everything-dev 2.0.0-rc.7 → 2.0.0-rc.9

package/dist/outlayer-login.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"outlayer-login.cjs","names":[],"sources":["../src/outlayer-login.ts"],"sourcesContent":["import { execa } from \"execa\";\nimport type { CustodyWalletRecord } from \"./auth-session\";\n\nexport interface OutlayerCliResult {\n  status: \"linked\" | \"cli-missing\" | \"error\";\n  network: \"mainnet\" | \"testnet\";\n  detail?: string;\n}\n\nexport async function loginOutlayerCli(\n  custodyWallet: CustodyWalletRecord,\n  env: NodeJS.ProcessEnv = process.env,\n): Promise<OutlayerCliResult> {\n  try {\n    await execa(\"outlayer\", [\"--version\"], { env, stdio: \"pipe\" });\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return { status: \"cli-missing\", network: custodyWallet.network };\n    }\n    return {\n      status: \"error\",\n      network: custodyWallet.network,\n      detail: error instanceof Error ? error.message : \"Unknown error\",\n    };\n  }\n\n  const args =\n    custodyWallet.network === \"testnet\"\n      ? [\"login\", \"testnet\", \"--wallet-key\", custodyWallet.apiKey]\n      : [\"login\", \"--wallet-key\", custodyWallet.apiKey];\n  const login = await execa(\"outlayer\", args, { env, stdio: \"pipe\", reject: false });\n  if (login.failed) {\n    return {\n      status: \"error\",\n      network: custodyWallet.network,\n      detail:\n        [login.stderr, login.stdout].filter(Boolean).join(\"\\n\").trim() ||\n        \"OutLayer CLI login failed\",\n    };\n  }\n\n  const whoami = await execa(\"outlayer\", [\"whoami\"], { env, stdio: \"pipe\" }).catch(() => null);\n  return {\n    status: \"linked\",\n    network: custodyWallet.network,\n    detail: whoami?.stdout.trim(),\n  };\n}\n"],"mappings":";;;AASA,eAAsB,iBACpB,eACA,MAAyB,QAAQ,KACL;CAC5B,IAAI;EACF,UAAM,aAAM,YAAY,CAAC,WAAW,GAAG;GAAE;GAAK,OAAO;EAAO,CAAC;CAC/D,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAC5C,OAAO;GAAE,QAAQ;GAAe,SAAS,cAAc;EAAQ;EAEjE,OAAO;GACL,QAAQ;GACR,SAAS,cAAc;GACvB,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;EACnD;CACF;CAEA,MAAM,OACJ,cAAc,YAAY,YACtB;EAAC;EAAS;EAAW;EAAgB,cAAc;CAAM,IACzD;EAAC;EAAS;EAAgB,cAAc;CAAM;CACpD,MAAM,QAAQ,UAAM,aAAM,YAAY,MAAM;EAAE;EAAK,OAAO;EAAQ,QAAQ;CAAM,CAAC;CACjF,IAAI,MAAM,QACR,OAAO;EACL,QAAQ;EACR,SAAS,cAAc;EACvB,QACE,CAAC,MAAM,QAAQ,MAAM,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAC7D;CACJ;CAGF,MAAM,SAAS,UAAM,aAAM,YAAY,CAAC,QAAQ,GAAG;EAAE;EAAK,OAAO;CAAO,CAAC,CAAC,CAAC,YAAY,IAAI;CAC3F,OAAO;EACL,QAAQ;EACR,SAAS,cAAc;EACvB,QAAQ,QAAQ,OAAO,KAAK;CAC9B;AACF"}

package/dist/outlayer-login.mjs

@@ -0,0 +1,54 @@
+import { execa } from "execa";
+
+//#region src/outlayer-login.ts
+async function loginOutlayerCli(custodyWallet, env = process.env) {
+	try {
+		await execa("outlayer", ["--version"], {
+			env,
+			stdio: "pipe"
+		});
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			status: "cli-missing",
+			network: custodyWallet.network
+		};
+		return {
+			status: "error",
+			network: custodyWallet.network,
+			detail: error instanceof Error ? error.message : "Unknown error"
+		};
+	}
+	const args = custodyWallet.network === "testnet" ? [
+		"login",
+		"testnet",
+		"--wallet-key",
+		custodyWallet.apiKey
+	] : [
+		"login",
+		"--wallet-key",
+		custodyWallet.apiKey
+	];
+	const login = await execa("outlayer", args, {
+		env,
+		stdio: "pipe",
+		reject: false
+	});
+	if (login.failed) return {
+		status: "error",
+		network: custodyWallet.network,
+		detail: [login.stderr, login.stdout].filter(Boolean).join("\n").trim() || "OutLayer CLI login failed"
+	};
+	const whoami = await execa("outlayer", ["whoami"], {
+		env,
+		stdio: "pipe"
+	}).catch(() => null);
+	return {
+		status: "linked",
+		network: custodyWallet.network,
+		detail: whoami?.stdout.trim()
+	};
+}
+
+//#endregion
+export { loginOutlayerCli };
+//# sourceMappingURL=outlayer-login.mjs.map

package/dist/outlayer-login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"outlayer-login.mjs","names":[],"sources":["../src/outlayer-login.ts"],"sourcesContent":["import { execa } from \"execa\";\nimport type { CustodyWalletRecord } from \"./auth-session\";\n\nexport interface OutlayerCliResult {\n  status: \"linked\" | \"cli-missing\" | \"error\";\n  network: \"mainnet\" | \"testnet\";\n  detail?: string;\n}\n\nexport async function loginOutlayerCli(\n  custodyWallet: CustodyWalletRecord,\n  env: NodeJS.ProcessEnv = process.env,\n): Promise<OutlayerCliResult> {\n  try {\n    await execa(\"outlayer\", [\"--version\"], { env, stdio: \"pipe\" });\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return { status: \"cli-missing\", network: custodyWallet.network };\n    }\n    return {\n      status: \"error\",\n      network: custodyWallet.network,\n      detail: error instanceof Error ? error.message : \"Unknown error\",\n    };\n  }\n\n  const args =\n    custodyWallet.network === \"testnet\"\n      ? [\"login\", \"testnet\", \"--wallet-key\", custodyWallet.apiKey]\n      : [\"login\", \"--wallet-key\", custodyWallet.apiKey];\n  const login = await execa(\"outlayer\", args, { env, stdio: \"pipe\", reject: false });\n  if (login.failed) {\n    return {\n      status: \"error\",\n      network: custodyWallet.network,\n      detail:\n        [login.stderr, login.stdout].filter(Boolean).join(\"\\n\").trim() ||\n        \"OutLayer CLI login failed\",\n    };\n  }\n\n  const whoami = await execa(\"outlayer\", [\"whoami\"], { env, stdio: \"pipe\" }).catch(() => null);\n  return {\n    status: \"linked\",\n    network: custodyWallet.network,\n    detail: whoami?.stdout.trim(),\n  };\n}\n"],"mappings":";;;AASA,eAAsB,iBACpB,eACA,MAAyB,QAAQ,KACL;CAC5B,IAAI;EACF,MAAM,MAAM,YAAY,CAAC,WAAW,GAAG;GAAE;GAAK,OAAO;EAAO,CAAC;CAC/D,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAC5C,OAAO;GAAE,QAAQ;GAAe,SAAS,cAAc;EAAQ;EAEjE,OAAO;GACL,QAAQ;GACR,SAAS,cAAc;GACvB,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;EACnD;CACF;CAEA,MAAM,OACJ,cAAc,YAAY,YACtB;EAAC;EAAS;EAAW;EAAgB,cAAc;CAAM,IACzD;EAAC;EAAS;EAAgB,cAAc;CAAM;CACpD,MAAM,QAAQ,MAAM,MAAM,YAAY,MAAM;EAAE;EAAK,OAAO;EAAQ,QAAQ;CAAM,CAAC;CACjF,IAAI,MAAM,QACR,OAAO;EACL,QAAQ;EACR,SAAS,cAAc;EACvB,QACE,CAAC,MAAM,QAAQ,MAAM,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAC7D;CACJ;CAGF,MAAM,SAAS,MAAM,MAAM,YAAY,CAAC,QAAQ,GAAG;EAAE;EAAK,OAAO;CAAO,CAAC,CAAC,CAAC,YAAY,IAAI;CAC3F,OAAO;EACL,QAAQ;EACR,SAAS,cAAc;EACvB,QAAQ,QAAQ,OAAO,KAAK;CAC9B;AACF"}

