@mysten-incubation/devstack 0.0.0

package/dist/plugins/seal/config-render.mjs

@@ -0,0 +1,82 @@
+import { atomicWriteFile } from "../../substrate/runtime/atomic-write.mjs";
+import { sealError } from "./errors.mjs";
+import { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from "./keygen.mjs";
+import { Effect } from "effect";
+//#region src/plugins/seal/config-render.ts
+const DEFAULT_TS_SDK_REQUIREMENT = ">=0.4.5";
+/** Render the key-server config yaml.
+*
+*  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.
+*  This is the "custom chain via node_url" discriminator the
+*  upstream binary expects when devstack supplies its own RPC. */
+const renderSealKeyServerConfig = (inputs) => {
+	const tsReq = inputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT;
+	return [
+		"network: !Devnet",
+		`  seal_package: "${inputs.sealPackageId}"`,
+		`node_url: "${inputs.nodeUrl}"`,
+		"server_mode: !Open",
+		`  key_server_object_id: "${inputs.keyServerObjectId}"`,
+		`ts_sdk_version_requirement: "${tsReq}"`,
+		""
+	].join("\n");
+};
+/** Render the docker `--env-file` body. Single `KEY=value` line.
+*  Distilled-doc invariant #3 — this is the ONLY path the master key
+*  reaches the container; inline `-e MASTER_KEY=…` would surface
+*  the secret in `docker inspect` and host process env. */
+const renderMasterKeyEnvFile = (masterKeyHex) => `MASTER_KEY=${masterKeyHex}\n`;
+const parseMasterKeyEnvFile = (body) => {
+	return /^MASTER_KEY=(0x)?([0-9a-fA-F]+)\s*$/m.exec(body)?.[2] ?? null;
+};
+/** Compose the two writes the local-keygen mode needs.
+*
+*  Writes:
+*
+*    - `${servicePath}/key-server-config.yaml` (mode 0o644 — public)
+*    - `${servicePath}/master-key.env`          (mode 0o600 — secret)
+*
+*  Parent dir is created with 0o700 (distilled-doc invariant #2).
+*  Both writes flow through the substrate's `atomicWriteFile`
+*  (tempfile + fsync + rename, never partial-write visible).
+*
+*  Distilled-doc invariant #4: `master-key.env` MUST NOT be unlinked
+*  on scope close (snapshot → restore round-trip retains the key).
+*  We do NOT register a finalizer here.
+*
+*  Error surface: `SealError({phase: 'config-render'})` wraps any
+*  underlying `AtomicWriteFailed`. The substrate's atomic write owns
+*  fsync + rename + cleanup semantics. */
+const stageSealConfig = (yamlBody, masterKeyHex, servicePath, name) => Effect.gen(function* () {
+	const configPath = `${servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;
+	const masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;
+	const yamlBytes = new TextEncoder().encode(yamlBody);
+	const envBytes = new TextEncoder().encode(renderMasterKeyEnvFile(masterKeyHex));
+	yield* atomicWriteFile(configPath, yamlBytes, {
+		mode: 420,
+		parentMode: 448
+	}).pipe(Effect.catch((cause) => Effect.fail(sealError("config-render", {
+		name,
+		message: `seal.config-render: failed to write ${KEY_SERVER_CONFIG_BASENAME} (${cause.stage})`,
+		cause
+	}))));
+	yield* atomicWriteFile(masterKeyEnvFile, envBytes, {
+		mode: 384,
+		parentMode: 448
+	}).pipe(Effect.catch((cause) => Effect.fail(sealError("config-render", {
+		name,
+		message: `seal.config-render: failed to write ${MASTER_KEY_ENVFILE_BASENAME} (${cause.stage})`,
+		cause
+	}))));
+	return {
+		configPath,
+		masterKeyEnvFile
+	};
+}).pipe(Effect.withSpan("devstack.plugin.seal.config-render.stage", { attributes: {
+	"seal.name": name,
+	"seal.servicePath": servicePath
+} }));
+//#endregion
+export { parseMasterKeyEnvFile, renderSealKeyServerConfig, stageSealConfig };
+
+//# sourceMappingURL=config-render.mjs.map

package/dist/plugins/seal/config-render.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-render.mjs","names":[],"sources":["../../../src/plugins/seal/config-render.ts"],"sourcesContent":["// Seal plugin — key-server-config.yaml renderer.\n//\n// Distilled-doc invariant #19: the `network: !Devnet` discriminator\n// is LOAD-BEARING. Env-only mode silently routes at the public\n// testnet fullnode regardless of `NODE_URL`; going through the\n// config file with the `!Devnet` discriminator binds the daemon to\n// the in-stack sui RPC.\n//\n// Distilled-doc invariant #20: the rendered file MUST land under\n// `runtime/seal/`, NOT a scoped temp dir. The substrate's\n// service-path resolver (`servicePath('seal')`) produces the host\n// path; we land both the yaml and the master-key env-file there.\n//\n// This file declares the renderer + the staging procedure. The\n// renderer is a pure string builder; the staging procedure uses the\n// substrate's atomic-write primitive (FileSystem-backed).\n\nimport { Effect, FileSystem } from 'effect';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\n\n// ---------------------------------------------------------------------------\n// Render inputs\n// ---------------------------------------------------------------------------\n\n/** Inputs the renderer consumes. The substrate provides the\n *  sui node URL (in-container DNS form, e.g. `http://sui-localnet:9000`)\n *  + the seal package id + the on-chain key-server object id. */\nexport interface SealKeyServerConfigInputs {\n\t/** Seal Move package id (from publish). */\n\treadonly sealPackageId: string;\n\t/** Sui RPC node URL as seen from inside the container's network. */\n\treadonly nodeUrl: string;\n\t/** On-chain `KeyServer` object id (from register). */\n\treadonly keyServerObjectId: string;\n\t/** Optional ts-sdk version requirement override. Default is the\n\t *  pin distilled from v3 (`'>=0.4.5'`); v2 plans expose this so\n\t *  consumers running older `@mysten/seal` aren't silently\n\t *  rejected. Distilled-doc opportunity #8. */\n\treadonly tsSdkVersionRequirement?: string;\n}\n\nexport interface ParsedSealKeyServerConfig {\n\treadonly sealPackageId: string;\n\treadonly nodeUrl: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst DEFAULT_TS_SDK_REQUIREMENT = '>=0.4.5';\n\n// ---------------------------------------------------------------------------\n// Render — pure string builder\n// ---------------------------------------------------------------------------\n\n/** Render the key-server config yaml.\n *\n *  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.\n *  This is the \"custom chain via node_url\" discriminator the\n *  upstream binary expects when devstack supplies its own RPC. */\nexport const renderSealKeyServerConfig = (inputs: SealKeyServerConfigInputs): string => {\n\tconst tsReq = inputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT;\n\treturn [\n\t\t'network: !Devnet',\n\t\t`  seal_package: \"${inputs.sealPackageId}\"`,\n\t\t`node_url: \"${inputs.nodeUrl}\"`,\n\t\t'server_mode: !Open',\n\t\t`  key_server_object_id: \"${inputs.keyServerObjectId}\"`,\n\t\t`ts_sdk_version_requirement: \"${tsReq}\"`,\n\t\t'',\n\t].join('\\n');\n};\n\n// ---------------------------------------------------------------------------\n// Master-key env-file body\n// ---------------------------------------------------------------------------\n\n/** Render the docker `--env-file` body. Single `KEY=value` line.