everything-dev 1.53.2 → 2.0.0-rc.1

package/dist/publish.mjs

@@ -1,26 +1,112 @@
+import { mergeAuthoredOverPublished } from "./merge.mjs";
 import { buildRegistryConfigUrlForNetwork, fetchBosConfigFromFastKv, getRegistryNamespaceForNetwork } from "./fastkv.mjs";
 import { getNetworkIdForAccount } from "./network.mjs";
-import { loadResolvedConfig } from "./config.mjs";
+import { resolveSlotVersion } from "./version-manifest-resolve.mjs";
+import { findConfigPath, isAppDescriptorPath, resolveUiRuntimeName } from "./config.mjs";
+import { openResolution } from "./resolution/session.mjs";
+import { pointerFingerprint, slotPins } from "./fingerprint.mjs";
+import { applyDeployResults } from "./integrity.mjs";
+import { formatDuration } from "./cli/timing.mjs";
 import { padRight } from "./utils/string.mjs";
 import { colors, icons } from "./utils/theme.mjs";
-import { buildWorkspaceTargets, selectWorkspaceTargets } from "./build.mjs";
+import { buildWorkspaceTargets, resolveWorkspaceTarget, selectWorkspaceTargets } from "./build.mjs";
 import { generateCodeArtifacts } from "./code-artifacts.mjs";
-import { ensureNearCli, executeTransaction, resolveNearSigningMode } from "./near-cli.mjs";
-import { readFileSync } from "node:fs";
+import { readSessionHandle } from "./auth-session.mjs";
+import { probeStorageOrigin, resolveCdnDeployInputs } from "./cdn-deploy.mjs";
+import { ensureDelegateKey, submitRegistryWriteDelegated } from "./delegate-signer.mjs";
+import { verifyRollbackSnapshot } from "./rollback.mjs";
+import { diffWorkspaceFiles, localSriMap, mergedFileIntegrity, pinsFromDeployState, pinsFromPublishedConfig, upsertDeployStatePins } from "./deploy-diff.mjs";
+import { describeSigningStrategy, resolveSigningStrategy, submitRegistryWrite } from "./near-signer.mjs";
+import { platformUrlDeployEntries, pluginUiUrlDeployEntries } from "./platform-deploy.mjs";
+import { collectDistFiles, uploadBundle, uploadWorkspaceDist } from "./storage-upload.mjs";
+import { composeWorkspaceVersionManifest, readBuildReport } from "./version-manifest-deploy.mjs";
+import { existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { Effect } from "effect";
 import process from "node:process";
+import { hasFolderFormUi } from "every-plugin/build/ui";
 
 //#region src/publish.ts
 function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function extractPublishedUrl(output) {
-	const deployMatch = output.match(/🚀.*Deployed:\s*(https?:\S+)/);
-	if (deployMatch) return deployMatch[1];
-	const match = output.match(/https?:\/\/[^\s"'<>]+/g);
-	if (!match || match.length === 0) return null;
-	return match[match.length - 1] ?? null;
+async function pinWorkspaceVersionManifest(input) {
+	if (!input.report) return void 0;
+	const versionManifest = composeWorkspaceVersionManifest({
+		report: input.report,
+		ssrReport: input.ssrReport,
+		integrityMap: input.integrityMap,
+		...input.files ? { files: input.files } : {}
+	});
+	if (!versionManifest) return void 0;
+	const manifestFile = `versions/${versionManifest.version}.json`;
+	const manifestUpload = await uploadBundle({
+		origin: input.origin,
+		apiKey: input.apiKey,
+		account: input.account,
+		gateway: input.gateway,
+		workspace: input.workspace,
+		files: [{
+			path: manifestFile,
+			bytes: new TextEncoder().encode(`${JSON.stringify(versionManifest, null, 2)}\n`)
+		}]
+	});
+	const manifestIntegrity = manifestUpload.integrity[manifestFile];
+	if (!manifestIntegrity) return void 0;
+	console.log(`    ${colors.dim(`${padRight("", 28)} version manifest ${manifestFile} (SRI pinned)`)}`);
+	return {
+		file: manifestFile,
+		integrity: manifestIntegrity,
+		storage: manifestUpload.storage
+	};
+}
+/**
+* One workspace's upload leg with skip-unchanged diffing: resolve the previous
+* manifest's `files` map, hash the local dist, upload only new/changed files,
+* and return the merged per-file SRI map for the version manifest. Any failure
+* to resolve the previous map degrades to a full upload.