package/dist/plugin.cjs

@@ -12,6 +12,7 @@ const require_deploy = require('./commands/deploy.cjs');
 const require_project_env = require('./env/project-env.cjs');
 const require_progress = require('./progress.cjs');
 const require_dev = require('./commands/dev.cjs');
+const require_import = require('./commands/import.cjs');
 const require_init = require('./commands/init.cjs');
 const require_keys = require('./commands/keys.cjs');
 const require_ops = require('./commands/ops.cjs');
@@ -62,6 +63,7 @@ var plugin_default = (0, every_plugin.createPlugin)({
 		...require_smoke.registerSmoke(builder),
 		...require_keys.registerKeys(builder),
 		...require_init.registerInit(builder),
+		...require_import.registerImport(builder),
 		...require_upgrade.registerUpgrade(builder),
 		...require_db.registerDb(builder),
 		...require_ops.registerOps(builder)

package/dist/plugin.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.cjs","names":["createPlugin","z","bosContract","Effect","openResolution","buildScoped","ProjectEnv","ProjectEnvLive","process","buildScopedContext","Layer","makeDatabaseBindings","makeDrizzleKitLive","p","BosDepsTag","Context","DatabaseBindings","DrizzleKit","registerConfig","registerPlugins","registerDev","registerBuild","registerDeploy","registerSmoke","registerKeys","registerInit","registerUpgrade","registerDb","registerOps"],"sources":["../src/plugin.ts"],"sourcesContent":["import process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport { Context, Effect, Layer } from \"effect\";\nimport { buildScoped, buildScopedContext } from \"every-plugin\";\nimport { registerBuild } from \"./commands/build\";\nimport { registerConfig } from \"./commands/config\";\nimport { registerDb } from \"./commands/db\";\nimport { registerDeploy } from \"./commands/deploy\";\nimport { registerDev } from \"./commands/dev\";\nimport { registerInit } from \"./commands/init\";\nimport { registerKeys } from \"./commands/keys\";\nimport { registerOps } from \"./commands/ops\";\nimport { registerPlugins } from \"./commands/plugins\";\nimport { type BosDeps, BosDepsTag } from \"./commands/shared\";\nimport { registerSmoke } from \"./commands/smoke\";\nimport { registerUpgrade } from \"./commands/upgrade\";\nimport { bosContract } from \"./contract\";\nimport { DatabaseBindings, DrizzleKit, makeDatabaseBindings, makeDrizzleKitLive } from \"./db\";\nimport { ProjectEnv, ProjectEnvLive } from \"./env/project-env\";\nimport { openResolution } from \"./resolution/session\";\nimport { createPlugin, z } from \"./sdk\";\n\nexport { resolveRemoteConfigChain } from \"./commands/config\";\nexport type { DevSessionData, StartSummary } from \"./dev-program\";\nexport { type ProgressEvent, pluginEvents } from \"./progress\";\n\nexport default createPlugin({\n  variables: z.object({\n    configPath: z.string().optional(),\n    // The artifact root (cwd-derived) — decoupled from configPath so an\n    // explicit boot config (--config-path fixture) validates and loads\n    // without redirecting where the CLI writes generated artifacts.\n    configDir: z.string().optional(),\n  }),\n  secrets: z.object({}),\n  contract: bosContract,\n  initialize: (config, _plugins) =>\n    Effect.gen(function* () {\n      const session = yield* Effect.promise(() =>\n        openResolution({ path: config.variables.configPath }),\n      );\n\n      const projectEnv = yield* buildScoped(ProjectEnv, ProjectEnvLive);\n      const effectContext = yield* Effect.context();\n\n      const configDir = config.variables.configDir ?? session?.root ?? process.cwd();\n\n      const services = yield* buildScopedContext(\n        Layer.mergeAll(\n          makeDatabaseBindings({\n            projectDir: configDir,\n            loadRuntimeConfig: async () => (await session?.buildRuntime()) ?? null,\n            loadEnv: () => Effect.runPromiseWith(effectContext)(projectEnv.load(configDir)),\n          }),\n          makeDrizzleKitLive({\n            projectDir: configDir,\n            onLog: (message) => p.log.info(message),\n          }),\n        ),\n      );\n\n      return Layer.succeed(BosDepsTag, {\n        session,\n        databaseBindings: Context.get(services, DatabaseBindings),\n        drizzleKit: Context.get(services, DrizzleKit),\n      } satisfies BosDeps);\n    }),\n  createRouter: (builder) => ({\n    ...registerConfig(builder),\n    ...registerPlugins(builder),\n    ...registerDev(builder),\n    ...registerBuild(builder),\n    ...registerDeploy(builder),\n    ...registerSmoke(builder),\n    ...registerKeys(builder),\n    ...registerInit(builder),\n    ...registerUpgrade(builder),\n    ...registerDb(builder),\n    ...registerOps(builder),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,yBAAeA,2BAAa;CAC1B,WAAWC,MAAE,OAAO;EAClB,YAAYA,MAAE,OAAO,CAAC,CAAC,SAAS;EAIhC,WAAWA,MAAE,OAAO,CAAC,CAAC,SAAS;CACjC,CAAC;CACD,SAASA,MAAE,OAAO,CAAC,CAAC;CACpB,UAAUC;CACV,aAAa,QAAQ,aACnBC,cAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAOA,cAAO,cAC5BC,0CAAe,EAAE,MAAM,OAAO,UAAU,WAAW,CAAC,CACtD;EAEA,MAAM,aAAa,WAAOC,0BAAYC,gCAAYC,kCAAc;EAChE,MAAM,gBAAgB,OAAOJ,cAAO,QAAQ;EAE5C,MAAM,YAAY,OAAO,UAAU,aAAa,SAAS,QAAQK,qBAAQ,IAAI;EAE7E,MAAM,WAAW,WAAOC,iCACtBC,aAAM,SACJC,sCAAqB;GACnB,YAAY;GACZ,mBAAmB,YAAa,MAAM,SAAS,aAAa,KAAM;GAClE,eAAeR,cAAO,eAAe,aAAa,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC;EAChF,CAAC,GACDS,uCAAmB;GACjB,YAAY;GACZ,QAAQ,YAAYC,eAAE,IAAI,KAAK,OAAO;EACxC,CAAC,CACH,CACF;EAEA,OAAOH,aAAM,QAAQI,2BAAY;GAC/B;GACA,kBAAkBC,eAAQ,IAAI,UAAUC,iCAAgB;GACxD,YAAYD,eAAQ,IAAI,UAAUE,8BAAU;EAC9C,CAAmB;CACrB,CAAC;CACH,eAAe,aAAa;EAC1B,GAAGC,8BAAe,OAAO;EACzB,GAAGC,gCAAgB,OAAO;EAC1B,GAAGC,wBAAY,OAAO;EACtB,GAAGC,4BAAc,OAAO;EACxB,GAAGC,8BAAe,OAAO;EACzB,GAAGC,4BAAc,OAAO;EACxB,GAAGC,0BAAa,OAAO;EACvB,GAAGC,0BAAa,OAAO;EACvB,GAAGC,gCAAgB,OAAO;EAC1B,GAAGC,sBAAW,OAAO;EACrB,GAAGC,wBAAY,OAAO;CACxB;AACF,CAAC"}