\n *  Distilled-doc invariant #3 — this is the ONLY path the master key\n *  reaches the container; inline `-e MASTER_KEY=…` would surface\n *  the secret in `docker inspect` and host process env. */\nexport const renderMasterKeyEnvFile = (masterKeyHex: string): string =>\n\t`MASTER_KEY=${masterKeyHex}\\n`;\n\nconst readQuotedYamlField = (body: string, field: string): string | null => {\n\tconst escaped = field.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`(?:^|\\\\n)\\\\s*${escaped}:\\\\s*\"([^\"]+)\"\\\\s*(?:\\\\n|$)`).exec(body);\n\treturn match?.[1] ?? null;\n};\n\nexport const parseSealKeyServerConfig = (body: string): ParsedSealKeyServerConfig | null => {\n\tconst sealPackageId = readQuotedYamlField(body, 'seal_package');\n\tconst nodeUrl = readQuotedYamlField(body, 'node_url');\n\tconst keyServerObjectId = readQuotedYamlField(body, 'key_server_object_id');\n\tif (sealPackageId === null || nodeUrl === null || keyServerObjectId === null) {\n\t\treturn null;\n\t}\n\treturn { sealPackageId, nodeUrl, keyServerObjectId };\n};\n\nexport const parseMasterKeyEnvFile = (body: string): string | null => {\n\tconst match = /^MASTER_KEY=(0x)?([0-9a-fA-F]+)\\s*$/m.exec(body);\n\treturn match?.[2] ?? null;\n};\n\n// ---------------------------------------------------------------------------\n// Staging procedure — write yaml + env-file with proper mode bits\n// ---------------------------------------------------------------------------\n\n/** Compose the two writes the local-keygen mode needs.\n *\n *  Writes:\n *\n *    - `${servicePath}/key-server-config.yaml` (mode 0o644 — public)\n *    - `${servicePath}/master-key.env`          (mode 0o600 — secret)\n *\n *  Parent dir is created with 0o700 (distilled-doc invariant #2).\n *  Both writes flow through the substrate's `atomicWriteFile`\n *  (tempfile + fsync + rename, never partial-write visible).\n *\n *  Distilled-doc invariant #4: `master-key.env` MUST NOT be unlinked\n *  on scope close (snapshot → restore round-trip retains the key).\n *  We do NOT register a finalizer here.\n *\n *  Error surface: `SealError({phase: 'config-render'})` wraps any\n *  underlying `AtomicWriteFailed`. The substrate's atomic write owns\n *  fsync + rename + cleanup semantics. */\nexport const stageSealConfig = (\n\tyamlBody: string,\n\tmasterKeyHex: string,\n\tservicePath: string,\n\tname: string,\n): Effect.Effect<\n\t{\n\t\treadonly configPath: string;\n\t\treadonly masterKeyEnvFile: string;\n\t},\n\tSealError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tconst configPath = `${servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst yamlBytes = new TextEncoder().encode(yamlBody);\n\t\tconst envBytes = new TextEncoder().encode(renderMasterKeyEnvFile(masterKeyHex));\n\n\t\t// World-readable yaml (no secrets) inside 0o700 parent — the\n\t\t// daemon process inside the container reads via the bind-mount\n\t\t// so host-side mode bits don't fully matter, but 0o644 is the\n\t\t// least-surprising default for a non-secret config.\n\t\tyield* atomicWriteFile(configPath, yamlBytes, {\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${KEY_SERVER_CONFIG_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\t// SECRET — 0o600 inside the same 0o700 parent. Distilled-doc\n\t\t// §Hard requirements #2.\n\t\tyield* atomicWriteFile(masterKeyEnvFile, envBytes, {\n\t\t\tmode: 0o600,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${MASTER_KEY_ENVFILE_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\treturn { configPath, masterKeyEnvFile };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.config-render.stage', {\n\t\t\tattributes: { 'seal.name': name, 'seal.servicePath': servicePath },\n\t\t}),\n\t);\n"],"mappings":";;;;;AAkDA,MAAM,6BAA6B;;;;;;AAWnC,MAAa,6BAA6B,WAA8C;CACvF,MAAM,QAAQ,OAAO,2BAA2B;AAChD,QAAO;EACN;EACA,oBAAoB,OAAO,cAAc;EACzC,cAAc,OAAO,QAAQ;EAC7B;EACA,4BAA4B,OAAO,kBAAkB;EACrD,gCAAgC,MAAM;EACtC;EACA,CAAC,KAAK,KAAK;;;;;;AAWb,MAAa,0BAA0B,iBACtC,cAAc,aAAa;AAkB5B,MAAa,yBAAyB,SAAgC;AAErE,QADc,uCAAuC,KAAK,KAC9C,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;AAyBtB,MAAa,mBACZ,UACA,cACA,aACA,SASA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,GAAG,YAAY,GAAG;CACrC,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,YAAY,IAAI,aAAa,CAAC,OAAO,SAAS;CACpD,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,uBAAuB,aAAa,CAAC;AAM/E,QAAO,gBAAgB,YAAY,WAAW;EAC7C,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,2BAA2B,IAAI,MAAM,MAAM;EAC3F;EACA,CAAC,CACF,CACD,CACD;AAID,QAAO,gBAAgB,kBAAkB,UAAU;EAClD,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;EAC5F;EACA,CAAC,CACF,CACD,CACD;AAED,QAAO;EAAE;EAAY;EAAkB;EACtC,CAAC,KACF,OAAO,SAAS,4CAA4C,EAC3D,YAAY;CAAE,aAAa;CAAM,oBAAoB;CAAa,EAClE,CAAC,CACF"}

package/dist/plugins/seal/deploy.mjs

@@ -0,0 +1,198 @@
+import { contentHash } from "../../substrate/brand.mjs";
+import { hashMoveSources, runMoveBuild, scrubLocksHost } from "../../substrate/runtime/sui-move-build/index.mjs";
+import { sealError } from "./errors.mjs";
+import { decodeHex } from "./keygen.mjs";
+import { executeSuiTx } from "../../substrate/runtime/sui-execute/index.mjs";
+import { Effect, Schema } from "effect";
+import { createHash } from "node:crypto";
+import { Transaction } from "@mysten/sui/transactions";
+//#region src/plugins/seal/deploy.ts
+const KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;
+const sealProduceFailed = (op, err) => ({
+	_tag: "ArtifactPublishError",
+	reason: "produce-failed",
+	detail: `seal.${op} ${err.phase}: ${err.message}`
+});
+const moveBuildToSealError = (name, err) => sealError("publish", {
+	name,
+	message: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,
+	cause: err
+});
+const verifyObjectLenient = (probe, objectId, schema) => probe.get({
+	kind: "object",
+	objectId
+}, schema, "lenient").pipe(Effect.catch(() => Effect.succeed(null)));
+const SEAL_PACKAGE_NAMESPACE = "seal/package";
+const SealPackageVerifyShape = Schema.Struct({
+	objectId: Schema.String,
+	type: Schema.optional(Schema.Unknown)
+});
+const sealPackageInputsHash = (sourceHash, signerAddress) => contentHash(`seal-package|source=${sourceHash}|signer=${signerAddress}`);
+const publishTransactionBuilder = (tx) => ({
+	setSender: (address) => tx.setSender(address),
+	publish: (input) => tx.publish({
+		modules: input.modules.map((m) => [...m]),
+		dependencies: [...input.dependencies]
+	}),
+	transferObjects: (objects, recipient) => tx.transferObjects([...objects], recipient)
+});
+const buildSealPublishTransaction = (tx, buildOutput, signerAddress) => {
+	tx.setSender(signerAddress);
+	const upgradeCap = tx.publish({
+		modules: buildOutput.modules.map((m) => Array.from(m)),
