@mysten-incubation/devstack 0.0.0

package/dist/plugins/wallet/service.mjs

@@ -0,0 +1,97 @@
+import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
+import { walletBootError } from "./errors.mjs";
+import { WalletHttpPath } from "./protocol.mjs";
+import { acquirePairingToken, composePairUrl, tokenPath } from "./pairing.mjs";
+import { resolveOriginPolicy } from "./origin-policy.mjs";
+import { startHttpServer } from "./server.mjs";
+import { Effect } from "effect";
+//#region src/plugins/wallet/service.ts
+const WALLET_DEFAULT_BIND_ADDRESS = "0.0.0.0";
+const WALLET_DIRECT_URL_HOST = "127.0.0.1";
+const portProbeHostForBindAddress = (bindAddress) => bindAddress === WALLET_DEFAULT_BIND_ADDRESS ? "0.0.0.0" : "127.0.0.1";
+const directUrlHostForBindAddress = (bindAddress) => bindAddress === WALLET_DEFAULT_BIND_ADDRESS ? WALLET_DIRECT_URL_HOST : bindAddress;
+/**
+* Acquire the wallet service.
+*
+* Distilled-doc invariants honored:
+*
+*   - C12 (mandatory Origin + bearer): both gates are wired in
+*     `server.ts:dispatch`.
+*   - Token comparison constant-time: `pairing.ts:safeBearerEquals`.
+*   - Token file 0o600: `pairing.ts:acquirePairingToken`.
+*   - Token in URL fragment only: `pairing.ts:composePairUrl`.
+*   - Token NEVER in log lines: handlers log only `bearerValid:
+*     boolean`.
+*   - Default bindAddress `'0.0.0.0'`: required for the Docker router to
+*     reach host-loopback services on native Linux.
+*   - Stack-scoped origin allowlist (no cross-stack pairing risk):
+*     `origin-policy.ts:resolveOriginPolicy`.
+*/
+const acquireWallet = (opts, ctx) => Effect.gen(function* () {
+	yield* Effect.annotateCurrentSpan({
+		"wallet.app": ctx.app,
+		"wallet.stack": ctx.stack,
+		"wallet.chain": ctx.chain
+	});
+	const accounts = yield* ctx.resolveAccounts();
+	yield* Effect.annotateCurrentSpan({ "wallet.accountCount": accounts.length });
+	if (accounts.length === 0) return yield* Effect.fail(walletBootError({
+		phase: "no-accounts",
+		message: "wallet resolved zero accounts; add account('name') to the stack or pass accounts explicitly.",
+		hint: "`wallet()` and `wallet({ accounts: 'all' })` require at least one account member in the final stack."
+	}));
+	const accountsByAddress = /* @__PURE__ */ new Map();
+	for (const acct of accounts) accountsByAddress.set(acct.address, acct);
+	const bindAddress = opts.bindAddress ?? WALLET_DEFAULT_BIND_ADDRESS;
+	const port = yield* ctx.allocatePort(opts.port, portProbeHostForBindAddress(bindAddress));
+	const token = yield* acquirePairingToken(tokenPath(ctx.stateRoot));
+	const server = yield* startHttpServer({
+		bindAddress,
+		port,
+		token,
+		policy: yield* resolveOriginPolicy({
+			app: ctx.app,
+			stack: ctx.stack,
+			vitePortForThisStack: ctx.vitePortForThisStack,
+			routedAppOrigin: ctx.routedAppOrigin,
+			extraOrigins: opts.allowedOrigins ?? [],
+			allowLocalhostVite: opts.allowLocalhostVite ?? false
+		}),
+		accountsByAddress,
+		supervisorCtx: ctx.supervisorCtx
+	});
+	const walletUrl = ctx.routerFrontedUrl ?? `http://${directUrlHostForBindAddress(bindAddress)}:${port}`;
+	const pairUrl = composePairUrl(walletUrl, token);
+	const bindings = {
+		walletUrl,
+		pairUrl,
+		chain: ctx.chain,
+		protocolPaths: {
+			health: WalletHttpPath.HEALTH,
+			accounts: WalletHttpPath.ACCOUNTS,
+			signTransaction: WalletHttpPath.SIGN_TRANSACTION,
+			signPersonalMessage: WalletHttpPath.SIGN_PERSONAL_MESSAGE,
+			execute: WalletHttpPath.EXECUTE
+		}
+	};
+	yield* Effect.annotateCurrentSpan({
+		"wallet.url": walletUrl,
+		"wallet.localPort": port
+	});
+	yield* Effect.logInfo("wallet ready").pipe(Effect.annotateLogs({
+		[SpanAttr.walletUrl]: walletUrl,
+		[SpanAttr.walletToken]: "redacted-fragment"
+	}));
+	return {
+		url: walletUrl,
+		pairUrl,
+		bindings,
+		localPort: port,
+		token,
+		server
+	};
+});
+//#endregion
+export { acquireWallet };
+
+//# sourceMappingURL=service.mjs.map

