everything-dev 1.30.0 → 1.31.1

package/dist/near-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"near-cli.cjs","names":["Effect"],"sources":["../src/near-cli.ts"],"sourcesContent":["import { generateKeyPairSync } from \"node:crypto\";\nimport { Effect } from \"effect\";\nimport { execa } from \"execa\";\n\nexport interface NearTransactionConfig {\n  account: string;\n  contract: string;\n  method: string;\n  argsBase64: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  gas?: string;\n  deposit?: string;\n}\n\nexport interface NearTransactionResult {\n  success: boolean;\n  txHash?: string;\n  error?: string;\n}\n\nexport interface NearKeyPair {\n  publicKey: string;\n  privateKey: string;\n}\n\nexport interface FunctionCallAccessKeyConfig {\n  account: string;\n  contract: string;\n  allowance: string;\n  functionNames: string[];\n  network?: \"mainnet\" | \"testnet\";\n}\n\nconst NEAR_CLI_VERSION = \"0.23.5\";\nconst INSTALLER_URL = `https://github.com/near/near-cli-rs/releases/download/v${NEAR_CLI_VERSION}/near-cli-rs-installer.sh`;\nconst BASE58_ALPHABET = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n\nexport class NearCliNotFoundError extends Error {\n  readonly _tag = \"NearCliNotFoundError\";\n  constructor() {\n    super(\"NEAR CLI not found\");\n  }\n}\n\nexport class NearCliInstallError extends Error {\n  readonly _tag = \"NearCliInstallError\";\n  constructor(message: string) {\n    super(`Failed to install NEAR CLI: ${message}`);\n  }\n}\n\nexport class NearTransactionError extends Error {\n  readonly _tag = \"NearTransactionError\";\n}\n\nfunction base64UrlToBytes(input: string): Uint8Array {\n  const normalized = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  return new Uint8Array(Buffer.from(normalized, \"base64\"));\n}\n\nfunction base58Encode(input: Uint8Array): string {\n  if (input.length === 0) return \"\";\n\n  const digits: number[] = [0];\n  for (const byte of input) {\n    let carry = byte;\n    for (let i = 0; i < digits.length; i++) {\n      carry += digits[i]! << 8;\n      digits[i] = carry % 58;\n      carry = Math.floor(carry / 58);\n    }\n    while (carry > 0) {\n      digits.push(carry % 58);\n      carry = Math.floor(carry / 58);\n    }\n  }\n\n  let output = \"\";\n  for (const byte of input) {\n    if (byte === 0) output += BASE58_ALPHABET[0];\n    else break;\n  }\n\n  for (let i = digits.length - 1; i >= 0; i--) {\n    output += BASE58_ALPHABET[digits[i]!]!;\n  }\n\n  return output;\n}\n\nexport function generateNearKeyPair(): NearKeyPair {\n  const { publicKey, privateKey } = generateKeyPairSync(\"ed25519\");\n  const publicJwk = publicKey.export({ format: \"jwk\" }) as JsonWebKey;\n  const privateJwk = privateKey.export({ format: \"jwk\" }) as JsonWebKey;\n\n  if (!publicJwk.x || !privateJwk.d) {\n    throw new Error(\"Failed to generate NEAR keypair\");\n  }\n\n  const publicBytes = base64UrlToBytes(publicJwk.x);\n  const privateSeed = base64UrlToBytes(privateJwk.d);\n  const secretBytes = new Uint8Array(privateSeed.length + publicBytes.length);\n  secretBytes.set(privateSeed, 0);\n  secretBytes.set(publicBytes, privateSeed.length);\n\n  return {\n    publicKey: `ed25519:${base58Encode(publicBytes)}`,\n    privateKey: `ed25519:${base58Encode(secretBytes)}`,\n  };\n}\n\nconst checkNearCliInstalled = Effect.tryPromise({\n  try: async () => {\n    try {\n      await execa(\"near\", [\"--version\"], { stdio: \"pipe\" });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n  catch: () => new Error(\"Failed to check NEAR CLI\"),\n});\n\nconst installNearCli = Effect.tryPromise({\n  try: async () => {\n    await execa(\"sh\", [\"-c\", `curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`], {\n      stdio: \"inherit\",\n    });\n  },\n  catch: (error) => {\n    if (error instanceof Error && \"exitCode\" in error) {\n      return new NearCliInstallError(\n        `Installer exited with code ${(error as { exitCode: number }).exitCode}`,\n      );\n    }\n    return new NearCliInstallError(error instanceof Error ? error.message : String(error));\n  },\n});\n\nasync function runNearCommand(args: string[]): Promise<void> {\n  await execa(\"near\", args, { stdio: \"inherit\" });\n}\n\nexport const ensureNearCli = Effect.gen(function* () {\n  const isInstalled = yield* checkNearCliInstalled;\n  if (isInstalled) return;\n\n  if (process.env.BOS_INSTALL_NEAR_CLI === \"true\") {\n    yield* installNearCli;\n    return;\n  }\n\n  console.log();\n  console.log(\"  NEAR CLI not found\");\n\n  console.log();\n  console.log(`  To install manually: curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`);\n  console.log();\n  yield* Effect.fail(new NearCliNotFoundError());\n});\n\nexport const executeTransaction = (\n  config: NearTransactionConfig,\n): Effect.Effect<NearTransactionResult, Error> =>\n  Effect.gen(function* () {\n    const gas = (config.gas || \"300Tgas\").replace(/\\s+/g, \"\");\n    const deposit = (config.deposit || \"0NEAR\").replace(/\\s+/g, \"\");\n    const network = config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\");\n\n    const args = [\n      \"contract\",\n      \"call-function\",\n      \"as-transaction\",\n      config.contract,\n      config.method,\n      \"base64-args\",\n      config.argsBase64,\n      \"prepaid-gas\",\n      gas,\n      \"attached-deposit\",\n      deposit,\n      \"sign-as\",\n      config.account,\n      \"network-config\",\n      network,\n    ];\n\n    if (config.privateKey) {\n      args.push(\"sign-with-plaintext-private-key\", config.privateKey, \"send\");\n    } else {\n      args.push(\"sign-with-keychain\", \"send\");\n    }\n\n    const output = yield* Effect.tryPromise({\n      try: async () => {\n        const result = await execa(\"near\", args, {\n          stdin: \"inherit\",\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n          reject: false,\n        });\n\n        process.stdout.write(result.stdout);\n        const combined = `${result.stdout}\\n${result.stderr}`;\n        const txHashMatch = combined.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n        const hasCodeDoesNotExist = /CodeDoesNotExist/i.test(combined);\n        const hasTransactionFailed = /Transaction failed/i.test(combined);\n        const softSuccess =\n          Boolean(txHashMatch?.[1]) && hasCodeDoesNotExist && hasTransactionFailed;\n\n        if (result.exitCode === 0 || softSuccess) {\n          if (softSuccess) {\n            console.log(`  ${txHashMatch?.[1]} — FastDATA CodeDoesNotExist (expected)`);\n          }\n          return combined;\n        }\n\n        throw new NearTransactionError(\n          result.stderr || `Transaction failed with code ${result.exitCode}`,\n        );\n      },\n      catch: (error) => error as Error,\n    });\n\n    const txHashMatch = output.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n\n    return {\n      success: true,\n      txHash: txHashMatch?.[1],\n    };\n  });\n\nexport async function addFunctionCallAccessKey(\n  config: FunctionCallAccessKeyConfig,\n): Promise<NearKeyPair> {\n  const keyPair = generateNearKeyPair();\n  const args = [\n    \"account\",\n    \"add-key\",\n    config.account,\n    \"grant-function-call-access\",\n    \"--allowance\",\n    config.allowance,\n    \"--contract-account-id\",\n    config.contract,\n    \"--function-names\",\n    config.functionNames.join(\", \"),\n    \"use-manually-provided-public-key\",\n    keyPair.publicKey,\n    \"network-config\",\n    config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\"),\n    \"sign-with-keychain\",\n    \"send\",\n  ];\n\n  await runNearCommand(args);\n  return