everything-dev 1.53.2 → 2.0.0-rc.1

package/dist/cli.mjs

@@ -1,18 +1,25 @@
 #!/usr/bin/env node
-import { findConfigPath } from "./config.mjs";
+import { getRegistryNamespaceForAccount } from "./fastkv.mjs";
+import { getNetworkIdForAccount } from "./network.mjs";
+import { MISSING_CONFIG_MESSAGE, findConfigPath, readAuthoredConfigInput } from "./config.mjs";
 import { createPluginRuntime } from "./sdk.mjs";
+import { runDockerComposeUp } from "./infra/docker.mjs";
+import { installBundleFetchFromEnv } from "./bundle-fs-resolve.mjs";
 import { formatDuration, sumPhaseDurations } from "./cli/timing.mjs";
 import { colors, frames, gradients, icons } from "./utils/theme.mjs";
-import { loadProjectEnv } from "./cli/infra.mjs";
-import { fetchParentConfig, runDockerComposeUp } from "./cli/init.mjs";
+import { listPublishKeys } from "./near-cli.mjs";
+import { pluginEvents } from "./progress.mjs";
+import { fetchInitParent } from "./commands/init.mjs";
 import { resolveFrameworkPackage } from "./cli/framework-version.mjs";
-import plugin_default, { consumeDevSession, pluginEvents } from "./plugin.mjs";
+import plugin_default from "./plugin.mjs";
 import { findCommandDescriptor } from "./cli/catalog.mjs";
 import { printHelp } from "./cli/help.mjs";
 import { parseCommandInput } from "./cli/parse.mjs";
 import { promptInitBasic, promptInitOverrides } from "./cli/prompts.mjs";
 import { printBanner } from "./utils/banner.mjs";
+import { existsSync, watch } from "node:fs";
 import { dirname, resolve } from "node:path";
+import { readFile } from "node:fs/promises";
 import * as p from "@clack/prompts";
 
 //#region src/cli.ts
@@ -41,6 +48,25 @@ function formatTimeAgo(isoTimestamp) {
 function normalizeVersion(v) {
 	return v.replace(/^[\^~>=v]+/, "").trim();
 }
+const RETIRED_BOOTSTRAP_STUBS = [
+	"ui/src/entry.ts",
+	"ui/src/hydrate.tsx",
+	"ui/src/router.server.tsx",
+	"ui/src/compose.ts"
+];
+/**
+* Hand-modified bootstrap stubs retire as conflicted (backed up, then
+* deleted) — print the mechanical port into the authored seams (ADR 0023).
+*/
+function printStubMigrationGuide(retiredConflicted) {
+	if ((retiredConflicted ?? []).filter((f) => RETIRED_BOOTSTRAP_STUBS.includes(f)).length === 0) return;
+	console.log(`  ${colors.yellow("Port your stub customizations into the authored seams:")}`);
+	console.log(`    ${colors.dim("- defaultErrorComponent / defaultPendingComponent / defaultNotFoundComponent")}`);
+	console.log(`    ${colors.dim("  → set them inside the createRouter factory in ui/src/router.tsx (after ...opts)")}`);
+	console.log(`    ${colors.dim("- apiConnectionError copy + SSR locale config (locales, defaultLocale, cookieName)")}`);
+	console.log(`    ${colors.dim("  → export apiConnectionError / appLocale from ui/src/app.ts (see the scaffold template)")}`);
+	console.log(`    ${colors.dim("  backed-up originals: .bos/sync-backup/<timestamp>/")}`);
+}
 function printTimingSummary(timings) {
 	if (!timings || timings.length === 0) return;
 	console.log(`  ${colors.dim("Timings:")}`);
@@ -83,11 +109,15 @@ async function warnIfOutdated(client, command) {
 		const outdated = status.packages.filter((p) => !p.isLinked && p.installed && p.latest && normalizeVersion(p.installed) !== normalizeVersion(p.latest) && frameworkPackages.includes(p.name));
 		if (linked.length > 0) for (const pkg of linked) console.log(colors.dim(`    ${pkg.name} is linked locally (v${pkg.installed})`));
 		if (outdated.length === 0) return;
-		console.log();
-		console.log(colors.yellow(`  ! Outdated packages detected:`));
-		for (const pkg of outdated) console.log(colors.dim(`    ${pkg.name}  ${pkg.installed} → ${pkg.latest}`));