package/dist/plugins/wallet/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/wallet/service.ts"],"sourcesContent":["// Wallet plugin — main acquire Effect.\n//\n// What this file does (15-wallet.md §Lifecycle, Startup ordered):\n//\n//   1. Resolve each consumed account tag and key the AccountValues by\n//      address (load-bearing: sign endpoints look up by address).\n//   2. Allocate a port via the substrate's `PortBrokerService`.\n//   3. Mint or rehydrate the pairing token (read-existing-or-mint at\n//      `<stateRoot>/wallet/token`, mode 0o600) via the substrate's\n//      `atomicWriteFile`.\n//   4. Resolve the stack-scoped origin allowlist via\n//      `origin-policy.ts`.\n//   5. Start the in-process HTTP server.\n//   6. Compose the wallet URL + pair URL + return the resolved\n//      `WalletValue`.\n//\n// The substrate handles:\n//\n//   - Scope finalizers (port release, server close) — declared by the\n//     substrate primitives we call into.\n//   - Endpoint registry publication (we surface the URL/pairUrl via\n//     our resolved tag value; the substrate's endpoint-registry\n//     primitive consumes the `RoutableDecl` from `routable.ts`).\n//   - Manifest emit — the substrate projects from registry. We never\n//     write `.devstack/manifest.json` directly.\n\nimport { Effect } from 'effect';\nimport type { FileSystem, Scope } from 'effect';\n\nimport type { AccountValue } from '../account/service.ts';\nimport type { DappKitConfigBindings } from './codegen.ts';\nimport { walletBootError, type WalletBootError } from './errors.ts';\nimport { resolveOriginPolicy } from './origin-policy.ts';\nimport { acquirePairingToken, composePairUrl, tokenPath, type PairingToken } from './pairing.ts';\nimport { startHttpServer, type WalletServerConfig, type WalletServerHandle } from './server.ts';\nimport { WalletHttpPath } from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// User-facing options\n// ----------------------------------------------------------------------\n\nimport type { ResourceRef } from '../../api/define-plugin.ts';\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport type { AccountResourceId } from '../account/index.ts';\n\n/** Literal sentinel for `WalletOptions.accounts: 'all'` — every account\n *  member in the stack. Expanded by the composer at `defineDevstack`\n *  call time (api-surface-design §4 D6). Kept as an exported constant\n *  so the wallet factory + composer share one source of truth. */\nexport const WALLET_ACCOUNTS_ALL = 'all' as const;\nexport type WalletAccountsAll = typeof WALLET_ACCOUNTS_ALL;\n\n/** A user-supplied account ref. The user passes the result of\n *  `account('alice')` — NOT a bare string. Generic over the literal\n *  account name so the wallet's dependency tuple preserves each\n *  per-account resource id (`account/alice`, `account/bob`, ...). */\nexport type WalletAccountMember<Name extends string = string> = ResourceRef<\n\tAccountResourceId<Name>,\n\tAccountValue\n>;\n\nexport interface WalletOptions<\n\tAccounts extends ReadonlyArray<WalletAccountMember> = ReadonlyArray<WalletAccountMember>,\n> {\n\t/** Accounts the wallet binds. Each is yielded for ordering AND its\n\t *  resolved value is keyed by address into the sign-handler map.\n\t *\n\t *  Two shapes:\n\t *\n\t *   - Explicit tuple — each entry is the plugin/resource ref returned\n\t *     by `account('name')`. Pins the bound set at the wallet's call\n\t *     site; preserves each literal `account/${Name}` so stack\n\t *     composition can validate and recursively expand the refs.\n\t *\n\t *   - The literal `'all'` — shorthand for \"every account member in\n\t *     the stack\". The composer expands this against the final\n\t *     member tuple at `defineDevstack(...)` time (api-surface-design\n\t *     §4 D6). The wallet member returned by the factory carries an\n\t *     expander hook keyed off `WALLET_ACCOUNTS_ALL` that the\n\t *     composer invokes once the account-providing members are\n\t *     known. */\n\treadonly accounts: Accounts | typeof WALLET_ACCOUNTS_ALL;\n\t/** Extra origins merged on top of the stack-scoped auto-derived\n\t *  origin. Useful for headless test runners and custom dev hosts. */\n\treadonly allowedOrigins?: ReadonlyArray<string>;\n\t/** Preferred host port. Substrate's port broker forward-scans if\n\t *  this is taken. Default: substrate-picked (no preference). */\n\treadonly port?: number;\n\t/** NIC the HTTP server binds. Defaults to `'0.0.0.0'` because the\n\t *  router runs in Docker and must reach the host process through the\n\t *  host-gateway address on native Linux. The public wallet URL remains\n\t *  router-fronted and stack-scoped. */\n\treadonly bindAddress?: string;\n\t/** Opt-in: allowlist the bare `http://localhost:<vite-port>` form.\n\t *  Off by default to close the cross-stack pairing risk (see\n\t *  `origin-policy.ts` for the long-form rationale). */\n\treadonly allowLocalhostVite?: boolean;\n}\n\n// ----------------------------------------------------------------------\n// Resolved value (what the wallet plugin publishes)\n// ----------------------------------------------------------------------\n\nexport interface WalletValue {\n\treadonly url: string; // router-fronted URL when available, loopback otherwise\n\treadonly pairUrl: string;\n\treadonly bindings: DappKitConfigBindings;\n\treadonly localPort: number;\n\treadonly token: PairingToken;\n\t/** Server handle — substrate's scope finalizer chain invokes\n\t *  `.close()`; callers don't reach in. Exposed here so tests can\n\t *  drive teardown explicitly. */\n\treadonly server: WalletServerHandle;\n}\n\nconst WALLET_DEFAULT_BIND_ADDRESS = '0.0.0.0' as const;\nconst WALLET_DIRECT_URL_HOST = '127.0.0.1' as const;\ntype WalletPortProbeHost = '127.0.0.1' | '0.0.0.0';\n\nconst portProbeHostForBindAddress = (bindAddress: string): WalletPortProbeHost =>\n\tbindAddress === WALLET_DEFAULT_BIND_ADDRESS ? '0.0.0.0' : '127.0.0.1';\n\nconst directUrlHostForBindAddress = (bindAddress: string): string =>\n\tbindAddress === WALLET_DEFAULT_BIND_ADDRESS ? WALLET_DIRECT_URL_HOST : bindAddress;\n\n// ----------------------------------------------------------------------\n// Per-acquire context — supplied by the barrel\n// ----------------------------------------------------------------------\n\n/** Inputs from the substrate. The barrel fills these from the\n *  BuildContext; tests can construct directly. */\nexport interface WalletAcquireContext {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly chain: string;\n\t/** State root where `wallet/token` lives. Convention:\n\t *  `<appDir>/.devstack/stacks/<stack>/runtime`. */\n\treadonly stateRoot: string;\n\t/** Vite port for THIS stack (per-stack scoping — see\n\t *  `origin-policy.ts`). `null` if no vite is mounted. */\n\treadonly vitePortForThisStack: number | null;\n\t/** Port broker seam — returns the allocated port + a scope-\n\t *  finalizer-installed release. The barrel adapts the substrate's\n\t *  `PortBrokerService.allocate` to this signature so tests can pin\n\t *  the port without yielding from a substrate Layer. */\n\treadonly allocatePort: (\n\t\tpreferred?: number,\n\t\tprobeHost?: WalletPortProbeHost,\n\t) => Effect.Effect<number, WalletBootError, Scope.Scope>;\n\t/** Account value resolver — the barrel hands this in keyed off the\n\t *  BuildContext so the service body stays substrate-agnostic. */\n\treadonly resolveAccounts: () => Effect.Effect<ReadonlyArray<AccountValue>, WalletBootError>;\n\t/** Stable router-fronted base URL for this wallet on the stack-scoped\n\t *  hostname (e.g. `http://wallet.<app>.localhost:<router-port>`). Null\n\t *  only in tests that bypass the router derivation. */\n\treadonly routerFrontedUrl: string | null;\n\t/** Stable router-fronted dev-server origin for this stack. Added to\n\t *  the wallet allowlist so app+wallet stacks work without repeating\n\t *  router origins in user configs. */\n\treadonly routedAppOrigin: string | null;\n\t/** Supervisor context captured for log/span propagation on handler\n\t *  fibers (the in-process HTTP server forks per-request from this). */\n\treadonly supervisorCtx: unknown;\n}\n\n// ----------------------------------------------------------------------\n// Acquire\n// ----------------------------------------------------------------------\n\n/**\n * Acquire the wallet service.\n *\n * Distilled-doc invariants honored:\n *\n *   - C12 (mandatory Origin + bearer): both gates are wired in\n *     `server.ts:dispatch`.\n *   - Token comparison constant-time: `pairing.ts:safeBearerEquals`.\n *   - Token file 0o600: `pairing.ts:acquirePairingToken`.\n *   - Token in URL fragment only: `pairing.ts:composePairUrl`.\n *   - Token NEVER in log lines: handlers log only `bearerValid:\n *     boolean`.\n *   - Default bindAddress `'0.0.0.0'`: required for the Docker router to\n *     reach host-loopback services on native Linux.\n *   - Stack-scoped origin allowlist (no cross-stack pairing risk):\n *     `origin-policy.ts:resolveOriginPolicy`.\n */\nexport const acquireWallet = (\n\topts: WalletOptions,\n\tctx: WalletAcquireContext,\n): Effect.Effect<WalletValue, WalletBootError, Scope.Scope | FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'wallet.app': ctx.app,\n\t\t\t'wallet.stack': ctx.stack,\n\t\t\t'wallet.chain': ctx.chain,\n\t\t});\n\n\t\t// 1. Resolve the dependency account values. The barrel sets up\n\t\t//    `resolveAccounts` to walk the BuildContext via resolved dependencies in\n\t\t//    `opts.accounts`; we just project to the address-keyed map.\n\t\t//    Count is annotated AFTER resolution — `opts.accounts` may\n\t\t//    be the `'all'` sentinel before composer expansion, so the\n\t\t//    resolved-array length is the load-bearing value.\n\t\tconst accounts = yield* ctx.resolveAccounts();\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'wallet.accountCount': accounts.length,\n\t\t});\n\t\tif (accounts.length === 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'no-accounts',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"wallet resolved zero accounts; add account('name') to the stack or pass accounts explicitly.\",\n\t\t\t\t\thint: \"`wallet()` and `wallet({ accounts: 'all' })` require at least one account member in the final stack.\",\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst accountsByAddress = new Map<string, AccountValue>();\n\t\tfor (const acct of accounts) {\n\t\t\taccountsByAddress.set(acct.address, acct);\n\t\t}\n\n\t\t// 2. Port allocation. Probe the same host family the real\n\t\t//    listener uses, otherwise a process bound on a non-loopback\n\t\t//    interface could race the wallet's all-interface listen.\n\t\tconst bindAddress = opts.bindAddress ?? WALLET_DEFAULT_BIND_ADDRESS;\n\t\tconst port = yield* ctx.allocatePort(opts.port, portProbeHostForBindAddress(bindAddress));\n\n\t\t// 3. Token mint or rehydrate. Lives at the stack-scoped state root\n\t\t//    so warm-start + snapshot-restore preserve the existing\n\t\t//    pairing.\n\t\tconst token = yield* acquirePairingToken(tokenPath(ctx.stateRoot));\n\n\t\t// 4. Origin policy. Stack-scoped — only allows THIS stack's vite\n\t\t//    port through.\n\t\tconst policy = yield* resolveOriginPolicy({\n\t\t\tapp: ctx.app,\n\t\t\tstack: ctx.stack,\n\t\t\tvitePortForThisStack: ctx.vitePortForThisStack,\n\t\t\troutedAppOrigin: ctx.routedAppOrigin,\n\t\t\textraOrigins: opts.allowedOrigins ?? [],\n\t\t\tallowLocalhostVite: opts.allowLocalhostVite ?? false,\n\t\t});\n\n\t\t// 5. Start the HTTP server. The dispatcher in `server.ts` owns\n\t\t//    route matching + the constant-time bearer compare + the\n\t\t//    JSON envelope contract.\n\t\tconst serverConfig: WalletServerConfig = {\n\t\t\tbindAddress,\n\t\t\tport,\n\t\t\ttoken,\n\t\t\tpolicy,\n\t\t\taccountsByAddress,\n\t\t\tsupervisorCtx: ctx.supervisorCtx,\n\t\t};\n\t\tconst server = yield* startHttpServer(serverConfig);\n\n\t\t// 6. Compose URLs. Router-fronted form when available, loopback\n\t\t//    fallback otherwise. The token rides ONLY the fragment — never\n\t\t//    a query param — per C13.\n\t\tconst walletUrl =\n\t\t\tctx.routerFrontedUrl ?? `http://${directUrlHostForBindAddress(bindAddress)}:${port}`;\n\t\tconst pairUrl = composePairUrl(walletUrl, token);\n\n\t\tconst bindings: DappKitConfigBindings = {\n\t\t\twalletUrl,\n\t\t\tpairUrl,\n\t\t\tchain: ctx.chain,\n\t\t\tprotocolPaths: {\n\t\t\t\thealth: WalletHttpPath.HEALTH,\n\t\t\t\taccounts: WalletHttpPath.ACCOUNTS,\n\t\t\t\tsignTransaction: WalletHttpPath.SIGN_TRANSACTION,\n\t\t\t\tsignPersonalMessage: WalletHttpPath.SIGN_PERSONAL_MESSAGE,\n\t\t\t\texecute: WalletHttpPath.EXECUTE,\n\t\t\t},\n\t\t};\n\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'wallet.url': walletUrl,\n\t\t\t'wallet.localPort': port,\n\t\t});\n\n\t\t// Defensive: NEVER log `pairUrl` directly. It carries the token.\n\t\tyield* Effect.logInfo('wallet ready').pipe(\n\t\t\tEffect.annotateLogs({\n\t\t\t\t[SpanAttr.walletUrl]: walletUrl,\n\t\t\t\t[SpanAttr.walletToken]: 'redacted-fragment',\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\turl: walletUrl,\n\t\t\tpairUrl,\n\t\t\tbindings,\n\t\t\tlocalPort: port,\n\t\t\ttoken,\n\t\t\tserver,\n\t\t} satisfies WalletValue;\n\t});\n"],"mappings":";;;;;;;;AAmHA,MAAM,8BAA8B;AACpC,MAAM,yBAAyB;AAG/B,MAAM,+BAA+B,gBACpC,gBAAgB,8BAA8B,YAAY;AAE3D,MAAM,+BAA+B,gBACpC,gBAAgB,8BAA8B,yBAAyB;;;;;;;;;;;;;;;;;;AA+DxE,MAAa,iBACZ,MACA,QAEA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;EACjC,cAAc,IAAI;EAClB,gBAAgB,IAAI;EACpB,gBAAgB,IAAI;EACpB,CAAC;CAQF,MAAM,WAAW,OAAO,IAAI,iBAAiB;AAC7C,QAAO,OAAO,oBAAoB,EACjC,uBAAuB,SAAS,QAChC,CAAC;AACF,KAAI,SAAS,WAAW,EACvB,QAAO,OAAO,OAAO,KACpB,gBAAgB;EACf,OAAO;EACP,SACC;EACD,MAAM;EACN,CAAC,CACF;CAEF,MAAM,oCAAoB,IAAI,KAA2B;AACzD,MAAK,MAAM,QAAQ,SAClB,mBAAkB,IAAI,KAAK,SAAS,KAAK;CAM1C,MAAM,cAAc,KAAK,eAAe;CACxC,MAAM,OAAO,OAAO,IAAI,aAAa,KAAK,MAAM,4BAA4B,YAAY,CAAC;CAKzF,MAAM,QAAQ,OAAO,oBAAoB,UAAU,IAAI,UAAU,CAAC;CAwBlE,MAAM,SAAS,OAAO,gBAAgB;EAPrC;EACA;EACA;EACA,QAAA,OAhBqB,oBAAoB;GACzC,KAAK,IAAI;GACT,OAAO,IAAI;GACX,sBAAsB,IAAI;GAC1B,iBAAiB,IAAI;GACrB,cAAc,KAAK,kBAAkB,EAAE;GACvC,oBAAoB,KAAK,sBAAsB;GAC/C,CAAC;EAUD;EACA,eAAe,IAAI;EAE8B,CAAC;CAKnD,MAAM,YACL,IAAI,oBAAoB,UAAU,4BAA4B,YAAY,CAAC,GAAG;CAC/E,MAAM,UAAU,eAAe,WAAW,MAAM;CAEhD,MAAM,WAAkC;EACvC;EACA;EACA,OAAO,IAAI;EACX,eAAe;GACd,QAAQ,eAAe;GACvB,UAAU,eAAe;GACzB,iBAAiB,eAAe;GAChC,qBAAqB,eAAe;GACpC,SAAS,eAAe;GACxB;EACD;AAED,QAAO,OAAO,oBAAoB;EACjC,cAAc;EACd,oBAAoB;EACpB,CAAC;AAGF,QAAO,OAAO,QAAQ,eAAe,CAAC,KACrC,OAAO,aAAa;GAClB,SAAS,YAAY;GACrB,SAAS,cAAc;EACxB,CAAC,CACF;AAED,QAAO;EACN,KAAK;EACL;EACA;EACA,WAAW;EACX;EACA;EACA;EACA"}

package/dist/plugins/wallet/snapshot.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/plugins/wallet/snapshot.mjs

