everything-dev 2.0.0-rc.6 → 2.0.0-rc.8

package/dist/commands/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["Context","BosDepsTag","MISSING_CONFIG_MESSAGE","publishToFastKv","fetchConfigHistory","summarizeSlotPins","fetchBosConfigFromFastKv","verifyRollbackSnapshot","BosConfigSchema","buildRollbackPayload","fetchDeployManifests","process","isValidImageDigest","openResolution","resolveDeployImagePlan","resolveImageRef","hasDocker","existsSync","join","colors","icons","buildAndPushImage","deployImageToRailway"],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,SAAS,MAAMC,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADOH,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAME,kCAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAASC,mCAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAMC,wCAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAMC,wCAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAeC,8BAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAUC,sCAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAMN,gCAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADOH,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARaQ,oCAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAeC,qBAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAACC,wCAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAMT,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAMU,0CAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAYC,4CAAuB;IAKvC,UAAUC,qCAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAKJ,qBAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAMK,+BAAU;IAC3B,mBAAeC,wBAAWC,gBAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAIC,qBAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACNA,qBAAO,MACL,KAAKC,oBAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAMC,uCAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACNF,qBAAO,MACL,KAAKC,oBAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAID,qBAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAEA,IAAIR,qBAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACNQ,qBAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACNA,qBAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAMG,0CAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAIH,qBAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAIA,qBAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"deploy.cjs","names":["fetchConfigHistory","verifyRollbackSnapshot","buildRollbackPayload","BosConfigSchema","publishToFastKv","Context","BosDepsTag","MISSING_CONFIG_MESSAGE","summarizeSlotPins","fetchBosConfigFromFastKv","fetchDeployManifests","process","isValidImageDigest","openResolution","resolveDeployImagePlan","resolveImageRef","hasDocker","existsSync","join","colors","icons","buildAndPushImage","runSmoke","imageRefWithDigest","deployImageToRailway"],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  imageRefWithDigest,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport { runSmoke } from \"../smoke\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\ninterface RollbackToPreviousInput {\n  account: string;\n  domain: string;\n  env: \"production\" | \"staging\";\n  runtimeConfig: Parameters<typeof publishToFastKv>[0][\"runtimeConfig\"];\n  configDir: string;\n  registry?: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  wallet?: boolean;\n  verbose?: boolean;\n}\n\n/** Roll the registry config back to the previous snapshot in the FastKV\n * publish history — the post-publish smoke failure protocol (ADR 0021):\n * a red boot gate must never leave a new config live against an old image,\n * so the promotion is halted and the config reverts to the last known-good\n * snapshot within seconds. */\nasync function rollbackToPreviousSnapshot(\n  input: RollbackToPreviousInput,\n): Promise<{ ok: boolean; blockHeight?: string; error?: string }> {\n  let history: ConfigHistoryEntry[];\n  try {\n    history = await fetchConfigHistory({\n      accountId: input.account,\n      gatewayId: input.domain,\n      registry: input.registry,\n      limit: 20,\n    });\n  } catch (error) {\n    return {\n      ok: false,\n      error: `fetching publish history failed: ${error instanceof Error ? error.message : String(error)}`,\n    };\n  }\n\n  const previous = history[1];\n  if (!previous) {\n    return {\n      ok: false,\n      error: \"no previous snapshot in the publish history — nothing to roll back to\",\n    };\n  }\n\n  const verification = await verifyRollbackSnapshot(previous.value as BosConfigInput);\n  if (!verification.ok && verification.verifiable) {\n    return {\n      ok: false,\n      error: \"rollback refused — a pinned slot's bytes are gone or no longer match their SRI\",\n    };\n  }\n\n  const payload = buildRollbackPayload(\n    BosConfigSchema.parse(previous.value),\n    new Date().toISOString(),\n  );\n  const result = await publishToFastKv({\n    bosConfig: payload,\n    runtimeConfig: input.runtimeConfig,\n    configDir: input.configDir,\n    env: input.env,\n    build: false,\n    dryRun: false,\n    verbose: input.verbose,\n    packages: \"all\",\n    network: input.network,\n    privateKey: input.privateKey,\n    wallet: input.wallet,\n    registry: input.registry,\n    exactPayload: true,\n  });\n  if (result.status !