keyPair;\n}\n"],"mappings":";;;;;;AAmCA,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AAExB,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;CAChB,cAAc;AACZ,QAAM,qBAAqB;;;AAI/B,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS,OAAO;CAChB,YAAY,SAAiB;AAC3B,QAAM,+BAA+B,UAAU;;;AAInD,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;;AAGlB,SAAS,iBAAiB,OAA2B;CACnD,MAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;AAC9D,QAAO,IAAI,WAAW,OAAO,KAAK,YAAY,SAAS,CAAC;;AAG1D,SAAS,aAAa,OAA2B;AAC/C,KAAI,MAAM,WAAW,EAAG,QAAO;CAE/B,MAAM,SAAmB,CAAC,EAAE;AAC5B,MAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,QAAQ;AACZ,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAS,OAAO,MAAO;AACvB,UAAO,KAAK,QAAQ;AACpB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;AAEhC,SAAO,QAAQ,GAAG;AAChB,UAAO,KAAK,QAAQ,GAAG;AACvB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;;CAIlC,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MACjB,KAAI,SAAS,EAAG,WAAU,gBAAgB;KACrC;AAGP,MAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,IACtC,WAAU,gBAAgB,OAAO;AAGnC,QAAO;;AAGT,SAAgB,sBAAmC;CACjD,MAAM,EAAE,WAAW,oDAAmC,UAAU;CAChE,MAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,CAAC;CACrD,MAAM,aAAa,WAAW,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEvD,KAAI,CAAC,UAAU,KAAK,CAAC,WAAW,EAC9B,OAAM,IAAI,MAAM,kCAAkC;CAGpD,MAAM,cAAc,iBAAiB,UAAU,EAAE;CACjD,MAAM,cAAc,iBAAiB,WAAW,EAAE;CAClD,MAAM,cAAc,IAAI,WAAW,YAAY,SAAS,YAAY,OAAO;AAC3E,aAAY,IAAI,aAAa,EAAE;AAC/B,aAAY,IAAI,aAAa,YAAY,OAAO;AAEhD,QAAO;EACL,WAAW,WAAW,aAAa,YAAY;EAC/C,YAAY,WAAW,aAAa,YAAY;EACjD;;AAGH,MAAM,wBAAwBA,cAAO,WAAW;CAC9C,KAAK,YAAY;AACf,MAAI;AACF,0BAAY,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,QAAQ,CAAC;AACrD,UAAO;UACD;AACN,UAAO;;;CAGX,6BAAa,IAAI,MAAM,2BAA2B;CACnD,CAAC;AAEF,MAAM,iBAAiBA,cAAO,WAAW;CACvC,KAAK,YAAY;AACf,yBAAY,MAAM,CAAC,MAAM,yCAAyC,cAAc,OAAO,EAAE,EACvF,OAAO,WACR,CAAC;;CAEJ,QAAQ,UAAU;AAChB,MAAI,iBAAiB,SAAS,cAAc,MAC1C,QAAO,IAAI,oBACT,8BAA+B,MAA+B,WAC/D;AAEH,SAAO,IAAI,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;CAEzF,CAAC;AAEF,eAAe,eAAe,MAA+B;AAC3D,wBAAY,QAAQ,MAAM,EAAE,OAAO,WAAW,CAAC;;AAGjD,MAAa,gBAAgBA,cAAO,IAAI,aAAa;AAEnD,KAAI,OADuB,sBACV;AAEjB,KAAI,QAAQ,IAAI,yBAAyB,QAAQ;AAC/C,SAAO;AACP;;AAGF,SAAQ,KAAK;AACb,SAAQ,IAAI,uBAAuB;AAEnC,SAAQ,KAAK;AACb,SAAQ,IAAI,gEAAgE,cAAc,OAAO;AACjG,SAAQ,KAAK;AACb,QAAOA,cAAO,KAAK,IAAI,sBAAsB,CAAC;EAC9C;AAEF,MAAa,sBACX,WAEAA,cAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,QAAQ,GAAG;CACzD,MAAM,WAAW,OAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,UAAU,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;CAErF,MAAM,OAAO;EACX;EACA;EACA;EACA,OAAO;EACP,OAAO;EACP;EACA,OAAO;EACP;EACA;EACA;EACA;EACA;EACA,OAAO;EACP;EACA;EACD;AAED,KAAI,OAAO,WACT,MAAK,KAAK,mCAAmC,OAAO,YAAY,OAAO;KAEvE,MAAK,KAAK,sBAAsB,OAAO;AAoCzC,QAAO;EACL,SAAS;EACT,SAJkB,OA/BEA,cAAO,WAAW;GACtC,KAAK,YAAY;IACf,MAAM,SAAS,uBAAY,QAAQ,MAAM;KACvC,OAAO;KACP,QAAQ;KACR,QAAQ;KACR,QAAQ;KACT,CAAC;AAEF,YAAQ,OAAO,MAAM,OAAO,OAAO;IACnC,MAAM,WAAW,GAAG,OAAO,OAAO,IAAI,OAAO;IAC7C,MAAM,cAAc,SAAS,MAAM,oCAAoC;IACvE,MAAM,sBAAsB,oBAAoB,KAAK,SAAS;IAC9D,MAAM,uBAAuB,sBAAsB,KAAK,SAAS;IACjE,MAAM,cACJ,QAAQ,cAAc,GAAG,IAAI,uBAAuB;AAEtD,QAAI,OAAO,aAAa,KAAK,aAAa;AACxC,SAAI,YACF,SAAQ,IAAI,KAAK,cAAc,GAAG,yCAAyC;AAE7E,YAAO;;AAGT,UAAM,IAAI,qBACR,OAAO,UAAU,gCAAgC,OAAO,WACzD;;GAEH,QAAQ,UAAU;GACnB,CAAC,EAEyB,MAAM,oCAIZ,GAAG;EACvB;EACD;AAEJ,eAAsB,yBACpB,QACsB;CACtB,MAAM,UAAU,qBAAqB;AAoBrC,OAAM,eAAe;EAlBnB;EACA;EACA,OAAO;EACP;EACA;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO,cAAc,KAAK,KAAK;EAC/B;EACA,QAAQ;EACR;EACA,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;EACrE;EACA;EAGuB,CAAC;AAC1B,QAAO"}
+{"version":3,"file":"near-cli.cjs","names":["Effect","colors"],"sources":["../src/near-cli.ts"],"sourcesContent":["import { generateKeyPairSync } from \"node:crypto\";\nimport { Effect } from \"effect\";\nimport { execa } from \"execa\";\nimport { colors } from \"./utils/theme\";\n\nexport interface NearTransactionConfig {\n  account: string;\n  contract: string;\n  method: string;\n  argsBase64: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  gas?: string;\n  deposit?: string;\n}\n\nexport interface NearTransactionResult {\n  success: boolean;\n  txHash?: string;\n  error?: string;\n}\n\nexport interface NearKeyPair {\n  publicKey: string;\n  privateKey: string;\n}\n\nexport interface FunctionCallAccessKeyConfig {\n  account: string;\n  contract: string;\n  allowance: string;\n  functionNames: string[];\n  network?: \"mainnet\" | \"testnet\";\n}\n\nconst NEAR_CLI_VERSION = \"0.23.5\";\nconst INSTALLER_URL = `https://github.com/near/near-cli-rs/releases/download/v${NEAR_CLI_VERSION}/near-cli-rs-installer.sh`;\nconst BASE58_ALPHABET = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n\nexport class NearCliNotFoundError extends Error {\n  readonly _tag = \"NearCliNotFoundError\";\n  constructor() {\n    super(\"NEAR CLI not found\");\n  }\n}\n\nexport class NearCliInstallError extends Error {\n  readonly _tag = \"NearCliInstallError\";\n  constructor(message: string) {\n    super(`Failed to install NEAR CLI: ${message}`);\n  }\n}\n\nexport class NearTransactionError extends Error {\n  readonly _tag = \"NearTransactionError\";\n}\n\nfunction base64UrlToBytes(input: string): Uint8Array {\n  const normalized = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  return new Uint8Array(Buffer.from(normalized, \"base64\"));\n}\n\nfunction base58Encode(input: Uint8Array): string {\n  if (input.length === 0) return \"\";\n\n  const digits: number[] = [0];\n  for (const byte of input) {\n    let carry = byte;\n    for (let i = 0; i < digits.length; i++) {\n      carry += digits[i]! << 8;\n      digits[i] = carry % 58;\n      carry = Math.floor(carry / 58);\n    }\n    while (carry > 0) {\n      digits.push(carry % 58);\n      carry = Math.floor(carry / 58);\n    }\n  }\n\n  let output = \"\";\n  for (const byte of input) {\n    if (byte === 0) output += BASE58_ALPHABET[0];\n    else break;\n  }\n\n  for (let i = digits.length - 1; i >= 0; i--) {\n    output += BASE58_ALPHABET[digits[i]!]!;\n  }\n\n  return output;\n}\n\nexport function generateNearKeyPair(): NearKeyPair {\n  const { publicKey, privateKey } = generateKeyPairSync(\"ed25519\");\n  const publicJwk = publicKey.export({ format: \"jwk\" }) as JsonWebKey;\n  const privateJwk = privateKey.export({ format: \"jwk\" }) as JsonWebKey;\n\n  if (!publicJwk.x || !privateJwk.d) {\n    throw new Error(\"Failed to generate NEAR keypair\");\n  }\n\n  const publicBytes = base64UrlToBytes(publicJwk.x);\n  const privateSeed = base64UrlToBytes(privateJwk.d);\n  const secretBytes = new Uint8Array(privateSeed.length + publicBytes.length);\n  secretBytes.set(privateSeed, 0);\n  secretBytes.set(publicBytes, privateSeed.length);\n\n  return {\n    publicKey: `ed25519:${base58Encode(publicBytes)}`,\n    privateKey: `ed25519:${base58Encode(secretBytes)}`,\n  };\n}\n\nconst checkNearCliInstalled = Effect.tryPromise({\n  try: async () => {\n    try {\n      await execa(\"near\", [\"--version\"], { stdio: \"pipe\" });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n  catch: () => new Error(\"Failed to check NEAR CLI\"),\n});\n\nconst installNearCli = Effect.tryPromise({\n  try: async () => {\n    await execa(\"sh\", [\"-c\", `curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`], {\n      stdin: \"ignore\",\n      stdout: \"inherit\",\n      stderr: \"inherit\",\n    });\n  },\n  catch: (error) => {\n    if (error instanceof Error && \"exitCode\" in error) {\n      return new NearCliInstallError(\n        `Installer exited with code ${(error as { exitCode: number }).exitCode}`,\n      );\n    }\n    return new NearCliInstallError(error instanceof Error ? error.message : String(error));\n  },\n});\n\nasync function runNearCommand(args: string[]): Promise<void> {\n  await execa(\"near\", args, { stdin: \"pipe\", stdout: \"inherit\", stderr: \"inherit\" });\n}\n\nexport const ensureNearCli = Effect.gen(function* () {\n  const isInstalled = yield* checkNearCliInstalled;\n  if (isInstalled) return;\n\n  if (process.env.BOS_INSTALL_NEAR_CLI === \"true\") {\n    yield* installNearCli;\n    return;\n  }\n\n  console.log();\n  console.log(\"  NEAR CLI not found\");\n\n  console.log();\n  console.log(`  To install manually: curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`);\n  console.log();\n  yield* Effect.fail(new NearCliNotFoundError());\n});\n\nexport const executeTransaction = (\n  config: NearTransactionConfig,\n): Effect.Effect<NearTransactionResult, Error> =>\n  Effect.gen(function* () {\n    const gas = (config.gas || \"300Tgas\").replace(/\\s+/g, \"\");\n    const deposit = (config.deposit || \"0NEAR\").replace(/\\s+/g, \"\");\n    const network = config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\");\n\n    const args = [\n      \"contract\",\n      \"call-function\",\n      \"as-transaction\",\n      config.contract,\n      config.method,\n      \"base64-args\",\n      config.argsBase64,\n      \"prepaid-gas\",\n      gas,\n      \"attached-deposit\",\n      deposit,\n      \"sign-as\",\n      config.account,\n      \"network-config\",\n      network,\n    ];\n\n    if (config.privateKey) {\n      args.push(\"sign-with-plaintext-private-key\", config.privateKey, \"send\");\n    } else {\n      if (!process.stdin.isTTY) {\n        return {\n          success: false,\n          error:\n            \"No private key provided and no TTY available for keychain signing. Set NEAR_PRIVATE_KEY environment variable to sign locally.