everything-dev 2.0.0-rc.8 → 2.0.0-rc.9

package/dist/commands/import.mjs

@@ -0,0 +1,46 @@
+import { MISSING_CONFIG_MESSAGE, findConfigPath } from "../config.mjs";
+import { importWorkspace } from "../cli/import.mjs";
+import { dirname } from "node:path";
+import process from "node:process";
+import * as p from "@clack/prompts";
+
+//#region src/commands/import.ts
+function registerImport(builder) {
+	return { import: builder.import.handler(async ({ input }) => {
+		const configPath = findConfigPath();
+		if (!configPath) return {
+			status: "error",
+			workspace: input.workspace,
+			from: input.from ?? "",
+			ref: "",
+			added: [],
+			updated: [],
+			unchanged: [],
+			preservedLocal: [],
+			merged: [],
+			conflicts: [],
+			heldBackMigrations: [],
+			migrationCollisions: [],
+			warnings: [],
+			error: `${MISSING_CONFIG_MESSAGE} in current directory`
+		};
+		const options = input;
+		const projectDir = dirname(configPath);
+		const confirm = !options.yes && !options.dryRun && process.stdin.isTTY && process.stdout.isTTY ? async (info) => {
+			const collisionNote = info.migrationCollisionCount > 0 ? ` + ${info.migrationCollisionCount} unresolvable migration collision(s)` : "";
+			const heldNote = info.heldCount > 0 ? `; ${info.heldCount} migration-chain file(s) will be held back` : "";
+			const appendedNote = info.appendedCount > 0 ? `; ${info.appendedCount} upstream migration(s) will be renumbered and appended to the local chain` : "";
+			const answer = await p.confirm({
+				message: info.conflictCount > 0 || info.migrationCollisionCount > 0 ? `${info.conflictCount} conflicting file(s)${collisionNote} in ${info.workspace} — apply upstream over conflicting files (local copies backed up)${heldNote}?` : `Migration chain reconciliation in ${info.workspace}: apply upstream migrations${appendedNote}${heldNote}?`,
+				initialValue: false
+			});
+			if (p.isCancel(answer)) return false;
+			return answer === true;
+		} : void 0;
+		return importWorkspace(projectDir, options, { confirm });
+	}) };
+}
+
+//#endregion
+export { registerImport };
+//# sourceMappingURL=import.mjs.map

package/dist/commands/import.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.mjs","names":[],"sources":["../../src/commands/import.ts"],"sourcesContent":["import { dirname } from \"node:path\";\nimport process from \"node:process\";\nimport * as p from \"@clack/prompts\";\nimport type { ImportDeps } from \"../cli/import\";\nimport { importWorkspace } from \"../cli/import\";\nimport { findConfigPath, MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { ImportOptions, ImportResult } from \"../contract\";\nimport type { BosBuilder } from \"./shared\";\n\nexport function registerImport(builder: BosBuilder) {\n  return {\n    import: builder.import.handler(async ({ input }): Promise<ImportResult> => {\n      const configPath = findConfigPath();\n      if (!configPath) {\n        return {\n          status: \"error\",\n          workspace: input.workspace,\n          from: input.from ?? \"\",\n          ref: \"\",\n          added: [],\n          updated: [],\n          unchanged: [],\n          preservedLocal: [],\n          merged: [],\n          conflicts: [],\n          heldBackMigrations: [],\n          migrationCollisions: [],\n          warnings: [],\n          error: `${MISSING_CONFIG_MESSAGE} in current directory`,\n        };\n      }\n\n      const options = input as ImportOptions;\n      const projectDir = dirname(configPath);\n      const interactive =\n        !options.yes && !options.dryRun && process.stdin.isTTY && process.stdout.isTTY;\n\n      const confirm = interactive\n        ? async (info: Parameters<NonNullable<ImportDeps[\"confirm\"]>>[0]): Promise<boolean> => {\n            const collisionNote =\n              info.migrationCollisionCount > 0\n                ? ` + ${info.migrationCollisionCount} unresolvable migration collision(s)`\n                : \"\";\n            const heldNote =\n              info.heldCount > 0\n                ? `; ${info.heldCount} migration-chain file(s) will be held back`\n                : \"\";\n            const appendedNote =\n              info.appendedCount > 0\n                ? `; ${info.appendedCount} upstream migration(s) will be renumbered and appended to the local chain`\n                : \"\";\n            const answer = await p.confirm({\n              message:\n                info.conflictCount > 0 || info.migrationCollisionCount > 0\n                  ? `${info.conflictCount} conflicting file(s)${collisionNote} in ${info.workspace} — apply upstream over conflicting files (local copies backed up)${heldNote}?`\n                  : `Migration chain reconciliation in ${info.workspace}: apply upstream migrations${appendedNote}${heldNote}?`,\n              initialValue: false,\n            });\n            if (p.isCancel(answer)) return false;\n            return answer === true;\n          }\n        : undefined;\n\n      return importWorkspace(projectDir, options, { confirm });\n    }),\n  };\n}\n"],"mappings":";;;;;;;AASA,SAAgB,eAAe,SAAqB;CAClD,OAAO,EACL,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,YAAmC;EACzE,MAAM,aAAa,eAAe;EAClC,IAAI,CAAC,YACH,OAAO;GACL,QAAQ;GACR,WAAW,MAAM;GACjB,MAAM,MAAM,QAAQ;GACpB,KAAK;GACL,OAAO,CAAC;GACR,SAAS,CAAC;GACV,WAAW,CAAC;GACZ,gBAAgB,CAAC;GACjB,QAAQ,CAAC;GACT,WAAW,CAAC;GACZ,oBAAoB,CAAC;GACrB,qBAAqB,CAAC;GACtB,UAAU,CAAC;GACX,OAAO,GAAG,uBAAuB;EACnC;EAGF,MAAM,UAAU;EAChB,MAAM,aAAa,QAAQ,UAAU;EAIrC,MAAM,UAFJ,CAAC,QAAQ,OAAO,CAAC,QAAQ,UAAU,QAAQ,MAAM,SAAS,QAAQ,OAAO,QAGvE,OAAO,SAA8E;GACnF,MAAM,gBACJ,KAAK,0BAA0B,IAC3B,MAAM,KAAK,wBAAwB,wCACnC;GACN,MAAM,WACJ,KAAK,YAAY,IACb,KAAK,KAAK,UAAU,8CACpB;GACN,MAAM,eACJ,KAAK,gBAAgB,IACjB,KAAK,KAAK,cAAc,6EACxB;GACN,MAAM,SAAS,MAAM,EAAE,QAAQ;IAC7B,SACE,KAAK,gBAAgB,KAAK,KAAK,0BAA0B,IACrD,GAAG,KAAK,cAAc,sBAAsB,cAAc,MAAM,KAAK,UAAU,mEAAmE,SAAS,KAC3J,qCAAqC,KAAK,UAAU,6BAA6B,eAAe,SAAS;IAC/G,cAAc;GAChB,CAAC;GACD,IAAI,EAAE,SAAS,MAAM,GAAG,OAAO;GAC/B,OAAO,WAAW;EACpB,IACA;EAEJ,OAAO,gBAAgB,YAAY,SAAS,EAAE,QAAQ,CAAC;CACzD,CAAC,EACH;AACF"}