== \"published\") {\n    return {\n      ok: false,\n      error: `rollback publish failed: ${result.error ?? result.status}`,\n    };\n  }\n  return { ok: true, blockHeight: String(previous.blockHeight) };\n}\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n        exactPayload: true,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      // Post-publish boot gate (publish → smoke → Railway, ADR 0021): the\n      // just-published config is only promoted to Railway if the runtime\n      // image — the one this train pinned — boots against it. A red smoke\n      // rolls the config back to the previous snapshot, so the new-config/\n      // old-image window never survives the deploy run.\n      if (input.smoke) {\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Post-publish smoke skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST)\",\n            ),\n          );\n        } else {\n          console.log();\n          console.log(colors.cyan(\"  ▶ Post-publish smoke (boot gate)\"));\n          const smokeResult = await runSmoke({\n            image: imageRefWithDigest(image, imageDigest),\n            account: nextSession.config?.account,\n            gateway: nextSession.config?.domain,\n          });\n          if (!smokeResult.ok) {\n            const cause = smokeResult.error ?? \"unknown failure\";\n            console.log();\n            console.log(colors.error(`  ${icons.err} Post-publish smoke failed: ${cause}`));\n            if (smokeResult.diagnosis) {\n              console.log(colors.yellow(`  ${smokeResult.diagnosis}`));\n            }\n            const account = nextSession.config?.account;\n            const domain = nextSession.config?.domain;\n            if (!account || !domain) {\n              console.log(colors.yellow(\"  Rollback skipped: no registry identity in the session\"));\n              return {\n                status: \"published\" as const,\n                ...configPublished,\n                image,\n                error: `Post-publish smoke failed (${cause}) — config NOT rolled back: no registry identity`,\n              };\n            }\n            console.log(colors.yellow(\"  Rolling the published config back…\"));\n            const rollback = await rollbackToPreviousSnapshot({\n              account,\n              domain,\n              env: input.env,\n              runtimeConfig: nextSession.runtime,\n              configDir: nextSession.root,\n              registry: input.registry,\n              network: input.network,\n              privateKey: input.privateKey,\n              wallet: input.wallet,\n              verbose: input.verbose,\n            });\n            const rollbackNote = rollback.ok\n              ? `config rolled back to block ${rollback.blockHeight}`\n              : `config NOT rolled back: ${rollback.error ?? \"unknown\"}`;\n            console.log(colors.yellow(`  ${rollbackNote}`));\n            return {\n              status: \"published\" as const,\n              ...configPublished,\n              image,\n              error: `Post-publish smoke failed (${cause}) — ${rollbackNote}`,\n            };\n          }\n          console.log(\n            colors.green(`  ${icons.ok} Post-publish smoke passed: ${smokeResult.summary ?? \"\"}`),\n          );\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA+CA,eAAe,2BACb,OACgE;CAChE,IAAI;CACJ,IAAI;EACF,UAAU,MAAMA,kCAAmB;GACjC,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,OAAO;EACT,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GACL,IAAI;GACJ,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAClG;CACF;CAEA,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,UACH,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,eAAe,MAAMC,wCAAuB,SAAS,KAAuB;CAClF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,UAAUC,sCACdC,8BAAgB,MAAM,SAAS,KAAK,oBACpC,IAAI,KAAK,EAAC,CAAC,YAAY,CACzB;CACA,MAAM,SAAS,MAAMC,gCAAgB;EACnC,WAAW;EACX,eAAe,MAAM;EACrB,WAAW,MAAM;EACjB,KAAK,MAAM;EACX,OAAO;EACP,QAAQ;EACR,SAAS,MAAM;EACf,UAAU;EACV,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,cAAc;CAChB,CAAC;CACD,IAAI,OAAO,WAAW,aACpB,OAAO;EACL,IAAI;EACJ,OAAO,4BAA4B,OAAO,SAAS,OAAO;CAC5D;CAEF,OAAO;EAAE,IAAI;EAAM,aAAa,OAAO,SAAS,WAAW;CAAE;AAC/D;AAEA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADOC,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,SAAS,MAAMH,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADOC,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAMP,kCAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAASQ,mCAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAMC,wCAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAMR,wCAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAeE,8BAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAUD,sCAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAME,gCAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,cAAc;GAChB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADOC,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARaG,oCAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAeC,qBAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAACC,wCAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAMR,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAMS,0CAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAYC,4CAAuB;IAKvC,UAAUC,qCAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAKJ,qBAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAMK,+BAAU;IAC3B,mBAAeC,wBAAWC,gBAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAIC,qBAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACNA,qBAAO,MACL,KAAKC,oBAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAMC,uCAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACNF,qBAAO,MACL,KAAKC,oBAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAID,qBAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAOA,IAAI,MAAM,OAAO;IACf,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACNA,qBAAO,OACL,iGACF,CACF;IACF,OAAO;KACL,QAAQ,IAAI;KACZ,QAAQ,IAAIA,qBAAO,KAAK,oCAAoC,CAAC;KAC7D,MAAM,cAAc,MAAMG,uBAAS;MACjC,OAAOC,wCAAmB,OAAO,WAAW;MAC5C,SAAS,YAAY,QAAQ;MAC7B,SAAS,YAAY,QAAQ;KAC/B,CAAC;KACD,IAAI,CAAC,YAAY,IAAI;MACnB,MAAM,QAAQ,YAAY,SAAS;MACnC,QAAQ,IAAI;MACZ,QAAQ,IAAIJ,qBAAO,MAAM,KAAKC,oBAAM,IAAI,8BAA8B,OAAO,CAAC;MAC9E,IAAI,YAAY,WACd,QAAQ,IAAID,qBAAO,OAAO,KAAK,YAAY,WAAW,CAAC;MAEzD,MAAM,UAAU,YAAY,QAAQ;MACpC,MAAM,SAAS,YAAY,QAAQ;MACnC,IAAI,CAAC,WAAW,CAAC,QAAQ;OACvB,QAAQ,IAAIA,qBAAO,OAAO,yDAAyD,CAAC;OACpF,OAAO;QACL,QAAQ;QACR,GAAG;QACH;QACA,OAAO,8BAA8B,MAAM;OAC7C;MACF;MACA,QAAQ,IAAIA,qBAAO,OAAO,sCAAsC,CAAC;MACjE,MAAM,WAAW,MAAM,2BAA2B;OAChD;OACA;OACA,KAAK,MAAM;OACX,eAAe,YAAY;OAC3B,WAAW,YAAY;OACvB,UAAU,MAAM;OAChB,SAAS,MAAM;OACf,YAAY,MAAM;OAClB,QAAQ,MAAM;OACd,SAAS,MAAM;MACjB,CAAC;MACD,MAAM,eAAe,SAAS,KAC1B,+BAA+B,SAAS,gBACxC,2BAA2B,SAAS,SAAS;MACjD,QAAQ,IAAIA,qBAAO,OAAO,KAAK,cAAc,CAAC;MAC9C,OAAO;OACL,QAAQ;OACR,GAAG;OACH;OACA,OAAO,8BAA8B,MAAM,MAAM;MACnD;KACF;KACA,QAAQ,IACNA,qBAAO,MAAM,KAAKC,oBAAM,GAAG,8BAA8B,YAAY,WAAW,IAAI,CACtF;IACF;GACF;GAEA,IAAIT,qBAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACNQ,qBAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACNA,qBAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAMK,0CAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAIL,qBAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAIA,qBAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}

package/dist/commands/deploy.mjs

@@ -2,17 +2,73 @@ import { BosConfigSchema } from "../types.mjs";
 import { fetchBosConfigFromFastKv, fetchConfigHistory, fetchDeployManifests } from "../fastkv.mjs";
 import { MISSING_CONFIG_MESSAGE } from "../config.mjs";
 import { colors, icons } from "../utils/theme.mjs";
-import { buildAndPushImage, deployImageToRailway, hasDocker, isValidImageDigest, resolveDeployImagePlan, resolveImageRef } from "../image-deploy.mjs";
+import { buildAndPushImage, deployImageToRailway, hasDocker, imageRefWithDigest, isValidImageDigest, resolveDeployImagePlan, resolveImageRef } from "../image-deploy.mjs";
 import { openResolution } from "../resolution/session.mjs";
 import { BosDepsTag } from "./shared.mjs";
 import { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from "../rollback.mjs";
 import { publishToFastKv } from "../publish.mjs";
+import { runSmoke } from "../smoke.mjs";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { Context } from "effect";
 import process from "node:process";
 
 //#region src/commands/deploy.ts
+/** Roll the registry config back to the previous snapshot in the FastKV
+* publish history — the post-publish smoke failure protocol (ADR 0021):
+* a red boot gate must never leave a new config live against an old image,
+* so the promotion is halted and the config reverts to the last known-good
+* snapshot within seconds. */
+async function rollbackToPreviousSnapshot(input) {
+	let history;
+	try {
+		history = await fetchConfigHistory({
+			accountId: input.account,
+			gatewayId: input.domain,
+			registry: input.registry,
+			limit: 20
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			error: `fetching publish history failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const previous = history[1];
+	if (!previous) return {
+		ok: false,
+		error: "no previous snapshot in the publish history — nothing to roll back to"
+	};
+	const verification = await verifyRollbackSnapshot(previous.value);
+	if (!verification.ok && verification.verifiable) return {
+		ok: false,
+		error: "rollback refused — a pinned slot's bytes are gone or no longer match their SRI"