+*/
+async function diffUploadWorkspace(input) {
+	const localSri = localSriMap(input.files);
+	let uploadFiles = input.files;
+	let prevFiles;
+	if (input.previousPin) try {
+		const resolved = await resolveSlotVersion({
+			base: input.base,
+			pin: input.previousPin
+		});
+		if (resolved.files) {
+			const diff = diffWorkspaceFiles(input.files, localSri, resolved.files);
+			prevFiles = resolved.files;
+			uploadFiles = diff.upload;
+			if (diff.skipped > 0) console.log(`    ${colors.dim(`${padRight(input.workspace, 28)} ${diff.skipped} unchanged file(s) — skipping (manifest diff)`)}`);
+		}
+	} catch {
+		console.log(`    ${colors.dim(`${padRight(input.workspace, 28)} previous manifest unusable — uploading everything`)}`);
+	}
+	console.log(`    ${padRight(input.workspace, 28)} uploading ${uploadFiles.length} of ${input.files.length} files (${formatBundleMb(uploadFiles)}) → ${input.base}`);
+	const result = uploadFiles.length > 0 ? await uploadWorkspaceDist({
+		origin: input.origin,
+		apiKey: input.apiKey,
+		account: input.account,
+		gateway: input.gateway,
+		workspace: input.workspace,
+		files: uploadFiles
+	}) : {
+		stored: 0,
+		totalBytes: 0,
+		integrity: {},
+		storage: void 0
+	};
+	return {
+		result,
+		fileIntegrity: mergedFileIntegrity(input.files, result.integrity, prevFiles),
+		uploaded: result.stored,
+		skipped: input.files.length - uploadFiles.length,
+		total: input.files.length
+	};
+}
+function formatBundleMb(files) {
+	return `${(files.reduce((sum, file) => sum + file.bytes.byteLength, 0) / 1024 / 1024).toFixed(1)} MB`;
 }
 async function waitForPublishedConfig(opts) {
 	const envTimeoutMs = Number(process.env.BOS_PUBLISH_CONFIRMATION_TIMEOUT_MS);
@@ -31,7 +117,7 @@ async function waitForPublishedConfig(opts) {
 	let lastError;
 	while (Date.now() - startedAt < timeoutMs) {
 		try {
-			const verifiedConfig = await fetchBosConfigFromFastKv(`bos://${opts.account}/${opts.gateway}`);
+			const verifiedConfig = await fetchBosConfigFromFastKv(`bos://${opts.account}/${opts.gateway}`, opts.registry);
 			if (JSON.stringify(verifiedConfig) === JSON.stringify(opts.publishConfig)) return;
 		} catch (error) {
 			lastError = error;
@@ -41,45 +127,142 @@ async function waitForPublishedConfig(opts) {
 	const reason = lastError instanceof Error ? ` Last error: ${lastError.message}` : "";
 	throw new Error(`Timed out waiting for publish confirmation at bos://${opts.account}/${opts.gateway}.${reason}`);
 }
-async function publishToFastKv(input) {
-	const { env, dryRun, configDir } = input;
-	let bosConfig = input.bosConfig;
-	const runtimeConfig = input.runtimeConfig;
-	const isStaging = env === "staging";
-	const account = bosConfig.account;
+async function isConfigAlreadyPublished(opts) {
+	try {
+		const current = await fetchBosConfigFromFastKv(`bos://${opts.account}/${opts.gateway}`, opts.registry);
+		return JSON.stringify(current) === JSON.stringify(opts.publishConfig);
+	} catch {
+		return false;
+	}
+}
+async function preflightPublish(input) {
+	const { configDir } = input;
+	const bosConfig = input.bosConfig;
+	const isStaging = input.env === "staging";
+	const account = isStaging ? bosConfig.staging?.account ?? bosConfig.account : bosConfig.account;
 	const gateway = isStaging ? bosConfig.staging?.domain ?? bosConfig.domain : bosConfig.domain;
 	if (!gateway) return {
-		status: "error",
+		kind: "error",
 		registryUrl: "",
-		error: "bos.config.json must define domain to publish"
+		error: "authored config must define domain to publish"
 	};
 	const network = input.network ?? getNetworkIdForAccount(account);
-	const registryUrl = buildRegistryConfigUrlForNetwork(network, account, gateway);
-	const targets = selectWorkspaceTargets(input.packages, bosConfig);
-	let built;
-	let skipped;
-	let deployResults;
-	if (dryRun) return {
-		status: "dry-run",
+	const registryUrl = buildRegistryConfigUrlForNetwork(network, account, gateway, input.registry);
+	const fail = (error) => ({
+		kind: "error",
 		registryUrl,
-		built,
-		skipped
+		error