@@ -0,0 +1,14 @@
+import { Effect } from "effect";
+//#region src/plugins/wallet/snapshot.ts
+const makeWalletSnapshotable = () => ({
+	kind: "snapshotable",
+	subtrees: ["wallet/token"],
+	missingTolerance: "fatal",
+	secretMaterial: true,
+	preRestore: Effect.succeed({ kind: "wallet-pairing-token" }),
+	postRestore: Effect.void
+});
+//#endregion
+export { makeWalletSnapshotable };
+
+//# sourceMappingURL=snapshot.mjs.map

package/dist/plugins/wallet/snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/wallet/snapshot.ts"],"sourcesContent":["// Wallet plugin — Snapshotable contribution.\n//\n// The dev-wallet pairing token is plugin-owned state. Snapshot L3 must\n// not special-case its runtime path; the wallet declares the subtree\n// like any other stateful plugin.\n\nimport { Effect } from 'effect';\n\nimport type { SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\nexport const makeWalletSnapshotable = (): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: ['wallet/token'],\n\tmissingTolerance: 'fatal',\n\tsecretMaterial: true,\n\tpreRestore: Effect.succeed({ kind: 'wallet-pairing-token' as const }),\n\tpostRestore: Effect.void,\n});\n"],"mappings":";;AAUA,MAAa,gCAAkD;CAC9D,MAAM;CACN,UAAU,CAAC,eAAe;CAC1B,kBAAkB;CAClB,gBAAgB;CAChB,YAAY,OAAO,QAAQ,EAAE,MAAM,wBAAiC,CAAC;CACrE,aAAa,OAAO;CACpB"}

package/dist/plugins/walrus/bootstrap-assets/cargo-image.mjs

@@ -0,0 +1,42 @@
+import { walrusPluginError } from "../errors.mjs";
+import { Effect } from "effect";
+//#region src/plugins/walrus/bootstrap-assets/cargo-image.ts
+const WALRUS_CARGO_IMAGE_OVERRIDE_ENV = "WALRUS_CARGO_IMAGE_OVERRIDE";
+/** Pinned Walrus release whose native binaries are packaged into the
+*  local-cluster wrapper image. */
+const DEFAULT_WALRUS_REF = "testnet-v1.49.1";
+/** Distilled-doc invariant 24: the wrapper-baked sui binary must
+*  match the localnet image's sui release. Pinned here in lockstep
+*  with the walrus ref bump. */
+const DEFAULT_SUI_VERSION = "devnet-v1.71.0";
+/** Resolve to the on-disk path of the vendored Dockerfile context. */
+const vendoredDockerfileContext = () => new URL("../../../../images/walrus/", import.meta.url).pathname;
+/** Resolve the walrus image. Path (a) trusts an env-override tag; path
+*  (b) builds the vendored Dockerfile via `runtime.ensureImage`. */
+const resolveCargoImage = (runtime, inputs) => Effect.gen(function* () {
+	const override = globalThis.process?.env?.[WALRUS_CARGO_IMAGE_OVERRIDE_ENV];
+	if (override && override.length > 0) return {
+		digest: override,
+		tag: override
+	};
+	const buildCtx = {
+		contextPath: vendoredDockerfileContext(),
+		dockerfile: "Dockerfile",
+		buildArgs: {
+			WALRUS_VERSION: inputs.walrusRef,
+			SUI_VERSION: inputs.suiVersion
+		}
+	};
+	const built = yield* runtime.ensureImage(buildCtx).pipe(Effect.mapError((cause) => walrusPluginError("image-build", `walrus image build failed (walrusRef=${inputs.walrusRef}, suiVersion=${inputs.suiVersion}): ${cause.reason}: ${cause.detail}`, { cause })));
+	return {
+		digest: built.digest,
+		tag: built.tag ?? built.digest
+	};
+}).pipe(Effect.withSpan("devstack.plugin.walrus.cargoImage.resolve", { attributes: {
+	"walrus.ref": inputs.walrusRef,
+	"walrus.suiVersion": inputs.suiVersion
+} }));
+//#endregion
+export { DEFAULT_SUI_VERSION, DEFAULT_WALRUS_REF, resolveCargoImage };
+
+//# sourceMappingURL=cargo-image.mjs.map

package/dist/plugins/walrus/bootstrap-assets/cargo-image.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/walrus/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Walrus vendored Dockerfile-built image.\n//\n// CONTRACT:\n//\n// The vendored Dockerfile packages the upstream Walrus release tarball\n// selected by Docker's TARGETARCH. It never builds Walrus from source:\n// upstream release binaries are the contract, and the Dockerfile verifies\n// the selected asset before the image is accepted.\n//\n// Two staged paths:\n//\n//   (a) `WALRUS_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n//        registry tag (or a locally `docker build`-tagged image). Skips\n//        the runtime build entirely and returns a bare `ImageRef`. The\n//        e2e stub test uses this path (`walrus-test-stub:latest`).\n//\n//   (b) Vendored Dockerfile build via `runtime.ensureImage()`. The\n//        substrate's content-addressed build cache short-circuits when\n//        the (context + dockerfile + buildArgs) hash matches a prior result;\n//        cold-cache wall-time is the upstream release download.\n//\n// Distilled-doc invariants honored:\n//   - 24: `DEFAULT_SUI_VERSION` (the wrapper-baked sui binary) MUST\n//        align with the localnet image's sui release.\n//   - 25: ubuntu:24.04 base — handled in the Dockerfile.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../../contracts/container-runtime.ts';\nimport { walrusPluginError, type WalrusPluginError } from '../errors.ts';\n\nconst WALRUS_CARGO_IMAGE_OVERRIDE_ENV = 'WALRUS_CARGO_IMAGE_OVERRIDE' as const;\n\n/** Pinned Walrus release whose native binaries are packaged into the\n *  local-cluster wrapper image. */\nexport const DEFAULT_WALRUS_REF = 'testnet-v1.49.1' as const;\n\n/** Distilled-doc invariant 24: the wrapper-baked sui binary must\n *  match the localnet image's sui release. Pinned here in lockstep\n *  with the walrus ref bump. */\nexport const DEFAULT_SUI_VERSION = 'devnet-v1.71.0' as const;\n\n/** Inputs to the walrus image resolver. */\nexport interface WalrusCargoImageInputs<Ref extends string = string, SuiV extends string = string> {\n\treadonly walrusRef: Ref;\n\treadonly suiVersion: SuiV;\n}\n\n/** Resolved value — the content-addressed image ref. */\nexport interface WalrusCargoImageResolved {\n\treadonly digest: string;\n\treadonly tag: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve to the on-disk path of the vendored Dockerfile context. */\nconst vendoredDockerfileContext = (): string =>\n\tnew URL('../../../../images/walrus/', import.meta.url).pathname;\n\n/** Resolve the walrus image. Path (a) trusts an env-override tag; path\n *  (b) builds the vendored Dockerfile via `runtime.ensureImage`. */\nexport const resolveCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: WalrusCargoImageInputs,\n): Effect.Effect<WalrusCargoImageResolved, WalrusPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n\t\t\t.process?.env?.[WALRUS_CARGO_IMAGE_OVERRIDE_ENV];\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. The digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker inspect`\n\t\t\t// when it materializes the image).\n\t\t\treturn { digest: override, tag: override };\n\t\t}\n\n\t\t// Real build via the vendored Dockerfile.\n\t\tconst buildCtx = {\n\t\t\tcontextPath: vendoredDockerfileContext(),\n\t\t\tdockerfile: 'Dockerfile',\n\t\t\tbuildArgs: {\n\t\t\t\tWALRUS_VERSION: inputs.walrusRef,\n\t\t\t\tSUI_VERSION: inputs.suiVersion,\n\t\t\t},\n\t\t};\n\n\t\tconst built = yield* runtime\n\t\t\t.ensureImage(buildCtx)\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'image-build',\n\t\t\t\t\t\t`walrus image build failed (walrusRef=${inputs.walrusRef}, suiVersion=${inputs.suiVersion}): ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn { digest: built.digest, tag: built.tag ?? built.digest };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.walrus.cargoImage.resolve', {\n\t\t\tattributes: {\n\t\t\t\t'walrus.ref': inputs.walrusRef,\n\t\t\t\t'walrus.suiVersion': inputs.suiVersion,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultCargoImage = (\n\truntime: ContainerRuntime,\n): Effect.Effect<ImageRef, WalrusPluginError, Scope.Scope> =>\n\tresolveCargoImage(runtime, {\n\t\twalrusRef: DEFAULT_WALRUS_REF,\n\t\tsuiVersion: DEFAULT_SUI_VERSION,\n\t});\n"],"mappings":";;;AA+BA,MAAM,kCAAkC;;;AAIxC,MAAa,qBAAqB;;;;AAKlC,MAAa,sBAAsB;;AAmBnC,MAAM,kCACL,IAAI,IAAI,8BAA8B,OAAO,KAAK,IAAI,CAAC;;;AAIxD,MAAa,qBACZ,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAY,WAChB,SAAS,MAAM;AACjB,KAAI,YAAY,SAAS,SAAS,EAIjC,QAAO;EAAE,QAAQ;EAAU,KAAK;EAAU;CAI3C,MAAM,WAAW;EAChB,aAAa,2BAA2B;EACxC,YAAY;EACZ,WAAW;GACV,gBAAgB,OAAO;GACvB,aAAa,OAAO;GACpB;EACD;CAED,MAAM,QAAQ,OAAO,QACnB,YAAY,SAAS,CACrB,KACA,OAAO,UAAU,UAChB,kBACC,eACA,wCAAwC,OAAO,UAAU,eAAe,OAAO,WAAW,KAAK,MAAM,OAAO,IAAI,MAAM,UACtH,EAAE,OAAO,CACT,CACD,CACD;AACF,QAAO;EAAE,QAAQ,MAAM;EAAQ,KAAK,MAAM,OAAO,MAAM;EAAQ;EAC9D,CAAC,KACF,OAAO,SAAS,6CAA6C,EAC5D,YAAY;CACX,cAAc,OAAO;CACrB,qBAAqB,OAAO;CAC5B,EACD,CAAC,CACF"}