-		console.log(colors.dim(`    Run ${colors.cyan("bos upgrade")} to update packages and sync template files.`));
-		console.log();
+		const warn = (line) => {
+			if (command === "dev" || command === "start") process.stderr.write(`${line}\n`);
+			else console.log(line);
+		};
+		warn("");
+		warn(colors.yellow(`  ! Outdated packages detected:`));
+		for (const pkg of outdated) warn(colors.dim(`    ${pkg.name}  ${pkg.installed} → ${pkg.latest}`));
+		warn(colors.dim(`    Run ${colors.cyan("bos upgrade")} to update packages and sync template files.`));
+		warn("");
 	} catch {}
 }
 async function main() {
@@ -98,7 +128,6 @@ async function main() {
 	}
 	const invocationArgs = args.length > 0 ? args : ["dev"];
 	const command = invocationArgs[0] ?? "dev";
-	const configPath = findConfigPath();
 	const commandMatch = findCommandDescriptor(invocationArgs);
 	if (!commandMatch) {
 		console.error(`Unknown command: ${command}`);
@@ -106,7 +135,18 @@ async function main() {
 	}
 	const { descriptor, consumed } = commandMatch;
 	const commandArgs = invocationArgs.slice(consumed);
-	const projectDir = configPath ? dirname(configPath) : void 0;
+	let parsedInput;
+	try {
+		parsedInput = parseCommandInput(descriptor, commandArgs);
+	} catch (error) {
+		console.error(`[CLI] ${error instanceof Error ? error.message : String(error)}`);
+		process.exit(1);
+	}
+	const bootInput = parsedInput;
+	const cwdConfigPath = findConfigPath();
+	const configPath = bootInput.configPath ?? cwdConfigPath;
+	installBundleFetchFromEnv({ configPath });
+	const projectDir = cwdConfigPath ? dirname(cwdConfigPath) : void 0;
 	const edResolved = projectDir ? resolveFrameworkPackage(projectDir, "everything-dev") : void 0;
 	const displayVersion = edResolved?.installedVersion ? `${edResolved.installedVersion}${edResolved.isLinked ? " (linked)" : ""}` : void 0;
 	if (!process.env.BOS_NO_BANNER) printBanner("everything-dev", displayVersion);
@@ -115,12 +155,68 @@ async function main() {
 		secrets: {}
 	});
 	const client = (await pluginRuntime.usePlugin.bind(pluginRuntime)("bos", {
-		variables: { configPath: configPath ?? void 0 },
+		variables: {
+			configPath: configPath ?? void 0,
+			configDir: cwdConfigPath ? dirname(cwdConfigPath) : void 0
+		},
 		secrets: {}
 	})).createClient();
-	const outdatedWarning = warnIfOutdated(client, command);
+	warnIfOutdated(client, command);
 	try {
-		const input = parseCommandInput(descriptor, commandArgs);
+		const input = parsedInput;
+		const rollbackInput = input;
+		if (descriptor.key === "rollback" && !rollbackInput.listOnly && !rollbackInput.version && !rollbackInput.previous) {
+			const listing = await client.rollback({
+				...rollbackInput,
+				listOnly: true
+			});
+			if (listing.status !== "list" || !listing.history?.length) {
+				console.error(listing.error ?? "No publish history found");
+				process.exit(1);
+			}
+			console.log();
+			const selection = await p.select({
+				message: "Roll back to which publish?",
+				options: listing.history.map((entry) => ({
+					value: String(entry.blockHeight),
+					label: `${entry.blockTimestamp}  (block ${entry.blockHeight})`,
+					hint: entry.summary
+				}))
+			});
+			if (p.isCancel(selection)) return;
+			rollbackInput.version = selection;
+		}
+		if (descriptor.key === "keyPublish") {
+			const keyPublishInput = input;
+			if (keyPublishInput.removeOldKeys === void 0) {
+				if (process.stdin.isTTY) {
+					const authored = configPath ? await readAuthoredConfigInput(dirname(configPath)) : null;
