@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/plugins/seal/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../src/plugins/seal/deploy.ts"],"sourcesContent":["// Seal plugin — SDK-backed Move publish + on-chain KeyServer register.\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport {\n\tTransaction,\n\ttype TransactionArgument,\n\ttype TransactionObjectArgument,\n} from '@mysten/sui/transactions';\n\nimport type { ChainProbe, ChainProbeSchema } from '../../contracts/chain-probe.ts';\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport { contentHash, type ChainId, type ContentHash } from '../../substrate/brand.ts';\nimport {\n\texecuteSuiTx,\n\ttype ExecutedReceipt,\n\ttype SuiExecuteClient,\n} from '../../substrate/runtime/sui-execute/index.ts';\nimport {\n\thashMoveSources,\n\trunMoveBuild,\n\tscrubLocksHost,\n\ttype BuildOutput,\n\ttype MoveBuildError,\n} from '../../substrate/runtime/sui-move-build/index.ts';\nimport type { AccountValue } from '../account/service.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { decodeHex } from './keygen.ts';\n\nconst KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;\n\nexport type SealObjectProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport interface SealSuiSdk {\n\treadonly client: unknown;\n}\n\nconst sealProduceFailed = (op: 'publish' | 'register', err: SealError): ArtifactPublishError => ({\n\t_tag: 'ArtifactPublishError',\n\treason: 'produce-failed',\n\tdetail: `seal.${op} ${err.phase}: ${err.message}`,\n});\n\nconst moveBuildToSealError = (name: string, err: MoveBuildError): SealError =>\n\tsealError('publish', {\n\t\tname,\n\t\tmessage: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,\n\t\tcause: err,\n\t});\n\nconst verifyObjectLenient = <Verified>(\n\tprobe: ChainProbe<SealObjectProbeKey>,\n\tobjectId: string,\n\tschema: ChainProbeSchema<Verified>,\n): Effect.Effect<Verified | null, never> =>\n\tprobe\n\t\t.get({ kind: 'object', objectId }, schema, 'lenient')\n\t\t.pipe(Effect.catch(() => Effect.succeed(null as Verified | null)));\n\n// ---------------------------------------------------------------------------\n// Move publish — `sealPackage` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_PACKAGE_NAMESPACE = 'seal/package' as const;\n\nexport interface SealPackageCached {\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n}\n\nexport const SealPackageVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealPackageVerified = Schema.Schema.Type<typeof SealPackageVerifyShape>;\n\nexport interface SealPublishInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly movePackagePath: string;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly runtime: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealPackageInputsHash = (\n\tsourceHash: ContentHash,\n\tsignerAddress: string,\n): ContentHash => contentHash(`seal-package|source=${sourceHash}|signer=${signerAddress}`);\n\nexport const parseSealPublishOutput = (stdout: string): SealPackageCached | null => {\n\tconst re = /(?:^|\\n)\\s*(?:package_id|packageId)\\s*[:=]\\s*(0x[0-9a-fA-F]+)/;\n\tconst m = re.exec(stdout);\n\tif (!m?.[1]) return null;\n\treturn { packageId: m[1] };\n};\n\nexport interface SealPublishTransactionBuilder<TUpgradeCap = unknown> {\n\treadonly setSender: (address: string) => void;\n\treadonly publish: (input: {\n\t\treadonly modules: ReadonlyArray<ReadonlyArray<number>>;\n\t\treadonly dependencies: ReadonlyArray<string>;\n\t}) => TUpgradeCap;\n\treadonly transferObjects: (objects: ReadonlyArray<TUpgradeCap>, recipient: string) => void;\n}\n\nconst publishTransactionBuilder = (\n\ttx: Transaction,\n): SealPublishTransactionBuilder<TransactionObjectArgument> => ({\n\tsetSender: (address) => tx.setSender(address),\n\tpublish: (input) =>\n\t\ttx.publish({\n\t\t\tmodules: input.modules.map((m) => [...m]),\n\t\t\tdependencies: [...input.dependencies],\n\t\t}),\n\ttransferObjects: (objects, recipient) => tx.transferObjects([...objects], recipient),\n});\n\nexport const buildSealPublishTransaction = <TUpgradeCap>(\n\ttx: SealPublishTransactionBuilder<TUpgradeCap>,\n\tbuildOutput: BuildOutput,\n\tsignerAddress: string,\n): void => {\n\ttx.setSender(signerAddress);\n\tconst upgradeCap = tx.publish({\n\t\tmodules: buildOutput.modules.map((m) => Array.from(m)),\n\t\tdependencies: [...buildOutput.dependencies],\n\t});\n\ttx.transferObjects([upgradeCap], signerAddress);\n};\n\nexport const pickPackageWriteObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find((change) => change.outputState === 'PackageWrite')?.objectId ?? null;\n\nexport const pickUpgradeCapObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectSealPublishReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealPackageCached, SealError> => {\n\tconst packageId = pickPackageWriteObjectId(receipt);\n\tif (packageId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('publish', {\n\t\t\t\tname,\n\t\t\t\tmessage: `seal publish tx wrote no PackageWrite object ` + `(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\tconst upgradeCapId = pickUpgradeCapObjectId(receipt);\n\treturn Effect.succeed({\n\t\tpackageId,\n\t\t...(upgradeCapId !== null ? { upgradeCapId } : {}),\n\t});\n};\n\nexport const runSealPublishTransaction = (\n\tinputs: SealPublishInputs,\n): Effect.Effect<SealPackageCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// The one-shot build path scrubs the mounted package again. Seal's\n\t\t// default source is a shared cache, so a prior container build can\n\t\t// leave Move.lock unwritable to the host.\n\t\tyield* scrubLocksHost(inputs.movePackagePath, '~/.move', {\n\t\t\tpackageLockFailures: inputs.buildImage !== undefined ? 'best-effort' : 'fatal',\n\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\n\t\tconst buildOutput = yield* runMoveBuild({\n\t\t\tsourcePath: inputs.movePackagePath,\n\t\t\tpackageName: inputs.name,\n\t\t\tchainId: inputs.chain,\n\t\t\truntime: inputs.runtime,\n\t\t\t...(inputs.buildImage !== undefined ? { buildImage: inputs.buildImage } : {}),\n\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\n\t\tconst receipt = yield* executeSuiTx({\n\t\t\tclient: inputs.sdk.client as SuiExecuteClient,\n\t\t\tsigner: inputs.signer,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildSealPublishTransaction(\n\t\t\t\t\tpublishTransactionBuilder(tx),\n\t\t\t\t\tbuildOutput,\n\t\t\t\t\tinputs.signer.address,\n\t\t\t\t);\n\t\t\t\treturn tx.build({\n\t\t\t\t\tclient: inputs.sdk.client as Parameters<typeof tx.build>[0] extends\n\t\t\t\t\t\t| { client?: infer C }\n\t\t\t\t\t\t| undefined\n\t\t\t\t\t\t? C\n\t\t\t\t\t\t: never,\n\t\t\t\t});\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx failed for signer '${inputs.signer.name}' ` +\n\t\t\t\t\t\t`(address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\n\t\treturn yield* projectSealPublishReceipt(inputs.name, receipt);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish.suiTx', {\n\t\t\tattributes: {\n\t\t\t\t'seal.name': inputs.name,\n\t\t\t\t'seal.signer': inputs.signer.address,\n\t\t\t},\n\t\t}),\n\t);\n\nexport const publishSealPackage = (\n\tpublisher: ArtifactPublisher,\n\tinputs: SealPublishInputs,\n): Effect.Effect<{ readonly packageId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst sourceHash = yield* hashMoveSources(inputs.movePackagePath).pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\t\tconst inputsHash = sealPackageInputsHash(sourceHash, inputs.signer.address);\n\n\t\tconst result = yield* publisher.publish<SealPackageCached, SealPackageVerified>({\n\t\t\tnamespace: SEAL_PACKAGE_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverifySchema: SealPackageVerifyShape,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),\n\t\t\tproduce: runSealPublishTransaction(inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('publish', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\tconst packageId = 'packageId' in result ? result.packageId : result.objectId;\n\t\tif (!packageId) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage: 'seal.deploy.publishSealPackage: publisher returned no package id',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn { packageId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish', {\n\t\t\tattributes: { 'seal.name': inputs.name, 'seal.chain': inputs.chain },\n\t\t}),\n\t);\n\n// ---------------------------------------------------------------------------\n// KeyServer register — `keyServer` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_KEY_SERVER_NAMESPACE = 'seal/key-server-id' as const;\n\nexport interface SealKeyServerCached {\n\treadonly objectId: string;\n}\n\nexport const SealKeyServerVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealKeyServerVerified = Schema.Schema.Type<typeof SealKeyServerVerifyShape>;\n\nexport interface RegisterKeyServerTransactionInputs {\n\treadonly keyServerUrl: string;\n\treadonly sealPackageId: string;\n\treadonly publicKeyHex: string;\n\treadonly keyServerName: string;\n}\n\nexport interface RegisterKeyServerInputs extends RegisterKeyServerTransactionInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealRegisterInputsHash = (\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): ContentHash =>\n\t// Keep the cache key path-safe and bounded. The raw material includes\n\t// a routed URL plus a long BLS public key; using it directly made the\n\t// best-effort cache write miss on normal restarts.\n\tcontentHash(\n\t\t`seal-register-v2|${createHash('sha256')\n\t\t\t.update(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\tpackageId: inputs.sealPackageId,\n\t\t\t\t\tkeyServerUrl: inputs.keyServerUrl,\n\t\t\t\t\tkeyServerName: inputs.keyServerName,\n\t\t\t\t\tpublicKeyHex: inputs.publicKeyHex,\n\t\t\t\t\tsignerAddress,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.digest('hex')}`,\n\t);\n\nexport const parseRegisterKeyServerOutput = (stdout: string): SealKeyServerCached | null => {\n\tconst re =\n\t\t/(?:^|\\n)\\s*(?:key_server_object_id|object_id|objectId|key_server_id)\\s*[:=]\\s*(0x[0-9a-fA-F]+)/;\n\tconst m = re.exec(stdout);\n\tif (!m?.[1]) return null;\n\treturn { objectId: m[1] };\n};\n\nexport interface SealRegisterTransactionBuilder<TArgument = unknown> {\n\treadonly pure: {\n\t\treadonly string: (value: string) => TArgument;\n\t\treadonly u8: (value: number) => TArgument;\n\t\treadonly vector: (type: 'u8', value: ReadonlyArray<number>) => TArgument;\n\t};\n\treadonly setSender: (address: string) => void;\n\treadonly moveCall: (input: {\n\t\treadonly target: string;\n\t\treadonly arguments: ReadonlyArray<TArgument>;\n\t}) => unknown;\n}\n\nexport type SealRegisterSdk = SealSuiSdk;\n\nconst registerTransactionBuilder = (\n\ttx: Transaction,\n): SealRegisterTransactionBuilder<TransactionArgument> => ({\n\tpure: {\n\t\tstring: (value) => tx.pure.string(value),\n\t\tu8: (value) => tx.pure.u8(value),\n\t\tvector: (type, value) => tx.pure.vector(type, [...value]),\n\t},\n\tsetSender: (address) => tx.setSender(address),\n\tmoveCall: (input) =>\n\t\ttx.moveCall({\n\t\t\ttarget: input.target,\n\t\t\targuments: [...input.arguments],\n\t\t}),\n});\n\nexport const buildRegisterKeyServerMoveCall = <TArgument>(\n\ttx: SealRegisterTransactionBuilder<TArgument>,\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): void => {\n\tconst pkBytes = decodeHex(inputs.publicKeyHex);\n\ttx.setSender(signerAddress);\n\ttx.moveCall({\n\t\ttarget: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,\n\t\targuments: [\n\t\t\ttx.pure.string(inputs.keyServerName),\n\t\t\ttx.pure.string(inputs.keyServerUrl),\n\t\t\ttx.pure.u8(KEY_TYPE_BONEH_FRANKLIN_BLS12381),\n\t\t\ttx.pure.vector('u8', Array.from(pkBytes)),\n\t\t],\n\t});\n};\n\nexport const pickCreatedKeyServerObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::key_server::KeyServer') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectRegisterKeyServerReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealKeyServerCached, SealError> => {\n\tconst objectId = pickCreatedKeyServerObjectId(receipt);\n\tif (objectId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('register', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal register tx created no ::key_server::KeyServer object ` +\n\t\t\t\t\t`(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({ objectId });\n};\n\nexport const runRegisterKeyServerTransaction = (\n\tsdk: SealRegisterSdk,\n\tsigner: AccountValue,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<SealKeyServerCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst receipt = yield* executeSuiTx({\n\t\t\tclient: sdk.client as SuiExecuteClient,\n\t\t\tsigner,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildRegisterKeyServerMoveCall(registerTransactionBuilder(tx), inputs, signer.address);\n\t\t\t\treturn tx.build({\n\t\t\t\t\tclient: sdk.client as Parameters<typeof tx.build>[0] extends\n\t\t\t\t\t\t| { client?: infer C }\n\t\t\t\t\t\t| undefined\n\t\t\t\t\t\t? C\n\t\t\t\t\t\t: never,\n\t\t\t\t});\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx failed for signer '${signer.name}' ` +\n\t\t\t\t\t\t`(address=${signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\n\t\treturn