\",\n        };\n      }\n      console.log(\n        colors.yellow(\n          \"  Warning: No NEAR_PRIVATE_KEY set — falling back to interactive keychain signing.\",\n        ),\n      );\n      args.push(\"sign-with-keychain\", \"send\");\n    }\n\n    const output = yield* Effect.tryPromise({\n      try: async () => {\n        const result = await execa(\"near\", args, {\n          stdin: config.privateKey ? \"pipe\" : \"inherit\",\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n          reject: false,\n        });\n\n        process.stdout.write(result.stdout);\n        const combined = `${result.stdout}\\n${result.stderr}`;\n        const txHashMatch = combined.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n        const hasCodeDoesNotExist = /CodeDoesNotExist/i.test(combined);\n        const hasTransactionFailed = /Transaction failed/i.test(combined);\n        const softSuccess =\n          Boolean(txHashMatch?.[1]) && hasCodeDoesNotExist && hasTransactionFailed;\n\n        if (result.exitCode === 0 || softSuccess) {\n          if (softSuccess) {\n            console.log(`  ${txHashMatch?.[1]} — FastDATA CodeDoesNotExist (expected)`);\n          }\n          return combined;\n        }\n\n        throw new NearTransactionError(\n          result.stderr || `Transaction failed with code ${result.exitCode}`,\n        );\n      },\n      catch: (error) => error as Error,\n    });\n\n    const txHashMatch = output.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n\n    return {\n      success: true,\n      txHash: txHashMatch?.[1],\n    };\n  });\n\nexport async function addFunctionCallAccessKey(\n  config: FunctionCallAccessKeyConfig,\n): Promise<NearKeyPair> {\n  const keyPair = generateNearKeyPair();\n  const args = [\n    \"account\",\n    \"add-key\",\n    config.account,\n    \"grant-function-call-access\",\n    \"--allowance\",\n    config.allowance,\n    \"--contract-account-id\",\n    config.contract,\n    \"--function-names\",\n    config.functionNames.join(\", \"),\n    \"use-manually-provided-public-key\",\n    keyPair.publicKey,\n    \"network-config\",\n    config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\"),\n    \"sign-with-keychain\",\n    \"send\",\n  ];\n\n  await runNearCommand(args);\n  return keyPair;\n}\n"],"mappings":";;;;;;;AAoCA,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AAExB,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;CAChB,cAAc;AACZ,QAAM,qBAAqB;;;AAI/B,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS,OAAO;CAChB,YAAY,SAAiB;AAC3B,QAAM,+BAA+B,UAAU;;;AAInD,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;;AAGlB,SAAS,iBAAiB,OAA2B;CACnD,MAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;AAC9D,QAAO,IAAI,WAAW,OAAO,KAAK,YAAY,SAAS,CAAC;;AAG1D,SAAS,aAAa,OAA2B;AAC/C,KAAI,MAAM,WAAW,EAAG,QAAO;CAE/B,MAAM,SAAmB,CAAC,EAAE;AAC5B,MAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,QAAQ;AACZ,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAS,OAAO,MAAO;AACvB,UAAO,KAAK,QAAQ;AACpB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;AAEhC,SAAO,QAAQ,GAAG;AAChB,UAAO,KAAK,QAAQ,GAAG;AACvB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;;CAIlC,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MACjB,KAAI,SAAS,EAAG,WAAU,gBAAgB;KACrC;AAGP,MAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,IACtC,WAAU,gBAAgB,OAAO;AAGnC,QAAO;;AAGT,SAAgB,sBAAmC;CACjD,MAAM,EAAE,WAAW,oDAAmC,UAAU;CAChE,MAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,CAAC;CACrD,MAAM,aAAa,WAAW,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEvD,KAAI,CAAC,UAAU,KAAK,CAAC,WAAW,EAC9B,OAAM,IAAI,MAAM,kCAAkC;CAGpD,MAAM,cAAc,iBAAiB,UAAU,EAAE;CACjD,MAAM,cAAc,iBAAiB,WAAW,EAAE;CAClD,MAAM,cAAc,IAAI,WAAW,YAAY,SAAS,YAAY,OAAO;AAC3E,aAAY,IAAI,aAAa,EAAE;AAC/B,aAAY,IAAI,aAAa,YAAY,OAAO;AAEhD,QAAO;EACL,WAAW,WAAW,aAAa,YAAY;EAC/C,YAAY,WAAW,aAAa,YAAY;EACjD;;AAGH,MAAM,wBAAwBA,cAAO,WAAW;CAC9C,KAAK,YAAY;AACf,MAAI;AACF,0BAAY,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,QAAQ,CAAC;AACrD,UAAO;UACD;AACN,UAAO;;;CAGX,6BAAa,IAAI,MAAM,2BAA2B;CACnD,CAAC;AAEF,MAAM,iBAAiBA,cAAO,WAAW;CACvC,KAAK,YAAY;AACf,yBAAY,MAAM,CAAC,MAAM,yCAAyC,cAAc,OAAO,EAAE;GACvF,OAAO;GACP,QAAQ;GACR,QAAQ;GACT,CAAC;;CAEJ,QAAQ,UAAU;AAChB,MAAI,iBAAiB,SAAS,cAAc,MAC1C,QAAO,IAAI,oBACT,8BAA+B,MAA+B,WAC/D;AAEH,SAAO,IAAI,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;CAEzF,CAAC;AAEF,eAAe,eAAe,MAA+B;AAC3D,wBAAY,QAAQ,MAAM;EAAE,OAAO;EAAQ,QAAQ;EAAW,QAAQ;EAAW,CAAC;;AAGpF,MAAa,gBAAgBA,cAAO,IAAI,aAAa;AAEnD,KAAI,OADuB,sBACV;AAEjB,KAAI,QAAQ,IAAI,yBAAyB,QAAQ;AAC/C,SAAO;AACP;;AAGF,SAAQ,KAAK;AACb,SAAQ,IAAI,uBAAuB;AAEnC,SAAQ,KAAK;AACb,SAAQ,IAAI,gEAAgE,cAAc,OAAO;AACjG,SAAQ,KAAK;AACb,QAAOA,cAAO,KAAK,IAAI,sBAAsB,CAAC;EAC9C;AAEF,MAAa,sBACX,WAEAA,cAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,QAAQ,GAAG;CACzD,MAAM,WAAW,OAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,UAAU,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;CAErF,MAAM,OAAO;EACX;EACA;EACA;EACA,OAAO;EACP,OAAO;EACP;EACA,OAAO;EACP;EACA;EACA;EACA;EACA;EACA,OAAO;EACP;EACA;EACD;AAED,KAAI,OAAO,WACT,MAAK,KAAK,mCAAmC,OAAO,YAAY,OAAO;MAClE;AACL,MAAI,CAAC,QAAQ,MAAM,MACjB,QAAO;GACL,SAAS;GACT,OACE;GACH;AAEH,UAAQ,IACNC,qBAAO,OACL,qFACD,CACF;AACD,OAAK,KAAK,sBAAsB,OAAO;;AAoCzC,QAAO;EACL,SAAS;EACT,SAJkB,OA/BED,cAAO,WAAW;GACtC,KAAK,YAAY;IACf,MAAM,SAAS,uBAAY,QAAQ,MAAM;KACvC,OAAO,OAAO,aAAa,SAAS;KACpC,QAAQ;KACR,QAAQ;KACR,QAAQ;KACT,CAAC;AAEF,YAAQ,OAAO,MAAM,OAAO,OAAO;IACnC,MAAM,WAAW,GAAG,OAAO,OAAO,IAAI,OAAO;IAC7C,MAAM,cAAc,SAAS,MAAM,oCAAoC;IACvE,MAAM,sBAAsB,oBAAoB,KAAK,SAAS;IAC9D,MAAM,uBAAuB,sBAAsB,KAAK,SAAS;IACjE,MAAM,cACJ,QAAQ,cAAc,GAAG,IAAI,uBAAuB;AAEtD,QAAI,OAAO,aAAa,KAAK,aAAa;AACxC,SAAI,YACF,SAAQ,IAAI,KAAK,cAAc,GAAG,yCAAyC;AAE7E,YAAO;;AAGT,UAAM,IAAI,qBACR,OAAO,UAAU,gCAAgC,OAAO,WACzD;;GAEH,QAAQ,UAAU;GACnB,CAAC,EAEyB,MAAM,oCAIZ,GAAG;EACvB;EACD;AAEJ,eAAsB,yBACpB,QACsB;CACtB,MAAM,UAAU,qBAAqB;AAoBrC,OAAM,eAAe;EAlBnB;EACA;EACA,OAAO;EACP;EACA;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO,cAAc,KAAK,KAAK;EAC/B;EACA,QAAQ;EACR;EACA,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;EACrE;EACA;EAGuB,CAAC;AAC1B,QAAO"}

package/dist/near-cli.mjs

@@ -1,3 +1,4 @@
+import { colors } from "./utils/theme.mjs";
 import { generateKeyPairSync } from "node:crypto";
 import { Effect } from "effect";
 import { execa } from "execa";
@@ -73,7 +74,11 @@ const checkNearCliInstalled = Effect.tryPromise({
 });
 const installNearCli = Effect.tryPromise({
 	try: async () => {
-		await execa("sh", ["-c", `curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`], { stdio: "inherit" });
+		await execa("sh", ["-c", `curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`], {
+			stdin: "ignore",
+			stdout: "inherit",
+			stderr: "inherit"
+		});
 	},
 	catch: (error) => {
 		if (error instanceof Error && "exitCode" in error) return new NearCliInstallError(`Installer exited with code ${error.exitCode}`);
@@ -81,7 +86,11 @@ const installNearCli = Effect.tryPromise({
 	}
 });
 async function runNearCommand(args) {
-	await execa("near", args, { stdio: "inherit" });
+	await execa("near", args, {
+		stdin: "pipe",
+		stdout: "inherit",
+		stderr: "inherit"
+	});
 }
 const ensureNearCli = Effect.gen(function* () {
 	if (yield* checkNearCliInstalled) return;
@@ -118,13 +127,20 @@ const executeTransaction = (config) => Effect.gen(function* () {
 		network
 	];
 	if (config.privateKey) args.push("sign-with-plaintext-private-key", config.privateKey, "send");
-	else args.push("sign-with-keychain", "send");
+	else {
+		if (!process.stdin.isTTY) return {
+			success: false,
+			error: "No private key provided and no TTY available for keychain signing. Set NEAR_PRIVATE_KEY environment variable to sign locally."