+					const account = keyPublishInput.env === "staging" ? authored?.staging?.account ?? authored?.account : authored?.account;
+					let listed = null;
+					if (account) {
+						const network = getNetworkIdForAccount(account);
+						const contract = getRegistryNamespaceForAccount(account, keyPublishInput.registry);
+						try {
+							listed = await listPublishKeys({
+								account,
+								contract,
+								network
+							});
+						} catch {
+							listed = null;
+						}
+					}
+					if (listed?.length) {
+						const removeOldKeys = await p.confirm({
+							message: `Remove ${listed.length} existing publish key${listed.length > 1 ? "s" : ""}?`,
+							initialValue: true
+						});
+						if (p.isCancel(removeOldKeys)) return;
+						keyPublishInput.removeOldKeys = removeOldKeys;
+					} else keyPublishInput.removeOldKeys = true;
+				} else keyPublishInput.removeOldKeys = true;
+			}
+		}
 		if (descriptor.key === "dev") {
 			const devSpinner = p.spinner();
 			devSpinner.start("Starting dev environment");
@@ -130,6 +226,7 @@ async function main() {
 				build: "Building...",
 				"resolve config": "Resolving config...",
 				ports: "Finding available ports...",
+				"docker compose up": "Starting local Postgres...",
 				"generate artifacts": "Generating code artifacts..."
 			};
 			const onDevProgress = (event) => {
@@ -150,11 +247,10 @@ async function main() {
 			}
 			devSpinner.stop();
 			clearSpinnerStopLine();
-			const session = consumeDevSession();
-			await outdatedWarning;
+			const session = result.session;
 			if (session) {
 				const { devApp } = await import("./dev-session.mjs");
-				devApp(session.orchestrator, session.services, session.runtimeConfig);
+				devApp(projectDir ?? process.cwd(), session.orchestrator, session.services, session.runtimeConfig, session.envGenerated, session.shellEnv);
 			}
 			return;
 		}
@@ -182,13 +278,12 @@ async function main() {
 				process.exit(1);
 			}
 			startSpinner.stop("Ready");
-			const session = consumeDevSession();
-			await outdatedWarning;
+			const session = result.session;
+			const summary = result.summary;
 			if (session) {
-				const summary = session.summary;
 				if (summary) printStartSummary(summary);
 				const { startApp } = await import("./dev-session.mjs");
-				startApp(session.orchestrator, session.services, session.runtimeConfig);
+				startApp(projectDir ?? process.cwd(), session.orchestrator, session.services, session.runtimeConfig, session.envGenerated, session.shellEnv);
 			}
 			return;
 		}
@@ -205,8 +300,9 @@ async function main() {
 				const fetchSpinner = p.spinner();
 				fetchSpinner.start("Fetching parent config");
 				try {
-					parentConfig = await fetchParentConfig(basic.extendsAccount, basic.extendsGateway);
-					if (parentConfig?.plugins && typeof parentConfig.plugins === "object") parentPluginKeys = Object.keys(parentConfig.plugins);
+					const parent = await fetchInitParent(basic.extendsAccount, basic.extendsGateway);
+					parentConfig = parent.parentConfig;
+					parentPluginKeys = parent.parentPluginKeys;
 				} catch {
 					fetchSpinner.stop("Config not found");
 					console.error(`[CLI] No config found at bos://${basic.extendsAccount}/${basic.extendsGateway}`);
@@ -223,7 +319,8 @@ async function main() {
 				const overrides = await promptInitOverrides({
 					parentPluginKeys,
 					plugins: initInput.plugins,
-					overrides: initInput.overrides
+					overrides: initInput.overrides,
+					level: initInput.level
 				});
 				const directory = initInput.directory || basic.domain || basic.extendsGateway;
 				initInput = {
@@ -234,6 +331,7 @@ async function main() {