yield* projectRegisterKeyServerReceipt(inputs.name, receipt);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register.suiTx', {\n\t\t\tattributes: { 'seal.name': inputs.name, 'seal.url': inputs.keyServerUrl },\n\t\t}),\n\t);\n\nexport const registerKeyServer = (\n\tpublisher: ArtifactPublisher,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<{ readonly objectId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);\n\t\tconst result = yield* publisher.publish<SealKeyServerCached, SealKeyServerVerified>({\n\t\t\tnamespace: SEAL_KEY_SERVER_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverifySchema: SealKeyServerVerifyShape,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),\n\t\t\tproduce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('register', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\tconst objectId = 'objectId' in result ? result.objectId : undefined;\n\t\tif (!objectId) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage: 'seal.deploy.registerKeyServer: publisher returned no objectId',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn { objectId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register', {\n\t\t\tattributes: { 'seal.name': inputs.name, 'seal.url': inputs.keyServerUrl },\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;AAmCA,MAAM,mCAAmC;AAQzC,MAAM,qBAAqB,IAA4B,SAA0C;CAChG,MAAM;CACN,QAAQ;CACR,QAAQ,QAAQ,GAAG,GAAG,IAAI,MAAM,IAAI,IAAI;CACxC;AAED,MAAM,wBAAwB,MAAc,QAC3C,UAAU,WAAW;CACpB;CACA,SAAS,gBAAgB,IAAI,MAAM,sBAAsB,IAAI,WAAW,KAAK,IAAI;CACjF,OAAO;CACP,CAAC;AAEH,MAAM,uBACL,OACA,UACA,WAEA,MACE,IAAI;CAAE,MAAM;CAAU;CAAU,EAAE,QAAQ,UAAU,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAwB,CAAC,CAAC;AAMpE,MAAa,yBAAyB;AAOtC,MAAa,yBAAyB,OAAO,OAAO;CACnD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAcF,MAAa,yBACZ,YACA,kBACiB,YAAY,uBAAuB,WAAW,UAAU,gBAAgB;AAkB1F,MAAM,6BACL,QAC+D;CAC/D,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,UAAU,UACT,GAAG,QAAQ;EACV,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;EACzC,cAAc,CAAC,GAAG,MAAM,aAAa;EACrC,CAAC;CACH,kBAAkB,SAAS,cAAc,GAAG,gBAAgB,CAAC,GAAG,QAAQ,EAAE,UAAU;CACpF;AAED,MAAa,+BACZ,IACA,aACA,kBACU;AACV,IAAG,UAAU,cAAc;CAC3B,MAAM,aAAa,GAAG,QAAQ;EAC7B,SAAS,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC;EACtD,cAAc,CAAC,GAAG,YAAY,aAAa;EAC3C,CAAC;AACF,IAAG,gBAAgB,CAAC,WAAW,EAAE,cAAc;;AAGhD,MAAa,4BAA4B,YACxC,QAAQ,cAAc,MAAM,WAAW,OAAO,gBAAgB,eAAe,EAAE,YAAY;AAE5F,MAAa,0BAA0B,YACtC,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,wBAAwB,IAAI,OAC1D,EAAE,YAAY;AAEhB,MAAa,6BACZ,MACA,YACiD;CACjD,MAAM,YAAY,yBAAyB,QAAQ;AACnD,KAAI,cAAc,KACjB,QAAO,OAAO,KACb,UAAU,WAAW;EACpB;EACA,SAAS,wDAA6D,QAAQ,OAAO;EACrF,CAAC,CACF;CAEF,MAAM,eAAe,uBAAuB,QAAQ;AACpD,QAAO,OAAO,QAAQ;EACrB;EACA,GAAI,iBAAiB,OAAO,EAAE,cAAc,GAAG,EAAE;EACjD,CAAC;;AAGH,MAAa,6BACZ,WAEA,OAAO,IAAI,aAAa;AAIvB,QAAO,eAAe,OAAO,iBAAiB,WAAW,EACxD,qBAAqB,OAAO,eAAe,KAAA,IAAY,gBAAgB,SACvE,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAAC;CAEzE,MAAM,cAAc,OAAO,aAAa;EACvC,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,SAAS,OAAO;EAChB,GAAI,OAAO,eAAe,KAAA,IAAY,EAAE,YAAY,OAAO,YAAY,GAAG,EAAE;EAC5E,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAAC;CAEzE,MAAM,UAAU,OAAO,aAAa;EACnC,QAAQ,OAAO,IAAI;EACnB,QAAQ,OAAO;EACf,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,+BACC,0BAA0B,GAAG,EAC7B,aACA,OAAO,OAAO,QACd;AACD,UAAO,GAAG,MAAM,EACf,QAAQ,OAAO,IAAI,QAKnB,CAAC;;EAEH,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sCAAsC,OAAO,OAAO,KAAK,aAC7C,OAAO,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD;AAED,QAAO,OAAO,0BAA0B,OAAO,MAAM,QAAQ;EAC5D,CAAC,KACF,OAAO,SAAS,sCAAsC,EACrD,YAAY;CACX,aAAa,OAAO;CACpB,eAAe,OAAO,OAAO;CAC7B,EACD,CAAC,CACF;AAEF,MAAa,sBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,aAAa,sBAAsB,OAHf,gBAAgB,OAAO,gBAAgB,CAAC,KACjE,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAChE,EACoD,OAAO,OAAO,QAAQ;CAE3E,MAAM,SAAS,OAAO,UAAU,QAAgD;EAC/E,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,cAAc;EACd,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,WAAW,uBAAuB;EACjF,SAAS,0BAA0B,OAAO,CAAC,KAC1C,OAAO,UAAU,QAAQ,kBAAkB,WAAW,IAAI,CAAC,CAC3D;EACD,gBAAgB,OAAO;EACvB,CAAC;CAEF,MAAM,YAAY,eAAe,SAAS,OAAO,YAAY,OAAO;AACpE,KAAI,CAAC,UACJ,QAAO,OAAO,OAAO,KACpB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SAAS;EACT,CAAC,CACF;AAEF,QAAO,EAAE,WAAW;EACnB,CAAC,KACF,OAAO,SAAS,gCAAgC,EAC/C,YAAY;CAAE,aAAa,OAAO;CAAM,cAAc,OAAO;CAAO,EACpE,CAAC,CACF;AAMF,MAAa,4BAA4B;AAMzC,MAAa,2BAA2B,OAAO,OAAO;CACrD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAkBF,MAAa,0BACZ,QACA,kBAKA,YACC,oBAAoB,WAAW,SAAS,CACtC,OACA,KAAK,UAAU;CACd,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,eAAe,OAAO;CACtB,cAAc,OAAO;CACrB;CACA,CAAC,CACF,CACA,OAAO,MAAM,GACf;AAyBF,MAAM,8BACL,QAC0D;CAC1D,MAAM;EACL,SAAS,UAAU,GAAG,KAAK,OAAO,MAAM;EACxC,KAAK,UAAU,GAAG,KAAK,GAAG,MAAM;EAChC,SAAS,MAAM,UAAU,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC;EACzD;CACD,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,WAAW,UACV,GAAG,SAAS;EACX,QAAQ,MAAM;EACd,WAAW,CAAC,GAAG,MAAM,UAAU;EAC/B,CAAC;CACH;AAED,MAAa,kCACZ,IACA,QACA,kBACU;CACV,MAAM,UAAU,UAAU,OAAO,aAAa;AAC9C,IAAG,UAAU,cAAc;AAC3B,IAAG,SAAS;EACX,QAAQ,GAAG,OAAO,cAAc;EAChC,WAAW;GACV,GAAG,KAAK,OAAO,OAAO,cAAc;GACpC,GAAG,KAAK,OAAO,OAAO,aAAa;GACnC,GAAG,KAAK,GAAG,iCAAiC;GAC5C,GAAG,KAAK,OAAO,MAAM,MAAM,KAAK,QAAQ,CAAC;GACzC;EACD,CAAC;;AAGH,MAAa,gCAAgC,YAC5C,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,0BAA0B,IAAI,OAC5D,EAAE,YAAY;AAEhB,MAAa,mCACZ,MACA,YACmD;CACnD,MAAM,WAAW,6BAA6B,QAAQ;AACtD,KAAI,aAAa,KAChB,QAAO,OAAO,KACb,UAAU,YAAY;EACrB;EACA,SACC,sEACW,QAAQ,OAAO;EAC3B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;;AAGpC,MAAa,mCACZ,KACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,aAAa;EACnC,QAAQ,IAAI;EACZ;EACA,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,kCAA+B,2BAA2B,GAAG,EAAE,QAAQ,OAAO,QAAQ;AACtF,UAAO,GAAG,MAAM,EACf,QAAQ,IAAI,QAKZ,CAAC;;EAEH,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uCAAuC,OAAO,KAAK,aACvC,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EAC7D;EACA,CAAC,CACF,CACD;AAED,QAAO,OAAO,gCAAgC,OAAO,MAAM,QAAQ;EAClE,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY;CAAE,aAAa,OAAO;CAAM,YAAY,OAAO;CAAc,EACzE,CAAC,CACF;AAEF,MAAa,qBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,uBAAuB,QAAQ,OAAO,OAAO,QAAQ;CACxE,MAAM,SAAS,OAAO,UAAU,QAAoD;EACnF,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,cAAc;EACd,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,UAAU,yBAAyB;EAClF,SAAS,gCAAgC,OAAO,KAAK,OAAO,QAAQ,OAAO,CAAC,KAC3E,OAAO,UAAU,QAAQ,kBAAkB,YAAY,IAAI,CAAC,CAC5D;EACD,gBAAgB,OAAO;EACvB,CAAC;CAEF,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW,KAAA;AAC1D,KAAI,CAAC,SACJ,QAAO,OAAO,OAAO,KACpB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SAAS;EACT,CAAC,CACF;AAEF,QAAO,EAAE,UAAU;EAClB,CAAC,KACF,OAAO,SAAS,iCAAiC,EAChD,YAAY;CAAE,aAAa,OAAO;CAAM,YAAY,OAAO;CAAc,EACzE,CAAC,CACF"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../src/plugins/seal/deploy.ts"],"sourcesContent":["// Seal plugin — SDK-backed Move publish + on-chain KeyServer register.\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport {\n\tTransaction,\n\ttype TransactionArgument,\n\ttype TransactionObjectArgument,\n} from '@mysten/sui/transactions';\n\nimport type { ChainProbe, ChainProbeSchema } from '../../contracts/chain-probe.ts';\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tartifactPublishError,\n\ttype ArtifactPublishError,\n\ttype ArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport { contentHash, type ChainId, type ContentHash } from '../../substrate/brand.ts';\nimport {\n\texecuteSuiTx,\n\tformatExecutedFailure,\n\ttype ExecutedReceipt,\n} from '../../substrate/runtime/sui-execute/index.ts';\nimport {\n\thashMoveSources,\n\trunMoveBuild,\n\tscrubLocksHost,\n\ttype BuildOutput,\n\ttype MoveBuildError,\n} from '../../substrate/runtime/sui-move-build/index.ts';\nimport { fromHex } from '@mysten/sui/utils';\n\nimport type { AccountValue } from '../account/index.ts';\nimport type { ClientWithCoreApi } from '../sui/index.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { SealSpans } from './spans.ts';\n\nconst KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;\n\nexport type SealObjectProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport interface SealSuiSdk {\n\treadonly client: ClientWithCoreApi;\n}\n\nconst sealProduceFailed = (op: 'publish' | 'register', err: SealError): ArtifactPublishError =>\n\tartifactPublishError('produce-failed', `seal.${op} ${err.phase}: ${err.message}`);\n\nconst moveBuildToSealError = (name: string, err: MoveBuildError): SealError =>\n\tsealError('publish', {\n\t\tname,\n\t\tmessage: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,\n\t\tcause: err,\n\t});\n\nconst verifyObjectLenient = <Verified>(\n\tprobe: ChainProbe<SealObjectProbeKey>,\n\tobjectId: string,\n\tschema: ChainProbeSchema<Verified>,\n): Effect.Effect<Verified | null, never> =>\n\tprobe\n\t\t.get({ kind: 'object', objectId }, schema, 'lenient')\n\t\t.pipe(Effect.catch(() => Effect.succeed(null as Verified | null)));\n\n// ---------------------------------------------------------------------------\n// Move publish — `sealPackage` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_PACKAGE_NAMESPACE = 'seal/package' as const;\n\nexport interface SealPackageCached {\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n}\n\nexport const SealPackageVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealPackageVerified = Schema.Schema.Type<typeof SealPackageVerifyShape>;\n\nexport interface SealPublishInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly movePackagePath: string;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly runtime: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealPackageInputsHash = (\n\tsourceHash: ContentHash,\n\tsignerAddress: string,\n): ContentHash => contentHash(`seal-package|source=${sourceHash}|signer=${signerAddress}`);\n\nexport interface SealPublishTransactionBuilder<TUpgradeCap = unknown> {\n\treadonly setSender: (address: string) => void;\n\treadonly publish: (input: {\n\t\treadonly modules: ReadonlyArray<ReadonlyArray<number>>;\n\t\treadonly dependencies: ReadonlyArray<string>;\n\t}) => TUpgradeCap;\n\treadonly transferObjects: (objects: ReadonlyArray<TUpgradeCap>, recipient: string) => void;\n}\n\nconst publishTransactionBuilder = (\n\ttx: Transaction,\n): SealPublishTransactionBuilder<TransactionObjectArgument> => ({\n\tsetSender: (address) => tx.setSender(address),\n\tpublish: (input) =>\n\t\ttx.publish({\n\t\t\tmodules: input.modules.map((m) => [...m]),\n\t\t\tdependencies: [...input.dependencies],\n\t\t}),\n\ttransferObjects: (objects, recipient) => tx.transferObjects([...objects], recipient),\n});\n\nexport const buildSealPublishTransaction = <TUpgradeCap>(\n\ttx: SealPublishTransactionBuilder<TUpgradeCap>,\n\tbuildOutput: BuildOutput,\n\tsignerAddress: string,\n): void => {\n\ttx.setSender(signerAddress);\n\tconst upgradeCap = tx.publish({\n\t\tmodules: buildOutput.modules.map((m) => Array.from(m)),\n\t\tdependencies: [...buildOutput.dependencies],\n\t});\n\ttx.transferObjects([upgradeCap], signerAddress);\n};\n\nexport const pickPackageWriteObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find((change) => change.outputState === 'PackageWrite')?.objectId ?? null;\n\nexport const pickUpgradeCapObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectSealPublishReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealPackageCached, SealError> => {\n\tconst packageId = pickPackageWriteObjectId(receipt);\n\tif (packageId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('publish', {\n\t\t\t\tname,\n\t\t\t\tmessage: `seal publish tx wrote no PackageWrite object ` + `(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\tconst upgradeCapId = pickUpgradeCapObjectId(receipt);\n\treturn Effect.succeed({\n\t\tpackageId,\n\t\t...(upgradeCapId !== null ? { upgradeCapId } : {}),\n\t});\n};\n\nexport const runSealPublishTransaction = (\n\tinputs: SealPublishInputs,\n): Effect.Effect<SealPackageCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// Scrub the shared Move git cache so a stale pin can't leak into the\n\t\t// build. The package's own Move.lock is scrubbed inside the container\n\t\t// on a disposable copy, so the developer's checked-in source is left\n\t\t// untouched host-side.\n\t\tyield* scrubLocksHost(inputs.movePackagePath, '~/.move').pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\n\t\tconst buildOutput = yield* runMoveBuild({\n\t\t\tsourcePath: inputs.movePackagePath,\n\t\t\tpackageName: inputs.name,\n\t\t\tchainId: inputs.chain,\n\t\t\truntime: inputs.runtime,\n\t\t\t...(inputs.buildImage !== undefined ? { buildImage: inputs.buildImage } : {}),\n\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\n\t\tconst result = yield* executeSuiTx({\n\t\t\tclient: inputs.sdk.client,\n\t\t\tsigner: inputs.signer,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildSealPublishTransaction(\n\t\t\t\t\tpublishTransactionBuilder(tx),\n\t\t\t\t\tbuildOutput,\n\t\t\t\t\tinputs.signer.address,\n\t\t\t\t);\n\t\t\t\treturn tx.build({ client: inputs.sdk.client });\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx failed for signer '${inputs.signer.name}' ` +\n\t\t\t\t\t\t`(address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.