+{"version":3,"file":"plugin.cjs","names":["createPlugin","z","bosContract","Effect","openResolution","buildScoped","ProjectEnv","ProjectEnvLive","process","buildScopedContext","Layer","makeDatabaseBindings","makeDrizzleKitLive","p","BosDepsTag","Context","DatabaseBindings","DrizzleKit","registerConfig","registerPlugins","registerDev","registerBuild","registerDeploy","registerSmoke","registerKeys","registerInit","registerImport","registerUpgrade","registerDb","registerOps"],"sources":["../src/plugin.ts"],"sourcesContent":["import process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport { Context, Effect, Layer } from \"effect\";\nimport { buildScoped, buildScopedContext } from \"every-plugin\";\nimport { registerBuild } from \"./commands/build\";\nimport { registerConfig } from \"./commands/config\";\nimport { registerDb } from \"./commands/db\";\nimport { registerDeploy } from \"./commands/deploy\";\nimport { registerDev } from \"./commands/dev\";\nimport { registerImport } from \"./commands/import\";\nimport { registerInit } from \"./commands/init\";\nimport { registerKeys } from \"./commands/keys\";\nimport { registerOps } from \"./commands/ops\";\nimport { registerPlugins } from \"./commands/plugins\";\nimport { type BosDeps, BosDepsTag } from \"./commands/shared\";\nimport { registerSmoke } from \"./commands/smoke\";\nimport { registerUpgrade } from \"./commands/upgrade\";\nimport { bosContract } from \"./contract\";\nimport { DatabaseBindings, DrizzleKit, makeDatabaseBindings, makeDrizzleKitLive } from \"./db\";\nimport { ProjectEnv, ProjectEnvLive } from \"./env/project-env\";\nimport { openResolution } from \"./resolution/session\";\nimport { createPlugin, z } from \"./sdk\";\n\nexport { resolveRemoteConfigChain } from \"./commands/config\";\nexport type { DevSessionData, StartSummary } from \"./dev-program\";\nexport { type ProgressEvent, pluginEvents } from \"./progress\";\n\nexport default createPlugin({\n  variables: z.object({\n    configPath: z.string().optional(),\n    // The artifact root (cwd-derived) — decoupled from configPath so an\n    // explicit boot config (--config-path fixture) validates and loads\n    // without redirecting where the CLI writes generated artifacts.\n    configDir: z.string().optional(),\n  }),\n  secrets: z.object({}),\n  contract: bosContract,\n  initialize: (config, _plugins) =>\n    Effect.gen(function* () {\n      const session = yield* Effect.promise(() =>\n        openResolution({ path: config.variables.configPath }),\n      );\n\n      const projectEnv = yield* buildScoped(ProjectEnv, ProjectEnvLive);\n      const effectContext = yield* Effect.context();\n\n      const configDir = config.variables.configDir ?? session?.root ?? process.cwd();\n\n      const services = yield* buildScopedContext(\n        Layer.mergeAll(\n          makeDatabaseBindings({\n            projectDir: configDir,\n            loadRuntimeConfig: async () => (await session?.buildRuntime()) ?? null,\n            loadEnv: () => Effect.runPromiseWith(effectContext)(projectEnv.load(configDir)),\n          }),\n          makeDrizzleKitLive({\n            projectDir: configDir,\n            onLog: (message) => p.log.info(message),\n          }),\n        ),\n      );\n\n      return Layer.succeed(BosDepsTag, {\n        session,\n        databaseBindings: Context.get(services, DatabaseBindings),\n        drizzleKit: Context.get(services, DrizzleKit),\n      } satisfies BosDeps);\n    }),\n  createRouter: (builder) => ({\n    ...registerConfig(builder),\n    ...registerPlugins(builder),\n    ...registerDev(builder),\n    ...registerBuild(builder),\n    ...registerDeploy(builder),\n    ...registerSmoke(builder),\n    ...registerKeys(builder),\n    ...registerInit(builder),\n    ...registerImport(builder),\n    ...registerUpgrade(builder),\n    ...registerDb(builder),\n    ...registerOps(builder),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,yBAAeA,2BAAa;CAC1B,WAAWC,MAAE,OAAO;EAClB,YAAYA,MAAE,OAAO,CAAC,CAAC,SAAS;EAIhC,WAAWA,MAAE,OAAO,CAAC,CAAC,SAAS;CACjC,CAAC;CACD,SAASA,MAAE,OAAO,CAAC,CAAC;CACpB,UAAUC;CACV,aAAa,QAAQ,aACnBC,cAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAOA,cAAO,cAC5BC,0CAAe,EAAE,MAAM,OAAO,UAAU,WAAW,CAAC,CACtD;EAEA,MAAM,aAAa,WAAOC,0BAAYC,gCAAYC,kCAAc;EAChE,MAAM,gBAAgB,OAAOJ,cAAO,QAAQ;EAE5C,MAAM,YAAY,OAAO,UAAU,aAAa,SAAS,QAAQK,qBAAQ,IAAI;EAE7E,MAAM,WAAW,WAAOC,iCACtBC,aAAM,SACJC,sCAAqB;GACnB,YAAY;GACZ,mBAAmB,YAAa,MAAM,SAAS,aAAa,KAAM;GAClE,eAAeR,cAAO,eAAe,aAAa,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC;EAChF,CAAC,GACDS,uCAAmB;GACjB,YAAY;GACZ,QAAQ,YAAYC,eAAE,IAAI,KAAK,OAAO;EACxC,CAAC,CACH,CACF;EAEA,OAAOH,aAAM,QAAQI,2BAAY;GAC/B;GACA,kBAAkBC,eAAQ,IAAI,UAAUC,iCAAgB;GACxD,YAAYD,eAAQ,IAAI,UAAUE,8BAAU;EAC9C,CAAmB;CACrB,CAAC;CACH,eAAe,aAAa;EAC1B,GAAGC,8BAAe,OAAO;EACzB,GAAGC,gCAAgB,OAAO;EAC1B,GAAGC,wBAAY,OAAO;EACtB,GAAGC,4BAAc,OAAO;EACxB,GAAGC,8BAAe,OAAO;EACzB,GAAGC,4BAAc,OAAO;EACxB,GAAGC,0BAAa,OAAO;EACvB,GAAGC,0BAAa,OAAO;EACvB,GAAGC,8BAAe,OAAO;EACzB,GAAGC,gCAAgB,OAAO;EAC1B,GAAGC,sBAAW,OAAO;EACrB,GAAGC,wBAAY,OAAO;CACxB;AACF,CAAC"}