package/dist/plugins/walrus/codegen.d.mts

@@ -0,0 +1,38 @@
+//#region src/plugins/walrus/codegen.d.ts
+/** Per-node descriptor — matches the storage-nodes module's shape
+ *  for the local-cluster path, and is empty (or whatever the user
+ *  provides) for known. */
+interface WalrusNodeBinding {
+  readonly nodeIndex: number;
+  readonly publicHostname: string;
+  readonly rpcUrl: string;
+}
+/** The typed shape the emitted file exports. */
+interface WalrusBindings {
+  readonly mode: 'local' | 'known';
+  readonly chain: string;
+  readonly walrusPackageId: string | null;
+  readonly walPackageId: string | null;
+  readonly walCoinType: string | null;
+  /** SDK-ready `packageConfig` — structurally compatible with
+   *  `@mysten/walrus`'s `WalrusPackageConfig`. */
+  readonly packageConfig: {
+    readonly systemObjectId: string;
+    readonly stakingPoolId: string;
+    readonly exchangeIds?: ReadonlyArray<string>;
+  };
+  /** HTTP URLs — present iff the publishing mode populated them
+   *  (local always; known only when all three are non-empty —
+   *  distilled-doc invariant 15). */
+  readonly proxyUrl: string | null;
+  readonly aggregatorUrl: string | null;
+  readonly publisherUrl: string | null;
+  /** Storage-node committee — local publishes N descriptors; known
+   *  publishes user-supplied nodes (testnet/mainnet's 100+ nodes
+   *  are fetched dynamically by the SDK, not pinned here —
+   *  distilled-doc invariant 16). */
+  readonly nodes: ReadonlyArray<WalrusNodeBinding>;
+}
+//#endregion
+export { WalrusBindings, WalrusNodeBinding };
+//# sourceMappingURL=codegen.d.mts.map

package/dist/plugins/walrus/codegen.mjs

@@ -0,0 +1,34 @@
+import { Effect } from "effect";
+//#region src/plugins/walrus/codegen.ts
+/** Construct the Codegenable contribution. Emit is byte-deterministic
+*  on unchanged input (architecture: no mtime churn on no-op
+*  cycles). */
+const makeCodegenable = (inputs) => ({
+	kind: "codegenable",
+	emitterName: "walrus-network",
+	outputPath: "walrus/network.ts",
+	emit: (ctx) => Effect.sync(() => {
+		const bindings = {
+			mode: inputs.mode,
+			chain: inputs.chain,
+			walrusPackageId: inputs.walrusPackageId,
+			walPackageId: inputs.walPackageId,
+			walCoinType: inputs.walCoinType,
+			packageConfig: {
+				systemObjectId: inputs.systemObjectId,
+				stakingPoolId: inputs.stakingPoolId,
+				exchangeIds: inputs.exchangeIds.length > 0 ? inputs.exchangeIds : void 0
+			},
+			proxyUrl: inputs.proxyUrl,
+			aggregatorUrl: inputs.aggregatorUrl,
+			publisherUrl: inputs.publisherUrl,
+			nodes: inputs.nodes
+		};
+		ctx.exportConst("walrus", bindings);
+		return ctx.done();
+	})
+});
+//#endregion
+export { makeCodegenable };
+
+//# sourceMappingURL=codegen.mjs.map

package/dist/plugins/walrus/codegen.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/walrus/codegen.ts"],"sourcesContent":["// Walrus plugin — Codegenable contribution.\n//\n// Architecture §6: plugins emit typed `CodegenableDecl`s; the codegen\n// orchestrator stages files into the user's source tree WITHOUT\n// naming the plugin. Walrus's contribution is the SDK-ready\n// `packageConfig` shape that the `@mysten/walrus` SDK consumes —\n// `{systemObjectId, stakingPoolId, exchangeIds}` — plus the proxy /\n// aggregator / publisher URLs for HTTP consumers.\n//\n// Distilled-doc opportunity #8: the v3 `localnetWalrusOptions` couples\n// to a free-form cast. We surface the bindings here as a typed\n// `WalrusBindings` shape so downstream code can `import { walrus }`\n// from the codegen-staged file and get a fully-typed handle.\n//\n// Mode-asymmetric emission:\n//   - Local: emits `{packageConfig, proxyUrl, aggregatorUrl,\n//     publisherUrl, nodes}` — full shape.\n//   - Known: emits `{packageConfig, proxyUrl?, aggregatorUrl?,\n//     publisherUrl?}` — the proxy URLs are optional because the\n//     contract only publishes them when ALL three are present\n//     (distilled-doc invariant 15).\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\n\n/** Per-node descriptor — matches the storage-nodes module's shape\n *  for the local-cluster path, and is empty (or whatever the user\n *  provides) for known. */\nexport interface WalrusNodeBinding {\n\treadonly nodeIndex: number;\n\treadonly publicHostname: string;\n\treadonly rpcUrl: string;\n}\n\n/** The typed shape the emitted file exports. */\nexport interface WalrusBindings {\n\treadonly mode: 'local' | 'known';\n\treadonly chain: string;\n\treadonly walrusPackageId: string | null;\n\treadonly walPackageId: string | null;\n\treadonly walCoinType: string | null;\n\t/** SDK-ready `packageConfig` — structurally compatible with\n\t *  `@mysten/walrus`'s `WalrusPackageConfig`. */\n\treadonly packageConfig: {\n\t\treadonly systemObjectId: string;\n\t\treadonly stakingPoolId: string;\n\t\treadonly exchangeIds?: ReadonlyArray<string>;\n\t};\n\t/** HTTP URLs — present iff the publishing mode populated them\n\t *  (local always; known only when all three are non-empty —\n\t *  distilled-doc invariant 15). */\n\treadonly proxyUrl: string | null;\n\treadonly aggregatorUrl: string | null;\n\treadonly publisherUrl: string | null;\n\t/** Storage-node committee — local publishes N descriptors; known\n\t *  publishes user-supplied nodes (testnet/mainnet's 100+ nodes\n\t *  are fetched dynamically by the SDK, not pinned here —\n\t *  distilled-doc invariant 16). */\n\treadonly nodes: ReadonlyArray<WalrusNodeBinding>;\n}\n\n/** Inputs to the codegen contribution — supplied at acquire-time.\n *  The codegen orchestrator's resolve-once memo picks up the real\n *  values via the dynamic capability factory (same shape used by\n *  Sui + Account: the factory stamps placeholders at compose-time\n *  and the post-acquire factory restamps with resolved fields). */\nexport interface MakeCodegenableInputs {\n\treadonly mode: 'local' | 'known';\n\treadonly chain: string;\n\treadonly walrusPackageId: string | null;\n\treadonly walPackageId: string | null;\n\treadonly walCoinType: string | null;\n\treadonly systemObjectId: string;\n\treadonly stakingPoolId: string;\n\treadonly exchangeIds: ReadonlyArray<string>;\n\treadonly proxyUrl: string | null;\n\treadonly aggregatorUrl: string | null;\n\treadonly publisherUrl: string | null;\n\treadonly nodes: ReadonlyArray<WalrusNodeBinding>;\n}\n\n/** Construct the Codegenable contribution. Emit is byte-deterministic\n *  on unchanged input (architecture: no mtime churn on no-op\n *  cycles). */\nexport const makeCodegenable = (\n\tinputs: MakeCodegenableInputs,\n): CodegenableDecl<'walrus-network'> => ({\n\tkind: 'codegenable',\n\temitterName: 'walrus-network',\n\toutputPath: 'walrus/network.ts',\n\temit: (ctx) =>\n\t\tEffect.sync(() => {\n\t\t\tconst bindings: WalrusBindings = {\n\t\t\t\tmode: inputs.mode,\n\t\t\t\tchain: inputs.chain,\n\t\t\t\twalrusPackageId: inputs.walrusPackageId,\n\t\t\t\twalPackageId: inputs.walPackageId,\n\t\t\t\twalCoinType: inputs.walCoinType,\n\t\t\t\tpackageConfig: {\n\t\t\t\t\tsystemObjectId: inputs.systemObjectId,\n\t\t\t\t\tstakingPoolId: inputs.stakingPoolId,\n\t\t\t\t\texchangeIds: inputs.exchangeIds.length > 0 ? inputs.exchangeIds : undefined,\n\t\t\t\t},\n\t\t\t\tproxyUrl: inputs.proxyUrl,\n\t\t\t\taggregatorUrl: inputs.aggregatorUrl,\n\t\t\t\tpublisherUrl: inputs.publisherUrl,\n\t\t\t\tnodes: inputs.nodes,\n\t\t\t};\n\t\t\tctx.exportConst('walrus', bindings);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;;;AAqFA,MAAa,mBACZ,YACwC;CACxC,MAAM;CACN,aAAa;CACb,YAAY;CACZ,OAAO,QACN,OAAO,WAAW;EACjB,MAAM,WAA2B;GAChC,MAAM,OAAO;GACb,OAAO,OAAO;GACd,iBAAiB,OAAO;GACxB,cAAc,OAAO;GACrB,aAAa,OAAO;GACpB,eAAe;IACd,gBAAgB,OAAO;IACvB,eAAe,OAAO;IACtB,aAAa,OAAO,YAAY,SAAS,IAAI,OAAO,cAAc,KAAA;IAClE;GACD,UAAU,OAAO;GACjB,eAAe,OAAO;GACtB,cAAc,OAAO;GACrB,OAAO,OAAO;GACd;AACD,MAAI,YAAY,UAAU,SAAS;AACnC,SAAO,IAAI,MAAM;GAChB;CACH"}

package/dist/plugins/walrus/deploy-paths.mjs

@@ -0,0 +1,14 @@
+import { dirname, join, relative } from "node:path";
+//#region src/plugins/walrus/deploy-paths.ts
+const walrusDeployMountPaths = (deployOutputDirHostPath, mountTarget) => {
+	const sourceHostPath = dirname(dirname(dirname(deployOutputDirHostPath)));
+	return {
+		sourceHostPath,
+		mountTarget,
+		outputDirInContainer: join(mountTarget, relative(sourceHostPath, deployOutputDirHostPath))
+	};
+};
+//#endregion
+export { walrusDeployMountPaths };
+
+//# sourceMappingURL=deploy-paths.mjs.map

package/dist/plugins/walrus/deploy-paths.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-paths.mjs","names":[],"sources":["../../../src/plugins/walrus/deploy-paths.ts"],"sourcesContent":["import { dirname, join, relative } from 'node:path';\n\nexport interface WalrusDeployMountPaths {\n\treadonly sourceHostPath: string;\n\treadonly mountTarget: string;\n\treadonly outputDirInContainer: string;\n}\n\nexport const walrusDeployMountPaths = (\n\tdeployOutputDirHostPath: string,\n\tmountTarget: string,\n): WalrusDeployMountPaths => {\n\tconst sourceHostPath = dirname(dirname(dirname(deployOutputDirHostPath)));\n\tconst outputDirInContainer = join(mountTarget, relative(sourceHostPath, deployOutputDirHostPath));\n\treturn { sourceHostPath, mountTarget, outputDirInContainer };\n};\n"],"mappings":";;AAQA,MAAa,0BACZ,yBACA,gBAC4B;CAC5B,MAAM,iBAAiB,QAAQ,QAAQ,QAAQ,wBAAwB,CAAC,CAAC;AAEzE,QAAO;EAAE;EAAgB;EAAa,sBADT,KAAK,aAAa,SAAS,gBAAgB,wBAAwB,CACtC;EAAE"}

