@mysten-incubation/devstack 0.0.0

package/dist/plugins/seal/keygen.mjs

@@ -0,0 +1,96 @@
+import { redactText } from "../../substrate/runtime/observability/redaction.mjs";
+import { sealError } from "./errors.mjs";
+import { Duration, Effect } from "effect";
+//#region src/plugins/seal/keygen.ts
+/** Entrypoint binary inside the seal image. */
+const SEAL_KEYGEN_ENTRYPOINT = "seal-cli";
+/** Args for the keygen one-shot. */
+const SEAL_KEYGEN_ARGS = ["genkey"];
+/** Default master-key env-file basename inside `runtime/seal/`. */
+const MASTER_KEY_ENVFILE_BASENAME = "master-key.env";
+/** Default key-server config yaml basename inside `runtime/seal/`. */
+const KEY_SERVER_CONFIG_BASENAME = "key-server-config.yaml";
+/** Wall-clock timeout for the keygen one-shot. BLS12-381 keygen is
+*  small — under 1s. 30s ceiling absorbs container startup overhead
+*  on slow CI runners. */
+const KEYGEN_TIMEOUT_MS = 3e4;
+const MASTER_KEY_REDACTION_RULE = {
+	kind: "pattern",
+	pattern: /^.*master[_\- ]?key.*$/gim,
+	replacement: "[REDACTED master key]"
+};
+/** Replace any line containing `master_key` / `master-key` / `masterkey`
+*  (case-insensitive) with the literal `[REDACTED master key]`. Used at
+*  every site that may surface stdout/stderr from `seal-cli`. */
+const redactMasterKey = (s) => redactText(s, [MASTER_KEY_REDACTION_RULE]);
+/** Parse `Master key:` / `Public key:` hex lines from `seal-cli genkey`
+*  stdout. Hex prefix may or may not include `0x` (we strip it).
+*
+*  Returns a typed `PersistedBlsKeypair` on success, or fails with a
+*  `SealError({phase: 'keygen'})` carrying the REDACTED tail of the
+*  stdout so a parser drift doesn't leak the master key into logs. */
+const parseSealKeygenOutput = (stdout, name) => {
+	const stripHex = (s) => s.startsWith("0x") ? s.slice(2) : s;
+	const masterMatch = stdout.match(/Master key:\s*(0x)?([0-9a-fA-F]+)/);
+	const publicMatch = stdout.match(/Public key:\s*(0x)?([0-9a-fA-F]+)/);
+	if (!masterMatch || !publicMatch) return Effect.fail(sealError("keygen", {
+		name,
+		message: "seal.keygen: could not parse seal-cli genkey output (Master key: / Public key: lines missing)",
+		stdout: redactMasterKey(stdout)
+	}));
+	return Effect.succeed({
+		masterKey: stripHex(masterMatch[2]),
+		publicKey: stripHex(publicMatch[2])
+	});
+};
+/** Decode hex → bytes. Tolerates leading `0x`; fails on odd length. */
+const decodeHex = (hex) => {
+	const stripped = hex.startsWith("0x") ? hex.slice(2) : hex;
+	if (stripped.length % 2 !== 0) throw new Error("decodeHex: odd-length hex string");
+	const out = new Uint8Array(stripped.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = parseInt(stripped.slice(i * 2, i * 2 + 2), 16);
+	return out;
+};
+/** Run `seal-cli genkey` inside the cargo-built seal image and
+*  parse the BLS12-381 master + public keys.
+*
+*  Implementation:
+*   1. `runtime.runOneShot({ image, entrypoint: 'seal-cli', argv:
+*      ['genkey'], timeoutMillis: 30s })` — fresh `docker run --rm`.
+*   2. Promote non-zero exit to typed SealError with REDACTED tails.
+*   3. Parse stdout via `parseSealKeygenOutput`.
+*
+*  Distilled-doc invariant #16 — every stdout/stderr capture site
+*  passes through `redactMasterKey` BEFORE landing in the error. The
+*  parser handles the success-path; the failure path does its own
+*  redact at the raise site. */
+const runSealKeygen = (runtime, name, image) => Effect.gen(function* () {
+	const result = yield* runtime.runOneShot({
+		image,
+		entrypoint: SEAL_KEYGEN_ENTRYPOINT,
+		argv: SEAL_KEYGEN_ARGS,
+		timeoutMillis: KEYGEN_TIMEOUT_MS
+	}).pipe(Effect.catch((cause) => Effect.fail(sealError("keygen", {
+		name,
+		message: `seal-cli genkey one-shot failed: ${cause.reason}: ${cause.detail}`,
+		cause
+	}))));
+	if (result.exitCode !== 0) return yield* Effect.fail(sealError("keygen", {
+		name,
+		message: `seal-cli genkey exited with code ${result.exitCode}`,
+		exitCode: result.exitCode,
+		stdout: redactMasterKey(result.stdout),
+		stderr: redactMasterKey(result.stderr)
+	}));
+	return yield* parseSealKeygenOutput(result.stdout, name);
+}).pipe(Effect.withSpan("devstack.plugin.seal.keygen.oneShot", { attributes: { "seal.name": name } }), Effect.timeoutOrElse({
+	duration: Duration.millis(KEYGEN_TIMEOUT_MS + 5e3),
+	orElse: () => Effect.fail(sealError("keygen", {
+		name,
+		message: `seal.keygen: outer timeout ${KEYGEN_TIMEOUT_MS}ms exceeded`
+	}))
+}));
+//#endregion
+export { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME, decodeHex, runSealKeygen };
+
+//# sourceMappingURL=keygen.mjs.map