+	});
+	const publishAuth = bosConfig.publish?.auth;
+	if ((publishAuth === "session" || input.wallet) && !input.privateKey) {
+		const session = readSessionHandle(configDir);
+		if (!session?.credential) return fail((input.wallet ? "--wallet requires" : "the authored config sets publish.auth = \"session\", but") + " no CLI session is stored in .bos/ for this project. Run bos login to create one.");
+		if (session.credential.accountId && session.credential.accountId !== account) return fail(`The CLI session was created for ${session.credential.accountId}, but the configured account is ${account}. Gasless wallet publish relays the FastKV write under the session's NEAR account. Run bos login again under the matching account.`);
+	}
+	if (publishAuth && !input.privateKey) {
+		if (publishAuth === "custody") return fail("the authored config sets publish.auth = \"custody\", but custody publish is not implemented yet (see NEARBuilders/everything-dev#291).");
+	}
+	if (input.dryRun) return {
+		kind: "dry-run",
+		registryUrl
+	};
+	const useWallet = input.wallet === true;
+	let strategy;
+	if (useWallet) console.log(`  Signing via ${colors.cyan("gasless NEP-366 delegate action (relayed by the platform relayer)")}`);
+	else try {
+		strategy = await resolveSigningStrategy({
+			privateKey: input.privateKey,
+			account,
+			network
+		});
+		console.log(`  Signing via ${colors.cyan(describeSigningStrategy(strategy))}`);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : "Unknown error");
+	}
+	const session = readSessionHandle(configDir);
+	let cdnDeploy = {
+		cdnOrigin: void 0,
+		storageOrigin: "",
+		apiKey: void 0
 	};
-	const privateKey = input.privateKey || process.env.NEAR_PRIVATE_KEY || process.env.BOS_NEAR_PRIVATE_KEY;
-	let signingMode;
+	if (input.build) {
+		cdnDeploy = resolveCdnDeployInputs({
+			env: process.env,
+			bosConfig,
+			session: session?.credential ?? null,
+			account,
+			gateway,
+			uploadsPlanned: input.build
+		});
+		if (cdnDeploy.error) return fail(cdnDeploy.error);
+		if (cdnDeploy.warning) console.log(colors.yellow(`  ! ${cdnDeploy.warning}`));
+		if (!cdnDeploy.cdnOrigin) return fail("CDN deploy resolved no bundle origin");
+		const probeError = await probeStorageOrigin(cdnDeploy.storageOrigin);
+		if (probeError) return fail(`The bundle upload origin ${cdnDeploy.storageOrigin} is not running the platform API — ${probeError}. Check BOS_STORAGE_ORIGIN / the bos login session, then re-run.`);
+	}
+	let publishedConfig = null;
+	let publishedConfigState = "missing";
 	try {
-		signingMode = resolveNearSigningMode(privateKey);
+		publishedConfig = await fetchBosConfigFromFastKv(registryUrl, input.registry);
+		publishedConfigState = "fetched";
 	} catch (error) {
-		return {
-			status: "error",
-			registryUrl,
-			error: error instanceof Error ? error.message : "Unknown error"
-		};
+		if ((error instanceof Error ? error.message : String(error)).startsWith("No config found")) console.log(colors.dim("  Note: no published config found yet (first publish) — continuing"));
+		else {
+			publishedConfigState = "unreachable";
+			console.log(colors.dim("  Note: registry read failed — continuing"));
+		}
 	}
+	return {
+		kind: "ready",
+		plan: {
+			isStaging,
+			account,
+			gateway,
+			network,
+			registryUrl,
+			registryNamespace: getRegistryNamespaceForNetwork(network, input.registry),
+			targets: selectWorkspaceTargets(input.packages, bosConfig),
+			useWallet,
+			strategy,
+			cdnOrigin: cdnDeploy.cdnOrigin,
+			storageOrigin: cdnDeploy.storageOrigin,
+			storageApiKey: cdnDeploy.apiKey,
+			publishedConfig,
+			publishedConfigState
+		}
+	};
+}
+/**
+* The deploy-train publish core (ADR 0020, as amended): preflight
+* (storage/CDN creds + signing) fails fast before the build, then build →
+* upload → version-manifest pin → config write-back → FastKV publish +
+* read-back. Scoped to one plugin via `packages`, a single-plugin redeploy
+* ships real bytes to the storage origin — same as the full train, nothing
+* image-native left.