package/dist/plugins/walrus/deploy.d.mts

@@ -0,0 +1 @@
+import { Effect, Schema, Scope } from "effect";

package/dist/plugins/walrus/deploy.mjs

@@ -0,0 +1,224 @@
+import { walrusDeployMountPaths } from "./deploy-paths.mjs";
+import { walrusPluginError } from "./errors.mjs";
+import { Duration, Effect, Schema } from "effect";
+import { join } from "node:path";
+import { access, mkdir, writeFile } from "node:fs/promises";
+//#region src/plugins/walrus/deploy.ts
+/** Verify-schema: the publisher decodes the cached id's on-chain
+*  object through this. Minimal — the substrate's `ChainProbe`
+*  decodes against this; any decode failure surfaces structured.
+*  Distilled-doc invariant 8: the probe MUST consume a stable
+*  identifier (the object id), NOT a derived hash. */
+const WalrusDeployVerifyShape = Schema.Struct({
+	systemObjectId: Schema.String,
+	stakingObjectId: Schema.String
+});
+const SuiObjectExistsShape = Schema.Struct({ objectId: Schema.String });
+const requiredDeployOutputFiles = (inputs) => [join(inputs.outputDirHostPath, "deploy"), ...Array.from({ length: inputs.committeeSize }, (_, nodeIndex) => [
+	join(inputs.outputDirHostPath, `dryrun-node-${nodeIndex}.yaml`),
+	join(inputs.outputDirHostPath, `dryrun-node-${nodeIndex}-sui.yaml`),
+	join(inputs.outputDirHostPath, `dryrun-node-${nodeIndex}.keystore`)
+]).flat()];
+const deployOutputFilesComplete = (inputs) => Effect.tryPromise({
+	try: async () => {
+		await Promise.all(requiredDeployOutputFiles(inputs).map((file) => access(file)));
+		return true;
+	},
+	catch: (cause) => walrusPluginError("deploy", `walrus deploy cache is missing local output files under ${inputs.outputDirHostPath}`, { cause })
+}).pipe(Effect.catch(() => Effect.succeed(false)));
+/** Default deploy one-shot timeout. Walrus genesis publish runs the
+*  Move publish + WAL exchange creation + per-node config emission;
+*  observed wall-clock is 30-60s. 5-minute ceiling absorbs cold-cache
+*  + slow CI runners. */
+const DEPLOY_TIMEOUT_MS = 5 * 6e4;
+const DEPLOY_BIND_SOURCE_RETRY_ATTEMPTS = 10;
+const DEPLOY_BIND_SOURCE_RETRY_DELAY_MS = 500;
+const ensureDeployOutputDir = (inputs) => Effect.tryPromise({
+	try: async () => {
+		await mkdir(inputs.outputDirHostPath, { recursive: true });
+		await writeFile(join(inputs.outputDirHostPath, ".devstack-bind-source"), "devstack walrus bind source\n", "utf8");
+	},
+	catch: (cause) => walrusPluginError("deploy", `walrus deploy failed to prepare output directory ${inputs.outputDirHostPath}`, { cause })
+});
+const hostBindMountOwner = () => {
+	const process = globalThis.process;
+	if (typeof process?.getuid !== "function" || typeof process.getgid !== "function") return;
+	return `${process.getuid()}:${process.getgid()}`;
+};
+const excerpt = (label, value) => {
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return "";
+	const body = trimmed.length > 2400 ? `${trimmed.slice(0, 1100)}...<truncated ${trimmed.length - 2200} chars>...${trimmed.slice(-1100)}` : trimmed;
+	return ` ${label}=${JSON.stringify(body)}`;
+};
+const deployExitDetail = (result, inputs) => {
+	const missingCommandHint = result.exitCode === 127 ? " exit 127 usually means the deploy image is missing walrus-deploy or an entrypoint command." : "";
+	return `walrus deploy exited with code ${result.exitCode}.` + missingCommandHint + ` outputDir=${inputs.outputDirHostPath} committee=${inputs.committeeSize} shards=${inputs.shards}` + excerpt("stdout", result.stdout) + excerpt("stderr", result.stderr);
+};
+const isBindSourceMissing = (result) => result.exitCode === 125 && /bind source path does not exist/i.test(result.stderr) && /invalid mount config/i.test(result.stderr);
+const stringifyCause = (cause) => {
+	if (cause instanceof Error) return cause.message;
+	if (typeof cause === "string") return cause;
+	try {
+		return JSON.stringify(cause);
+	} catch {
+		return String(cause);
+	}
+};
+/** Parse the walrus deploy output into a `CachedDeployState`.
+*
+*  Expected output format (best-effort match against the v3 reference's
+*  deploy stdout — the walrus binary's exact format may drift between
+*  versions):
+*
+*    walrus_package_id: 0x<hex>
+*    system_object: 0x<hex>
+*    staking_object: 0x<hex>
+*    upgrade_manager_object: 0x<hex>      (optional)
+*    treasury_object: 0x<hex>             (optional)
+*    exchange_object: 0x<hex>             (optional)
+*
+*  Returns the parsed state OR a typed `WalrusPluginError('deploy')`
+*  surfaced with stdout/stderr capture for debugging. */
+const parseDeployOutput = (stdout) => {
+	const pick = (k) => {
+		const v = new RegExp(`(?:^|\\n)\\s*${k}\\s*[:=]\\s*(\\S+)`).exec(stdout)?.[1];
+		if (v === void 0 || v === "None") return void 0;
+		return v;
+	};
+	const walrusPackageId = pick("walrus_package_id") ?? pick("package_id");
+	const systemObject = pick("system_object") ?? pick("system_object_id");
+	const stakingObject = pick("staking_object") ?? pick("staking_pool_id") ?? pick("staking_object_id");
+	if (!walrusPackageId || !systemObject || !stakingObject) return null;
+	return {
+		walrusPackageId,
+		systemObject,
+		stakingObject,
+		upgradeManagerObject: pick("upgrade_manager_object"),
+		treasuryObject: pick("treasury_object"),
+		exchangeObject: pick("exchange_object")
+	};
+};
+/** Run the walrus-deploy one-shot and parse the output.
+*
+*  Implementation:
+*    1. `runtime.runOneShot({ image, argv: ['deploy', ...] })` —
+*       fresh `docker run --rm` container. Mount the host output dir
+*       at `/opt/walrus/outputs` so the per-node config files persist.
+*    2. Parse stdout for the deploy summary.
+*    3. Surface non-zero exits + parse failures as
+*       `WalrusPluginError('deploy')` with stdout/stderr capture. */
+const runDeployOneShot = (runtime, inputs) => Effect.gen(function* () {
+	if (inputs.waitForFundsReady !== void 0) yield* inputs.waitForFundsReady.pipe(Effect.mapError((cause) => walrusPluginError("deploy", `walrus deploy funding gate failed before walrus-deploy: ${stringifyCause(cause)}`, { cause })));
+	yield* ensureDeployOutputDir(inputs);
+	const outputOwner = hostBindMountOwner();
+	const outputMount = walrusDeployMountPaths(inputs.outputDirHostPath, "/opt/walrus/runtime");
+	const argv = [
+		"deploy",
+		"--output-dir",
+		outputMount.outputDirInContainer,
+		"--committee-size",
+		String(inputs.committeeSize),
+		"--shards",
+		String(inputs.shards),
+		"--epoch-duration",
+		inputs.epochDuration,
+		"--sui-rpc-url",
+		inputs.suiRpcUrlInNetwork,
+		"--faucet-url",
+		inputs.walrusFaucetUrlInNetwork,
+		"--public-hosts",
+		inputs.publicHostsCsv,
+		"--listening-ips",
+		inputs.listeningIpsCsv
+	];
+	const runAttempt = () => runtime.runOneShot({
+		image: inputs.walrusImage,
+		argv,
+		mounts: [{
+			source: outputMount.sourceHostPath,
+			target: outputMount.mountTarget
+		}],
+		...outputOwner === void 0 ? {} : { env: { DEVSTACK_HOST_UID_GID: outputOwner } },
+		network: inputs.suiNetworkName,
+		extraHosts: { "host.docker.internal": "host-gateway" },
+		timeoutMillis: DEPLOY_TIMEOUT_MS
+	}).pipe(Effect.catch((cause) => Effect.fail(walrusPluginError("deploy", `walrus deploy one-shot failed: ${cause.reason}: ${cause.detail}`, { cause }))));
+	let result;
+	for (let attempt = 0;; attempt += 1) {
+		result = yield* runAttempt();
+		if (!isBindSourceMissing(result) || attempt >= DEPLOY_BIND_SOURCE_RETRY_ATTEMPTS) break;
+		yield* ensureDeployOutputDir(inputs);
+		yield* Effect.sleep(Duration.millis(DEPLOY_BIND_SOURCE_RETRY_DELAY_MS));
+	}
+	if (result.exitCode !== 0) return yield* Effect.fail(walrusPluginError("deploy", deployExitDetail(result, inputs), {
+		exitCode: result.exitCode,
+		stdout: result.stdout,
+		stderr: result.stderr
+	}));
+	const parsed = parseDeployOutput(result.stdout);
+	if (!parsed) return yield* Effect.fail(walrusPluginError("deploy", "walrus deploy: parser could not find walrus_package_id / system_object / staking_object in deploy output. Confirm the walrus binary's output format and adjust `parseDeployOutput` regexes in deploy.ts. SEAM: see deploy.ts header for the expected format.", {
+		stdout: result.stdout,
+		stderr: result.stderr
+	}));
+	return parsed;
+}).pipe(Effect.withSpan("devstack.plugin.walrus.deploy.oneShot", { attributes: {
+	"walrus.committeeSize": inputs.committeeSize,
+	"walrus.shards": inputs.shards
+} }), Effect.timeoutOrElse({
+	duration: Duration.millis(DEPLOY_TIMEOUT_MS + 5e3),
+	orElse: () => Effect.fail(walrusPluginError("deploy", `walrus deploy: outer timeout ${DEPLOY_TIMEOUT_MS}ms exceeded`))
+}));
+/** Compose the ArtifactSpec for a walrus deploy and dispatch
+*  through the substrate primitive. The publisher handles the full
+*  cache/verify/produce/register loop.
+*
+*  Produce: real wiring — `runDeployOneShot` runs
+*  `docker run --rm walrusImage deploy …` and parses the deploy stdout.
+*
+*  Verify-hit projection: the artifact publisher primitive returns the cached
+*  `Produced` payload after verify succeeds, so callers keep the full
+*  `CachedDeployState` shape across warm restarts. */
+const deployWalrusContracts = (publisher, probe, runtime, inputs) => Effect.gen(function* () {
+	const verified = yield* publisher.publish({
+		namespace: "walrus-deploy",
+		chain: inputs.chainId,
+		contentHash: inputs.contentHash,
+		verifySchema: WalrusDeployVerifyShape,
+		verify: (cached) => Effect.gen(function* () {
+			if (!(yield* deployOutputFilesComplete(inputs))) return null;
+			const system = yield* probe.get({
+				kind: "object",
+				objectId: cached.systemObject
+			}, SuiObjectExistsShape, "lenient");
+			if (system === null) return null;
+			const staking = yield* probe.get({
+				kind: "object",
+				objectId: cached.stakingObject
+			}, SuiObjectExistsShape, "lenient");
+			if (staking === null) return null;
+			return {
+				systemObjectId: system.objectId,
+				stakingObjectId: staking.objectId
+			};
+		}).pipe(Effect.catch(() => Effect.succeed(null))),
+		produce: runDeployOneShot(runtime, inputs).pipe(Effect.mapError((err) => ({
+			_tag: "ArtifactPublishError",
+			reason: "produce-failed",
+			detail: `walrus.deploy ${err.phase}: ${err.message}`
+		}))),
+		register: () => Effect.void
+	});
+	return { state: "walrusPackageId" in verified ? verified : {
+		walrusPackageId: "<cache-hit-not-rehydrated>",
+		systemObject: verified.systemObjectId,
+		stakingObject: verified.stakingObjectId
+	} };
+}).pipe(Effect.withSpan("devstack.plugin.walrus.deploy", { attributes: {
+	"walrus.name": inputs.walrusName,
+	"walrus.chain": inputs.chainId
+} }));
+//#endregion
+export { deployWalrusContracts };
+
+//# sourceMappingURL=deploy.mjs.map