 					domain: basic.domain || void 0,
 					plugins: overrides.plugins,
 					overrides: overrides.overrides,
+					level: overrides.level ?? initInput.level,
 					noInteractive: true
 				};
 			}
@@ -282,13 +380,10 @@ async function main() {
 			console.log();
 			console.log(colors.dim("  Next steps:"));
 			console.log(colors.dim(`    cd ${result.directory}`));
-			if (!initInput.noInstall) {
-				console.log(colors.dim("    docker compose up -d --wait"));
-				console.log(colors.dim("    bun run dev"));
-			} else {
-				console.log(colors.dim("    bun install"));
-				console.log(colors.dim("    docker compose up -d --wait"));
-				console.log(colors.dim("    bun run dev"));
+			if (!initInput.noInstall) console.log(colors.dim("    pnpm run dev"));
+			else {
+				console.log(colors.dim("    pnpm install"));
+				console.log(colors.dim("    pnpm run dev"));
 			}
 			console.log();
 			if (initInput.noInteractive !== true && !initInput.noInstall && result.targetDir) {
@@ -298,43 +393,22 @@ async function main() {
 				}) === true) {
 					const dockerSpinner = p.spinner();
 					dockerSpinner.start("Starting Docker services");
-					try {
-						await runDockerComposeUp(result.targetDir);
-						dockerSpinner.stop("Docker services ready");
-					} catch (error) {
+					const compose = await runDockerComposeUp(result.targetDir);
+					if (compose.ok) dockerSpinner.stop("Docker services ready");
+					else {
 						dockerSpinner.stop("Docker services not started");
-						p.log.warn(`docker compose up -d --wait failed: ${error instanceof Error ? error.message : error}`);
+						p.log.warn(`docker compose up -d --wait failed${compose.tail ? `:\n${compose.tail}` : ""}`);
 					}
 				}
 			}
 			return;
 		}
-		await outdatedWarning;
 		const result = await client[descriptor.key](input);
 		if (descriptor.key === "dbStudio") {
 			if (result.status === "error") {
 				console.error(`[CLI] ${result.error || "Unknown error"}`);
 				process.exit(1);
 			}
-			const configPath = findConfigPath();
-			if (configPath) loadProjectEnv(dirname(configPath));
-			const { runStudioLocal, runStudioRemote } = await import("./cli/db-studio.mjs");
-			const info = {
-				key: result.plugin,
-				source: result.source,
-				section: result.section,
-				databaseSecret: result.databaseSecret,
-				databaseUrl: result.databaseUrl,
-				workspaceDir: result.workspaceDir,
-				projectDir: dirname(configPath ?? process.cwd())
-			};
-			try {
-				if (info.source === "local" && info.workspaceDir) await runStudioLocal(info);
-				else await runStudioRemote(info);
-			} catch (error) {
-				console.error(`[CLI] ${error instanceof Error ? error.message : String(error)}`);
-				process.exit(1);
-			}
 			return;
 		}
 		if (descriptor.key === "dbDoctor") {
@@ -384,7 +458,7 @@ async function main() {
 		}
 		if (descriptor.key === "config") {
 			if (!result.config) {
-				console.error("No bos.config.json found");
+				console.error(MISSING_CONFIG_MESSAGE);
 				process.exit(1);
 			}
 			printConfigView(result.config);
@@ -403,7 +477,8 @@ async function main() {
 			}
 			if (result.status === "dry-run") console.log(colors.cyan(`${icons.ok} Dry run — no files written`));
 			else console.log(colors.green(`${icons.ok} Synced`));
-			if (result.updated.length > 0 || result.added.length > 0 || result.conflicted.length > 0) {
+			const hasRetirement = (result.retired?.length ?? 0) > 0 || (result.retiredConflicted?.length ?? 0) > 0;
+			if (result.updated.length > 0 || result.added.length > 0 || result.conflicted.length > 0 || hasRetirement) {