package/dist/commands/keys.cjs

@@ -7,6 +7,7 @@ const require_shared = require('./shared.cjs');
 const require_auth_session = require('../auth-session.cjs');
 const require_auth_login = require('../auth-login.cjs');
 const require_near_cli = require('../near-cli.cjs');
+const require_outlayer_login = require('../outlayer-login.cjs');
 let node_path = require("node:path");
 let effect = require("effect");
 let node_process = require("node:process");
@@ -92,6 +93,7 @@ function registerKeys(builder) {
 					siteUrl,
 					device: input.device,
 					account: account || void 0,
+					custody: input.custody ? { network: require_network.getNetworkIdForAccount(account) } : void 0,
 					expiresIn: input.expiresIn
 				});
 				console.log();
@@ -109,7 +111,9 @@ function registerKeys(builder) {
 					error: "Login approved but no CLI credential was created"
 				};
 				const expiresAt = new Date(Date.now() + input.expiresIn * 1e3).toISOString();
-				require_auth_session.writeSessionHandle(deps.session?.root ?? node_process.default.cwd(), {
+				const configDir = deps.session?.root ?? node_process.default.cwd();
+				const existingSession = require_auth_session.readSessionHandle(configDir);
+				require_auth_session.writeSessionHandle(configDir, {
 					version: 1,
 					credential: {
 						kind: "session",
@@ -122,16 +126,26 @@ function registerKeys(builder) {
 						expiresAt
 					},
 					publishKey: null,
-					delegateKey: null
+					delegateKey: null,
+					custodyWallet: approval.custodyWallet ?? existingSession?.custodyWallet ?? null
 				});
 				let warning = null;
-				if (account && approval.accountId && approval.accountId !== account) warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;
+				if (input.custody && !approval.custodyWallet) warning = "Custody wallet credential could not be fetched after approval. Re-run `bos login --custody` — the wallet is kept server-side.";
+				if (account && approval.accountId && approval.accountId !== account) warning = warning ? `${warning} Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.` : `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;
 				let publishKey = null;
 				if (input.key) try {
 					publishKey = await exportPublishKey(account, input.registry);
 				} catch (error) {
 					warning = `Session stored, but publish-key export failed: ${error instanceof Error ? error.message : "unknown error"}`;
 				}
+				let outlayerCli = null;
+				if (input.custody && approval.custodyWallet) {
+					outlayerCli = await require_outlayer_login.loginOutlayerCli(approval.custodyWallet);
+					if (outlayerCli.status === "error") {
+						const failure = `OutLayer CLI login failed: ${outlayerCli.detail}`;
+						warning = warning ? `${warning} ${failure}` : failure;
+					}
+				}
 				return {
 					status: "logged-in",
 					siteUrl,
@@ -139,6 +153,13 @@ function registerKeys(builder) {
 					expiresAt,
 					loginUrl: login.verificationUrl,
 					publishKey,
+					custodyWallet: approval.custodyWallet ? {
+						walletId: approval.custodyWallet.walletId,
+						nearAccountId: approval.custodyWallet.nearAccountId,
+						network: approval.custodyWallet.network,
+						handoffUrl: approval.custodyWallet.handoffUrl
+					} : null,
+					outlayerCli,
 					warning
 				};
 			} catch (error) {

package/dist/commands/keys.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"keys.cjs","names":["Context","BosDepsTag","MISSING_CONFIG_MESSAGE","getNetworkIdForAccount","getRegistryNamespaceForAccount","Effect","ensureNearCli","listPublishKeys","addFunctionCallAccessKey","colors","deleteAccessKeys","startDeviceLogin","openInBrowser","process","readSessionHandle","generateNearKeyPair","join","nearCredentialsPath","parseKey"],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys === true) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        writeSessionHandle(deps.session?.root ?? process.cwd(), {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n        });\n\n        let warning: string | null = null;\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAOC;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAUC,uCAAuB,OAAO;GAC9C,MAAM,WAAWC,8CAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAMC,cAAO,WAAWC,8BAAa;IAErC,MAAM,UAAU,MAAMC,iCAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAMC,0CAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAOC,qBAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,MAC1B,IAAI;MACF,MAAMC,kCAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAKD,qBAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAKA,qBAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAKA,qBAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAOT,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAMU,oCAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoBF,qBAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAMG,iCAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAIH,qBAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6BA,qBAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,wCAAmB,KAAK,SAAS,QAAQI,qBAAQ,IAAI,GAAG;KACtD,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;IACf,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAG9F,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAOb,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQY,qBAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAUC,uCAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,4CAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAUL,qBAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,yCAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAMJ,cAAO,WAAWC,8BAAa;CAErC,MAAM,UAAUH,uCAAuB,OAAO;CAC9C,MAAM,WAAWC,8CAA+B,SAAS,QAAQ;CACjE,MAAMG,iCAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAUQ,qCAAoB;CACpC,MAAMP,0CAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,qBAAiBQ,gBACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAYC,yCAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,WAAOC,mBAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"keys.cjs","names":["Context","BosDepsTag","MISSING_CONFIG_MESSAGE","getNetworkIdForAccount","getRegistryNamespaceForAccount","Effect","ensureNearCli","listPublishKeys","addFunctionCallAccessKey","colors","deleteAccessKeys","startDeviceLogin","openInBrowser","process","readSessionHandle","loginOutlayerCli","generateNearKeyPair","join","nearCredentialsPath","parseKey"],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport { loginOutlayerCli } from \"../outlayer-login\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys === true) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          custody: input.custody ? { network: getNetworkIdForAccount(account) } : undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        const configDir = deps.session?.root ?? process.cwd();\n        const existingSession = readSessionHandle(configDir);\n        writeSessionHandle(configDir, {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n          custodyWallet: approval.custodyWallet ?? existingSession?.custodyWallet ?? null,\n        });\n\n        let warning: string | null = null;\n        if (input.custody && !approval.custodyWallet) {\n          warning =\n            \"Custody wallet credential could not be fetched after approval. Re-run `bos login --custody` — the wallet is kept server-side.\";\n        }\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = warning\n            ? `${warning} Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`\n            : `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        let outlayerCli: LoginResult[\"outlayerCli\"] = null;\n        if (input.custody && approval.custodyWallet) {\n          outlayerCli = await loginOutlayerCli(approval.custodyWallet);\n          if (outlayerCli.status === \"error\") {\n            const failure = `OutLayer CLI login failed: ${outlayerCli.detail}`;\n            warning = warning ? `${warning} ${failure}` : failure;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          custodyWallet: approval.custodyWallet\n            ? {\n                walletId: approval.custodyWallet.walletId,\n                nearAccountId: approval.custodyWallet.nearAccountId,\n                network: approval.custodyWallet.network,\n                handoffUrl: approval.custodyWallet.handoffUrl,\n              }\n            : null,\n          outlayerCli,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA6BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAOC;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAUC,uCAAuB,OAAO;GAC9C,MAAM,WAAWC,8CAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAMC,cAAO,WAAWC,8BAAa;IAErC,MAAM,UAAU,MAAMC,iCAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAMC,0CAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAOC,qBAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,MAC1B,IAAI;MACF,MAAMC,kCAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAKD,qBAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAKA,qBAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAKA,qBAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAOT,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAMU,oCAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,SAAS,MAAM,UAAU,EAAE,SAASR,uCAAuB,OAAO,EAAE,IAAI;KACxE,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoBM,qBAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAMG,iCAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAIH,qBAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6BA,qBAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,MAAM,YAAY,KAAK,SAAS,QAAQI,qBAAQ,IAAI;IACpD,MAAM,kBAAkBC,uCAAkB,SAAS;IACnD,wCAAmB,WAAW;KAC5B,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;KACb,eAAe,SAAS,iBAAiB,iBAAiB,iBAAiB;IAC7E,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,MAAM,WAAW,CAAC,SAAS,eAC7B,UACE;IAEJ,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,UACN,GAAG,QAAQ,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ,gDAC7F,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAGxF,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,IAAI,cAA0C;IAC9C,IAAI,MAAM,WAAW,SAAS,eAAe;KAC3C,cAAc,MAAMC,wCAAiB,SAAS,aAAa;KAC3D,IAAI,YAAY,WAAW,SAAS;MAClC,MAAM,UAAU,8BAA8B,YAAY;MAC1D,UAAU,UAAU,GAAG,QAAQ,GAAG,YAAY;KAChD;IACF;IAEA,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA,eAAe,SAAS,gBACpB;MACE,UAAU,SAAS,cAAc;MACjC,eAAe,SAAS,cAAc;MACtC,SAAS,SAAS,cAAc;MAChC,YAAY,SAAS,cAAc;KACrC,IACA;KACJ;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAOf,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQY,qBAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAUC,uCAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,4CAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAUL,qBAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,yCAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAMJ,cAAO,WAAWC,8BAAa;CAErC,MAAM,UAAUH,uCAAuB,OAAO;CAC9C,MAAM,WAAWC,8CAA+B,SAAS,QAAQ;CACjE,MAAMG,iCAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAUS,qCAAoB;CACpC,MAAMR,0CAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,qBAAiBS,gBACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAYC,yCAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,WAAOC,mBAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/commands/keys.mjs