$kind === 'FailedTransaction') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx executed but on-chain execution failed for signer ` +\n\t\t\t\t\t\t`'${inputs.signer.name}' (address=${inputs.signer.address}) ` +\n\t\t\t\t\t\tformatExecutedFailure(result.FailedTransaction),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* projectSealPublishReceipt(inputs.name, result.Transaction);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish.suiTx', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.name]: inputs.name,\n\t\t\t\t[SealSpans.signer]: inputs.signer.address,\n\t\t\t},\n\t\t}),\n\t);\n\nexport const publishSealPackage = (\n\tpublisher: ArtifactPublisher,\n\tinputs: SealPublishInputs,\n): Effect.Effect<{ readonly packageId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst sourceHash = yield* hashMoveSources(inputs.movePackagePath).pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\t\tconst inputsHash = sealPackageInputsHash(sourceHash, inputs.signer.address);\n\n\t\tconst cached: SealPackageCached = yield* publisher.publish<\n\t\t\tSealPackageCached,\n\t\t\tSealPackageVerified\n\t\t>({\n\t\t\tnamespace: SEAL_PACKAGE_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),\n\t\t\tproduce: runSealPublishTransaction(inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('publish', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\treturn { packageId: cached.packageId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish', {\n\t\t\tattributes: { [SealSpans.name]: inputs.name, [SealSpans.chain]: inputs.chain },\n\t\t}),\n\t);\n\n// ---------------------------------------------------------------------------\n// KeyServer register — `keyServer` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_KEY_SERVER_NAMESPACE = 'seal/key-server-id' as const;\n\nexport interface SealKeyServerCached {\n\treadonly objectId: string;\n}\n\nexport const SealKeyServerVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealKeyServerVerified = Schema.Schema.Type<typeof SealKeyServerVerifyShape>;\n\nexport interface RegisterKeyServerTransactionInputs {\n\treadonly keyServerUrl: string;\n\treadonly sealPackageId: string;\n\treadonly publicKeyHex: string;\n\treadonly keyServerName: string;\n}\n\nexport interface RegisterKeyServerInputs extends RegisterKeyServerTransactionInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealRegisterInputsHash = (\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): ContentHash =>\n\t// Keep the cache key path-safe and bounded. The raw material includes\n\t// a routed URL plus a long BLS public key; using it directly made the\n\t// best-effort cache write miss on normal restarts.\n\tcontentHash(\n\t\t`seal-register-v2|${createHash('sha256')\n\t\t\t.update(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\tpackageId: inputs.sealPackageId,\n\t\t\t\t\tkeyServerUrl: inputs.keyServerUrl,\n\t\t\t\t\tkeyServerName: inputs.keyServerName,\n\t\t\t\t\tpublicKeyHex: inputs.publicKeyHex,\n\t\t\t\t\tsignerAddress,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.digest('hex')}`,\n\t);\n\nexport interface SealRegisterTransactionBuilder<TArgument = unknown> {\n\treadonly pure: {\n\t\treadonly string: (value: string) => TArgument;\n\t\treadonly u8: (value: number) => TArgument;\n\t\treadonly vector: (type: 'u8', value: ReadonlyArray<number>) => TArgument;\n\t};\n\treadonly setSender: (address: string) => void;\n\treadonly moveCall: (input: {\n\t\treadonly target: string;\n\t\treadonly arguments: ReadonlyArray<TArgument>;\n\t}) => unknown;\n}\n\nexport type SealRegisterSdk = SealSuiSdk;\n\nconst registerTransactionBuilder = (\n\ttx: Transaction,\n): SealRegisterTransactionBuilder<TransactionArgument> => ({\n\tpure: {\n\t\tstring: (value) => tx.pure.string(value),\n\t\tu8: (value) => tx.pure.u8(value),\n\t\tvector: (type, value) => tx.pure.vector(type, [...value]),\n\t},\n\tsetSender: (address) => tx.setSender(address),\n\tmoveCall: (input) =>\n\t\ttx.moveCall({\n\t\t\ttarget: input.target,\n\t\t\targuments: [...input.arguments],\n\t\t}),\n});\n\nexport const buildRegisterKeyServerMoveCall = <TArgument>(\n\ttx: SealRegisterTransactionBuilder<TArgument>,\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): void => {\n\tconst pkBytes = fromHex(inputs.publicKeyHex);\n\ttx.setSender(signerAddress);\n\ttx.moveCall({\n\t\ttarget: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,\n\t\targuments: [\n\t\t\ttx.pure.string(inputs.keyServerName),\n\t\t\ttx.pure.string(inputs.keyServerUrl),\n\t\t\ttx.pure.u8(KEY_TYPE_BONEH_FRANKLIN_BLS12381),\n\t\t\ttx.pure.vector('u8', Array.from(pkBytes)),\n\t\t],\n\t});\n};\n\nexport const pickCreatedKeyServerObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::key_server::KeyServer') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectRegisterKeyServerReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealKeyServerCached, SealError> => {\n\tconst objectId = pickCreatedKeyServerObjectId(receipt);\n\tif (objectId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('register', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal register tx created no ::key_server::KeyServer object ` +\n\t\t\t\t\t`(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({ objectId });\n};\n\nexport const runRegisterKeyServerTransaction = (\n\tsdk: SealRegisterSdk,\n\tsigner: AccountValue,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<SealKeyServerCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* executeSuiTx({\n\t\t\tclient: sdk.client,\n\t\t\tsigner,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildRegisterKeyServerMoveCall(registerTransactionBuilder(tx), inputs, signer.address);\n\t\t\t\treturn tx.build({ client: sdk.client });\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx failed for signer '${signer.name}' ` +\n\t\t\t\t\t\t`(address=${signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.$kind === 'FailedTransaction') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx executed but on-chain execution failed for signer ` +\n\t\t\t\t\t\t`'${signer.name}' (address=${signer.address}) ` +\n\t\t\t\t\t\tformatExecutedFailure(result.FailedTransaction),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* projectRegisterKeyServerReceipt(inputs.name, result.Transaction);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register.suiTx', {\n\t\t\tattributes: { [SealSpans.name]: inputs.name, [SealSpans.url]: inputs.keyServerUrl },\n\t\t}),\n\t);\n\nexport const registerKeyServer = (\n\tpublisher: ArtifactPublisher,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<{ readonly objectId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);\n\t\tconst cached: SealKeyServerCached = yield* publisher.publish<\n\t\t\tSealKeyServerCached,\n\t\t\tSealKeyServerVerified\n\t\t>({\n\t\t\tnamespace: SEAL_KEY_SERVER_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),\n\t\t\tproduce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('register', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\treturn { objectId: cached.objectId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register', {\n\t\t\tattributes: { [SealSpans.name]: inputs.name, [SealSpans.url]: inputs.keyServerUrl },\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;AAuCA,MAAM,mCAAmC;AAQzC,MAAM,qBAAqB,IAA4B,QACtD,qBAAqB,kBAAkB,QAAQ,GAAG,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAElF,MAAM,wBAAwB,MAAc,QAC3C,UAAU,WAAW;CACpB;CACA,SAAS,gBAAgB,IAAI,MAAM,sBAAsB,IAAI,WAAW,KAAK,IAAI;CACjF,OAAO;CACP,CAAC;AAEH,MAAM,uBACL,OACA,UACA,WAEA,MACE,IAAI;CAAE,MAAM;CAAU;CAAU,EAAE,QAAQ,UAAU,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAwB,CAAC,CAAC;AAMpE,MAAa,yBAAyB;AAOtC,MAAa,yBAAyB,OAAO,OAAO;CACnD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAcF,MAAa,yBACZ,YACA,kBACiB,YAAY,uBAAuB,WAAW,UAAU,gBAAgB;AAW1F,MAAM,6BACL,QAC+D;CAC/D,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,UAAU,UACT,GAAG,QAAQ;EACV,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;EACzC,cAAc,CAAC,GAAG,MAAM,aAAa;EACrC,CAAC;CACH,kBAAkB,SAAS,cAAc,GAAG,gBAAgB,CAAC,GAAG,QAAQ,EAAE,UAAU;CACpF;AAED,MAAa,+BACZ,IACA,aACA,kBACU;AACV,IAAG,UAAU,cAAc;CAC3B,MAAM,aAAa,GAAG,QAAQ;EAC7B,SAAS,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC;EACtD,cAAc,CAAC,GAAG,YAAY,aAAa;EAC3C,CAAC;AACF,IAAG,gBAAgB,CAAC,WAAW,EAAE,cAAc;;AAGhD,MAAa,4BAA4B,YACxC,QAAQ,cAAc,MAAM,WAAW,OAAO,gBAAgB,eAAe,EAAE,YAAY;AAE5F,MAAa,0BAA0B,YACtC,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,wBAAwB,IAAI,OAC1D,EAAE,YAAY;AAEhB,MAAa,6BACZ,MACA,YACiD;CACjD,MAAM,YAAY,yBAAyB,QAAQ;AACnD,KAAI,cAAc,KACjB,QAAO,OAAO,KACb,UAAU,WAAW;EACpB;EACA,SAAS,wDAA6D,QAAQ,OAAO;EACrF,CAAC,CACF;CAEF,MAAM,eAAe,uBAAuB,QAAQ;AACpD,QAAO,OAAO,QAAQ;EACrB;EACA,GAAI,iBAAiB,OAAO,EAAE,cAAc,GAAG,EAAE;EACjD,CAAC;;AAGH,MAAa,6BACZ,WAEA,OAAO,IAAI,aAAa;AAKvB,QAAO,eAAe,OAAO,iBAAiB,UAAU,CAAC,KACxD,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAChE;CAED,MAAM,cAAc,OAAO,aAAa;EACvC,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,SAAS,OAAO;EAChB,GAAI,OAAO,eAAe,KAAA,IAAY,EAAE,YAAY,OAAO,YAAY,GAAG,EAAE;EAC5E,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAAC;CAEzE,MAAM,SAAS,OAAO,aAAa;EAClC,QAAQ,OAAO,IAAI;EACnB,QAAQ,OAAO;EACf,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,+BACC,0BAA0B,GAAG,EAC7B,aACA,OAAO,OAAO,QACd;AACD,UAAO,GAAG,MAAM,EAAE,QAAQ,OAAO,IAAI,QAAQ,CAAC;;EAE/C,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sCAAsC,OAAO,OAAO,KAAK,aAC7C,OAAO,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD;AACD,KAAI,OAAO,UAAU,oBACpB,QAAO,OAAO,OAAO,KACpB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sEACI,OAAO,OAAO,KAAK,aAAa,OAAO,OAAO,QAAQ,MAC1D,sBAAsB,OAAO,kBAAkB;EAChD,CAAC,CACF;AAGF,QAAO,OAAO,0BAA0B,OAAO,MAAM,OAAO,YAAY;EACvE,CAAC,KACF,OAAO,SAAS,sCAAsC,EACrD,YAAY;EACV,UAAU,OAAO,OAAO;EACxB,UAAU,SAAS,OAAO,OAAO;CAClC,EACD,CAAC,CACF;AAEF,MAAa,sBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,aAAa,sBAAsB,OAHf,gBAAgB,OAAO,gBAAgB,CAAC,KACjE,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAChE,EACoD,OAAO,OAAO,QAAQ;AAiB3E,QAAO,EAAE,YAAW,OAfqB,UAAU,QAGjD;EACD,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,WAAW,uBAAuB;EACjF,SAAS,0BAA0B,OAAO,CAAC,KAC1C,OAAO,UAAU,QAAQ,kBAAkB,WAAW,IAAI,CAAC,CAC3D;EACD,gBAAgB,OAAO;EACvB,CAAC,EAEyB,WAAW;EACrC,CAAC,KACF,OAAO,SAAS,gCAAgC,EAC/C,YAAY;EAAG,UAAU,OAAO,OAAO;EAAO,UAAU,QAAQ,OAAO;CAAO,EAC9E,CAAC,CACF;AAMF,MAAa,4BAA4B;AAMzC,MAAa,2BAA2B,OAAO,OAAO;CACrD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAkBF,MAAa,0BACZ,QACA,kBAKA,YACC,oBAAoB,WAAW,SAAS,CACtC,OACA,KAAK,UAAU;CACd,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,eAAe,OAAO;CACtB,cAAc,OAAO;CACrB;CACA,CAAC,CACF,CACA,OAAO,MAAM,GACf;AAiBF,MAAM,8BACL,QAC0D;CAC1D,MAAM;EACL,SAAS,UAAU,GAAG,KAAK,OAAO,MAAM;EACxC,KAAK,UAAU,GAAG,KAAK,GAAG,MAAM;EAChC,SAAS,MAAM,UAAU,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC;EACzD;CACD,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,WAAW,UACV,GAAG,SAAS;EACX,QAAQ,MAAM;EACd,WAAW,CAAC,GAAG,MAAM,UAAU;EAC/B,CAAC;CACH;AAED,MAAa,kCACZ,IACA,QACA,kBACU;CACV,MAAM,UAAU,QAAQ,OAAO,aAAa;AAC5C,IAAG,UAAU,cAAc;AAC3B,IAAG,SAAS;EACX,QAAQ,GAAG,OAAO,cAAc;EAChC,WAAW;GACV,GAAG,KAAK,OAAO,OAAO,cAAc;GACpC,GAAG,KAAK,OAAO,OAAO,aAAa;GACnC,GAAG,KAAK,GAAG,iCAAiC;GAC5C,GAAG,KAAK,OAAO,MAAM,MAAM,KAAK,QAAQ,CAAC;GACzC;EACD,CAAC;;AAGH,MAAa,gCAAgC,YAC5C,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,0BAA0B,IAAI,OAC5D,EAAE,YAAY;AAEhB,MAAa,mCACZ,MACA,YACmD;CACnD,MAAM,WAAW,6BAA6B,QAAQ;AACtD,KAAI,aAAa,KAChB,QAAO,OAAO,KACb,UAAU,YAAY;EACrB;EACA,SACC,sEACW,QAAQ,OAAO;EAC3B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;;AAGpC,MAAa,mCACZ,KACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,aAAa;EAClC,QAAQ,IAAI;EACZ;EACA,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,kCAA+B,2BAA2B,GAAG,EAAE,QAAQ,OAAO,QAAQ;AACtF,UAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,QAAQ,CAAC;;EAExC,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uCAAuC,OAAO,KAAK,aACvC,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EAC7D;EACA,CAAC,CACF,CACD;AACD,KAAI,OAAO,UAAU,oBACpB,QAAO,OAAO,OAAO,KACpB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uEACI,OAAO,KAAK,aAAa,OAAO,QAAQ,MAC5C,sBAAsB,OAAO,kBAAkB;EAChD,CAAC,CACF;AAGF,QAAO,OAAO,gCAAgC,OAAO,MAAM,OAAO,YAAY;EAC7E,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY;EAAG,UAAU,OAAO,OAAO;EAAO,UAAU,MAAM,OAAO;CAAc,EACnF,CAAC,CACF;AAEF,MAAa,qBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,uBAAuB,QAAQ,OAAO,OAAO,QAAQ;AAgBxE,QAAO,EAAE,WAAU,OAfwB,UAAU,QAGnD;EACD,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,UAAU,yBAAyB;EAClF,SAAS,gCAAgC,OAAO,KAAK,OAAO,QAAQ,OAAO,CAAC,KAC3E,OAAO,UAAU,QAAQ,kBAAkB,YAAY,IAAI,CAAC,CAC5D;EACD,gBAAgB,OAAO;EACvB,CAAC,EAEwB,UAAU;EACnC,CAAC,KACF,OAAO,SAAS,iCAAiC,EAChD,YAAY;EAAG,UAAU,OAAO,OAAO;EAAO,UAAU,MAAM,OAAO;CAAc,EACnF,CAAC,CACF"}

package/dist/plugins/seal/errors.d.mts

@@ -18,10 +18,8 @@ import { ForkIncompatibleError } from "../../substrate/runtime/mode-errors.mjs";
  *                        failed (FS perms, disk full).