package/dist/plugin.d.cts

@@ -109,6 +109,7 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
           key: "key";
           session: "session";
         }>>;
+        sourcePublish: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>>;
       ci: z.ZodOptional<z.ZodObject<{
         image: z.ZodOptional<z.ZodString>;
@@ -548,6 +549,7 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
   }, z.core.$strip>, object>;
   login: import("@orpc/contract").ProcedureContract<z.ZodObject<{
     key: z.ZodDefault<z.ZodBoolean>;
+    custody: z.ZodDefault<z.ZodBoolean>;
     site: z.ZodOptional<z.ZodString>;
     expiresIn: z.ZodDefault<z.ZodNumber>;
     device: z.ZodOptional<z.ZodString>;
@@ -574,6 +576,27 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
       contract: z.ZodString;
       exportedTo: z.ZodString;
     }, z.core.$strip>>>;
+    custodyWallet: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+      walletId: z.ZodString;
+      nearAccountId: z.ZodString;
+      network: z.ZodEnum<{
+        mainnet: "mainnet";
+        testnet: "testnet";
+      }>;
+      handoffUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    outlayerCli: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+      status: z.ZodEnum<{
+        "cli-missing": "cli-missing";
+        error: "error";
+        linked: "linked";
+      }>;
+      network: z.ZodEnum<{
+        mainnet: "mainnet";
+        testnet: "testnet";
+      }>;
+      detail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
     warning: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>, object>;
@@ -653,6 +676,57 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
     backupDir: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>, object>;
+  import: import("@orpc/contract").ProcedureContract<z.ZodObject<{
+    workspace: z.ZodString;
+    from: z.ZodOptional<z.ZodString>;
+    yes: z.ZodDefault<z.ZodBoolean>;
+    dryRun: z.ZodDefault<z.ZodBoolean>;
+    noInstall: z.ZodDefault<z.ZodBoolean>;
+    json: z.ZodDefault<z.ZodBoolean>;
+  }, z.core.$strip>, z.ZodObject<{
+    status: z.ZodEnum<{
+      conflicts: "conflicts";
+      "dry-run": "dry-run";
+      error: "error";
+      imported: "imported";
+    }>;
+    workspace: z.ZodString;
+    from: z.ZodString;
+    ref: z.ZodString;
+    resolvedSha: z.ZodOptional<z.ZodString>;
+    sourceRepository: z.ZodOptional<z.ZodString>;
+    warnings: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    added: z.ZodArray<z.ZodString>;
+    updated: z.ZodArray<z.ZodString>;
+    unchanged: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    preservedLocal: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    merged: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    conflicts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    heldBackMigrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    routeDelta: z.ZodOptional<z.ZodObject<{
+      oursOnly: z.ZodArray<z.ZodString>;
+      theirsOnly: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    migrationCollisions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"tag-mismatch">;
+      idx: z.ZodNumber;
+      localTag: z.ZodOptional<z.ZodString>;
+      upstreamTag: z.ZodOptional<z.ZodString>;
+      message: z.ZodString;
+    }, z.core.$strip>>>;
+    migrationReconciliation: z.ZodOptional<z.ZodObject<{
+      kept: z.ZodArray<z.ZodString>;
+      appended: z.ZodArray<z.ZodObject<{
+        idx: z.ZodNumber;
+        fromTag: z.ZodString;
+        toTag: z.ZodString;
+      }, z.core.$strip>>;
+      contentMatched: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    backupDir: z.ZodOptional<z.ZodString>;
+    reportPath: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, object>;
   upgrade: import("@orpc/contract").ProcedureContract<z.ZodObject<{
     dryRun: z.ZodDefault<z.ZodBoolean>;
     noInstall: z.ZodDefault<z.ZodBoolean>;

package/dist/plugin.d.mts

@@ -109,6 +109,7 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
           key: "key";
           session: "session";
         }>>;
+        sourcePublish: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>>;
       ci: z.ZodOptional<z.ZodObject<{
         image: z.ZodOptional<z.ZodString>;
@@ -548,6 +549,7 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
   }, z.core.$strip>, object>;
   login: import("@orpc/contract").ProcedureContract<z.ZodObject<{
     key: z.ZodDefault<z.ZodBoolean>;
+    custody: z.ZodDefault<z.ZodBoolean>;
     site: z.ZodOptional<z.ZodString>;
     expiresIn: z.ZodDefault<z.ZodNumber>;
     device: z.ZodOptional<z.ZodString>;
@@ -574,6 +576,27 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
       contract: z.ZodString;
       exportedTo: z.ZodString;
     }, z.core.$strip>>>;
+    custodyWallet: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+      walletId: z.ZodString;
+      nearAccountId: z.ZodString;
+      network: z.ZodEnum<{
+        mainnet: "mainnet";
+        testnet: "testnet";
+      }>;
+      handoffUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    outlayerCli: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+      status: z.ZodEnum<{
+        "cli-missing": "cli-missing";
+        error: "error";
+        linked: "linked";
+      }>;
+      network: z.ZodEnum<{
+        mainnet: "mainnet";
+        testnet: "testnet";
+      }>;
+      detail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
     warning: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>, object>;
@@ -653,6 +676,57 @@ declare const _default: import("every-plugin").LoadedPluginWithBinding<{
     backupDir: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>, object>;
+  import: import("@orpc/contract").ProcedureContract<z.ZodObject<{
+    workspace: z.ZodString;
+    from: z.ZodOptional<z.ZodString>;
+    yes: z.ZodDefault<z.ZodBoolean>;
+    dryRun: z.ZodDefault<z.ZodBoolean>;
+    noInstall: z.ZodDefault<z.ZodBoolean>;
+    json: z.ZodDefault<z.ZodBoolean>;
+  }, z.core.$strip>, z.ZodObject<{
+    status: z.ZodEnum<{
+      conflicts: "conflicts";
+      "dry-run": "dry-run";
+      error: "error";
+      imported: "imported";
+    }>;
+    workspace: z.ZodString;
+    from: z.ZodString;
+    ref: z.ZodString;
+    resolvedSha: z.ZodOptional<z.ZodString>;
+    sourceRepository: z.ZodOptional<z.ZodString>;
+    warnings: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    added: z.ZodArray<z.ZodString>;
+    updated: z.ZodArray<z.ZodString>;
+    unchanged: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    preservedLocal: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    merged: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    conflicts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    heldBackMigrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    routeDelta: z.ZodOptional<z.ZodObject<{
+      oursOnly: z.ZodArray<z.ZodString>;
+      theirsOnly: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    migrationCollisions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"tag-mismatch">;
+      idx: z.ZodNumber;
+      localTag: z.ZodOptional<z.ZodString>;
+      upstreamTag: z.ZodOptional<z.ZodString>;
+      message: z.ZodString;
+    }, z.core.$strip>>>;
+    migrationReconciliation: z.ZodOptional<z.ZodObject<{
+      kept: z.ZodArray<z.ZodString>;
+      appended: z.ZodArray<z.ZodObject<{
+        idx: z.ZodNumber;
+        fromTag: z.ZodString;
+        toTag: z.ZodString;
+      }, z.core.$strip>>;
+      contentMatched: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    backupDir: z.ZodOptional<z.ZodString>;
+    reportPath: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, object>;
   upgrade: import("@orpc/contract").ProcedureContract<z.ZodObject<{
     dryRun: z.ZodDefault<z.ZodBoolean>;
     noInstall: z.ZodDefault<z.ZodBoolean>;