+	};
+	const payload = buildRollbackPayload(BosConfigSchema.parse(previous.value), (/* @__PURE__ */ new Date()).toISOString());
+	const result = await publishToFastKv({
+		bosConfig: payload,
+		runtimeConfig: input.runtimeConfig,
+		configDir: input.configDir,
+		env: input.env,
+		build: false,
+		dryRun: false,
+		verbose: input.verbose,
+		packages: "all",
+		network: input.network,
+		privateKey: input.privateKey,
+		wallet: input.wallet,
+		registry: input.registry,
+		exactPayload: true
+	});
+	if (result.status !== "published") return {
+		ok: false,
+		error: `rollback publish failed: ${result.error ?? result.status}`
+	};
+	return {
+		ok: true,
+		blockHeight: String(previous.blockHeight)
+	};
+}
 function registerDeploy(builder) {
 	return {
 		publish: builder.publish.handler(async ({ input, context }) => {
@@ -142,7 +198,8 @@ function registerDeploy(builder) {
 				network: input.network,
 				privateKey: input.privateKey,
 				wallet: input.wallet,
-				registry: input.registry
+				registry: input.registry,
+				exactPayload: true
 			});
 			return {
 				status: result.status,
@@ -282,6 +339,59 @@ function registerDeploy(builder) {
 					};
 				}
 			}
+			if (input.smoke) {
+				if (!image || !imageDigest) {
+					console.log();
+					console.log(colors.yellow("  Post-publish smoke skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST)"));
+				} else {
+					console.log();
+					console.log(colors.cyan("  ▶ Post-publish smoke (boot gate)"));
+					const smokeResult = await runSmoke({
+						image: imageRefWithDigest(image, imageDigest),
+						account: nextSession.config?.account,
+						gateway: nextSession.config?.domain
+					});
+					if (!smokeResult.ok) {
+						const cause = smokeResult.error ?? "unknown failure";
+						console.log();
+						console.log(colors.error(`  ${icons.err} Post-publish smoke failed: ${cause}`));
+						if (smokeResult.diagnosis) console.log(colors.yellow(`  ${smokeResult.diagnosis}`));
+						const account = nextSession.config?.account;
+						const domain = nextSession.config?.domain;
+						if (!account || !domain) {
+							console.log(colors.yellow("  Rollback skipped: no registry identity in the session"));
+							return {
+								status: "published",
+								...configPublished,
+								image,
+								error: `Post-publish smoke failed (${cause}) — config NOT rolled back: no registry identity`
+							};
+						}
+						console.log(colors.yellow("  Rolling the published config back…"));
+						const rollback = await rollbackToPreviousSnapshot({
+							account,
+							domain,
+							env: input.env,
+							runtimeConfig: nextSession.runtime,
+							configDir: nextSession.root,
+							registry: input.registry,
+							network: input.network,
+							privateKey: input.privateKey,
+							wallet: input.wallet,
+							verbose: input.verbose
+						});
+						const rollbackNote = rollback.ok ? `config rolled back to block ${rollback.blockHeight}` : `config NOT rolled back: ${rollback.error ?? "unknown"}`;
+						console.log(colors.yellow(`  ${rollbackNote}`));
+						return {
+							status: "published",
+							...configPublished,
+							image,
+							error: `Post-publish smoke failed (${cause}) — ${rollbackNote}`
+						};
+					}
+					console.log(colors.green(`  ${icons.ok} Post-publish smoke passed: ${smokeResult.summary ?? ""}`));
+				}
+			}
 			if (process.env.RAILWAY_TOKEN) {
 				const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;
 				if (!railwayService) {

package/dist/commands/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,mBAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAAS,kBAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAM,yBAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAM,uBAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAe,gBAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAU,qBAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARa,qBAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAe,QAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAAC,mBAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAM,eAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAY,uBAAuB;IAKvC,UAAU,gBAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAK,QAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAM,UAAU;IAC3B,eAAe,WAAW,KAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAM,kBAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAI,OAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAEA,IAAI,QAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAM,qBAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAI,OAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  imageRefWithDigest,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport { runSmoke } from \"../smoke\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\ninterface RollbackToPreviousInput {\n  account: string;\n  domain: string;\n  env: \"production\" | \"staging\";\n  runtimeConfig: Parameters<typeof publishToFastKv>[0][\"runtimeConfig\"];\n  configDir: string;\n  registry?: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  wallet?: boolean;\n  verbose?: boolean;\n}\n\n/** Roll the registry config back to the previous snapshot in the FastKV\n * publish history — the post-publish smoke failure protocol (ADR 0021):\n * a red boot gate must never leave a new config live against an old image,\n * so the promotion is halted and the config reverts to the last known-good\n * snapshot within seconds. */\nasync function rollbackToPreviousSnapshot(\n  input: RollbackToPreviousInput,\n): Promise<{ ok: boolean; blockHeight?: string; error?: string }> {\n  let history: ConfigHistoryEntry[];\n  try {\n    history = await fetchConfigHistory({\n      accountId: input.account,\n      gatewayId: input.domain,\n      registry: input.registry,\n      limit: 20,\n    });\n  } catch (error) {\n    return {\n      ok: false,\n      error: `fetching publish history failed: ${error instanceof Error ? error.message : String(error)}`,\n    };\n  }\n\n  const previous = history[1];\n  if (!previous) {\n    return {\n      ok: false,\n      error: \"no previous snapshot in the publish history — nothing to roll back to\",\n    };\n  }\n\n  const verification = await verifyRollbackSnapshot(previous.value as BosConfigInput);\n  if (!verification.ok && verification.verifiable) {\n    return {\n      ok: false,\n      error: \"rollback refused — a pinned slot's bytes are gone or no longer match their SRI\",\n    };\n  }\n\n  const payload = buildRollbackPayload(\n    BosConfigSchema.parse(previous.value),\n    new Date().toISOString(),\n  );\n  const result = await publishToFastKv({\n    bosConfig: payload,\n    runtimeConfig: input.runtimeConfig,\n    configDir: input.configDir,\n    env: input.env,\n    build: false,\n    dryRun: false,\n    verbose: input.verbose,\n    packages: \"all\",\n    network: input.network,\n    privateKey: input.privateKey,\n    wallet: input.wallet,\n    registry: input.registry,\n    exactPayload: true,\n  });\n  if (result.status !== \"published\") {\n    return {\n      ok: false,\n      error: `rollback publish failed: ${result.error ?? result.status}`,\n    };\n  }\n  return { ok: true, blockHeight: String(previous.blockHeight) };\n}\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n        exactPayload: true,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      // Post-publish boot gate (publish → smoke → Railway, ADR 0021): the\n      // just-published config is only promoted to Railway if the runtime\n      // image — the one this train pinned — boots against it. A red smoke\n      // rolls the config back to the previous snapshot, so the new-config/\n      // old-image window never survives the deploy run.\n      if (input.smoke) {\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Post-publish smoke skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST)\",\n            ),\n          );\n        } else {\n          console.log();\n          console.log(colors.cyan(\"  ▶ Post-publish smoke (boot gate)\"));\n          const smokeResult = await runSmoke({\n            image: imageRefWithDigest(image, imageDigest),\n            account: nextSession.config?.account,\n            gateway: nextSession.config?.domain,\n          });\n          if (!smokeResult.ok) {\n            const cause = smokeResult.error ?? \"unknown failure\";\n            console.log();\n            console.log(colors.error(`  ${icons.err} Post-publish smoke failed: ${cause}`));\n            if (smokeResult.diagnosis) {\n              console.log(colors.yellow(`  ${smokeResult.diagnosis}`));\n            }\n            const account = nextSession.config?.account;\n            const domain = nextSession.config?.domain;\n            if (!account || !domain) {\n              console.log(colors.yellow(\"  Rollback skipped: no registry identity in the session\"));\n              return {\n                status: \"published\" as const,\n                ...configPublished,\n                image,\n                error: `Post-publish smoke failed (${cause}) — config NOT rolled back: no registry identity`,\n              };\n            }\n            console.log(colors.yellow(\"  Rolling the published config back…\"));\n            const rollback = await rollbackToPreviousSnapshot({\n              account,\n              domain,\n              env: input.env,\n              runtimeConfig: nextSession.runtime,\n              configDir: nextSession.root,\n              registry: input.registry,\n              network: input.network,\n              privateKey: input.privateKey,\n              wallet: input.wallet,\n              verbose: input.verbose,\n            });\n            const rollbackNote = rollback.ok\n              ? `config rolled back to block ${rollback.blockHeight}`\n              : `config NOT rolled back: ${rollback.error ?? \"unknown\"}`;\n            console.log(colors.yellow(`  ${rollbackNote}`));\n            return {\n              status: \"published\" as const,\n              ...configPublished,\n              image,\n              error: `Post-publish smoke failed (${cause}) — ${rollbackNote}`,\n            };\n          }\n          console.log(\n            colors.green(`  ${icons.ok} Post-publish smoke passed: ${smokeResult.summary ?? \"\"}`),\n          );\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA+CA,eAAe,2BACb,OACgE;CAChE,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,mBAAmB;GACjC,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,OAAO;EACT,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GACL,IAAI;GACJ,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAClG;CACF;CAEA,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,UACH,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,eAAe,MAAM,uBAAuB,SAAS,KAAuB;CAClF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,UAAU,qBACd,gBAAgB,MAAM,SAAS,KAAK,oBACpC,IAAI,KAAK,EAAC,CAAC,YAAY,CACzB;CACA,MAAM,SAAS,MAAM,gBAAgB;EACnC,WAAW;EACX,eAAe,MAAM;EACrB,WAAW,MAAM;EACjB,KAAK,MAAM;EACX,OAAO;EACP,QAAQ;EACR,SAAS,MAAM;EACf,UAAU;EACV,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,cAAc;CAChB,CAAC;CACD,IAAI,OAAO,WAAW,aACpB,OAAO;EACL,IAAI;EACJ,OAAO,4BAA4B,OAAO,SAAS,OAAO;CAC5D;CAEF,OAAO;EAAE,IAAI;EAAM,aAAa,OAAO,SAAS,WAAW;CAAE;AAC/D;AAEA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,mBAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAAS,kBAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAM,yBAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAM,uBAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAe,gBAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAU,qBAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,cAAc;GAChB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARa,qBAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAe,QAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAAC,mBAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAM,eAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAY,uBAAuB;IAKvC,UAAU,gBAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAK,QAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAM,UAAU;IAC3B,eAAe,WAAW,KAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAM,kBAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAI,OAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAOA,IAAI,MAAM,OAAO;IACf,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,iGACF,CACF;IACF,OAAO;KACL,QAAQ,IAAI;KACZ,QAAQ,IAAI,OAAO,KAAK,oCAAoC,CAAC;KAC7D,MAAM,cAAc,MAAM,SAAS;MACjC,OAAO,mBAAmB,OAAO,WAAW;MAC5C,SAAS,YAAY,QAAQ;MAC7B,SAAS,YAAY,QAAQ;KAC/B,CAAC;KACD,IAAI,CAAC,YAAY,IAAI;MACnB,MAAM,QAAQ,YAAY,SAAS;MACnC,QAAQ,IAAI;MACZ,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,IAAI,8BAA8B,OAAO,CAAC;MAC9E,IAAI,YAAY,WACd,QAAQ,IAAI,OAAO,OAAO,KAAK,YAAY,WAAW,CAAC;MAEzD,MAAM,UAAU,YAAY,QAAQ;MACpC,MAAM,SAAS,YAAY,QAAQ;MACnC,IAAI,CAAC,WAAW,CAAC,QAAQ;OACvB,QAAQ,IAAI,OAAO,OAAO,yDAAyD,CAAC;OACpF,OAAO;QACL,QAAQ;QACR,GAAG;QACH;QACA,OAAO,8BAA8B,MAAM;OAC7C;MACF;MACA,QAAQ,IAAI,OAAO,OAAO,sCAAsC,CAAC;MACjE,MAAM,WAAW,MAAM,2BAA2B;OAChD;OACA;OACA,KAAK,MAAM;OACX,eAAe,YAAY;OAC3B,WAAW,YAAY;OACvB,UAAU,MAAM;OAChB,SAAS,MAAM;OACf,YAAY,MAAM;OAClB,QAAQ,MAAM;OACd,SAAS,MAAM;MACjB,CAAC;MACD,MAAM,eAAe,SAAS,KAC1B,+BAA+B,SAAS,gBACxC,2BAA2B,SAAS,SAAS;MACjD,QAAQ,IAAI,OAAO,OAAO,KAAK,cAAc,CAAC;MAC9C,OAAO;OACL,QAAQ;OACR,GAAG;OACH;OACA,OAAO,8BAA8B,MAAM,MAAM;MACnD;KACF;KACA,QAAQ,IACN,OAAO,MAAM,KAAK,MAAM,GAAG,8BAA8B,YAAY,WAAW,IAAI,CACtF;IACF;GACF;GAEA,IAAI,QAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAM,qBAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAI,OAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}

package/dist/commands/keys.cjs

@@ -50,7 +50,7 @@ function registerKeys(builder) {
 					console.log();
 					console.log(`  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? "s" : ""}:`);
 					for (const k of oldKeys) console.log(`    ${require_theme.colors.dim(k)}`);
-					if (input.removeOldKeys !== false) try {
+					if (input.removeOldKeys === true) try {
 						await require_near_cli.deleteAccessKeys(account, oldKeys, network);
 						console.log(`  ${require_theme.colors.green("✓")} Removed ${oldKeys.length} old key${oldKeys.length > 1 ? "s" : ""}`);
 					} catch {

