@mysten-incubation/devstack 0.0.0

package/dist/plugins/account/variants/ephemeral.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ephemeral.mjs","names":[],"sources":["../../../../src/plugins/account/variants/ephemeral.ts"],"sourcesContent":["// Account variant — ephemeral (generate-or-recover, fund-by-default).\n//\n// Distilled-doc invariants:\n//\n//   - \"Concurrent first-time keypair persistence\": EXCL-create write.\n//     Two parallel generators must not both win; the loser falls\n//     back to reading the winner's persisted key.\n//   - \"Restrictive file permissions\": 0o600 secret + 0o700 parent.\n//   - \"Bare form equals ephemeral-funded\": this resolver is what the\n//     bare `account('alice')` factory call lands on.\n//   - \"Auto-promotion to fork-impersonate funding\": handled in\n//     `funding.ts`; this file just hands off the address. The\n//     promotion event is emitted there (loud-by-default).\n//\n// Persistence note: these accounts are \"ephemeral\" relative to user-\n// managed key material, but they are stable inside a devstack runtime\n// root. Package cache keys and wallet accounts depend on that stability\n// across warm starts.\n\nimport { dirname } from 'node:path';\nimport * as nodeFs from 'node:fs/promises';\n\nimport { Effect } from 'effect';\n\nimport { decodeBech32Secret, generateEd25519Keypair, type ResolvedKeypair } from '../keypair.ts';\nimport { accountAcquireError, type AccountAcquireError } from '../errors.ts';\n\nexport interface EphemeralVariantArgs {\n\treadonly name: string;\n\t/** Filesystem path where the bech32 secret will be persisted by\n\t *  the resolver and covered by the account snapshot capability. */\n\treadonly secretFilePath: string;\n}\n\ntype WriteResult = 'wrote' | 'exists';\n\nconst isErrnoCode = (cause: unknown, code: string): boolean =>\n\ttypeof cause === 'object' &&\n\tcause !== null &&\n\t'code' in cause &&\n\t(cause as { readonly code?: unknown }).code === code;\n\nconst bestEffortChmod = (path: string, mode: number): Effect.Effect<void> =>\n\tEffect.promise(() => nodeFs.chmod(path, mode)).pipe(Effect.ignore);\n\nconst readPersistedKeypair = (\n\targs: EphemeralVariantArgs,\n\tmessage: string,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst raw = yield* Effect.tryPromise({\n\t\t\ttry: () => nodeFs.readFile(args.secretFilePath, 'utf8'),\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'read-persisted-keypair',\n\t\t\t\t\taccountName: args.name,\n\t\t\t\t\tvariant: 'ephemeral',\n\t\t\t\t\tmessage,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tyield* bestEffortChmod(args.secretFilePath, 0o600);\n\t\treturn yield* decodeBech32Secret(raw.trim(), args.name, 'ephemeral');\n\t});\n\nconst readPersistedKeypairIfPresent = (\n\targs: EphemeralVariantArgs,\n): Effect.Effect<ResolvedKeypair | null, AccountAcquireError> =>\n\treadPersistedKeypair(\n\t\targs,\n\t\t`Account '${args.name}': failed to read persisted ephemeral keypair at ${args.secretFilePath}.`,\n\t).pipe(\n\t\tEffect.catch((cause: AccountAcquireError) =>\n\t\t\tisErrnoCode(cause.cause, 'ENOENT') ? Effect.succeed(null) : Effect.fail(cause),\n\t\t),\n\t);\n\nconst persistGeneratedSecret = (\n\targs: EphemeralVariantArgs,\n\tsecret: string,\n): Effect.Effect<WriteResult, AccountAcquireError> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tawait nodeFs.mkdir(dirname(args.secretFilePath), { recursive: true, mode: 0o700 });\n\t\t\tawait nodeFs.chmod(dirname(args.secretFilePath), 0o700).catch(() => {});\n\t\t\ttry {\n\t\t\t\tawait nodeFs.writeFile(args.secretFilePath, secret, { flag: 'wx', mode: 0o600 });\n\t\t\t\treturn 'wrote';\n\t\t\t} catch (cause) {\n\t\t\t\tif (isErrnoCode(cause, 'EEXIST')) return 'exists';\n\t\t\t\tthrow cause;\n\t\t\t}\n\t\t},\n\t\tcatch: (cause): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'persist-keypair',\n\t\t\t\taccountName: args.name,\n\t\t\t\tvariant: 'ephemeral',\n\t\t\t\tmessage: `Account '${args.name}': failed to persist ephemeral keypair at ${args.secretFilePath}.`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n/** Resolve the ephemeral variant — read or generate an Ed25519 keypair.\n *\n *  First-time writes use O_EXCL so parallel acquires for the same\n *  account cannot both publish different addresses; the loser re-reads\n *  the winner's file and returns the persisted identity. */\nexport const resolveEphemeralVariant = (\n\targs: EphemeralVariantArgs,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst persisted = yield* readPersistedKeypairIfPresent(args);\n\t\tif (persisted !== null) return persisted;\n\n\t\tconst generated = yield* generateEd25519Keypair(args.name);\n\t\tif (generated.bech32Secret === null) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'generate-keypair',\n\t\t\t\t\taccountName: args.name,\n\t\t\t\t\tvariant: 'ephemeral',\n\t\t\t\t\tmessage: `Account '${args.name}': generated keypair did not expose a bech32 secret.`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\tconst writeResult = yield* persistGeneratedSecret(args, generated.bech32Secret);\n\t\tif (writeResult === 'exists') {\n\t\t\treturn yield* readPersistedKeypair(\n\t\t\t\targs,\n\t\t\t\t`Account '${args.name}': lost ephemeral keypair write race at ${args.secretFilePath} and failed to read the winner.`,\n\t\t\t);\n\t\t}\n\n\t\tyield* bestEffortChmod(args.secretFilePath, 0o600);\n\t\treturn generated;\n\t});\n"],"mappings":";;;;;;AAoCA,MAAM,eAAe,OAAgB,SACpC,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAAsC,SAAS;AAEjD,MAAM,mBAAmB,MAAc,SACtC,OAAO,cAAc,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC,KAAK,OAAO,OAAO;AAEnE,MAAM,wBACL,MACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,OAAO,WAAW;EACpC,WAAW,OAAO,SAAS,KAAK,gBAAgB,OAAO;EACvD,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP,aAAa,KAAK;GAClB,SAAS;GACT;GACA;GACA,CAAC;EACH,CAAC;AACF,QAAO,gBAAgB,KAAK,gBAAgB,IAAM;AAClD,QAAO,OAAO,mBAAmB,IAAI,MAAM,EAAE,KAAK,MAAM,YAAY;EACnE;AAEH,MAAM,iCACL,SAEA,qBACC,MACA,YAAY,KAAK,KAAK,mDAAmD,KAAK,eAAe,GAC7F,CAAC,KACD,OAAO,OAAO,UACb,YAAY,MAAM,OAAO,SAAS,GAAG,OAAO,QAAQ,KAAK,GAAG,OAAO,KAAK,MAAM,CAC9E,CACD;AAEF,MAAM,0BACL,MACA,WAEA,OAAO,WAAW;CACjB,KAAK,YAAY;AAChB,QAAM,OAAO,MAAM,QAAQ,KAAK,eAAe,EAAE;GAAE,WAAW;GAAM,MAAM;GAAO,CAAC;AAClF,QAAM,OAAO,MAAM,QAAQ,KAAK,eAAe,EAAE,IAAM,CAAC,YAAY,GAAG;AACvE,MAAI;AACH,SAAM,OAAO,UAAU,KAAK,gBAAgB,QAAQ;IAAE,MAAM;IAAM,MAAM;IAAO,CAAC;AAChF,UAAO;WACC,OAAO;AACf,OAAI,YAAY,OAAO,SAAS,CAAE,QAAO;AACzC,SAAM;;;CAGR,QAAQ,UACP,oBAAoB;EACnB,OAAO;EACP,aAAa,KAAK;EAClB,SAAS;EACT,SAAS,YAAY,KAAK,KAAK,4CAA4C,KAAK,eAAe;EAC/F;EACA,CAAC;CACH,CAAC;;;;;;AAOH,MAAa,2BACZ,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,YAAY,OAAO,8BAA8B,KAAK;AAC5D,KAAI,cAAc,KAAM,QAAO;CAE/B,MAAM,YAAY,OAAO,uBAAuB,KAAK,KAAK;AAC1D,KAAI,UAAU,iBAAiB,KAC9B,QAAO,OAAO,OAAO,KACpB,oBAAoB;EACnB,OAAO;EACP,aAAa,KAAK;EAClB,SAAS;EACT,SAAS,YAAY,KAAK,KAAK;EAC/B,CAAC,CACF;AAIF,MAAI,OADuB,uBAAuB,MAAM,UAAU,aAAa,MAC3D,SACnB,QAAO,OAAO,qBACb,MACA,YAAY,KAAK,KAAK,0CAA0C,KAAK,eAAe,iCACpF;AAGF,QAAO,gBAAgB,KAAK,gBAAgB,IAAM;AAClD,QAAO;EACN"}

package/dist/plugins/account/variants/impersonate.d.mts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+
+//#region src/plugins/account/variants/impersonate.d.ts
+/** The synthetic impersonation signer object. THROWS SYNCHRONOUSLY
+ *  on direct sign calls; routes `signAndExecute` through the fork's
+ *  empty-signature submit path (wired in `service.ts`). */
+interface SyntheticImpersonationSigner {
+  readonly _kind: 'impersonate';
+  readonly toSuiAddress: () => string;
+  readonly getKeyScheme: () => 'ed25519';
+  readonly signTransaction: () => never;
+  readonly signPersonalMessage: () => never;
+}
+//#endregion
+export { SyntheticImpersonationSigner };
+//# sourceMappingURL=impersonate.d.mts.map