 				console.log(`  ${colors.dim("Sync results:")} ${result.updated.length} updated, ${result.added.length} added, ${result.conflicted.length} conflicted`);
 				if (result.updated.length > 0) for (const f of result.updated) console.log(`    ${colors.dim(f)}`);
 				if (result.added.length > 0) for (const f of result.added) console.log(`    ${colors.dim(f)}`);
@@ -412,8 +487,15 @@ async function main() {
 					if (result.backupDir) console.log(`    ${colors.dim(result.backupDir)}`);
 					for (const f of result.conflicted) console.log(`    ${colors.dim(f)}`);
 				}
+				if (hasRetirement) {
+					console.log(`  ${colors.yellow("Retired")} (replaced by generated stubs — ADR 0023):`);
+					if (result.retiredBackupDir) console.log(`    ${colors.dim(result.retiredBackupDir)}`);
+					for (const f of result.retiredConflicted ?? []) console.log(`    ${colors.dim(`${f} (backed up)`)}`);
+					for (const f of result.retired ?? []) console.log(`    ${colors.dim(f)}`);
+					printStubMigrationGuide(result.retiredConflicted);
+				}
 			}
-			if (result.updated.length === 0 && result.added.length === 0 && result.conflicted.length === 0) console.log(`  ${colors.dim("Already up to date")}`);
+			if (result.updated.length === 0 && result.added.length === 0 && result.conflicted.length === 0 && !hasRetirement) console.log(`  ${colors.dim("Already up to date")}`);
 			console.log();
 			return;
 		}
@@ -442,14 +524,22 @@ async function main() {
 			if (result.selectedPlugins && result.selectedPlugins.length > 0) console.log(`  Added plugins: ${result.selectedPlugins.join(", ")}`);
 			if (result.sync) {
 				const sync = result.sync;
+				const hasRetirement = (sync.retired?.length ?? 0) > 0 || (sync.retiredConflicted?.length ?? 0) > 0;
 				console.log(`  ${colors.dim("Sync results:")}`);
-				if (sync.updated.length > 0 || sync.added.length > 0 || sync.conflicted.length > 0) {
+				if (sync.updated.length > 0 || sync.added.length > 0 || sync.conflicted.length > 0 || hasRetirement) {
 					console.log(`  ${sync.updated.length} updated, ${sync.added.length} added, ${sync.conflicted.length} conflicted`);
 					if (sync.conflicted.length > 0) {
 						console.log(`  ${colors.yellow("Conflicted")} (template applied, your changes backed up):`);
 						if (sync.backupDir) console.log(`    ${colors.dim(sync.backupDir)}`);
 						for (const f of sync.conflicted) console.log(`    ${colors.dim(f)}`);
 					}
+					if (hasRetirement) {
+						console.log(`  ${colors.yellow("Retired")} (replaced by generated stubs — ADR 0023):`);
+						if (sync.retiredBackupDir) console.log(`    ${colors.dim(sync.retiredBackupDir)}`);
+						for (const f of sync.retiredConflicted ?? []) console.log(`    ${colors.dim(`${f} (backed up)`)}`);
+						for (const f of sync.retired ?? []) console.log(`    ${colors.dim(f)}`);
+						printStubMigrationGuide(sync.retiredConflicted);
+					}
 				} else console.log(`  ${colors.dim("Already up to date")}`);
 			}
 			if (result.migrated && result.migrated.length > 0) {
@@ -466,7 +556,7 @@ async function main() {
 					console.log(colors.dim(`  ${result.sync.conflicted.length} file(s) had local conflicts — template version applied, backups at ${result.sync.backupDir || ".bos/sync-backup/"}.`));
 					console.log(colors.dim(`  If local changes should be preserved upstream, open a PR: https://github.com/${parentRepo}${somedelta ? `/compare/${somedelta}` : ""}`));
 				}
-				console.log(colors.dim("  Load matching intent skills: bunx @tanstack/intent@latest load everything-dev#..."));
+				console.log(colors.dim("  Load matching intent skills: pnpm dlx @tanstack/intent@latest load everything-dev#..."));