package/dist/plugins/walrus/deploy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../src/plugins/walrus/deploy.ts"],"sourcesContent":["// Walrus deploy one-shot — Move publish via ArtifactPublisher.\n//\n// Distilled-doc reference (06-walrus.md §\"Lifecycle phase 2\"):\n// the `walrus-deploy` one-shot:\n//   - publishes the Walrus Move package on the local sui chain,\n//   - mints a WAL exchange,\n//   - emits per-node config files (`dryrun-node-<i>.yaml`,\n//     `dryrun-node-<i>.keystore`) under `runtime/walrus/<name>/deploy/`.\n//\n// We route this through the substrate's `ArtifactPublisher`\n// primitive (architecture §10 — \"callable from any plugin; no\n// plugin-side contract to implement\"). The publisher owns:\n//   - cache key derivation (folds `chainId`),\n//   - verify probe (lenient — re-derives on transient RPC failure),\n//   - produce-on-miss (runs `walrus-deploy`),\n//   - register-on-every-cycle (so downstream consumers always see\n//     the resolved state).\n//\n// Distilled-doc invariants honored here:\n//   - 5: cache key folds `chainId`.\n//   - 6: verify checks BOTH the on-disk `deploy` file AND on-chain\n//        object existence (system + staking). Either failure\n//        invalidates and re-deploys.\n//   - 7: `runtime/walrus/<name>/deploy/` rides the snapshot tar\n//        (declared via `Snapshotable.subtrees` in `snapshot.ts`).\n//   - 10: deploy summary must contain `package_id` + `system_object`\n//        + `staking_object`. We surface parse failure as\n//        `WalrusPluginError{phase: 'deploy'}` (the publisher's\n//        `produce-failed` reason).\n\nimport { Duration, Effect, Schema, type Scope } from 'effect';\nimport { access, mkdir, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { ChainProbe } from '../../contracts/chain-probe.ts';\nimport type { ChainId, ContentHash } from '../../substrate/brand.ts';\nimport type { SuiProbeKey } from '../sui/chain-probe.ts';\nimport { walrusDeployMountPaths } from './deploy-paths.ts';\nimport { walrusPluginError, type WalrusPluginError } from './errors.ts';\n\n/** Cache-stored payload — what verify re-confirms on every cycle.\n *  Mirrors the v3 `CachedDeployState` shape (06-walrus.md §\"State-\n *  store entries\"). */\nexport interface CachedDeployState {\n\treadonly walrusPackageId: string;\n\treadonly systemObject: string;\n\treadonly stakingObject: string;\n\treadonly upgradeManagerObject?: string;\n\treadonly treasuryObject?: string;\n\treadonly exchangeObject?: string;\n}\n\n/** Verify-schema: the publisher decodes the cached id's on-chain\n *  object through this. Minimal — the substrate's `ChainProbe`\n *  decodes against this; any decode failure surfaces structured.\n *  Distilled-doc invariant 8: the probe MUST consume a stable\n *  identifier (the object id), NOT a derived hash. */\nexport const WalrusDeployVerifyShape = Schema.Struct({\n\tsystemObjectId: Schema.String,\n\tstakingObjectId: Schema.String,\n});\nexport type WalrusDeployVerified = Schema.Schema.Type<typeof WalrusDeployVerifyShape>;\n\nconst SuiObjectExistsShape = Schema.Struct({\n\tobjectId: Schema.String,\n});\n\nconst requiredDeployOutputFiles = (inputs: DeployInputs): ReadonlyArray<string> => [\n\tjoin(inputs.outputDirHostPath, 'deploy'),\n\t...Array.from({ length: inputs.committeeSize }, (_, nodeIndex) => [\n\t\tjoin(inputs.outputDirHostPath, `dryrun-node-${nodeIndex}.yaml`),\n\t\tjoin(inputs.outputDirHostPath, `dryrun-node-${nodeIndex}-sui.yaml`),\n\t\tjoin(inputs.outputDirHostPath, `dryrun-node-${nodeIndex}.keystore`),\n\t]).flat(),\n];\n\nconst deployOutputFilesComplete = (\n\tinputs: DeployInputs,\n): Effect.Effect<boolean, WalrusPluginError> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tawait Promise.all(requiredDeployOutputFiles(inputs).map((file) => access(file)));\n\t\t\treturn true;\n\t\t},\n\t\tcatch: (cause) =>\n\t\t\twalrusPluginError(\n\t\t\t\t'deploy',\n\t\t\t\t`walrus deploy cache is missing local output files under ${inputs.outputDirHostPath}`,\n\t\t\t\t{ cause },\n\t\t\t),\n\t}).pipe(Effect.catch(() => Effect.succeed(false)));\n\n/** Inputs to one deploy round. */\nexport interface DeployInputs {\n\treadonly walrusName: string;\n\treadonly chainId: ChainId;\n\treadonly contentHash: ContentHash;\n\t/** Pre-derived host output dir — substrate's `servicePath('walrus',\n\t *  name, 'deploy')` equivalent. Persists across teardown\n\t *  (distilled-doc §\"What survives teardown\"). */\n\treadonly outputDirHostPath: string;\n\treadonly suiRpcUrlInNetwork: string;\n\treadonly walrusFaucetUrlInNetwork: string;\n\treadonly committeeSize: number;\n\treadonly shards: number;\n\treadonly epochDuration: string;\n\treadonly publicHostsCsv: string;\n\treadonly listeningIpsCsv: string;\n\t/** Wrapper image — the cargo-built walrus image (bootstrap asset).\n\t *  The deploy one-shot is `docker run --rm <image> deploy …`. */\n\treadonly walrusImage: ImageRef;\n\t/** Docker network the deploy one-shot attaches to, so its in-network\n\t *  Sui RPC + faucet hostnames resolve. */\n\treadonly suiNetworkName: string;\n\t/** Centralized Sui funding readiness gate. Local Sui exposes this so\n\t *  callers don't race the faucet's socket-ready / funds-ready gap. */\n\treadonly waitForFundsReady?: Effect.Effect<void, unknown>;\n}\n\n/** Default deploy one-shot timeout. Walrus genesis publish runs the\n *  Move publish + WAL exchange creation + per-node config emission;\n *  observed wall-clock is 30-60s. 5-minute ceiling absorbs cold-cache\n *  + slow CI runners. */\nconst DEPLOY_TIMEOUT_MS = 5 * 60_000;\nconst DEPLOY_BIND_SOURCE_RETRY_ATTEMPTS = 10;\nconst DEPLOY_BIND_SOURCE_RETRY_DELAY_MS = 500;\n\nconst ensureDeployOutputDir = (inputs: DeployInputs): Effect.Effect<void, WalrusPluginError> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tawait mkdir(inputs.outputDirHostPath, { recursive: true });\n\t\t\tawait writeFile(\n\t\t\t\tjoin(inputs.outputDirHostPath, '.devstack-bind-source'),\n\t\t\t\t'devstack walrus bind source\\n',\n\t\t\t\t'utf8',\n\t\t\t);\n\t\t},\n\t\tcatch: (cause) =>\n\t\t\twalrusPluginError(\n\t\t\t\t'deploy',\n\t\t\t\t`walrus deploy failed to prepare output directory ${inputs.outputDirHostPath}`,\n\t\t\t\t{ cause },\n\t\t\t),\n\t});\n\nconst hostBindMountOwner = (): string | undefined => {\n\tconst process = (\n\t\tglobalThis as {\n\t\t\tprocess?: { getuid?: () => number; getgid?: () => number };\n\t\t}\n\t).process;\n\tif (typeof process?.getuid !== 'function' || typeof process.getgid !== 'function') {\n\t\treturn undefined;\n\t}\n\treturn `${process.getuid()}:${process.getgid()}`;\n};\n\nconst excerpt = (label: string, value: string): string => {\n\tconst trimmed = value.trim();\n\tif (trimmed.length === 0) return '';\n\tconst max = 2_400;\n\tconst body =\n\t\ttrimmed.length > max\n\t\t\t? `${trimmed.slice(0, 1_100)}...<truncated ${trimmed.length - 2_200} chars>...${trimmed.slice(-1_100)}`\n\t\t\t: trimmed;\n\treturn ` ${label}=${JSON.stringify(body)}`;\n};\n\nconst deployExitDetail = (\n\tresult: { readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\tinputs: DeployInputs,\n): string => {\n\tconst missingCommandHint =\n\t\tresult.exitCode === 127\n\t\t\t? ' exit 127 usually means the deploy image is missing walrus-deploy or an entrypoint command.'\n\t\t\t: '';\n\treturn (\n\t\t`walrus deploy exited with code ${result.exitCode}.` +\n\t\tmissingCommandHint +\n\t\t` outputDir=${inputs.outputDirHostPath} committee=${inputs.committeeSize} shards=${inputs.shards}` +\n\t\texcerpt('stdout', result.stdout) +\n\t\texcerpt('stderr', result.stderr)\n\t);\n};\n\nconst isBindSourceMissing = (result: {\n\treadonly exitCode: number;\n\treadonly stderr: string;\n}): boolean =>\n\tresult.exitCode === 125 &&\n\t/bind source path does not exist/i.test(result.stderr) &&\n\t/invalid mount config/i.test(result.stderr);\n\nconst stringifyCause = (cause: unknown): string => {\n\tif (cause instanceof Error) return cause.message;\n\tif (typeof cause === 'string') return cause;\n\ttry {\n\t\treturn JSON.stringify(cause);\n\t} catch {\n\t\treturn String(cause);\n\t}\n};\n\n/** Parse the walrus deploy output into a `CachedDeployState`.