package/dist/plugins/seal/keygen.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.mjs","names":[],"sources":["../../../src/plugins/seal/keygen.ts"],"sourcesContent":["// Seal plugin — BLS12-381 keygen helpers + master-key redactor.\n//\n// Distilled-doc invariant (07-seal.md §\"Generic artifact-publisher-publish\"\n// + §Hard requirements #16): the master-key MUST be redacted from any\n// stdout/stderr that may surface in a SealError. The redactor lives\n// here as the single owner so call sites (`mode/local-keygen.ts`,\n// `key-manager.ts`) all funnel through one regex.\n//\n// The keygen pipeline is REAL — `runtime.runOneShot` against the cargo\n// image runs `seal-cli genkey`, captures stdout, parses the BLS hex\n// pair. The image itself is the seam (`SEAL_CARGO_IMAGE_OVERRIDE` env\n// — see `bootstrap-assets/cargo-image.ts`).\n\nimport { Duration, Effect, type Scope } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport { redactText, type RedactionRule } from '../../substrate/runtime/observability/index.ts';\nimport { sealError, type SealError } from './errors.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — mirror v3 (`seal/internal.ts:115-149`)\n// ---------------------------------------------------------------------------\n\n/** Entrypoint binary inside the seal image. */\nexport const SEAL_KEYGEN_ENTRYPOINT = 'seal-cli';\n\n/** Args for the keygen one-shot. */\nexport const SEAL_KEYGEN_ARGS = ['genkey'] as const;\n\n/** Default master-key env-file basename inside `runtime/seal/`. */\nexport const MASTER_KEY_ENVFILE_BASENAME = 'master-key.env';\n\n/** Default key-server config yaml basename inside `runtime/seal/`. */\nexport const KEY_SERVER_CONFIG_BASENAME = 'key-server-config.yaml';\n\n/** Wall-clock timeout for the keygen one-shot. BLS12-381 keygen is\n *  small — under 1s. 30s ceiling absorbs container startup overhead\n *  on slow CI runners. */\nconst KEYGEN_TIMEOUT_MS = 30_000;\n\n// ---------------------------------------------------------------------------\n// PersistedBlsKeypair — the cache-stored shape\n// ---------------------------------------------------------------------------\n\n/** Two hex blobs round-tripped through the substrate StateStore. The\n *  master key is the secret; the public key is on-chain in the\n *  registered `KeyServer` object. Distilled-doc §\"Persistence model\"\n *  + §Hard requirements #5 — chainId is folded into the cache key by\n *  the ArtifactPublisher substrate. */\nexport interface PersistedBlsKeypair {\n\treadonly masterKey: string;\n\treadonly publicKey: string;\n}\n\n// ---------------------------------------------------------------------------\n// Redaction — distilled-doc invariant #16\n// ---------------------------------------------------------------------------\n\n/** Case-insensitive line-level pattern matching any `master[_-]?key`\n *  mention. Mirrors v3's `MASTER_KEY_LINE_RE` (`seal/internal.ts:1343`). */\nconst MASTER_KEY_LINE_RE = /^.*master[_\\- ]?key.*$/gim;\n\nconst MASTER_KEY_REDACTION_RULE: RedactionRule = {\n\tkind: 'pattern',\n\tpattern: MASTER_KEY_LINE_RE,\n\treplacement: '[REDACTED master key]',\n};\n\n/** Replace any line containing `master_key` / `master-key` / `masterkey`\n *  (case-insensitive) with the literal `[REDACTED master key]`. Used at\n *  every site that may surface stdout/stderr from `seal-cli`. */\nexport const redactMasterKey = (s: string): string => redactText(s, [MASTER_KEY_REDACTION_RULE]);\n\n// ---------------------------------------------------------------------------\n// Output parser — distilled-doc §\"Helpers\"\n// ---------------------------------------------------------------------------\n\n/** Parse `Master key:` / `Public key:` hex lines from `seal-cli genkey`\n *  stdout. Hex prefix may or may not include `0x` (we strip it).\n *\n *  Returns a typed `PersistedBlsKeypair` on success, or fails with a\n *  `SealError({phase: 'keygen'})` carrying the REDACTED tail of the\n *  stdout so a parser drift doesn't leak the master key into logs. */\nexport const parseSealKeygenOutput = (\n\tstdout: string,\n\tname: string,\n): Effect.Effect<PersistedBlsKeypair, SealError> => {\n\tconst stripHex = (s: string): string => (s.startsWith('0x') ? s.slice(2) : s);\n\tconst masterMatch = stdout.match(/Master key:\\s*(0x)?([0-9a-fA-F]+)/);\n\tconst publicMatch = stdout.match(/Public key:\\s*(0x)?([0-9a-fA-F]+)/);\n\tif (!masterMatch || !publicMatch) {\n\t\treturn Effect.fail(\n\t\t\tsealError('keygen', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t'seal.keygen: could not parse seal-cli genkey output (Master key: / Public key: lines missing)',\n\t\t\t\tstdout: redactMasterKey(stdout),\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({\n\t\tmasterKey: stripHex(masterMatch[2]!),\n\t\tpublicKey: stripHex(publicMatch[2]!),\n\t} satisfies PersistedBlsKeypair);\n};\n\n// ---------------------------------------------------------------------------\n// Hex decode — minimal helper\n// ---------------------------------------------------------------------------\n\n/** Decode hex → bytes. Tolerates leading `0x`; fails on odd length. */\nexport const decodeHex = (hex: string): Uint8Array => {\n\tconst stripped = hex.startsWith('0x') ? hex.slice(2) : hex;\n\tif (stripped.length % 2 !== 0) {\n\t\tthrow new Error('decodeHex: odd-length hex string');\n\t}\n\tconst out = new Uint8Array(stripped.length / 2);\n\tfor (let i = 0; i < out.length; i++) {\n\t\tout[i] = parseInt(stripped.slice(i * 2, i * 2 + 2), 16);\n\t}\n\treturn out;\n};\n\n// ---------------------------------------------------------------------------\n// Real keygen one-shot\n// ---------------------------------------------------------------------------\n\n/** Run `seal-cli genkey` inside the cargo-built seal image and\n *  parse the BLS12-381 master + public keys.\n *\n *  Implementation:\n *   1. `runtime.runOneShot({ image, entrypoint: 'seal-cli', argv:\n *      ['genkey'], timeoutMillis: 30s })` — fresh `docker run --rm`.\n *   2. Promote non-zero exit to typed SealError with REDACTED tails.\n *   3. Parse stdout via `parseSealKeygenOutput`.\n *\n *  Distilled-doc invariant #16 — every stdout/stderr capture site\n *  passes through `redactMasterKey` BEFORE landing in the error. The\n *  parser handles the success-path; the failure path does its own\n *  redact at the raise site. */\nexport const runSealKeygen = (\n\truntime: ContainerRuntime,\n\tname: string,\n\timage: ImageRef,\n): Effect.Effect<PersistedBlsKeypair, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* runtime\n\t\t\t.runOneShot({\n\t\t\t\timage,\n\t\t\t\tentrypoint: SEAL_KEYGEN_ENTRYPOINT,\n\t\t\t\targv: SEAL_KEYGEN_ARGS,\n\t\t\t\ttimeoutMillis: KEYGEN_TIMEOUT_MS,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tsealError('keygen', {\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tmessage: `seal-cli genkey one-shot failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('keygen', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal-cli genkey exited with code ${result.exitCode}`,\n\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t// Defense-in-depth — the redactor handles success-path\n\t\t\t\t\t// output (where the key is the parsed value) but the\n\t\t\t\t\t// failure path's stdout MAY also carry the key, e.g.\n\t\t\t\t\t// when stderr says \"wrote master key to <log>\".\n\t\t\t\t\tstdout: redactMasterKey(result.stdout),\n\t\t\t\t\tstderr: redactMasterKey(result.stderr),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* parseSealKeygenOutput(result.stdout, name);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.keygen.oneShot', {\n\t\t\tattributes: { 'seal.name': name },\n\t\t}),\n\t\tEffect.timeoutOrElse({\n\t\t\tduration: Duration.millis(KEYGEN_TIMEOUT_MS + 5_000),\n\t\t\torElse: () =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('keygen', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.keygen: outer timeout ${KEYGEN_TIMEOUT_MS}ms exceeded`,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t}),\n\t);\n"],"mappings":";;;;;AAwBA,MAAa,yBAAyB;;AAGtC,MAAa,mBAAmB,CAAC,SAAS;;AAG1C,MAAa,8BAA8B;;AAG3C,MAAa,6BAA6B;;;;AAK1C,MAAM,oBAAoB;AAwB1B,MAAM,4BAA2C;CAChD,MAAM;CACN,SAAS;CACT,aAAa;CACb;;;;AAKD,MAAa,mBAAmB,MAAsB,WAAW,GAAG,CAAC,0BAA0B,CAAC;;;;;;;AAYhG,MAAa,yBACZ,QACA,SACmD;CACnD,MAAM,YAAY,MAAuB,EAAE,WAAW,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG;CAC3E,MAAM,cAAc,OAAO,MAAM,oCAAoC;CACrE,MAAM,cAAc,OAAO,MAAM,oCAAoC;AACrE,KAAI,CAAC,eAAe,CAAC,YACpB,QAAO,OAAO,KACb,UAAU,UAAU;EACnB;EACA,SACC;EACD,QAAQ,gBAAgB,OAAO;EAC/B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ;EACrB,WAAW,SAAS,YAAY,GAAI;EACpC,WAAW,SAAS,YAAY,GAAI;EACpC,CAA+B;;;AAQjC,MAAa,aAAa,QAA4B;CACrD,MAAM,WAAW,IAAI,WAAW,KAAK,GAAG,IAAI,MAAM,EAAE,GAAG;AACvD,KAAI,SAAS,SAAS,MAAM,EAC3B,OAAM,IAAI,MAAM,mCAAmC;CAEpD,MAAM,MAAM,IAAI,WAAW,SAAS,SAAS,EAAE;AAC/C,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAC/B,KAAI,KAAK,SAAS,SAAS,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,EAAE,GAAG;AAExD,QAAO;;;;;;;;;;;;;;;AAoBR,MAAa,iBACZ,SACA,MACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,QACpB,WAAW;EACX;EACA,YAAY;EACZ,MAAM;EACN,eAAe;EACf,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,UAAU,UAAU;EACnB;EACA,SAAS,oCAAoC,MAAM,OAAO,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD,CACD;AAEF,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,UAAU;EACnB;EACA,SAAS,oCAAoC,OAAO;EACpD,UAAU,OAAO;EAKjB,QAAQ,gBAAgB,OAAO,OAAO;EACtC,QAAQ,gBAAgB,OAAO,OAAO;EACtC,CAAC,CACF;AAGF,QAAO,OAAO,sBAAsB,OAAO,QAAQ,KAAK;EACvD,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY,EAAE,aAAa,MAAM,EACjC,CAAC,EACF,OAAO,cAAc;CACpB,UAAU,SAAS,OAAO,oBAAoB,IAAM;CACpD,cACC,OAAO,KACN,UAAU,UAAU;EACnB;EACA,SAAS,8BAA8B,kBAAkB;EACzD,CAAC,CACF;CACF,CAAC,CACF"}

package/dist/plugins/seal/mode/fork-known.d.mts

@@ -0,0 +1,8 @@
+import { Effect } from "effect";
+
+//#region src/plugins/seal/mode/fork-known.d.ts
+/** Map a fork upstream to its known-deployment lookup target. */
+type ForkUpstream = 'mainnet' | 'testnet' | 'devnet';
+//#endregion
+export { ForkUpstream };
+//# sourceMappingURL=fork-known.d.mts.map

package/dist/plugins/seal/mode/fork-known.mjs

@@ -0,0 +1,23 @@
+import { sealError } from "../errors.mjs";
+import { acquireLive } from "./live.mjs";
+import { Effect } from "effect";
+//#region src/plugins/seal/mode/fork-known.ts
+/** Resolve the wrapped upstream's known deployment key. Distilled-
+*  doc invariant #13. */
+const resolveDeploymentNetwork = (upstream) => upstream;
+/** Acquire body for the fork-known mode. Delegates to live mode
+*  with the resolved network. */
+const acquireForkKnown = (inputs) => acquireLive({
+	name: inputs.name,
+	network: resolveDeploymentNetwork(inputs.upstream),
+	objectId: inputs.objectId,
+	keyServerUrl: inputs.keyServerUrl
+}).pipe(Effect.mapError((err) => sealError("seal", {
+	name: inputs.name,
+	message: `seal.fork-known (upstream=${inputs.upstream}): ${err.message}`,
+	cause: err
+})));
+//#endregion
+export { acquireForkKnown };
+
+//# sourceMappingURL=fork-known.mjs.map

