@mysten-incubation/devstack 0.0.0

package/dist/plugins/account/keypair.mjs

@@ -0,0 +1,99 @@
+import { accountAcquireError } from "./errors.mjs";
+import { Effect } from "effect";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+//#region src/plugins/account/keypair.ts
+/** Normalize the SDK's mixed-case scheme to the lowercased wire form.
+*  Unknown schemes surface as a typed acquisition error (distilled
+*  doc: "Unsupported signature scheme (multisig / zklogin / passkey)
+*  — currently a raw throw; should be promoted to the typed-error
+*  channel"). */
+const normalizeScheme = (raw, accountName, variant) => {
+	const lower = raw.toLowerCase();
+	if (lower === "ed25519" || lower === "secp256k1" || lower === "secp256r1") return Effect.succeed(lower);
+	return Effect.fail(accountAcquireError({
+		phase: "unsupported-scheme",
+		accountName,
+		variant,
+		message: `Account '${accountName}': unsupported signature scheme '${raw}'. devstack supports ed25519, secp256k1, secp256r1.`,
+		hint: "Multisig, zklogin, and passkey schemes are not yet supported via the Account plugin — bring your own Signer via {kind:\"signer\"}."
+	}));
+};
+/** Generate a fresh Ed25519 keypair. The default for the
+*  `ephemeral` variant.
+*
+*  Architecture-distilled invariant: schemes other than Ed25519
+*  must be loaded via keystore/env/inline; we never generate
+*  Secp256* keys from scratch. */
+const generateEd25519Keypair = (accountName) => Effect.try({
+	try: () => {
+		return resolvedKeypairFromEd25519(Ed25519Keypair.generate());
+	},
+	catch: (cause) => accountAcquireError({
+		phase: "generate-keypair",
+		accountName,
+		variant: "ephemeral",
+		message: `Account '${accountName}': Ed25519Keypair.generate() threw.`,
+		cause
+	})
+});
+/** Decode a bech32 `suiprivkey1...` string into a resolved keypair.
+*  Used by the inline / env / keystore variants. */
+const decodeBech32Secret = (bech32, accountName, variant) => Effect.gen(function* () {
+	const parsed = yield* Effect.try({
+		try: () => decodeSuiPrivateKey(bech32),
+		catch: (cause) => accountAcquireError({
+			phase: "decode-inline",
+			accountName,
+			variant,
+			message: `Account '${accountName}': decodeSuiPrivateKey() rejected the supplied bech32 secret.`,
+			cause
+		})
+	});
+	const scheme = yield* normalizeScheme(parsed.scheme, accountName, variant);
+	if (scheme !== "ed25519") return yield* Effect.fail(accountAcquireError({
+		phase: "unsupported-scheme",
+		accountName,
+		variant,
+		message: `Account '${accountName}': scheme '${scheme}' is not yet wired for the ${variant} variant.`,
+		hint: "Wire the matching @mysten/sui/keypairs/<scheme> import next to the Ed25519 path."
+	}));
+	return yield* Effect.try({
+		try: () => {
+			return resolvedKeypairFromEd25519(Ed25519Keypair.fromSecretKey(parsed.secretKey));
+		},
+		catch: (cause) => accountAcquireError({
+			phase: "decode-inline",
+			accountName,
+			variant,
+			message: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the decoded secret.`,
+			cause
+		})
+	});
+});
+/** Build a `ResolvedKeypair` view from a raw Ed25519 secret-key
+*  byte array. Used by the inline-bytes path (`variants/inline.ts`
+*  Uint8Array branch). */
+const resolvedKeypairFromEd25519Bytes = (secretKey, accountName, variant) => Effect.try({
+	try: () => {
+		return resolvedKeypairFromEd25519(Ed25519Keypair.fromSecretKey(secretKey));
+	},
+	catch: (cause) => accountAcquireError({
+		phase: "decode-inline",
+		accountName,
+		variant,
+		message: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the supplied raw bytes.`,
+		cause
+	})
+});
+const resolvedKeypairFromEd25519 = (kp) => ({
+	address: kp.toSuiAddress(),
+	scheme: "ed25519",
+	publicKey: kp.getPublicKey().toRawBytes(),
+	signer: kp,
+	bech32Secret: kp.getSecretKey()
+});
+//#endregion
+export { decodeBech32Secret, generateEd25519Keypair, normalizeScheme, resolvedKeypairFromEd25519Bytes };
+
+//# sourceMappingURL=keypair.mjs.map