\n *\n *  Expected output format (best-effort match against the v3 reference's\n *  deploy stdout — the walrus binary's exact format may drift between\n *  versions):\n *\n *    walrus_package_id: 0x<hex>\n *    system_object: 0x<hex>\n *    staking_object: 0x<hex>\n *    upgrade_manager_object: 0x<hex>      (optional)\n *    treasury_object: 0x<hex>             (optional)\n *    exchange_object: 0x<hex>             (optional)\n *\n *  Returns the parsed state OR a typed `WalrusPluginError('deploy')`\n *  surfaced with stdout/stderr capture for debugging. */\nexport const parseDeployOutput = (stdout: string): CachedDeployState | null => {\n\t// Match `key: value` (or `key = value`) lines; treat `None` as\n\t// \"absent\" per the upstream walrus-deploy output convention. The\n\t// pattern is permissive on the value (`\\S+`) — walrus-deploy\n\t// versions have varied on the exact hex format, and the substrate's\n\t// downstream `ChainProbe` re-validates the id shape anyway.\n\tconst pick = (k: string): string | undefined => {\n\t\tconst re = new RegExp(`(?:^|\\\\n)\\\\s*${k}\\\\s*[:=]\\\\s*(\\\\S+)`);\n\t\tconst m = re.exec(stdout);\n\t\tconst v = m?.[1];\n\t\tif (v === undefined || v === 'None') return undefined;\n\t\treturn v;\n\t};\n\tconst walrusPackageId = pick('walrus_package_id') ?? pick('package_id');\n\tconst systemObject = pick('system_object') ?? pick('system_object_id');\n\tconst stakingObject =\n\t\tpick('staking_object') ?? pick('staking_pool_id') ?? pick('staking_object_id');\n\tif (!walrusPackageId || !systemObject || !stakingObject) return null;\n\treturn {\n\t\twalrusPackageId,\n\t\tsystemObject,\n\t\tstakingObject,\n\t\tupgradeManagerObject: pick('upgrade_manager_object'),\n\t\ttreasuryObject: pick('treasury_object'),\n\t\texchangeObject: pick('exchange_object'),\n\t};\n};\n\n/** Run the walrus-deploy one-shot and parse the output.\n *\n *  Implementation:\n *    1. `runtime.runOneShot({ image, argv: ['deploy', ...] })` —\n *       fresh `docker run --rm` container. Mount the host output dir\n *       at `/opt/walrus/outputs` so the per-node config files persist.\n *    2. Parse stdout for the deploy summary.\n *    3. Surface non-zero exits + parse failures as\n *       `WalrusPluginError('deploy')` with stdout/stderr capture. */\nexport const runDeployOneShot = (\n\truntime: ContainerRuntime,\n\tinputs: DeployInputs,\n): Effect.Effect<CachedDeployState, WalrusPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tif (inputs.waitForFundsReady !== undefined) {\n\t\t\tyield* inputs.waitForFundsReady.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'deploy',\n\t\t\t\t\t\t`walrus deploy funding gate failed before walrus-deploy: ${stringifyCause(cause)}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tyield* ensureDeployOutputDir(inputs);\n\n\t\tconst outputOwner = hostBindMountOwner();\n\t\tconst outputMount = walrusDeployMountPaths(inputs.outputDirHostPath, '/opt/walrus/runtime');\n\t\tconst argv: ReadonlyArray<string> = [\n\t\t\t'deploy',\n\t\t\t'--output-dir',\n\t\t\toutputMount.outputDirInContainer,\n\t\t\t'--committee-size',\n\t\t\tString(inputs.committeeSize),\n\t\t\t'--shards',\n\t\t\tString(inputs.shards),\n\t\t\t'--epoch-duration',\n\t\t\tinputs.epochDuration,\n\t\t\t'--sui-rpc-url',\n\t\t\tinputs.suiRpcUrlInNetwork,\n\t\t\t'--faucet-url',\n\t\t\tinputs.walrusFaucetUrlInNetwork,\n\t\t\t'--public-hosts',\n\t\t\tinputs.publicHostsCsv,\n\t\t\t'--listening-ips',\n\t\t\tinputs.listeningIpsCsv,\n\t\t];\n\n\t\tconst runAttempt = () =>\n\t\t\truntime\n\t\t\t\t.runOneShot({\n\t\t\t\t\timage: inputs.walrusImage,\n\t\t\t\t\targv,\n\t\t\t\t\tmounts: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tsource: outputMount.sourceHostPath,\n\t\t\t\t\t\t\ttarget: outputMount.mountTarget,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t\t...(outputOwner === undefined ? {} : { env: { DEVSTACK_HOST_UID_GID: outputOwner } }),\n\t\t\t\t\tnetwork: inputs.suiNetworkName,\n\t\t\t\t\t// Same `host-gateway` rationale as storage-nodes.ts —\n\t\t\t\t\t// deploy one-shot dials sui's host-bound RPC + faucet via\n\t\t\t\t\t// `host.docker.internal`. Native Linux Docker needs the\n\t\t\t\t\t// explicit mapping; Docker Desktop is a no-op.\n\t\t\t\t\textraHosts: { 'host.docker.internal': 'host-gateway' },\n\t\t\t\t\ttimeoutMillis: DEPLOY_TIMEOUT_MS,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t\t\t'deploy',\n\t\t\t\t\t\t\t\t`walrus deploy one-shot failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\tlet result: { readonly exitCode: number; readonly stdout: string; readonly stderr: string };\n\t\tfor (let attempt = 0; ; attempt += 1) {\n\t\t\tresult = yield* runAttempt();\n\t\t\tif (!isBindSourceMissing(result) || attempt >= DEPLOY_BIND_SOURCE_RETRY_ATTEMPTS) break;\n\t\t\tyield* ensureDeployOutputDir(inputs);\n\t\t\tyield* Effect.sleep(Duration.millis(DEPLOY_BIND_SOURCE_RETRY_DELAY_MS));\n\t\t}\n\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError('deploy', deployExitDetail(result, inputs), {\n\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\tstdout: result.stdout,\n\t\t\t\t\tstderr: result.stderr,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\tconst parsed = parseDeployOutput(result.stdout);\n\t\tif (!parsed) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'deploy',\n\t\t\t\t\t`walrus deploy: parser could not find walrus_package_id / system_object / staking_object ` +\n\t\t\t\t\t\t`in deploy output. Confirm the walrus binary's output format and adjust ` +\n\t\t\t\t\t\t`\\`parseDeployOutput\\` regexes in deploy.ts. ` +\n\t\t\t\t\t\t`SEAM: see deploy.ts header for the expected format.`,\n\t\t\t\t\t{ stdout: result.stdout, stderr: result.stderr },\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn parsed;\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.walrus.deploy.oneShot', {\n\t\t\tattributes: { 'walrus.committeeSize': inputs.committeeSize, 'walrus.shards': inputs.shards },\n\t\t}),\n\t\tEffect.timeoutOrElse({\n\t\t\tduration: Duration.millis(DEPLOY_TIMEOUT_MS + 5_000),\n\t\t\torElse: () =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'deploy',\n\t\t\t\t\t\t`walrus deploy: outer timeout ${DEPLOY_TIMEOUT_MS}ms exceeded`,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t}),\n\t);\n\n/** Outputs of one deploy round — surfaced to the plugin's\n *  resolved value. */\nexport interface DeployOutputs {\n\treadonly state: CachedDeployState;\n}\n\n/** Compose the ArtifactSpec for a walrus deploy and dispatch\n *  through the substrate primitive. The publisher handles the full\n *  cache/verify/produce/register loop.\n *\n *  Produce: real wiring — `runDeployOneShot` runs\n *  `docker run --rm walrusImage deploy …` and parses the deploy stdout.\n *\n *  Verify-hit projection: the artifact publisher primitive returns the cached\n *  `Produced` payload after verify succeeds, so callers keep the full\n *  `CachedDeployState` shape across warm restarts. */\nexport const deployWalrusContracts = (\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\truntime: ContainerRuntime,\n\tinputs: DeployInputs,\n): Effect.Effect<DeployOutputs, WalrusPluginError | ArtifactPublishError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst verified = yield* publisher.publish<CachedDeployState, WalrusDeployVerified>({\n\t\t\tnamespace: 'walrus-deploy',\n\t\t\tchain: inputs.chainId,\n\t\t\tcontentHash: inputs.contentHash,\n\t\t\tverifySchema: WalrusDeployVerifyShape,\n\t\t\t// Verify: lenient probes of the cached system + staking\n\t\t\t// objects. The Sui chain probe decodes raw `getObject`\n\t\t\t// responses, so the probe schema matches that envelope and\n\t\t\t// this closure returns the compact verified shape.