+		};
+		console.log(colors.yellow("  Warning: No NEAR_PRIVATE_KEY set — falling back to interactive keychain signing."));
+		args.push("sign-with-keychain", "send");
+	}
 	return {
 		success: true,
 		txHash: (yield* Effect.tryPromise({
 			try: async () => {
 				const result = await execa("near", args, {
-					stdin: "inherit",
+					stdin: config.privateKey ? "pipe" : "inherit",
 					stdout: "pipe",
 					stderr: "pipe",
 					reject: false

package/dist/near-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"near-cli.mjs","names":[],"sources":["../src/near-cli.ts"],"sourcesContent":["import { generateKeyPairSync } from \"node:crypto\";\nimport { Effect } from \"effect\";\nimport { execa } from \"execa\";\n\nexport interface NearTransactionConfig {\n  account: string;\n  contract: string;\n  method: string;\n  argsBase64: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  gas?: string;\n  deposit?: string;\n}\n\nexport interface NearTransactionResult {\n  success: boolean;\n  txHash?: string;\n  error?: string;\n}\n\nexport interface NearKeyPair {\n  publicKey: string;\n  privateKey: string;\n}\n\nexport interface FunctionCallAccessKeyConfig {\n  account: string;\n  contract: string;\n  allowance: string;\n  functionNames: string[];\n  network?: \"mainnet\" | \"testnet\";\n}\n\nconst NEAR_CLI_VERSION = \"0.23.5\";\nconst INSTALLER_URL = `https://github.com/near/near-cli-rs/releases/download/v${NEAR_CLI_VERSION}/near-cli-rs-installer.sh`;\nconst BASE58_ALPHABET = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n\nexport class NearCliNotFoundError extends Error {\n  readonly _tag = \"NearCliNotFoundError\";\n  constructor() {\n    super(\"NEAR CLI not found\");\n  }\n}\n\nexport class NearCliInstallError extends Error {\n  readonly _tag = \"NearCliInstallError\";\n  constructor(message: string) {\n    super(`Failed to install NEAR CLI: ${message}`);\n  }\n}\n\nexport class NearTransactionError extends Error {\n  readonly _tag = \"NearTransactionError\";\n}\n\nfunction base64UrlToBytes(input: string): Uint8Array {\n  const normalized = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  return new Uint8Array(Buffer.from(normalized, \"base64\"));\n}\n\nfunction base58Encode(input: Uint8Array): string {\n  if (input.length === 0) return \"\";\n\n  const digits: number[] = [0];\n  for (const byte of input) {\n    let carry = byte;\n    for (let i = 0; i < digits.length; i++) {\n      carry += digits[i]! << 8;\n      digits[i] = carry % 58;\n      carry = Math.floor(carry / 58);\n    }\n    while (carry > 0) {\n      digits.push(carry % 58);\n      carry = Math.floor(carry / 58);\n    }\n  }\n\n  let output = \"\";\n  for (const byte of input) {\n    if (byte === 0) output += BASE58_ALPHABET[0];\n    else break;\n  }\n\n  for (let i = digits.length - 1; i >= 0; i--) {\n    output += BASE58_ALPHABET[digits[i]!]!;\n  }\n\n  return output;\n}\n\nexport function generateNearKeyPair(): NearKeyPair {\n  const { publicKey, privateKey } = generateKeyPairSync(\"ed25519\");\n  const publicJwk = publicKey.export({ format: \"jwk\" }) as JsonWebKey;\n  const privateJwk = privateKey.export({ format: \"jwk\" }) as JsonWebKey;\n\n  if (!publicJwk.x || !privateJwk.d) {\n    throw new Error(\"Failed to generate NEAR keypair\");\n  }\n\n  const publicBytes = base64UrlToBytes(publicJwk.x);\n  const privateSeed = base64UrlToBytes(privateJwk.d);\n  const secretBytes = new Uint8Array(privateSeed.length + publicBytes.length);\n  secretBytes.set(privateSeed, 0);\n  secretBytes.set(publicBytes, privateSeed.length);\n\n  return {\n    publicKey: `ed25519:${base58Encode(publicBytes)}`,\n    privateKey: `ed25519:${base58Encode(secretBytes)}`,\n  };\n}\n\nconst checkNearCliInstalled = Effect.tryPromise({\n  try: async () => {\n    try {\n      await execa(\"near\", [\"--version\"], { stdio: \"pipe\" });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n  catch: () => new Error(\"Failed to check NEAR CLI\"),\n});\n\nconst installNearCli = Effect.tryPromise({\n  try: async () => {\n    await execa(\"sh\", [\"-c\", `curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`], {\n      stdio: \"inherit\",\n    });\n  },\n  catch: (error) => {\n    if (error instanceof Error && \"exitCode\" in error) {\n      return new NearCliInstallError(\n        `Installer exited with code ${(error as { exitCode: number }).exitCode}`,\n      );\n    }\n    return new NearCliInstallError(error instanceof Error ? error.message : String(error));\n  },\n});\n\nasync function runNearCommand(args: string[]): Promise<void> {\n  await execa(\"near\", args, { stdio: \"inherit\" });\n}\n\nexport const ensureNearCli = Effect.gen(function* () {\n  const isInstalled = yield* checkNearCliInstalled;\n  if (isInstalled) return;\n\n  if (process.env.BOS_INSTALL_NEAR_CLI === \"true\") {\n    yield* installNearCli;\n    return;\n  }\n\n  console.log();\n  console.log(\"  NEAR CLI not found\");\n\n  console.log();\n  console.log(`  To install manually: curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`);\n  console.log();\n  yield* Effect.fail(new NearCliNotFoundError());\n});\n\nexport const executeTransaction = (\n  config: NearTransactionConfig,\n): Effect.Effect<NearTransactionResult, Error> =>\n  Effect.gen(function* () {\n    const gas = (config.gas || \"300Tgas\").replace(/\\s+/g, \"\");\n    const deposit = (config.deposit || \"0NEAR\").replace(/\\s+/g, \"\");\n    const network = config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\");\n\n    const args = [\n      \"contract\",\n      \"call-function\",\n      \"as-transaction\",\n      config.contract,\n      config.method,\n      \"base64-args\",\n      config.argsBase64,\n      \"prepaid-gas\",\n      gas,\n      \"attached-deposit\",\n      deposit,\n      \"sign-as\",\n      config.account,\n      \"network-config\",\n      network,\n    ];\n\n    if (config.privateKey) {\n      args.push(\"sign-with-plaintext-private-key\", config.privateKey, \"send\");\n    } else {\n      args.push(\"sign-with-keychain\", \"send\");\n    }\n\n    const output = yield* Effect.tryPromise({\n      try: async () => {\n        const result = await execa(\"near\", args, {\n          stdin: \"inherit\",\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n          reject: false,\n        });\n\n        process.stdout.write(result.stdout);\n        const combined = `${result.stdout}\\n${result.stderr}`;\n        const txHashMatch = combined.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n        const hasCodeDoesNotExist = /CodeDoesNotExist/i.test(combined);\n        const hasTransactionFailed = /Transaction failed/i.test(combined);\n        const softSuccess =\n          Boolean(txHashMatch?.[1]) && hasCodeDoesNotExist && hasTransactionFailed;\n\n        if (result.exitCode === 0 || softSuccess) {\n          if (softSuccess) {\n            console.log(`  ${txHashMatch?.[1]} — FastDATA CodeDoesNotExist (expected)`);\n          }\n          return combined;\n        }\n\n        throw new NearTransactionError(\n          result.stderr || `Transaction failed with code ${result.exitCode}`,\n        );\n      },\n      catch: (error) => error as Error,\n    });\n\n    const txHashMatch = output.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n\n    return {\n      success: true,\n      txHash: txHashMatch?.