@@ -6,6 +6,7 @@ import { BosDepsTag } from "./shared.mjs";
 import { deleteSessionHandle, nearCredentialsPath, readSessionHandle, removePublishedKeyFile, writeSessionHandle } from "../auth-session.mjs";
 import { openInBrowser, startDeviceLogin } from "../auth-login.mjs";
 import { addFunctionCallAccessKey, deleteAccessKeys, ensureNearCli, generateNearKeyPair, listPublishKeys } from "../near-cli.mjs";
+import { loginOutlayerCli } from "../outlayer-login.mjs";
 import { join } from "node:path";
 import { Context, Effect } from "effect";
 import process from "node:process";
@@ -90,6 +91,7 @@ function registerKeys(builder) {
 					siteUrl,
 					device: input.device,
 					account: account || void 0,
+					custody: input.custody ? { network: getNetworkIdForAccount(account) } : void 0,
 					expiresIn: input.expiresIn
 				});
 				console.log();
@@ -107,7 +109,9 @@ function registerKeys(builder) {
 					error: "Login approved but no CLI credential was created"
 				};
 				const expiresAt = new Date(Date.now() + input.expiresIn * 1e3).toISOString();
-				writeSessionHandle(deps.session?.root ?? process.cwd(), {
+				const configDir = deps.session?.root ?? process.cwd();
+				const existingSession = readSessionHandle(configDir);
+				writeSessionHandle(configDir, {
 					version: 1,
 					credential: {
 						kind: "session",
@@ -120,16 +124,26 @@ function registerKeys(builder) {
 						expiresAt
 					},
 					publishKey: null,
-					delegateKey: null
+					delegateKey: null,
+					custodyWallet: approval.custodyWallet ?? existingSession?.custodyWallet ?? null
 				});
 				let warning = null;
-				if (account && approval.accountId && approval.accountId !== account) warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;
+				if (input.custody && !approval.custodyWallet) warning = "Custody wallet credential could not be fetched after approval. Re-run `bos login --custody` — the wallet is kept server-side.";
+				if (account && approval.accountId && approval.accountId !== account) warning = warning ? `${warning} Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.` : `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;
 				let publishKey = null;
 				if (input.key) try {
 					publishKey = await exportPublishKey(account, input.registry);
 				} catch (error) {
 					warning = `Session stored, but publish-key export failed: ${error instanceof Error ? error.message : "unknown error"}`;
 				}
+				let outlayerCli = null;
+				if (input.custody && approval.custodyWallet) {
+					outlayerCli = await loginOutlayerCli(approval.custodyWallet);
+					if (outlayerCli.status === "error") {
+						const failure = `OutLayer CLI login failed: ${outlayerCli.detail}`;
+						warning = warning ? `${warning} ${failure}` : failure;
+					}
+				}
 				return {
 					status: "logged-in",
 					siteUrl,
@@ -137,6 +151,13 @@ function registerKeys(builder) {
 					expiresAt,
 					loginUrl: login.verificationUrl,
 					publishKey,
+					custodyWallet: approval.custodyWallet ? {
+						walletId: approval.custodyWallet.walletId,
+						nearAccountId: approval.custodyWallet.nearAccountId,
+						network: approval.custodyWallet.network,
+						handoffUrl: approval.custodyWallet.handoffUrl
+					} : null,
+					outlayerCli,
 					warning
 				};
 			} catch (error) {

package/dist/commands/keys.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keys.mjs","names":[],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys === true) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        writeSessionHandle(deps.session?.root ?? process.cwd(), {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n        });\n\n        let warning: string | null = null;\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AA4BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAO;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAU,uBAAuB,OAAO;GAC9C,MAAM,WAAW,+BAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAM,OAAO,WAAW,aAAa;IAErC,MAAM,UAAU,MAAM,gBAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAM,yBAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAO,OAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,MAC1B,IAAI;MACF,MAAM,iBAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAK,OAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAK,OAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAK,OAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAM,iBAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoB,OAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAM,cAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAI,OAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6B,OAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,mBAAmB,KAAK,SAAS,QAAQ,QAAQ,IAAI,GAAG;KACtD,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;IACf,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAG9F,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQ,QAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAU,kBAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,uBAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAU,OAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,oBAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,OAAO,WAAW,aAAa;CAErC,MAAM,UAAU,uBAAuB,OAAO;CAC9C,MAAM,WAAW,+BAA+B,SAAS,QAAQ;CACjE,MAAM,gBAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAU,oBAAoB;CACpC,MAAM,yBAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,iBAAiB,KACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAY,oBAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,OAAO,SAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"keys.mjs","names":[],"sources":["../../src/commands/keys.ts"],"sourcesContent":["import { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context, Effect } from \"effect\";\nimport { type KeyPair, parseKey } from \"near-kit\";\nimport { openInBrowser, startDeviceLogin } from \"../auth-login\";\nimport {\n  deleteSessionHandle,\n  nearCredentialsPath,\n  readSessionHandle,\n  removePublishedKeyFile,\n  type SessionCredential,\n  writeSessionHandle,\n} from \"../auth-session\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport type { LoginResult } from \"../contract\";\nimport { getRegistryNamespaceForAccount } from \"../fastkv\";\nimport {\n  addFunctionCallAccessKey,\n  deleteAccessKeys,\n  ensureNearCli,\n  generateNearKeyPair,\n  listPublishKeys,\n} from \"../near-cli\";\nimport { getNetworkIdForAccount } from \"../network\";\nimport { loginOutlayerCli } from \"../outlayer-login\";\nimport type { ResolutionSession } from \"../resolution/session\";\nimport { colors } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nconst PUBLISH_FUNCTION_NAMES = [\"__fastdata_kv\"];\n\nexport function registerKeys(builder: BosBuilder) {\n  return {\n    keyPublish: builder.keyPublish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          account: \"\",\n          network: \"mainnet\" as const,\n          env: input.env,\n          contract: \"\",\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const account =\n        input.env === \"staging\"\n          ? (session.config.staging?.account ?? session.config.account)\n          : session.config.account;\n      const network = getNetworkIdForAccount(account);\n      const contract = getRegistryNamespaceForAccount(account, input.registry);\n      try {\n        await Effect.runPromise(ensureNearCli);\n\n        const oldKeys = await listPublishKeys({ account, contract, network });\n\n        const keyPair = await addFunctionCallAccessKey({\n          account,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          network,\n        });\n\n        if (oldKeys.length > 0) {\n          console.log();\n          console.log(\n            `  Found ${oldKeys.length} existing publish key${oldKeys.length > 1 ? \"s\" : \"\"}:`,\n          );\n          for (const k of oldKeys) {\n            console.log(`    ${colors.dim(k)}`);\n          }\n\n          if (input.removeOldKeys === true) {\n            try {\n              await deleteAccessKeys(account, oldKeys, network);\n              console.log(\n                `  ${colors.green(\"✓\")} Removed ${oldKeys.length} old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                }`,\n              );\n            } catch {\n              console.log(\n                `  ${colors.yellow(\"⚠\")} Failed to remove old key${\n                  oldKeys.length > 1 ? \"s\" : \"\"\n                } (new key still active)`,\n              );\n            }\n          } else {\n            console.log(`  ${colors.dim(\"Old key(s) retained.\")}`);\n          }\n        }\n\n        return {\n          status: \"published\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          publicKey: keyPair.publicKey,\n          privateKey: keyPair.privateKey,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          account,\n          network,\n          env: input.env,\n          contract,\n          allowance: input.allowance,\n          functionNames: PUBLISH_FUNCTION_NAMES,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    login: builder.login.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const staging = input.env === \"staging\";\n      const account = staging\n        ? (deps.session?.config?.staging?.account ?? deps.session?.config?.account ?? \"\")\n        : (deps.session?.config?.account ?? \"\");\n\n      try {\n        const siteUrl = resolveLoginSiteUrl(input.site, deps.session, staging);\n        const login = await startDeviceLogin({\n          siteUrl,\n          device: input.device,\n          account: account || undefined,\n          custody: input.custody ? { network: getNetworkIdForAccount(account) } : undefined,\n          expiresIn: input.expiresIn,\n        });\n\n        console.log();\n        console.log(`  One-time code: ${colors.cyan(login.userCode)}`);\n        await openInBrowser(login.verificationUrl).catch((error: unknown) => {\n          console.log(colors.yellow(`  ⚠ ${(error as Error).message}`));\n        });\n        console.log();\n        console.log(`  Waiting for approval at ${colors.dim(login.verificationUrl)}…`);\n\n        const approval = await login.waitForApproval();\n\n        if (!approval.apiKey) {\n          return {\n            status: \"error\" as const,\n            siteUrl,\n            loginUrl: login.verificationUrl,\n            error: \"Login approved but no CLI credential was created\",\n          };\n        }\n\n        const expiresAt = new Date(Date.now() + input.expiresIn * 1000).toISOString();\n        const configDir = deps.session?.root ?? process.cwd();\n        const existingSession = readSessionHandle(configDir);\n        writeSessionHandle(configDir, {\n          version: 1,\n          credential: {\n            kind: \"session\",\n            apiKey: approval.apiKey.key,\n            apiKeyId: approval.apiKey.id,\n            accountId: approval.accountId,\n            label: input.device ?? siteUrl,\n            siteUrl,\n            createdAt: new Date().toISOString(),\n            expiresAt,\n          },\n          publishKey: null,\n          delegateKey: null,\n          custodyWallet: approval.custodyWallet ?? existingSession?.custodyWallet ?? null,\n        });\n\n        let warning: string | null = null;\n        if (input.custody && !approval.custodyWallet) {\n          warning =\n            \"Custody wallet credential could not be fetched after approval. Re-run `bos login --custody` — the wallet is kept server-side.