package/dist/plugins/account/variants/impersonate.mjs

@@ -0,0 +1,48 @@
+import { accountAcquireError, accountSignError } from "../errors.mjs";
+import { Effect } from "effect";
+//#region src/plugins/account/variants/impersonate.ts
+const makeSyntheticSigner = (accountName, address) => ({
+	_kind: "impersonate",
+	toSuiAddress: () => address,
+	getKeyScheme: () => "ed25519",
+	signTransaction: () => {
+		throw accountSignError({
+			phase: "impersonation-bypass-attempt",
+			accountName,
+			address,
+			message: `Account '${accountName}' is an impersonation account — direct sign calls are forbidden. Route through signAndExecute (which goes via the fork's impersonation submit path).`
+		});
+	},
+	signPersonalMessage: () => {
+		throw accountSignError({
+			phase: "impersonation-bypass-attempt",
+			accountName,
+			address,
+			message: `Account '${accountName}' is an impersonation account — signPersonalMessage is not supported.`
+		});
+	}
+});
+/** Resolve the impersonate variant.
+*
+*  Distilled-doc invariant: refuse outside fork mode. The refusal
+*  is a typed acquisition error pointing at the runtime requirement. */
+const resolveImpersonateVariant = (args) => {
+	if (args.suiMode !== "fork") return Effect.fail(accountAcquireError({
+		phase: "bind-impersonation-slot",
+		accountName: args.name,
+		variant: "impersonate",
+		message: `Account '${args.name}' uses {kind:'impersonate'} but Sui runtime is '${args.suiMode}'. Impersonation only works on fork-mode networks.`,
+		hint: `Switch to suiFor(network).fork.{mainnet|testnet|devnet}(...) — or use a different account variant.`
+	}));
+	return Effect.succeed({
+		address: args.address,
+		scheme: "ed25519",
+		publicKey: new Uint8Array(32),
+		signer: makeSyntheticSigner(args.name, args.address),
+		bech32Secret: null
+	});
+};
+//#endregion
+export { resolveImpersonateVariant };
+
+//# sourceMappingURL=impersonate.mjs.map

package/dist/plugins/account/variants/impersonate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonate.mjs","names":[],"sources":["../../../../src/plugins/account/variants/impersonate.ts"],"sourcesContent":["// Account variant — impersonate (fork-mode only).\n//\n// Distilled-doc invariants:\n//\n//   - \"Impersonation only on fork\": the variant must refuse outside\n//     fork-runtime. The refusal lands at variant-resolution time\n//     (typed AccountAcquireError, phase: bind-impersonation-slot).\n//\n//   - \"Sign-and-execute is the only execution surface for\n//     impersonation\": synthetic impersonation signers must THROW\n//     SYNCHRONOUSLY on direct sign calls so accidental bypass is\n//     loud, not silent. We surface this through the\n//     `SyntheticImpersonationSigner` object's `signTransaction` /\n//     `signPersonalMessage` methods.\n//\n//   - \"publicKey caveat\": the resolved value's `publicKey` is a\n//     zero buffer. The resolved-account TYPE (in `service.ts`)\n//     encodes the source discriminator so consumers can't accidentally\n//     treat an impersonation publicKey as authoritative.\n//\n// Distilled-doc opportunity: \"Move the synthetic impersonation\n// signer next to the other fork-only helpers\". For now, it stays\n// here because the variant resolver is the only construction site —\n// if Wallet ever needs to materialize impersonation signers directly,\n// we lift this into `plugins/sui/fork-orchestration.ts`.\n\nimport { Effect } from 'effect';\n\nimport { accountAcquireError, accountSignError, type AccountAcquireError } from '../errors.ts';\nimport type { ResolvedKeypair } from '../keypair.ts';\n\nexport interface ImpersonateVariantArgs {\n\treadonly name: string;\n\t/** The address to execute AS. Must appear in the fork's seed\n\t *  manifest's owned-object index (typically by being listed\n\t *  in `Sui({fork:{seed:{addresses}}})`). */\n\treadonly address: string;\n\t/** Sui's resolved runtime mode — gates the refusal-outside-fork\n\t *  check. */\n\treadonly suiMode: 'local' | 'local-rpc' | 'live' | 'fork';\n}\n\n/** The synthetic impersonation signer object. THROWS SYNCHRONOUSLY\n *  on direct sign calls; routes `signAndExecute` through the fork's\n *  empty-signature submit path (wired in `service.ts`). */\nexport interface SyntheticImpersonationSigner {\n\treadonly _kind: 'impersonate';\n\treadonly toSuiAddress: () => string;\n\treadonly getKeyScheme: () => 'ed25519';\n\treadonly signTransaction: () => never;\n\treadonly signPersonalMessage: () => never;\n}\n\nconst makeSyntheticSigner = (\n\taccountName: string,\n\taddress: string,\n): SyntheticImpersonationSigner => ({\n\t_kind: 'impersonate',\n\ttoSuiAddress: () => address,\n\t// Stable lie: report ed25519 so manifest serialization doesn't\n\t// have to branch. Consumers that need the truth read `source`\n\t// off the resolved-account value (architecture-distilled\n\t// invariant).\n\tgetKeyScheme: () => 'ed25519',\n\tsignTransaction: () => {\n\t\tthrow accountSignError({\n\t\t\tphase: 'impersonation-bypass-attempt',\n\t\t\taccountName,\n\t\t\taddress,\n\t\t\tmessage: `Account '${accountName}' is an impersonation account — direct sign calls are forbidden. Route through signAndExecute (which goes via the fork's impersonation submit path).`,\n\t\t});\n\t},\n\tsignPersonalMessage: () => {\n\t\tthrow accountSignError({\n\t\t\tphase: 'impersonation-bypass-attempt',\n\t\t\taccountName,\n\t\t\taddress,\n\t\t\tmessage: `Account '${accountName}' is an impersonation account — signPersonalMessage is not supported.`,\n\t\t});\n\t},\n});\n\n/** Resolve the impersonate variant.\n *\n *  Distilled-doc invariant: refuse outside fork mode. The refusal\n *  is a typed acquisition error pointing at the runtime requirement. */\nexport const resolveImpersonateVariant = (\n\targs: ImpersonateVariantArgs,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> => {\n\tif (args.suiMode !== 'fork') {\n\t\treturn Effect.fail(\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'bind-impersonation-slot',\n\t\t\t\taccountName: args.name,\n\t\t\t\tvariant: 'impersonate',\n\t\t\t\tmessage: `Account '${args.name}' uses {kind:'impersonate'} but Sui runtime is '${args.suiMode}'. Impersonation only works on fork-mode networks.`,\n\t\t\t\thint: `Switch to suiFor(network).fork.{mainnet|testnet|devnet}(...) — or use a different account variant.`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({\n\t\taddress: args.address,\n\t\tscheme: 'ed25519',\n\t\t// Zero-buffer publicKey — the type-level lie. The `source`\n\t\t// discriminator on the resolved AccountValue is the\n\t\t// trustworthy signal.\n\t\tpublicKey: new Uint8Array(32),\n\t\tsigner: makeSyntheticSigner(args.name, args.address),\n\t\tbech32Secret: null,\n\t} satisfies ResolvedKeypair);\n};\n"],"mappings":";;;AAqDA,MAAM,uBACL,aACA,aACmC;CACnC,OAAO;CACP,oBAAoB;CAKpB,oBAAoB;CACpB,uBAAuB;AACtB,QAAM,iBAAiB;GACtB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC,CAAC;;CAEH,2BAA2B;AAC1B,QAAM,iBAAiB;GACtB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC,CAAC;;CAEH;;;;;AAMD,MAAa,6BACZ,SACyD;AACzD,KAAI,KAAK,YAAY,OACpB,QAAO,OAAO,KACb,oBAAoB;EACnB,OAAO;EACP,aAAa,KAAK;EAClB,SAAS;EACT,SAAS,YAAY,KAAK,KAAK,kDAAkD,KAAK,QAAQ;EAC9F,MAAM;EACN,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ;EACrB,SAAS,KAAK;EACd,QAAQ;EAIR,WAAW,IAAI,WAAW,GAAG;EAC7B,QAAQ,oBAAoB,KAAK,MAAM,KAAK,QAAQ;EACpD,cAAc;EACd,CAA2B"}

package/dist/plugins/account/variants/inline.mjs

@@ -0,0 +1,13 @@
+import { decodeBech32Secret, resolvedKeypairFromEd25519Bytes } from "../keypair.mjs";
+import "effect";
+//#region src/plugins/account/variants/inline.ts
+/** Resolve the inline variant. String input takes the bech32 decode
+*  path; Uint8Array input takes the raw-bytes-into-Ed25519 path. */
+const resolveInlineVariant = (args) => {
+	if (typeof args.privateKey === "string") return decodeBech32Secret(args.privateKey, args.name, "inline");
+	return resolvedKeypairFromEd25519Bytes(args.privateKey, args.name, "inline");
+};
+//#endregion
+export { resolveInlineVariant };
+
+//# sourceMappingURL=inline.mjs.map

package/dist/plugins/account/variants/inline.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.mjs","names":[],"sources":["../../../../src/plugins/account/variants/inline.ts"],"sourcesContent":["// Account variant — inline (literal bech32 secret in config).\n//\n// Distilled-doc warning: TESTS AND DEMOS ONLY. The key is serialized\n// as part of the user's devstack config; if that file is committed,\n// the key is in their git history. The user-facing factory in\n// `index.ts` mirrors the warning in JSDoc.\n//\n// This file accepts either a `string` (bech32 form) or a `Uint8Array`\n// (raw 32-byte secret key). Both funnel through Ed25519 construction\n// so downstream paths are uniform.\n\nimport { Effect } from 'effect';\n\nimport {\n\tdecodeBech32Secret,\n\tresolvedKeypairFromEd25519Bytes,\n\ttype ResolvedKeypair,\n} from '../keypair.ts';\nimport type { AccountAcquireError } from '../errors.ts';\n\nexport interface InlineVariantArgs {\n\treadonly name: string;\n\treadonly privateKey: string | Uint8Array;\n}\n\n/** Resolve the inline variant. String input takes the bech32 decode\n *  path; Uint8Array input takes the raw-bytes-into-Ed25519 path. */\nexport const resolveInlineVariant = (\n\targs: InlineVariantArgs,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> => {\n\tif (typeof args.privateKey === 'string') {\n\t\treturn decodeBech32Secret(args.privateKey, args.name, 'inline');\n\t}\n\treturn resolvedKeypairFromEd25519Bytes(args.privateKey, args.name, 'inline');\n};\n"],"mappings":";;;;;AA2BA,MAAa,wBACZ,SACyD;AACzD,KAAI,OAAO,KAAK,eAAe,SAC9B,QAAO,mBAAmB,KAAK,YAAY,KAAK,MAAM,SAAS;AAEhE,QAAO,gCAAgC,KAAK,YAAY,KAAK,MAAM,SAAS"}