[1],\n    };\n  });\n\nexport async function addFunctionCallAccessKey(\n  config: FunctionCallAccessKeyConfig,\n): Promise<NearKeyPair> {\n  const keyPair = generateNearKeyPair();\n  const args = [\n    \"account\",\n    \"add-key\",\n    config.account,\n    \"grant-function-call-access\",\n    \"--allowance\",\n    config.allowance,\n    \"--contract-account-id\",\n    config.contract,\n    \"--function-names\",\n    config.functionNames.join(\", \"),\n    \"use-manually-provided-public-key\",\n    keyPair.publicKey,\n    \"network-config\",\n    config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\"),\n    \"sign-with-keychain\",\n    \"send\",\n  ];\n\n  await runNearCommand(args);\n  return keyPair;\n}\n"],"mappings":";;;;;AAmCA,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AAExB,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;CAChB,cAAc;AACZ,QAAM,qBAAqB;;;AAI/B,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS,OAAO;CAChB,YAAY,SAAiB;AAC3B,QAAM,+BAA+B,UAAU;;;AAInD,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;;AAGlB,SAAS,iBAAiB,OAA2B;CACnD,MAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;AAC9D,QAAO,IAAI,WAAW,OAAO,KAAK,YAAY,SAAS,CAAC;;AAG1D,SAAS,aAAa,OAA2B;AAC/C,KAAI,MAAM,WAAW,EAAG,QAAO;CAE/B,MAAM,SAAmB,CAAC,EAAE;AAC5B,MAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,QAAQ;AACZ,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAS,OAAO,MAAO;AACvB,UAAO,KAAK,QAAQ;AACpB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;AAEhC,SAAO,QAAQ,GAAG;AAChB,UAAO,KAAK,QAAQ,GAAG;AACvB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;;CAIlC,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MACjB,KAAI,SAAS,EAAG,WAAU,gBAAgB;KACrC;AAGP,MAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,IACtC,WAAU,gBAAgB,OAAO;AAGnC,QAAO;;AAGT,SAAgB,sBAAmC;CACjD,MAAM,EAAE,WAAW,eAAe,oBAAoB,UAAU;CAChE,MAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,CAAC;CACrD,MAAM,aAAa,WAAW,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEvD,KAAI,CAAC,UAAU,KAAK,CAAC,WAAW,EAC9B,OAAM,IAAI,MAAM,kCAAkC;CAGpD,MAAM,cAAc,iBAAiB,UAAU,EAAE;CACjD,MAAM,cAAc,iBAAiB,WAAW,EAAE;CAClD,MAAM,cAAc,IAAI,WAAW,YAAY,SAAS,YAAY,OAAO;AAC3E,aAAY,IAAI,aAAa,EAAE;AAC/B,aAAY,IAAI,aAAa,YAAY,OAAO;AAEhD,QAAO;EACL,WAAW,WAAW,aAAa,YAAY;EAC/C,YAAY,WAAW,aAAa,YAAY;EACjD;;AAGH,MAAM,wBAAwB,OAAO,WAAW;CAC9C,KAAK,YAAY;AACf,MAAI;AACF,SAAM,MAAM,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,QAAQ,CAAC;AACrD,UAAO;UACD;AACN,UAAO;;;CAGX,6BAAa,IAAI,MAAM,2BAA2B;CACnD,CAAC;AAEF,MAAM,iBAAiB,OAAO,WAAW;CACvC,KAAK,YAAY;AACf,QAAM,MAAM,MAAM,CAAC,MAAM,yCAAyC,cAAc,OAAO,EAAE,EACvF,OAAO,WACR,CAAC;;CAEJ,QAAQ,UAAU;AAChB,MAAI,iBAAiB,SAAS,cAAc,MAC1C,QAAO,IAAI,oBACT,8BAA+B,MAA+B,WAC/D;AAEH,SAAO,IAAI,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;CAEzF,CAAC;AAEF,eAAe,eAAe,MAA+B;AAC3D,OAAM,MAAM,QAAQ,MAAM,EAAE,OAAO,WAAW,CAAC;;AAGjD,MAAa,gBAAgB,OAAO,IAAI,aAAa;AAEnD,KAAI,OADuB,sBACV;AAEjB,KAAI,QAAQ,IAAI,yBAAyB,QAAQ;AAC/C,SAAO;AACP;;AAGF,SAAQ,KAAK;AACb,SAAQ,IAAI,uBAAuB;AAEnC,SAAQ,KAAK;AACb,SAAQ,IAAI,gEAAgE,cAAc,OAAO;AACjG,SAAQ,KAAK;AACb,QAAO,OAAO,KAAK,IAAI,sBAAsB,CAAC;EAC9C;AAEF,MAAa,sBACX,WAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,QAAQ,GAAG;CACzD,MAAM,WAAW,OAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,UAAU,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;CAErF,MAAM,OAAO;EACX;EACA;EACA;EACA,OAAO;EACP,OAAO;EACP;EACA,OAAO;EACP;EACA;EACA;EACA;EACA;EACA,OAAO;EACP;EACA;EACD;AAED,KAAI,OAAO,WACT,MAAK,KAAK,mCAAmC,OAAO,YAAY,OAAO;KAEvE,MAAK,KAAK,sBAAsB,OAAO;AAoCzC,QAAO;EACL,SAAS;EACT,SAJkB,OA/BE,OAAO,WAAW;GACtC,KAAK,YAAY;IACf,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM;KACvC,OAAO;KACP,QAAQ;KACR,QAAQ;KACR,QAAQ;KACT,CAAC;AAEF,YAAQ,OAAO,MAAM,OAAO,OAAO;IACnC,MAAM,WAAW,GAAG,OAAO,OAAO,IAAI,OAAO;IAC7C,MAAM,cAAc,SAAS,MAAM,oCAAoC;IACvE,MAAM,sBAAsB,oBAAoB,KAAK,SAAS;IAC9D,MAAM,uBAAuB,sBAAsB,KAAK,SAAS;IACjE,MAAM,cACJ,QAAQ,cAAc,GAAG,IAAI,uBAAuB;AAEtD,QAAI,OAAO,aAAa,KAAK,aAAa;AACxC,SAAI,YACF,SAAQ,IAAI,KAAK,cAAc,GAAG,yCAAyC;AAE7E,YAAO;;AAGT,UAAM,IAAI,qBACR,OAAO,UAAU,gCAAgC,OAAO,WACzD;;GAEH,QAAQ,UAAU;GACnB,CAAC,EAEyB,MAAM,oCAIZ,GAAG;EACvB;EACD;AAEJ,eAAsB,yBACpB,QACsB;CACtB,MAAM,UAAU,qBAAqB;AAoBrC,OAAM,eAAe;EAlBnB;EACA;EACA,OAAO;EACP;EACA;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO,cAAc,KAAK,KAAK;EAC/B;EACA,QAAQ;EACR;EACA,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;EACrE;EACA;EAGuB,CAAC;AAC1B,QAAO"}
+{"version":3,"file":"near-cli.mjs","names":[],"sources":["../src/near-cli.ts"],"sourcesContent":["import { generateKeyPairSync } from \"node:crypto\";\nimport { Effect } from \"effect\";\nimport { execa } from \"execa\";\nimport { colors } from \"./utils/theme\";\n\nexport interface NearTransactionConfig {\n  account: string;\n  contract: string;\n  method: string;\n  argsBase64: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  gas?: string;\n  deposit?: string;\n}\n\nexport interface NearTransactionResult {\n  success: boolean;\n  txHash?: string;\n  error?: string;\n}\n\nexport interface NearKeyPair {\n  publicKey: string;\n  privateKey: string;\n}\n\nexport interface FunctionCallAccessKeyConfig {\n  account: string;\n  contract: string;\n  allowance: string;\n  functionNames: string[];\n  network?: \"mainnet\" | \"testnet\";\n}\n\nconst NEAR_CLI_VERSION = \"0.23.5\";\nconst INSTALLER_URL = `https://github.com/near/near-cli-rs/releases/download/v${NEAR_CLI_VERSION}/near-cli-rs-installer.sh`;\nconst BASE58_ALPHABET = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n\nexport class NearCliNotFoundError extends Error {\n  readonly _tag = \"NearCliNotFoundError\";\n  constructor() {\n    super(\"NEAR CLI not found\");\n  }\n}\n\nexport class NearCliInstallError extends Error {\n  readonly _tag = \"NearCliInstallError\";\n  constructor(message: string) {\n    super(`Failed to install NEAR CLI: ${message}`);\n  }\n}\n\nexport class NearTransactionError extends Error {\n  readonly _tag = \"NearTransactionError\";\n}\n\nfunction base64UrlToBytes(input: string): Uint8Array {\n  const normalized = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  return new Uint8Array(Buffer.from(normalized, \"base64\"));\n}\n\nfunction base58Encode(input: Uint8Array): string {\n  if (input.length === 0) return \"\";\n\n  const digits: number[] = [0];\n  for (const byte of input) {\n    let carry = byte;\n    for (let i = 0; i < digits.length; i++) {\n      carry += digits[i]! << 8;\n      digits[i] = carry % 58;\n      carry = Math.floor(carry / 58);\n    }\n    while (carry > 0) {\n      digits.push(carry % 58);\n      carry = Math.floor(carry / 58);\n    }\n  }\n\n  let output = \"\";\n  for (const byte of input) {\n    if (byte === 0) output += BASE58_ALPHABET[0];\n    else break;\n  }\n\n  for (let i = digits.length - 1; i >= 0; i--) {\n    output += BASE58_ALPHABET[digits[i]!]!;\n  }\n\n  return output;\n}\n\nexport function generateNearKeyPair(): NearKeyPair {\n  const { publicKey, privateKey } = generateKeyPairSync(\"ed25519\");\n  const publicJwk = publicKey.export({ format: \"jwk\" }) as JsonWebKey;\n  const privateJwk = privateKey.export({ format: \"jwk\" }) as JsonWebKey;\n\n  if (!publicJwk.x || !privateJwk.d) {\n    throw new Error(\"Failed to generate NEAR keypair\");\n  }\n\n  const publicBytes = base64UrlToBytes(publicJwk.x);\n  const privateSeed = base64UrlToBytes(privateJwk.d);\n  const secretBytes = new Uint8Array(privateSeed.length + publicBytes.length);\n  secretBytes.set(privateSeed, 0);\n  secretBytes.set(publicBytes, privateSeed.length);\n\n  return {\n    publicKey: `ed25519:${base58Encode(publicBytes)}`,\n    privateKey: `ed25519:${base58Encode(secretBytes)}`,\n  };\n}\n\nconst checkNearCliInstalled = Effect.tryPromise({\n  try: async () => {\n    try {\n      await execa(\"near\", [\"--version\"], { stdio: \"pipe\" });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n  catch: () => new Error(\"Failed to check NEAR CLI\"),\n});\n\nconst installNearCli = Effect.tryPromise({\n  try: async () => {\n    await execa(\"sh\", [\"-c\", `curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`], {\n      stdin: \"ignore\",\n      stdout: \"inherit\",\n      stderr: \"inherit\",\n    });\n  },\n  catch: (error) => {\n    if (error instanceof Error && \"exitCode\" in error) {\n      return new NearCliInstallError(\n        `Installer exited