\";\n        }\n        if (account && approval.accountId && approval.accountId !== account) {\n          warning = warning\n            ? `${warning} Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`\n            : `Logged in as ${approval.accountId}, but the authored config account is ${account}. Publishes will use the configured account.`;\n        }\n\n        let publishKey: LoginResult[\"publishKey\"] = null;\n        if (input.key) {\n          try {\n            publishKey = await exportPublishKey(account, input.registry);\n          } catch (error) {\n            warning = `Session stored, but publish-key export failed: ${\n              error instanceof Error ? error.message : \"unknown error\"\n            }`;\n          }\n        }\n\n        let outlayerCli: LoginResult[\"outlayerCli\"] = null;\n        if (input.custody && approval.custodyWallet) {\n          outlayerCli = await loginOutlayerCli(approval.custodyWallet);\n          if (outlayerCli.status === \"error\") {\n            const failure = `OutLayer CLI login failed: ${outlayerCli.detail}`;\n            warning = warning ? `${warning} ${failure}` : failure;\n          }\n        }\n\n        return {\n          status: \"logged-in\" as const,\n          siteUrl,\n          accountId: approval.accountId,\n          expiresAt,\n          loginUrl: login.verificationUrl,\n          publishKey,\n          custodyWallet: approval.custodyWallet\n            ? {\n                walletId: approval.custodyWallet.walletId,\n                nearAccountId: approval.custodyWallet.nearAccountId,\n                network: approval.custodyWallet.network,\n                handoffUrl: approval.custodyWallet.handoffUrl,\n              }\n            : null,\n          outlayerCli,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          siteUrl: input.site ?? \"\",\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n\n    logout: builder.logout.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const configDir = input.configDir ?? deps.session?.root ?? process.cwd();\n\n      try {\n        const session = readSessionHandle(configDir);\n        let revokedApiKey = false;\n        let removedPublishKey = false;\n        let warning: string | null = null;\n\n        if (session?.credential) {\n          revokedApiKey = await revokeApiKey(session.credential).catch(() => false);\n          if (!revokedApiKey) {\n            warning =\n              \"Could not revoke the API key remotely — revoke it manually under Settings → API keys.\";\n          }\n        }\n\n        if (session?.publishKey) {\n          const account = session.credential?.accountId ?? deps.session?.config?.account ?? \"\";\n          removePublishedKeyFile(session.publishKey.network, account, session.publishKey.publicKey);\n          removedPublishKey = true;\n          warning = warning\n            ? `${warning} Re-run ${colors.cyan(\"bos login --key\")} to re-export a publish key.`\n            : \"Removed the exported publish key. Re-run bos login --key to re-export one.\";\n        }\n\n        deleteSessionHandle(configDir);\n        return {\n          status: \"logged-out\" as const,\n          revokedApiKey,\n          removedPublishKey,\n          warning,\n        };\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          revokedApiKey: false,\n          removedPublishKey: false,\n          error: error instanceof Error ? error.message : \"Unknown error\",\n        };\n      }\n    }),\n  };\n}\n\nfunction resolveLoginSiteUrl(\n  siteInput: string | undefined,\n  session: ResolutionSession | null,\n  staging: boolean,\n): string {\n  if (siteInput) {\n    return siteInput.replace(/\\/+$/, \"\");\n  }\n  if (staging) {\n    const stagingDomain = session?.config?.staging?.domain ?? session?.config?.domain;\n    return stagingDomain ? `https://${stagingDomain}` : (session?.runtime?.ui?.url ?? \"\");\n  }\n  const devUiUrl = session?.runtime?.ui?.url;\n  if (devUiUrl && /^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(devUiUrl)) {\n    return devUiUrl.replace(/\\/+$/, \"\");\n  }\n  const domain = session?.config?.domain;\n  return domain ? `https://${domain}` : \"\";\n}\n\nasync function exportPublishKey(\n  account: string,\n  registry: string | undefined,\n): Promise<NonNullable<LoginResult[\"publishKey\"]>> {\n  if (!account) {\n    throw new Error(\"the authored config has no account to export a publish key for\");\n  }\n\n  await Effect.runPromise(ensureNearCli);\n\n  const network = getNetworkIdForAccount(account);\n  const contract = getRegistryNamespaceForAccount(account, registry);\n  await listPublishKeys({ account, contract, network });\n\n  const keyPair = generateNearKeyPair();\n  await addFunctionCallAccessKey({\n    account,\n    contract,\n    allowance: \"1NEAR\",\n    functionNames: PUBLISH_FUNCTION_NAMES,\n    network,\n    keyPair,\n  });\n\n  const { FileKeyStore } = await import(\"near-kit/keys/file\");\n  const keyStore = new FileKeyStore(\"~/.near-credentials\", network);\n  await keyStore.add(account, parseNearPrivateKey(keyPair.privateKey));\n  try {\n    const { statSync, chmodSync } = await import(\"node:fs\");\n    const { homedir } = await import(\"node:os\");\n    const credentialPath = join(\n      homedir(),\n      \".near-credentials\",\n      network === \"mainnet\" ? \"mainnet\" : network,\n      `${account}.json`,\n    );\n    if (statSync(credentialPath).mode & 0o077) {\n      chmodSync(credentialPath, 0o600);\n    }\n  } catch {}\n\n  return {\n    publicKey: keyPair.publicKey,\n    network,\n    contract,\n    exportedTo: nearCredentialsPath(network, account),\n  };\n}\nfunction parseNearPrivateKey(privateKey: string): KeyPair {\n  return parseKey(privateKey) as