[elliotBraem]

Summary

Before: three trips and a pile of env vars. After: one.

 bos login
-  → deploy key only if --key
-  → site = authored domain (localhost in this repo)
 bos deploy
-  → keychain / NEAR_PRIVATE_KEY, or --wallet (second browser approval AFTER the build)
-  → BOS_STORAGE_ORIGIN, BOS_STORAGE_AUTH_ORIGIN, ...
+bos login            # one browser approval
+  mints scoped deploy key (bundles:write, account/gateway scoped)
+  wallet adds a __fastdata_kv-scoped function-call key → .bos/session.json
+bos deploy           # no flags, no env vars, no keychain

Signing mode resolves explicitly, and the preflight plan carries one validated signing arm instead of useWallet / useCustody / optional strategy:

--private-key            → key
publish.auth             → key | session | custody
available key (env/creds) → key        (existing setups keep working)
session for config account → session   (gasless NEP-366 relay)

 plan
-  useWallet, useCustody, strategy?, custodyWallet?, credential?
+  signing: { mode: "session", credential }
+         | { mode: "custody", custodyWallet }
+         | { mode: "key", strategy }

Also:

• cdn.upload joins cdn.origin as an authored field (inherited via extends)
• Login site derives from the extends root; --site overrides (needed for a local stack)
• Custody: preflight gas-balance gate with the funding link; createDeployKey accepts the custody wallet's hex account
• A failed deploy-key mint degrades to a plain session key with a warning
• Approve page skips the key step (instead of throwing) when no wallet / wrong account is connected
• Any remaining browser approval happens right after preflight, before the build

Evidence

• Before: bos deploy --wallet opened a second browser approval after build + upload; a session with no NEAR account passed preflight then threw at submit; custody in CI failed with "No signing key available".
  After:
  • tsc --noEmit clean across all 13 workspaces plus everything-dev / every-plugin / better-near-auth; lint:effect clean (pre-push gate)
  • unit: cdn-deploy, cli-flags, auth-login, custody-signer, publish-auth-guard, publish-preflight-order all pass

it("an implicit session for the config account resolves to session signing")
  writeSession(account = "dev.everything.near")
  preflightPublish(...).plan.signing.mode  → "session"

it("a session without an accountId cannot relay")
  publish.auth = "session", session.accountId = null
  → error "no NEAR account", before any build

it("degrades a failed deploy-key mint to a plain session key")
  createDeployKey → 403 "link citynode.near first"
  approval.apiKey = plain key, approval.deployKeyWarning contains the server detail

Not run: plugins/auth integration test for custody deploy keys, and no end-to-end run against a live login/relay.

Merge Danger

Door: one-way for CLI consumers. --wallet is removed outright (breaking), and signing precedence changes.

Blast Radius: CLI users and CI

• --wallet is gone from publish, deploy, rollback, promote. Nothing in workflows or templates uses it; docs and tests updated.
• An already-available key (NEAR_PRIVATE_KEY / ~/.near-credentials) now outranks the login session, so a stale key keeps you on key signing until removed.
• bos login against this repo no longer defaults to the local dev UI; pass --site for a local stack.
• Default login credential lifetime is 90 days; deploy-key expiry (365 days) only applies with --key.
• Relayer funding is not checked in preflight, and publish.verification + session mode still needs a local key (train.ts). Custody still takes two logins plus a manual config edit.