package/dist/plugins/seal/mode/fork-known.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fork-known.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/fork-known.ts"],"sourcesContent":["// Seal fork-known mode — *-fork networks route to the wrapped\n// upstream's known key-server deployment.\n//\n// Distilled-doc §\"Startup — `sealKnownKeyServer` (testnet / mainnet\n// / fork)\": structurally IDENTICAL to live mode. The only difference\n// is the network resolver step at the barrel — `*-fork` networks\n// route to the wrapped upstream (mainnet-fork → mainnet,\n// testnet-fork → testnet, devnet-fork → devnet) BEFORE the\n// known-deployment lookup fires.\n//\n// Distilled-doc invariant #13: `Seal()` on `*-fork` MUST route to\n// `sealKnownKeyServer` with the wrapped upstream's deployment. The\n// barrel (`index.ts`) enforces this via `resolveDeploymentNetwork`;\n// this file's mode body simply consumes the resolved network the\n// barrel passed.\n//\n// The mode body re-uses `acquireLive` since the boot pipeline is\n// identical. We expose a distinct factory only so the mode-narrowed\n// factory namespace (`sealFor(network).forkKnown(opts)`) can\n// route by mode without leaking the live-mode internals.\n\nimport { Effect } from 'effect';\n\nimport { acquireLive, type KnownNetwork } from './live.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport type { SealKnownResolved } from '../registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Fork → upstream network mapping\n// ---------------------------------------------------------------------------\n\n/** Map a fork upstream to its known-deployment lookup target. */\nexport type ForkUpstream = 'mainnet' | 'testnet' | 'devnet';\n\n/** Resolve the wrapped upstream's known deployment key. Distilled-\n *  doc invariant #13. */\nexport const resolveDeploymentNetwork = (upstream: ForkUpstream): KnownNetwork => upstream;\n\n// ---------------------------------------------------------------------------\n// Inputs\n// ---------------------------------------------------------------------------\n\nexport interface ForkKnownInputs {\n\treadonly name: string;\n\treadonly upstream: ForkUpstream;\n\t/** Explicit overrides (rare — the wrapped upstream's known\n\t *  deployment is usually authoritative). */\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Mode acquire\n// ---------------------------------------------------------------------------\n\n/** Acquire body for the fork-known mode. Delegates to live mode\n *  with the resolved network. */\nexport const acquireForkKnown = (\n\tinputs: ForkKnownInputs,\n): Effect.Effect<SealKnownResolved, SealError> =>\n\tacquireLive({\n\t\tname: inputs.name,\n\t\tnetwork: resolveDeploymentNetwork(inputs.upstream),\n\t\tobjectId: inputs.objectId,\n\t\tkeyServerUrl: inputs.keyServerUrl,\n\t}).pipe(\n\t\t// Re-tag the error so the cause walker can attribute fork-mode\n\t\t// failures distinctly from live-mode failures.\n\t\tEffect.mapError((err) =>\n\t\t\tsealError('seal', {\n\t\t\t\tname: inputs.name,\n\t\t\t\tmessage: `seal.fork-known (upstream=${inputs.upstream}): ${err.message}`,\n\t\t\t\tcause: err,\n\t\t\t}),\n\t\t),\n\t);\n"],"mappings":";;;;;;AAoCA,MAAa,4BAA4B,aAAyC;;;AAqBlF,MAAa,oBACZ,WAEA,YAAY;CACX,MAAM,OAAO;CACb,SAAS,yBAAyB,OAAO,SAAS;CAClD,UAAU,OAAO;CACjB,cAAc,OAAO;CACrB,CAAC,CAAC,KAGF,OAAO,UAAU,QAChB,UAAU,QAAQ;CACjB,MAAM,OAAO;CACb,SAAS,6BAA6B,OAAO,SAAS,KAAK,IAAI;CAC/D,OAAO;CACP,CAAC,CACF,CACD"}

package/dist/plugins/seal/mode/live.d.mts

@@ -0,0 +1,18 @@
+import { Effect } from "effect";
+
+//#region src/plugins/seal/mode/live.d.ts
+/** Closed set of known deployments. `mainnet` + `devnet` intentionally
+ *  null (distilled-doc cross-ref). v2 plans should canonicalize this
+ *  table — for now we mirror v3's structure. */
+declare const KNOWN_DEPLOYMENTS: {
+  readonly testnet: {
+    readonly keyServerObjectId: string;
+    readonly keyServerUrl: "https://seal-keyserver.testnet.mystenlabs.com";
+  };
+  readonly mainnet: null;
+  readonly devnet: null;
+};
+type KnownNetwork = keyof typeof KNOWN_DEPLOYMENTS;
+//#endregion
+export { KnownNetwork };
+//# sourceMappingURL=live.d.mts.map

package/dist/plugins/seal/mode/live.mjs

@@ -0,0 +1,64 @@
+import { expectNonEmptyString } from "../../../substrate/runtime/config-validation.mjs";
+import { sealConfigError, sealError } from "../errors.mjs";
+import { Effect } from "effect";
+//#region src/plugins/seal/mode/live.ts
+/** Closed set of known deployments. `mainnet` + `devnet` intentionally
+*  null (distilled-doc cross-ref). v2 plans should canonicalize this
+*  table — for now we mirror v3's structure. */
+const KNOWN_DEPLOYMENTS = {
+	testnet: {
+		keyServerObjectId: "0x000000000000000000000000000000000000000000000000000000000000mysten",
+		keyServerUrl: "https://seal-keyserver.testnet.mystenlabs.com"
+	},
+	mainnet: null,
+	devnet: null
+};
+/** Validate the inputs at the factory boundary. Pure synchronous
+*  function. The plugin `start` body is reserved for Effect-flavored
+*  work; the throw here matches v3's pattern (distilled-doc
+*  §Failure modes). */
+const validateLiveInputs = (inputs) => {
+	const fromNetwork = inputs.network && KNOWN_DEPLOYMENTS[inputs.network] ? KNOWN_DEPLOYMENTS[inputs.network] : null;
+	const objectId = inputs.objectId ?? fromNetwork?.keyServerObjectId;
+	const keyServerUrl = inputs.keyServerUrl ?? fromNetwork?.keyServerUrl;
+	const message = `seal.live: missing required fields. Pass network ('testnet') or set objectId + keyServerUrl explicitly (got network=${String(inputs.network)}, objectId=${String(inputs.objectId)}, keyServerUrl=${String(inputs.keyServerUrl)}).`;
+	return {
+		objectId: expectNonEmptyString(objectId, {
+			field: "objectId",
+			message,
+			mkError: sealConfigError
+		}),
+		keyServerUrl: expectNonEmptyString(keyServerUrl, {
+			field: "keyServerUrl",
+			message,
+			mkError: sealConfigError
+		})
+	};
+};
+/** Acquire body for the live mode. Returns the read-side handle
+*  ONLY (no manager tag — distilled-doc invariant #15). */
+const acquireLive = (inputs) => Effect.gen(function* () {
+	let resolved;
+	try {
+		resolved = validateLiveInputs(inputs);
+	} catch (err) {
+		if (typeof err === "object" && err !== null && "_tag" in err && err._tag === "SealConfigError") return yield* Effect.fail(err);
+		return yield* Effect.fail(sealError("seal", {
+			name: inputs.name,
+			message: err instanceof Error ? err.message : String(err),
+			cause: err
+		}));
+	}
+	return { keyServer: {
+		serverConfigs: [{
+			objectId: resolved.objectId,
+			weight: 1
+		}],
+		keyServerUrl: resolved.keyServerUrl,
+		objectId: resolved.objectId
+	} };
+});
+//#endregion
+export { acquireLive, validateLiveInputs };
+
+//# sourceMappingURL=live.mjs.map

package/dist/plugins/seal/mode/live.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/live.ts"],"sourcesContent":["// Seal live mode — testnet / mainnet known key server.\n//\n// Distilled-doc §\"Startup — `sealKnownKeyServer`\": far simpler than\n// the local-keygen path.\n//\n//   1. Look up the known deployment (or accept explicit overrides).\n//   2. Publish the endpoint + state-store entry to the substrate\n//      registries (the codegen + manifest emitters consume these).\n//   3. Return the read-side handle.\n//\n// NO chain interactions, NO docker, NO state-store writes, NO\n// keygen. Distilled-doc invariant #15 — the manager tag is NOT\n// produced (we don't own the master key for a remote deployment).\n//\n// Known-deployment lookup: distilled-doc §\"Adjacent Seal references\"\n// → `engine/known-deployments.ts:153-157` carries the\n// `mysten-testnet-1` Open-mode independent server. `mainnet`\n// intentionally empty (Mysten doesn't ship a public default key\n// server on mainnet — production is via Enoki). `devnet`\n// intentionally empty.\n\nimport { Effect } from 'effect';\n\nimport { expectNonEmptyString } from '../../../substrate/runtime/config-validation.ts';\nimport { sealConfigError, sealError, type SealAnyError } from '../errors.ts';\nimport type { SealKeyServerEntry, SealKnownResolved } from '../registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Known-deployment table — distilled-doc reference\n// ---------------------------------------------------------------------------\n\n/** Closed set of known deployments. `mainnet` + `devnet` intentionally\n *  null (distilled-doc cross-ref). v2 plans should canonicalize this\n *  table — for now we mirror v3's structure. */\nexport const KNOWN_DEPLOYMENTS = {\n\ttestnet: {\n\t\tkeyServerObjectId:\n\t\t\t'0x000000000000000000000000000000000000000000000000000000000000mysten' as string,\n\t\tkeyServerUrl: 'https://seal-keyserver.testnet.mystenlabs.com',\n\t},\n\tmainnet: null,\n\tdevnet: null,\n} as const;\n\nexport type KnownNetwork = keyof typeof KNOWN_DEPLOYMENTS;\n\n// ---------------------------------------------------------------------------\n// Inputs\n// ---------------------------------------------------------------------------\n\n/** Live-mode inputs. Either `network` resolves to a known deployment\n *  OR the user supplies explicit `objectId` + `keyServerUrl`\n *  overrides. Distilled-doc §\"Configuration\" — the factory throws\n *  synchronously if neither path produces a usable tuple. */\nexport interface LiveModeInputs {\n\treadonly name: string;\n\treadonly network?: KnownNetwork;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Resolved\n// ---------------------------------------------------------------------------\n\n/** Validate the inputs at the factory boundary. Pure synchronous\n *  function. The plugin `start` body is reserved for Effect-flavored\n *  work; the throw here matches v3's pattern (distilled-doc\n *  §Failure modes). */\nexport const validateLiveInputs = (\n\tinputs: LiveModeInputs,\n): {\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n} => {\n\tconst fromNetwork =\n\t\tinputs.network && KNOWN_DEPLOYMENTS[inputs.network] ? KNOWN_DEPLOYMENTS[inputs.network] : null;\n\tconst objectId = inputs.objectId ?? fromNetwork?.keyServerObjectId;\n\tconst keyServerUrl = inputs.keyServerUrl ?? fromNetwork?.keyServerUrl;\n\tconst message = `seal.live: missing required fields. Pass network ('testnet') or set objectId + keyServerUrl explicitly (got network=${String(\n\t\tinputs.network,\n\t)}, objectId=${String(inputs.objectId)}, keyServerUrl=${String(inputs.keyServerUrl)}).`;\n\treturn {\n\t\tobjectId: expectNonEmptyString(objectId, {\n\t\t\tfield: 'objectId',\n\t\t\tmessage,\n\t\t\tmkError: sealConfigError,\n\t\t}),\n\t\tkeyServerUrl: expectNonEmptyString(keyServerUrl, {\n\t\t\tfield: 'keyServerUrl',\n\t\t\tmessage,\n\t\t\tmkError: sealConfigError,\n\t\t}),\n\t};\n};\n\n// ---------------------------------------------------------------------------\n// Mode acquire\n// ---------------------------------------------------------------------------\n\n/** Acquire body for the live mode. Returns the read-side handle\n *  ONLY (no manager tag — distilled-doc invariant #15). */\nexport const acquireLive = (\n\tinputs: LiveModeInputs,\n): Effect.Effect<SealKnownResolved, SealAnyError> =>\n\tEffect.gen(function* () {\n\t\t// Validation runs at the factory layer; here we trust the\n\t\t// validated fields. The substrate's registry publishes happen\n\t\t// at the orchestrator layer (manifest emitter walks the\n\t\t// codegen contributions); this body just returns the resolved\n\t\t// value.\n\t\tlet resolved: { readonly objectId: string; readonly keyServerUrl: string };\n\t\ttry {\n\t\t\tresolved = validateLiveInputs(inputs);\n\t\t} catch (err) {\n\t\t\tif (\n\t\t\t\ttypeof err === 'object' &&\n\t\t\t\terr !== null &&\n\t\t\t\t'_tag' in err &&\n\t\t\t\terr._tag === 'SealConfigError'\n\t\t\t) {\n\t\t\t\treturn yield* Effect.fail(err as SealAnyError);\n\t\t\t}\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('seal', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage: err instanceof Error ? err.message : String(err),\n\t\t\t\t\tcause: err,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst serverConfigs: ReadonlyArray<SealKeyServerEntry> = [\n\t\t\t{ objectId: resolved.objectId, weight: 1 },\n\t\t];\n\t\treturn {\n\t\t\tkeyServer: {\n\t\t\t\tserverConfigs,\n\t\t\t\tkeyServerUrl: resolved.keyServerUrl,\n\t\t\t\tobjectId: resolved.objectId,\n\t\t\t},\n\t\t} satisfies SealKnownResolved;\n\t});\n"],"mappings":";;;;;;;AAkCA,MAAa,oBAAoB;CAChC,SAAS;EACR,mBACC;EACD,cAAc;EACd;CACD,SAAS;CACT,QAAQ;CACR;;;;;AA2BD,MAAa,sBACZ,WAII;CACJ,MAAM,cACL,OAAO,WAAW,kBAAkB,OAAO,WAAW,kBAAkB,OAAO,WAAW;CAC3F,MAAM,WAAW,OAAO,YAAY,aAAa;CACjD,MAAM,eAAe,OAAO,gBAAgB,aAAa;CACzD,MAAM,UAAU,uHAAuH,OACtI,OAAO,QACP,CAAC,aAAa,OAAO,OAAO,SAAS,CAAC,iBAAiB,OAAO,OAAO,aAAa,CAAC;AACpF,QAAO;EACN,UAAU,qBAAqB,UAAU;GACxC,OAAO;GACP;GACA,SAAS;GACT,CAAC;EACF,cAAc,qBAAqB,cAAc;GAChD,OAAO;GACP;GACA,SAAS;GACT,CAAC;EACF;;;;AASF,MAAa,eACZ,WAEA,OAAO,IAAI,aAAa;CAMvB,IAAI;AACJ,KAAI;AACH,aAAW,mBAAmB,OAAO;UAC7B,KAAK;AACb,MACC,OAAO,QAAQ,YACf,QAAQ,QACR,UAAU,OACV,IAAI,SAAS,kBAEb,QAAO,OAAO,OAAO,KAAK,IAAoB;AAE/C,SAAO,OAAO,OAAO,KACpB,UAAU,QAAQ;GACjB,MAAM,OAAO;GACb,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GACzD,OAAO;GACP,CAAC,CACF;;AAKF,QAAO,EACN,WAAW;EACV,eAAA,CAJD;GAAE,UAAU,SAAS;GAAU,QAAQ;GAAG,CAI5B;EACb,cAAc,SAAS;EACvB,UAAU,SAAS;EACnB,EACD;EACA"}

