON.parse` on incoming RPC data was
+unguarded and threw inside the socket handler, where nothing upstream could
+catch it, killing the process mid-deploy. The other is `hasIPFS()` passing when
+`ipfs` is installed but was never initialised.
+
+Also brings, from 0.19.x: the storage-deposit floor for registering a name drops
+from a hardcoded 200 PAS to 5 PAS (measured cost is ~0.15), registers no longer
+revert when the chain moves between dry-run and inclusion, duplicate files in a
+bundle upload once instead of twice, an interrupted register no longer strands
+the commitment fee, Bulletin re-authorizes on an exhausted-but-unexpired quota,
+and deploying refuses to silently fall back to the public dev key when a stored
+session can't be read.
+
+Additive for us: `deploy()`'s signature is unchanged, every option we pass still
+exists, and the log banners the progress bar parses are intact.

.changeset/rfc0022-product-accounts.md

@@ -0,0 +1,32 @@
+---
+"playground-cli": minor
+---
+
+Fix QR pairing, and sign as the RFC-0022 product account.
+
+`playground login` has been unable to pair with current phones since
+mid-August: `@novasamatech/host-papp` 0.9.0 moved the pairing envelope from
+P-256/AES-GCM to X25519/ChaCha20-Poly1305, shrinking the device key from 65 to
+32 bytes. The handshake codec is fixed-width, so there was no graceful
+degrade — iOS reported "Something went wrong" and Android "invalid QR code".
+Moving to `@parity/product-sdk-terminal@0.10.0` (host-papp 0.10.0) puts the CLI
+back on the wire both shipping apps speak.
+
+The same release changes how the product account is derived. RFC-0022 places it
+at `//product//{productId}/{index}`, where the two `//product//{productId}`
+junctions are HARD — and a public key cannot cross a hard junction, so the
+account is now derived from a subtree key the wallet provides rather than from
+the session's root key locally.
+
+**Your product account address changes, and you must pair again.** Run
+`playground logout` and then `playground login`. Apps published from the old
+address stay owned by it; allowances and PGAS are re-granted at the next login.
+The new derivation is what current phones and the playground web app already
+use, so this brings the CLI back into agreement with them rather than away.
+
+Deploy also stops presenting a retry as progress. The phone-approval counter
+was counting signature *requests*, so a request that timed out and was re-sent
+appeared as the next step — and contradicted the "Phone approvals expected"
+plan, which counts operations. A deploy could print "step 2: Link content"
+while the plan said step 2 was the registry publish. Repeats are now labelled
+as retries, with the remedy worth checking when no prompt appeared at all.

package.json

@@ -34,15 +34,15 @@
         "@parity/product-sdk-contracts": "^0.10.1",
         "@parity/product-sdk-descriptors": "^0.9.0",
         "@parity/product-sdk-host": "^0.15.1",
-        "@parity/product-sdk-keys": "^0.3.18",
+        "@parity/product-sdk-keys": "^0.4.0",
         "@parity/product-sdk-logger": "^0.1.1",
-        "@parity/product-sdk-terminal": "^0.7.1",
+        "@parity/product-sdk-terminal": "^0.10.0",
         "@parity/product-sdk-tx": "^0.4.1",
         "@parity/product-sdk-utils": "^0.1.1",
         "@polkadot-api/sdk-ink": "^0.7.0",
         "@scure/sr25519": "^2.2.0",
         "@sentry/node": "^9.47.1",
-        "bulletin-deploy": "0.18.4",
+        "bulletin-deploy": "0.20.0",
         "commander": "^12.0.0",
         "ink": "^5.2.1",
         "polkadot-api": "^2.2.1",