+*/
+async function publishToFastKv(input) {
+	const preflight = await preflightPublish(input);
+	if (preflight.kind === "error") return {
+		status: "error",
+		registryUrl: preflight.registryUrl,
+		error: preflight.error
+	};
+	if (preflight.kind === "dry-run") return {
+		status: "dry-run",
+		registryUrl: preflight.registryUrl
+	};
+	const plan = preflight.plan;
+	const { isStaging, account, gateway, network, registryUrl, registryNamespace, targets, useWallet, strategy } = plan;
+	const storageOrigin = plan.storageOrigin;
+	const storageApiKey = plan.storageApiKey;
+	const { configDir } = input;
+	let bosConfig = input.bosConfig;
+	const runtimeConfig = input.runtimeConfig;
+	let built;
+	let skipped;
+	let deployResults;
+	let refreshedRawConfig = null;
 	if (input.build) {
-		console.log("  Ensuring NEAR CLI...");
-		await Effect.runPromise(ensureNearCli);
-		console.log("  NEAR CLI ready");
 		await generateCodeArtifacts(configDir, bosConfig, {
 			env: "production",
 			runtimeConfig: runtimeConfig ?? void 0
@@ -121,71 +304,324 @@ async function publishToFastKv(input) {
 				};
 			}
 		}
-		const refreshed = await loadResolvedConfig({ cwd: configDir });
+		const refreshed = await openResolution({ cwd: configDir });
 		if (!refreshed?.config) return {
 			status: "error",
 			registryUrl,
 			built,
 			skipped,
 			deployResults,
-			error: "Failed to reload bos.config.json after build"
+			error: "Failed to reload the config after build"
 		};
 		bosConfig = refreshed.config;
+		refreshedRawConfig = refreshed.rawConfig;
 	}
-	const rawConfigPath = join(configDir, "bos.config.json");
-	const rawConfig = JSON.parse(readFileSync(rawConfigPath, "utf-8"));
-	const publishPayload = isStaging ? {
-		...rawConfig,
+	const authoredPath = findConfigPath(configDir);
+	const tsForm = authoredPath !== null && isAppDescriptorPath(authoredPath);
+	let rawConfig;
+	if (refreshedRawConfig) rawConfig = refreshedRawConfig;
+	else {
+		const opened = await openResolution({ cwd: configDir });
+		if (!opened?.rawConfig) return {
+			status: "error",
+			registryUrl,
+			built,
+			skipped,
+			deployResults,
+			error: "Failed to load the authored config for publish"
+		};
+		rawConfig = opened.rawConfig;
+	}
+	if (tsForm && !input.build && plan.publishedConfigState === "unreachable") return {
+		status: "error",
+		registryUrl,
+		built,
+		skipped,
+		deployResults,
+		error: "Cannot read the currently published config from the registry — a config-only publish would overwrite live bundle URLs. Retry when the registry is reachable, or run a full deploy."