package/dist/plugins/account/keypair.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.mjs","names":[],"sources":["../../../src/plugins/account/keypair.ts"],"sourcesContent":["// Account plugin — keypair generation + scheme normalization helpers.\n//\n// Distilled-doc finding (12-account.md \"Scheme normalization\"\n// invariant): scheme surfaced to consumers MUST be lowercased at the\n// account boundary. Mixed-case from the SDK leaks into manifest\n// serialization and on-chain Move type matching if not converted. We\n// pin the canonical lowercased union at this module's boundary and\n// every variant resolver dumps through `normalizeScheme` before\n// producing the resolved value.\n//\n// Distilled-doc opportunity (\"Co-locate the canonical Account-value\n// Schema with the canonical type\"): the canonical signature scheme\n// union lives here, NOT next to the factory, so future Schema sits\n// alongside the type.\n\nimport { Effect } from 'effect';\n\nimport { decodeSuiPrivateKey, encodeSuiPrivateKey } from '@mysten/sui/cryptography';\nimport { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';\n\nimport {\n\taccountAcquireError,\n\ttype AccountAcquireError,\n\ttype AccountVariantKind,\n} from './errors.ts';\n\n/** Lowercased signature scheme — the canonical wire form. The SDK\n *  occasionally hands us `'ED25519'` / `'Secp256k1'`; the boundary\n *  conversion lives in `normalizeScheme`. */\nexport type SignatureScheme = 'ed25519' | 'secp256k1' | 'secp256r1';\n\n/** Resolved keypair shape — the variant resolvers all funnel into\n *  this so the funding + register passes are variant-agnostic.\n *\n *  Note: impersonation accounts do NOT produce a `Keypair`; they\n *  produce a `SyntheticImpersonationSigner` (see\n *  `variants/impersonate.ts`). The discriminator lives on the\n *  resolved `AccountValue` (architecture: distilled doc opportunity\n *  \"Tighten the resolved-account type\"). */\nexport interface ResolvedKeypair {\n\treadonly address: string;\n\treadonly scheme: SignatureScheme;\n\treadonly publicKey: Uint8Array;\n\t/** Opaque signer handle — typed loosely here because the four\n\t *  real variants (ed25519/secp256k1/secp256r1 + bring-your-own\n\t *  Signer) share no narrow TS type beyond `Signer`. The wallet /\n\t *  sign-and-execute capability narrows downstream. */\n\treadonly signer: unknown;\n\t/** Bech32-encoded secret. Only present for ephemeral / inline /\n\t *  env / keystore variants — `null` for `signer` (we never ask\n\t *  for it) and `impersonate` (no secret exists). */\n\treadonly bech32Secret: string | null;\n}\n\n/** Normalize the SDK's mixed-case scheme to the lowercased wire form.\n *  Unknown schemes surface as a typed acquisition error (distilled\n *  doc: \"Unsupported signature scheme (multisig / zklogin / passkey)\n *  — currently a raw throw; should be promoted to the typed-error\n *  channel\"). */\nexport const normalizeScheme = (\n\traw: string,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<SignatureScheme, AccountAcquireError> => {\n\tconst lower = raw.toLowerCase();\n\tif (lower === 'ed25519' || lower === 'secp256k1' || lower === 'secp256r1') {\n\t\treturn Effect.succeed(lower);\n\t}\n\treturn Effect.fail(\n\t\taccountAcquireError({\n\t\t\tphase: 'unsupported-scheme',\n\t\t\taccountName,\n\t\t\tvariant,\n\t\t\tmessage: `Account '${accountName}': unsupported signature scheme '${raw}'. devstack supports ed25519, secp256k1, secp256r1.`,\n\t\t\thint: 'Multisig, zklogin, and passkey schemes are not yet supported via the Account plugin — bring your own Signer via {kind:\"signer\"}.',\n\t\t}),\n\t);\n};\n\n/** Generate a fresh Ed25519 keypair. The default for the\n *  `ephemeral` variant.\n *\n *  Architecture-distilled invariant: schemes other than Ed25519\n *  must be loaded via keystore/env/inline; we never generate\n *  Secp256* keys from scratch. */\nexport const generateEd25519Keypair = (\n\taccountName: string,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst kp = Ed25519Keypair.generate();\n\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t},\n\t\tcatch: (cause): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'generate-keypair',\n\t\t\t\taccountName,\n\t\t\t\tvariant: 'ephemeral',\n\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.generate() threw.