package/dist/plugins/account/variants/keystore.mjs

@@ -0,0 +1,93 @@
+import { decodeJsonText } from "../../../substrate/runtime/runtime-decode.mjs";
+import { accountAcquireError } from "../errors.mjs";
+import { decodeBech32Secret } from "../keypair.mjs";
+import { Effect, Schema } from "effect";
+import { promises } from "node:fs";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+//#region src/plugins/account/variants/keystore.ts
+const AliasesShape = Schema.Array(Schema.Struct({
+	alias: Schema.String,
+	public_key_base64: Schema.optional(Schema.String)
+}));
+const KeystoreShape = Schema.Array(Schema.String);
+/** Resolve the keystore variant. */
+const resolveKeystoreVariant = (args) => Effect.gen(function* () {
+	const rows = yield* decodeJsonText(KeystoreShape, yield* Effect.tryPromise({
+		try: () => promises.readFile(args.path, "utf-8"),
+		catch: (cause) => accountAcquireError({
+			phase: "load-keystore",
+			accountName: args.name,
+			variant: "keystore",
+			message: `Account '${args.name}': failed to read keystore at '${args.path}'.`,
+			hint: "Verify the path exists and is readable. The Sui CLI default is `~/.sui/sui_config/sui.keystore`.",
+			cause
+		})
+	}), {
+		source: args.path,
+		mkError: (issue) => accountAcquireError({
+			phase: "load-keystore",
+			accountName: args.name,
+			variant: "keystore",
+			message: issue.message === "failed to parse JSON" ? `Account '${args.name}': keystore at '${args.path}' is not valid JSON.` : `Account '${args.name}': keystore at '${args.path}' did not match the expected schema (array of bech32 strings).`,
+			cause: issue.cause
+		})
+	});
+	const aliasIdx = yield* resolveAliasIndex(`${args.path.replace(/\.keystore$/, "")}.aliases`, args.aliasOrAddress).pipe(Effect.orElseSucceed(() => -1));
+	if (aliasIdx >= 0 && aliasIdx < rows.length) {
+		const bech32 = rows[aliasIdx];
+		return yield* decodeBech32Secret(bech32, args.name, "keystore");
+	}
+	const wantAddr = normalizeAddress(args.aliasOrAddress);
+	for (const bech32 of rows) {
+		const addr = yield* tryDeriveAddress(bech32).pipe(Effect.orElseSucceed(() => null));
+		if (addr !== null && normalizeAddress(addr) === wantAddr) return yield* decodeBech32Secret(bech32, args.name, "keystore");
+	}
+	return yield* Effect.fail(accountAcquireError({
+		phase: "load-keystore",
+		accountName: args.name,
+		variant: "keystore",
+		message: `Account '${args.name}': keystore at '${args.path}' has no entry matching alias-or-address '${args.aliasOrAddress}'.`,
+		hint: "Check the sibling sui.aliases file for the alias spelling, or pass the on-chain address (0x-prefixed) directly."
+	}));
+});
+const resolveAliasIndex = (aliasesPath, want) => Effect.gen(function* () {
+	return (yield* decodeJsonText(AliasesShape, yield* Effect.tryPromise({
+		try: () => promises.readFile(aliasesPath, "utf-8"),
+		catch: (cause) => accountAcquireError({
+			phase: "load-keystore",
+			accountName: "<keystore>",
+			variant: "keystore",
+			message: `aliases file '${aliasesPath}' missing or unreadable`,
+			cause
+		})
+	}), {
+		source: aliasesPath,
+		mkError: (issue) => accountAcquireError({
+			phase: "load-keystore",
+			accountName: "<keystore>",
+			variant: "keystore",
+			message: issue.message === "failed to parse JSON" ? `aliases file '${aliasesPath}' is not valid JSON` : `aliases file '${aliasesPath}' did not match the expected schema`,
+			cause: issue.cause
+		})
+	})).findIndex((row) => row.alias === want);
+});
+/** Derive the on-chain address from a bech32 secret without
+*  surfacing a typed error — used by the by-address scan, which
+*  swallows per-row failures and moves on. */
+const tryDeriveAddress = (bech32) => Effect.try({
+	try: () => {
+		const parsed = decodeSuiPrivateKey(bech32);
+		if (parsed.scheme !== "ED25519") throw new Error(`scheme ${parsed.scheme} not yet derivable here`);
+		return Ed25519Keypair.fromSecretKey(parsed.secretKey).toSuiAddress();
+	},
+	catch: (cause) => cause instanceof Error ? cause : new Error(String(cause))
+});
+const normalizeAddress = (addr) => {
+	const lower = addr.toLowerCase();
+	return lower.startsWith("0x") ? lower : `0x${lower}`;
+};
+//#endregion
+export { resolveKeystoreVariant };
+
+//# sourceMappingURL=keystore.mjs.map

package/dist/plugins/account/variants/keystore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore.mjs","names":["fs"],"sources":["../../../../src/plugins/account/variants/keystore.ts"],"sourcesContent":["// Account variant — keystore (read from Sui CLI keystore file).\n//\n// Distilled-doc surface: read a `suiprivkey1...` entry by alias or\n// by address from a CLI-shape keystore file. Devstack NEVER copies\n// the keystore — only reads. Persistence stays with the user's\n// CLI tooling.\n//\n// Keystore file shape (canonical sui-cli output):\n//   `<path>`           — a JSON array of bech32 `suiprivkey1...` strings\n//   `<path>.aliases`   — a sibling JSON array of `{alias, public_key_base64}`\n//                         entries; the array's index matches the keystore.\n//\n// Lookup precedence: alias match first (case-sensitive), then by-address\n// match (the resolver decodes each bech32 row, derives the address,\n// and compares). The address path is intentionally O(n) — keystores\n// are small and the alternative is a side-table the CLI doesn't\n// maintain.\n\nimport { Effect, Schema } from 'effect';\nimport { promises as fs } from 'node:fs';\n\nimport { decodeJsonText } from '../../../substrate/runtime/runtime-decode.ts';\nimport { accountAcquireError, type AccountAcquireError } from '../errors.ts';\nimport { decodeBech32Secret, type ResolvedKeypair } from '../keypair.ts';\nimport { decodeSuiPrivateKey } from '@mysten/sui/cryptography';\nimport { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';\n\nexport interface KeystoreVariantArgs {\n\treadonly name: string;\n\t/** Absolute path to the keystore file. Defaults at the factory\n\t *  boundary to `~/.sui/sui_config/sui.keystore`. */\n\treadonly path: string;\n\t/** Alias name (from the sibling `sui.aliases` file) OR the\n\t *  on-chain address — the resolver tries alias first, then a\n\t *  by-address lookup. */\n\treadonly aliasOrAddress: string;\n}\n\nconst AliasesShape = Schema.Array(\n\tSchema.Struct({\n\t\talias: Schema.String,\n\t\t// Optional because some CLI versions omit it for newer rows;\n\t\t// we only need the alias for the alias-path.\n\t\tpublic_key_base64: Schema.optional(Schema.String),\n\t}),\n);\n\nconst KeystoreShape = Schema.Array(Schema.String);\n\n/** Resolve the keystore variant. */\nexport const resolveKeystoreVariant = (\n\targs: KeystoreVariantArgs,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\t// --- read + parse the keystore ----------------------------------\n\t\tconst raw = yield* Effect.tryPromise({\n\t\t\ttry: () => fs.readFile(args.path, 'utf-8'),\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'load-keystore',\n\t\t\t\t\taccountName: args.name,\n\t\t\t\t\tvariant: 'keystore',\n\t\t\t\t\tmessage: `Account '${args.name}': failed to read keystore at '${args.path}'.`,\n\t\t\t\t\thint: 'Verify the path exists and is readable. The Sui CLI default is `~/.sui/sui_config/sui.keystore`.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tconst rows = yield* decodeJsonText(KeystoreShape, raw, {\n\t\t\tsource: args.path,\n\t\t\tmkError: (issue): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'load-keystore',\n\t\t\t\t\taccountName: args.name,\n\t\t\t\t\tvariant: 'keystore',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tissue.message === 'failed to parse JSON'\n\t\t\t\t\t\t\t? `Account '${args.name}': keystore at '${args.path}' is not valid JSON.`\n\t\t\t\t\t\t\t: `Account '${args.name}': keystore at '${args.path}' did not match the expected schema (array of bech32 strings).`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\n\t\t// --- alias path -------------------------------------------------\n\t\t// Best-effort: missing aliases file is not fatal — fall through\n\t\t// to the by-address path.\n\t\tconst aliasesPath = `${args.path.replace(/\\.keystore$/, '')}.aliases`;\n\t\tconst aliasIdx = yield* resolveAliasIndex(aliasesPath, args.aliasOrAddress).pipe(\n\t\t\tEffect.orElseSucceed(() => -1),\n\t\t);\n\t\tif (aliasIdx >= 0 && aliasIdx < rows.length) {\n\t\t\tconst bech32 = rows[aliasIdx]!;\n\t\t\treturn yield* decodeBech32Secret(bech32, args.name, 'keystore');\n\t\t}\n\n\t\t// --- by-address path -------------------------------------------\n\t\t// Normalize the lookup key to a lowercased 0x-prefixed string so\n\t\t// comparisons match regardless of caller casing.\n\t\tconst wantAddr = normalizeAddress(args.aliasOrAddress);\n\t\tfor (const bech32 of rows) {\n\t\t\tconst addr = yield* tryDeriveAddress(bech32).pipe(Effect.orElseSucceed(() => null));\n\t\t\tif (addr !== null && normalizeAddress(addr) === wantAddr) {\n\t\t\t\treturn yield* decodeBech32Secret(bech32, args.name, 'keystore');\n\t\t\t}\n\t\t}\n\n\t\treturn yield* Effect.fail(\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'load-keystore',\n\t\t\t\taccountName: args.name,\n\t\t\t\tvariant: 'keystore',\n\t\t\t\tmessage: `Account '${args.name}': keystore at '${args.path}' has no entry matching alias-or-address '${args.aliasOrAddress}'.`,\n\t\t\t\thint: 'Check the sibling sui.aliases file for the alias spelling, or pass the on-chain address (0x-prefixed) directly.',\n\t\t\t}),\n\t\t);\n\t});\n\nconst resolveAliasIndex = (\n\taliasesPath: string,\n\twant: string,\n): Effect.Effect<number, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst raw = yield* Effect.tryPromise({\n\t\t\ttry: () => fs.readFile(aliasesPath, 'utf-8'),\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'load-keystore',\n\t\t\t\t\taccountName: '<keystore>',\n\t\t\t\t\tvariant: 'keystore',\n\t\t\t\t\tmessage: `aliases file '${aliasesPath}' missing or unreadable`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tconst aliases = yield* decodeJsonText(AliasesShape, raw, {\n\t\t\tsource: aliasesPath,\n\t\t\tmkError: (issue): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'load-keystore',\n\t\t\t\t\taccountName: '<keystore>',\n\t\t\t\t\tvariant: 'keystore',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tissue.message === 'failed to parse JSON'\n\t\t\t\t\t\t\t? `aliases file '${aliasesPath}' is not valid JSON`\n\t\t\t\t\t\t\t: `aliases file '${aliasesPath}' did not match the expected schema`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\treturn aliases.findIndex((row) => row.alias === want);\n\t});\n\n/** Derive the on-chain address from a bech32 secret without\n *  surfacing a typed error — used by the by-address scan, which\n *  swallows per-row failures and moves on. */\nconst tryDeriveAddress = (bech32: string): Effect.Effect<string, Error> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst parsed = decodeSuiPrivateKey(bech32);\n\t\t\tif (parsed.scheme !== 'ED25519') {\n\t\t\t\tthrow new Error(`scheme ${parsed.scheme} not yet derivable here`);\n\t\t\t}\n\t\t\treturn Ed25519Keypair.fromSecretKey(parsed.secretKey).toSuiAddress();\n\t\t},\n\t\tcatch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n\t});\n\nconst normalizeAddress = (addr: string): string => {\n\tconst lower = addr.toLowerCase();\n\treturn lower.startsWith('0x') ? lower : `0x${lower}`;\n};\n"],"mappings":";;;;;;;;AAsCA,MAAM,eAAe,OAAO,MAC3B,OAAO,OAAO;CACb,OAAO,OAAO;CAGd,mBAAmB,OAAO,SAAS,OAAO,OAAO;CACjD,CAAC,CACF;AAED,MAAM,gBAAgB,OAAO,MAAM,OAAO,OAAO;;AAGjD,MAAa,0BACZ,SAEA,OAAO,IAAI,aAAa;CAcvB,MAAM,OAAO,OAAO,eAAe,eAAe,OAZ/B,OAAO,WAAW;EACpC,WAAWA,SAAG,SAAS,KAAK,MAAM,QAAQ;EAC1C,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP,aAAa,KAAK;GAClB,SAAS;GACT,SAAS,YAAY,KAAK,KAAK,iCAAiC,KAAK,KAAK;GAC1E,MAAM;GACN;GACA,CAAC;EACH,CAAC,EACqD;EACtD,QAAQ,KAAK;EACb,UAAU,UACT,oBAAoB;GACnB,OAAO;GACP,aAAa,KAAK;GAClB,SAAS;GACT,SACC,MAAM,YAAY,yBACf,YAAY,KAAK,KAAK,kBAAkB,KAAK,KAAK,wBAClD,YAAY,KAAK,KAAK,kBAAkB,KAAK,KAAK;GACtD,OAAO,MAAM;GACb,CAAC;EACH,CAAC;CAMF,MAAM,WAAW,OAAO,kBAAkB,GADnB,KAAK,KAAK,QAAQ,eAAe,GAAG,CAAC,WACL,KAAK,eAAe,CAAC,KAC3E,OAAO,oBAAoB,GAAG,CAC9B;AACD,KAAI,YAAY,KAAK,WAAW,KAAK,QAAQ;EAC5C,MAAM,SAAS,KAAK;AACpB,SAAO,OAAO,mBAAmB,QAAQ,KAAK,MAAM,WAAW;;CAMhE,MAAM,WAAW,iBAAiB,KAAK,eAAe;AACtD,MAAK,MAAM,UAAU,MAAM;EAC1B,MAAM,OAAO,OAAO,iBAAiB,OAAO,CAAC,KAAK,OAAO,oBAAoB,KAAK,CAAC;AACnF,MAAI,SAAS,QAAQ,iBAAiB,KAAK,KAAK,SAC/C,QAAO,OAAO,mBAAmB,QAAQ,KAAK,MAAM,WAAW;;AAIjE,QAAO,OAAO,OAAO,KACpB,oBAAoB;EACnB,OAAO;EACP,aAAa,KAAK;EAClB,SAAS;EACT,SAAS,YAAY,KAAK,KAAK,kBAAkB,KAAK,KAAK,4CAA4C,KAAK,eAAe;EAC3H,MAAM;EACN,CAAC,CACF;EACA;AAEH,MAAM,qBACL,aACA,SAEA,OAAO,IAAI,aAAa;AA0BvB,SAAO,OAdgB,eAAe,cAAc,OAXjC,OAAO,WAAW;EACpC,WAAWA,SAAG,SAAS,aAAa,QAAQ;EAC5C,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP,aAAa;GACb,SAAS;GACT,SAAS,iBAAiB,YAAY;GACtC;GACA,CAAC;EACH,CAAC,EACuD;EACxD,QAAQ;EACR,UAAU,UACT,oBAAoB;GACnB,OAAO;GACP,aAAa;GACb,SAAS;GACT,SACC,MAAM,YAAY,yBACf,iBAAiB,YAAY,uBAC7B,iBAAiB,YAAY;GACjC,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EACa,WAAW,QAAQ,IAAI,UAAU,KAAK;EACpD;;;;AAKH,MAAM,oBAAoB,WACzB,OAAO,IAAI;CACV,WAAW;EACV,MAAM,SAAS,oBAAoB,OAAO;AAC1C,MAAI,OAAO,WAAW,UACrB,OAAM,IAAI,MAAM,UAAU,OAAO,OAAO,yBAAyB;AAElE,SAAO,eAAe,cAAc,OAAO,UAAU,CAAC,cAAc;;CAErE,QAAQ,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;CAC5E,CAAC;AAEH,MAAM,oBAAoB,SAAyB;CAClD,MAAM,QAAQ,KAAK,aAAa;AAChC,QAAO,MAAM,WAAW,KAAK,GAAG,QAAQ,KAAK"}