 				console.log(colors.dim("  Review AGENTS.md — local updates may need merging."));
 			}
 			console.log();
@@ -545,6 +635,41 @@ async function main() {
 			}
 			return;
 		}
+		if (descriptor.key === "logs") {
+			const logsResult = result;
+			const opts = input;
+			for (const line of logsResult.lines) console.log(line);
+			if (logsResult.lines.length === 0) console.log(colors.dim(`  No matching log lines in ${logsResult.logFile}.`));
+			if (opts.follow) {
+				if (logsResult.logFile === "unknown" || !existsSync(logsResult.logFile)) console.log(colors.dim("  No log file to follow — nothing was found on disk."));
+				else {
+					const filter = opts.service;
+					let byteOffset = 0;
+					for (const line of logsResult.lines) byteOffset += Buffer.byteLength(line, "utf8") + 1;
+					const followMatch = (line) => {
+						if (!filter) return true;
+						const source = /\] \[([^\]]+)\] \[(?:OUT|ERR)\] /.exec(line)?.[1];
+						return source === filter || source === `plugin:${filter}`;
+					};
+					const watcher = watch(logsResult.logFile, (event) => {
+						if (event !== "change") return;
+						readFile(logsResult.logFile, "utf8").then((text) => {
+							const newLines = text.slice(byteOffset).split("\n").filter((line) => line.length > 0 && followMatch(line));
+							byteOffset = Buffer.byteLength(text, "utf8");
+							for (const line of newLines) console.log(line);
+						}).catch(() => {
+							watcher.close();
+						});
+					});
+					console.log(colors.dim("  Following — Ctrl+C to stop."));
+					process.on("SIGINT", () => {
+						watcher.close();
+						process.exit(0);
+					});
+				}
+			}
+			return;
+		}
 		if (descriptor.key === "kill") {
 			const killResult = result;
 			console.log();
@@ -618,17 +743,83 @@ async function main() {
 			console.log();
 			return;
 		}
+		if (descriptor.key === "typecheck") {
+			console.log();
+			if (result.status === "error") {
+				console.error(`[CLI] ${result.error || "Unknown error"}`);
+				process.exit(1);
+			}
+			const failed = result.results.filter((r) => !r.passed);
+			const passed = result.results.filter((r) => r.passed);
+			console.log(colors.cyan(frames.top(52)));
+			console.log(`  ${icons.app} ${gradients.cyber("TYPECHECK")}`);
+			console.log(colors.cyan(frames.bottom(52)));
+			console.log();
+			for (const r of result.results) {
+				const icon = r.passed ? colors.green("✓") : colors.error("✗");
+				console.log(`  ${icon} ${r.workspace}`);
+			}
+			if (result.skipped.length > 0) console.log(`  ${colors.dim(`Skipped: ${result.skipped.join(", ")}`)}`);
+			console.log();
+			if (failed.length > 0) {
+				console.log(`  ${colors.error(`${failed.length} failed`)}`);
+				for (const f of failed) if (f.error) console.log(`    ${colors.dim(f.error)}`);
+				console.log();
+				process.exit(1);
+			}
+			console.log(`  ${colors.green(`${passed.length} passed`)}`);
+			console.log();
+			return;
+		}
+		if (descriptor.key === "mfCheck") {
+			console.log();
+			console.log(`  ${colors.dim("Host")}   ${result.hostReachable ? colors.green("OK  ") : colors.error("FAIL")}  ${result.hostVersion ?? "unreachable"}${result.hostReason ? `  (${result.hostReason})` : ""}`);
+			for (const r of result.remotes) {
+				const tag = r.ok ? colors.green("OK  ") : colors.error("FAIL");
+				console.log(`  ${colors.dim(r.role.padEnd(10))} ${tag} ${r.url}  pluginVersion=${r.pluginVersion ?? "?"}${r.reason ? `  ↳ ${r.reason}` : ""}`);
+			}
+			console.log();
+			if (result.status !== "ok") {
+				console.log(colors.error("  mf-compat: ✗ federation manifests NOT compatible — redeploy affected plugin(s) so pluginVersion and shared versions match host"));