with code ${(error as { exitCode: number }).exitCode}`,\n      );\n    }\n    return new NearCliInstallError(error instanceof Error ? error.message : String(error));\n  },\n});\n\nasync function runNearCommand(args: string[]): Promise<void> {\n  await execa(\"near\", args, { stdin: \"pipe\", stdout: \"inherit\", stderr: \"inherit\" });\n}\n\nexport const ensureNearCli = Effect.gen(function* () {\n  const isInstalled = yield* checkNearCliInstalled;\n  if (isInstalled) return;\n\n  if (process.env.BOS_INSTALL_NEAR_CLI === \"true\") {\n    yield* installNearCli;\n    return;\n  }\n\n  console.log();\n  console.log(\"  NEAR CLI not found\");\n\n  console.log();\n  console.log(`  To install manually: curl --proto '=https' --tlsv1.2 -LsSf ${INSTALLER_URL} | sh`);\n  console.log();\n  yield* Effect.fail(new NearCliNotFoundError());\n});\n\nexport const executeTransaction = (\n  config: NearTransactionConfig,\n): Effect.Effect<NearTransactionResult, Error> =>\n  Effect.gen(function* () {\n    const gas = (config.gas || \"300Tgas\").replace(/\\s+/g, \"\");\n    const deposit = (config.deposit || \"0NEAR\").replace(/\\s+/g, \"\");\n    const network = config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\");\n\n    const args = [\n      \"contract\",\n      \"call-function\",\n      \"as-transaction\",\n      config.contract,\n      config.method,\n      \"base64-args\",\n      config.argsBase64,\n      \"prepaid-gas\",\n      gas,\n      \"attached-deposit\",\n      deposit,\n      \"sign-as\",\n      config.account,\n      \"network-config\",\n      network,\n    ];\n\n    if (config.privateKey) {\n      args.push(\"sign-with-plaintext-private-key\", config.privateKey, \"send\");\n    } else {\n      if (!process.stdin.isTTY) {\n        return {\n          success: false,\n          error:\n            \"No private key provided and no TTY available for keychain signing. Set NEAR_PRIVATE_KEY environment variable to sign locally.\",\n        };\n      }\n      console.log(\n        colors.yellow(\n          \"  Warning: No NEAR_PRIVATE_KEY set — falling back to interactive keychain signing.\",\n        ),\n      );\n      args.push(\"sign-with-keychain\", \"send\");\n    }\n\n    const output = yield* Effect.tryPromise({\n      try: async () => {\n        const result = await execa(\"near\", args, {\n          stdin: config.privateKey ? \"pipe\" : \"inherit\",\n          stdout: \"pipe\",\n          stderr: \"pipe\",\n          reject: false,\n        });\n\n        process.stdout.write(result.stdout);\n        const combined = `${result.stdout}\\n${result.stderr}`;\n        const txHashMatch = combined.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n        const hasCodeDoesNotExist = /CodeDoesNotExist/i.test(combined);\n        const hasTransactionFailed = /Transaction failed/i.test(combined);\n        const softSuccess =\n          Boolean(txHashMatch?.[1]) && hasCodeDoesNotExist && hasTransactionFailed;\n\n        if (result.exitCode === 0 || softSuccess) {\n          if (softSuccess) {\n            console.log(`  ${txHashMatch?.[1]} — FastDATA CodeDoesNotExist (expected)`);\n          }\n          return combined;\n        }\n\n        throw new NearTransactionError(\n          result.stderr || `Transaction failed with code ${result.exitCode}`,\n        );\n      },\n      catch: (error) => error as Error,\n    });\n\n    const txHashMatch = output.match(/Transaction ID:\\s*([A-Za-z0-9]+)/i);\n\n    return {\n      success: true,\n      txHash: txHashMatch?.[1],\n    };\n  });\n\nexport async function addFunctionCallAccessKey(\n  config: FunctionCallAccessKeyConfig,\n): Promise<NearKeyPair> {\n  const keyPair = generateNearKeyPair();\n  const args = [\n    \"account\",\n    \"add-key\",\n    config.account,\n    \"grant-function-call-access\",\n    \"--allowance\",\n    config.allowance,\n    \"--contract-account-id\",\n    config.contract,\n    \"--function-names\",\n    config.functionNames.join(\", \"),\n    \"use-manually-provided-public-key\",\n    keyPair.publicKey,\n    \"network-config\",\n    config.network || (config.account.endsWith(\".testnet\") ? \"testnet\" : \"mainnet\"),\n    \"sign-with-keychain\",\n    \"send\",\n  ];\n\n  await runNearCommand(args);\n  return keyPair;\n}\n"],"mappings":";;;;;;AAoCA,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AAExB,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;CAChB,cAAc;AACZ,QAAM,qBAAqB;;;AAI/B,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS,OAAO;CAChB,YAAY,SAAiB;AAC3B,QAAM,+BAA+B,UAAU;;;AAInD,IAAa,uBAAb,cAA0C,MAAM;CAC9C,AAAS,OAAO;;AAGlB,SAAS,iBAAiB,OAA2B;CACnD,MAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;AAC9D,QAAO,IAAI,WAAW,OAAO,KAAK,YAAY,SAAS,CAAC;;AAG1D,SAAS,aAAa,OAA2B;AAC/C,KAAI,MAAM,WAAW,EAAG,QAAO;CAE/B,MAAM,SAAmB,CAAC,EAAE;AAC5B,MAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,QAAQ;AACZ,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAS,OAAO,MAAO;AACvB,UAAO,KAAK,QAAQ;AACpB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;AAEhC,SAAO,QAAQ,GAAG;AAChB,UAAO,KAAK,QAAQ,GAAG;AACvB,WAAQ,KAAK,MAAM,QAAQ,GAAG;;;CAIlC,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MACjB,KAAI,SAAS,EAAG,WAAU,gBAAgB;KACrC;AAGP,MAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,IACtC,WAAU,gBAAgB,OAAO;AAGnC,QAAO;;AAGT,SAAgB,sBAAmC;CACjD,MAAM,EAAE,WAAW,eAAe,oBAAoB,UAAU;CAChE,MAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,CAAC;CACrD,MAAM,aAAa,WAAW,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEvD,KAAI,CAAC,UAAU,KAAK,CAAC,WAAW,EAC9B,OAAM,IAAI,MAAM,kCAAkC;CAGpD,MAAM,cAAc,iBAAiB,UAAU,EAAE;CACjD,MAAM,cAAc,iBAAiB,WAAW,EAAE;CAClD,MAAM,cAAc,IAAI,WAAW,YAAY,SAAS,YAAY,OAAO;AAC3E,aAAY,IAAI,aAAa,EAAE;AAC/B,aAAY,IAAI,aAAa,YAAY,OAAO;AAEhD,QAAO;EACL,WAAW,WAAW,aAAa,YAAY;EAC/C,YAAY,WAAW,aAAa,YAAY;EACjD;;AAGH,MAAM,wBAAwB,OAAO,WAAW;CAC9C,KAAK,YAAY;AACf,MAAI;AACF,SAAM,MAAM,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,QAAQ,CAAC;AACrD,UAAO;UACD;AACN,UAAO;;;CAGX,6BAAa,IAAI,MAAM,2BAA2B;CACnD,CAAC;AAEF,MAAM,iBAAiB,OAAO,WAAW;CACvC,KAAK,YAAY;AACf,QAAM,MAAM,MAAM,CAAC,MAAM,yCAAyC,cAAc,OAAO,EAAE;GACvF,OAAO;GACP,QAAQ;GACR,QAAQ;GACT,CAAC;;CAEJ,QAAQ,UAAU;AAChB,MAAI,iBAAiB,SAAS,cAAc,MAC1C,QAAO,IAAI,oBACT,8BAA+B,MAA+B,WAC/D;AAEH,SAAO,IAAI,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;CAEzF,CAAC;AAEF,eAAe,eAAe,MAA+B;AAC3D,OAAM,MAAM,QAAQ,MAAM;EAAE,OAAO;EAAQ,QAAQ;EAAW,QAAQ;EAAW,CAAC;;AAGpF,MAAa,gBAAgB,OAAO,IAAI,aAAa;AAEnD,KAAI,OADuB,sBACV;AAEjB,KAAI,QAAQ,IAAI,yBAAyB,QAAQ;AAC/C,SAAO;AACP;;AAGF,SAAQ,KAAK;AACb,SAAQ,IAAI,uBAAuB;AAEnC,SAAQ,KAAK;AACb,SAAQ,IAAI,gEAAgE,cAAc,OAAO;AACjG,SAAQ,KAAK;AACb,QAAO,OAAO,KAAK,IAAI,sBAAsB,CAAC;EAC9C;AAEF,MAAa,sBACX,WAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,QAAQ,GAAG;CACzD,MAAM,WAAW,OAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,UAAU,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;CAErF,MAAM,OAAO;EACX;EACA;EACA;EACA,OAAO;EACP,OAAO;EACP;EACA,OAAO;EACP;EACA;EACA;EACA;EACA;EACA,OAAO;EACP;EACA;EACD;AAED,KAAI,OAAO,WACT,MAAK,KAAK,mCAAmC,OAAO,YAAY,OAAO;MAClE;AACL,MAAI,CAAC,QAAQ,MAAM,MACjB,QAAO;GACL,SAAS;GACT,OACE;GACH;AAEH,UAAQ,IACN,OAAO,OACL,qFACD,CACF;AACD,OAAK,KAAK,sBAAsB,OAAO;;AAoCzC,QAAO;EACL,SAAS;EACT,SAJkB,OA/BE,OAAO,WAAW;GACtC,KAAK,YAAY;IACf,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM;KACvC,OAAO,OAAO,aAAa,SAAS;KACpC,QAAQ;KACR,QAAQ;KACR,QAAQ;KACT,CAAC;AAEF,YAAQ,OAAO,MAAM,OAAO,OAAO;IACnC,MAAM,WAAW,GAAG,OAAO,OAAO,IAAI,OAAO;IAC7C,MAAM,cAAc,SAAS,MAAM,oCAAoC;IACvE,MAAM,sBAAsB,oBAAoB,KAAK,SAAS;IAC9D,MAAM,uBAAuB,sBAAsB,KAAK,SAAS;IACjE,MAAM,cACJ,QAAQ,cAAc,GAAG,IAAI,uBAAuB;AAEtD,QAAI,OAAO,aAAa,KAAK,aAAa;AACxC,SAAI,YACF,SAAQ,IAAI,KAAK,cAAc,GAAG,yCAAyC;AAE7E,YAAO;;AAGT,UAAM,IAAI,qBACR,OAAO,UAAU,gCAAgC,OAAO,WACzD;;GAEH,QAAQ,UAAU;GACnB,CAAC,EAEyB,MAAM,oCAIZ,GAAG;EACvB;EACD;AAEJ,eAAsB,yBACpB,QACsB;CACtB,MAAM,UAAU,qBAAqB;AAoBrC,OAAM,eAAe;EAlBnB;EACA;EACA,OAAO;EACP;EACA;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO,cAAc,KAAK,KAAK;EAC/B;EACA,QAAQ;EACR;EACA,OAAO,YAAY,OAAO,QAAQ,SAAS,WAAW,GAAG,YAAY;EACrE;EACA;EAGuB,CAAC;AAC1B,QAAO"}