package/dist/plugins/seal/mode/local-keygen.mjs

@@ -0,0 +1,180 @@
+import { atomicWriteFile } from "../../../substrate/runtime/atomic-write.mjs";
+import { sealError } from "../errors.mjs";
+import { MASTER_KEY_ENVFILE_BASENAME, runSealKeygen } from "../keygen.mjs";
+import { buildKeyServerSpec, startKeyServer } from "../key-server.mjs";
+import { parseMasterKeyEnvFile, renderSealKeyServerConfig, stageSealConfig } from "../config-render.mjs";
+import { publishSealPackage, registerKeyServer } from "../deploy.mjs";
+import { makeKeyManager, stubRotate } from "../key-manager.mjs";
+import { resolveDefaultSealSource } from "../bootstrap-assets/source-fetch.mjs";
+import { resolveDefaultSealCargoImage } from "../bootstrap-assets/cargo-image.mjs";
+import { Effect, FileSystem, Schema } from "effect";
+//#region src/plugins/seal/mode/local-keygen.ts
+const DEFAULT_READY_TIMEOUT_MS = 6e4;
+const DEFAULT_KEY_SERVER_NAME = "devstack-local";
+/** Synchronous factory-time defaults application. Pure — no
+*  validation throws because the localnet signer requirement is
+*  enforced one layer up in the barrel (the type-narrowed
+*  `sealFor(local).localKeygen({signer})` makes signer required). */
+const resolveLocalKeygenOptions = (opts, defaultVersion) => ({
+	name: opts.name ?? "seal",
+	version: opts.version ?? defaultVersion,
+	readyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
+	keyServerName: opts.keyServerName ?? DEFAULT_KEY_SERVER_NAME,
+	movePackagePath: opts.movePackagePath
+});
+const LOCAL_KEYGEN_STATE_VERSION = 1;
+const LOCAL_KEYGEN_STATE_BASENAME = "local-keygen-state.v1.json";
+const PersistedLocalKeygenMetadataSchema = Schema.Struct({
+	version: Schema.Literal(LOCAL_KEYGEN_STATE_VERSION),
+	publicKey: Schema.String
+});
+const localKeygenMetadataPath = (servicePath) => `${servicePath}/${LOCAL_KEYGEN_STATE_BASENAME}`;
+const readPersistedLocalKeygenMetadata = (servicePath) => Effect.gen(function* () {
+	const raw = yield* (yield* FileSystem.FileSystem).readFileString(localKeygenMetadataPath(servicePath)).pipe(Effect.catch(() => Effect.succeed(null)));
+	if (raw === null) return null;
+	const parsed = yield* Effect.try({
+		try: () => JSON.parse(raw),
+		catch: () => null
+	}).pipe(Effect.catch(() => Effect.succeed(null)));
+	if (parsed === null) return null;
+	return yield* Schema.decodeUnknownEffect(PersistedLocalKeygenMetadataSchema)(parsed).pipe(Effect.catch(() => Effect.succeed(null)));
+});
+const stagePersistedLocalKeygenMetadata = (servicePath, name, metadata) => atomicWriteFile(localKeygenMetadataPath(servicePath), new TextEncoder().encode(`${JSON.stringify(metadata, null, 2)}\n`), {
+	mode: 420,
+	parentMode: 448
+}).pipe(Effect.catch((cause) => Effect.fail(sealError("config-render", {
+	name,
+	message: `seal.config-render: failed to write ${LOCAL_KEYGEN_STATE_BASENAME} (${cause.stage})`,
+	cause
+}))));
+const readPersistedLocalKeygenState = (servicePath) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;
+	const masterKeyBody = yield* fs.readFileString(masterKeyEnvFile).pipe(Effect.catch(() => Effect.succeed(null)));
+	if (masterKeyBody === null) return null;
+	const masterKey = parseMasterKeyEnvFile(masterKeyBody);
+	if (masterKey === null) return null;
+	const metadata = yield* readPersistedLocalKeygenMetadata(servicePath);
+	if (metadata === null) return null;
+	return {
+		masterKey,
+		publicKey: metadata.publicKey,
+		masterKeyEnvFile
+	};
+});
+const sealConfigFingerprint = (parts) => [
+	`package=${parts.packageId}`,
+	`keyServer=${parts.keyServerObjectId}`,
+	`nodeUrl=${parts.nodeUrl}`
+].join("|");
+const resolveMovePackagePath = (deps, opts) => opts.movePackagePath ? Effect.succeed(opts.movePackagePath) : resolveDefaultSealSource(deps.runtime).pipe(Effect.map((s) => s.path));
+const ensureLocalKeygenArtifacts = (deps, opts, publicKey) => Effect.gen(function* () {
+	const movePackagePath = yield* resolveMovePackagePath(deps, opts);
+	const { packageId } = yield* publishSealPackage(deps.publisher, {
+		name: opts.name,
+		chain: deps.chain,
+		movePackagePath,
+		signer: deps.signer,
+		sdk: deps.sdk,
+		runtime: deps.runtime,
+		chainProbe: deps.chainProbe,
+		...deps.buildImage !== void 0 ? { buildImage: deps.buildImage } : {}
+	});
+	const { objectId: keyServerObjectId } = yield* registerKeyServer(deps.publisher, {
+		name: opts.name,
+		chain: deps.chain,
+		keyServerUrl: deps.routedUrl,
+		sealPackageId: packageId,
+		publicKeyHex: publicKey,
+		keyServerName: opts.keyServerName,
+		signer: deps.signer,
+		sdk: deps.sdk,
+		chainProbe: deps.chainProbe
+	});
+	return {
+		packageId,
+		keyServerObjectId
+	};
+});
+const stageResolvedLocalKeygenState = (deps, opts, artifacts, keypair) => Effect.gen(function* () {
+	const { masterKeyEnvFile } = yield* stageSealConfig(renderSealKeyServerConfig({
+		sealPackageId: artifacts.packageId,
+		nodeUrl: deps.suiRpcUrlInNetwork,
+		keyServerObjectId: artifacts.keyServerObjectId
+	}), keypair.masterKey, deps.servicePath, opts.name);
+	yield* stagePersistedLocalKeygenMetadata(deps.servicePath, opts.name, {
+		version: LOCAL_KEYGEN_STATE_VERSION,
+		publicKey: keypair.publicKey
+	});
+	return {
+		packageId: artifacts.packageId,
+		keyServerObjectId: artifacts.keyServerObjectId,
+		masterKey: keypair.masterKey,
+		publicKey: keypair.publicKey,
+		masterKeyEnvFile
+	};
+});
+const startLocalKeygenContainer = (deps, opts, cargoImage, state) => Effect.gen(function* () {
+	const spec = buildKeyServerSpec({
+		name: opts.name,
+		image: cargoImage,
+		containerName: deps.containerName,
+		labels: deps.labels,
+		suiNetwork: deps.suiNetworkName,
+		servicePath: deps.servicePath,
+		configFingerprint: sealConfigFingerprint({
+			packageId: state.packageId,
+			keyServerObjectId: state.keyServerObjectId,
+			nodeUrl: deps.suiRpcUrlInNetwork
+		}),
+		routedHostname: deps.routedHostname,
+		routedUrl: deps.routedUrl,
+		readyTimeoutMs: opts.readyTimeoutMs
+	});
+	const { containerName } = yield* startKeyServer(deps.runtime, spec, opts.name);
+	const serverConfigs = [{
+		objectId: state.keyServerObjectId,
+		weight: 1
+	}];
+	const keyManager = makeKeyManager({
+		name: opts.name,
+		masterKeyEnvFile: state.masterKeyEnvFile,
+		rotateImpl: stubRotate(opts.name)
+	});
+	return {
+		keyServer: {
+			serverConfigs,
+			keyServerUrl: deps.routedUrl,
+			objectId: state.keyServerObjectId
+		},
+		keyManager,
+		packageId: state.packageId
+	};
+});
+/** The plugin's aggregate acquire body. Calls each phase in
+*  order; failures surface as typed `SealError` /
+*  `ArtifactPublishError` through the Effect's error channel.
+*
+*  Distilled-doc invariant #2 — phase order is keygen → publish →
+*  register → config-render → container. Any phase failure short-
+*  circuits before downstream phases (cheap on warm restart because
+*  the ArtifactPublisher cache + verify covers steps 3-4). */
+const bootLocalKeygen = (deps, opts) => Effect.gen(function* () {
+	const cargoImage = yield* resolveDefaultSealCargoImage(deps.runtime);
+	const persisted = yield* readPersistedLocalKeygenState(deps.servicePath);
+	if (persisted !== null) return yield* startLocalKeygenContainer(deps, opts, cargoImage, yield* stageResolvedLocalKeygenState(deps, opts, yield* ensureLocalKeygenArtifacts(deps, opts, persisted.publicKey), persisted));
+	const keypair = yield* runSealKeygen(deps.runtime, opts.name, cargoImage);
+	return yield* startLocalKeygenContainer(deps, opts, cargoImage, yield* stageResolvedLocalKeygenState(deps, opts, yield* ensureLocalKeygenArtifacts(deps, opts, keypair.publicKey), keypair));
+}).pipe(Effect.catchTag("ArtifactPublishError", (err) => Effect.fail(sealError("seal", {
+	name: opts.name,
+	message: `seal.local-keygen: on-chain artifact failure (${err.reason}): ${err.detail}`,
+	cause: err
+}))), Effect.withSpan("devstack.plugin.seal.localKeygen.boot", { attributes: {
+	"devstack.plugin": "seal",
+	"seal.name": opts.name,
+	"seal.version": opts.version
+} }));
+//#endregion
+export { bootLocalKeygen, resolveLocalKeygenOptions };
+
+//# sourceMappingURL=local-keygen.mjs.map