`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n/** Decode a bech32 `suiprivkey1...` string into a resolved keypair.\n *  Used by the inline / env / keystore variants. */\nexport const decodeBech32Secret = (\n\tbech32: string,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst parsed = yield* Effect.try({\n\t\t\ttry: () => decodeSuiPrivateKey(bech32),\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'decode-inline',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': decodeSuiPrivateKey() rejected the supplied bech32 secret.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tconst scheme = yield* normalizeScheme(parsed.scheme, accountName, variant);\n\t\tif (scheme !== 'ed25519') {\n\t\t\t// Architecture-distilled: today we only construct Ed25519 here.\n\t\t\t// Secp256k1 / Secp256r1 paths land when the SDK's per-scheme\n\t\t\t// Keypair classes are wired in; the typed-error channel keeps\n\t\t\t// the failure actionable until then.\n\t\t\treturn yield* Effect.fail(\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'unsupported-scheme',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': scheme '${scheme}' is not yet wired for the ${variant} variant.`,\n\t\t\t\t\thint: 'Wire the matching @mysten/sui/keypairs/<scheme> import next to the Ed25519 path.',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn yield* Effect.try({\n\t\t\ttry: () => {\n\t\t\t\tconst kp = Ed25519Keypair.fromSecretKey(parsed.secretKey);\n\t\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t\t},\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'decode-inline',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the decoded secret.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t});\n\n/** Build a `ResolvedKeypair` view from a raw Ed25519 secret-key\n *  byte array. Used by the inline-bytes path (`variants/inline.ts`\n *  Uint8Array branch). */\nexport const resolvedKeypairFromEd25519Bytes = (\n\tsecretKey: Uint8Array,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst kp = Ed25519Keypair.fromSecretKey(secretKey);\n\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t},\n\t\tcatch: (cause): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'decode-inline',\n\t\t\t\taccountName,\n\t\t\t\tvariant,\n\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the supplied raw bytes.`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n/** Encode a 32-byte secret key as a bech32 `suiprivkey1...` string\n *  for the canonical wire form. Re-exported because the\n *  `variants/inline.ts` Uint8Array branch needs it. */\nexport const encodeEd25519Bech32 = (bytes: Uint8Array): string =>\n\tencodeSuiPrivateKey(bytes, 'ED25519');\n\nconst resolvedKeypairFromEd25519 = (kp: Ed25519Keypair): ResolvedKeypair => ({\n\taddress: kp.toSuiAddress(),\n\tscheme: 'ed25519',\n\tpublicKey: kp.getPublicKey().toRawBytes(),\n\tsigner: kp,\n\tbech32Secret: kp.getSecretKey(),\n});\n"],"mappings":";;;;;;;;;;AA2DA,MAAa,mBACZ,KACA,aACA,YACyD;CACzD,MAAM,QAAQ,IAAI,aAAa;AAC/B,KAAI,UAAU,aAAa,UAAU,eAAe,UAAU,YAC7D,QAAO,OAAO,QAAQ,MAAM;AAE7B,QAAO,OAAO,KACb,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY,mCAAmC,IAAI;EACxE,MAAM;EACN,CAAC,CACF;;;;;;;;AASF,MAAa,0BACZ,gBAEA,OAAO,IAAI;CACV,WAAW;AAEV,SAAO,2BADI,eAAe,UACU,CAAC;;CAEtC,QAAQ,UACP,oBAAoB;EACnB,OAAO;EACP;EACA,SAAS;EACT,SAAS,YAAY,YAAY;EACjC;EACA,CAAC;CACH,CAAC;;;AAIH,MAAa,sBACZ,QACA,aACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,OAAO,IAAI;EAChC,WAAW,oBAAoB,OAAO;EACtC,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC;GACA,CAAC;EACH,CAAC;CACF,MAAM,SAAS,OAAO,gBAAgB,OAAO,QAAQ,aAAa,QAAQ;AAC1E,KAAI,WAAW,UAKd,QAAO,OAAO,OAAO,KACpB,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY,aAAa,OAAO,6BAA6B,QAAQ;EAC1F,MAAM;EACN,CAAC,CACF;AAEF,QAAO,OAAO,OAAO,IAAI;EACxB,WAAW;AAEV,UAAO,2BADI,eAAe,cAAc,OAAO,UACX,CAAC;;EAEtC,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC;GACA,CAAC;EACH,CAAC;EACD;;;;AAKH,MAAa,mCACZ,WACA,aACA,YAEA,OAAO,IAAI;CACV,WAAW;AAEV,SAAO,2BADI,eAAe,cAAc,UACJ,CAAC;;CAEtC,QAAQ,UACP,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY;EACjC;EACA,CAAC;CACH,CAAC;AAQH,MAAM,8BAA8B,QAAyC;CAC5E,SAAS,GAAG,cAAc;CAC1B,QAAQ;CACR,WAAW,GAAG,cAAc,CAAC,YAAY;CACzC,QAAQ;CACR,cAAc,GAAG,cAAc;CAC/B"}