package/dist/plugin.cjs

@@ -15,6 +15,7 @@ const require_status = require('./cli/status.cjs');
 const require_sync = require('./cli/sync.cjs');
 const require_shared = require('./shared.cjs');
 const require_upgrade = require('./cli/upgrade.cjs');
+const require_theme = require('./utils/theme.cjs');
 const require_near_cli = require('./near-cli.cjs');
 const require_service_descriptor = require('./service-descriptor.cjs');
 const require_run = require('./utils/run.cjs');
@@ -252,8 +253,9 @@ async function buildEverythingDevQuietly(cwd) {
 async function fetchPublishedConfig(accountId, gatewayId) {
 	try {
 		return await require_fastkv.fetchBosConfigFromFastKv(`bos://${accountId}/${gatewayId}`);
-	} catch {
-		return null;
+	} catch (error) {
+		if (error instanceof Error && error.message.startsWith("No config found")) return null;
+		throw error;
 	}
 }
 function selectWorkspaceTargets(packages, bosConfig) {
@@ -614,20 +616,31 @@ var plugin_default = (0, every_plugin.createPlugin)({
 				phase: "config",
 				status: "running"
 			});
+			const bosEnv = input.env ?? (node_process.default.env.BOS_ENV === "staging" ? "staging" : "production");
 			const account = input.account ?? node_process.default.env.BOS_ACCOUNT;
 			const domain = input.domain ?? node_process.default.env.BOS_GATEWAY;
 			let config = null;
 			let remoteConfig = null;
-			if (account && domain) {
+			if (account && domain) try {
 				remoteConfig = await fetchPublishedConfig(account, domain);
 				if (remoteConfig) config = remoteConfig;
-				else console.warn(`[Start] Failed to fetch remote config for ${account}/${domain}, falling back to local bos.config.json`);
+				else return {
+					status: "error",
+					url: "",
+					error: `No config found at bos://${account}/${domain}. Verify the account and gateway are correct and the config has been published.\nExpected URL: ${require_fastkv.buildRegistryConfigUrl(account, domain)}`
+				};
+			} catch (error) {
+				return {
+					status: "error",
+					url: "",
+					error: `Failed to fetch config for bos://${account}/${domain}: ${error instanceof Error ? error.message : "Unknown error"}\nExpected URL: ${require_fastkv.buildRegistryConfigUrl(account, domain)}`
+				};
 			}
-			if (!config) config = deps.bosConfig;
+			else config = deps.bosConfig;
 			if (!config) return {
 				status: "error",
 				url: "",
-				error: "No configuration found. Set BOS_ACCOUNT and BOS_GATEWAY environment variables, or provide a local bos.config.json."
+				error: "No configuration found. Provide --account and --gateway flags, or create a local bos.config.json."
 			};
 			if (account) config = {
 				...config,
@@ -638,7 +651,7 @@ var plugin_default = (0, every_plugin.createPlugin)({
 				domain
 			};
 			const port = input.port ?? require_config.getHostDevelopmentPort(config.app.host.development);
-			const isStaging = input.env === "staging";
+			const isStaging = bosEnv === "staging";
 			const runtimePlugins = await require_config.buildRuntimePluginsForConfig(config, deps.configDir, "production");
 			require_config.suppressWarnings();
 			const runtimeConfig = require_app.buildRuntimeConfig(config, {
@@ -651,6 +664,8 @@ var plugin_default = (0, every_plugin.createPlugin)({
 			});
 			require_config.drainConfigWarnings();
 			require_config.resumeWarnings();
+			if (isStaging && config.staging?.domain) runtimeConfig.domain = config.staging.domain;
+			if (isStaging) runtimeConfig.env = "staging";
 			require_infra.syncGeneratedInfra(deps.configDir, runtimeConfig);
 			if (!(0, node_fs.existsSync)((0, node_path.join)(deps.configDir, ".env"))) {
 				require_infra.ensureEnvFile(deps.configDir);
@@ -671,12 +686,13 @@ var plugin_default = (0, every_plugin.createPlugin)({
 			const productionEnv = {};
 			const warnings = [];
 			if (!node_process.default.env.CORS_ORIGIN && config.domain) {
-				const defaultOrigin = `https://${config.domain}`;
+				const defaultOrigin = `https://${isStaging ? config.staging?.domain ?? config.domain : config.domain}`;
 				productionEnv.CORS_ORIGIN = defaultOrigin;
 				warnings.push(`CORS_ORIGIN defaulting to ${defaultOrigin}`);
 			}
 			const requiredSecrets = /* @__PURE__ */ new Set();
 			const missingSecrets = [];
+			if (runtimeConfig.host.secrets) for (const s of runtimeConfig.host.secrets) requiredSecrets.add(s);
 			if (runtimeConfig.auth?.secrets) for (const s of runtimeConfig.auth.secrets) requiredSecrets.add(s);
 			if (runtimeConfig.api?.secrets) for (const s of runtimeConfig.api.secrets) requiredSecrets.add(s);
 			for (const plugin of Object.values(runtimeConfig.plugins ?? {})) if (plugin.secrets) for (const s of plugin.secrets) requiredSecrets.add(s);
@@ -779,89 +795,134 @@ var plugin_default = (0, every_plugin.createPlugin)({
 				registryUrl: "",
 				error: "No bos.config.json found"
 			};
-			const account = deps.bosConfig.account;
-			const gateway = deps.bosConfig.domain;
-			if (!gateway) return {
+			const result = await publishToFastKv({
+				bosConfig: deps.bosConfig,
+				runtimeConfig: deps.runtimeConfig,
+				configDir: deps.configDir,
+				env: input.env,
+				build: input.deploy,
+				dryRun: input.dryRun,
+				packages: input.packages,
+				network: input.network,
+				privateKey: input.privateKey
+			});
+			if (result.publishConfig) {
+				const refreshed = await require_config.loadResolvedConfig({ cwd: deps.configDir });
+				if (refreshed?.config) {
+					deps.bosConfig = refreshed.config;
+					deps.runtimeConfig = refreshed.runtime;
+				}
+			}
+			return {
+				status: result.status,
+				registryUrl: result.registryUrl,
+				txHash: result.txHash,
+				error: result.error,
+				built: result.built,
+				skipped: result.skipped
+			};
+		}),
+		deploy: builder.deploy.handler(async ({ input }) => {
+			if (!deps.bosConfig) return {
 				status: "error",
 				registryUrl: "",
-				error: "bos.config.json must define domain to publish"
+				redeployed: false,
+				error: "No bos.config.json found"
 			};
-			const network = input.network ?? require_network.getNetworkIdForAccount(account);
-			const bosUrl = `bos://${account}/${gateway}`;
-			const registryUrl = require_fastkv.buildRegistryConfigUrlForNetwork(network, account, gateway);
-			const targets = selectWorkspaceTargets(input.packages, deps.bosConfig);
-			let publishConfig = deps.bosConfig;
-			let built;
-			let skipped;
-			if (input.dryRun) return {
+			const result = await publishToFastKv({
+				bosConfig: deps.bosConfig,
+				runtimeConfig: deps.runtimeConfig,
+				configDir: deps.configDir,
+				env: input.env,
+				build: input.build,
+				dryRun: input.dryRun,
+				packages: input.packages,
+				network: input.network,
+				privateKey: input.privateKey
+			});
+			if (result.status === "error") return {
+				status: "error",
+				registryUrl: result.registryUrl,
+				txHash: result.txHash,
+				built: result.built,
+				skipped: result.skipped,
+				redeployed: false,
+				error: result.error
+			};
+			if (result.status === "dry-run") return {
 				status: "dry-run",
-				registryUrl,
-				built,
-				skipped
+				registryUrl: result.registryUrl,
+				built: result.built,
+				skipped: result.skipped,
+				redeployed: false
 			};
-			if (input.deploy) {
-				await generateCodeArtifacts(deps.configDir, deps.bosConfig, {
-					env: "production",
-					runtimeConfig: deps.runtimeConfig ?? void 0
-				});
-				const result = await buildWorkspaceTargets({
-					configDir: deps.configDir,
-					bosConfig: deps.bosConfig,
-					runtimeConfig: deps.runtimeConfig,
-					targets,
-					deploy: true
-				});
-				built = result.built;