package/dist/commands/keys.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"keys.cjs","names":["Context","BosDepsTag","MISSING_CONFIG_MESSAGE","getNetworkIdForAccount","getRegistryNamespaceForAccount","Effect","ensureNearCli","listPublishKeys","addFunctionCallAccessKey","colors","deleteAccessKeys","startDeviceLogin","openInBrowser","process","readSessionHandle","generateNearKeyPair","join","nearCredentialsPath","parseKey"],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys !== false) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        writeSessionHandle(deps.session?.root ?? process.cwd(), {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n        });\n\n        let warning: string | null = null;\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAOC;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAUC,uCAAuB,OAAO;GAC9C,MAAM,WAAWC,8CAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAMC,cAAO,WAAWC,8BAAa;IAErC,MAAM,UAAU,MAAMC,iCAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAMC,0CAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAOC,qBAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,OAC1B,IAAI;MACF,MAAMC,kCAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAKD,qBAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAKA,qBAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAKA,qBAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAOT,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAMU,oCAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoBF,qBAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAMG,iCAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAIH,qBAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6BA,qBAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,wCAAmB,KAAK,SAAS,QAAQI,qBAAQ,IAAI,GAAG;KACtD,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;IACf,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAG9F,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAOb,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQY,qBAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAUC,uCAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,4CAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAUL,qBAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,yCAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAMJ,cAAO,WAAWC,8BAAa;CAErC,MAAM,UAAUH,uCAAuB,OAAO;CAC9C,MAAM,WAAWC,8CAA+B,SAAS,QAAQ;CACjE,MAAMG,iCAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAUQ,qCAAoB;CACpC,MAAMP,0CAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,qBAAiBQ,gBACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAYC,yCAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,WAAOC,mBAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"keys.cjs","names":["Context","BosDepsTag","MISSING_CONFIG_MESSAGE","getNetworkIdForAccount","getRegistryNamespaceForAccount","Effect","ensureNearCli","listPublishKeys","addFunctionCallAccessKey","colors","deleteAccessKeys","startDeviceLogin","openInBrowser","process","readSessionHandle","generateNearKeyPair","join","nearCredentialsPath","parseKey"],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys === true) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        writeSessionHandle(deps.session?.root ?? process.cwd(), {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n        });\n\n        let warning: string | null = null;\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAOC;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAUC,uCAAuB,OAAO;GAC9C,MAAM,WAAWC,8CAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAMC,cAAO,WAAWC,8BAAa;IAErC,MAAM,UAAU,MAAMC,iCAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAMC,0CAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAOC,qBAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,MAC1B,IAAI;MACF,MAAMC,kCAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAKD,qBAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAKA,qBAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAKA,qBAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAOT,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAMU,oCAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoBF,qBAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAMG,iCAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAIH,qBAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6BA,qBAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,wCAAmB,KAAK,SAAS,QAAQI,qBAAQ,IAAI,GAAG;KACtD,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;IACf,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAG9F,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAOb,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQY,qBAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAUC,uCAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,4CAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAUL,qBAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,yCAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAMJ,cAAO,WAAWC,8BAAa;CAErC,MAAM,UAAUH,uCAAuB,OAAO;CAC9C,MAAM,WAAWC,8CAA+B,SAAS,QAAQ;CACjE,MAAMG,iCAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAUQ,qCAAoB;CACpC,MAAMP,0CAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,qBAAiBQ,gBACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAYC,yCAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,WAAOC,mBAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/commands/keys.mjs