  *   - `container`      — long-running key-server container start failed.
  *   - `ready`          — /health probe timed out.
- *   - `rotate`         — master-key rotation pipeline failed (sub-phase
- *                        is in the `cause` chain).
  *   - `seal`           — generic catch-all for non-phaseable failures. */
-type SealPhase = 'port-alloc' | 'image' | 'keygen' | 'publish' | 'register' | 'config-render' | 'container' | 'ready' | 'rotate' | 'seal';
+type SealPhase = 'port-alloc' | 'image' | 'keygen' | 'publish' | 'register' | 'config-render' | 'container' | 'ready' | 'seal';
 /** Generic Seal plugin error. The structured shape mirrors the v3
  *  `SealError` from `engine/errors.ts:325-341` minus the dead
  *  `keyServer` field (07-seal.md §Opportunities #6).

package/dist/plugins/seal/errors.mjs

@@ -1,3 +1,4 @@
+import "../../substrate/runtime/mode-errors.mjs";
 import { defineConfigError } from "../../substrate/runtime/config-validation.mjs";
 //#region src/plugins/seal/errors.ts
 const sealError = (phase, parts) => ({
@@ -5,6 +6,11 @@ const sealError = (phase, parts) => ({
 	phase,
 	...parts
 });
+/** Structural predicate — true iff `value` has the `SealError` tag.
+*  Used at re-wrap sites (e.g. `key-server.ts` probe mapError) to
+*  unwrap a nested `SealError` rather than re-wrap and create a
+*  two-layer cause walk. */
+const isSealError = (value) => typeof value === "object" && value !== null && value._tag === "SealError";
 const sealConfigError = defineConfigError("SealConfigError");
 /** Error tags this plugin contributes — surfaced to the cause walker
 *  via `PluginErrorContribution`. */
@@ -14,6 +20,6 @@ const SEAL_ERROR_TAGS = [
 	"SealConfigError"
 ];
 //#endregion
-export { SEAL_ERROR_TAGS, sealConfigError, sealError };
+export { SEAL_ERROR_TAGS, isSealError, sealConfigError, sealError };
 
 //# sourceMappingURL=errors.mjs.map

package/dist/plugins/seal/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/seal/errors.ts"],"sourcesContent":["// Seal plugin — typed errors.\n//\n// Every error surfacing site that may carry stdout/stderr from the\n// seal-cli MUST run the bytes through a master-key redactor. The\n// redactor lives in `keygen.ts` so the keygen pipeline is the single\n// owner of the redaction substrate; this file only declares the\n// closed phase set + the structured error shapes.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// (per surrounding subsystem style). `Effect.catchTag` / `catchTags`\n// match on the literal `_tag`.\n//\n// `ForkIncompatibleError` is a cross-cutting mode-refusal shape\n// owned by `substrate/runtime/mode-errors.ts`; seal contributes\n// the `sealLocalKeygen` variant via the factory below. Substrate\n// owns the canonical re-export; this module does NOT re-export the\n// class — the cross-plugin re-export was the cause of a name\n// collision at the root barrel.\n\nimport { ForkIncompatibleError } from '../../substrate/runtime/mode-errors.ts';\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n// ---------------------------------------------------------------------------\n// SealError — the plugin's primary tagged error\n// ---------------------------------------------------------------------------\n\n/** Phases for `SealError`. Closed sum — matches the v3 catalog\n *  (07-seal.md §\"Adjacent Seal references\" → `engine/phases.ts:79-91`).\n *\n *  Phase semantics:\n *   - `port-alloc`     — router `seal` entrypoint not registered.\n *   - `image`          — image build / pull failed (bootstrap-asset\n *                        cargo step).\n *   - `keygen`         — `seal-cli genkey` container failed OR stdout\n *                        parse failed.\n *   - `publish`        — Move publish of the seal contracts failed.\n *   - `register`       — `KeyServer::create_and_transfer_v2_independent_server`\n *                        Move call failed OR object id parse failed.\n *   - `config-render`  — key-server-config.yaml / master-key.env write\n *                        failed (FS perms, disk full).\n *   - `container`      — long-running key-server container start failed.\n *   - `ready`          — /health probe timed out.\n *   - `rotate`         — master-key rotation pipeline failed (sub-phase\n *                        is in the `cause` chain).\n *   - `seal`           — generic catch-all for non-phaseable failures. */\nexport type SealPhase =\n\t| 'port-alloc'\n\t| 'image'\n\t| 'keygen'\n\t| 'publish'\n\t| 'register'\n\t| 'config-render'\n\t| 'container'\n\t| 'ready'\n\t| 'rotate'\n\t| 'seal';\n\n/** Generic Seal plugin error. The structured shape mirrors the v3\n *  `SealError` from `engine/errors.ts:325-341` minus the dead\n *  `keyServer` field (07-seal.md §Opportunities #6).\n *\n *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted\n *  via `redactMasterKey` at every raise site that touches `seal-cli`\n *  output. The raise sites in this plugin pipe their captures\n *  through the redactor before constructing the error. */\nexport interface SealError {\n\treadonly _tag: 'SealError';\n\treadonly phase: SealPhase;\n\t/** Seal instance name (default `'seal'`). Folds into TUI display\n\t *  + cause-walker context. */\n\treadonly name: string;\n\treadonly message: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n\treadonly exitCode?: number;\n\treadonly cause?: unknown;\n}\n\nexport const sealError = (\n\tphase: SealPhase,\n\tparts: Omit<SealError, '_tag' | 'phase'>,\n): SealError => ({ _tag: 'SealError', phase, ...parts });\n\n// ---------------------------------------------------------------------------\n// ForkIncompatibleError — shared shape owned by substrate\n// ---------------------------------------------------------------------------\n\n/** Synchronous refusal raised at factory time when a local-keygen\n *  variant is composed under a fork network. Refusal MUST be a\n *  synchronous throw at the factory call site (NOT a deferred\n *  acquire-time failure) so the user sees the actionable hint before\n *  any other plugin starts work. */\nexport const forkIncompatibleError = (\n\tparts: ConstructorParameters<typeof ForkIncompatibleError>[0],\n): ForkIncompatibleError => new ForkIncompatibleError(parts);\n\n// ---------------------------------------------------------------------------\n// SealConfigError — synchronous factory-time configuration faults\n// ---------------------------------------------------------------------------\n\nexport interface SealConfigError extends ConfigIssue {\n\treadonly _tag: 'SealConfigError';\n}\n\nexport const sealConfigError = defineConfigError('SealConfigError');\n\n// ---------------------------------------------------------------------------\n// Error-tag inventory\n// ---------------------------------------------------------------------------\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const SEAL_ERROR_TAGS = ['SealError', 'ForkIncompatibleError', 'SealConfigError'] as const;\n\n/** Union of every error a Seal-plugin caller may encounter. */\nexport type SealAnyError = SealError | ForkIncompatibleError | SealConfigError;\n"],"mappings":";;AA8EA,MAAa,aACZ,OACA,WACgB;CAAE,MAAM;CAAa;CAAO,GAAG;CAAO;AAuBvD,MAAa,kBAAkB,kBAAkB,kBAAkB;;;AAQnE,MAAa,kBAAkB;CAAC;CAAa;CAAyB;CAAkB"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/seal/errors.ts"],"sourcesContent":["// Seal plugin — typed errors.\n//\n// Every error surfacing site that may carry stdout/stderr from the\n// seal-cli MUST run the bytes through a master-key redactor. The\n// redactor lives in `keygen.ts` so the keygen pipeline is the single\n// owner of the redaction substrate; this file only declares the\n// closed phase set + the structured error shapes.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// (per surrounding subsystem style). `Effect.catchTag` / `catchTags`\n// match on the literal `_tag`.\n//\n// `ForkIncompatibleError` is a cross-cutting mode-refusal shape\n// owned by `substrate/runtime/mode-errors.ts`; seal contributes\n// the `sealLocalKeygen` variant via the factory below. Substrate\n// owns the canonical re-export; this module does NOT re-export the\n// class — the cross-plugin re-export was the cause of a name\n// collision at the root barrel.\n\nimport { ForkIncompatibleError } from '../../substrate/runtime/mode-errors.ts';\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n// ---------------------------------------------------------------------------\n// SealError — the plugin's primary tagged error\n// ---------------------------------------------------------------------------\n\n/** Phases for `SealError`. Closed sum — matches the v3 catalog\n *  (07-seal.md §\"Adjacent Seal references\" → `engine/phases.ts:79-91`).\n *\n *  Phase semantics:\n *   - `port-alloc`     — router `seal` entrypoint not registered.\n *   - `image`          — image build / pull failed (bootstrap-asset\n *                        cargo step).\n *   - `keygen`         — `seal-cli genkey` container failed OR stdout\n *                        parse failed.\n *   - `publish`        — Move publish of the seal contracts failed.\n *   - `register`       — `KeyServer::create_and_transfer_v2_independent_server`\n *                        Move call failed OR object id parse failed.\n *   - `config-render`  — key-server-config.yaml / master-key.env write\n *                        failed (FS perms, disk full).\n *   - `container`      — long-running key-server container start failed.\n *   - `ready`          — /health probe timed out.\n *   - `seal`           — generic catch-all for non-phaseable failures. */\nexport type SealPhase =\n\t| 'port-alloc'\n\t| 'image'\n\t| 'keygen'\n\t| 'publish'\n\t| 'register'\n\t| 'config-render'\n\t| 'container'\n\t| 'ready'\n\t| 'seal';\n\n/** Generic Seal plugin error. The structured shape mirrors the v3\n *  `SealError` from `engine/errors.ts:325-341` minus the dead\n *  `keyServer` field (07-seal.md §Opportunities #6).\n *\n *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted\n *  via `redactMasterKey` at every raise site that touches `seal-cli`\n *  output. The raise sites in this plugin pipe their captures\n *  through the redactor before constructing the error. */\nexport interface SealError {\n\treadonly _tag: 'SealError';\n\treadonly phase: SealPhase;\n\t/** Seal instance name (default `'seal'`). Folds into TUI display\n\t *  + cause-walker context. */\n\treadonly name: string;\n\treadonly message: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n\treadonly exitCode?: number;\n\treadonly cause?: unknown;\n}\n\nexport const sealError = (\n\tphase: SealPhase,\n\tparts: Omit<SealError, '_tag' | 'phase'>,\n): SealError => ({ _tag: 'SealError', phase, ...parts });\n\n/** Structural predicate — true iff `value` has the `SealError` tag.\n *  Used at re-wrap sites (e.g. `key-server.ts` probe mapError) to\n *  unwrap a nested `SealError` rather than re-wrap and create a\n *  two-layer cause walk. */\nexport const isSealError = (value: unknown): value is SealError =>\n\ttypeof value === 'object' &&\n\tvalue !== null &&\n\t(value as { readonly _tag?: unknown })._tag === 'SealError';\n\n// ---------------------------------------------------------------------------\n// SealConfigError — synchronous factory-time configuration faults\n// ---------------------------------------------------------------------------\n\nexport interface SealConfigError extends ConfigIssue {\n\treadonly _tag: 'SealConfigError';\n}\n\nexport const sealConfigError = defineConfigError('SealConfigError');\n\n// ---------------------------------------------------------------------------\n// Error-tag inventory\n// ---------------------------------------------------------------------------\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const SEAL_ERROR_TAGS = ['SealError', 'ForkIncompatibleError', 'SealConfigError'] as const;\n\n/** Union of every error a Seal-plugin caller may encounter. */\nexport type SealAnyError = SealError | ForkIncompatibleError | SealConfigError;\n"],"mappings":";;;AA2EA,MAAa,aACZ,OACA,WACgB;CAAE,MAAM;CAAa;CAAO,GAAG;CAAO;;;;;AAMvD,MAAa,eAAe,UAC3B,OAAO,UAAU,YACjB,UAAU,QACT,MAAsC,SAAS;AAUjD,MAAa,kBAAkB,kBAAkB,kBAAkB;;;AAQnE,MAAa,kBAAkB;CAAC;CAAa;CAAyB;CAAkB"}

package/dist/plugins/seal/index.d.mts

@@ -3,14 +3,13 @@ import { RoutableDecl } from "../../contracts/routable.mjs";
 import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
 import { AnyResourceRef, Plugin, ResourceRef } from "../../substrate/plugin.mjs";
 import { ModeNamespace } from "../../api/mode-narrowed-factory.mjs";