+		dependencies: [...buildOutput.dependencies]
+	});
+	tx.transferObjects([upgradeCap], signerAddress);
+};
+const pickPackageWriteObjectId = (receipt) => receipt.objectChanges.find((change) => change.outputState === "PackageWrite")?.objectId ?? null;
+const pickUpgradeCapObjectId = (receipt) => receipt.objectChanges.find((change) => change.idOperation === "Created" && (change.objectType?.endsWith("::package::UpgradeCap") ?? false))?.objectId ?? null;
+const projectSealPublishReceipt = (name, receipt) => {
+	const packageId = pickPackageWriteObjectId(receipt);
+	if (packageId === null) return Effect.fail(sealError("publish", {
+		name,
+		message: `seal publish tx wrote no PackageWrite object (digest=${receipt.digest})`
+	}));
+	const upgradeCapId = pickUpgradeCapObjectId(receipt);
+	return Effect.succeed({
+		packageId,
+		...upgradeCapId !== null ? { upgradeCapId } : {}
+	});
+};
+const runSealPublishTransaction = (inputs) => Effect.gen(function* () {
+	yield* scrubLocksHost(inputs.movePackagePath, "~/.move", { packageLockFailures: inputs.buildImage !== void 0 ? "best-effort" : "fatal" }).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
+	const buildOutput = yield* runMoveBuild({
+		sourcePath: inputs.movePackagePath,
+		packageName: inputs.name,
+		chainId: inputs.chain,
+		runtime: inputs.runtime,
+		...inputs.buildImage !== void 0 ? { buildImage: inputs.buildImage } : {}
+	}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
+	const receipt = yield* executeSuiTx({
+		client: inputs.sdk.client,
+		signer: inputs.signer,
+		build: async () => {
+			const tx = new Transaction();
+			buildSealPublishTransaction(publishTransactionBuilder(tx), buildOutput, inputs.signer.address);
+			return tx.build({ client: inputs.sdk.client });
+		}
+	}).pipe(Effect.mapError((cause) => sealError("publish", {
+		name: inputs.name,
+		message: `seal publish tx failed for signer '${inputs.signer.name}' (address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,
+		cause
+	})));
+	return yield* projectSealPublishReceipt(inputs.name, receipt);
+}).pipe(Effect.withSpan("devstack.plugin.seal.publish.suiTx", { attributes: {
+	"seal.name": inputs.name,
+	"seal.signer": inputs.signer.address
+} }));
+const publishSealPackage = (publisher, inputs) => Effect.gen(function* () {
+	const inputsHash = sealPackageInputsHash(yield* hashMoveSources(inputs.movePackagePath).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err))), inputs.signer.address);
+	const result = yield* publisher.publish({
+		namespace: SEAL_PACKAGE_NAMESPACE,
+		chain: inputs.chain,
+		contentHash: inputsHash,
+		verifySchema: SealPackageVerifyShape,
+		verify: (cached) => verifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),
+		produce: runSealPublishTransaction(inputs).pipe(Effect.mapError((err) => sealProduceFailed("publish", err))),
+		register: () => Effect.void
+	});
+	const packageId = "packageId" in result ? result.packageId : result.objectId;
+	if (!packageId) return yield* Effect.fail(sealError("publish", {
+		name: inputs.name,
+		message: "seal.deploy.publishSealPackage: publisher returned no package id"
+	}));
+	return { packageId };
+}).pipe(Effect.withSpan("devstack.plugin.seal.publish", { attributes: {
+	"seal.name": inputs.name,
+	"seal.chain": inputs.chain
+} }));
+const SEAL_KEY_SERVER_NAMESPACE = "seal/key-server-id";
+const SealKeyServerVerifyShape = Schema.Struct({
+	objectId: Schema.String,
+	type: Schema.optional(Schema.Unknown)
+});
+const sealRegisterInputsHash = (inputs, signerAddress) => contentHash(`seal-register-v2|${createHash("sha256").update(JSON.stringify({
+	packageId: inputs.sealPackageId,
+	keyServerUrl: inputs.keyServerUrl,
+	keyServerName: inputs.keyServerName,
+	publicKeyHex: inputs.publicKeyHex,
+	signerAddress
+})).digest("hex")}`);
+const registerTransactionBuilder = (tx) => ({
+	pure: {
+		string: (value) => tx.pure.string(value),
+		u8: (value) => tx.pure.u8(value),
+		vector: (type, value) => tx.pure.vector(type, [...value])
+	},
+	setSender: (address) => tx.setSender(address),
+	moveCall: (input) => tx.moveCall({
+		target: input.target,
+		arguments: [...input.arguments]
+	})
+});
+const buildRegisterKeyServerMoveCall = (tx, inputs, signerAddress) => {
+	const pkBytes = decodeHex(inputs.publicKeyHex);
+	tx.setSender(signerAddress);
+	tx.moveCall({
+		target: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,
+		arguments: [
+			tx.pure.string(inputs.keyServerName),
+			tx.pure.string(inputs.keyServerUrl),
+			tx.pure.u8(KEY_TYPE_BONEH_FRANKLIN_BLS12381),
+			tx.pure.vector("u8", Array.from(pkBytes))
+		]
+	});
+};
+const pickCreatedKeyServerObjectId = (receipt) => receipt.objectChanges.find((change) => change.idOperation === "Created" && (change.objectType?.endsWith("::key_server::KeyServer") ?? false))?.objectId ?? null;
+const projectRegisterKeyServerReceipt = (name, receipt) => {
+	const objectId = pickCreatedKeyServerObjectId(receipt);
+	if (objectId === null) return Effect.fail(sealError("register", {
+		name,
+		message: `seal register tx created no ::key_server::KeyServer object (digest=${receipt.digest})`
+	}));
+	return Effect.succeed({ objectId });
+};
+const runRegisterKeyServerTransaction = (sdk, signer, inputs) => Effect.gen(function* () {
+	const receipt = yield* executeSuiTx({
+		client: sdk.client,
+		signer,
+		build: async () => {
+			const tx = new Transaction();
+			buildRegisterKeyServerMoveCall(registerTransactionBuilder(tx), inputs, signer.address);
+			return tx.build({ client: sdk.client });
+		}
+	}).pipe(Effect.mapError((cause) => sealError("register", {
+		name: inputs.name,
+		message: `seal register tx failed for signer '${signer.name}' (address=${signer.address}) during ${cause.phase}: ${cause.message}`,
+		cause
+	})));
+	return yield* projectRegisterKeyServerReceipt(inputs.name, receipt);
+}).pipe(Effect.withSpan("devstack.plugin.seal.register.suiTx", { attributes: {
+	"seal.name": inputs.name,
+	"seal.url": inputs.keyServerUrl
+} }));
+const registerKeyServer = (publisher, inputs) => Effect.gen(function* () {
+	const inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);
+	const result = yield* publisher.publish({
+		namespace: SEAL_KEY_SERVER_NAMESPACE,
+		chain: inputs.chain,
+		contentHash: inputsHash,
+		verifySchema: SealKeyServerVerifyShape,
+		verify: (cached) => verifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),
+		produce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(Effect.mapError((err) => sealProduceFailed("register", err))),
+		register: () => Effect.void
+	});
+	const objectId = "objectId" in result ? result.objectId : void 0;
+	if (!objectId) return yield* Effect.fail(sealError("register", {
+		name: inputs.name,
+		message: "seal.deploy.registerKeyServer: publisher returned no objectId"
+	}));
+	return { objectId };