package/dist/plugins/account/lease.mjs

@@ -0,0 +1,21 @@
+import { leaseKey } from "../../substrate/runtime/lease-broker/service.mjs";
+import { Effect } from "effect";
+//#region src/plugins/account/lease.ts
+/** Run `effect` while holding the per-address lease. Scope-bound
+*  release: a fresh scope is opened per call, the broker installs
+*  an uninterruptible finalizer, and the lease drops the moment
+*  the inner Effect returns. Same-address concurrent callers
+*  serialize via the broker's FIFO queue.
+*
+*  Non-reentrant: nested calls for the SAME (broker, accountName,
+*  address) tuple deadlock. The broker has no concept of
+*  re-entrancy by design — per-address sequence-number semantics
+*  require at-most-one in-flight. */
+const withAddressLease = (broker, accountName, address, effect) => Effect.scoped(Effect.gen(function* () {
+	yield* broker.acquire(leaseKey(`account:${address}`), accountName);
+	return yield* effect;
+}));
+//#endregion
+export { withAddressLease };
+
+//# sourceMappingURL=lease.mjs.map

package/dist/plugins/account/lease.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.mjs","names":[],"sources":["../../../src/plugins/account/lease.ts"],"sourcesContent":["// Account plugin — per-address lease helper.\n//\n// Thin wrapper over `LeaseBrokerService.acquire(...)` that opens a\n// fresh scope per call and keys the lease as `account:<address>`.\n// Both the funding pass (`funding.ts`) and the resolved-value\n// sign/execute closures (`service.ts`) share this helper so the\n// per-key encoding lives in exactly one place.\n//\n// Substrate name-blindness: the broker treats the key as opaque —\n// the `account:` prefix is a plugin convention so the broker's\n// `holders()` snapshot is readable in the renderer / debug logs.\n\nimport { Effect } from 'effect';\n\nimport { leaseKey, type LeaseBroker } from '../../substrate/runtime/lease-broker/index.ts';\n\n/** Run `effect` while holding the per-address lease. Scope-bound\n *  release: a fresh scope is opened per call, the broker installs\n *  an uninterruptible finalizer, and the lease drops the moment\n *  the inner Effect returns. Same-address concurrent callers\n *  serialize via the broker's FIFO queue.\n *\n *  Non-reentrant: nested calls for the SAME (broker, accountName,\n *  address) tuple deadlock. The broker has no concept of\n *  re-entrancy by design — per-address sequence-number semantics\n *  require at-most-one in-flight. */\nexport const withAddressLease = <A, E, R>(\n\tbroker: LeaseBroker,\n\taccountName: string,\n\taddress: string,\n\teffect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, E, R> =>\n\tEffect.scoped(\n\t\tEffect.gen(function* () {\n\t\t\tyield* broker.acquire(leaseKey(`account:${address}`), accountName);\n\t\t\treturn yield* effect;\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;;AA0BA,MAAa,oBACZ,QACA,aACA,SACA,WAEA,OAAO,OACN,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,QAAQ,SAAS,WAAW,UAAU,EAAE,YAAY;AAClE,QAAO,OAAO;EACb,CACF"}