package/dist/plugins/account/variants/signer.mjs

@@ -0,0 +1,31 @@
+import { accountAcquireError } from "../errors.mjs";
+import { normalizeScheme } from "../keypair.mjs";
+import { Effect } from "effect";
+//#region src/plugins/account/variants/signer.ts
+/** Resolve the signer variant.
+*
+*  The body reads the address + scheme via the SDK shim and hands
+*  back the resolved-keypair view. The `bech32Secret` field is
+*  `null` — we never fish the secret out of an external signer. */
+const resolveSignerVariant = (args) => Effect.gen(function* () {
+	return {
+		address: args.addressOverride ?? args.signer.toSuiAddress(),
+		scheme: yield* normalizeScheme(args.signer.getKeyScheme(), args.name, "signer"),
+		publicKey: yield* Effect.try({
+			try: () => args.signer.getPublicKey().toRawBytes(),
+			catch: (cause) => accountAcquireError({
+				phase: "bind-signer",
+				accountName: args.name,
+				variant: "signer",
+				message: `Account '${args.name}': signer.getPublicKey().toRawBytes() threw.`,
+				cause
+			})
+		}),
+		signer: args.signer,
+		bech32Secret: null
+	};
+});
+//#endregion
+export { resolveSignerVariant };
+
+//# sourceMappingURL=signer.mjs.map

package/dist/plugins/account/variants/signer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.mjs","names":[],"sources":["../../../../src/plugins/account/variants/signer.ts"],"sourcesContent":["// Account variant — signer (provided as a Signer object directly).\n//\n// Distilled-doc surface: the escape hatch for hardware wallets,\n// custom KMS adapters, and dApp-side signers. Devstack NEVER calls\n// `getSecretKey()` on this branch — the supplied signer's\n// `signTransaction` / `signPersonalMessage` / `signAndExecuteTransaction`\n// methods are called directly.\n//\n// Type-encoded contract: the `signer` field is the @mysten/sui\n// abstract `Signer` shape. We accept `unknown` here at the variant\n// boundary (the substrate's import surface stays SDK-free for tree-\n// shaking and version-pinning); the user-facing factory in `index.ts`\n// pins `Signer` from `@mysten/sui/cryptography`.\n\nimport { Effect } from 'effect';\n\nimport { accountAcquireError, type AccountAcquireError } from '../errors.ts';\nimport { normalizeScheme, type ResolvedKeypair } from '../keypair.ts';\n\nexport interface SignerVariantArgs {\n\treadonly name: string;\n\t/** A `@mysten/sui/cryptography` `Signer` instance. Typed loosely\n\t *  here; the user-facing factory pins the SDK type. */\n\treadonly signer: {\n\t\treadonly toSuiAddress: () => string;\n\t\treadonly getKeyScheme: () => string;\n\t\treadonly getPublicKey: () => { readonly toRawBytes: () => Uint8Array };\n\t};\n\t/** Optional address override. When omitted, `signer.toSuiAddress()`\n\t *  is called. Useful for signers whose address is more expensive\n\t *  to derive than to memoize. */\n\treadonly addressOverride?: string;\n}\n\n/** Resolve the signer variant.\n *\n *  The body reads the address + scheme via the SDK shim and hands\n *  back the resolved-keypair view. The `bech32Secret` field is\n *  `null` — we never fish the secret out of an external signer. */\nexport const resolveSignerVariant = (\n\targs: SignerVariantArgs,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst address = args.addressOverride ?? args.signer.toSuiAddress();\n\t\tconst rawScheme = args.signer.getKeyScheme();\n\t\tconst scheme = yield* normalizeScheme(rawScheme, args.name, 'signer');\n\t\tconst publicKey = yield* Effect.try({\n\t\t\ttry: () => args.signer.getPublicKey().toRawBytes(),\n\t\t\tcatch: (cause) =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'bind-signer',\n\t\t\t\t\taccountName: args.name,\n\t\t\t\t\tvariant: 'signer',\n\t\t\t\t\tmessage: `Account '${args.name}': signer.getPublicKey().toRawBytes() threw.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\treturn {\n\t\t\taddress,\n\t\t\tscheme,\n\t\t\tpublicKey,\n\t\t\tsigner: args.signer,\n\t\t\tbech32Secret: null,\n\t\t} satisfies ResolvedKeypair;\n\t});\n"],"mappings":";;;;;;;;;AAuCA,MAAa,wBACZ,SAEA,OAAO,IAAI,aAAa;AAevB,QAAO;EACN,SAfe,KAAK,mBAAmB,KAAK,OAAO,cAAc;EAgBjE,QAAA,OAdqB,gBADJ,KAAK,OAAO,cACiB,EAAE,KAAK,MAAM,SAAS;EAepE,WAAA,OAdwB,OAAO,IAAI;GACnC,WAAW,KAAK,OAAO,cAAc,CAAC,YAAY;GAClD,QAAQ,UACP,oBAAoB;IACnB,OAAO;IACP,aAAa,KAAK;IAClB,SAAS;IACT,SAAS,YAAY,KAAK,KAAK;IAC/B;IACA,CAAC;GACH,CAAC;EAKD,QAAQ,KAAK;EACb,cAAc;EACd;EACA"}