+}).pipe(Effect.withSpan("devstack.plugin.seal.register", { attributes: {
+	"seal.name": inputs.name,
+	"seal.url": inputs.keyServerUrl
+} }));
+//#endregion
+export { publishSealPackage, registerKeyServer };
+
+//# sourceMappingURL=deploy.mjs.map

package/dist/plugins/seal/deploy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../src/plugins/seal/deploy.ts"],"sourcesContent":["// Seal plugin — SDK-backed Move publish + on-chain KeyServer register.\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport {\n\tTransaction,\n\ttype TransactionArgument,\n\ttype TransactionObjectArgument,\n} from '@mysten/sui/transactions';\n\nimport type { ChainProbe, ChainProbeSchema } from '../../contracts/chain-probe.ts';\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport { contentHash, type ChainId, type ContentHash } from '../../substrate/brand.ts';\nimport {\n\texecuteSuiTx,\n\ttype ExecutedReceipt,\n\ttype SuiExecuteClient,\n} from '../../substrate/runtime/sui-execute/index.ts';\nimport {\n\thashMoveSources,\n\trunMoveBuild,\n\tscrubLocksHost,\n\ttype BuildOutput,\n\ttype MoveBuildError,\n} from '../../substrate/runtime/sui-move-build/index.ts';\nimport type { AccountValue } from '../account/service.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { decodeHex } from './keygen.ts';\n\nconst KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;\n\nexport type SealObjectProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport interface SealSuiSdk {\n\treadonly client: unknown;\n}\n\nconst sealProduceFailed = (op: 'publish' | 'register', err: SealError): ArtifactPublishError => ({\n\t_tag: 'ArtifactPublishError',\n\treason: 'produce-failed',\n\tdetail: `seal.${op} ${err.phase}: ${err.message}`,\n});\n\nconst moveBuildToSealError = (name: string, err: MoveBuildError): SealError =>\n\tsealError('publish', {\n\t\tname,\n\t\tmessage: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,\n\t\tcause: err,\n\t});\n\nconst verifyObjectLenient = <Verified>(\n\tprobe: ChainProbe<SealObjectProbeKey>,\n\tobjectId: string,\n\tschema: ChainProbeSchema<Verified>,\n): Effect.Effect<Verified | null, never> =>\n\tprobe\n\t\t.get({ kind: 'object', objectId }, schema, 'lenient')\n\t\t.pipe(Effect.catch(() => Effect.succeed(null as Verified | null)));\n\n// ---------------------------------------------------------------------------\n// Move publish — `sealPackage` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_PACKAGE_NAMESPACE = 'seal/package' as const;\n\nexport interface SealPackageCached {\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n}\n\nexport const SealPackageVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealPackageVerified = Schema.Schema.Type<typeof SealPackageVerifyShape>;\n\nexport interface SealPublishInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly movePackagePath: string;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly runtime: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealPackageInputsHash = (\n\tsourceHash: ContentHash,\n\tsignerAddress: string,\n): ContentHash => contentHash(`seal-package|source=${sourceHash}|signer=${signerAddress}`);\n\nexport const parseSealPublishOutput = (stdout: string): SealPackageCached | null => {\n\tconst re = /(?:^|\\n)\\s*(?:package_id|packageId)\\s*[:=]\\s*(0x[0-9a-fA-F]+)/;\n\tconst m = re.exec(stdout);\n\tif (!m?.[1]) return null;\n\treturn { packageId: m[1] };\n};\n\nexport interface SealPublishTransactionBuilder<TUpgradeCap = unknown> {\n\treadonly setSender: (address: string) => void;\n\treadonly publish: (input: {\n\t\treadonly modules: ReadonlyArray<ReadonlyArray<number>>;\n\t\treadonly dependencies: ReadonlyArray<string>;\n\t}) => TUpgradeCap;\n\treadonly transferObjects: (objects: ReadonlyArray<TUpgradeCap>, recipient: string) => void;\n}\n\nconst publishTransactionBuilder = (\n\ttx: Transaction,\n): SealPublishTransactionBuilder<TransactionObjectArgument> => ({\n\tsetSender: (address) => tx.setSender(address),\n\tpublish: (input) =>\n\t\ttx.publish({\n\t\t\tmodules: input.modules.map((m) => [...m]),\n\t\t\tdependencies: [...input.dependencies],\n\t\t}),\n\ttransferObjects: (objects, recipient) => tx.transferObjects([...objects], recipient),\n});\n\nexport const buildSealPublishTransaction = <TUpgradeCap>(\n\ttx: SealPublishTransactionBuilder<TUpgradeCap>,\n\tbuildOutput: BuildOutput,\n\tsignerAddress: string,\n): void => {\n\ttx.setSender(signerAddress);\n\tconst upgradeCap = tx.publish({\n\t\tmodules: buildOutput.modules.map((m) => Array.from(m)),\n\t\tdependencies: [...buildOutput.dependencies],\n\t});\n\ttx.transferObjects([upgradeCap], signerAddress);\n};\n\nexport const pickPackageWriteObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find((change) => change.outputState === 'PackageWrite')?.objectId ?? null;\n\nexport const pickUpgradeCapObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectSealPublishReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealPackageCached, SealError> => {\n\tconst packageId = pickPackageWriteObjectId(receipt);\n\tif (packageId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('publish', {\n\t\t\t\tname,\n\t\t\t\tmessage: `seal publish tx wrote no PackageWrite object ` + `(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\tconst upgradeCapId = pickUpgradeCapObjectId(receipt);\n\treturn Effect.succeed({\n\t\tpackageId,\n\t\t...(upgradeCapId !== null ? { upgradeCapId } : {}),\n\t});\n};\n\nexport const runSealPublishTransaction = (\n\tinputs: SealPublishInputs,\n): Effect.Effect<SealPackageCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// The one-shot build path scrubs the mounted package again. Seal's\n\t\t// default source is a shared cache, so a prior container build can\n\t\t// leave Move.lock unwritable to the host.\n\t\tyield* scrubLocksHost(inputs.movePackagePath, '~/.move', {\n\t\t\tpackageLockFailures: inputs.buildImage !== undefined ? 'best-effort' : 'fatal',\n\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\n\t\tconst buildOutput = yield* runMoveBuild({\n\t\t\tsourcePath: inputs.movePackagePath,\n\t\t\tpackageName: inputs.name,\n\t\t\tchainId: inputs.chain,\n\t\t\truntime: inputs.runtime,\n\t\t\t...(inputs.buildImage !