-import { SeedObjectsAccumulator } from "../sui/seed-objects.mjs";
 import { SuiClient } from "../sui/mode/shared.mjs";
 import { SuiOptions } from "../sui/mode/spec.mjs";
 import { AccountValue } from "../account/service.mjs";
 import { AccountResourceId } from "../account/index.mjs";
-import { SealAnyError, SealConfigError, SealError } from "./errors.mjs";
 import { SealKeyManager } from "./key-manager.mjs";
 import { SealKeyServer, SealKeyServerEntry, SealKnownResolved, SealLocalKeygenResolved, SealResolved } from "./registry-publish.mjs";
+import { SealAnyError, SealConfigError, SealError } from "./errors.mjs";
 import { KnownNetwork } from "./mode/live.mjs";
 import { ForkUpstream } from "./mode/fork-known.mjs";
 import { SealBindings } from "./codegen.mjs";
@@ -70,13 +69,11 @@ type SealOptions<Signer extends SealSignerMember = SealSignerMember> = ({
 declare const seal: <const Signer extends SealSignerMember = SealSignerMember>(opts: SealOptions<Signer>) => Plugin<`seal:${string}`, SealResolved, {
   readonly sui: ResourceRef<"sui", SuiClient & {
     readonly mode: SuiOptions["mode"];
-    readonly seedObjects: SeedObjectsAccumulator;
   }>;
   readonly signer: Signer;
 } extends infer T ? T extends {
   readonly sui: ResourceRef<"sui", SuiClient & {
     readonly mode: SuiOptions["mode"];
-    readonly seedObjects: SeedObjectsAccumulator;
   }>;
   readonly signer: Signer;
 } ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">, RoutableDecl]> | Plugin<`seal:${string}`, {
@@ -112,13 +109,11 @@ declare const sealFor: ModeNamespace<{
     localKeygen: <const Signer extends SealSignerMember>(opts: SealLocalKeygenOptions<Signer>) => Plugin<`seal:${string}`, SealResolved, {
       readonly sui: ResourceRef<"sui", SuiClient & {
         readonly mode: SuiOptions["mode"];
-        readonly seedObjects: SeedObjectsAccumulator;
       }>;
       readonly signer: Signer;
     } extends infer T ? T extends {
       readonly sui: ResourceRef<"sui", SuiClient & {
         readonly mode: SuiOptions["mode"];
-        readonly seedObjects: SeedObjectsAccumulator;
       }>;
       readonly signer: Signer;
     } ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">, RoutableDecl]>;

package/dist/plugins/seal/index.mjs

@@ -1,17 +1,23 @@
 import { definePlugin } from "../../substrate/plugin.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import "../../api/define-plugin.mjs";
 import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { defineModeNamespace } from "../../api/mode-narrowed-factory.mjs";
 import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
-import { suiResource } from "../sui/index.mjs";
 import { ArtifactPublisherService } from "../../substrate/runtime/artifact-publisher/index.mjs";
 import { chainProbeFor } from "../../substrate/runtime/strategy-registry/chain-probe-for.mjs";
+import "../../substrate/runtime/strategy-registry/index.mjs";
 import { DEFAULT_KEY_SERVER_PORT, buildSealKeyServerPublicRoute, makeSealRoutable } from "./routable.mjs";
+import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import { defineModeNamespace } from "../../api/mode-narrowed-factory.mjs";
+import { suiResource } from "../sui/index.mjs";
+import { withSubnetAddressing } from "../../substrate/runtime/subnet-broker.mjs";
 import { sealPluginKey } from "./plugin-key.mjs";
 import { makeSealCodegenable } from "./codegen.mjs";
-import { SEAL_ERROR_TAGS } from "./errors.mjs";
+import { SEAL_ERROR_TAGS, sealError } from "./errors.mjs";
 import { validateLiveInputs } from "./mode/live.mjs";
-import { buildSealNetworkName, deriveSealSubnetPrefix, sealNetworkCreateSpec } from "./key-server.mjs";
+import { validateForkKnownInputs } from "./mode/fork-known.mjs";
+import "./spans.mjs";
+import { buildSealNetworkName, deriveSealSubnetPrefix } from "./key-server.mjs";
+import { DEFAULT_SEAL_VERSION } from "./bootstrap-assets/source-fetch.mjs";
 import { bootLocalKeygen, resolveLocalKeygenOptions } from "./mode/local-keygen.mjs";
 import { makeSealResource } from "./registry-publish.mjs";
 import { makeKnownSnapshotable, makeLocalKeygenSnapshotable } from "./snapshot.mjs";
@@ -28,7 +34,7 @@ const DEFAULT_NAME = "seal";
 *  `IdentityContext` wired via the supervisor's plugin runtime context,
 *  artifact publisher publisher + chain probe yielded inside `acquire`. */
 const buildLocalKeygenPlugin = (opts) => {
-	const resolved = resolveLocalKeygenOptions(opts, "<default-seal-version>");
+	const resolved = resolveLocalKeygenOptions(opts, DEFAULT_SEAL_VERSION);
 	return definePlugin({
 		id: makeSealResource(resolved.name).id,
 		dependsOn: {
@@ -36,6 +42,7 @@ const buildLocalKeygenPlugin = (opts) => {
 			signer: opts.signer
 		},
 		role: "service",
+		section: "service",
 		pluginKey: sealPluginKey(resolved.name),
 		start: (deps) => Effect.gen(function* () {
 			const { sui, signer: signerAccount } = deps;
@@ -47,7 +54,11 @@ const buildLocalKeygenPlugin = (opts) => {
 			const path = yield* Path.Path;
 			const probe = yield* chainProbeFor(sui.chain);
 			const servicePath = path.join(stackPaths.stackRoot, "seal", resolved.name);
-			yield* fs.makeDirectory(servicePath, { recursive: true }).pipe(Effect.catch(() => Effect.void));
+			yield* fs.makeDirectory(servicePath, { recursive: true }).pipe(Effect.catch((cause) => Effect.fail(sealError("config-render", {
+				name: resolved.name,
+				message: `seal.config-render: failed to create service directory at ${servicePath} — downstream config + master-key writes would all fail; surfacing the underlying filesystem error.`,
+				cause
+			}))));
 			const sealNetworkName = buildSealNetworkName(identity.app, identity.stack, resolved.name);
 			const suiRpcUrlInNetwork = sui.hostGateway.rpcUrl;
 			const routed = buildSealKeyServerPublicRoute({
@@ -60,7 +71,7 @@ const buildLocalKeygenPlugin = (opts) => {
 				stack: identity.stack,
 				sealName: resolved.name
 			});
-			yield* runtime.ensureNetwork(sealNetworkCreateSpec({
+			yield* runtime.ensureNetwork(withSubnetAddressing({
 				name: sealNetworkName,
 				app: identity.app,
 				stack: identity.stack
@@ -139,11 +150,12 @@ const buildLivePlugin = (opts) => {
 	return definePlugin({
 		id: sealResource.id,
 		role: "task",
+		section: "service",
 		start: () => Effect.gen(function* () {
 			const mode = {
 				mode: "live",
 				name,
-				...opts
+				resolved: validated
 			};
 			return {
 				...(yield* bootSealService(yield* ArtifactPublisherService, mode)).keyServer,
@@ -155,22 +167,36 @@ const buildLivePlugin = (opts) => {
 		errorContributions: sealErrorContributions
 	});
 };
-/** Build the fork-known-mode plugin. Same structure as live, but with
-*  dynamic capabilities so the codegen bindings carry the REAL
-*  objectId / keyServerUrl resolved at acquire (the user-supplied
-*  options may be undefined → resolved by the upstream lookup). */
+/** Build the fork-known-mode plugin. Structurally symmetric with
+*  `buildLivePlugin` — both resolve their `{objectId, keyServerUrl}`
+*  tuple at factory time via `validateLiveInputs` (the fork-known
+*  side maps `upstream → KnownNetwork` first via
+*  `validateForkKnownInputs`) and thread it through SealMode's
+*  `resolved:` envelope.
+*
+*  Capabilities are kept on the dynamic shape (callback form)
+*  rather than precomputed — leaves room for a future on-acquire
+*  override path (e.g. the substrate dynamically rewrites the
+*  bindings) without restructuring the factory. Not load-bearing
+*  today; static capabilities would also work. */
 const buildForkKnownPlugin = (opts) => {
 	const name = opts.name ?? DEFAULT_NAME;
 	const sealResource = makeSealResource(name);
 	const snap = makeKnownSnapshotable({ name });
+	const validated = validateForkKnownInputs({
+		name,
+		...opts
+	});
 	return definePlugin({
 		id: sealResource.id,
 		role: "task",
+		section: "service",
 		start: () => Effect.gen(function* () {
 			const mode = {
 				mode: "fork-known",
 				name,
-				...opts
+				upstream: opts.upstream,
+				resolved: validated
 			};
 			return {
 				...(yield* bootSealService(yield* ArtifactPublisherService, mode)).keyServer,

package/dist/plugins/seal/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/seal/index.ts"],"sourcesContent":["// Seal plugin — barrel + factories.\n//\n// Architecture (07-seal.md): Seal is a local or known service plugin.\n// Three operative modes:\n//\n//   - `local-keygen`  — localnet, owns the master key. Heavy boot.\n//   - `live`          — testnet / mainnet, read-only handle to a\n//                       known deployment.\n//   - `fork-known`    — `*-fork` networks; routes to the wrapped\n//                       upstream's known deployment.\n//\n// Plus one type-level refusal:\n//\n//   - `fork-localkeygen-refused` — local-keygen ON `*-fork` is a\n//     synchronous throw at factory time (distilled-doc invariant #8).\n//\n// Public surface:\n//\n//   - `seal(opts)`              — explicit mode selection.\n//   - `sealFor(network).<mode>` — mode-narrowed factory namespace.\n//     Mode-narrowing makes `sealFor(forkNetwork).localKeygen(...)`\n//     a COMPILE-time refusal (architecture Tension 11 + type-prototype\n//     finding #4).\n//\n// Capability decls emitted:\n//\n//   1. Snapshotable        — local-keygen contributes secret material\n//                            subtree; known modes contribute the\n//                            empty shape.\n//   2. Codegenable         — `seal-key-server` bindings (server\n//                            configs + URL + objectId).\n//   3. Routable            — `seal-key-server` endpoint, local-keygen\n//                            only (known modes route to a remote URL\n//                            outside Traefik's purview).\n\nimport { Effect, FileSystem, Path } from 'effect';\n\nimport { definePlugin, type ResourceRef } from '../../api/define-plugin.ts';\nimport { defineModeNamespace } from '../../api/mode-narrowed-factory.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { ArtifactPublisherService } from '../../substrate/runtime/artifact-publisher/index.ts';\nimport { chainProbeFor } from '../../substrate/runtime/strategy-registry/index.ts';\nimport type { AccountResourceId } from '../account/index.ts';\nimport type { AccountValue } from '../account/service.ts';\nimport { suiResource } from '../sui/index.ts';\n\nimport type { SealObjectProbeKey } from './deploy.ts';\nimport { sealPluginKey } from './plugin-key.ts';\nimport { makeSealCodegenable, type SealBindings } from './codegen.ts';\nimport { SEAL_ERROR_TAGS, type SealError } from './errors.ts';\nimport type { ForkUpstream } from './mode/fork-known.ts';\nimport type { KnownNetwork } from './mode/live.ts';\nimport { validateLiveInputs } from './mode/live.ts';\nimport {\n\tbuildSealNetworkName,\n\tDEFAULT_KEY_SERVER_PORT,\n\tderiveSealSubnetPrefix,\n\tsealNetworkCreateSpec,\n} from './key-server.ts';\nimport {\n\tbootLocalKeygen,\n\tresolveLocalKeygenOptions,\n\ttype LocalKeygenDeps,\n} from './mode/local-keygen.ts';\nimport {\n\tmakeSealResource,\n\ttype SealLocalKeygenResolved,\n\ttype SealKnownResolved,\n\ttype SealResolved,\n} from './registry-publish.ts';\nimport { buildSealKeyServerPublicRoute, makeSealRoutable } from './routable.ts';\nimport { makeKnownSnapshotable, makeLocalKeygenSnapshotable } from './snapshot.ts';\nimport { bootSealService, type SealMode } from './service.ts';\n\nconst sealErrorContributions = pluginErrorContributions(SEAL_ERROR_TAGS);\n\n// ---------------------------------------------------------------------------\n// Resource exports — distilled-doc §\"TypeScript exports consumed elsewhere\"\n// ---------------------------------------------------------------------------\n\nexport {\n\tmakeSealResource,\n\tsealResourceId,\n\ttype SealKeyServer,\n\ttype SealKeyServerEntry,\n\ttype SealResolved,\n\ttype SealLocalKeygenResolved,\n\ttype SealKnownResolved,\n\ttype SealResourceId,\n} from './registry-publish.ts';\nexport type { SealKeyManager } from './key-manager.ts';\nexport {\n\ttype SealError,\n\ttype SealAnyError,\n\ttype SealConfigError,\n\tSEAL_ERROR_TAGS,\n} from './errors.ts';\nexport type { SealBindings } from './codegen.ts';\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Common options shared across all three modes. */\nexport interface SealCommonOptions {\n\treadonly name?: string;\n}\n\n/** A user-supplied signer account ref. The user passes the result of\n *  `account('publisher')` — NOT a magic-string token. Generic over the\n *  literal account name so the seal dependency edge preserves the\n *  per-account resource id. */\nexport type SealSignerMember<Name extends string = string> = ResourceRef<\n\tAccountResourceId<Name>,\n\tAccountValue\n>;\n\n/** Local-keygen mode options. The `signer` field is REQUIRED — the\n *  Move publish + on-chain register both need it. The mode-narrowed\n *  factory's TypeScript shape enforces this (no `signer?