package/dist/plugin.mjs

@@ -11,6 +11,7 @@ import { registerDeploy } from "./commands/deploy.mjs";
 import { ProjectEnv, ProjectEnvLive } from "./env/project-env.mjs";
 import { pluginEvents } from "./progress.mjs";
 import { registerDev } from "./commands/dev.mjs";
+import { registerImport } from "./commands/import.mjs";
 import { registerInit } from "./commands/init.mjs";
 import { registerKeys } from "./commands/keys.mjs";
 import { registerOps } from "./commands/ops.mjs";
@@ -58,6 +59,7 @@ var plugin_default = createPlugin({
 		...registerSmoke(builder),
 		...registerKeys(builder),
 		...registerInit(builder),
+		...registerImport(builder),
 		...registerUpgrade(builder),
 		...registerDb(builder),
 		...registerOps(builder)

package/dist/plugin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["import process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport { Context, Effect, Layer } from \"effect\";\nimport { buildScoped, buildScopedContext } from \"every-plugin\";\nimport { registerBuild } from \"./commands/build\";\nimport { registerConfig } from \"./commands/config\";\nimport { registerDb } from \"./commands/db\";\nimport { registerDeploy } from \"./commands/deploy\";\nimport { registerDev } from \"./commands/dev\";\nimport { registerInit } from \"./commands/init\";\nimport { registerKeys } from \"./commands/keys\";\nimport { registerOps } from \"./commands/ops\";\nimport { registerPlugins } from \"./commands/plugins\";\nimport { type BosDeps, BosDepsTag } from \"./commands/shared\";\nimport { registerSmoke } from \"./commands/smoke\";\nimport { registerUpgrade } from \"./commands/upgrade\";\nimport { bosContract } from \"./contract\";\nimport { DatabaseBindings, DrizzleKit, makeDatabaseBindings, makeDrizzleKitLive } from \"./db\";\nimport { ProjectEnv, ProjectEnvLive } from \"./env/project-env\";\nimport { openResolution } from \"./resolution/session\";\nimport { createPlugin, z } from \"./sdk\";\n\nexport { resolveRemoteConfigChain } from \"./commands/config\";\nexport type { DevSessionData, StartSummary } from \"./dev-program\";\nexport { type ProgressEvent, pluginEvents } from \"./progress\";\n\nexport default createPlugin({\n  variables: z.object({\n    configPath: z.string().optional(),\n    // The artifact root (cwd-derived) — decoupled from configPath so an\n    // explicit boot config (--config-path fixture) validates and loads\n    // without redirecting where the CLI writes generated artifacts.\n    configDir: z.string().optional(),\n  }),\n  secrets: z.object({}),\n  contract: bosContract,\n  initialize: (config, _plugins) =>\n    Effect.gen(function* () {\n      const session = yield* Effect.promise(() =>\n        openResolution({ path: config.variables.configPath }),\n      );\n\n      const projectEnv = yield* buildScoped(ProjectEnv, ProjectEnvLive);\n      const effectContext = yield* Effect.context();\n\n      const configDir = config.variables.configDir ?? session?.root ?? process.cwd();\n\n      const services = yield* buildScopedContext(\n        Layer.mergeAll(\n          makeDatabaseBindings({\n            projectDir: configDir,\n            loadRuntimeConfig: async () => (await session?.buildRuntime()) ?? null,\n            loadEnv: () => Effect.runPromiseWith(effectContext)(projectEnv.load(configDir)),\n          }),\n          makeDrizzleKitLive({\n            projectDir: configDir,\n            onLog: (message) => p.log.info(message),\n          }),\n        ),\n      );\n\n      return Layer.succeed(BosDepsTag, {\n        session,\n        databaseBindings: Context.get(services, DatabaseBindings),\n        drizzleKit: Context.get(services, DrizzleKit),\n      } satisfies BosDeps);\n    }),\n  createRouter: (builder) => ({\n    ...registerConfig(builder),\n    ...registerPlugins(builder),\n    ...registerDev(builder),\n    ...registerBuild(builder),\n    ...registerDeploy(builder),\n    ...registerSmoke(builder),\n    ...registerKeys(builder),\n    ...registerInit(builder),\n    ...registerUpgrade(builder),\n    ...registerDb(builder),\n    ...registerOps(builder),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,qBAAe,aAAa;CAC1B,WAAW,EAAE,OAAO;EAClB,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAIhC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,CAAC;CACD,SAAS,EAAE,OAAO,CAAC,CAAC;CACpB,UAAU;CACV,aAAa,QAAQ,aACnB,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,OAAO,cAC5B,eAAe,EAAE,MAAM,OAAO,UAAU,WAAW,CAAC,CACtD;EAEA,MAAM,aAAa,OAAO,YAAY,YAAY,cAAc;EAChE,MAAM,gBAAgB,OAAO,OAAO,QAAQ;EAE5C,MAAM,YAAY,OAAO,UAAU,aAAa,SAAS,QAAQ,QAAQ,IAAI;EAE7E,MAAM,WAAW,OAAO,mBACtB,MAAM,SACJ,qBAAqB;GACnB,YAAY;GACZ,mBAAmB,YAAa,MAAM,SAAS,aAAa,KAAM;GAClE,eAAe,OAAO,eAAe,aAAa,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC;EAChF,CAAC,GACD,mBAAmB;GACjB,YAAY;GACZ,QAAQ,YAAY,EAAE,IAAI,KAAK,OAAO;EACxC,CAAC,CACH,CACF;EAEA,OAAO,MAAM,QAAQ,YAAY;GAC/B;GACA,kBAAkB,QAAQ,IAAI,UAAU,gBAAgB;GACxD,YAAY,QAAQ,IAAI,UAAU,UAAU;EAC9C,CAAmB;CACrB,CAAC;CACH,eAAe,aAAa;EAC1B,GAAG,eAAe,OAAO;EACzB,GAAG,gBAAgB,OAAO;EAC1B,GAAG,YAAY,OAAO;EACtB,GAAG,cAAc,OAAO;EACxB,GAAG,eAAe,OAAO;EACzB,GAAG,cAAc,OAAO;EACxB,GAAG,aAAa,OAAO;EACvB,GAAG,aAAa,OAAO;EACvB,GAAG,gBAAgB,OAAO;EAC1B,GAAG,WAAW,OAAO;EACrB,GAAG,YAAY,OAAO;CACxB;AACF,CAAC"}