== undefined ? { buildImage: inputs.buildImage } : {}),\n\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\n\t\tconst receipt = yield* executeSuiTx({\n\t\t\tclient: inputs.sdk.client as SuiExecuteClient,\n\t\t\tsigner: inputs.signer,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildSealPublishTransaction(\n\t\t\t\t\tpublishTransactionBuilder(tx),\n\t\t\t\t\tbuildOutput,\n\t\t\t\t\tinputs.signer.address,\n\t\t\t\t);\n\t\t\t\treturn tx.build({\n\t\t\t\t\tclient: inputs.sdk.client as Parameters<typeof tx.build>[0] extends\n\t\t\t\t\t\t| { client?: infer C }\n\t\t\t\t\t\t| undefined\n\t\t\t\t\t\t? C\n\t\t\t\t\t\t: never,\n\t\t\t\t});\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx failed for signer '${inputs.signer.name}' ` +\n\t\t\t\t\t\t`(address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\n\t\treturn yield* projectSealPublishReceipt(inputs.name, receipt);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish.suiTx', {\n\t\t\tattributes: {\n\t\t\t\t'seal.name': inputs.name,\n\t\t\t\t'seal.signer': inputs.signer.address,\n\t\t\t},\n\t\t}),\n\t);\n\nexport const publishSealPackage = (\n\tpublisher: ArtifactPublisher,\n\tinputs: SealPublishInputs,\n): Effect.Effect<{ readonly packageId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst sourceHash = yield* hashMoveSources(inputs.movePackagePath).pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\t\tconst inputsHash = sealPackageInputsHash(sourceHash, inputs.signer.address);\n\n\t\tconst result = yield* publisher.publish<SealPackageCached, SealPackageVerified>({\n\t\t\tnamespace: SEAL_PACKAGE_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverifySchema: SealPackageVerifyShape,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),\n\t\t\tproduce: runSealPublishTransaction(inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('publish', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\tconst packageId = 'packageId' in result ? result.packageId : result.objectId;\n\t\tif (!packageId) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage: 'seal.deploy.publishSealPackage: publisher returned no package id',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn { packageId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish', {\n\t\t\tattributes: { 'seal.name': inputs.name, 'seal.chain': inputs.chain },\n\t\t}),\n\t);\n\n// ---------------------------------------------------------------------------\n// KeyServer register — `keyServer` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_KEY_SERVER_NAMESPACE = 'seal/key-server-id' as const;\n\nexport interface SealKeyServerCached {\n\treadonly objectId: string;\n}\n\nexport const SealKeyServerVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealKeyServerVerified = Schema.Schema.Type<typeof SealKeyServerVerifyShape>;\n\nexport interface RegisterKeyServerTransactionInputs {\n\treadonly keyServerUrl: string;\n\treadonly sealPackageId: string;\n\treadonly publicKeyHex: string;\n\treadonly keyServerName: string;\n}\n\nexport interface RegisterKeyServerInputs extends RegisterKeyServerTransactionInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealRegisterInputsHash = (\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): ContentHash =>\n\t// Keep the cache key path-safe and bounded. The raw material includes\n\t// a routed URL plus a long BLS public key; using it directly made the\n\t// best-effort cache write miss on normal restarts.\n\tcontentHash(\n\t\t`seal-register-v2|${createHash('sha256')\n\t\t\t.update(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\tpackageId: inputs.sealPackageId,\n\t\t\t\t\tkeyServerUrl: inputs.keyServerUrl,\n\t\t\t\t\tkeyServerName: inputs.keyServerName,\n\t\t\t\t\tpublicKeyHex: inputs.publicKeyHex,\n\t\t\t\t\tsignerAddress,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.digest('hex')}`,\n\t);\n\nexport const parseRegisterKeyServerOutput = (stdout: string): SealKeyServerCached | null => {\n\tconst re =\n\t\t/(?:^|\\n)\\s*(?:key_server_object_id|object_id|objectId|key_server_id)\\s*[:=]\\s*(0x[0-9a-fA-F]+)/;\n\tconst m = re.exec(stdout);\n\tif (!m?.[1]) return null;\n\treturn { objectId: m[1] };\n};\n\nexport interface SealRegisterTransactionBuilder<TArgument = unknown> {\n\treadonly pure: {\n\t\treadonly string: (value: string) => TArgument;\n\t\treadonly u8: (value: number) => TArgument;\n\t\treadonly vector: (type: 'u8', value: ReadonlyArray<number>) => TArgument;\n\t};\n\treadonly setSender: (address: string) => void;\n\treadonly moveCall: (input: {\n\t\treadonly target: string;\n\t\treadonly arguments: ReadonlyArray<TArgument>;\n\t}) => unknown;\n}\n\nexport type SealRegisterSdk = SealSuiSdk;\n\nconst registerTransactionBuilder = (\n\ttx: Transaction,\n): SealRegisterTransactionBuilder<TransactionArgument> => ({\n\tpure: {\n\t\tstring: (value) => tx.pure.string(value),\n\t\tu8: (value) => tx.pure.u8(value),\n\t\tvector: (type, value) => tx.pure.vector(type, [...value]),\n\t},\n\tsetSender: (address) => tx.setSender(address),\n\tmoveCall: (input) =>\n\t\ttx.moveCall({\n\t\t\ttarget: input.target,\n\t\t\targuments: [...input.arguments],\n\t\t}),\n});\n\nexport const buildRegisterKeyServerMoveCall = <TArgument>(\n\ttx: SealRegisterTransactionBuilder<TArgument>,\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): void => {\n\tconst pkBytes = decodeHex(inputs.publicKeyHex);\n\ttx.setSender(signerAddress);\n\ttx.moveCall({\n\t\ttarget: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,\n\t\targuments: [\n\t\t\ttx.pure.string(inputs.keyServerName),\n\t\t\ttx.pure.string(inputs.keyServerUrl),\n\t\t\ttx.pure.u8(KEY_TYPE_BONEH_FRANKLIN_BLS12381),\n\t\t\ttx.pure.vector('u8', Array.from(pkBytes)),\n\t\t],\n\t});\n};\n\nexport const pickCreatedKeyServerObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::key_server::KeyServer') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectRegisterKeyServerReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealKeyServerCached, SealError> => {\n\tconst objectId = pickCreatedKeyServerObjectId(receipt);\n\tif (objectId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('register', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal register tx created no ::key_server::KeyServer object ` +\n\t\t\t\t\t`(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({ objectId });\n};\n\nexport const runRegisterKeyServerTransaction = (\n\tsdk: SealRegisterSdk,\n\tsigner: AccountValue,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<SealKeyServerCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst receipt = yield* executeSuiTx({\n\t\t\tclient: sdk.client as SuiExecuteClient,\n\t\t\tsigner,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildRegisterKeyServerMoveCall(registerTransactionBuilder(tx), inputs, signer.address);\n\t\t\t\treturn tx.build({\n\t\t\t\t\tclient: sdk.client as Parameters<typeof tx.build>[0] extends\n\t\t\t\t\t\t| { client?: infer C }\n\t\t\t\t\t\t| undefined\n\t\t\t\t\t\t? C\n\t\t\t\t\t\t: never,\n\t\t\t\t});\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx failed for signer '${signer.name}' ` +\n\t\t\t\t\t\t`(address=${signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\n\t\treturn yield* projectRegisterKeyServerReceipt(inputs.name, receipt);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register.suiTx', {\n\t\t\tattributes: { 'seal.name': inputs.name, 'seal.url': inputs.keyServerUrl },\n\t\t}),\n\t);\n\nexport const registerKeyServer = (\n\tpublisher: ArtifactPublisher,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<{ readonly