package/dist/plugins/account/registry.d.mts

@@ -0,0 +1,33 @@
+//#region src/plugins/account/registry.d.ts
+/** The strategy value published under `account:<name>`. Carries the
+ *  load-bearing identity columns only — signing closures stay on
+ *  the Account tag's resolved value because their lifetime is
+ *  scope-bounded.
+ *
+ *  Architecture-distilled (12-account.md "Tighten the resolved-
+ *  account type"): the `source` discriminator is mandatory so
+ *  consumers can branch on impersonation without a `publicKey`
+ *  nullcheck (impersonation accounts have a zero-buffer publicKey
+ *  — a type-level lie). */
+interface AccountRegistryEntry {
+  readonly name: string;
+  readonly address: string;
+  readonly scheme: 'ed25519' | 'secp256k1' | 'secp256r1';
+  readonly source: 'real' | 'impersonate';
+  readonly funding: AccountRegistryFunding;
+}
+interface AccountRegistryFunding {
+  readonly status: 'funded' | 'skipped' | 'unknown';
+  readonly balanceMist: string | null;
+  readonly requestedMist: string | null;
+  readonly entries?: ReadonlyArray<AccountRegistryFundingEntry>;
+}
+interface AccountRegistryFundingEntry {
+  readonly coin: string;
+  readonly fullCoinType: string;
+  readonly amount: string;
+  readonly status: 'funded' | 'skipped';
+}
+//#endregion
+export { AccountRegistryEntry, AccountRegistryFunding };
+//# sourceMappingURL=registry.d.mts.map

package/dist/plugins/account/registry.mjs

@@ -0,0 +1,36 @@
+//#region src/plugins/account/registry.ts
+const accountRegistryKey = (name) => `account:${name}`;
+/** Construct the strategy-contributor decl Account emits for one
+*  acquired identity. Auto-mounted: the registry's role is
+*  infrastructure; the user never types it explicitly. */
+const makeAccountRegistryContribution = (entry) => ({
+	kind: "strategy-contributor",
+	capabilityKey: accountRegistryKey(entry.name),
+	strategy: entry,
+	autoMounted: true
+});
+const makeAccountProjectionContribution = (entry) => {
+	const updatedAt = Date.now();
+	return {
+		kind: "projection",
+		event: {
+			tag: "account.updated",
+			account: {
+				key: `account/${entry.name}`,
+				rowKey: null,
+				name: entry.name,
+				address: entry.address,
+				scheme: entry.scheme,
+				source: entry.source,
+				funding: entry.funding,
+				walletVisible: false,
+				updatedAt
+			},
+			at: updatedAt
+		}
+	};
+};
+//#endregion
+export { accountRegistryKey, makeAccountProjectionContribution, makeAccountRegistryContribution };
+
+//# sourceMappingURL=registry.mjs.map