+				console.log();
+				process.exit(1);
+			}
+			console.log(colors.green("  mf-compat: ✓ all federation manifests compatible"));
+			console.log();
+			return;
+		}
 		if (result?.status === "error" && descriptor.key !== "publish" && descriptor.key !== "deploy") {
 			console.error(`[CLI] ${result.error || "Unknown error"}`);
 			process.exit(1);
 		}
+		if (descriptor.key === "login") {
+			console.log();
+			console.log(colors.green(`${icons.ok} Logged in to ${result.siteUrl}`));
+			if (result.accountId) console.log(`  ${colors.dim("Account:")} ${result.accountId}`);
+			if (result.expiresAt) console.log(`  ${colors.dim("Expires:")} ${result.expiresAt}`);
+			if (result.warning) console.log(`  ${colors.yellow("⚠")} ${result.warning}`);
+			if (result.publishKey) console.log(`  ${colors.dim("Publish key:")} ${result.publishKey.publicKey} ${colors.dim(`(${result.publishKey.network}, exported to ${result.publishKey.exportedTo})`)}`);
+			console.log();
+			return;
+		}
+		if (descriptor.key === "logout") {
+			console.log();
+			console.log(colors.green(`${icons.ok} Logged out`));
+			if (result.revokedApiKey) console.log(`  ${colors.dim("Revoked API key")}`);
+			if (result.removedPublishKey) console.log(`  ${colors.dim("Removed exported publish key")}`);
+			if (result.warning) console.log(`  ${colors.yellow("⚠")} ${result.warning}`);
+			console.log();
+			return;
+		}
 		if (descriptor.key === "keyPublish") {
 			process.stdout.write(`Generated publish key for ${result.account}\n`);
 			process.stdout.write(`  Network: ${result.network}\n`);
 			process.stdout.write(`  Allowance: ${result.allowance}\n`);
 			process.stdout.write(`\n`);
-			process.stdout.write(`  Set this as NEAR_PRIVATE_KEY in GitHub Actions or before calling publish:\n`);
-			process.stdout.write(`  NEAR_PRIVATE_KEY=${result.privateKey}\n`);
+			const secretName = result.env === "staging" ? "NEAR_TESTNET_PRIVATE_KEY" : "NEAR_PRIVATE_KEY";
+			if (!process.stdout.isTTY) process.stderr.write(`  ⚠ Non-interactive stdout: this private key will be captured in any log or pipe (GitHub Actions logs persist stdout).\n`);
+			process.stdout.write(`  Set this as ${secretName} in GitHub Actions or before calling publish:\n`);
+			process.stdout.write(`${secretName}=${result.privateKey}\n`);
 		}
 		if (descriptor.key === "pluginAdd") {
 			console.log();
@@ -663,8 +854,22 @@ async function main() {
 			console.log();
 			console.log(colors.green(`${icons.ok} Published plugin ${result.key}`));
 			if (result.path) console.log(`  ${colors.dim("Path:")} ${result.path}`);
-			if (result.script) console.log(`  ${colors.dim("Script:")} bun run ${result.script}`);
 			if (result.production) console.log(`  ${colors.dim("Production:")} ${result.production}`);
+			if (result.version) console.log(`  ${colors.dim("Version:")} ${result.version}`);
+			if (result.fingerprint) console.log(`  ${colors.dim("Fingerprint:")} ${result.fingerprint}`);
+			console.log();
+			return;
+		}
+		if (descriptor.key === "registryUse") {
+			console.log();
+			if (result.status === "error") {
+				console.error(colors.error(`${icons.err} ${result.error || "Unknown error"}`));
+				process.exit(1);
+			}
+			console.log(colors.green(`${icons.ok} ${result.status === "dry-run" ? "Dry run" : "Composed"} from ${result.from}`));
+			for (const section of result.applied) console.log(`  ${colors.green("+")} ${section}`);
+			if (result.configPath) console.log(`  ${colors.dim("Config:")} ${result.configPath}`);
+			if (result.status === "updated") console.log(colors.dim("  Run bos types gen to refresh generated types."));