objectId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);\n\t\tconst result = yield* publisher.publish<SealKeyServerCached, SealKeyServerVerified>({\n\t\t\tnamespace: SEAL_KEY_SERVER_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverifySchema: SealKeyServerVerifyShape,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),\n\t\t\tproduce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('register', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\tconst objectId = 'objectId' in result ? result.objectId : undefined;\n\t\tif (!objectId) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage: 'seal.deploy.registerKeyServer: publisher returned no objectId',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn { objectId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register', {\n\t\t\tattributes: { 'seal.name': inputs.name, 'seal.url': inputs.keyServerUrl },\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;AAmCA,MAAM,mCAAmC;AAQzC,MAAM,qBAAqB,IAA4B,SAA0C;CAChG,MAAM;CACN,QAAQ;CACR,QAAQ,QAAQ,GAAG,GAAG,IAAI,MAAM,IAAI,IAAI;CACxC;AAED,MAAM,wBAAwB,MAAc,QAC3C,UAAU,WAAW;CACpB;CACA,SAAS,gBAAgB,IAAI,MAAM,sBAAsB,IAAI,WAAW,KAAK,IAAI;CACjF,OAAO;CACP,CAAC;AAEH,MAAM,uBACL,OACA,UACA,WAEA,MACE,IAAI;CAAE,MAAM;CAAU;CAAU,EAAE,QAAQ,UAAU,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAwB,CAAC,CAAC;AAMpE,MAAa,yBAAyB;AAOtC,MAAa,yBAAyB,OAAO,OAAO;CACnD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAcF,MAAa,yBACZ,YACA,kBACiB,YAAY,uBAAuB,WAAW,UAAU,gBAAgB;AAkB1F,MAAM,6BACL,QAC+D;CAC/D,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,UAAU,UACT,GAAG,QAAQ;EACV,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;EACzC,cAAc,CAAC,GAAG,MAAM,aAAa;EACrC,CAAC;CACH,kBAAkB,SAAS,cAAc,GAAG,gBAAgB,CAAC,GAAG,QAAQ,EAAE,UAAU;CACpF;AAED,MAAa,+BACZ,IACA,aACA,kBACU;AACV,IAAG,UAAU,cAAc;CAC3B,MAAM,aAAa,GAAG,QAAQ;EAC7B,SAAS,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC;EACtD,cAAc,CAAC,GAAG,YAAY,aAAa;EAC3C,CAAC;AACF,IAAG,gBAAgB,CAAC,WAAW,EAAE,cAAc;;AAGhD,MAAa,4BAA4B,YACxC,QAAQ,cAAc,MAAM,WAAW,OAAO,gBAAgB,eAAe,EAAE,YAAY;AAE5F,MAAa,0BAA0B,YACtC,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,wBAAwB,IAAI,OAC1D,EAAE,YAAY;AAEhB,MAAa,6BACZ,MACA,YACiD;CACjD,MAAM,YAAY,yBAAyB,QAAQ;AACnD,KAAI,cAAc,KACjB,QAAO,OAAO,KACb,UAAU,WAAW;EACpB;EACA,SAAS,wDAA6D,QAAQ,OAAO;EACrF,CAAC,CACF;CAEF,MAAM,eAAe,uBAAuB,QAAQ;AACpD,QAAO,OAAO,QAAQ;EACrB;EACA,GAAI,iBAAiB,OAAO,EAAE,cAAc,GAAG,EAAE;EACjD,CAAC;;AAGH,MAAa,6BACZ,WAEA,OAAO,IAAI,aAAa;AAIvB,QAAO,eAAe,OAAO,iBAAiB,WAAW,EACxD,qBAAqB,OAAO,eAAe,KAAA,IAAY,gBAAgB,SACvE,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAAC;CAEzE,MAAM,cAAc,OAAO,aAAa;EACvC,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,SAAS,OAAO;EAChB,GAAI,OAAO,eAAe,KAAA,IAAY,EAAE,YAAY,OAAO,YAAY,GAAG,EAAE;EAC5E,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAAC;CAEzE,MAAM,UAAU,OAAO,aAAa;EACnC,QAAQ,OAAO,IAAI;EACnB,QAAQ,OAAO;EACf,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,+BACC,0BAA0B,GAAG,EAC7B,aACA,OAAO,OAAO,QACd;AACD,UAAO,GAAG,MAAM,EACf,QAAQ,OAAO,IAAI,QAKnB,CAAC;;EAEH,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sCAAsC,OAAO,OAAO,KAAK,aAC7C,OAAO,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD;AAED,QAAO,OAAO,0BAA0B,OAAO,MAAM,QAAQ;EAC5D,CAAC,KACF,OAAO,SAAS,sCAAsC,EACrD,YAAY;CACX,aAAa,OAAO;CACpB,eAAe,OAAO,OAAO;CAC7B,EACD,CAAC,CACF;AAEF,MAAa,sBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,aAAa,sBAAsB,OAHf,gBAAgB,OAAO,gBAAgB,CAAC,KACjE,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAChE,EACoD,OAAO,OAAO,QAAQ;CAE3E,MAAM,SAAS,OAAO,UAAU,QAAgD;EAC/E,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,cAAc;EACd,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,WAAW,uBAAuB;EACjF,SAAS,0BAA0B,OAAO,CAAC,KAC1C,OAAO,UAAU,QAAQ,kBAAkB,WAAW,IAAI,CAAC,CAC3D;EACD,gBAAgB,OAAO;EACvB,CAAC;CAEF,MAAM,YAAY,eAAe,SAAS,OAAO,YAAY,OAAO;AACpE,KAAI,CAAC,UACJ,QAAO,OAAO,OAAO,KACpB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SAAS;EACT,CAAC,CACF;AAEF,QAAO,EAAE,WAAW;EACnB,CAAC,KACF,OAAO,SAAS,gCAAgC,EAC/C,YAAY;CAAE,aAAa,OAAO;CAAM,cAAc,OAAO;CAAO,EACpE,CAAC,CACF;AAMF,MAAa,4BAA4B;AAMzC,MAAa,2BAA2B,OAAO,OAAO;CACrD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAkBF,MAAa,0BACZ,QACA,kBAKA,YACC,oBAAoB,WAAW,SAAS,CACtC,OACA,KAAK,UAAU;CACd,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,eAAe,OAAO;CACtB,cAAc,OAAO;CACrB;CACA,CAAC,CACF,CACA,OAAO,MAAM,GACf;AAyBF,MAAM,8BACL,QAC0D;CAC1D,MAAM;EACL,SAAS,UAAU,GAAG,KAAK,OAAO,MAAM;EACxC,KAAK,UAAU,GAAG,KAAK,GAAG,MAAM;EAChC,SAAS,MAAM,UAAU,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC;EACzD;CACD,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,WAAW,UACV,GAAG,SAAS;EACX,QAAQ,MAAM;EACd,WAAW,CAAC,GAAG,MAAM,UAAU;EAC/B,CAAC;CACH;AAED,MAAa,kCACZ,IACA,QACA,kBACU;CACV,MAAM,UAAU,UAAU,OAAO,aAAa;AAC9C,IAAG,UAAU,cAAc;AAC3B,IAAG,SAAS;EACX,QAAQ,GAAG,OAAO,cAAc;EAChC,WAAW;GACV,GAAG,KAAK,OAAO,OAAO,cAAc;GACpC,GAAG,KAAK,OAAO,OAAO,aAAa;GACnC,GAAG,KAAK,GAAG,iCAAiC;GAC5C,GAAG,KAAK,OAAO,MAAM,MAAM,KAAK,QAAQ,CAAC;GACzC;EACD,CAAC;;AAGH,MAAa,gCAAgC,YAC5C,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,0BAA0B,IAAI,OAC5D,EAAE,YAAY;AAEhB,MAAa,mCACZ,MACA,YACmD;CACnD,MAAM,WAAW,6BAA6B,QAAQ;AACtD,KAAI,aAAa,KAChB,QAAO,OAAO,KACb,UAAU,YAAY;EACrB;EACA,SACC,sEACW,QAAQ,OAAO;EAC3B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;;AAGpC,MAAa,mCACZ,KACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,aAAa;EACnC,QAAQ,IAAI;EACZ;EACA,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,kCAA+B,2BAA2B,GAAG,EAAE,QAAQ,OAAO,QAAQ;AACtF,UAAO,GAAG,MAAM,EACf,QAAQ,IAAI,QAKZ,CAAC;;EAEH,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uCAAuC,OAAO,KAAK,aACvC,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EAC7D;EACA,CAAC,CACF,CACD;AAED,QAAO,OAAO,gCAAgC,OAAO,MAAM,QAAQ;EAClE,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY;CAAE,aAAa,OAAO;CAAM,YAAY,OAAO;CAAc,EACzE,CAAC,CACF;AAEF,MAAa,qBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,uBAAuB,QAAQ,OAAO,OAAO,QAAQ;CACxE,MAAM,SAAS,OAAO,UAAU,QAAoD;EACnF,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,cAAc;EACd,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,UAAU,yBAAyB;EAClF,SAAS,gCAAgC,OAAO,KAAK,OAAO,QAAQ,OAAO,CAAC,KAC3E,OAAO,UAAU,QAAQ,kBAAkB,YAAY,IAAI,CAAC,CAC5D;EACD,gBAAgB,OAAO;EACvB,CAAC;CAEF,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW,KAAA;AAC1D,KAAI,CAAC,SACJ,QAAO,OAAO,OAAO,KACpB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SAAS;EACT,CAAC,CACF;AAEF,QAAO,EAAE,UAAU;EAClB,CAAC,KACF,OAAO,SAAS,iCAAiC,EAChD,YAAY;CAAE,aAAa,OAAO;CAAM,YAAY,OAAO;CAAc,EACzE,CAAC,CACF"}

package/dist/plugins/seal/errors.d.mts

@@ -0,0 +1,52 @@
+import { ConfigIssue } from "../../substrate/runtime/config-validation.mjs";
+import { ForkIncompatibleError } from "../../substrate/runtime/mode-errors.mjs";
+
+//#region src/plugins/seal/errors.d.ts
+/** Phases for `SealError`. Closed sum — matches the v3 catalog
+ *  (07-seal.md §"Adjacent Seal references" → `engine/phases.ts:79-91`).