-				skipped = result.skipped;
+			if (result.publishConfig) {
 				const refreshed = await require_config.loadResolvedConfig({ cwd: deps.configDir });
 				if (refreshed?.config) {
 					deps.bosConfig = refreshed.config;
 					deps.runtimeConfig = refreshed.runtime;
-					publishConfig = refreshed.config;
 				}
 			}
-			const registryEntries = { [`apps/${account}/${gateway}/bos.config.json`]: JSON.stringify(publishConfig) };
-			const payload = JSON.stringify(registryEntries);
-			const argsBase64 = Buffer.from(payload).toString("base64");
-			const privateKey = input.privateKey || node_process.default.env.NEAR_PRIVATE_KEY || node_process.default.env.BOS_NEAR_PRIVATE_KEY;
-			try {
-				await effect.Effect.runPromise(require_near_cli.ensureNearCli);
-				let txHash;
+			let redeployed = false;
+			let service;
+			if (node_process.default.env.RAILWAY_TOKEN) {
+				const railwayService = input.service ?? deps.bosConfig.ci?.railway?.service;
+				if (!railwayService) {
+					console.log();
+					console.log(require_theme.colors.yellow("  Railway redeploy skipped: ci.railway.service is not configured in bos.config.json"));
+					return {
+						status: "published",
+						registryUrl: result.registryUrl,
+						txHash: result.txHash,
+						built: result.built,
+						skipped: result.skipped,
+						redeployed: false,
+						error: "Config published but Railway redeploy failed: ci.railway.service is not configured in bos.config.json"
+					};
+				}
+				service = railwayService;
+				console.log();
+				console.log(`  Redeploying Railway service ${require_theme.colors.cyan(railwayService)}...`);
 				try {
-					txHash = (await effect.Effect.runPromise(require_near_cli.executeTransaction({
-						account,
-						contract: require_fastkv.getRegistryNamespaceForNetwork(network),
-						method: "__fastdata_kv",
-						argsBase64,
-						network,
-						privateKey,
-						gas: "300Tgas",
-						deposit: "0NEAR"
-					}))).txHash;
+					const railResult = await require_run.run("railway", [
+						"redeploy",
+						"--service",
+						railwayService,
+						"--yes"
+					], { capture: true });
+					if (railResult?.stdout) {
+						for (const line of railResult.stdout.split("\n")) if (line.trim()) console.log(`  ${require_theme.colors.dim(line.trim())}`);
+					}
+					redeployed = true;
+					console.log(require_theme.colors.green(`  Railway redeploy complete`));
 				} catch (error) {
-					txHash = extractTransactionHash(error);
-					if (!txHash) throw error;
-					try {
-						const verifiedConfig = await require_fastkv.fetchBosConfigFromFastKv(bosUrl);
-						if (JSON.stringify(verifiedConfig) !== JSON.stringify(publishConfig)) throw error;
-					} catch {}
+					const message = error instanceof Error ? error.message : String(error);
+					const railError = message.includes("not found") || message.includes("ENOENT") ? "Railway CLI not found. Install it: npm i -g @railway/cli" : `Railway redeploy failed: ${message}`;
+					console.log(require_theme.colors.yellow(`  ${railError}`));
+					return {
+						status: "published",
+						registryUrl: result.registryUrl,
+						txHash: result.txHash,
+						built: result.built,
+						skipped: result.skipped,
+						redeployed: false,
+						service,
+						error: `Config published but ${railError}`
+					};
 				}
-				return {
-					status: "published",
-					registryUrl,
-					txHash,
-					built,
-					skipped
-				};
-			} catch (error) {
-				return {
-					status: "error",
-					registryUrl,
-					error: error instanceof Error ? error.message : "Unknown error",
-					built,
-					skipped
-				};
+			} else {
+				console.log();
+				console.log(require_theme.colors.yellow("  Railway redeploy skipped (RAILWAY_TOKEN not set)"));
 			}
+			return {
+				status: "deployed",
+				registryUrl: result.registryUrl,
+				txHash: result.txHash,
+				built: result.built,
+				skipped: result.skipped,
+				redeployed,
+				service
+			};
 		}),
 		keyPublish: builder.keyPublish.handler(async ({ input }) => {
 			if (!deps.bosConfig) return {
@@ -1214,6 +1275,112 @@ var plugin_default = (0, every_plugin.createPlugin)({
 		})
 	})
 });
+async function publishToFastKv(input) {
+	const { env, dryRun, configDir } = input;
+	let bosConfig = input.bosConfig;
+	const runtimeConfig = input.runtimeConfig;
+	const isStaging = env === "staging";
+	const account = bosConfig.account;
+	const gateway = isStaging ? bosConfig.staging?.domain ?? bosConfig.domain : bosConfig.domain;
+	if (!gateway) return {
+		status: "error",
+		registryUrl: "",
+		error: "bos.config.json must define domain to publish"
+	};
+	const network = input.network ?? require_network.getNetworkIdForAccount(account);
+	const registryUrl = require_fastkv.buildRegistryConfigUrlForNetwork(network, account, gateway);
+	const targets = selectWorkspaceTargets(input.packages, bosConfig);
+	let publishConfig = isStaging ? {
+		...bosConfig,
+		domain: gateway
+	} : bosConfig;
+	let built;
+	let skipped;
+	if (dryRun) return {
+		status: "dry-run",
+		registryUrl,
+		built,
+		skipped
+	};
+	if (input.build) {
+		await generateCodeArtifacts(configDir, bosConfig, {
+			env: "production",
+			runtimeConfig: runtimeConfig ?? void 0
+		});
+		const result = await buildWorkspaceTargets({
+			configDir,
+			bosConfig,
+			runtimeConfig,
+			targets,
+			deploy: true
+		});
+		built = result.built;
+		skipped = result.skipped;
+		const refreshed = await require_config.loadResolvedConfig({ cwd: configDir });
+		if (refreshed?.config) {
+			bosConfig = refreshed.config;
+			publishConfig = isStaging ? {
+				...refreshed.config,
+				domain: gateway
+			} : refreshed.config;
+		}
+	}
+	const registryEntries = { [`apps/${account}/${gateway}/bos.config.json`]: JSON.stringify(publishConfig) };
+	const payload = JSON.stringify(registryEntries);
+	const argsBase64 = Buffer.from(payload).toString("base64");
+	const privateKey = input.privateKey || node_process.default.env.NEAR_PRIVATE_KEY || node_process.default.env.BOS_NEAR_PRIVATE_KEY;
+	if (!privateKey) {
+		if (!node_process.default.stdin.isTTY) return {
+			status: "error",
+			registryUrl,
+			error: "No private key provided and no TTY available for keychain signing. Set NEAR_PRIVATE_KEY environment variable to sign locally."
+		};
+		console.log(require_theme.colors.yellow("  Warning: No NEAR_PRIVATE_KEY set — falling back to interactive keychain signing."));
+	}
+	console.log();
+	console.log(`  Publishing to ${require_theme.colors.cyan(registryUrl)}...`);
+	try {
+		await effect.Effect.runPromise(require_near_cli.ensureNearCli);
+		let txHash;
+		console.log(`  Submitting transaction on ${network}...`);
+		try {
+			txHash = (await effect.Effect.runPromise(require_near_cli.executeTransaction({
+				account,
+				contract: require_fastkv.getRegistryNamespaceForNetwork(network),
+				method: "__fastdata_kv",
+				argsBase64,
+				network,
+				privateKey,
+				gas: "300Tgas",
+				deposit: "0NEAR"
+			}))).txHash;
+			if (txHash) console.log(`  Transaction submitted: ${require_theme.colors.dim(txHash)}`);
+		} catch (error) {
+			txHash = extractTransactionHash(error);
+			if (!txHash) throw error;
+			try {
+				const verifiedConfig = await require_fastkv.fetchBosConfigFromFastKv(`bos://${account}/${gateway}`);
+				if (JSON.stringify(verifiedConfig) !== JSON.stringify(publishConfig)) throw error;
+			} catch {}
+		}
+		return {
+			status: "published",
+			registryUrl,
+			txHash,
+			built,
+			skipped,
+			publishConfig
+		};
+	} catch (error) {
+		return {
+			status: "error",
+			registryUrl,
+			error: error instanceof Error ? error.message : "Unknown error",
+			built,
+			skipped
+		};
+	}
+}
 function extractTransactionHash(error) {
 	return (error instanceof Error ? error.message : String(error)).match(/Transaction ID:\s*([A-Za-z0-9]+)/i)?.[1];
 }