package/dist/plugins/action/build-context.d.mts

@@ -0,0 +1,41 @@
+import { SuiClient } from "../sui/mode/shared.mjs";
+import { AccountValue } from "../account/service.mjs";
+import { ActionError } from "./errors.mjs";
+import { ActionReceipt } from "./service.mjs";
+import { Effect, Scope } from "effect";
+import { Transaction } from "@mysten/sui/transactions";
+
+//#region src/plugins/action/build-context.d.ts
+/** Build-time context handed to the user's `body` callback (and the
+ *  optional `discriminator` callback).
+ *
+ *  Carries:
+ *
+ *   - `sui` — the resolved `SuiClient` (sdk shim + chain id + opaque
+ *     `client` for `Transaction.build({client})`). Threaded eagerly
+ *     because suiResource is always part of the action's hard upstream.
+ *   - `signAndExecute(account, build)` — high-level helper. Drives
+ *     the full build → sign → execute → wait → project pipeline
+ *     against the supplied account, returning a parsed
+ *     `ActionReceipt`. Folds the SDK boundary cast +
+ *     `include: {effects, objectTypes}` execute + finality wait +
+ *     envelope projection into a single call. Errors surface as
+ *     `ActionError` (phase `sign` for transport / RPC failures;
+ *     `parse` for envelope-shape failures). */
+interface ActionBuildContext {
+  /** Resolved SuiClient. suiResource is part of action's hard upstream so
+   *  this is always populated. */
+  readonly sui: SuiClient;
+  /** High-level: build + sign + execute + wait + project the
+   *  transaction in one call. The `account` is the signer, usually
+   *  from the resolved dependency values passed to the action body.
+   *  The `build` callback populates the fresh `Transaction`; the
+   *  sender is set automatically to `account.address`. Returns a
+   *  parsed `ActionReceipt` whose `objectChanges` array is non-empty
+   *  when the transaction created or mutated on-chain objects (the
+   *  SDK is invoked with `include: { effects, objectTypes }`). */
+  readonly signAndExecute: (account: AccountValue, build: (tx: Transaction) => void) => Effect.Effect<ActionReceipt, ActionError, Scope.Scope>;
+}
+//#endregion
+export { ActionBuildContext };
+//# sourceMappingURL=build-context.d.mts.map

package/dist/plugins/action/discriminator.d.mts

@@ -0,0 +1,20 @@
+import { ActionError } from "./errors.mjs";
+import { ActionBuildContext } from "./build-context.mjs";
+import { Effect } from "effect";
+
+//#region src/plugins/action/discriminator.d.ts
+/** Dynamic portion (resolved at acquire time). Two accepted shapes:
+ *
+ *  - `string`    — literal cache-key fragment, used verbatim.
+ *  - `(ctx, deps) => Effect<string, ActionError>` — callback receiving
+ *                  action helpers and resolved deps in the same shape
+ *                  as the body callback. The Effect is yielded at
+ *                  acquire time so the callback can derive the
+ *                  discriminator from upstream resolved values (e.g.
+ *                  fold in a freshly-published package id). Re-runs
+ *                  on EVERY acquire (hit OR miss). User errors
+ *                  propagate as `ActionError({phase: 'discriminator'})`. */
+type DynamicDiscriminator<Deps = unknown> = string | ((ctx: ActionBuildContext, deps: Deps) => Effect.Effect<string, ActionError>);
+//#endregion
+export { DynamicDiscriminator };
+//# sourceMappingURL=discriminator.d.mts.map

package/dist/plugins/action/discriminator.mjs

@@ -0,0 +1,13 @@
+//#region src/plugins/action/discriminator.ts
+/** Build the content-hash input string from static + resolved-dynamic
+*  pieces. Canonical shape: newline-delimited so two strings with
+*  shared prefixes hash differently. */
+const composeDiscriminatorMaterial = (staticParts, resolvedDynamic) => {
+	const lines = [`action=${staticParts.actionName}`, `dependencies=${JSON.stringify(staticParts.dependencyResourceIds)}`];
+	if (resolvedDynamic !== void 0) lines.push(`discriminator=${resolvedDynamic}`);
+	return lines.join("\n");
+};
+//#endregion
+export { composeDiscriminatorMaterial };
+
+//# sourceMappingURL=discriminator.mjs.map

package/dist/plugins/action/discriminator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discriminator.mjs","names":[],"sources":["../../../src/plugins/action/discriminator.ts"],"sourcesContent":["// Action plugin — discriminator types.\n//\n// An action's cache key is `action/<chainId>/<contentHash>` where the\n// content hash folds in:\n//\n//   - `actionName`   — symbolic action name (drives namespace + TUI\n//                      attribution).\n//   - `chainId`      — substrate-folded automatically (substrate-side\n//                      of the artifact publisher cache key).\n//   - `consumedKeys` — the literal resource ids of every entry in\n//                      `dependsOn`. Folded so reordering/changing\n//                      upstream deps invalidates the cache. Static —\n//                      resolved at factory construction time.\n//   - `discriminator` — OPTIONAL caller-supplied extra material. Two\n//                      accepted shapes: a literal `string`, or a\n//                      callback `(ctx, deps) => Effect<string>`\n//                      receiving action helpers and resolved deps\n//                      shaped by `dependsOn`. The callback form re-runs\n//                      on EVERY acquire (hit OR miss) — mirrors v3's `cacheKey:\n//                      Effect<string>` semantics (16-action.md\n//                      invariant 5/6).\n//\n// The dynamic discriminator covers the common case where the action's\n// idempotency hinges on a value not known until upstream resolution\n// completes. The v3 example: `cacheKey: Effect.gen(function* () {\n// const pkg = yield* connectFour; return pkg.packageId; })`.\n\nimport type { Effect } from 'effect';\n\nimport type { ActionError } from './errors.ts';\nimport type { ActionBuildContext } from './build-context.ts';\n\n/** Static portion of the discriminator (known at factory construction\n *  time). The substrate folds this into the content-hash so the\n *  cache key changes when these fields do. */\nexport interface StaticDiscriminator {\n\t/** Symbolic action name. */\n\treadonly actionName: string;\n\t/** Resource-id literals of every entry in `dependsOn`, in declaration\n\t *  order. Reordering MUST invalidate the cache (this is the v3\n\t *  behavior — `needs.map(n => n.key)` was folded in order). */\n\treadonly dependencyResourceIds: ReadonlyArray<string>;\n}\n\n/** Dynamic portion (resolved at acquire time). Two accepted shapes:\n *\n *  - `string`    — literal cache-key fragment, used verbatim.\n *  - `(ctx, deps) => Effect<string, ActionError>` — callback receiving\n *                  action helpers and resolved deps in the same shape\n *                  as the body callback. The Effect is yielded at\n *                  acquire time so the callback can derive the\n *                  discriminator from upstream resolved values (e.g.\n *                  fold in a freshly-published package id). Re-runs\n *                  on EVERY acquire (hit OR miss). User errors\n *                  propagate as `ActionError({phase: 'discriminator'})`. */\nexport type DynamicDiscriminator<Deps = unknown> =\n\t| string\n\t| ((ctx: ActionBuildContext, deps: Deps) => Effect.Effect<string, ActionError>);\n\n/** Build the content-hash input string from static + resolved-dynamic\n *  pieces. Canonical shape: newline-delimited so two strings with\n *  shared prefixes hash differently. */\nexport const composeDiscriminatorMaterial = (\n\tstaticParts: StaticDiscriminator,\n\tresolvedDynamic: string | undefined,\n): string => {\n\tconst lines: string[] = [\n\t\t`action=${staticParts.actionName}`,\n\t\t`dependencies=${JSON.stringify(staticParts.dependencyResourceIds)}`,\n\t];\n\tif (resolvedDynamic !== undefined) {\n\t\tlines.push(`discriminator=${resolvedDynamic}`);\n\t}\n\treturn lines.join('\\n');\n};\n"],"mappings":";;;;AA8DA,MAAa,gCACZ,aACA,oBACY;CACZ,MAAM,QAAkB,CACvB,UAAU,YAAY,cACtB,gBAAgB,KAAK,UAAU,YAAY,sBAAsB,GACjE;AACD,KAAI,oBAAoB,KAAA,EACvB,OAAM,KAAK,iBAAiB,kBAAkB;AAE/C,QAAO,MAAM,KAAK,KAAK"}

package/dist/plugins/action/errors.d.mts

@@ -0,0 +1,31 @@
+//#region src/plugins/action/errors.d.ts
+/** Phases for `ActionError`. Closed sum — adding a phase requires
+ *  editing this file (and the plugin doc's catalog).
+ *
+ *  Phase semantics:
+ *   - `discriminator` — `opts.discriminator` Effect evaluation failed.
+ *                       User-code defect or yielded upstream raised.
+ *   - `build`         — `opts.body`'s build phase (the user-supplied
+ *                       Effect) failed before producing a transaction.
+ *   - `sign`          — `signAndExecute` failed (gas, bytecode
+ *                       verification, RPC).
+ *   - `parse`         — the action's receipt projection (digest /
+ *                       objectChanges) was malformed.
+ *   - `verify`        — verify probe authoritatively raised (transient
+ *                       is masked by the lenient probe — does NOT raise
+ *                       this).
+ */
+type ActionPhase = 'discriminator' | 'build' | 'sign' | 'parse' | 'verify';
+/** Single tagged action error. */
+interface ActionError {
+  readonly _tag: 'ActionError';
+  readonly phase: ActionPhase;
+  /** Symbolic action name (the user-declared `action.name`). Flows
+   *  into the cache key namespace and the TUI row title. */
+  readonly actionName: string;
+  readonly message: string;
+  readonly cause?: unknown;
+}
+//#endregion
+export { ActionError, ActionPhase };
+//# sourceMappingURL=errors.d.mts.map