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["import process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport { Context, Effect, Layer } from \"effect\";\nimport { buildScoped, buildScopedContext } from \"every-plugin\";\nimport { registerBuild } from \"./commands/build\";\nimport { registerConfig } from \"./commands/config\";\nimport { registerDb } from \"./commands/db\";\nimport { registerDeploy } from \"./commands/deploy\";\nimport { registerDev } from \"./commands/dev\";\nimport { registerImport } from \"./commands/import\";\nimport { registerInit } from \"./commands/init\";\nimport { registerKeys } from \"./commands/keys\";\nimport { registerOps } from \"./commands/ops\";\nimport { registerPlugins } from \"./commands/plugins\";\nimport { type BosDeps, BosDepsTag } from \"./commands/shared\";\nimport { registerSmoke } from \"./commands/smoke\";\nimport { registerUpgrade } from \"./commands/upgrade\";\nimport { bosContract } from \"./contract\";\nimport { DatabaseBindings, DrizzleKit, makeDatabaseBindings, makeDrizzleKitLive } from \"./db\";\nimport { ProjectEnv, ProjectEnvLive } from \"./env/project-env\";\nimport { openResolution } from \"./resolution/session\";\nimport { createPlugin, z } from \"./sdk\";\n\nexport { resolveRemoteConfigChain } from \"./commands/config\";\nexport type { DevSessionData, StartSummary } from \"./dev-program\";\nexport { type ProgressEvent, pluginEvents } from \"./progress\";\n\nexport default createPlugin({\n  variables: z.object({\n    configPath: z.string().optional(),\n    // The artifact root (cwd-derived) — decoupled from configPath so an\n    // explicit boot config (--config-path fixture) validates and loads\n    // without redirecting where the CLI writes generated artifacts.\n    configDir: z.string().optional(),\n  }),\n  secrets: z.object({}),\n  contract: bosContract,\n  initialize: (config, _plugins) =>\n    Effect.gen(function* () {\n      const session = yield* Effect.promise(() =>\n        openResolution({ path: config.variables.configPath }),\n      );\n\n      const projectEnv = yield* buildScoped(ProjectEnv, ProjectEnvLive);\n      const effectContext = yield* Effect.context();\n\n      const configDir = config.variables.configDir ?? session?.root ?? process.cwd();\n\n      const services = yield* buildScopedContext(\n        Layer.mergeAll(\n          makeDatabaseBindings({\n            projectDir: configDir,\n            loadRuntimeConfig: async () => (await session?.buildRuntime()) ?? null,\n            loadEnv: () => Effect.runPromiseWith(effectContext)(projectEnv.load(configDir)),\n          }),\n          makeDrizzleKitLive({\n            projectDir: configDir,\n            onLog: (message) => p.log.info(message),\n          }),\n        ),\n      );\n\n      return Layer.succeed(BosDepsTag, {\n        session,\n        databaseBindings: Context.get(services, DatabaseBindings),\n        drizzleKit: Context.get(services, DrizzleKit),\n      } satisfies BosDeps);\n    }),\n  createRouter: (builder) => ({\n    ...registerConfig(builder),\n    ...registerPlugins(builder),\n    ...registerDev(builder),\n    ...registerBuild(builder),\n    ...registerDeploy(builder),\n    ...registerSmoke(builder),\n    ...registerKeys(builder),\n    ...registerInit(builder),\n    ...registerImport(builder),\n    ...registerUpgrade(builder),\n    ...registerDb(builder),\n    ...registerOps(builder),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,qBAAe,aAAa;CAC1B,WAAW,EAAE,OAAO;EAClB,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAIhC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,CAAC;CACD,SAAS,EAAE,OAAO,CAAC,CAAC;CACpB,UAAU;CACV,aAAa,QAAQ,aACnB,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,OAAO,cAC5B,eAAe,EAAE,MAAM,OAAO,UAAU,WAAW,CAAC,CACtD;EAEA,MAAM,aAAa,OAAO,YAAY,YAAY,cAAc;EAChE,MAAM,gBAAgB,OAAO,OAAO,QAAQ;EAE5C,MAAM,YAAY,OAAO,UAAU,aAAa,SAAS,QAAQ,QAAQ,IAAI;EAE7E,MAAM,WAAW,OAAO,mBACtB,MAAM,SACJ,qBAAqB;GACnB,YAAY;GACZ,mBAAmB,YAAa,MAAM,SAAS,aAAa,KAAM;GAClE,eAAe,OAAO,eAAe,aAAa,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC;EAChF,CAAC,GACD,mBAAmB;GACjB,YAAY;GACZ,QAAQ,YAAY,EAAE,IAAI,KAAK,OAAO;EACxC,CAAC,CACH,CACF;EAEA,OAAO,MAAM,QAAQ,YAAY;GAC/B;GACA,kBAAkB,QAAQ,IAAI,UAAU,gBAAgB;GACxD,YAAY,QAAQ,IAAI,UAAU,UAAU;EAC9C,CAAmB;CACrB,CAAC;CACH,eAAe,aAAa;EAC1B,GAAG,eAAe,OAAO;EACzB,GAAG,gBAAgB,OAAO;EAC1B,GAAG,YAAY,OAAO;EACtB,GAAG,cAAc,OAAO;EACxB,GAAG,eAAe,OAAO;EACzB,GAAG,cAAc,OAAO;EACxB,GAAG,aAAa,OAAO;EACvB,GAAG,aAAa,OAAO;EACvB,GAAG,eAAe,OAAO;EACzB,GAAG,gBAAgB,OAAO;EAC1B,GAAG,WAAW,OAAO;EACrB,GAAG,YAAY,OAAO;CACxB;AACF,CAAC"}