package/dist/plugins/seal/mode/local-keygen.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-keygen.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/local-keygen.ts"],"sourcesContent":["// Seal local-keygen mode — the full localnet path.\n//\n// Distilled-doc reference (07-seal.md §\"Lifecycle / Startup —\n// `sealLocalKeygen`\"). Eight ordered phases:\n//\n//   0. Yield deps (Sui, Identity, ContainerRuntime, artifact publisher publisher).\n//   1. Image build (bootstrap asset — parallel with sui's boot).\n//  1a. Move source resolve (bootstrap asset, conditional).\n//   2. BLS keygen one-shot (real `runtime.runOneShot` against cargo\n//                            image; output parsed via regex).\n//   3. Publish seal Move package (via artifact publisher primitive).\n//   4. Register on-chain KeyServer (via artifact publisher primitive).\n//   5. Render config yaml + stage master-key env-file (atomic\n//                                                       FileSystem\n//                                                       writes).\n//   6. Start long-running key-server container (real\n//                                               `runtime.ensureContainer`\n//                                               + exec-based ready\n//                                               probe).\n//   7. Project the plugin's aggregate value.\n//\n// Distilled-doc invariants pinned by this file:\n//\n//   #1  KeyServer.url == routed hostname        — single mint point\n//                                                 (`routedUrl` passed\n//                                                 identically into\n//                                                 `registerKeyServer`\n//                                                 and `buildKeyServerSpec`).\n//   #2  Boot order keygen → publish → register → config → container.\n//   #4  env-file for secret loading (not -e MASTER_KEY=…).\n//   #5  No host-port publish.\n//   #6  Keypair B8 verify cascade (deploy.ts:buildKeypairVerify).\n//   #7  Signal-forwarding entrypoint shell (image-side).\n//   #8  Fork incompatibility throw — handled at the barrel\n//       (`index.ts`), NOT here.\n//   #9  Peer-dep structural assignability (compile-time check\n//       lives in registry-publish.ts).\n//\n// This is the substrate-name-LEAK boundary. Inside this file we can\n// say \"seal\"; outside `src/plugins/seal/`, the substrate doesn't\n// know seal exists.\n\nimport { Effect, FileSystem, Path, Schema, type Scope } from 'effect';\n\nimport type { ChainId } from '../../../substrate/brand.ts';\nimport type { ChainProbe } from '../../../contracts/chain-probe.ts';\nimport type { ContainerLabelTuple } from '../../../contracts/snapshotable.ts';\nimport type { ContainerRuntime, ImageRef } from '../../../contracts/container-runtime.ts';\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../../primitives/artifact-publisher.ts';\nimport type { AccountValue } from '../../account/service.ts';\nimport {\n\tparseMasterKeyEnvFile,\n\trenderSealKeyServerConfig,\n\tstageSealConfig,\n} from '../config-render.ts';\nimport {\n\tpublishSealPackage,\n\tregisterKeyServer,\n\ttype SealObjectProbeKey,\n\ttype SealSuiSdk,\n} from '../deploy.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { MASTER_KEY_ENVFILE_BASENAME, runSealKeygen, type PersistedBlsKeypair } from '../keygen.ts';\nimport { makeKeyManager, stubRotate } from '../key-manager.ts';\nimport { buildKeyServerSpec, startKeyServer, type KeyServerContainerSpec } from '../key-server.ts';\nimport type { SealKeyServerEntry, SealLocalKeygenResolved } from '../registry-publish.ts';\nimport { resolveDefaultSealCargoImage } from '../bootstrap-assets/cargo-image.ts';\nimport { resolveDefaultSealSource } from '../bootstrap-assets/source-fetch.ts';\nimport { atomicWriteFile } from '../../../substrate/runtime/atomic-write.ts';\n\n// ---------------------------------------------------------------------------\n// Options (factory-time)\n// ---------------------------------------------------------------------------\n\n/** Options the local-keygen mode accepts. Mirrors v3\n *  `SealLocalKeygenOptions` (07-seal.md §\"Configuration\"). The\n *  barrel (`index.ts`) folds the typed `SealLocalKeygenOptions`\n *  surface into this internal shape after default resolution. */\nexport interface LocalKeygenOptions {\n\treadonly name?: string;\n\treadonly version?: string;\n\treadonly movePackagePath?: string;\n\treadonly readyTimeoutMs?: number;\n\treadonly keyServerName?: string;\n}\n\n/** Resolved options after defaults are applied. */\nexport interface ResolvedLocalKeygenOptions {\n\treadonly name: string;\n\treadonly version: string;\n\treadonly readyTimeoutMs: number;\n\treadonly keyServerName: string;\n\treadonly movePackagePath?: string;\n}\n\nconst DEFAULT_READY_TIMEOUT_MS = 60_000;\nconst DEFAULT_KEY_SERVER_NAME = 'devstack-local';\n\n/** Synchronous factory-time defaults application. Pure — no\n *  validation throws because the localnet signer requirement is\n *  enforced one layer up in the barrel (the type-narrowed\n *  `sealFor(local).localKeygen({signer})` makes signer required). */\nexport const resolveLocalKeygenOptions = (\n\topts: LocalKeygenOptions,\n\tdefaultVersion: string,\n): ResolvedLocalKeygenOptions => ({\n\tname: opts.name ?? 'seal',\n\tversion: opts.version ?? defaultVersion,\n\treadyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\tkeyServerName: opts.keyServerName ?? DEFAULT_KEY_SERVER_NAME,\n\tmovePackagePath: opts.movePackagePath,\n});\n\n// ---------------------------------------------------------------------------\n// Inputs to the boot pipeline (acquire-time)\n// ---------------------------------------------------------------------------\n\n/** Acquire-time deps the boot pipeline consumes. Sourced by the\n *  barrel (`index.ts`) from a mix of:\n *\n *   - substrate-resolved values (`IdentityContext`,\n *     `ContainerRuntimeService`, `ArtifactPublisher`);\n *   - substrate-derived identifiers (chainId, servicePath,\n *     subnet, etc.);\n *   - router-resolved URL (single mint — distilled-doc invariant #1).