package/dist/plugins/account/registry.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.mjs","names":[],"sources":["../../../src/plugins/account/registry.ts"],"sourcesContent":["// Account plugin — per-stack registry contribution.\n//\n// Architecture (12-account.md \"Outputs / capabilities provided\"):\n// Account publishes `{name, address}` to a per-stack account\n// registry. Downstream consumers (Wallet, Codegen, the manifest\n// emitter, Coin's deepbook market maker) look accounts up by name.\n//\n// The architecture's `strategy-contributor` capability covers this\n// shape — Account contributes one entry per acquired account under\n// the capability key `account:<name>`. The strategy value is the\n// resolved-account view (sans signing closures, which stay scoped\n// to the acquire body's lifetime; consumers ask the Account tag\n// directly when they need to sign).\n//\n// Distilled-doc opportunity: today's `publishAccount(...)` writes\n// into an engine-singleton registry. The redesign moves it onto the\n// capability-decl surface so the substrate orchestrates dedup-by-\n// name and last-write-wins without an engine import.\n\nimport type { ProjectionDecl } from '../../contracts/projection.ts';\nimport type { StrategyContributorDecl } from '../../contracts/strategy-contributor.ts';\n\n/** Capability key for the per-name account registry. The literal\n *  form (`account:<name>`) lets downstream consumers (Coin, Wallet,\n *  the manifest emitter) `StrategyFor<Caps, \"account:alice\">` to\n *  recover the registered address at the type level. */\nexport type AccountRegistryKey<Name extends string> = `account:${Name}`;\n\nexport const accountRegistryKey = <Name extends string>(name: Name): AccountRegistryKey<Name> =>\n\t`account:${name}` as AccountRegistryKey<Name>;\n\n/** The strategy value published under `account:<name>`. Carries the\n *  load-bearing identity columns only — signing closures stay on\n *  the Account tag's resolved value because their lifetime is\n *  scope-bounded.\n *\n *  Architecture-distilled (12-account.md \"Tighten the resolved-\n *  account type\"): the `source` discriminator is mandatory so\n *  consumers can branch on impersonation without a `publicKey`\n *  nullcheck (impersonation accounts have a zero-buffer publicKey\n *  — a type-level lie). */\nexport interface AccountRegistryEntry {\n\treadonly name: string;\n\treadonly address: string;\n\treadonly scheme: 'ed25519' | 'secp256k1' | 'secp256r1';\n\treadonly source: 'real' | 'impersonate';\n\treadonly funding: AccountRegistryFunding;\n}\n\nexport interface AccountRegistryFunding {\n\treadonly status: 'funded' | 'skipped' | 'unknown';\n\treadonly balanceMist: string | null;\n\treadonly requestedMist: string | null;\n\treadonly entries?: ReadonlyArray<AccountRegistryFundingEntry>;\n}\n\nexport interface AccountRegistryFundingEntry {\n\treadonly coin: string;\n\treadonly fullCoinType: string;\n\treadonly amount: string;\n\treadonly status: 'funded' | 'skipped';\n}\n\n/** Construct the strategy-contributor decl Account emits for one\n *  acquired identity. Auto-mounted: the registry's role is\n *  infrastructure; the user never types it explicitly. */\nexport const makeAccountRegistryContribution = <Name extends string>(\n\tentry: AccountRegistryEntry & { readonly name: Name },\n): StrategyContributorDecl<AccountRegistryKey<Name>, AccountRegistryEntry> => ({\n\tkind: 'strategy-contributor',\n\tcapabilityKey: accountRegistryKey(entry.name),\n\tstrategy: entry,\n\tautoMounted: true,\n});\n\nexport const makeAccountProjectionContribution = <Name extends string>(\n\tentry: AccountRegistryEntry & { readonly name: Name },\n): ProjectionDecl => {\n\tconst updatedAt = Date.now();\n\treturn {\n\t\tkind: 'projection',\n\t\tevent: {\n\t\t\ttag: 'account.updated',\n\t\t\taccount: {\n\t\t\t\tkey: `account/${entry.name}` as `account/${string}`,\n\t\t\t\trowKey: null,\n\t\t\t\tname: entry.name,\n\t\t\t\taddress: entry.address,\n\t\t\t\tscheme: entry.scheme,\n\t\t\t\tsource: entry.source,\n\t\t\t\tfunding: entry.funding,\n\t\t\t\twalletVisible: false,\n\t\t\t\tupdatedAt,\n\t\t\t},\n\t\t\tat: updatedAt,\n\t\t},\n\t};\n};\n"],"mappings":";AA4BA,MAAa,sBAA2C,SACvD,WAAW;;;;AAqCZ,MAAa,mCACZ,WAC8E;CAC9E,MAAM;CACN,eAAe,mBAAmB,MAAM,KAAK;CAC7C,UAAU;CACV,aAAa;CACb;AAED,MAAa,qCACZ,UACoB;CACpB,MAAM,YAAY,KAAK,KAAK;AAC5B,QAAO;EACN,MAAM;EACN,OAAO;GACN,KAAK;GACL,SAAS;IACR,KAAK,WAAW,MAAM;IACtB,QAAQ;IACR,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,eAAe;IACf;IACA;GACD,IAAI;GACJ;EACD"}