 			console.log();
 			return;
 		}
@@ -712,8 +917,47 @@ async function main() {
 				return;
 			}
 		}
+		if (descriptor.key === "rollback") {
+			const rollbackResult = result;
+			if (rollbackResult.status === "error") {
+				console.log();
+				console.log(colors.error(`${icons.err} Roll back failed`));
+				if (rollbackResult.error) console.log(`  ${colors.dim("Error:")} ${rollbackResult.error}`);
+				if (rollbackResult.verification) {
+					console.log();
+					for (const check of rollbackResult.verification) {
+						const mark = check.ok ? colors.green(icons.ok) : colors.error(icons.err);
+						const reason = check.reason ? colors.dim(` — ${check.reason}`) : "";
+						console.log(`  ${mark} ${check.slot}${reason}`);
+					}
+				}
+				console.log();
+				process.exit(1);
+			}
+			if (rollbackResult.status === "dry-run") {
+				console.log();
+				console.log(colors.cyan(`${icons.ok} Rollback dry run complete`));
+				console.log(`  ${colors.dim("Registry URL:")} ${rollbackResult.registryUrl}`);
+				console.log();
+				return;
+			}
+			console.log();
+			console.log(colors.green(`${icons.ok} Rolled back`));
+			console.log(`  ${colors.dim("Registry URL:")} ${rollbackResult.registryUrl}`);
+			if (rollbackResult.txHash) console.log(`  ${colors.dim("Transaction:")} ${rollbackResult.txHash}`);
+			console.log();
+			return;
+		}
 		if (descriptor.key === "deploy") {
 			const deployResult = result;
+			if (deployResult.status === "list") {
+				console.log();
+				console.log(colors.cyan("Recent publishes (audit trail)"));
+				for (const entry of deployResult.history ?? []) console.log(`  ${entry.blockTimestamp}  ${colors.dim(`block ${entry.blockHeight}`)}${entry.publishedAt ? colors.dim(`  ${entry.publishedAt}`) : ""}`);
+				console.log();
+				return;
+			}
+			if (deployResult.fingerprint) console.log(`  ${colors.dim("Fingerprint:")} ${deployResult.fingerprint}`);
 			if (deployResult.status === "dry-run") {
 				console.log();
 				console.log(colors.cyan(`${icons.ok} Dry run complete`));
@@ -753,21 +997,25 @@ async function main() {
 						for (const w of warnings) console.log(`    ${colors.dim(w)}`);
 					}
 				}
-				if (deployResult.redeployed) console.log(`  ${colors.dim("Railway:")} redeployed ${deployResult.service ?? "service"}`);
-				else if (!process.env.RAILWAY_TOKEN) console.log(`  ${colors.yellow("Railway:")} skipped (RAILWAY_TOKEN not set)`);
+				if (deployResult.image) console.log(`  ${colors.dim("Image:")} ${deployResult.image}`);
+				if (deployResult.service) console.log(`  ${colors.dim("Railway:")} deployed ${deployResult.service}`);
 				console.log();
 				return;
 			}
 			if (deployResult.status === "published") {
 				console.log();
-				console.log(colors.yellow(`${icons.err} Config published, but Railway redeploy failed`));
+				console.log(colors.yellow(`${icons.err} Config published, but a deploy leg failed`));
 				console.log(`  ${colors.dim("Registry URL:")} ${deployResult.registryUrl}`);
 				if (deployResult.txHash) console.log(`  ${colors.dim("Transaction:")} ${deployResult.txHash}`);
-				if (deployResult.error) console.log(`  ${colors.dim("Railway:")} ${deployResult.error}`);
+				if (deployResult.error) console.log(`  ${colors.dim("Error:")} ${deployResult.error}`);
 				console.log();
 				process.exit(1);
 			}
 		}
+		if (descriptor.key === "infraExport") {
+			process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+			return;
+		}
 	} catch (error) {
 		console.error(`[CLI] ${error instanceof Error ? error.message : String(error)}`);
 		process.exit(1);