+ *
+ *  Phase semantics:
+ *   - `port-alloc`     — router `seal` entrypoint not registered.
+ *   - `image`          — image build / pull failed (bootstrap-asset
+ *                        cargo step).
+ *   - `keygen`         — `seal-cli genkey` container failed OR stdout
+ *                        parse failed.
+ *   - `publish`        — Move publish of the seal contracts failed.
+ *   - `register`       — `KeyServer::create_and_transfer_v2_independent_server`
+ *                        Move call failed OR object id parse failed.
+ *   - `config-render`  — key-server-config.yaml / master-key.env write
+ *                        failed (FS perms, disk full).
+ *   - `container`      — long-running key-server container start failed.
+ *   - `ready`          — /health probe timed out.
+ *   - `rotate`         — master-key rotation pipeline failed (sub-phase
+ *                        is in the `cause` chain).
+ *   - `seal`           — generic catch-all for non-phaseable failures. */
+type SealPhase = 'port-alloc' | 'image' | 'keygen' | 'publish' | 'register' | 'config-render' | 'container' | 'ready' | 'rotate' | 'seal';
+/** Generic Seal plugin error. The structured shape mirrors the v3
+ *  `SealError` from `engine/errors.ts:325-341` minus the dead
+ *  `keyServer` field (07-seal.md §Opportunities #6).
+ *
+ *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted
+ *  via `redactMasterKey` at every raise site that touches `seal-cli`
+ *  output. The raise sites in this plugin pipe their captures
+ *  through the redactor before constructing the error. */
+interface SealError {
+  readonly _tag: 'SealError';
+  readonly phase: SealPhase;
+  /** Seal instance name (default `'seal'`). Folds into TUI display
+   *  + cause-walker context. */
+  readonly name: string;
+  readonly message: string;
+  readonly stdout?: string;
+  readonly stderr?: string;
+  readonly exitCode?: number;
+  readonly cause?: unknown;
+}
+interface SealConfigError extends ConfigIssue {
+  readonly _tag: 'SealConfigError';
+}
+/** Union of every error a Seal-plugin caller may encounter. */
+type SealAnyError = SealError | ForkIncompatibleError | SealConfigError;
+//#endregion
+export { SealAnyError, SealConfigError, SealError };
+//# sourceMappingURL=errors.d.mts.map

package/dist/plugins/seal/errors.mjs

@@ -0,0 +1,19 @@
+import { defineConfigError } from "../../substrate/runtime/config-validation.mjs";
+//#region src/plugins/seal/errors.ts
+const sealError = (phase, parts) => ({
+	_tag: "SealError",
+	phase,
+	...parts
+});
+const sealConfigError = defineConfigError("SealConfigError");
+/** Error tags this plugin contributes — surfaced to the cause walker
+*  via `PluginErrorContribution`. */
+const SEAL_ERROR_TAGS = [
+	"SealError",
+	"ForkIncompatibleError",
+	"SealConfigError"
+];
+//#endregion
+export { SEAL_ERROR_TAGS, sealConfigError, sealError };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/plugins/seal/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/seal/errors.ts"],"sourcesContent":["// Seal plugin — typed errors.\n//\n// Every error surfacing site that may carry stdout/stderr from the\n// seal-cli MUST run the bytes through a master-key redactor. The\n// redactor lives in `keygen.ts` so the keygen pipeline is the single\n// owner of the redaction substrate; this file only declares the\n// closed phase set + the structured error shapes.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// (per surrounding subsystem style). `Effect.catchTag` / `catchTags`\n// match on the literal `_tag`.\n//\n// `ForkIncompatibleError` is a cross-cutting mode-refusal shape\n// owned by `substrate/runtime/mode-errors.ts`; seal contributes\n// the `sealLocalKeygen` variant via the factory below. Substrate\n// owns the canonical re-export; this module does NOT re-export the\n// class — the cross-plugin re-export was the cause of a name\n// collision at the root barrel.\n\nimport { ForkIncompatibleError } from '../../substrate/runtime/mode-errors.ts';\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n// ---------------------------------------------------------------------------\n// SealError — the plugin's primary tagged error\n// ---------------------------------------------------------------------------\n\n/** Phases for `SealError`. Closed sum — matches the v3 catalog\n *  (07-seal.md §\"Adjacent Seal references\" → `engine/phases.ts:79-91`).\n *\n *  Phase semantics:\n *   - `port-alloc`     — router `seal` entrypoint not registered.\n *   - `image`          — image build / pull failed (bootstrap-asset\n *                        cargo step).\n *   - `keygen`         — `seal-cli genkey` container failed OR stdout\n *                        parse failed.\n *   - `publish`        — Move publish of the seal contracts failed.\n *   - `register`       — `KeyServer::create_and_transfer_v2_independent_server`\n *                        Move call failed OR object id parse failed.\n *   - `config-render`  — key-server-config.yaml / master-key.env write\n *                        failed (FS perms, disk full).\n *   - `container`      — long-running key-server container start failed.\n *   - `ready`          — /health probe timed out.\n *   - `rotate`         — master-key rotation pipeline failed (sub-phase\n *                        is in the `cause` chain).\n *   - `seal`           — generic catch-all for non-phaseable failures. */\nexport type SealPhase =\n\t| 'port-alloc'\n\t| 'image'\n\t| 'keygen'\n\t| 'publish'\n\t| 'register'\n\t| 'config-render'\n\t| 'container'\n\t| 'ready'\n\t| 'rotate'\n\t| 'seal';\n\n/** Generic Seal plugin error. The structured shape mirrors the v3\n *  `SealError` from `engine/errors.ts:325-341` minus the dead\n *  `keyServer` field (07-seal.md §Opportunities #6).\n *\n *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted\n *  via `redactMasterKey` at every raise site that touches `seal-cli`\n *  output. The raise sites in this plugin pipe their captures\n *  through the redactor before constructing the error. */\nexport interface SealError {\n\treadonly _tag: 'SealError';\n\treadonly phase: SealPhase;\n\t/** Seal instance name (default `'seal'`). Folds into TUI display\n\t *  + cause-walker context. */\n\treadonly name: string;\n\treadonly message: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n\treadonly exitCode?: number;\n\treadonly cause?: unknown;\n}\n\nexport const sealError = (\n\tphase: SealPhase,\n\tparts: Omit<SealError, '_tag' | 'phase'>,\n): SealError => ({ _tag: 'SealError', phase, ...parts });\n\n// ---------------------------------------------------------------------------\n// ForkIncompatibleError — shared shape owned by substrate\n// ---------------------------------------------------------------------------\n\n/** Synchronous refusal raised at factory time when a local-keygen\n *  variant is composed under a fork network. Refusal MUST be a\n *  synchronous throw at the factory call site (NOT a deferred\n *  acquire-time failure) so the user sees the actionable hint before\n *  any other plugin starts work. */\nexport const forkIncompatibleError = (\n\tparts: ConstructorParameters<typeof ForkIncompatibleError>[0],\n): ForkIncompatibleError => new ForkIncompatibleError(parts);\n\n// ---------------------------------------------------------------------------\n// SealConfigError — synchronous factory-time configuration faults\n// ---------------------------------------------------------------------------\n\nexport interface SealConfigError extends ConfigIssue {\n\treadonly _tag: 'SealConfigError';\n}\n\nexport const sealConfigError = defineConfigError('SealConfigError');\n\n// ---------------------------------------------------------------------------\n// Error-tag inventory\n// ---------------------------------------------------------------------------\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const SEAL_ERROR_TAGS = ['SealError', 'ForkIncompatibleError', 'SealConfigError'] as const;\n\n/** Union of every error a Seal-plugin caller may encounter. */\nexport type SealAnyError = SealError | ForkIncompatibleError | SealConfigError;\n"],"mappings":";;AA8EA,MAAa,aACZ,OACA,WACgB;CAAE,MAAM;CAAa;CAAO,GAAG;CAAO;AAuBvD,MAAa,kBAAkB,kBAAkB,kBAAkB;;;AAQnE,MAAa,kBAAkB;CAAC;CAAa;CAAyB;CAAkB"}