package/dist/publish.cjs

@@ -5,6 +5,7 @@ const require_fastkv = require('./fastkv.cjs');
 const require_network = require('./network.cjs');
 const require_version_manifest_resolve = require('./version-manifest-resolve.cjs');
 const require_config = require('./config.cjs');
+const require_run = require('./utils/run.cjs');
 const require_theme = require('./utils/theme.cjs');
 const require_resolution_session = require('./resolution/session.cjs');
 const require_fingerprint = require('./fingerprint.cjs');
@@ -15,11 +16,13 @@ const require_build = require('./build.cjs');
 const require_code_artifacts = require('./code-artifacts.cjs');
 const require_auth_session = require('./auth-session.cjs');
 const require_cdn_deploy = require('./cdn-deploy.cjs');
+const require_custody_signer = require('./custody-signer.cjs');
 const require_delegate_signer = require('./delegate-signer.cjs');
 const require_rollback = require('./rollback.cjs');
 const require_deploy_diff = require('./deploy-diff.cjs');
 const require_near_signer = require('./near-signer.cjs');
 const require_platform_deploy = require('./platform-deploy.cjs');
+const require_source_archive = require('./source-archive.cjs');
 const require_storage_upload = require('./storage-upload.cjs');
 const require_version_manifest_deploy = require('./version-manifest-deploy.cjs');
 let node_fs = require("node:fs");
@@ -38,7 +41,9 @@ async function pinWorkspaceVersionManifest(input) {
 		report: input.report,
 		ssrReport: input.ssrReport,
 		integrityMap: input.integrityMap,
-		...input.files ? { files: input.files } : {}
+		...input.files ? { files: input.files } : {},
+		...input.source ? { source: input.source } : {},
+		...input.gitSha ? { gitSha: input.gitSha } : {}
 	});
 	if (!versionManifest) return void 0;
 	const manifestFile = `versions/${versionManifest.version}.json`;
@@ -63,6 +68,77 @@ async function pinWorkspaceVersionManifest(input) {
 	};
 }
 /**
+* Best-effort repo HEAD for the version manifest (`gitSha`): non-git
+* contexts (child bundles built outside a repo) omit the field silently —
+* it never fails the deploy.
+*/
+async function resolveGitSha(cwd) {
+	try {
+		const result = await require_run.run("git", ["rev-parse", "HEAD"], {
+			cwd,
+			capture: true
+		});
+		const sha = result?.stdout.trim();
+		return result && result.exitCode === 0 && sha ? sha : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The source-archive leg (publish.sourcePublish, #406): tar the workspace
+* subtree, dedupe against the previous pin's manifest by archive SRI (reuse
+* skips the upload), otherwise upload and take the **server-computed** SRI
+* (MAP decision 6). The temp archive dir is cleaned up on every path — the
+* manifest only carries `{ file, integrity }`, not the bytes.
+*/
+async function resolveSourceReference(input) {
+	const outDir = require_source_archive.makeSourceArchiveTempDir();
+	try {
+		const archive = await require_source_archive.buildSourceArchive({
+			repoRoot: input.repoRoot,
+			workspace: input.workspaceDir,
+			outDir
+		});
+		if (input.previousPin) try {
+			const resolved = await require_version_manifest_resolve.resolveSlotVersion({
+				base: input.base,
+				pin: input.previousPin
+			});
+			if (resolved.source?.integrity === archive.integrity) {
+				console.log(`    ${require_theme.colors.dim(`${require_string.padRight(input.workspace, 28)} source unchanged — reusing ${archive.file}`)}`);
+				return { source: {
+					file: resolved.source.file,
+					integrity: resolved.source.integrity
+				} };
+			}
+		} catch {}
+		const upload = await require_storage_upload.uploadBundle({
+			origin: input.origin,
+			apiKey: input.apiKey,
+			account: input.account,
+			gateway: input.gateway,
+			workspace: input.workspace,
+			files: [{
+				path: archive.file,
+				bytes: new Uint8Array((0, node_fs.readFileSync)(archive.path))
+			}]
+		});
+		if (upload.storage === "memory") return { memory: true };
+		const integrity = upload.integrity[archive.file];
+		if (!integrity) throw new Error(`[publish] source archive upload for ${input.workspace}: missing server SRI for ${archive.file}`);
+		console.log(`    ${require_theme.colors.dim(`${require_string.padRight(input.workspace, 28)} source archive ${archive.file}`)}`);
+		return { source: {
+			file: archive.file,
+			integrity
+		} };
+	} finally {
+		(0, node_fs.rmSync)(outDir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/**
 * One workspace's upload leg with skip-unchanged diffing: resolve the previous
 * manifest's `files` map, hash the local dist, upload only new/changed files,
 * and return the merged per-file SRI map for the version manifest. Any failure
@@ -206,8 +282,12 @@ async function preflightPublish(input) {
 		if (!session?.credential) return fail((input.wallet ? "--wallet requires" : "the authored config sets publish.auth = \"session\", but") + " no CLI session is stored in .bos/ for this project. Run bos login to create one.");
 		if (session.credential.accountId && session.credential.accountId !== account) return fail(`The CLI session was created for ${session.credential.accountId}, but the configured account is ${account}. Gasless wallet publish relays the FastKV write under the session's NEAR account. Run bos login again under the matching account.`);
 	}
-	if (publishAuth && !input.privateKey) {
-		if (publishAuth === "custody") return fail("the authored config sets publish.auth = \"custody\", but custody publish is not implemented yet (see NEARBuilders/everything-dev#291).");
+	const useCustody = publishAuth === "custody" && !input.privateKey && !input.wallet;
+	if (useCustody) {
+		const custodyWallet = require_auth_session.readSessionHandle(configDir)?.custodyWallet;
+		if (!custodyWallet) return fail("the authored config sets publish.auth = \"custody\", but no custody wallet is stored in .bos/. Run `bos login --custody` first.");
+		if (custodyWallet.network !== network) return fail(`The custody wallet was registered on ${custodyWallet.network}, but this project publishes on ${network}. Run \`bos login --custody\` from a ${network} account.`);
+		if (custodyWallet.nearAccountId !== account) return fail(`publish.auth = "custody" publishes under the custody wallet's account, but the configured account is ${account} and the custody wallet account is ${custodyWallet.nearAccountId}. Set the authored config's account to the custody wallet account.`);
 	}
 	if (input.dryRun) return {
 		kind: "dry-run",
@@ -239,6 +319,7 @@ async function preflightPublish(input) {
 			env: node_process.default.env,
 			bosConfig,
 			session: session?.credential ?? null,
+			custodyAccount: useCustody ? session?.custodyWallet?.nearAccountId : void 0,
 			account,
 			gateway,
 			uploadsPlanned: input.build