package/dist/plugins/account/service.d.mts

@@ -0,0 +1,104 @@
+import { AccountSignError } from "./errors.mjs";
+import { TransactionSignerScope } from "../../substrate/runtime/sui-execute/index.mjs";
+import { AccountFunding, AccountFundingResult } from "./funding.mjs";
+import { Effect } from "effect";
+
+//#region src/plugins/account/service.d.ts
+/** Account variant discriminated union. The user-facing factory
+ *  takes one of these shapes (or omits `opts` entirely for the
+ *  default ephemeral form). */
+type AccountOptions<Funding extends AccountFunding = AccountFunding> = {
+  readonly kind: 'ephemeral';
+  readonly funding?: Funding;
+} | {
+  readonly kind: 'keystore';
+  readonly path: string;
+  readonly aliasOrAddress: string;
+  readonly funding?: Funding;
+} | {
+  readonly kind: 'env';
+  readonly key: string;
+  readonly funding?: Funding;
+} | {
+  readonly kind: 'inline';
+  readonly privateKey: string | Uint8Array;
+  readonly funding?: Funding;
+} | {
+  readonly kind: 'signer';
+  readonly signer: {
+    readonly toSuiAddress: () => string;
+    readonly getKeyScheme: () => string;
+    readonly getPublicKey: () => {
+      readonly toRawBytes: () => Uint8Array;
+    };
+    readonly signTransaction: (tx: Uint8Array) => Promise<{
+      readonly bytes: string;
+      readonly signature: string;
+    }>;
+    readonly signPersonalMessage: (msg: Uint8Array) => Promise<{
+      readonly bytes: string;
+      readonly signature: string;
+    }>;
+  };
+  readonly addressOverride?: string;
+  readonly funding?: Funding;
+} | {
+  readonly kind: 'impersonate';
+  readonly address: string;
+  readonly funding?: Funding;
+};
+/** Per-account resolved value — the typed handle the Account tag
+ *  publishes.
+ *
+ *  Architecture-distilled finding (12-account.md "Tighten the
+ *  resolved-account type"): the `source` discriminator is mandatory
+ *  so consumers can branch on impersonation. Impersonation accounts
+ *  carry a zero-buffer publicKey — the discriminator is the
+ *  trustworthy signal. */
+interface AccountValue {
+  readonly name: string;
+  readonly address: string;
+  readonly scheme: 'ed25519' | 'secp256k1' | 'secp256r1';
+  readonly publicKey: Uint8Array;
+  /** Source discriminator — `'real'` for ephemeral / keystore / env
+   *  / inline / signer; `'impersonate'` for the fork-only variant. */
+  readonly source: 'real' | 'impersonate';
+  /** Sign + execute (the canonical execution surface — per-address
+   *  serialized, post-submit transaction-wait included, bounded
+   *  retry on the "dependent package not found on-chain" race).
+   *
+   *  For impersonation accounts, routes through Sui's fork
+   *  admin `impersonate` surface; for real signers, routes
+   *  through the SDK's executeTransaction surface. */
+  readonly signAndExecute: (tx: Uint8Array) => Effect.Effect<TxResult, AccountSignError>;
+  /** Run a full account-bound transaction critical section.
+   *  Callers that must serialize `Transaction.build({ client })`
+   *  together with signing/execution use the signer passed to this
+   *  callback; the callback runs while the per-address lease is held. */
+  readonly withTransactionSigner: <A, E, R>(body: (signer: AccountTransactionSigner) => Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+  /** Sign-only — real signers honor this; impersonation accounts
+   *  throw synchronously (see `variants/impersonate.ts`). */
+  readonly signTransaction: (tx: Uint8Array) => Effect.Effect<{
+    readonly bytes: string;
+    readonly signature: string;
+  }, AccountSignError>;
+  readonly signPersonalMessage: (msg: Uint8Array) => Effect.Effect<{
+    readonly bytes: string;
+    readonly signature: string;
+  }, AccountSignError>;
+  readonly funding: AccountFundingResult;
+}
+/** Submit result projection — kept narrow so downstream consumers
+ *  don't depend on the full @mysten/sui execute envelope. */
+interface TxResult {
+  readonly digest: string;
+  readonly effects: unknown;
+  readonly objectChanges: ReadonlyArray<unknown>;
+  readonly balanceChanges: ReadonlyArray<unknown>;
+}
+interface AccountTransactionSigner extends TransactionSignerScope<AccountSignError> {
+  readonly signAndExecute: AccountValue['signAndExecute'];
+}
+//#endregion
+export { AccountOptions, AccountValue, TxResult };
+//# sourceMappingURL=service.d.mts.map