+	};
+	let publishPayload = tsForm && !input.build ? mergeAuthoredOverPublished(plan.publishedConfig ?? {}, rawConfig) : rawConfig;
+	const urlOrigin = plan.cdnOrigin ?? `https://${gateway}`;
+	const deployTargets = (built ?? []).filter((key) => targets.includes(key));
+	const platformEntries = [];
+	const prevPins = input.fullUpload === true || process.env.BOS_FULL_UPLOAD === "1" ? {} : {
+		...pinsFromPublishedConfig(plan.publishedConfig ?? {}, account, gateway),
+		...pinsFromDeployState(configDir, account, gateway)
+	};
+	console.log();
+	console.log(`  CDN deploy — uploading workspace dists to ${storageOrigin}...`);
+	for (const key of deployTargets) {
+		const ws = resolveWorkspaceTarget(key, bosConfig, runtimeConfig, configDir);
+		if (!ws) continue;
+		const distFiles = await collectDistFiles(join(ws.path, "dist"));
+		const workspaceBase = `${urlOrigin}/bundles/${account}/${gateway}/${key}/`;
+		const startedAt = Date.now();
+		let outcome;
+		try {
+			outcome = await diffUploadWorkspace({
+				origin: storageOrigin,
+				apiKey: storageApiKey,
+				account,
+				gateway,
+				workspace: key,
+				files: distFiles,
+				base: workspaceBase,
+				previousPin: prevPins[key]
+			});
+		} catch (error) {
+			return {
+				status: "error",
+				registryUrl,
+				built,
+				skipped,
+				deployResults,
+				error: error instanceof Error ? error.message : `[publish] bundle upload for ${key} failed`
+			};
+		}
+		const report = readBuildReport(join(ws.path, "dist"));
+		const ssrReport = readBuildReport(join(ws.path, "dist", "ssr"));
+		const integrity = report ? outcome.fileIntegrity[report.entry] : void 0;
+		const ssrIntegrity = ssrReport?.entry ? outcome.fileIntegrity[`ssr/${ssrReport.entry}`] : void 0;
+		const manifestPointer = await pinWorkspaceVersionManifest({
+			origin: storageOrigin,
+			apiKey: storageApiKey,
+			account,
+			gateway,
+			workspace: key,
+			report,
+			ssrReport,
+			integrityMap: outcome.fileIntegrity,
+			files: outcome.fileIntegrity
+		});
+		if (!manifestPointer) return {
+			status: "error",
+			registryUrl,
+			built,
+			skipped,
+			deployResults,
+			error: `bundle upload for ${key}: version manifest missing — the dist predates hashed entry names (rebuild required; atomic-deploys hard break)`
+		};
+		if (outcome.result.storage === "memory" || manifestPointer.storage === "memory") return {
+			status: "error",
+			registryUrl,
+			built,
+			skipped,
+			deployResults,
+			error: "The receiving instance is serving bundle storage from memory (BOS_STORAGE_* R2 credentials are not configured there) — uploaded bytes would be lost on restart. Aborting before publish."
+		};
+		console.log(`    ${colors.green(icons.ok)} ${padRight(key, 28)} → ${urlOrigin}/bundles/${account}/${gateway}/${key}/ (${outcome.uploaded} uploaded, ${outcome.skipped} skipped, ${formatDuration(Date.now() - startedAt)})`);
+		platformEntries.push(...platformUrlDeployEntries({
+			origin: urlOrigin,
+			account,
+			gateway,
+			key,
+			kind: ws.kind,
+			integrity,
+			ssrIntegrity,
+			pin: manifestPointer
+		}));
+		if (hasFolderFormUi(ws.path)) {
+			const uiDistDir = join(ws.path, "ui", "dist");
+			const rawUi = ((ws.kind === "app" ? "app" : "plugins") === "app" ? rawConfig.app : rawConfig.plugins)?.[key]?.ui;
+			const uiName = resolveUiRuntimeName(rawUi, join(ws.path, "ui"), key);
+			let uiIntegrity;
+			let uiSsrIntegrity;
+			let uiManifestPointer;
+			if (existsSync(uiDistDir)) {
+				const uiDistFiles = await collectDistFiles(uiDistDir);
+				const uiStartedAt = Date.now();
+				const uiOutcome = await diffUploadWorkspace({
+					origin: storageOrigin,
+					apiKey: storageApiKey,
+					account,
+					gateway,
+					workspace: `${key}-ui`,
+					files: uiDistFiles,
+					base: `${urlOrigin}/bundles/${account}/${gateway}/${key}-ui/`,
+					previousPin: prevPins[`${key}-ui`]
+				});
+				const uiReport = readBuildReport(uiDistDir);
+				const uiSsrReport = readBuildReport(join(uiDistDir, "ssr"));
+				uiIntegrity = uiReport ? uiOutcome.fileIntegrity[uiReport.entry] : void 0;
+				uiSsrIntegrity = uiSsrReport?.entry ? uiOutcome.fileIntegrity[`ssr/${uiSsrReport.entry}`] : void 0;
+				uiManifestPointer = await pinWorkspaceVersionManifest({
+					origin: storageOrigin,
+					apiKey: storageApiKey,
+					account,
+					gateway,
+					workspace: `${key}-ui`,
+					report: uiReport,
+					ssrReport: uiSsrReport,
+					integrityMap: uiOutcome.fileIntegrity,
+					files: uiOutcome.fileIntegrity
+				});
+				if (!uiManifestPointer) return {
+					status: "error",
+					registryUrl,
+					built,
+					skipped,
+					deployResults,
+					error: `bundle upload for ${key}-ui: version manifest missing — the dist predates hashed entry names (rebuild required; atomic-deploys hard break)`
+				};
+				if (uiOutcome.result.storage === "memory" || uiManifestPointer.storage === "memory") return {
+					status: "error",
+					registryUrl,
+					built,
+					skipped,
+					deployResults,
+					error: "The receiving instance is serving bundle storage from memory (BOS_STORAGE_* R2 credentials are not configured there) — uploaded bytes would be lost on restart. Aborting before publish."