@@ -272,6 +353,7 @@ async function preflightPublish(input) {
 			registryNamespace: require_fastkv.getRegistryNamespaceForNetwork(network, input.registry),
 			targets: require_build.selectWorkspaceTargets(input.packages, bosConfig),
 			useWallet,
+			useCustody,
 			strategy,
 			cdnOrigin: cdnDeploy.cdnOrigin,
 			storageOrigin: cdnDeploy.storageOrigin,
@@ -301,7 +383,7 @@ async function publishToFastKv(input) {
 		registryUrl: preflight.registryUrl
 	};
 	const plan = preflight.plan;
-	const { isStaging, account, gateway, network, registryUrl, registryNamespace, targets, useWallet, strategy } = plan;
+	const { isStaging, account, gateway, network, registryUrl, registryNamespace, targets, useWallet, useCustody, strategy } = plan;
 	const storageOrigin = plan.storageOrigin;
 	const storageApiKey = plan.storageApiKey;
 	const { configDir } = input;
@@ -399,6 +481,16 @@ async function publishToFastKv(input) {
 	};
 	console.log();
 	console.log(`  CDN deploy — uploading workspace dists to ${storageOrigin}...`);
+	const sourcePublish = bosConfig.publish?.sourcePublish === true;
+	const gitSha = await resolveGitSha(configDir);
+	const memoryBackendAbort = () => ({
+		status: "error",
+		registryUrl,
+		built,
+		skipped,
+		deployResults,
+		error: "The receiving instance is serving bundle storage from memory (BOS_STORAGE_* R2 credentials are not configured there) — uploaded bytes would be lost on restart. Aborting before publish."
+	});
 	for (const key of deployTargets) {
 		const ws = require_build.resolveWorkspaceTarget(key, bosConfig, runtimeConfig, configDir);
 		if (!ws) continue;
@@ -431,6 +523,34 @@ async function publishToFastKv(input) {
 		const ssrReport = require_version_manifest_deploy.readBuildReport((0, node_path.join)(ws.path, "dist", "ssr"));
 		const integrity = report ? outcome.fileIntegrity[report.entry] : void 0;
 		const ssrIntegrity = ssrReport?.entry ? outcome.fileIntegrity[`ssr/${ssrReport.entry}`] : void 0;
+		let sourceRef;
+		if (sourcePublish) {
+			if (outcome.result.storage === "memory") return memoryBackendAbort();
+			try {
+				const sourceOutcome = await resolveSourceReference({
+					origin: storageOrigin,
+					apiKey: storageApiKey,
+					account,
+					gateway,
+					workspace: key,
+					base: workspaceBase,
+					previousPin: prevPins[key],
+					repoRoot: (0, node_path.dirname)(ws.path),
+					workspaceDir: (0, node_path.basename)(ws.path)
+				});
+				if ("memory" in sourceOutcome) return memoryBackendAbort();
+				sourceRef = sourceOutcome.source;
+			} catch (error) {
+				return {
+					status: "error",
+					registryUrl,
+					built,
+					skipped,
+					deployResults,
+					error: error instanceof Error ? error.message : `[publish] source archive for ${key} failed`
+				};
+			}
+		}
 		const manifestPointer = await pinWorkspaceVersionManifest({
 			origin: storageOrigin,
 			apiKey: storageApiKey,
@@ -440,7 +560,9 @@ async function publishToFastKv(input) {
 			report,
 			ssrReport,
 			integrityMap: outcome.fileIntegrity,
-			files: outcome.fileIntegrity
+			files: outcome.fileIntegrity,
+			...sourceRef ? { source: sourceRef } : {},
+			...gitSha ? { gitSha } : {}
 		});
 		if (!manifestPointer) return {
 			status: "error",
@@ -450,14 +572,7 @@ async function publishToFastKv(input) {
 			deployResults,
 			error: `bundle upload for ${key}: version manifest missing — the dist predates hashed entry names (rebuild required; atomic-deploys hard break)`
 		};
-		if (outcome.result.storage === "memory" || manifestPointer.storage === "memory") return {
-			status: "error",
-			registryUrl,
-			built,
-			skipped,
-			deployResults,
-			error: "The receiving instance is serving bundle storage from memory (BOS_STORAGE_* R2 credentials are not configured there) — uploaded bytes would be lost on restart. Aborting before publish."
-		};
+		if (outcome.result.storage === "memory" || manifestPointer.storage === "memory") return memoryBackendAbort();
 		console.log(`    ${require_theme.colors.green(require_theme.icons.ok)} ${require_string.padRight(key, 28)} → ${urlOrigin}/bundles/${account}/${gateway}/${key}/ (${outcome.uploaded} uploaded, ${outcome.skipped} skipped, ${require_timing.formatDuration(Date.now() - startedAt)})`);
 		platformEntries.push(...require_platform_deploy.platformUrlDeployEntries({
 			origin: urlOrigin,
@@ -512,14 +627,7 @@ async function publishToFastKv(input) {
 					deployResults,
 					error: `bundle upload for ${key}-ui: version manifest missing — the dist predates hashed entry names (rebuild required; atomic-deploys hard break)`
 				};
-				if (uiOutcome.result.storage === "memory" || uiManifestPointer.storage === "memory") return {
-					status: "error",
-					registryUrl,
-					built,
-					skipped,
-					deployResults,
-					error: "The receiving instance is serving bundle storage from memory (BOS_STORAGE_* R2 credentials are not configured there) — uploaded bytes would be lost on restart. Aborting before publish."
-				};
+				if (uiOutcome.result.storage === "memory" || uiManifestPointer.storage === "memory") return memoryBackendAbort();
 				console.log(`    ${require_theme.colors.green(require_theme.icons.ok)} ${require_string.padRight(`${key}-ui`, 28)} → ${urlOrigin}/bundles/${account}/${gateway}/${key}-ui/ (${uiOutcome.uploaded} uploaded, ${uiOutcome.skipped} skipped, ${require_timing.formatDuration(Date.now() - uiStartedAt)})`);
 			} else console.log(`    ${require_theme.colors.green(require_theme.icons.ok)} ${require_string.padRight(`${key}-ui`, 28)} → ${urlOrigin}/bundles/${account}/${gateway}/${key}-ui/`);
 			platformEntries.push(...require_platform_deploy.pluginUiUrlDeployEntries({
@@ -618,7 +726,22 @@ async function publishToFastKv(input) {
 		}
 		console.log(`  Submitting transaction on ${network}...`);
 		let result;
-		if (useWallet) {
+		if (useCustody) {
+			const custodyWallet = require_auth_session.readSessionHandle(configDir)?.custodyWallet;
+			if (!custodyWallet) return {
+				status: "error",
+				registryUrl,
+				error: "the authored config sets publish.auth = \"custody\", but no custody wallet is stored in .bos/. Run `bos login --custody` first."
+			};
+			await require_custody_signer.ensureCustodyBalance(custodyWallet);
+			console.log(`  Signing via ${require_theme.colors.cyan(`OutLayer custody wallet ${custodyWallet.nearAccountId}`)}`);
+			result = await require_custody_signer.submitRegistryWriteCustody({
+				contract: registryNamespace,
+				args: registryEntries,
+				custodyWallet,
+				idempotencyKey: `bos-publish-${fingerprint}`
+			});
+		} else if (useWallet) {
 			const credential = require_auth_session.readSessionHandle(configDir)?.credential;
 			if (!credential || credential.accountId !== account) return {
 				status: "error",