\n *\n *  The barrel composes these from substrate services\n *  (ContainerRuntime, IdentityContext, ArtifactPublisher,\n *  StackPathsService) at acquire-time. */\nexport interface LocalKeygenDeps {\n\treadonly runtime: ContainerRuntime;\n\treadonly publisher: ArtifactPublisher;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n\treadonly chain: ChainId;\n\t/** Per-stack on-disk dir under `runtime/seal/`. Host path for the\n\t *  config yaml + master-key env-file. */\n\treadonly servicePath: string;\n\t/** Container name composed by the substrate (app + stack + name +\n\t *  role). */\n\treadonly containerName: string;\n\t/** Label tuple driving snapshot/inspect by labels. */\n\treadonly labels: ContainerLabelTuple;\n\t/** Seal's per-stack docker network — the key-server daemon attaches\n\t *  to this network. */\n\treadonly suiNetworkName: string;\n\t/** In-network sui RPC URL — the daemon's CONFIG_PATH yaml carries\n\t *  this. */\n\treadonly suiRpcUrlInNetwork: string;\n\t/** Router-resolved single mint (distilled-doc invariant #1). */\n\treadonly routedHostname: string;\n\treadonly routedUrl: string;\n}\n\ninterface PersistedLocalKeygenKeyMaterial {\n\treadonly masterKey: string;\n\treadonly publicKey: string;\n\treadonly masterKeyEnvFile: string;\n}\n\ninterface PersistedLocalKeygenState extends PersistedLocalKeygenKeyMaterial {\n\treadonly packageId: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst LOCAL_KEYGEN_STATE_VERSION = 1;\nconst LOCAL_KEYGEN_STATE_BASENAME = 'local-keygen-state.v1.json';\n\nconst PersistedLocalKeygenMetadataSchema = Schema.Struct({\n\tversion: Schema.Literal(LOCAL_KEYGEN_STATE_VERSION),\n\tpublicKey: Schema.String,\n});\n\ntype PersistedLocalKeygenMetadata = Schema.Schema.Type<typeof PersistedLocalKeygenMetadataSchema>;\n\nconst localKeygenMetadataPath = (servicePath: string): string =>\n\t`${servicePath}/${LOCAL_KEYGEN_STATE_BASENAME}`;\n\nconst readPersistedLocalKeygenMetadata = (\n\tservicePath: string,\n): Effect.Effect<PersistedLocalKeygenMetadata | null, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst raw = yield* fs\n\t\t\t.readFileString(localKeygenMetadataPath(servicePath))\n\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (raw === null) return null;\n\t\tconst parsed = yield* Effect.try({\n\t\t\ttry: () => JSON.parse(raw) as unknown,\n\t\t\tcatch: () => null,\n\t\t}).pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (parsed === null) return null;\n\t\treturn yield* Schema.decodeUnknownEffect(PersistedLocalKeygenMetadataSchema)(parsed).pipe(\n\t\t\tEffect.catch(() => Effect.succeed(null)),\n\t\t);\n\t});\n\nconst stagePersistedLocalKeygenMetadata = (\n\tservicePath: string,\n\tname: string,\n\tmetadata: PersistedLocalKeygenMetadata,\n): Effect.Effect<void, SealError, FileSystem.FileSystem> =>\n\tatomicWriteFile(\n\t\tlocalKeygenMetadataPath(servicePath),\n\t\tnew TextEncoder().encode(`${JSON.stringify(metadata, null, 2)}\\n`),\n\t\t{\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t},\n\t).pipe(\n\t\tEffect.catch((cause) =>\n\t\t\tEffect.fail(\n\t\t\t\tsealError('config-render', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal.config-render: failed to write ${LOCAL_KEYGEN_STATE_BASENAME} (${cause.stage})`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\nconst readPersistedLocalKeygenState = (\n\tservicePath: string,\n): Effect.Effect<PersistedLocalKeygenKeyMaterial | null, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst masterKeyBody = yield* fs\n\t\t\t.readFileString(masterKeyEnvFile)\n\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (masterKeyBody === null) return null;\n\t\tconst masterKey = parseMasterKeyEnvFile(masterKeyBody);\n\t\tif (masterKey === null) return null;\n\t\tconst metadata = yield* readPersistedLocalKeygenMetadata(servicePath);\n\t\tif (metadata === null) return null;\n\n\t\treturn {\n\t\t\tmasterKey,\n\t\t\tpublicKey: metadata.publicKey,\n\t\t\tmasterKeyEnvFile,\n\t\t};\n\t});\n\nconst sealConfigFingerprint = (parts: {\n\treadonly packageId: string;\n\treadonly keyServerObjectId: string;\n\treadonly nodeUrl: string;\n}): string =>\n\t[\n\t\t`package=${parts.packageId}`,\n\t\t`keyServer=${parts.keyServerObjectId}`,\n\t\t`nodeUrl=${parts.nodeUrl}`,\n\t].join('|');\n\nconst resolveMovePackagePath = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n): Effect.Effect<string, SealError, Scope.Scope | FileSystem.FileSystem | Path.Path> =>\n\topts.movePackagePath\n\t\t? Effect.succeed(opts.movePackagePath)\n\t\t: resolveDefaultSealSource(deps.runtime).pipe(Effect.map((s) => s.path));\n\nconst ensureLocalKeygenArtifacts = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tpublicKey: string,\n): Effect.Effect<\n\t{\n\t\treadonly packageId: string;\n\t\treadonly keyServerObjectId: string;\n\t},\n\tSealError | ArtifactPublishError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst movePackagePath = yield* resolveMovePackagePath(deps, opts);\n\t\tconst { packageId } = yield* publishSealPackage(deps.publisher, {\n\t\t\tname: opts.name,\n\t\t\tchain: deps.chain,\n\t\t\tmovePackagePath,\n\t\t\tsigner: deps.signer,\n\t\t\tsdk: deps.sdk,\n\t\t\truntime: deps.runtime,\n\t\t\tchainProbe: deps.chainProbe,\n\t\t\t...(deps.buildImage !== undefined ? { buildImage: deps.buildImage } : {}),\n\t\t});\n\t\tconst { objectId: keyServerObjectId } = yield* registerKeyServer(deps.publisher, {\n\t\t\tname: opts.name,\n\t\t\tchain: deps.chain,\n\t\t\tkeyServerUrl: deps.routedUrl,\n\t\t\tsealPackageId: packageId,\n\t\t\tpublicKeyHex: publicKey,\n\t\t\tkeyServerName: opts.keyServerName,\n\t\t\tsigner: deps.signer,\n\t\t\tsdk: deps.sdk,\n\t\t\tchainProbe: deps.chainProbe,\n\t\t});\n\t\treturn { packageId, keyServerObjectId };\n\t});\n\nconst stageResolvedLocalKeygenState = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tartifacts: {\n\t\treadonly packageId: string;\n\t\treadonly keyServerObjectId: string;\n\t},\n\tkeypair: Pick<PersistedBlsKeypair, 'masterKey' | 'publicKey'>,\n): Effect.Effect<PersistedLocalKeygenState, SealError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst yaml = renderSealKeyServerConfig({\n\t\t\tsealPackageId: artifacts.packageId,\n\t\t\tnodeUrl: deps.suiRpcUrlInNetwork,\n\t\t\tkeyServerObjectId: artifacts.keyServerObjectId,\n\t\t});\n\t\tconst { masterKeyEnvFile } = yield* stageSealConfig(\n\t\t\tyaml,\n\t\t\tkeypair.masterKey,\n\t\t\tdeps.servicePath,\n\t\t\topts.name,\n\t\t);\n\t\tyield* stagePersistedLocalKeygenMetadata(deps.servicePath, opts.name, {\n\t\t\tversion: LOCAL_KEYGEN_STATE_VERSION,\n\t\t\tpublicKey: keypair.publicKey,\n\t\t});\n\t\treturn {\n\t\t\tpackageId: artifacts.packageId,\n\t\t\tkeyServerObjectId: artifacts.keyServerObjectId,\n\t\t\tmasterKey: keypair.masterKey,\n\t\t\tpublicKey: keypair.publicKey,\n\t\t\tmasterKeyEnvFile,\n\t\t};\n\t});\n\nconst startLocalKeygenContainer = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tcargoImage: ImageRef,\n\tstate: PersistedLocalKeygenState,\n): Effect.Effect<SealLocalKeygenResolved, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst spec: KeyServerContainerSpec = buildKeyServerSpec({\n\t\t\tname: opts.name,\n\t\t\timage: cargoImage,\n\t\t\tcontainerName: deps.containerName,\n\t\t\tlabels: deps.labels,\n\t\t\tsuiNetwork: deps.suiNetworkName,\n\t\t\tservicePath: deps.servicePath,\n\t\t\tconfigFingerprint: sealConfigFingerprint({\n\t\t\t\tpackageId: state.packageId,\n\t\t\t\tkeyServerObjectId: state.keyServerObjectId,\n\t\t\t\tnodeUrl: deps.suiRpcUrlInNetwork,\n\t\t\t}),\n\t\t\troutedHostname: deps.routedHostname,\n\t\t\troutedUrl: deps.routedUrl,\n\t\t\treadyTimeoutMs: opts.readyTimeoutMs,\n\t\t});\n\t\tconst { containerName } = yield* startKeyServer(deps.runtime, spec, opts.name);\n\t\tvoid containerName;\n\n\t\tconst serverConfigs: ReadonlyArray<SealKeyServerEntry> = [\n\t\t\t{ objectId: state.keyServerObjectId, weight: 1 },\n\t\t];\n\t\tconst keyManager = makeKeyManager({\n\t\t\tname: opts.name,\n\t\t\tmasterKeyEnvFile: state.masterKeyEnvFile,\n\t\t\trotateImpl: stubRotate(opts.name),\n\t\t});\n\t\treturn {\n\t\t\tkeyServer: {\n\t\t\t\tserverConfigs,\n\t\t\t\tkeyServerUrl: deps.routedUrl,\n\t\t\t\tobjectId: state.keyServerObjectId,\n\t\t\t},\n\t\t\tkeyManager,\n\t\t\tpackageId: state.packageId,\n\t\t} satisfies SealLocalKeygenResolved;\n\t});\n\n// ---------------------------------------------------------------------------\n// Boot pipeline\n// ---------------------------------------------------------------------------\n\n/** The plugin's aggregate acquire body. Calls each phase in\n *  order; failures surface as typed `SealError` /\n *  `ArtifactPublishError` through the Effect's error channel.