KeyPair;\n}\n\nasync function revokeApiKey(credential: SessionCredential): Promise<boolean> {\n  if (!credential.apiKey || !credential.siteUrl) return false;\n  try {\n    const response = await fetch(`${credential.siteUrl}/api/auth/api-key/delete`, {\n      method: \"POST\",\n      headers: {\n        \"x-api-key\": credential.apiKey,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify({ keyId: credential.apiKeyId }),\n      signal: AbortSignal.timeout(10_000),\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,yBAAyB,CAAC,eAAe;AAE/C,SAAgB,aAAa,SAAqB;CAChD,OAAO;EACL,YAAY,QAAQ,WAAW,QAAQ,OAAO,EAAE,OAAO,cAAc;GAEnE,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK,MAAM;IACX,UAAU;IACV,WAAW,MAAM;IACjB,eAAe;IACf,OAAO;GACT;GAGF,MAAM,UACJ,MAAM,QAAQ,YACT,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,UACnD,QAAQ,OAAO;GACrB,MAAM,UAAU,uBAAuB,OAAO;GAC9C,MAAM,WAAW,+BAA+B,SAAS,MAAM,QAAQ;GACvE,IAAI;IACF,MAAM,OAAO,WAAW,aAAa;IAErC,MAAM,UAAU,MAAM,gBAAgB;KAAE;KAAS;KAAU;IAAQ,CAAC;IAEpE,MAAM,UAAU,MAAM,yBAAyB;KAC7C;KACA;KACA,WAAW,MAAM;KACjB,eAAe;KACf;IACF,CAAC;IAED,IAAI,QAAQ,SAAS,GAAG;KACtB,QAAQ,IAAI;KACZ,QAAQ,IACN,WAAW,QAAQ,OAAO,uBAAuB,QAAQ,SAAS,IAAI,MAAM,GAAG,EACjF;KACA,KAAK,MAAM,KAAK,SACd,QAAQ,IAAI,OAAO,OAAO,IAAI,CAAC,GAAG;KAGpC,IAAI,MAAM,kBAAkB,MAC1B,IAAI;MACF,MAAM,iBAAiB,SAAS,SAAS,OAAO;MAChD,QAAQ,IACN,KAAK,OAAO,MAAM,GAAG,EAAE,WAAW,QAAQ,OAAO,UAC/C,QAAQ,SAAS,IAAI,MAAM,IAE/B;KACF,QAAQ;MACN,QAAQ,IACN,KAAK,OAAO,OAAO,GAAG,EAAE,2BACtB,QAAQ,SAAS,IAAI,MAAM,GAC5B,wBACH;KACF;UAEA,QAAQ,IAAI,KAAK,OAAO,IAAI,sBAAsB,GAAG;IAEzD;IAEA,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR;KACA;KACA,KAAK,MAAM;KACX;KACA,WAAW,MAAM;KACjB,eAAe;KACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;GACzD,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,UAAU,UACX,KAAK,SAAS,QAAQ,SAAS,WAAW,KAAK,SAAS,QAAQ,WAAW,KAC3E,KAAK,SAAS,QAAQ,WAAW;GAEtC,IAAI;IACF,MAAM,UAAU,oBAAoB,MAAM,MAAM,KAAK,SAAS,OAAO;IACrE,MAAM,QAAQ,MAAM,iBAAiB;KACnC;KACA,QAAQ,MAAM;KACd,SAAS,WAAW;KACpB,SAAS,MAAM,UAAU,EAAE,SAAS,uBAAuB,OAAO,EAAE,IAAI;KACxE,WAAW,MAAM;IACnB,CAAC;IAED,QAAQ,IAAI;IACZ,QAAQ,IAAI,oBAAoB,OAAO,KAAK,MAAM,QAAQ,GAAG;IAC7D,MAAM,cAAc,MAAM,eAAe,CAAC,CAAC,OAAO,UAAmB;KACnE,QAAQ,IAAI,OAAO,OAAO,OAAQ,MAAgB,SAAS,CAAC;IAC9D,CAAC;IACD,QAAQ,IAAI;IACZ,QAAQ,IAAI,6BAA6B,OAAO,IAAI,MAAM,eAAe,EAAE,EAAE;IAE7E,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAE7C,IAAI,CAAC,SAAS,QACZ,OAAO;KACL,QAAQ;KACR;KACA,UAAU,MAAM;KAChB,OAAO;IACT;IAGF,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI,CAAC,CAAC,YAAY;IAC5E,MAAM,YAAY,KAAK,SAAS,QAAQ,QAAQ,IAAI;IACpD,MAAM,kBAAkB,kBAAkB,SAAS;IACnD,mBAAmB,WAAW;KAC5B,SAAS;KACT,YAAY;MACV,MAAM;MACN,QAAQ,SAAS,OAAO;MACxB,UAAU,SAAS,OAAO;MAC1B,WAAW,SAAS;MACpB,OAAO,MAAM,UAAU;MACvB;MACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;MAClC;KACF;KACA,YAAY;KACZ,aAAa;KACb,eAAe,SAAS,iBAAiB,iBAAiB,iBAAiB;IAC7E,CAAC;IAED,IAAI,UAAyB;IAC7B,IAAI,MAAM,WAAW,CAAC,SAAS,eAC7B,UACE;IAEJ,IAAI,WAAW,SAAS,aAAa,SAAS,cAAc,SAC1D,UAAU,UACN,GAAG,QAAQ,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ,gDAC7F,gBAAgB,SAAS,UAAU,uCAAuC,QAAQ;IAGxF,IAAI,aAAwC;IAC5C,IAAI,MAAM,KACR,IAAI;KACF,aAAa,MAAM,iBAAiB,SAAS,MAAM,QAAQ;IAC7D,SAAS,OAAO;KACd,UAAU,kDACR,iBAAiB,QAAQ,MAAM,UAAU;IAE7C;IAGF,IAAI,cAA0C;IAC9C,IAAI,MAAM,WAAW,SAAS,eAAe;KAC3C,cAAc,MAAM,iBAAiB,SAAS,aAAa;KAC3D,IAAI,YAAY,WAAW,SAAS;MAClC,MAAM,UAAU,8BAA8B,YAAY;MAC1D,UAAU,UAAU,GAAG,QAAQ,GAAG,YAAY;KAChD;IACF;IAEA,OAAO;KACL,QAAQ;KACR;KACA,WAAW,SAAS;KACpB;KACA,UAAU,MAAM;KAChB;KACA,eAAe,SAAS,gBACpB;MACE,UAAU,SAAS,cAAc;MACjC,eAAe,SAAS,cAAc;MACtC,SAAS,SAAS,cAAc;MAChC,YAAY,SAAS,cAAc;KACrC,IACA;KACJ;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,SAAS,MAAM,QAAQ;KACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAC3D,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;GAC9D,MAAM,YAAY,MAAM,aAAa,KAAK,SAAS,QAAQ,QAAQ,IAAI;GAEvE,IAAI;IACF,MAAM,UAAU,kBAAkB,SAAS;IAC3C,IAAI,gBAAgB;IACpB,IAAI,oBAAoB;IACxB,IAAI,UAAyB;IAE7B,IAAI,SAAS,YAAY;KACvB,gBAAgB,MAAM,aAAa,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAK;KACxE,IAAI,CAAC,eACH,UACE;IAEN;IAEA,IAAI,SAAS,YAAY;KACvB,MAAM,UAAU,QAAQ,YAAY,aAAa,KAAK,SAAS,QAAQ,WAAW;KAClF,uBAAuB,QAAQ,WAAW,SAAS,SAAS,QAAQ,WAAW,SAAS;KACxF,oBAAoB;KACpB,UAAU,UACN,GAAG,QAAQ,UAAU,OAAO,KAAK,iBAAiB,EAAE,gCACpD;IACN;IAEA,oBAAoB,SAAS;IAC7B,OAAO;KACL,QAAQ;KACR;KACA;KACA;IACF;GACF,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,eAAe;KACf,mBAAmB;KACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IAClD;GACF;EACF,CAAC;CACH;AACF;AAEA,SAAS,oBACP,WACA,SACA,SACQ;CACR,IAAI,WACF,OAAO,UAAU,QAAQ,QAAQ,EAAE;CAErC,IAAI,SAAS;EACX,MAAM,gBAAgB,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ;EAC3E,OAAO,gBAAgB,WAAW,kBAAmB,SAAS,SAAS,IAAI,OAAO;CACpF;CACA,MAAM,WAAW,SAAS,SAAS,IAAI;CACvC,IAAI,YAAY,uCAAuC,KAAK,QAAQ,GAClE,OAAO,SAAS,QAAQ,QAAQ,EAAE;CAEpC,MAAM,SAAS,SAAS,QAAQ;CAChC,OAAO,SAAS,WAAW,WAAW;AACxC;AAEA,eAAe,iBACb,SACA,UACiD;CACjD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,OAAO,WAAW,aAAa;CAErC,MAAM,UAAU,uBAAuB,OAAO;CAC9C,MAAM,WAAW,+BAA+B,SAAS,QAAQ;CACjE,MAAM,gBAAgB;EAAE;EAAS;EAAU;CAAQ,CAAC;CAEpD,MAAM,UAAU,oBAAoB;CACpC,MAAM,yBAAyB;EAC7B;EACA;EACA,WAAW;EACX,eAAe;EACf;EACA;CACF,CAAC;CAED,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,IADe,aAAa,uBAAuB,OAC5C,CAAC,CAAC,IAAI,SAAS,oBAAoB,QAAQ,UAAU,CAAC;CACnE,IAAI;EACF,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,iBAAiB,KACrB,QAAQ,GACR,qBACA,YAAY,YAAY,YAAY,SACpC,GAAG,QAAQ,MACb;EACA,IAAI,SAAS,cAAc,CAAC,CAAC,OAAO,IAClC,UAAU,gBAAgB,GAAK;CAEnC,QAAQ,CAAC;CAET,OAAO;EACL,WAAW,QAAQ;EACnB;EACA;EACA,YAAY,oBAAoB,SAAS,OAAO;CAClD;AACF;AACA,SAAS,oBAAoB,YAA6B;CACxD,OAAO,SAAS,UAAU;AAC5B;AAEA,eAAe,aAAa,YAAiD;CAC3E,IAAI,CAAC,WAAW,UAAU,CAAC,WAAW,SAAS,OAAO;CACtD,IAAI;EAUF,QAAO,MATgB,MAAM,GAAG,WAAW,QAAQ,2BAA2B;GAC5E,QAAQ;GACR,SAAS;IACP,aAAa,WAAW;IACxB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,CAAC;GACnD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC,EACc,CAAC;CAClB,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/config.d.cts