@@ -48,7 +48,7 @@ function registerKeys(builder) {
 					console.log();
 					console.log(`  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? "s" : ""}:`);
 					for (const k of oldKeys) console.log(`    ${colors.dim(k)}`);
-					if (input.removeOldKeys !== false) try {
+					if (input.removeOldKeys === true) try {
 						await deleteAccessKeys(account, oldKeys, network);
 						console.log(`  ${colors.green("✓")} Removed ${oldKeys.length} old key${oldKeys.length > 1 ? "s" : ""}`);
 					} catch {

package/dist/commands/keys.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keys.mjs","names":[],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys !== false) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        writeSessionHandle(deps.session?.root ?? process.cwd(), {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n        });\n\n        let warning: string | null = null;\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAO;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAU,uBAAuB,OAAO;GAC9C,MAAM,WAAW,+BAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAM,OAAO,WAAW,aAAa;IAErC,MAAM,UAAU,MAAM,gBAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAM,yBAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAO,OAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,OAC1B,IAAI;MACF,MAAM,iBAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAK,OAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAK,OAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAK,OAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAM,iBAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoB,OAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAM,cAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAI,OAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6B,OAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,mBAAmB,KAAK,SAAS,QAAQ,QAAQ,IAAI,GAAG;KACtD,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;IACf,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAG9F,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQ,QAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAU,kBAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,uBAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAU,OAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,oBAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,OAAO,WAAW,aAAa;CAErC,MAAM,UAAU,uBAAuB,OAAO;CAC9C,MAAM,WAAW,+BAA+B,SAAS,QAAQ;CACjE,MAAM,gBAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAU,oBAAoB;CACpC,MAAM,yBAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,iBAAiB,KACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAY,oBAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,OAAO,SAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"keys.mjs","names":[],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys === true) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        writeSessionHandle(deps.session?.root ?? process.cwd(), {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n        });\n\n        let warning: string | null = null;\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAO;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAU,uBAAuB,OAAO;GAC9C,MAAM,WAAW,+BAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAM,OAAO,WAAW,aAAa;IAErC,MAAM,UAAU,MAAM,gBAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAM,yBAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAO,OAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,MAC1B,IAAI;MACF,MAAM,iBAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAK,OAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAK,OAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAK,OAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAM,iBAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoB,OAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAM,cAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAI,OAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6B,OAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,mBAAmB,KAAK,SAAS,QAAQ,QAAQ,IAAI,GAAG;KACtD,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;IACf,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAG9F,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQ,QAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAU,kBAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,uBAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAU,OAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,oBAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,OAAO,WAAW,aAAa;CAErC,MAAM,UAAU,uBAAuB,OAAO;CAC9C,MAAM,WAAW,+BAA+B,SAAS,QAAQ;CACjE,MAAM,gBAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAU,oBAAoB;CACpC,MAAM,yBAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,iBAAiB,KACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAY,oBAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,OAAO,SAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}