package/dist/plugins/action/errors.mjs

@@ -0,0 +1,13 @@
+//#region src/plugins/action/errors.ts
+const actionError = (phase, parts) => ({
+	_tag: "ActionError",
+	phase,
+	...parts
+});
+/** Error tags this plugin contributes — surfaced to the cause walker
+*  via `PluginErrorContribution`. */
+const ACTION_ERROR_TAGS = ["ActionError"];
+//#endregion
+export { ACTION_ERROR_TAGS, actionError };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/plugins/action/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/action/errors.ts"],"sourcesContent":["// Action plugin — typed errors.\n//\n// Distilled doc 16-action.md \"Failure modes\": signing failure routes\n// through `PublishError({ phase: 'publish-tx' })`. The rewrite splits\n// the user-facing action error from `package`'s `PublishError` because\n// action-specific phases (build, sign, parse) carry different semantics\n// — `build` here is the user-supplied transaction-builder Effect,\n// `sign` is the `signAndExecute` invocation, `parse` covers downstream\n// receipt projection.\n//\n// Per architecture §Effect, errors are plain interfaces with a `_tag`\n// discriminator; `Effect.catchTag` / `catchTags` match on the literal.\n\n/** Phases for `ActionError`. Closed sum — adding a phase requires\n *  editing this file (and the plugin doc's catalog).\n *\n *  Phase semantics:\n *   - `discriminator` — `opts.discriminator` Effect evaluation failed.\n *                       User-code defect or yielded upstream raised.\n *   - `build`         — `opts.body`'s build phase (the user-supplied\n *                       Effect) failed before producing a transaction.\n *   - `sign`          — `signAndExecute` failed (gas, bytecode\n *                       verification, RPC).\n *   - `parse`         — the action's receipt projection (digest /\n *                       objectChanges) was malformed.\n *   - `verify`        — verify probe authoritatively raised (transient\n *                       is masked by the lenient probe — does NOT raise\n *                       this).\n */\nexport type ActionPhase = 'discriminator' | 'build' | 'sign' | 'parse' | 'verify';\n\n/** Single tagged action error. */\nexport interface ActionError {\n\treadonly _tag: 'ActionError';\n\treadonly phase: ActionPhase;\n\t/** Symbolic action name (the user-declared `action.name`). Flows\n\t *  into the cache key namespace and the TUI row title. */\n\treadonly actionName: string;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const actionError = (\n\tphase: ActionPhase,\n\tparts: Omit<ActionError, '_tag' | 'phase'>,\n): ActionError => ({ _tag: 'ActionError', phase, ...parts });\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const ACTION_ERROR_TAGS = ['ActionError'] as const;\n"],"mappings":";AA0CA,MAAa,eACZ,OACA,WACkB;CAAE,MAAM;CAAe;CAAO,GAAG;CAAO;;;AAI3D,MAAa,oBAAoB,CAAC,cAAc"}

package/dist/plugins/action/execute.d.mts

@@ -0,0 +1,2 @@
+import { Effect, Scope } from "effect";
+import { Transaction } from "@mysten/sui/transactions";

package/dist/plugins/action/execute.mjs

@@ -0,0 +1,145 @@
+import { buildForkImpersonationTransactionBytes } from "../sui/fork-transaction.mjs";
+import { actionError } from "./errors.mjs";
+import { Effect } from "effect";
+import { Transaction } from "@mysten/sui/transactions";
+//#region src/plugins/action/execute.ts
+const projectAccountObjectChanges = (changes) => changes.filter((change) => typeof change === "object" && change !== null && typeof change.objectId === "string").map((change) => {
+	const entry = {
+		kind: change.type === "created" || change.kind === "created" ? "created" : "mutated",
+		objectId: change.objectId
+	};
+	if (typeof change.objectType === "string") entry.objectType = change.objectType;
+	if (typeof change.outputState === "string") entry.outputState = change.outputState;
+	if (typeof change.idOperation === "string") entry.idOperation = change.idOperation;
+	return entry;
+});
+const receiptFromAccountTx = (tx) => ({
+	digest: tx.digest,
+	objectChanges: projectAccountObjectChanges(tx.objectChanges),
+	balanceChanges: tx.balanceChanges
+});
+/** Drive the full build → sign → execute → wait → project pipeline.
+*
+*  Allocates a fresh `Transaction`, sets the sender to the account's
+*  address, lets the caller populate it via the `build` callback,
+*  serialises via `Transaction.build({ client })`, signs via the
+*  account's transaction-signer scope, executes via the SDK's
+*  `executeTransaction` (with `include: { effects: true, objectTypes:
+*  true }` so the SDK surfaces `changedObjects` + types), waits for
+*  finality, and projects the envelope into an `ActionReceipt`.
+*
+*  All failures surface as `ActionError`:
+*   - `build` callback throws  → `phase: 'sign'` (matches the existing
+*      catch-all phase for body-side failures).
+*   - `Transaction.build` rejects → `phase: 'sign'`.
+*   - `signTransaction` rejects → `phase: 'sign'`.
+*   - `executeTransaction` rejects → `phase: 'sign'`.
+*   - SDK returns `FailedTransaction` → `phase: 'sign'`.
+*   - SDK returns no digest → `phase: 'parse'`.
+*   - `waitForTransaction` rejects → `phase: 'sign'`.
+*
+*  The `actionName` parameter threads into every error's `actionName`
+*  field so cause-walker output stays attributable.
+*/
+const signAndExecute = (params) => Effect.gen(function* () {
+	const { actionName, sui, account, build } = params;
+	return yield* account.withTransactionSigner((lockedSigner) => Effect.gen(function* () {
+		const tx = new Transaction();
+		tx.setSender(account.address);
+		yield* Effect.try({
+			try: () => build(tx),
+			catch: (cause) => actionError("sign", {
+				actionName,
+				message: `Action '${actionName}': build callback threw before serialisation.`,
+				cause
+			})
+		});
+		const txBytes = account.source === "impersonate" ? yield* buildForkImpersonationTransactionBytes(tx, account.address, sui.sdk.core).pipe(Effect.mapError((cause) => actionError("sign", {
+			actionName,
+			message: `Action '${actionName}': fork impersonation Transaction.build failed — ${cause.message}.`,
+			cause
+		}))) : yield* Effect.tryPromise({
+			try: () => tx.build({ client: sui.sdk.client }),
+			catch: (cause) => actionError("sign", {
+				actionName,
+				message: `Action '${actionName}': Transaction.build failed — ${cause instanceof Error ? cause.message : String(cause)}.`,
+				cause
+			})
+		});
+		if (account.source === "impersonate") return receiptFromAccountTx(yield* lockedSigner.signAndExecute(txBytes).pipe(Effect.mapError((cause) => actionError("sign", {
+			actionName,
+			message: `Action '${actionName}': account.signAndExecute failed for '${account.name}' (address=${account.address}): ${cause instanceof Error ? cause.message : String(cause)}`,
+			cause
+		}))));
+		const signed = yield* lockedSigner.signTransaction(txBytes).pipe(Effect.mapError((cause) => actionError("sign", {
+			actionName,
+			message: `Action '${actionName}': account.signTransaction failed for '${account.name}' (address=${account.address}): ${cause instanceof Error ? cause.message : String(cause)}`,
+			cause
+		})));
+		const sdkClient = sui.sdk.client;
+		const env = yield* Effect.tryPromise({
+			try: () => sdkClient.executeTransaction({
+				transaction: txBytes,
+				signatures: [signed.signature],
+				include: {
+					effects: true,
+					objectTypes: true
+				}
+			}),
+			catch: (cause) => actionError("sign", {
+				actionName,
+				message: `Action '${actionName}': executeTransaction failed — ` + (cause instanceof Error ? cause.message : String(cause)),
+				cause
+			})
+		});
+		if (env.$kind === "FailedTransaction") {
+			const failedDigest = env.FailedTransaction?.digest;
+			if (failedDigest !== void 0) yield* Effect.tryPromise({
+				try: () => sdkClient.waitForTransaction({ digest: failedDigest }),
+				catch: (cause) => actionError("sign", {
+					actionName,
+					message: `Action '${actionName}': waitForTransaction(${failedDigest}) failed.`,
+					cause
+				})
+			});
+			return yield* Effect.fail(actionError("sign", {
+				actionName,
+				message: `Action '${actionName}': FailedTransaction (digest=${env.FailedTransaction?.digest ?? "<unknown>"}): ${env.FailedTransaction?.status?.error ?? "<no error>"}`
+			}));
+		}
+		const txOk = env.Transaction;
+		if (txOk?.digest === void 0) return yield* Effect.fail(actionError("parse", {
+			actionName,
+			message: `Action '${actionName}': executeTransaction returned no digest.`
+		}));
+		yield* Effect.tryPromise({
+			try: () => sdkClient.waitForTransaction({ digest: txOk.digest }),
+			catch: (cause) => actionError("sign", {
+				actionName,
+				message: `Action '${actionName}': waitForTransaction(${txOk.digest}) failed.`,
+				cause
+			})
+		});
+		const objectTypes = txOk.objectTypes ?? {};
+		const objectChanges = (txOk.effects?.changedObjects ?? []).filter((c) => typeof c.objectId === "string").map((c) => {
+			const objectType = objectTypes[c.objectId];
+			const entry = {
+				kind: c.idOperation === "Created" ? "created" : "mutated",
+				objectId: c.objectId
+			};
+			if (objectType !== void 0) entry.objectType = objectType;
+			if (c.outputState !== void 0) entry.outputState = c.outputState;
+			if (c.idOperation !== void 0) entry.idOperation = c.idOperation;
+			return entry;
+		});
+		return {
+			digest: txOk.digest,
+			objectChanges,
+			balanceChanges: []
+		};
+	}));
+}).pipe(Effect.withSpan("devstack.plugin.action.signAndExecute", { attributes: { "action.name": params.actionName } }));
+//#endregion
+export { signAndExecute };
+
+//# sourceMappingURL=execute.mjs.map