@@ -152,6 +152,7 @@ declare const buildRuntimeConfigEffect: (config: {
   repository?: string | undefined;
   publish?: {
     auth?: "custody" | "key" | "session" | undefined;
+    sourcePublish?: boolean | undefined;
   } | undefined;
   ci?: {
     image?: string | undefined;

package/dist/config.d.mts

@@ -152,6 +152,7 @@ declare const buildRuntimeConfigEffect: (config: {
   repository?: string | undefined;
   publish?: {
     auth?: "custody" | "key" | "session" | undefined;
+    sourcePublish?: boolean | undefined;
   } | undefined;
   ci?: {
     image?: string | undefined;

package/dist/contract.cjs

@@ -297,6 +297,7 @@ const OverrideSectionSchema = zod.enum([
 const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 7776e3;
 const LoginOptionsSchema = zod.object({
 	key: zod.boolean().default(false),
+	custody: zod.boolean().default(false),
 	site: zod.string().optional(),
 	expiresIn: zod.number().int().positive().default(DEFAULT_LOGIN_EXPIRES_IN_SECONDS),
 	device: zod.string().optional(),
@@ -315,6 +316,21 @@ const LoginResultSchema = zod.object({
 		contract: zod.string(),
 		exportedTo: zod.string()
 	}).nullish(),
+	custodyWallet: zod.object({
+		walletId: zod.string(),
+		nearAccountId: zod.string(),
+		network: zod.enum(["mainnet", "testnet"]),
+		handoffUrl: zod.string().nullish()
+	}).nullish(),
+	outlayerCli: zod.object({
+		status: zod.enum([
+			"linked",
+			"cli-missing",
+			"error"
+		]),
+		network: zod.enum(["mainnet", "testnet"]),
+		detail: zod.string().nullish()
+	}).nullish(),
 	warning: zod.string().nullish(),
 	error: zod.string().optional()
 });
@@ -382,6 +398,68 @@ const SyncResultSchema = zod.object({
 	backupDir: zod.string().optional(),
 	error: zod.string().optional()
 });
+const ImportOptionsSchema = zod.object({
+	workspace: zod.string(),
+	/** omitted → resolve the upstream from the authored config's extends chain */
+	from: zod.string().optional(),
+	yes: zod.boolean().default(false),
+	dryRun: zod.boolean().default(false),
+	noInstall: zod.boolean().default(false),
+	json: zod.boolean().default(false)
+});
+const ImportRouteDeltaSchema = zod.object({
+	oursOnly: zod.array(zod.string()),
+	theirsOnly: zod.array(zod.string())
+});
+const ImportMigrationCollisionSchema = zod.object({
+	kind: zod.literal("tag-mismatch"),
+	idx: zod.number(),
+	localTag: zod.string().optional(),
+	upstreamTag: zod.string().optional(),
+	message: zod.string()
+});
+const ImportMigrationAppendSchema = zod.object({
+	idx: zod.number(),
+	fromTag: zod.string(),
+	toTag: zod.string()
+});
+const ImportMigrationReconciliationSchema = zod.object({
+	/** local journal tags kept verbatim (already applied, never renumbered) */
+	kept: zod.array(zod.string()),
+	/** upstream migrations renumbered and appended after the local tail */
+	appended: zod.array(ImportMigrationAppendSchema),
+	/** upstream migrations matched to local entries by SQL content hash */
+	contentMatched: zod.array(zod.string())
+});
+const ImportResultSchema = zod.object({
+	status: zod.enum([
+		"imported",
+		"dry-run",
+		"conflicts",
+		"error"
+	]),
+	workspace: zod.string(),
+	from: zod.string(),
+	ref: zod.string(),
+	resolvedSha: zod.string().optional(),
+	/** the dereferenced upstream repository when the source was chain-resolved */
+	sourceRepository: zod.string().optional(),
+	/** resolution notes (e.g. HEAD fallback when no git sha is pinned) */
+	warnings: zod.array(zod.string()).default([]),
+	added: zod.array(zod.string()),
+	updated: zod.array(zod.string()),
+	unchanged: zod.array(zod.string()).default([]),
+	preservedLocal: zod.array(zod.string()).default([]),
+	merged: zod.array(zod.string()).default([]),
+	conflicts: zod.array(zod.string()).default([]),
+	heldBackMigrations: zod.array(zod.string()).default([]),
+	routeDelta: ImportRouteDeltaSchema.optional(),
+	migrationCollisions: zod.array(ImportMigrationCollisionSchema).default([]),
+	migrationReconciliation: ImportMigrationReconciliationSchema.optional(),
+	backupDir: zod.string().optional(),
+	reportPath: zod.string().optional(),
+	error: zod.string().optional()
+});
 const UpgradeOptionsSchema = zod.object({
 	dryRun: zod.boolean().default(false),
 	noInstall: zod.boolean().default(false),
@@ -620,6 +698,7 @@ const commandOptionSchemas = {
 	logout: LogoutOptionsSchema,
 	init: InitOptionsSchema,
 	sync: SyncOptionsSchema,
+	import: ImportOptionsSchema,
 	upgrade: UpgradeOptionsSchema,
 	typecheck: TypecheckOptionsSchema,
 	mfCheck: MfCheckOptionsSchema,
@@ -703,6 +782,10 @@ const bosContract = _orpc_contract.oc.router({
 		method: "POST",
 		path: "/sync"
 	}).input(SyncOptionsSchema).output(SyncResultSchema),
+	import: _orpc_contract.oc.route({
+		method: "POST",
+		path: "/import"
+	}).input(ImportOptionsSchema).output(ImportResultSchema),
 	upgrade: _orpc_contract.oc.route({
 		method: "POST",
 		path: "/upgrade"
@@ -770,6 +853,12 @@ exports.DeployResultSchema = DeployResultSchema;
 exports.DeployedVersionStatusSchema = DeployedVersionStatusSchema;
 exports.DevOptionsSchema = DevOptionsSchema;
 exports.DevResultSchema = DevResultSchema;
+exports.ImportMigrationAppendSchema = ImportMigrationAppendSchema;
+exports.ImportMigrationCollisionSchema = ImportMigrationCollisionSchema;
+exports.ImportMigrationReconciliationSchema = ImportMigrationReconciliationSchema;
+exports.ImportOptionsSchema = ImportOptionsSchema;
+exports.ImportResultSchema = ImportResultSchema;
+exports.ImportRouteDeltaSchema = ImportRouteDeltaSchema;
 exports.InfraExportOptionsSchema = InfraExportOptionsSchema;
 exports.InfraExportResultSchema = InfraExportResultSchema;
 exports.InfraExportServiceSchema = InfraExportServiceSchema;