package/dist/plugins/seal/index.d.mts

@@ -0,0 +1,161 @@
+import { CodegenableDecl } from "../../contracts/codegenable.mjs";
+import { RoutableDecl } from "../../contracts/routable.mjs";
+import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
+import { AnyResourceRef, Plugin, ResourceRef } from "../../substrate/plugin.mjs";
+import { ModeNamespace } from "../../api/mode-narrowed-factory.mjs";
+import { SeedObjectsAccumulator } from "../sui/seed-objects.mjs";
+import { SuiClient } from "../sui/mode/shared.mjs";
+import { SuiOptions } from "../sui/mode/spec.mjs";
+import { AccountValue } from "../account/service.mjs";
+import { AccountResourceId } from "../account/index.mjs";
+import { SealAnyError, SealConfigError, SealError } from "./errors.mjs";
+import { SealKeyManager } from "./key-manager.mjs";
+import { SealKeyServer, SealKeyServerEntry, SealKnownResolved, SealLocalKeygenResolved, SealResolved } from "./registry-publish.mjs";
+import { KnownNetwork } from "./mode/live.mjs";
+import { ForkUpstream } from "./mode/fork-known.mjs";
+import { SealBindings } from "./codegen.mjs";
+//#region src/plugins/seal/index.d.ts
+/** Common options shared across all three modes. */
+interface SealCommonOptions {
+  readonly name?: string;
+}
+/** A user-supplied signer account ref. The user passes the result of
+ *  `account('publisher')` — NOT a magic-string token. Generic over the
+ *  literal account name so the seal dependency edge preserves the
+ *  per-account resource id. */
+type SealSignerMember<Name extends string = string> = ResourceRef<AccountResourceId<Name>, AccountValue>;
+/** Local-keygen mode options. The `signer` field is REQUIRED — the
+ *  Move publish + on-chain register both need it. The mode-narrowed
+ *  factory's TypeScript shape enforces this (no `signer?` here). */
+interface SealLocalKeygenOptions<Signer extends SealSignerMember = SealSignerMember> extends SealCommonOptions {
+  /** Signer for the seal Move publish + on-chain key-server register.
+   *  Pass the result of `account('publisher')` — the same plugin/resource
+   *  ref used elsewhere in the stack. The ref is threaded through
+   *  `dependsOn` so the publish tx waits for the account's acquire
+   *  (keypair mint + funding) to complete. */
+  readonly signer: Signer;
+  readonly version?: string;
+  readonly movePackagePath?: string;
+  readonly readyTimeoutMs?: number;
+  readonly keyServerName?: string;
+  readonly image?: {
+    readonly pull: string;
+  } | {
+    readonly build: {
+      readonly context: string;
+    };
+  };
+}
+/** Live-mode options (testnet / mainnet). */
+interface SealLiveOptions extends SealCommonOptions {
+  readonly network?: KnownNetwork;
+  readonly objectId?: string;
+  readonly keyServerUrl?: string;
+}
+/** Fork-known-mode options. */
+interface SealForkKnownOptions extends SealCommonOptions {
+  readonly upstream: ForkUpstream;
+  readonly objectId?: string;
+  readonly keyServerUrl?: string;
+}
+type SealOptions<Signer extends SealSignerMember = SealSignerMember> = ({
+  readonly mode: 'local-keygen';
+} & SealLocalKeygenOptions<Signer>) | ({
+  readonly mode: 'live';
+} & SealLiveOptions) | ({
+  readonly mode: 'fork-known';
+} & SealForkKnownOptions);
+/** Explicit Seal factory. `local-keygen` requires a signer; live and
+ *  fork-known modes must be selected directly or through `sealFor`. */
+declare const seal: <const Signer extends SealSignerMember = SealSignerMember>(opts: SealOptions<Signer>) => Plugin<`seal:${string}`, SealResolved, {
+  readonly sui: ResourceRef<"sui", SuiClient & {
+    readonly mode: SuiOptions["mode"];
+    readonly seedObjects: SeedObjectsAccumulator;
+  }>;
+  readonly signer: Signer;
+} extends infer T ? T extends {
+  readonly sui: ResourceRef<"sui", SuiClient & {
+    readonly mode: SuiOptions["mode"];
+    readonly seedObjects: SeedObjectsAccumulator;
+  }>;
+  readonly signer: Signer;
+} ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">, RoutableDecl]> | Plugin<`seal:${string}`, {
+  mode: "live";
+  manager: null;
+  serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+  keyServerUrl: string;
+  objectId: string;
+}, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]> | Plugin<`seal:${string}`, {
+  mode: "fork-known";
+  manager: null;
+  serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+  keyServerUrl: string;
+  objectId: string;
+}, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+/** Mode-narrowed factory namespace.
+ *
+ *  Usage:
+ *      const local = { mode: 'local' } as const;
+ *      sealFor(local).localKeygen({signer})    // OK
+ *      sealFor(local).forkKnown(...)           // type error: not in 'local' branch
+ *
+ *      const fork = { mode: 'fork' } as const;
+ *      sealFor(fork).forkKnown({upstream})     // OK
+ *      sealFor(fork).localKeygen({signer})     // type error: not in 'fork' branch
+ *                                              // (distilled-doc invariant #8)
+ *
+ *  Distilled-doc invariant #8 (fork-localkeygen-refused): the
+ *  fork-mode branch has NO `localKeygen` entry — that's the
+ *  type-level refusal. */
+declare const sealFor: ModeNamespace<{
+  local: {
+    localKeygen: <const Signer extends SealSignerMember>(opts: SealLocalKeygenOptions<Signer>) => Plugin<`seal:${string}`, SealResolved, {
+      readonly sui: ResourceRef<"sui", SuiClient & {
+        readonly mode: SuiOptions["mode"];
+        readonly seedObjects: SeedObjectsAccumulator;
+      }>;
+      readonly signer: Signer;
+    } extends infer T ? T extends {
+      readonly sui: ResourceRef<"sui", SuiClient & {
+        readonly mode: SuiOptions["mode"];
+        readonly seedObjects: SeedObjectsAccumulator;
+      }>;
+      readonly signer: Signer;
+    } ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">, RoutableDecl]>;
+  };
+  live: {
+    testnet: (opts?: Omit<SealLiveOptions, "network">) => Plugin<`seal:${string}`, {
+      mode: "live";
+      manager: null;
+      serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+      keyServerUrl: string;
+      objectId: string;
+    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+    mainnet: (opts?: Omit<SealLiveOptions, "network">) => Plugin<`seal:${string}`, {
+      mode: "live";
+      manager: null;
+      serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+      keyServerUrl: string;
+      objectId: string;
+    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+    custom: (opts: Required<Pick<SealLiveOptions, "objectId" | "keyServerUrl">> & SealLiveOptions) => Plugin<`seal:${string}`, {
+      mode: "live";
+      manager: null;
+      serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+      keyServerUrl: string;
+      objectId: string;
+    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+  };
+  fork: {
+    forkKnown: (opts: SealForkKnownOptions) => Plugin<`seal:${string}`, {
+      mode: "fork-known";
+      manager: null;
+      serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+      keyServerUrl: string;
+      objectId: string;
+    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+  };
+}>;
+//#endregion
+export { SealCommonOptions, SealForkKnownOptions, SealLiveOptions, SealLocalKeygenOptions, SealOptions, seal, sealFor };
+//# sourceMappingURL=index.d.mts.map