\n *\n *  Distilled-doc invariant #2 — phase order is keygen → publish →\n *  register → config-render → container. Any phase failure short-\n *  circuits before downstream phases (cheap on warm restart because\n *  the ArtifactPublisher cache + verify covers steps 3-4). */\nexport const bootLocalKeygen = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n): Effect.Effect<\n\tSealLocalKeygenResolved,\n\tSealError | ArtifactPublishError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\t// ---- cargo image (bootstrap asset) -----------------------\n\t\t// The cargo image's resolver honors `SEAL_CARGO_IMAGE_OVERRIDE`\n\t\t// for the pre-baked path; falls back to a documented seam error\n\t\t// pointing at the override hatch.\n\t\tconst cargoImage: ImageRef = yield* resolveDefaultSealCargoImage(deps.runtime);\n\n\t\tconst persisted = yield* readPersistedLocalKeygenState(deps.servicePath);\n\t\tif (persisted !== null) {\n\t\t\tconst artifacts = yield* ensureLocalKeygenArtifacts(deps, opts, persisted.publicKey);\n\t\t\tconst refreshed = yield* stageResolvedLocalKeygenState(deps, opts, artifacts, persisted);\n\t\t\treturn yield* startLocalKeygenContainer(deps, opts, cargoImage, refreshed);\n\t\t}\n\n\t\t// ---- keygen (BLS12-381 master + public) -----------------\n\t\t// The keypair flows into publish + register inputs. The\n\t\t// artifact publisher still owns the on-chain artifacts; this\n\t\t// local state only persists key material.\n\t\tconst keypair: PersistedBlsKeypair = yield* runSealKeygen(deps.runtime, opts.name, cargoImage);\n\n\t\t// ---- render config + stage master-key -------------------\n\t\t// Distilled-doc invariant #19 — `network: !Devnet` is hardcoded\n\t\t// by `renderSealKeyServerConfig`. Invariant #4 — `master-key.env`\n\t\t// MUST NOT be unlinked on scope close. `stageSealConfig` does\n\t\t// NOT register a finalizer.\n\t\tconst artifacts = yield* ensureLocalKeygenArtifacts(deps, opts, keypair.publicKey);\n\t\tconst state = yield* stageResolvedLocalKeygenState(deps, opts, artifacts, keypair);\n\t\treturn yield* startLocalKeygenContainer(deps, opts, cargoImage, state);\n\t}).pipe(\n\t\tEffect.catchTag('ArtifactPublishError', (err) =>\n\t\t\tEffect.fail(\n\t\t\t\tsealError('seal', {\n\t\t\t\t\tname: opts.name,\n\t\t\t\t\tmessage: `seal.local-keygen: on-chain artifact failure (${err.reason}): ${err.detail}`,\n\t\t\t\t\tcause: err,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t\tEffect.withSpan('devstack.plugin.seal.localKeygen.boot', {\n\t\t\tattributes: {\n\t\t\t\t'devstack.plugin': 'seal',\n\t\t\t\t'seal.name': opts.name,\n\t\t\t\t'seal.version': opts.version,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;AAkGA,MAAM,2BAA2B;AACjC,MAAM,0BAA0B;;;;;AAMhC,MAAa,6BACZ,MACA,oBACiC;CACjC,MAAM,KAAK,QAAQ;CACnB,SAAS,KAAK,WAAW;CACzB,gBAAgB,KAAK,kBAAkB;CACvC,eAAe,KAAK,iBAAiB;CACrC,iBAAiB,KAAK;CACtB;AAwDD,MAAM,6BAA6B;AACnC,MAAM,8BAA8B;AAEpC,MAAM,qCAAqC,OAAO,OAAO;CACxD,SAAS,OAAO,QAAQ,2BAA2B;CACnD,WAAW,OAAO;CAClB,CAAC;AAIF,MAAM,2BAA2B,gBAChC,GAAG,YAAY,GAAG;AAEnB,MAAM,oCACL,gBAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,MAAM,QAAO,OADD,WAAW,YAE3B,eAAe,wBAAwB,YAAY,CAAC,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAChD,KAAI,QAAQ,KAAM,QAAO;CACzB,MAAM,SAAS,OAAO,OAAO,IAAI;EAChC,WAAW,KAAK,MAAM,IAAI;EAC1B,aAAa;EACb,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AACjD,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,OAAO,OAAO,oBAAoB,mCAAmC,CAAC,OAAO,CAAC,KACpF,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CACxC;EACA;AAEH,MAAM,qCACL,aACA,MACA,aAEA,gBACC,wBAAwB,YAAY,EACpC,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI,EAClE;CACC,MAAM;CACN,YAAY;CACZ,CACD,CAAC,KACD,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;CAC1B;CACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;CAC5F;CACA,CAAC,CACF,CACD,CACD;AAEF,MAAM,iCACL,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,gBAAgB,OAAO,GAC3B,eAAe,iBAAiB,CAChC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAChD,KAAI,kBAAkB,KAAM,QAAO;CACnC,MAAM,YAAY,sBAAsB,cAAc;AACtD,KAAI,cAAc,KAAM,QAAO;CAC/B,MAAM,WAAW,OAAO,iCAAiC,YAAY;AACrE,KAAI,aAAa,KAAM,QAAO;AAE9B,QAAO;EACN;EACA,WAAW,SAAS;EACpB;EACA;EACA;AAEH,MAAM,yBAAyB,UAK9B;CACC,WAAW,MAAM;CACjB,aAAa,MAAM;CACnB,WAAW,MAAM;CACjB,CAAC,KAAK,IAAI;AAEZ,MAAM,0BACL,MACA,SAEA,KAAK,kBACF,OAAO,QAAQ,KAAK,gBAAgB,GACpC,yBAAyB,KAAK,QAAQ,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC;AAE1E,MAAM,8BACL,MACA,MACA,cASA,OAAO,IAAI,aAAa;CACvB,MAAM,kBAAkB,OAAO,uBAAuB,MAAM,KAAK;CACjE,MAAM,EAAE,cAAc,OAAO,mBAAmB,KAAK,WAAW;EAC/D,MAAM,KAAK;EACX,OAAO,KAAK;EACZ;EACA,QAAQ,KAAK;EACb,KAAK,KAAK;EACV,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,GAAI,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,YAAY,GAAG,EAAE;EACxE,CAAC;CACF,MAAM,EAAE,UAAU,sBAAsB,OAAO,kBAAkB,KAAK,WAAW;EAChF,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,cAAc,KAAK;EACnB,eAAe;EACf,cAAc;EACd,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,KAAK,KAAK;EACV,YAAY,KAAK;EACjB,CAAC;AACF,QAAO;EAAE;EAAW;EAAmB;EACtC;AAEH,MAAM,iCACL,MACA,MACA,WAIA,YAEA,OAAO,IAAI,aAAa;CAMvB,MAAM,EAAE,qBAAqB,OAAO,gBALvB,0BAA0B;EACtC,eAAe,UAAU;EACzB,SAAS,KAAK;EACd,mBAAmB,UAAU;EAC7B,CAEI,EACJ,QAAQ,WACR,KAAK,aACL,KAAK,KACL;AACD,QAAO,kCAAkC,KAAK,aAAa,KAAK,MAAM;EACrE,SAAS;EACT,WAAW,QAAQ;EACnB,CAAC;AACF,QAAO;EACN,WAAW,UAAU;EACrB,mBAAmB,UAAU;EAC7B,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB;EACA;EACA;AAEH,MAAM,6BACL,MACA,MACA,YACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAA+B,mBAAmB;EACvD,MAAM,KAAK;EACX,OAAO;EACP,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,mBAAmB,sBAAsB;GACxC,WAAW,MAAM;GACjB,mBAAmB,MAAM;GACzB,SAAS,KAAK;GACd,CAAC;EACF,gBAAgB,KAAK;EACrB,WAAW,KAAK;EAChB,gBAAgB,KAAK;EACrB,CAAC;CACF,MAAM,EAAE,kBAAkB,OAAO,eAAe,KAAK,SAAS,MAAM,KAAK,KAAK;CAG9E,MAAM,gBAAmD,CACxD;EAAE,UAAU,MAAM;EAAmB,QAAQ;EAAG,CAChD;CACD,MAAM,aAAa,eAAe;EACjC,MAAM,KAAK;EACX,kBAAkB,MAAM;EACxB,YAAY,WAAW,KAAK,KAAK;EACjC,CAAC;AACF,QAAO;EACN,WAAW;GACV;GACA,cAAc,KAAK;GACnB,UAAU,MAAM;GAChB;EACD;EACA,WAAW,MAAM;EACjB;EACA;;;;;;;;;AAcH,MAAa,mBACZ,MACA,SAMA,OAAO,IAAI,aAAa;CAKvB,MAAM,aAAuB,OAAO,6BAA6B,KAAK,QAAQ;CAE9E,MAAM,YAAY,OAAO,8BAA8B,KAAK,YAAY;AACxE,KAAI,cAAc,KAGjB,QAAO,OAAO,0BAA0B,MAAM,MAAM,YAAY,OADvC,8BAA8B,MAAM,MAAM,OAD1C,2BAA2B,MAAM,MAAM,UAAU,UAAU,EACN,UAAU,CACd;CAO3E,MAAM,UAA+B,OAAO,cAAc,KAAK,SAAS,KAAK,MAAM,WAAW;AAS9F,QAAO,OAAO,0BAA0B,MAAM,MAAM,YAAY,OAD3C,8BAA8B,MAAM,MAAM,OADtC,2BAA2B,MAAM,MAAM,QAAQ,UAAU,EACR,QAAQ,CACZ;EACrE,CAAC,KACF,OAAO,SAAS,yBAAyB,QACxC,OAAO,KACN,UAAU,QAAQ;CACjB,MAAM,KAAK;CACX,SAAS,iDAAiD,IAAI,OAAO,KAAK,IAAI;CAC9E,OAAO;CACP,CAAC,CACF,CACD,EACD,OAAO,SAAS,yCAAyC,EACxD,YAAY;CACX,mBAAmB;CACnB,aAAa,KAAK;CAClB,gBAAgB,KAAK;CACrB,EACD,CAAC,CACF"}