+				};
+				console.log(`    ${colors.green(icons.ok)} ${padRight(`${key}-ui`, 28)} → ${urlOrigin}/bundles/${account}/${gateway}/${key}-ui/ (${uiOutcome.uploaded} uploaded, ${uiOutcome.skipped} skipped, ${formatDuration(Date.now() - uiStartedAt)})`);
+			} else console.log(`    ${colors.green(icons.ok)} ${padRight(`${key}-ui`, 28)} → ${urlOrigin}/bundles/${account}/${gateway}/${key}-ui/`);
+			platformEntries.push(...pluginUiUrlDeployEntries({
+				origin: urlOrigin,
+				account,
+				gateway,
+				key,
+				kind: ws.kind,
+				integrity: uiIntegrity,
+				ssrIntegrity: uiSsrIntegrity,
+				name: uiName,
+				pin: uiManifestPointer
+			}));
+		}
+	}
+	if (platformEntries.length > 0) {
+		const merged = applyDeployResults(rawConfig, platformEntries);
+		if (!tsForm) try {
+			writeFileSync(join(configDir, "bos.config.json"), `${JSON.stringify(merged, null, 2)}\n`);
+		} catch (error) {
+			return {
+				status: "error",
+				registryUrl,
+				built,
+				skipped,
+				deployResults,
+				error: `Failed to write bundle URLs to bos.config.json: ${error instanceof Error ? error.message : error}`
+			};
+		}
+		publishPayload = merged;
+	}
+	if (isStaging) publishPayload = {
+		...publishPayload,
 		domain: gateway
-	} : rawConfig;
-	const registryEntries = { [`apps/${account}/${gateway}/bos.config.json`]: JSON.stringify(publishPayload) };
-	const payload = JSON.stringify(registryEntries);
-	const argsBase64 = Buffer.from(payload).toString("base64");
+	};
+	const pinVerification = await verifyRollbackSnapshot(publishPayload);
+	if (pinVerification.verifiable && !pinVerification.ok) {
+		const failures = pinVerification.slots.filter((check) => !check.ok).map((check) => `    ${check.slot}: ${check.reason}`).join("\n");
+		console.error(`  ${colors.error(icons.err)} Publish blocked — a pinned slot's bytes do not serve at its production URL:\n${failures}`);
+		return {
+			status: "error",
+			registryUrl,
+			built,
+			skipped,
+			deployResults,
+			error: `Publish blocked — pinned slot bytes missing or SRI mismatched:\n${failures}`
+		};
+	}
+	const registryKey = `apps/${account}/${gateway}/bos.config.json`;
+	const publishedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const fingerprint = pointerFingerprint(publishPayload);
+	const publishSlotPins = slotPins(publishPayload);
+	const registryEntries = { [registryKey]: JSON.stringify(publishPayload) };
+	const manifestKey = `apps/${account}/${gateway}/manifests/${publishedAt.replace(/[:.]/g, "-")}.json`;
+	registryEntries[manifestKey] = JSON.stringify({
+		account,
+		gateway,
+		network,
+		publishedAt,
+		registryUrl
+	});
 	console.log();
 	console.log("  Publishing to:");
 	console.log(`    ${colors.cyan(registryUrl)}`);
+	console.log(`    ${colors.dim("Fingerprint:")} ${fingerprint}`);
+	for (const [slot, pin] of Object.entries(publishSlotPins)) {
+		console.log(`    ${colors.dim(`${slot}:`)}`);
+		console.log(`      ${pin}`);
+	}
+	console.log(`    ${colors.dim(`+ per-deploy manifest ${manifestKey.split("/").pop()} (audit trail)`)}`);
+	const persistDeployState = () => {
+		try {
+			const pins = pinsFromPublishedConfig(publishPayload, account, gateway);
+			if (Object.keys(pins).length > 0) upsertDeployStatePins(configDir, account, gateway, pins);
+		} catch (error) {
+			console.log(colors.dim(`  Note: could not update .bos/deploy-state.json — ${error instanceof Error ? error.message : String(error)}`));
+		}
+	};
 	try {
-		let txHash;
+		if (await isConfigAlreadyPublished({