` here). */\nexport interface SealLocalKeygenOptions<\n\tSigner extends SealSignerMember = SealSignerMember,\n> extends SealCommonOptions {\n\t/** Signer for the seal Move publish + on-chain key-server register.\n\t *  Pass the result of `account('publisher')` — the same plugin/resource\n\t *  ref used elsewhere in the stack. The ref is threaded through\n\t *  `dependsOn` so the publish tx waits for the account's acquire\n\t *  (keypair mint + funding) to complete. */\n\treadonly signer: Signer;\n\treadonly version?: string;\n\treadonly movePackagePath?: string;\n\treadonly readyTimeoutMs?: number;\n\treadonly keyServerName?: string;\n\treadonly image?: { readonly pull: string } | { readonly build: { readonly context: string } };\n}\n\n/** Live-mode options (testnet / mainnet). */\nexport interface SealLiveOptions extends SealCommonOptions {\n\treadonly network?: KnownNetwork;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n/** Fork-known-mode options. */\nexport interface SealForkKnownOptions extends SealCommonOptions {\n\treadonly upstream: ForkUpstream;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\nexport type SealOptions<Signer extends SealSignerMember = SealSignerMember> =\n\t| ({ readonly mode: 'local-keygen' } & SealLocalKeygenOptions<Signer>)\n\t| ({ readonly mode: 'live' } & SealLiveOptions)\n\t| ({ readonly mode: 'fork-known' } & SealForkKnownOptions);\n\n// ---------------------------------------------------------------------------\n// Plugin construction\n// ---------------------------------------------------------------------------\n\n/** Constants + shared knobs for the buildXyz helpers below. */\nconst DEFAULT_NAME = 'seal';\n\n/** Build the local-keygen-mode plugin. The service contributes\n *  Snapshotable (secret) + Codegenable + Routable.\n *\n *  Architecture mirror (walrus): `ContainerRuntimeService` +\n *  `IdentityContext` wired via the supervisor's plugin runtime context,\n *  artifact publisher publisher + chain probe yielded inside `acquire`. */\nconst buildLocalKeygenPlugin = <const Signer extends SealSignerMember>(\n\topts: SealLocalKeygenOptions<Signer>,\n) => {\n\t// Synchronous factory-time defaults. Localnet-signer-required is\n\t// enforced by the typed `signer:` field on\n\t// SealLocalKeygenOptions.\n\tconst resolved = resolveLocalKeygenOptions(opts, '<default-seal-version>');\n\n\tconst sealResource = makeSealResource(resolved.name);\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\tdependsOn: { sui: suiResource, signer: opts.signer },\n\t\trole: 'service',\n\t\tpluginKey: sealPluginKey(resolved.name),\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst { sui, signer: signerAccount } = deps;\n\t\t\t\t// Substrate-context primitives:\n\t\t\t\t//   - `ContainerRuntimeService` + `IdentityContext` arrive\n\t\t\t\t//     via the supervisor's plugin runtime context.\n\t\t\t\t//   - `ArtifactPublisher` is the substrate-level\n\t\t\t\t//     publisher (cache → verify → produce → register cycle).\n\t\t\t\t//   - Chain probe is looked up via the\n\t\t\t\t//     StrategyRegistry under `chain-probe:<chainId>`; the\n\t\t\t\t//     Sui plugin registered it during its own acquire.\n\t\t\t\t//     The probe is yielded eagerly so the dep edge fails\n\t\t\t\t//     fast if sui's chain-probe registration is missing,\n\t\t\t\t//     matching walrus's pattern.\n\t\t\t\t//   - `StackPathsService` resolves the per-stack on-disk\n\t\t\t\t//     root so the key-server config + master-key.env\n\t\t\t\t//     bind-mount sources are real paths (not the\n\t\t\t\t//     `<runtime>/...` template).\n\t\t\t\tconst runtime = yield* ContainerRuntimeService;\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst stackPaths = yield* StackPathsService;\n\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\tconst path = yield* Path.Path;\n\t\t\t\tconst probe = yield* chainProbeFor<SealObjectProbeKey>(sui.chain);\n\n\t\t\t\t// Resolve the seal service dir from the per-stack paths\n\t\t\t\t// bundle. The dir must exist before the key-server's\n\t\t\t\t// bind-mounts (config yaml + master-key env-file).\n\t\t\t\tconst servicePath = path.join(stackPaths.stackRoot, 'seal', resolved.name);\n\t\t\t\tyield* fs\n\t\t\t\t\t.makeDirectory(servicePath, { recursive: true })\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.void));\n\n\t\t\t\t// Cross-container DNS: seal's key-server dials sui RPC via\n\t\t\t\t// `host.docker.internal`. The sui plugin binds a brokered\n\t\t\t\t// host port; the SDK publish/register path runs from the host\n\t\t\t\t// process and does not need the container network.\n\t\t\t\t//\n\t\t\t\t// Architectural decision (B5): seal owns its OWN docker\n\t\t\t\t// network for the key-server's network attachment;\n\t\t\t\t// sui-side hops go through the host gateway. Mirrors\n\t\t\t\t// walrus's pattern (see plugins/walrus/index.ts §B5).\n\t\t\t\tconst sealNetworkName = buildSealNetworkName(identity.app, identity.stack, resolved.name);\n\t\t\t\tconst suiRpcUrlInNetwork = sui.hostGateway.rpcUrl;\n\t\t\t\tconst routed = buildSealKeyServerPublicRoute({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tport: DEFAULT_KEY_SERVER_PORT,\n\t\t\t\t});\n\n\t\t\t\t// Idempotent network create — the long-running key-server\n\t\t\t\t// attaches to this name. The seal boot pipeline doesn't own\n\t\t\t\t// the create (unlike walrus's local-cluster which calls\n\t\t\t\t// `ensureNetwork` from its mode body); we call it here\n\t\t\t\t// because the substrate's `acquire` is the only seam that\n\t\t\t\t// holds both the runtime + the identity needed for the\n\t\t\t\t// per-stack label tuple.\n\t\t\t\tconst sealSubnetPrefix = deriveSealSubnetPrefix({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tsealName: resolved.name,\n\t\t\t\t});\n\t\t\t\tyield* runtime.ensureNetwork(\n\t\t\t\t\tsealNetworkCreateSpec(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: sealNetworkName,\n\t\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsealSubnetPrefix,\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst localKeygenDeps: LocalKeygenDeps = {\n\t\t\t\t\truntime,\n\t\t\t\t\tpublisher,\n\t\t\t\t\tsigner: signerAccount,\n\t\t\t\t\tsdk: sui.sdk,\n\t\t\t\t\t...(sui.buildImage !== null ? { buildImage: sui.buildImage } : {}),\n\t\t\t\t\tchainProbe: probe,\n\t\t\t\t\tchain: sui.chain,\n\t\t\t\t\tservicePath,\n\t\t\t\t\tcontainerName: `devstack-${identity.app}-${identity.stack}-seal-${resolved.name}-key-server`,\n\t\t\t\t\tlabels: {\n\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\tplugin: 'seal',\n\t\t\t\t\t\trole: 'key-server',\n\t\t\t\t\t},\n\t\t\t\t\tsuiNetworkName: sealNetworkName,\n\t\t\t\t\tsuiRpcUrlInNetwork,\n\t\t\t\t\troutedHostname: routed.hostname,\n\t\t\t\t\troutedUrl: routed.url,\n\t\t\t\t};\n\n\t\t\t\tconst boot = (yield* bootLocalKeygen(\n\t\t\t\t\tlocalKeygenDeps,\n\t\t\t\t\tresolved,\n\t\t\t\t)) satisfies SealLocalKeygenResolved;\n\n\t\t\t\tconst resolvedValue: SealResolved = {\n\t\t\t\t\t...boot.keyServer,\n\t\t\t\t\tmode: 'local-keygen',\n\t\t\t\t\tmanager: boot.keyManager,\n\t\t\t\t};\n\t\t\t\treturn resolvedValue;\n\t\t\t}),\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `SealKeyServer` + acquire context. Stamps the REAL\n\t\t// objectId / keyServerUrl into codegen bindings and the\n\t\t// real identity app/stack into the snapshot decl.\n\t\tcapabilities: ({ value: resolvedKs, runtime: acquireCtx }) => {\n\t\t\tconst bindings: SealBindings = {\n\t\t\t\tname: resolved.name,\n\t\t\t\tobjectId: resolvedKs.objectId,\n\t\t\t\tkeyServerUrl: resolvedKs.keyServerUrl,\n\t\t\t\tserverConfigs: resolvedKs.serverConfigs,\n\t\t\t\tmode: 'local-keygen',\n\t\t\t};\n\t\t\tconst snap = makeLocalKeygenSnapshotable({\n\t\t\t\tname: resolved.name,\n\t\t\t\tapp: acquireCtx.identity.app,\n\t\t\t\tstack: acquireCtx.identity.stack,\n\t\t\t});\n\t\t\tconst codegen = makeSealCodegenable(bindings);\n\t\t\tconst routable = makeSealRoutable({\n\t\t\t\tname: resolved.name,\n\t\t\t\tcontainerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-seal-${resolved.name}-key-server`,\n\t\t\t});\n\t\t\treturn [snap, codegen, routable] as const;\n\t\t},\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n/** Build the live-mode plugin. No Routable (URL is remote). */\nconst buildLivePlugin = (opts: SealLiveOptions) => {\n\tconst name = opts.name ?? DEFAULT_NAME;\n\tconst sealResource = makeSealResource(name);\n\t// Validate inputs at factory time so misconfigurations fail\n\t// before any plugin row starts work.\n\tconst validated = validateLiveInputs({ name, ...opts });\n\tconst bindings: SealBindings = {\n\t\tname,\n\t\tobjectId: validated.objectId,\n\t\tkeyServerUrl: validated.keyServerUrl,\n\t\tserverConfigs: [{ objectId: validated.objectId, weight: 1 }],\n\t\tmode: 'live',\n\t};\n\tconst snap = makeKnownSnapshotable({ name });\n\tconst codegen = makeSealCodegenable(bindings);\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\trole: 'task',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst mode: SealMode = { mode: 'live', name, ...opts };\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst resolved = (yield* bootSealService(publisher, mode)) as SealKnownResolved;\n\t\t\t\treturn {\n\t\t\t\t\t...resolved.keyServer,\n\t\t\t\t\tmode: 'live',\n\t\t\t\t\tmanager: null,\n\t\t\t\t} satisfies SealResolved;\n\t\t\t}),\n\t\tcapabilities: [snap, codegen] as const,\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n/** Build the fork-known-mode plugin. Same structure as live, but with\n *  dynamic capabilities so the codegen bindings carry the REAL\n *  objectId / keyServerUrl resolved at acquire (the user-supplied\n *  options may be undefined → resolved by the upstream lookup). */\nconst buildForkKnownPlugin = (opts: SealForkKnownOptions) => {\n\tconst name = opts.name ?? DEFAULT_NAME;\n\tconst sealResource = makeSealResource(name);\n\tconst snap = makeKnownSnapshotable({ name });\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\trole: 'task',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst mode: SealMode = { mode: 'fork-known', name, ...opts };\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst resolved = (yield* bootSealService(publisher, mode)) as SealKnownResolved;\n\t\t\t\treturn {\n\t\t\t\t\t...resolved.keyServer,\n\t\t\t\t\tmode: 'fork-known',\n\t\t\t\t\tmanager: null,\n\t\t\t\t} satisfies SealResolved;\n\t\t\t}),\n\t\tcapabilities: ({ value: resolvedKs }) => {\n\t\t\tconst bindings: SealBindings = {\n\t\t\t\tname,\n\t\t\t\tobjectId: resolvedKs.objectId,\n\t\t\t\tkeyServerUrl: resolvedKs.keyServerUrl,\n\t\t\t\tserverConfigs: resolvedKs.serverConfigs,\n\t\t\t\tmode: 'fork-known',\n\t\t\t};\n\t\t\treturn [snap, makeSealCodegenable(bindings)] as const;\n\t\t},\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// User-facing factories\n// ---------------------------------------------------------------------------\n\n/** Explicit Seal factory. `local-keygen` requires a signer; live and\n *  fork-known modes must be selected directly or through `sealFor`. */\nexport const seal = <const Signer extends SealSignerMember = SealSignerMember>(\n\topts: SealOptions<Signer>,\n) => {\n\tswitch (opts.mode) {\n\t\tcase 'local-keygen':\n\t\t\treturn buildLocalKeygenPlugin(opts);\n\t\tcase 'live':\n\t\t\treturn buildLivePlugin(opts);\n\t\tcase 'fork-known':\n\t\t\treturn buildForkKnownPlugin(opts);\n\t}\n};\n\n/** Mode-narrowed factory namespace.\n *\n *  Usage:\n *      const local = { mode: 'local' } as const;\n *      sealFor(local).localKeygen({signer})    // OK\n *      sealFor(local).forkKnown(...)           // type error: not in 'local' branch\n *\n *      const fork = { mode: 'fork' } as const;\n *      sealFor(fork).forkKnown({upstream})     // OK\n *      sealFor(fork).localKeygen({signer})     // type error: not in 'fork' branch\n *                                              // (distilled-doc invariant #8)\n *\n *  Distilled-doc invariant #8 (fork-localkeygen-refused): the\n *  fork-mode branch has NO `localKeygen` entry — that's the\n *  type-level refusal. */\nexport const sealFor = defineModeNamespace({\n\tlocal: {\n\t\tlocalKeygen: <const Signer extends SealSignerMember>(opts: SealLocalKeygenOptions<Signer>) =>\n\t\t\tbuildLocalKeygenPlugin(opts),\n\t},\n\tlive: {\n\t\ttestnet: (opts: Omit<SealLiveOptions, 'network'> = {}) =>\n\t\t\tbuildLivePlugin({ network: 'testnet', ...opts }),\n\t\tmainnet: (opts: Omit<SealLiveOptions, 'network'> = {}) =>\n\t\t\tbuildLivePlugin({ network: 'mainnet', ...opts }),\n\t\tcustom: (\n\t\t\topts: Required<Pick<SealLiveOptions, 'objectId' | 'keyServerUrl'>> & SealLiveOptions,\n\t\t) => buildLivePlugin(opts),\n\t},\n\tfork: {\n\t\tforkKnown: (opts: SealForkKnownOptions) => buildForkKnownPlugin(opts),\n\t},\n});\n\n// ---------------------------------------------------------------------------\n// Type-only error re-export\n// ---------------------------------------------------------------------------\n\nexport type { SealError as SealAcquireError };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4EA,MAAM,yBAAyB,yBAAyB,gBAAgB;;AAsFxE,MAAM,eAAe;;;;;;;AAQrB,MAAM,0BACL,SACI;CAIJ,MAAM,WAAW,0BAA0B,MAAM,yBAAyB;AAI1E,QAAO,aAAa;EACnB,IAHoB,iBAAiB,SAAS,KAG9B,CAAC;EACjB,WAAW;GAAE,KAAK;GAAa,QAAQ,KAAK;GAAQ;EACpD,MAAM;EACN,WAAW,cAAc,SAAS,KAAK;EACvC,QAAQ,SACP,OAAO,IAAI,aAAa;GACvB,MAAM,EAAE,KAAK,QAAQ,kBAAkB;GAgBvC,MAAM,UAAU,OAAO;GACvB,MAAM,WAAW,OAAO;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,aAAa,OAAO;GAC1B,MAAM,KAAK,OAAO,WAAW;GAC7B,MAAM,OAAO,OAAO,KAAK;GACzB,MAAM,QAAQ,OAAO,cAAkC,IAAI,MAAM;GAKjE,MAAM,cAAc,KAAK,KAAK,WAAW,WAAW,QAAQ,SAAS,KAAK;AAC1E,UAAO,GACL,cAAc,aAAa,EAAE,WAAW,MAAM,CAAC,CAC/C,KAAK,OAAO,YAAY,OAAO,KAAK,CAAC;GAWvC,MAAM,kBAAkB,qBAAqB,SAAS,KAAK,SAAS,OAAO,SAAS,KAAK;GACzF,MAAM,qBAAqB,IAAI,YAAY;GAC3C,MAAM,SAAS,8BAA8B;IAC5C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,MAAM;IACN,CAAC;GASF,MAAM,mBAAmB,uBAAuB;IAC/C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,UAAU,SAAS;IACnB,CAAC;AACF,UAAO,QAAQ,cACd,sBACC;IACC,MAAM;IACN,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,EACD,iBACA,CACD;GAwBD,MAAM,OAAQ,OAAO,gBACpB;IAtBA;IACA;IACA,QAAQ;IACR,KAAK,IAAI;IACT,GAAI,IAAI,eAAe,OAAO,EAAE,YAAY,IAAI,YAAY,GAAG,EAAE;IACjE,YAAY;IACZ,OAAO,IAAI;IACX;IACA,eAAe,YAAY,SAAS,IAAI,GAAG,SAAS,MAAM,QAAQ,SAAS,KAAK;IAChF,QAAQ;KACP,KAAK,SAAS;KACd,OAAO,SAAS;KAChB,QAAQ;KACR,MAAM;KACN;IACD,gBAAgB;IAChB;IACA,gBAAgB,OAAO;IACvB,WAAW,OAAO;IAIH,EACf,SACA;AAOD,UAAO;IAJN,GAAG,KAAK;IACR,MAAM;IACN,SAAS,KAAK;IAEK;IACnB;EAKH,eAAe,EAAE,OAAO,YAAY,SAAS,iBAAiB;GAC7D,MAAM,WAAyB;IAC9B,MAAM,SAAS;IACf,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,eAAe,WAAW;IAC1B,MAAM;IACN;AAWD,UAAO;IAVM,4BAA4B;KACxC,MAAM,SAAS;KACf,KAAK,WAAW,SAAS;KACzB,OAAO,WAAW,SAAS;KAC3B,CAMW;IALI,oBAAoB,SAKf;IAJJ,iBAAiB;KACjC,MAAM,SAAS;KACf,eAAe,YAAY,WAAW,SAAS,IAAI,GAAG,WAAW,SAAS,MAAM,QAAQ,SAAS,KAAK;KACtG,CAC8B;IAAC;;EAEjC,oBAAoB;EACpB,CAAC;;;AAIH,MAAM,mBAAmB,SAA0B;CAClD,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,eAAe,iBAAiB,KAAK;CAG3C,MAAM,YAAY,mBAAmB;EAAE;EAAM,GAAG;EAAM,CAAC;CACvD,MAAM,WAAyB;EAC9B;EACA,UAAU,UAAU;EACpB,cAAc,UAAU;EACxB,eAAe,CAAC;GAAE,UAAU,UAAU;GAAU,QAAQ;GAAG,CAAC;EAC5D,MAAM;EACN;CACD,MAAM,OAAO,sBAAsB,EAAE,MAAM,CAAC;CAC5C,MAAM,UAAU,oBAAoB,SAAS;AAE7C,QAAO,aAAa;EACnB,IAAI,aAAa;EACjB,MAAM;EACN,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,OAAiB;IAAE,MAAM;IAAQ;IAAM,GAAG;IAAM;AAGtD,UAAO;IACN,IAAG,OAFqB,gBAAgB,OADhB,0BAC2B,KAAK,EAE5C;IACZ,MAAM;IACN,SAAS;IACT;IACA;EACH,cAAc,CAAC,MAAM,QAAQ;EAC7B,oBAAoB;EACpB,CAAC;;;;;;AAOH,MAAM,wBAAwB,SAA+B;CAC5D,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,eAAe,iBAAiB,KAAK;CAC3C,MAAM,OAAO,sBAAsB,EAAE,MAAM,CAAC;AAE5C,QAAO,aAAa;EACnB,IAAI,aAAa;EACjB,MAAM;EACN,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,OAAiB;IAAE,MAAM;IAAc;IAAM,GAAG;IAAM;AAG5D,UAAO;IACN,IAAG,OAFqB,gBAAgB,OADhB,0BAC2B,KAAK,EAE5C;IACZ,MAAM;IACN,SAAS;IACT;IACA;EACH,eAAe,EAAE,OAAO,iBAAiB;AAQxC,UAAO,CAAC,MAAM,oBAAoB;IANjC;IACA,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,eAAe,WAAW;IAC1B,MAAM;IAEmC,CAAC,CAAC;;EAE7C,oBAAoB;EACpB,CAAC;;;;AASH,MAAa,QACZ,SACI;AACJ,SAAQ,KAAK,MAAb;EACC,KAAK,eACJ,QAAO,uBAAuB,KAAK;EACpC,KAAK,OACJ,QAAO,gBAAgB,KAAK;EAC7B,KAAK,aACJ,QAAO,qBAAqB,KAAK;;;;;;;;;;;;;;;;;;AAmBpC,MAAa,UAAU,oBAAoB;CAC1C,OAAO,EACN,cAAqD,SACpD,uBAAuB,KAAK,EAC7B;CACD,MAAM;EACL,UAAU,OAAyC,EAAE,KACpD,gBAAgB;GAAE,SAAS;GAAW,GAAG;GAAM,CAAC;EACjD,UAAU,OAAyC,EAAE,KACpD,gBAAgB;GAAE,SAAS;GAAW,GAAG;GAAM,CAAC;EACjD,SACC,SACI,gBAAgB,KAAK;EAC1B;CACD,MAAM,EACL,YAAY,SAA+B,qBAAqB,KAAK,EACrE;CACD,CAAC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/seal/index.ts"],"sourcesContent":["// Seal plugin — barrel + factories.\n//\n// Architecture (07-seal.md): Seal is a local or known service plugin.\n// Three operative modes:\n//\n//   - `local-keygen`  — localnet, owns the master key. Heavy boot.\n//   - `live`          — testnet / mainnet, read-only handle to a\n//                       known deployment.\n//   - `fork-known`    — `*-fork` networks; routes to the wrapped\n//                       upstream's known deployment.\n//\n// Plus one type-level refusal:\n//\n//   - `fork-localkeygen-refused` — local-keygen ON `*-fork` is a\n//     synchronous throw at factory time (distilled-doc invariant #8).\n//\n// Public surface:\n//\n//   - `seal(opts)`              — explicit mode selection.\n//   - `sealFor(network).<mode>` — mode-narrowed factory namespace.\n//     Mode-narrowing makes `sealFor(forkNetwork).localKeygen(...)`\n//     a COMPILE-time refusal (architecture Tension 11 + type-prototype\n//     finding #4).\n//\n// Capability decls emitted:\n//\n//   1. Snapshotable        — local-keygen contributes secret material\n//                            subtree; known modes contribute the\n//                            empty shape.\n//   2. Codegenable         — `seal-key-server` bindings (server\n//                            configs + URL + objectId).\n//   3. Routable            — `seal-key-server` endpoint, local-keygen\n//                            only (known modes route to a remote URL\n//                            outside Traefik's purview).\n\nimport { Effect, FileSystem, Path } from 'effect';\n\nimport { definePlugin, type ResourceRef } from '../../api/define-plugin.ts';\nimport { defineModeNamespace } from '../../api/mode-narrowed-factory.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { ArtifactPublisherService } from '../../substrate/runtime/artifact-publisher/index.ts';\nimport { chainProbeFor } from '../../substrate/runtime/strategy-registry/index.ts';\nimport type { AccountResourceId, AccountValue } from '../account/index.ts';\nimport { suiResource } from '../sui/index.ts';\n\nimport type { SealObjectProbeKey } from './deploy.ts';\nimport { sealPluginKey } from './plugin-key.ts';\nimport { makeSealCodegenable, type SealBindings } from './codegen.ts';\nimport { sealError, SEAL_ERROR_TAGS, type SealError } from './errors.ts';\nimport { validateForkKnownInputs, type ForkUpstream } from './mode/fork-known.ts';\nimport type { KnownNetwork } from './mode/live.ts';\nimport { validateLiveInputs } from './mode/live.ts';\nimport {\n\tbuildSealNetworkName,\n\tDEFAULT_KEY_SERVER_PORT,\n\tderiveSealSubnetPrefix,\n} from './key-server.ts';\nimport { withSubnetAddressing } from '../../substrate/runtime/subnet-broker.ts';\nimport {\n\tbootLocalKeygen,\n\tresolveLocalKeygenOptions,\n\ttype LocalKeygenDeps,\n} from './mode/local-keygen.ts';\nimport {\n\tmakeSealResource,\n\ttype SealLocalKeygenResolved,\n\ttype SealKnownResolved,\n\ttype SealResolved,\n} from './registry-publish.ts';\nimport { buildSealKeyServerPublicRoute, makeSealRoutable } from './routable.ts';\nimport { makeKnownSnapshotable, makeLocalKeygenSnapshotable } from './snapshot.ts';\nimport { bootSealService, type SealMode } from './service.ts';\nimport { DEFAULT_SEAL_VERSION } from './bootstrap-assets/source-fetch.ts';\n\nconst sealErrorContributions = pluginErrorContributions(SEAL_ERROR_TAGS);\n\n// ---------------------------------------------------------------------------\n// Resource exports — distilled-doc §\"TypeScript exports consumed elsewhere\"\n// ---------------------------------------------------------------------------\n\nexport {\n\tmakeSealResource,\n\tsealResourceId,\n\ttype SealKeyServer,\n\ttype SealKeyServerEntry,\n\ttype SealResolved,\n\ttype SealLocalKeygenResolved,\n\ttype SealKnownResolved,\n\ttype SealResourceId,\n} from './registry-publish.ts';\nexport type { SealKeyManager } from './key-manager.ts';\nexport {\n\ttype SealError,\n\ttype SealAnyError,\n\ttype SealConfigError,\n\tSEAL_ERROR_TAGS,\n} from './errors.ts';\nexport type { SealBindings } from './codegen.ts';\nexport { SealSpans } from './spans.ts';\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Common options shared across all three modes. */\nexport interface SealCommonOptions {\n\treadonly name?: string;\n}\n\n/** A user-supplied signer account ref. The user passes the result of\n *  `account('publisher')` — NOT a magic-string token. Generic over the\n *  literal account name so the seal dependency edge preserves the\n *  per-account resource id. */\nexport type SealSignerMember<Name extends string = string> = ResourceRef<\n\tAccountResourceId<Name>,\n\tAccountValue\n>;\n\n/** Local-keygen mode options. The `signer` field is REQUIRED — the\n *  Move publish + on-chain register both need it. The mode-narrowed\n *  factory's TypeScript shape enforces this (no `signer?` here). */\nexport interface SealLocalKeygenOptions<\n\tSigner extends SealSignerMember = SealSignerMember,\n> extends SealCommonOptions {\n\t/** Signer for the seal Move publish + on-chain key-server register.\n\t *  Pass the result of `account('publisher')` — the same plugin/resource\n\t *  ref used elsewhere in the stack. The ref is threaded through\n\t *  `dependsOn` so the publish tx waits for the account's acquire\n\t *  (keypair mint + funding) to complete. */\n\treadonly signer: Signer;\n\treadonly version?: string;\n\treadonly movePackagePath?: string;\n\treadonly readyTimeoutMs?: number;\n\treadonly keyServerName?: string;\n\treadonly image?: { readonly pull: string } | { readonly build: { readonly context: string } };\n}\n\n/** Live-mode options (testnet / mainnet). */\nexport interface SealLiveOptions extends SealCommonOptions {\n\treadonly network?: KnownNetwork;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n/** Fork-known-mode options. */\nexport interface SealForkKnownOptions extends SealCommonOptions {\n\treadonly upstream: ForkUpstream;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\nexport type SealOptions<Signer extends SealSignerMember = SealSignerMember> =\n\t| ({ readonly mode: 'local-keygen' } & SealLocalKeygenOptions<Signer>)\n\t| ({ readonly mode: 'live' } & SealLiveOptions)\n\t| ({ readonly mode: 'fork-known' } & SealForkKnownOptions);\n\n// ---------------------------------------------------------------------------\n// Plugin construction\n// ---------------------------------------------------------------------------\n\n/** Constants + shared knobs for the buildXyz helpers below. */\nconst DEFAULT_NAME = 'seal';\n\n/** Build the local-keygen-mode plugin. The service contributes\n *  Snapshotable (secret) + Codegenable + Routable.\n *\n *  Architecture mirror (walrus): `ContainerRuntimeService` +\n *  `IdentityContext` wired via the supervisor's plugin runtime context,\n *  artifact publisher publisher + chain probe yielded inside `acquire`. */\nconst buildLocalKeygenPlugin = <const Signer extends SealSignerMember>(\n\topts: SealLocalKeygenOptions<Signer>,\n) => {\n\t// Synchronous factory-time defaults. Localnet-signer-required is\n\t// enforced by the typed `signer:` field on\n\t// SealLocalKeygenOptions.\n\tconst resolved = resolveLocalKeygenOptions(opts, DEFAULT_SEAL_VERSION);\n\n\tconst sealResource = makeSealResource(resolved.name);\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\tdependsOn: { sui: suiResource, signer: opts.signer },\n\t\trole: 'service',\n\t\tsection: 'service',\n\t\tpluginKey: sealPluginKey(resolved.name),\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst { sui, signer: signerAccount } = deps;\n\t\t\t\t// Substrate-context primitives:\n\t\t\t\t//   - `ContainerRuntimeService` + `IdentityContext` arrive\n\t\t\t\t//     via the supervisor's plugin runtime context.\n\t\t\t\t//   - `ArtifactPublisher` is the substrate-level\n\t\t\t\t//     publisher (cache → verify → produce → register cycle).\n\t\t\t\t//   - Chain probe is looked up via the\n\t\t\t\t//     StrategyRegistry under `chain-probe:<chainId>`; the\n\t\t\t\t//     Sui plugin registered it during its own acquire.\n\t\t\t\t//     The probe is yielded eagerly so the dep edge fails\n\t\t\t\t//     fast if sui's chain-probe registration is missing,\n\t\t\t\t//     matching walrus's pattern.