package/dist/plugins/seal/plugin-key.mjs

@@ -0,0 +1,7 @@
+import { pluginKey } from "../../substrate/brand.mjs";
+//#region src/plugins/seal/plugin-key.ts
+const sealPluginKey = (name) => pluginKey(`seal:${name}`);
+//#endregion
+export { sealPluginKey };
+
+//# sourceMappingURL=plugin-key.mjs.map

package/dist/plugins/seal/plugin-key.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-key.mjs","names":[],"sources":["../../../src/plugins/seal/plugin-key.ts"],"sourcesContent":["import { pluginKey, type PluginKey } from '../../substrate/brand.ts';\n\nexport const sealPluginKey = (name: string): PluginKey => pluginKey(`seal:${name}`);\n"],"mappings":";;AAEA,MAAa,iBAAiB,SAA4B,UAAU,QAAQ,OAAO"}

package/dist/plugins/seal/registry-publish.d.mts

@@ -0,0 +1,43 @@
+import { SealKeyManager } from "./key-manager.mjs";
+//#region src/plugins/seal/registry-publish.d.ts
+/** Structural mirror of `@mysten/seal`'s `KeyServerConfig`.
+ *
+ *  Distilled-doc invariant #9 + #18: peer-dep structural
+ *  assignability. `@mysten/seal` is a peer dep — we duplicate the
+ *  shape locally to keep the runtime import off the bundle. A
+ *  compile-time `_SealKeyServerEntryCheck`
+ *  guards against drift. */
+interface SealKeyServerEntry {
+  readonly objectId: string;
+  readonly weight: number;
+  readonly aggregatorUrl?: string;
+}
+/** Read-side resolved value. SDK-ready: pass `serverConfigs` to
+ *  `new SealClient({serverConfigs, ...})` directly. */
+interface SealKeyServer {
+  readonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+  readonly keyServerUrl: string;
+  readonly objectId: string;
+}
+/** Public Seal resolved value. The key-server fields stay top-level
+ *  so the direct member ref is immediately SDK-ready; local-keygen
+ *  additionally exposes `manager`, while known deployments set it to
+ *  `null` because this stack does not own the master key. */
+interface SealResolved extends SealKeyServer {
+  readonly mode: 'local-keygen' | 'live' | 'fork-known';
+  readonly manager: SealKeyManager | null;
+}
+/** Aggregate resolved value the plugin's acquire body returns.
+ *  Distilled-doc §"SealLocalKeygenInternalShape" — `{keyServer,
+ *  keyManager, packageId}`. Modes that don't own a manager omit it. */
+interface SealLocalKeygenResolved {
+  readonly keyServer: SealKeyServer;
+  readonly keyManager: SealKeyManager;
+  readonly packageId: string;
+}
+interface SealKnownResolved {
+  readonly keyServer: SealKeyServer;
+}
+//#endregion
+export { SealKeyServer, SealKeyServerEntry, SealKnownResolved, SealLocalKeygenResolved, SealResolved };
+//# sourceMappingURL=registry-publish.d.mts.map

package/dist/plugins/seal/registry-publish.mjs

@@ -0,0 +1,9 @@
+import { resource } from "../../substrate/plugin.mjs";
+//#region src/plugins/seal/registry-publish.ts
+const sealResourceId = (name) => `seal:${name}`;
+/** Construct the read-side resource. */
+const makeSealResource = (name) => resource(sealResourceId(name));
+//#endregion
+export { makeSealResource, sealResourceId };
+
+//# sourceMappingURL=registry-publish.mjs.map

package/dist/plugins/seal/registry-publish.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-publish.mjs","names":[],"sources":["../../../src/plugins/seal/registry-publish.ts"],"sourcesContent":["// Seal plugin — public resolved value.\n//\n// Resource ids:\n//\n//   - `seal:<name>` — read-side key-server fields plus the local-only\n//                     manager handle when the stack owns the master key.\n//\n// The `<name>` suffix lets multiple seal instances coexist in a stack\n// without colliding on the resource registry (distilled doc §Pain Points\n// #7 — multi-instance currently untested but structurally supported).\n\nimport { resource } from '../../api/define-plugin.ts';\nimport type { SealKeyManager } from './key-manager.ts';\n\n// ---------------------------------------------------------------------------\n// Read-side: SealKeyServer\n// ---------------------------------------------------------------------------\n\n/** Structural mirror of `@mysten/seal`'s `KeyServerConfig`.\n *\n *  Distilled-doc invariant #9 + #18: peer-dep structural\n *  assignability. `@mysten/seal` is a peer dep — we duplicate the\n *  shape locally to keep the runtime import off the bundle. A\n *  compile-time `_SealKeyServerEntryCheck`\n *  guards against drift. */\nexport interface SealKeyServerEntry {\n\treadonly objectId: string;\n\treadonly weight: number;\n\treadonly aggregatorUrl?: string;\n}\n\n/** Read-side resolved value. SDK-ready: pass `serverConfigs` to\n *  `new SealClient({serverConfigs, ...})` directly. */\nexport interface SealKeyServer {\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\treadonly keyServerUrl: string;\n\treadonly objectId: string;\n}\n\n/** Public Seal resolved value. The key-server fields stay top-level\n *  so the direct member ref is immediately SDK-ready; local-keygen\n *  additionally exposes `manager`, while known deployments set it to\n *  `null` because this stack does not own the master key. */\nexport interface SealResolved extends SealKeyServer {\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n\treadonly manager: SealKeyManager | null;\n}\n\n/** Resource id constructor for the read-side handle. */\nexport type SealResourceId<Name extends string> = `seal:${Name}`;\nexport const sealResourceId = <Name extends string>(name: Name): SealResourceId<Name> =>\n\t`seal:${name}`;\n\n/** Construct the read-side resource. */\nexport const makeSealResource = <Name extends string>(name: Name) =>\n\tresource<SealResourceId<Name>, SealResolved>(sealResourceId(name));\n\n// ---------------------------------------------------------------------------\n// Projection helpers — narrow the plugin's resolved value\n// ---------------------------------------------------------------------------\n\n/** Aggregate resolved value the plugin's acquire body returns.\n *  Distilled-doc §\"SealLocalKeygenInternalShape\" — `{keyServer,\n *  keyManager, packageId}`. Modes that don't own a manager omit it. */\nexport interface SealLocalKeygenResolved {\n\treadonly keyServer: SealKeyServer;\n\treadonly keyManager: SealKeyManager;\n\treadonly packageId: string;\n}\n\nexport interface SealKnownResolved {\n\treadonly keyServer: SealKeyServer;\n}\n"],"mappings":";;AAkDA,MAAa,kBAAuC,SACnD,QAAQ;;AAGT,MAAa,oBAAyC,SACrD,SAA6C,eAAe,KAAK,CAAC"}

package/dist/plugins/seal/routable.mjs

@@ -0,0 +1,57 @@
+//#region src/plugins/seal/routable.ts
+/** Well-known endpoint name for the seal key-server. Conventional
+*  router entrypoint `'seal-key-server'` on port 2024. */
+const SEAL_KEY_SERVER_ENDPOINT_NAME = "seal-key-server";
+const SEAL_KEY_SERVER_ROUTE_ROLE = "key-server";
+const DEFAULT_KEY_SERVER_PORT = 2024;
+const SEAL_ENTRYPOINTS = [{
+	name: SEAL_KEY_SERVER_ENDPOINT_NAME,
+	port: DEFAULT_KEY_SERVER_PORT,
+	protocol: "http"
+}];
+const DEFAULT_STACK = "main";
+const normalizeRouteSegment = (raw) => raw.toLowerCase().replace(/\./g, "-");
+/** Build the DispatchId for a seal instance. The service key
+*  encodes the instance name so multi-instance seal in the same
+*  stack mints distinct dispatch files.
+*
+*  Note: distilled-doc Open Question #7 — multi-instance seal is
+*  structurally supported but untested. The two routable decls
+*  would both claim the `'seal-key-server'` entrypoint and the
+*  same `key-server.<stack>.<app>.localhost` hostname. Until v2
+*  plans canonicalize multi-instance routing, treat one-seal-per-stack
+*  as the safe default. */
+const buildSealDispatchId = (name) => ({
+	serviceKey: `seal:${name}`,
+	role: SEAL_KEY_SERVER_ROUTE_ROLE
+});
+const buildSealKeyServerPublicRoute = (inputs) => {
+	const role = normalizeRouteSegment(SEAL_KEY_SERVER_ROUTE_ROLE);
+	const app = normalizeRouteSegment(inputs.app);
+	const stack = normalizeRouteSegment(inputs.stack);
+	const hostname = stack === DEFAULT_STACK ? `${role}.${app}.localhost` : `${role}.${stack}.${app}.localhost`;
+	return {
+		hostname,
+		url: `http://${hostname}:${inputs.port}`
+	};
+};
+/** Build the Routable contribution. The substrate's router
+*  orchestrator consumes this; the actual hostname / URL minting
+*  happens there (architecture: routes-by-key, no hardcoded
+*  service hostnames in router code). */
+const makeSealRoutable = (inputs) => ({
+	kind: "routable",
+	endpointName: SEAL_KEY_SERVER_ENDPOINT_NAME,
+	dispatchId: buildSealDispatchId(inputs.name),
+	upstream: {
+		type: "container",
+		containerName: inputs.containerName,
+		containerPort: DEFAULT_KEY_SERVER_PORT
+	},
+	cors: true,
+	wireProtocol: "http"
+});
+//#endregion
+export { DEFAULT_KEY_SERVER_PORT, SEAL_ENTRYPOINTS, SEAL_KEY_SERVER_ENDPOINT_NAME, buildSealKeyServerPublicRoute, makeSealRoutable };
+
+//# sourceMappingURL=routable.mjs.map