+			account,
+			gateway,
+			publishConfig: publishPayload,
+			registry: input.registry
+		})) {
+			console.log("  Already up to date — skipping transaction");
+			persistDeployState();
+			return {
+				status: "published",
+				registryUrl,
+				built,
+				skipped,
+				deployResults,
+				publishConfig: publishPayload
+			};
+		}
 		console.log(`  Submitting transaction on ${network}...`);
-		try {
-			const tx = await Effect.runPromise(executeTransaction({
+		let result;
+		if (useWallet) {
+			const credential = readSessionHandle(configDir)?.credential;
+			if (!credential || credential.accountId !== account) return {
+				status: "error",
+				registryUrl,
+				error: `--wallet requires a CLI session under ${account}. Run bos login first.`
+			};
+			const record = await ensureDelegateKey({
+				configDir,
+				account,
+				contract: registryNamespace,
+				network,
+				siteUrl: credential.siteUrl
+			});
+			result = await submitRegistryWriteDelegated({
 				account,
-				contract: getRegistryNamespaceForNetwork(network),
+				contract: registryNamespace,
+				network,
+				args: registryEntries,
+				delegatePrivateKey: record.privateKey,
+				relayEndpoint: `${credential.siteUrl}/api/auth/near/relay`,
+				apiKey: credential.apiKey
+			});
+		} else {
+			if (!strategy) return {
+				status: "error",
+				registryUrl,
+				error: "non-wallet publish requires a resolved signing strategy"
+			};
+			result = await submitRegistryWrite({
+				account,
+				contract: registryNamespace,
 				method: "__fastdata_kv",
-				argsBase64,
+				args: registryEntries,
 				network,
-				privateKey: signingMode._tag === "privateKey" ? signingMode.privateKey : void 0,
-				gas: "300Tgas",
-				deposit: "0NEAR",
-				verbose: input.verbose
-			}, signingMode));
-			txHash = tx.txHash;
-			if (txHash && !tx.output?.includes("CodeDoesNotExist")) console.log(`  Transaction submitted: ${colors.dim(txHash)}`);
-		} catch (error) {
-			console.log(colors.dim("  Transaction reported an error — verifying publish..."));
-			try {
-				await waitForPublishedConfig({
-					account,
-					gateway,
-					publishConfig: publishPayload,
-					timeoutMs: 3e4,
-					intervalMs: 2e3
-				});
-				txHash = extractTransactionHash(error);
-			} catch {
-				throw error;
-			}
+				privateKey: input.privateKey
+			}, strategy);
 		}
+		if (result.txHash) console.log(`  Transaction submitted: ${colors.dim(result.txHash)}`);
 		console.log("  Waiting for publish confirmation...");
 		await waitForPublishedConfig({
 			account,
 			gateway,
-			publishConfig: publishPayload
+			publishConfig: publishPayload,
+			registry: input.registry
 		});
+		persistDeployState();
 		return {
 			status: "published",
 			registryUrl,
-			txHash,
+			txHash: result.txHash,
+			fingerprint,
+			slotPins: publishSlotPins,
 			built,
 			skipped,
 			deployResults,
@@ -212,10 +648,7 @@ function formatNearError(error) {
 	if (message.includes("timeout") || message.includes("Timeout")) return `Transaction timed out. Check NEAR network status.\n  Original: ${message}`;
 	return message;
 }
-function extractTransactionHash(error) {
-	return (error instanceof Error ? error.message : String(error)).match(/Transaction ID:\s*([A-Za-z0-9]+)/i)?.[1];
-}
 
 //#endregion
-export { extractPublishedUrl, publishToFastKv, waitForPublishedConfig };
+export { isConfigAlreadyPublished, preflightPublish, publishToFastKv, waitForPublishedConfig };
 //# sourceMappingURL=publish.mjs.map