package/dist/plugins/action/execute.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.mjs","names":[],"sources":["../../../src/plugins/action/execute.ts"],"sourcesContent":["// Action plugin — `signAndExecute` helper.\n//\n// This module encapsulates the \"build → sign → execute → wait → project\"\n// roundtrip that every action body needs to perform a Move call against\n// the booted Sui chain. Without it, every action body re-implements the\n// SDK boundary cast on `sdk.client.executeTransaction` + the SDK envelope\n// projection + the post-submit `waitForTransaction` gate.\n//\n// The same wiring lives in `plugins/package/publish-executor.ts` — both\n// sites cast the opaque `sdk.client` to call `executeTransaction({\n// include: { effects: true, objectTypes: true }})` so they recover\n// `changedObjects` + their fully-qualified types. Both run through the\n// Account plugin's transaction-signer scope so `Transaction.build`,\n// signing, execute, and finality wait serialize per address.\n//\n// What this helper extracts: the SDK-envelope projection + the\n// finality-wait. Per call sites:\n//\n//   - The user supplies a `build(tx)` callback that populates the\n//     `Transaction` synchronously (moveCalls, transferObjects, etc.).\n//   - The user supplies the signing `account` (an `AccountValue` from\n//     the action's resolved dependency values); we sign with the\n//     locked transaction signer and drive the SDK's\n//     `executeTransaction` directly.\n//   - The helper returns an `ActionReceipt` projection: `{ digest,\n//     objectChanges }`. The `objectChanges` array is shaped uniformly so\n//     downstream consumers can pick by `objectType` substring.\n//\n// All failures route through `ActionError` (phase: `sign` for transport\n// / RPC failures; `parse` for \"no digest\" / \"wrong envelope shape\"\n// situations). The action plugin's outer wrap collapses these into the\n// substrate's artifact publisher `produce-failed` channel.\n\nimport { Effect, type Scope } from 'effect';\n\nimport { Transaction } from '@mysten/sui/transactions';\n\nimport type { AccountValue, TxResult } from '../account/service.ts';\nimport type { SuiClient } from '../sui/index.ts';\nimport { buildForkImpersonationTransactionBytes } from '../sui/fork-transaction.ts';\n\nimport { actionError, type ActionError } from './errors.ts';\nimport type { ActionReceipt } from './service.ts';\n\n// ---------------------------------------------------------------------------\n// Receipt object-change projection\n// ---------------------------------------------------------------------------\n\n/** Flat object-change record surfaced on an `ActionReceipt`. Mirrors\n *  the package plugin's `PublishObjectChange` shape so consumers can\n *  reuse `findCreatedByType`-style helpers across the two surfaces.\n *\n *  - `kind`: 'created' when `idOperation === 'Created'`, else 'mutated'\n *    (we expose the same two buckets the package plugin uses; finer\n *    distinctions are recoverable from the raw `idOperation` /\n *    `outputState` fields preserved alongside).\n *  - `objectType`: optional fully-qualified type string\n *    (`<packageId>::<module>::<Name>`) — present when the SDK's\n *    `objectTypes` map carries the id. */\nexport interface ActionObjectChange {\n\treadonly kind: 'created' | 'mutated';\n\treadonly objectId: string;\n\treadonly objectType?: string;\n\treadonly outputState?: string;\n\treadonly idOperation?: string;\n}\n\n// ---------------------------------------------------------------------------\n// SDK shape — kept narrow, mirrors the cast in publish-executor.ts\n// ---------------------------------------------------------------------------\n\ninterface SdkExecuteClient {\n\treadonly executeTransaction: (args: {\n\t\treadonly transaction: Uint8Array;\n\t\treadonly signatures: ReadonlyArray<string>;\n\t\treadonly include?: {\n\t\t\treadonly effects?: boolean;\n\t\t\treadonly objectTypes?: boolean;\n\t\t};\n\t}) => Promise<unknown>;\n\treadonly waitForTransaction: (args: {\n\t\treadonly digest: string;\n\t\treadonly include?: { readonly effects?: boolean };\n\t\treadonly timeout?: number;\n\t}) => Promise<unknown>;\n}\n\ninterface RawExecuteEnvelope {\n\treadonly $kind?: 'Transaction' | 'FailedTransaction';\n\treadonly Transaction?: {\n\t\treadonly digest?: string;\n\t\treadonly effects?: {\n\t\t\treadonly changedObjects?: ReadonlyArray<{\n\t\t\t\treadonly objectId?: string;\n\t\t\t\treadonly outputState?: string;\n\t\t\t\treadonly idOperation?: string;\n\t\t\t}>;\n\t\t};\n\t\treadonly objectTypes?: Readonly<Record<string, string>>;\n\t};\n\treadonly FailedTransaction?: {\n\t\treadonly digest?: string;\n\t\treadonly status?: { readonly error?: string };\n\t};\n}\n\nconst projectAccountObjectChanges = (\n\tchanges: ReadonlyArray<unknown>,\n): ReadonlyArray<ActionObjectChange> =>\n\tchanges\n\t\t.filter(\n\t\t\t(\n\t\t\t\tchange,\n\t\t\t): change is {\n\t\t\t\treadonly type?: string;\n\t\t\t\treadonly kind?: string;\n\t\t\t\treadonly objectId: string;\n\t\t\t\treadonly objectType?: string;\n\t\t\t\treadonly outputState?: string;\n\t\t\t\treadonly idOperation?: string;\n\t\t\t} =>\n\t\t\t\ttypeof change === 'object' &&\n\t\t\t\tchange !== null &&\n\t\t\t\ttypeof (change as { readonly objectId?: unknown }).objectId === 'string',\n\t\t)\n\t\t.map((change) => {\n\t\t\tconst entry: {\n\t\t\t\t-readonly [K in keyof ActionObjectChange]: ActionObjectChange[K];\n\t\t\t} = {\n\t\t\t\tkind: change.type === 'created' || change.kind === 'created' ? 'created' : 'mutated',\n\t\t\t\tobjectId: change.objectId,\n\t\t\t};\n\t\t\tif (typeof change.objectType === 'string') entry.objectType = change.objectType;\n\t\t\tif (typeof change.outputState === 'string') entry.outputState = change.outputState;\n\t\t\tif (typeof change.idOperation === 'string') entry.idOperation = change.idOperation;\n\t\t\treturn entry;\n\t\t});\n\nconst receiptFromAccountTx = (tx: TxResult): ActionReceipt => ({\n\tdigest: tx.digest,\n\tobjectChanges: projectAccountObjectChanges(tx.objectChanges),\n\tbalanceChanges: tx.balanceChanges,\n});\n\n// ---------------------------------------------------------------------------\n// `signAndExecute` helper\n// ---------------------------------------------------------------------------\n\n/** Drive the full build → sign → execute → wait → project pipeline.\n *\n *  Allocates a fresh `Transaction`, sets the sender to the account's\n *  address, lets the caller populate it via the `build` callback,\n *  serialises via `Transaction.build({ client })`, signs via the\n *  account's transaction-signer scope, executes via the SDK's\n *  `executeTransaction` (with `include: { effects: true, objectTypes:\n *  true }` so the SDK surfaces `changedObjects` + types), waits for\n *  finality, and projects the envelope into an `ActionReceipt`.\n *\n *  All failures surface as `ActionError`:\n *   - `build` callback throws  → `phase: 'sign'` (matches the existing\n *      catch-all phase for body-side failures).\n *   - `Transaction.build` rejects → `phase: 'sign'`.\n *   - `signTransaction` rejects → `phase: 'sign'`.\n *   - `executeTransaction` rejects → `phase: 'sign'`.\n *   - SDK returns `FailedTransaction` → `phase: 'sign'`.\n *   - SDK returns no digest → `phase: 'parse'`.\n *   - `waitForTransaction` rejects → `phase: 'sign'`.\n *\n *  The `actionName` parameter threads into every error's `actionName`\n *  field so cause-walker output stays attributable.\n */\nexport const signAndExecute = (params: {\n\treadonly actionName: string;\n\treadonly sui: SuiClient;\n\treadonly account: AccountValue;\n\treadonly build: (tx: Transaction) => void;\n}): Effect.Effect<ActionReceipt, ActionError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst { actionName, sui, account, build } = params;\n\t\treturn yield* account.withTransactionSigner((lockedSigner) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\t// --- 1. Allocate + populate the Transaction ------------------\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\ttx.setSender(account.address);\n\t\t\t\tyield* Effect.try({\n\t\t\t\t\ttry: () => build(tx),\n\t\t\t\t\tcatch: (cause): ActionError =>\n\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\tmessage: `Action '${actionName}': build callback threw before serialisation.`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t});\n\n\t\t\t\t// --- 2. Serialise via the mode-appropriate path --------------\n\t\t\t\tconst txBytes =\n\t\t\t\t\taccount.source === 'impersonate'\n\t\t\t\t\t\t? yield* buildForkImpersonationTransactionBytes(tx, account.address, sui.sdk.core).pipe(\n\t\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t\t(cause): ActionError =>\n\t\t\t\t\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\t\t\t\t\tmessage: `Action '${actionName}': fork impersonation Transaction.build failed — ${cause.message}.