\n\t\t\tverify: (cached) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tif (!(yield* deployOutputFilesComplete(inputs))) return null;\n\n\t\t\t\t\tconst system = yield* probe.get(\n\t\t\t\t\t\t{ kind: 'object', objectId: cached.systemObject },\n\t\t\t\t\t\tSuiObjectExistsShape,\n\t\t\t\t\t\t'lenient',\n\t\t\t\t\t);\n\t\t\t\t\tif (system === null) return null;\n\n\t\t\t\t\tconst staking = yield* probe.get(\n\t\t\t\t\t\t{ kind: 'object', objectId: cached.stakingObject },\n\t\t\t\t\t\tSuiObjectExistsShape,\n\t\t\t\t\t\t'lenient',\n\t\t\t\t\t);\n\t\t\t\t\tif (staking === null) return null;\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsystemObjectId: system.objectId,\n\t\t\t\t\t\tstakingObjectId: staking.objectId,\n\t\t\t\t\t} satisfies WalrusDeployVerified;\n\t\t\t\t}).pipe(Effect.catch(() => Effect.succeed(null as WalrusDeployVerified | null))),\n\t\t\t// Produce: real walrus-deploy one-shot.\n\t\t\tproduce: runDeployOneShot(runtime, inputs).pipe(\n\t\t\t\tEffect.mapError(\n\t\t\t\t\t(err): ArtifactPublishError => ({\n\t\t\t\t\t\t_tag: 'ArtifactPublishError',\n\t\t\t\t\t\treason: 'produce-failed',\n\t\t\t\t\t\tdetail: `walrus.deploy ${err.phase}: ${err.message}`,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t\t// Register: fires on EVERY cycle. The plugin's outer body\n\t\t\t// performs the walrus-state / endpoint / package registry\n\t\t\t// publishes after both deploy + storage-nodes are up; this\n\t\t\t// closure is the publisher-side null-op so the substrate\n\t\t\t// satisfies its Invariant-6 contract.\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\t// Project Produced ∪ Verified onto CachedDeployState. artifact publisher returns\n\t\t// the cached Produced payload on verify-hit, but keep a defensive\n\t\t// projection for custom publisher implementations in tests.\n\t\tconst state: CachedDeployState =\n\t\t\t'walrusPackageId' in verified\n\t\t\t\t? verified\n\t\t\t\t: {\n\t\t\t\t\t\t// Verify-hit path: synthesize from the cached id's.\n\t\t\t\t\t\t// The richer fields (packageId, exchange etc.) live\n\t\t\t\t\t\t// in the on-disk artifact publisher cache; downstream consumers\n\t\t\t\t\t\t// surface them through the in-process registry. The\n\t\t\t\t\t\t// artifact publisher primitive's next API revision will hand the\n\t\t\t\t\t\t// full Produced payload back here directly —\n\t\t\t\t\t\t// architecture revision tracked in the file header.\n\t\t\t\t\t\twalrusPackageId: '<cache-hit-not-rehydrated>',\n\t\t\t\t\t\tsystemObject: verified.systemObjectId,\n\t\t\t\t\t\tstakingObject: verified.stakingObjectId,\n\t\t\t\t\t};\n\n\t\treturn { state };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.walrus.deploy', {\n\t\t\tattributes: { 'walrus.name': inputs.walrusName, 'walrus.chain': inputs.chainId },\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;AA8DA,MAAa,0BAA0B,OAAO,OAAO;CACpD,gBAAgB,OAAO;CACvB,iBAAiB,OAAO;CACxB,CAAC;AAGF,MAAM,uBAAuB,OAAO,OAAO,EAC1C,UAAU,OAAO,QACjB,CAAC;AAEF,MAAM,6BAA6B,WAAgD,CAClF,KAAK,OAAO,mBAAmB,SAAS,EACxC,GAAG,MAAM,KAAK,EAAE,QAAQ,OAAO,eAAe,GAAG,GAAG,cAAc;CACjE,KAAK,OAAO,mBAAmB,eAAe,UAAU,OAAO;CAC/D,KAAK,OAAO,mBAAmB,eAAe,UAAU,WAAW;CACnE,KAAK,OAAO,mBAAmB,eAAe,UAAU,WAAW;CACnE,CAAC,CAAC,MAAM,CACT;AAED,MAAM,6BACL,WAEA,OAAO,WAAW;CACjB,KAAK,YAAY;AAChB,QAAM,QAAQ,IAAI,0BAA0B,OAAO,CAAC,KAAK,SAAS,OAAO,KAAK,CAAC,CAAC;AAChF,SAAO;;CAER,QAAQ,UACP,kBACC,UACA,2DAA2D,OAAO,qBAClE,EAAE,OAAO,CACT;CACF,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC;;;;;AAiCnD,MAAM,oBAAoB,IAAI;AAC9B,MAAM,oCAAoC;AAC1C,MAAM,oCAAoC;AAE1C,MAAM,yBAAyB,WAC9B,OAAO,WAAW;CACjB,KAAK,YAAY;AAChB,QAAM,MAAM,OAAO,mBAAmB,EAAE,WAAW,MAAM,CAAC;AAC1D,QAAM,UACL,KAAK,OAAO,mBAAmB,wBAAwB,EACvD,iCACA,OACA;;CAEF,QAAQ,UACP,kBACC,UACA,oDAAoD,OAAO,qBAC3D,EAAE,OAAO,CACT;CACF,CAAC;AAEH,MAAM,2BAA+C;CACpD,MAAM,UACL,WAGC;AACF,KAAI,OAAO,SAAS,WAAW,cAAc,OAAO,QAAQ,WAAW,WACtE;AAED,QAAO,GAAG,QAAQ,QAAQ,CAAC,GAAG,QAAQ,QAAQ;;AAG/C,MAAM,WAAW,OAAe,UAA0B;CACzD,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAM,OACL,QAAQ,SAAS,OACd,GAAG,QAAQ,MAAM,GAAG,KAAM,CAAC,gBAAgB,QAAQ,SAAS,KAAM,YAAY,QAAQ,MAAM,MAAO,KACnG;AACJ,QAAO,IAAI,MAAM,GAAG,KAAK,UAAU,KAAK;;AAGzC,MAAM,oBACL,QACA,WACY;CACZ,MAAM,qBACL,OAAO,aAAa,MACjB,gGACA;AACJ,QACC,kCAAkC,OAAO,SAAS,KAClD,qBACA,cAAc,OAAO,kBAAkB,aAAa,OAAO,cAAc,UAAU,OAAO,WAC1F,QAAQ,UAAU,OAAO,OAAO,GAChC,QAAQ,UAAU,OAAO,OAAO;;AAIlC,MAAM,uBAAuB,WAI5B,OAAO,aAAa,OACpB,mCAAmC,KAAK,OAAO,OAAO,IACtD,wBAAwB,KAAK,OAAO,OAAO;AAE5C,MAAM,kBAAkB,UAA2B;AAClD,KAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI;AACH,SAAO,KAAK,UAAU,MAAM;SACrB;AACP,SAAO,OAAO,MAAM;;;;;;;;;;;;;;;;;;AAmBtB,MAAa,qBAAqB,WAA6C;CAM9E,MAAM,QAAQ,MAAkC;EAG/C,MAAM,IADI,IADK,OAAO,gBAAgB,EAAE,oBAC5B,CAAC,KAAK,OACP,GAAG;AACd,MAAI,MAAM,KAAA,KAAa,MAAM,OAAQ,QAAO,KAAA;AAC5C,SAAO;;CAER,MAAM,kBAAkB,KAAK,oBAAoB,IAAI,KAAK,aAAa;CACvE,MAAM,eAAe,KAAK,gBAAgB,IAAI,KAAK,mBAAmB;CACtE,MAAM,gBACL,KAAK,iBAAiB,IAAI,KAAK,kBAAkB,IAAI,KAAK,oBAAoB;AAC/E,KAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,cAAe,QAAO;AAChE,QAAO;EACN;EACA;EACA;EACA,sBAAsB,KAAK,yBAAyB;EACpD,gBAAgB,KAAK,kBAAkB;EACvC,gBAAgB,KAAK,kBAAkB;EACvC;;;;;;;;;;;AAYF,MAAa,oBACZ,SACA,WAEA,OAAO,IAAI,aAAa;AACvB,KAAI,OAAO,sBAAsB,KAAA,EAChC,QAAO,OAAO,kBAAkB,KAC/B,OAAO,UAAU,UAChB,kBACC,UACA,2DAA2D,eAAe,MAAM,IAChF,EAAE,OAAO,CACT,CACD,CACD;AAEF,QAAO,sBAAsB,OAAO;CAEpC,MAAM,cAAc,oBAAoB;CACxC,MAAM,cAAc,uBAAuB,OAAO,mBAAmB,sBAAsB;CAC3F,MAAM,OAA8B;EACnC;EACA;EACA,YAAY;EACZ;EACA,OAAO,OAAO,cAAc;EAC5B;EACA,OAAO,OAAO,OAAO;EACrB;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO;EACP;EACA,OAAO;EACP;CAED,MAAM,mBACL,QACE,WAAW;EACX,OAAO,OAAO;EACd;EACA,QAAQ,CACP;GACC,QAAQ,YAAY;GACpB,QAAQ,YAAY;GACpB,CACD;EACD,GAAI,gBAAgB,KAAA,IAAY,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,aAAa,EAAE;EACpF,SAAS,OAAO;EAKhB,YAAY,EAAE,wBAAwB,gBAAgB;EACtD,eAAe;EACf,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,kBACC,UACA,kCAAkC,MAAM,OAAO,IAAI,MAAM,UACzD,EAAE,OAAO,CACT,CACD,CACD,CACD;CAEH,IAAI;AACJ,MAAK,IAAI,UAAU,IAAK,WAAW,GAAG;AACrC,WAAS,OAAO,YAAY;AAC5B,MAAI,CAAC,oBAAoB,OAAO,IAAI,WAAW,kCAAmC;AAClF,SAAO,sBAAsB,OAAO;AACpC,SAAO,OAAO,MAAM,SAAS,OAAO,kCAAkC,CAAC;;AAGxE,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,kBAAkB,UAAU,iBAAiB,QAAQ,OAAO,EAAE;EAC7D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,CAAC,CACF;CAGF,MAAM,SAAS,kBAAkB,OAAO,OAAO;AAC/C,KAAI,CAAC,OACJ,QAAO,OAAO,OAAO,KACpB,kBACC,UACA,gQAIA;EAAE,QAAQ,OAAO;EAAQ,QAAQ,OAAO;EAAQ,CAChD,CACD;AAEF,QAAO;EACN,CAAC,KACF,OAAO,SAAS,yCAAyC,EACxD,YAAY;CAAE,wBAAwB,OAAO;CAAe,iBAAiB,OAAO;CAAQ,EAC5F,CAAC,EACF,OAAO,cAAc;CACpB,UAAU,SAAS,OAAO,oBAAoB,IAAM;CACpD,cACC,OAAO,KACN,kBACC,UACA,gCAAgC,kBAAkB,aAClD,CACD;CACF,CAAC,CACF;;;;;;;;;;;AAkBF,MAAa,yBACZ,WACA,OACA,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO,UAAU,QAAiD;EAClF,WAAW;EACX,OAAO,OAAO;EACd,aAAa,OAAO;EACpB,cAAc;EAKd,SAAS,WACR,OAAO,IAAI,aAAa;AACvB,OAAI,EAAE,OAAO,0BAA0B,OAAO,EAAG,QAAO;GAExD,MAAM,SAAS,OAAO,MAAM,IAC3B;IAAE,MAAM;IAAU,UAAU,OAAO;IAAc,EACjD,sBACA,UACA;AACD,OAAI,WAAW,KAAM,QAAO;GAE5B,MAAM,UAAU,OAAO,MAAM,IAC5B;IAAE,MAAM;IAAU,UAAU,OAAO;IAAe,EAClD,sBACA,UACA;AACD,OAAI,YAAY,KAAM,QAAO;AAE7B,UAAO;IACN,gBAAgB,OAAO;IACvB,iBAAiB,QAAQ;IACzB;IACA,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAoC,CAAC,CAAC;EAEjF,SAAS,iBAAiB,SAAS,OAAO,CAAC,KAC1C,OAAO,UACL,SAA+B;GAC/B,MAAM;GACN,QAAQ;GACR,QAAQ,iBAAiB,IAAI,MAAM,IAAI,IAAI;GAC3C,EACD,CACD;EAMD,gBAAgB,OAAO;EACvB,CAAC;AAqBF,QAAO,EAAE,OAfR,qBAAqB,WAClB,WACA;EAQA,iBAAiB;EACjB,cAAc,SAAS;EACvB,eAAe,SAAS;EACxB,EAEY;EACf,CAAC,KACF,OAAO,SAAS,iCAAiC,EAChD,YAAY;CAAE,eAAe,OAAO;CAAY,gBAAgB,OAAO;CAAS,EAChF,CAAC,CACF"}