`,\n\t\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: yield* Effect.tryPromise({\n\t\t\t\t\t\t\t\ttry: () =>\n\t\t\t\t\t\t\t\t\ttx.build({\n\t\t\t\t\t\t\t\t\t\tclient: sui.sdk.client as Parameters<typeof tx.build>[0] extends\n\t\t\t\t\t\t\t\t\t\t\t| { client?: infer C }\n\t\t\t\t\t\t\t\t\t\t\t| undefined\n\t\t\t\t\t\t\t\t\t\t\t? C\n\t\t\t\t\t\t\t\t\t\t\t: never,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\tcatch: (cause): ActionError =>\n\t\t\t\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\t\t\t\tmessage: `Action '${actionName}': Transaction.build failed — ${\n\t\t\t\t\t\t\t\t\t\t\tcause instanceof Error ? cause.message : String(cause)\n\t\t\t\t\t\t\t\t\t\t}.`,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t});\n\n\t\t\t\tif (account.source === 'impersonate') {\n\t\t\t\t\tconst executed = yield* lockedSigner.signAndExecute(txBytes).pipe(\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause): ActionError =>\n\t\t\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t`Action '${actionName}': account.signAndExecute failed for ` +\n\t\t\t\t\t\t\t\t\t\t`'${account.name}' (address=${account.address}): ${\n\t\t\t\t\t\t\t\t\t\t\tcause instanceof Error ? cause.message : String(cause)\n\t\t\t\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\t\treturn receiptFromAccountTx(executed);\n\t\t\t\t}\n\n\t\t\t\t// --- 3. Sign with the account -------------------------------\n\t\t\t\tconst signed = yield* lockedSigner.signTransaction(txBytes).pipe(\n\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t(cause): ActionError =>\n\t\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t`Action '${actionName}': account.signTransaction failed for ` +\n\t\t\t\t\t\t\t\t\t`'${account.name}' (address=${account.address}): ${\n\t\t\t\t\t\t\t\t\t\tcause instanceof Error ? cause.message : String(cause)\n\t\t\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\t// --- 4. Execute via the SDK (with effects+objectTypes) ------\n\t\t\t\tconst sdkClient = sui.sdk.client as SdkExecuteClient;\n\t\t\t\tconst raw = yield* Effect.tryPromise({\n\t\t\t\t\ttry: () =>\n\t\t\t\t\t\tsdkClient.executeTransaction({\n\t\t\t\t\t\t\ttransaction: txBytes,\n\t\t\t\t\t\t\tsignatures: [signed.signature],\n\t\t\t\t\t\t\tinclude: { effects: true, objectTypes: true },\n\t\t\t\t\t\t}),\n\t\t\t\t\tcatch: (cause): ActionError =>\n\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`Action '${actionName}': executeTransaction failed — ` +\n\t\t\t\t\t\t\t\t(cause instanceof Error ? cause.message : String(cause)),\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t});\n\n\t\t\t\t// --- 5. Project the envelope --------------------------------\n\t\t\t\tconst env = raw as RawExecuteEnvelope;\n\t\t\t\tif (env.$kind === 'FailedTransaction') {\n\t\t\t\t\tconst failedDigest = env.FailedTransaction?.digest;\n\t\t\t\t\tif (failedDigest !== undefined) {\n\t\t\t\t\t\tyield* Effect.tryPromise({\n\t\t\t\t\t\t\ttry: () => sdkClient.waitForTransaction({ digest: failedDigest }),\n\t\t\t\t\t\t\tcatch: (cause): ActionError =>\n\t\t\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\t\t\tmessage: `Action '${actionName}': waitForTransaction(${failedDigest}) failed.`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`Action '${actionName}': FailedTransaction ` +\n\t\t\t\t\t\t\t\t`(digest=${env.FailedTransaction?.digest ?? '<unknown>'}): ` +\n\t\t\t\t\t\t\t\t`${env.FailedTransaction?.status?.error ?? '<no error>'}`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst txOk = env.Transaction;\n\t\t\t\tif (txOk?.digest === undefined) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tactionError('parse', {\n\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\tmessage: `Action '${actionName}': executeTransaction returned no digest.`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\t// --- 6. Wait for finality -----------------------------------\n\t\t\t\tyield* Effect.tryPromise({\n\t\t\t\t\ttry: () => sdkClient.waitForTransaction({ digest: txOk.digest! }),\n\t\t\t\t\tcatch: (cause): ActionError =>\n\t\t\t\t\t\tactionError('sign', {\n\t\t\t\t\t\t\tactionName,\n\t\t\t\t\t\t\tmessage: `Action '${actionName}': waitForTransaction(${txOk.digest}) failed.`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t});\n\n\t\t\t\t// --- 7. Project changedObjects into the receipt's objectChanges\n\t\t\t\tconst objectTypes = txOk.objectTypes ?? {};\n\t\t\t\tconst objectChanges: ReadonlyArray<ActionObjectChange> = (\n\t\t\t\t\ttxOk.effects?.changedObjects ?? []\n\t\t\t\t)\n\t\t\t\t\t.filter(\n\t\t\t\t\t\t(c): c is { objectId: string; outputState?: string; idOperation?: string } =>\n\t\t\t\t\t\t\ttypeof c.objectId === 'string',\n\t\t\t\t\t)\n\t\t\t\t\t.map((c) => {\n\t\t\t\t\t\tconst objectType = objectTypes[c.objectId];\n\t\t\t\t\t\tconst entry: {\n\t\t\t\t\t\t\t-readonly [K in keyof ActionObjectChange]: ActionObjectChange[K];\n\t\t\t\t\t\t} = {\n\t\t\t\t\t\t\tkind: c.idOperation === 'Created' ? 'created' : 'mutated',\n\t\t\t\t\t\t\tobjectId: c.objectId,\n\t\t\t\t\t\t};\n\t\t\t\t\t\tif (objectType !== undefined) entry.objectType = objectType;\n\t\t\t\t\t\tif (c.outputState !== undefined) entry.outputState = c.outputState;\n\t\t\t\t\t\tif (c.idOperation !== undefined) entry.idOperation = c.idOperation;\n\t\t\t\t\t\treturn entry;\n\t\t\t\t\t});\n\n\t\t\t\tconst receipt: ActionReceipt = {\n\t\t\t\t\tdigest: txOk.digest,\n\t\t\t\t\tobjectChanges,\n\t\t\t\t\tbalanceChanges: [],\n\t\t\t\t};\n\t\t\t\treturn receipt;\n\t\t\t}),\n\t\t);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.action.signAndExecute', {\n\t\t\tattributes: { 'action.name': params.actionName },\n\t\t}),\n\t);\n"],"mappings":";;;;;AA0GA,MAAM,+BACL,YAEA,QACE,QAEC,WASA,OAAO,WAAW,YAClB,WAAW,QACX,OAAQ,OAA2C,aAAa,SACjE,CACA,KAAK,WAAW;CAChB,MAAM,QAEF;EACH,MAAM,OAAO,SAAS,aAAa,OAAO,SAAS,YAAY,YAAY;EAC3E,UAAU,OAAO;EACjB;AACD,KAAI,OAAO,OAAO,eAAe,SAAU,OAAM,aAAa,OAAO;AACrE,KAAI,OAAO,OAAO,gBAAgB,SAAU,OAAM,cAAc,OAAO;AACvE,KAAI,OAAO,OAAO,gBAAgB,SAAU,OAAM,cAAc,OAAO;AACvE,QAAO;EACN;AAEJ,MAAM,wBAAwB,QAAiC;CAC9D,QAAQ,GAAG;CACX,eAAe,4BAA4B,GAAG,cAAc;CAC5D,gBAAgB,GAAG;CACnB;;;;;;;;;;;;;;;;;;;;;;;;AA6BD,MAAa,kBAAkB,WAM9B,OAAO,IAAI,aAAa;CACvB,MAAM,EAAE,YAAY,KAAK,SAAS,UAAU;AAC5C,QAAO,OAAO,QAAQ,uBAAuB,iBAC5C,OAAO,IAAI,aAAa;EAEvB,MAAM,KAAK,IAAI,aAAa;AAC5B,KAAG,UAAU,QAAQ,QAAQ;AAC7B,SAAO,OAAO,IAAI;GACjB,WAAW,MAAM,GAAG;GACpB,QAAQ,UACP,YAAY,QAAQ;IACnB;IACA,SAAS,WAAW,WAAW;IAC/B;IACA,CAAC;GACH,CAAC;EAGF,MAAM,UACL,QAAQ,WAAW,gBAChB,OAAO,uCAAuC,IAAI,QAAQ,SAAS,IAAI,IAAI,KAAK,CAAC,KACjF,OAAO,UACL,UACA,YAAY,QAAQ;GACnB;GACA,SAAS,WAAW,WAAW,mDAAmD,MAAM,QAAQ;GAChG;GACA,CAAC,CACH,CACD,GACA,OAAO,OAAO,WAAW;GACzB,WACC,GAAG,MAAM,EACR,QAAQ,IAAI,IAAI,QAKhB,CAAC;GACH,QAAQ,UACP,YAAY,QAAQ;IACnB;IACA,SAAS,WAAW,WAAW,gCAC9B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACtD;IACD;IACA,CAAC;GACH,CAAC;AAEL,MAAI,QAAQ,WAAW,cAetB,QAAO,qBAAqB,OAdJ,aAAa,eAAe,QAAQ,CAAC,KAC5D,OAAO,UACL,UACA,YAAY,QAAQ;GACnB;GACA,SACC,WAAW,WAAW,wCAClB,QAAQ,KAAK,aAAa,QAAQ,QAAQ,KAC7C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAExD;GACA,CAAC,CACH,CACD,CACoC;EAItC,MAAM,SAAS,OAAO,aAAa,gBAAgB,QAAQ,CAAC,KAC3D,OAAO,UACL,UACA,YAAY,QAAQ;GACnB;GACA,SACC,WAAW,WAAW,yCAClB,QAAQ,KAAK,aAAa,QAAQ,QAAQ,KAC7C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAExD;GACA,CAAC,CACH,CACD;EAGD,MAAM,YAAY,IAAI,IAAI;EAmB1B,MAAM,MAAM,OAlBO,OAAO,WAAW;GACpC,WACC,UAAU,mBAAmB;IAC5B,aAAa;IACb,YAAY,CAAC,OAAO,UAAU;IAC9B,SAAS;KAAE,SAAS;KAAM,aAAa;KAAM;IAC7C,CAAC;GACH,QAAQ,UACP,YAAY,QAAQ;IACnB;IACA,SACC,WAAW,WAAW,oCACrB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IACxD;IACA,CAAC;GACH,CAAC;AAIF,MAAI,IAAI,UAAU,qBAAqB;GACtC,MAAM,eAAe,IAAI,mBAAmB;AAC5C,OAAI,iBAAiB,KAAA,EACpB,QAAO,OAAO,WAAW;IACxB,WAAW,UAAU,mBAAmB,EAAE,QAAQ,cAAc,CAAC;IACjE,QAAQ,UACP,YAAY,QAAQ;KACnB;KACA,SAAS,WAAW,WAAW,wBAAwB,aAAa;KACpE;KACA,CAAC;IACH,CAAC;AAEH,UAAO,OAAO,OAAO,KACpB,YAAY,QAAQ;IACnB;IACA,SACC,WAAW,WAAW,+BACX,IAAI,mBAAmB,UAAU,YAAY,KACrD,IAAI,mBAAmB,QAAQ,SAAS;IAC5C,CAAC,CACF;;EAEF,MAAM,OAAO,IAAI;AACjB,MAAI,MAAM,WAAW,KAAA,EACpB,QAAO,OAAO,OAAO,KACpB,YAAY,SAAS;GACpB;GACA,SAAS,WAAW,WAAW;GAC/B,CAAC,CACF;AAIF,SAAO,OAAO,WAAW;GACxB,WAAW,UAAU,mBAAmB,EAAE,QAAQ,KAAK,QAAS,CAAC;GACjE,QAAQ,UACP,YAAY,QAAQ;IACnB;IACA,SAAS,WAAW,WAAW,wBAAwB,KAAK,OAAO;IACnE;IACA,CAAC;GACH,CAAC;EAGF,MAAM,cAAc,KAAK,eAAe,EAAE;EAC1C,MAAM,iBACL,KAAK,SAAS,kBAAkB,EAAE,EAEjC,QACC,MACA,OAAO,EAAE,aAAa,SACvB,CACA,KAAK,MAAM;GACX,MAAM,aAAa,YAAY,EAAE;GACjC,MAAM,QAEF;IACH,MAAM,EAAE,gBAAgB,YAAY,YAAY;IAChD,UAAU,EAAE;IACZ;AACD,OAAI,eAAe,KAAA,EAAW,OAAM,aAAa;AACjD,OAAI,EAAE,gBAAgB,KAAA,EAAW,OAAM,cAAc,EAAE;AACvD,OAAI,EAAE,gBAAgB,KAAA,EAAW,OAAM,cAAc,EAAE;AACvD,UAAO;IACN;AAOH,SAAO;GAJN,QAAQ,KAAK;GACb;GACA,gBAAgB,EAAE;GAEL;GACb,CACF;EACA,CAAC,KACF,OAAO,SAAS,yCAAyC,EACxD,YAAY,EAAE,eAAe,OAAO,YAAY,EAChD,CAAC,CACF"}