\n\t\t\t\t//   - `StackPathsService` resolves the per-stack on-disk\n\t\t\t\t//     root so the key-server config + master-key.env\n\t\t\t\t//     bind-mount sources are real paths (not the\n\t\t\t\t//     `<runtime>/...` template).\n\t\t\t\tconst runtime = yield* ContainerRuntimeService;\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst stackPaths = yield* StackPathsService;\n\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\tconst path = yield* Path.Path;\n\t\t\t\tconst probe = yield* chainProbeFor<SealObjectProbeKey>(sui.chain);\n\n\t\t\t\t// Resolve the seal service dir from the per-stack paths\n\t\t\t\t// bundle. The dir must exist before the key-server's\n\t\t\t\t// bind-mounts (config yaml + master-key env-file).\n\t\t\t\tconst servicePath = path.join(stackPaths.stackRoot, 'seal', resolved.name);\n\t\t\t\tyield* fs.makeDirectory(servicePath, { recursive: true }).pipe(\n\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\t\t\tname: resolved.name,\n\t\t\t\t\t\t\t\tmessage: `seal.config-render: failed to create service directory at ${servicePath} — downstream config + master-key writes would all fail; surfacing the underlying filesystem error.`,\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\t// Cross-container DNS: seal's key-server dials sui RPC via\n\t\t\t\t// `host.docker.internal`. The sui plugin binds a brokered\n\t\t\t\t// host port; the SDK publish/register path runs from the host\n\t\t\t\t// process and does not need the container network.\n\t\t\t\t//\n\t\t\t\t// Architectural decision (B5): seal owns its OWN docker\n\t\t\t\t// network for the key-server's network attachment;\n\t\t\t\t// sui-side hops go through the host gateway. Mirrors\n\t\t\t\t// walrus's pattern (see plugins/walrus/index.ts §B5).\n\t\t\t\tconst sealNetworkName = buildSealNetworkName(identity.app, identity.stack, resolved.name);\n\t\t\t\tconst suiRpcUrlInNetwork = sui.hostGateway.rpcUrl;\n\t\t\t\tconst routed = buildSealKeyServerPublicRoute({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tport: DEFAULT_KEY_SERVER_PORT,\n\t\t\t\t});\n\n\t\t\t\t// Idempotent network create — the long-running key-server\n\t\t\t\t// attaches to this name. The seal boot pipeline doesn't own\n\t\t\t\t// the create (unlike walrus's local-cluster which calls\n\t\t\t\t// `ensureNetwork` from its mode body); we call it here\n\t\t\t\t// because the substrate's `acquire` is the only seam that\n\t\t\t\t// holds both the runtime + the identity needed for the\n\t\t\t\t// per-stack label tuple.\n\t\t\t\tconst sealSubnetPrefix = deriveSealSubnetPrefix({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tsealName: resolved.name,\n\t\t\t\t});\n\t\t\t\tyield* runtime.ensureNetwork(\n\t\t\t\t\twithSubnetAddressing(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: sealNetworkName,\n\t\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsealSubnetPrefix,\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst localKeygenDeps: LocalKeygenDeps = {\n\t\t\t\t\truntime,\n\t\t\t\t\tpublisher,\n\t\t\t\t\tsigner: signerAccount,\n\t\t\t\t\tsdk: sui.sdk,\n\t\t\t\t\t...(sui.buildImage !== null ? { buildImage: sui.buildImage } : {}),\n\t\t\t\t\tchainProbe: probe,\n\t\t\t\t\tchain: sui.chain,\n\t\t\t\t\tservicePath,\n\t\t\t\t\tcontainerName: `devstack-${identity.app}-${identity.stack}-seal-${resolved.name}-key-server`,\n\t\t\t\t\tlabels: {\n\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\tplugin: 'seal',\n\t\t\t\t\t\trole: 'key-server',\n\t\t\t\t\t},\n\t\t\t\t\tsuiNetworkName: sealNetworkName,\n\t\t\t\t\tsuiRpcUrlInNetwork,\n\t\t\t\t\troutedHostname: routed.hostname,\n\t\t\t\t\troutedUrl: routed.url,\n\t\t\t\t};\n\n\t\t\t\tconst boot = (yield* bootLocalKeygen(\n\t\t\t\t\tlocalKeygenDeps,\n\t\t\t\t\tresolved,\n\t\t\t\t)) satisfies SealLocalKeygenResolved;\n\n\t\t\t\tconst resolvedValue: SealResolved = {\n\t\t\t\t\t...boot.keyServer,\n\t\t\t\t\tmode: 'local-keygen',\n\t\t\t\t\tmanager: boot.keyManager,\n\t\t\t\t};\n\t\t\t\treturn resolvedValue;\n\t\t\t}),\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `SealKeyServer` + acquire context. Stamps the REAL\n\t\t// objectId / keyServerUrl into codegen bindings and the\n\t\t// real identity app/stack into the snapshot decl.\n\t\tcapabilities: ({ value: resolvedKs, runtime: acquireCtx }) => {\n\t\t\tconst bindings: SealBindings = {\n\t\t\t\tname: resolved.name,\n\t\t\t\tobjectId: resolvedKs.objectId,\n\t\t\t\tkeyServerUrl: resolvedKs.keyServerUrl,\n\t\t\t\tserverConfigs: resolvedKs.serverConfigs,\n\t\t\t\tmode: 'local-keygen',\n\t\t\t};\n\t\t\tconst snap = makeLocalKeygenSnapshotable({\n\t\t\t\tname: resolved.name,\n\t\t\t\tapp: acquireCtx.identity.app,\n\t\t\t\tstack: acquireCtx.identity.stack,\n\t\t\t});\n\t\t\tconst codegen = makeSealCodegenable(bindings);\n\t\t\tconst routable = makeSealRoutable({\n\t\t\t\tname: resolved.name,\n\t\t\t\tcontainerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-seal-${resolved.name}-key-server`,\n\t\t\t});\n\t\t\treturn [snap, codegen, routable] as const;\n\t\t},\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n/** Build the live-mode plugin. No Routable (URL is remote). */\nconst buildLivePlugin = (opts: SealLiveOptions) => {\n\tconst name = opts.name ?? DEFAULT_NAME;\n\tconst sealResource = makeSealResource(name);\n\t// Validate inputs at factory time so misconfigurations fail\n\t// before any plugin row starts work.\n\tconst validated = validateLiveInputs({ name, ...opts });\n\tconst bindings: SealBindings = {\n\t\tname,\n\t\tobjectId: validated.objectId,\n\t\tkeyServerUrl: validated.keyServerUrl,\n\t\tserverConfigs: [{ objectId: validated.objectId, weight: 1 }],\n\t\tmode: 'live',\n\t};\n\tconst snap = makeKnownSnapshotable({ name });\n\tconst codegen = makeSealCodegenable(bindings);\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\trole: 'task',\n\t\tsection: 'service',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst mode: SealMode = { mode: 'live', name, resolved: validated };\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst resolved = (yield* bootSealService(publisher, mode)) as SealKnownResolved;\n\t\t\t\treturn {\n\t\t\t\t\t...resolved.keyServer,\n\t\t\t\t\tmode: 'live',\n\t\t\t\t\tmanager: null,\n\t\t\t\t} satisfies SealResolved;\n\t\t\t}),\n\t\tcapabilities: [snap, codegen] as const,\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n/** Build the fork-known-mode plugin. Structurally symmetric with\n *  `buildLivePlugin` — both resolve their `{objectId, keyServerUrl}`\n *  tuple at factory time via `validateLiveInputs` (the fork-known\n *  side maps `upstream → KnownNetwork` first via\n *  `validateForkKnownInputs`) and thread it through SealMode's\n *  `resolved:` envelope.\n *\n *  Capabilities are kept on the dynamic shape (callback form)\n *  rather than precomputed — leaves room for a future on-acquire\n *  override path (e.g. the substrate dynamically rewrites the\n *  bindings) without restructuring the factory. Not load-bearing\n *  today; static capabilities would also work. */\nconst buildForkKnownPlugin = (opts: SealForkKnownOptions) => {\n\tconst name = opts.name ?? DEFAULT_NAME;\n\tconst sealResource = makeSealResource(name);\n\tconst snap = makeKnownSnapshotable({ name });\n\t// Validate inputs at factory time so misconfigurations fail\n\t// before any plugin row starts work — symmetric with\n\t// `buildLivePlugin`'s factory-boundary `validateLiveInputs` call.\n\t// `validateForkKnownInputs` maps the upstream alias to a\n\t// `KnownNetwork` and runs the same validation pipeline as live mode.\n\tconst validated = validateForkKnownInputs({ name, ...opts });\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\trole: 'task',\n\t\tsection: 'service',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\t// Symmetric with the live branch's `{ mode, name, resolved }`\n\t\t\t\t// envelope. `upstream` rides through for downstream\n\t\t\t\t// span attribution; `resolved` carries the validated\n\t\t\t\t// `{objectId, keyServerUrl}` tuple.\n\t\t\t\tconst mode: SealMode = {\n\t\t\t\t\tmode: 'fork-known',\n\t\t\t\t\tname,\n\t\t\t\t\tupstream: opts.upstream,\n\t\t\t\t\tresolved: validated,\n\t\t\t\t};\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst resolved = (yield* bootSealService(publisher, mode)) as SealKnownResolved;\n\t\t\t\treturn {\n\t\t\t\t\t...resolved.keyServer,\n\t\t\t\t\tmode: 'fork-known',\n\t\t\t\t\tmanager: null,\n\t\t\t\t} satisfies SealResolved;\n\t\t\t}),\n\t\tcapabilities: ({ value: resolvedKs }) => {\n\t\t\tconst bindings: SealBindings = {\n\t\t\t\tname,\n\t\t\t\tobjectId: resolvedKs.objectId,\n\t\t\t\tkeyServerUrl: resolvedKs.keyServerUrl,\n\t\t\t\tserverConfigs: resolvedKs.serverConfigs,\n\t\t\t\tmode: 'fork-known',\n\t\t\t};\n\t\t\treturn [snap, makeSealCodegenable(bindings)] as const;\n\t\t},\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// User-facing factories\n// ---------------------------------------------------------------------------\n\n/** Explicit Seal factory. `local-keygen` requires a signer; live and\n *  fork-known modes must be selected directly or through `sealFor`. */\nexport const seal = <const Signer extends SealSignerMember = SealSignerMember>(\n\topts: SealOptions<Signer>,\n) => {\n\tswitch (opts.mode) {\n\t\tcase 'local-keygen':\n\t\t\treturn buildLocalKeygenPlugin(opts);\n\t\tcase 'live':\n\t\t\treturn buildLivePlugin(opts);\n\t\tcase 'fork-known':\n\t\t\treturn buildForkKnownPlugin(opts);\n\t}\n};\n\n/** Mode-narrowed factory namespace.\n *\n *  Usage:\n *      const local = { mode: 'local' } as const;\n *      sealFor(local).localKeygen({signer})    // OK\n *      sealFor(local).forkKnown(...)           // type error: not in 'local' branch\n *\n *      const fork = { mode: 'fork' } as const;\n *      sealFor(fork).forkKnown({upstream})     // OK\n *      sealFor(fork).localKeygen({signer})     // type error: not in 'fork' branch\n *                                              // (distilled-doc invariant #8)\n *\n *  Distilled-doc invariant #8 (fork-localkeygen-refused): the\n *  fork-mode branch has NO `localKeygen` entry — that's the\n *  type-level refusal. */\nexport const sealFor = defineModeNamespace({\n\tlocal: {\n\t\tlocalKeygen: <const Signer extends SealSignerMember>(opts: SealLocalKeygenOptions<Signer>) =>\n\t\t\tbuildLocalKeygenPlugin(opts),\n\t},\n\tlive: {\n\t\ttestnet: (opts: Omit<SealLiveOptions, 'network'> = {}) =>\n\t\t\tbuildLivePlugin({ network: 'testnet', ...opts }),\n\t\tmainnet: (opts: Omit<SealLiveOptions, 'network'> = {}) =>\n\t\t\tbuildLivePlugin({ network: 'mainnet', ...opts }),\n\t\tcustom: (\n\t\t\topts: Required<Pick<SealLiveOptions, 'objectId' | 'keyServerUrl'>> & SealLiveOptions,\n\t\t) => buildLivePlugin(opts),\n\t},\n\tfork: {\n\t\tforkKnown: (opts: SealForkKnownOptions) => buildForkKnownPlugin(opts),\n\t},\n});\n\n// ---------------------------------------------------------------------------\n// Type-only error re-export\n// ---------------------------------------------------------------------------\n\nexport type { SealError as SealAcquireError };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,MAAM,yBAAyB,yBAAyB,gBAAgB;;AAuFxE,MAAM,eAAe;;;;;;;AAQrB,MAAM,0BACL,SACI;CAIJ,MAAM,WAAW,0BAA0B,MAAM,qBAAqB;AAItE,QAAO,aAAa;EACnB,IAHoB,iBAAiB,SAAS,KAG9B,CAAC;EACjB,WAAW;GAAE,KAAK;GAAa,QAAQ,KAAK;GAAQ;EACpD,MAAM;EACN,SAAS;EACT,WAAW,cAAc,SAAS,KAAK;EACvC,QAAQ,SACP,OAAO,IAAI,aAAa;GACvB,MAAM,EAAE,KAAK,QAAQ,kBAAkB;GAgBvC,MAAM,UAAU,OAAO;GACvB,MAAM,WAAW,OAAO;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,aAAa,OAAO;GAC1B,MAAM,KAAK,OAAO,WAAW;GAC7B,MAAM,OAAO,OAAO,KAAK;GACzB,MAAM,QAAQ,OAAO,cAAkC,IAAI,MAAM;GAKjE,MAAM,cAAc,KAAK,KAAK,WAAW,WAAW,QAAQ,SAAS,KAAK;AAC1E,UAAO,GAAG,cAAc,aAAa,EAAE,WAAW,MAAM,CAAC,CAAC,KACzD,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;IAC1B,MAAM,SAAS;IACf,SAAS,6DAA6D,YAAY;IAClF;IACA,CAAC,CACF,CACD,CACD;GAWD,MAAM,kBAAkB,qBAAqB,SAAS,KAAK,SAAS,OAAO,SAAS,KAAK;GACzF,MAAM,qBAAqB,IAAI,YAAY;GAC3C,MAAM,SAAS,8BAA8B;IAC5C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,MAAM;IACN,CAAC;GASF,MAAM,mBAAmB,uBAAuB;IAC/C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,UAAU,SAAS;IACnB,CAAC;AACF,UAAO,QAAQ,cACd,qBACC;IACC,MAAM;IACN,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,EACD,iBACA,CACD;GAwBD,MAAM,OAAQ,OAAO,gBACpB;IAtBA;IACA;IACA,QAAQ;IACR,KAAK,IAAI;IACT,GAAI,IAAI,eAAe,OAAO,EAAE,YAAY,IAAI,YAAY,GAAG,EAAE;IACjE,YAAY;IACZ,OAAO,IAAI;IACX;IACA,eAAe,YAAY,SAAS,IAAI,GAAG,SAAS,MAAM,QAAQ,SAAS,KAAK;IAChF,QAAQ;KACP,KAAK,SAAS;KACd,OAAO,SAAS;KAChB,QAAQ;KACR,MAAM;KACN;IACD,gBAAgB;IAChB;IACA,gBAAgB,OAAO;IACvB,WAAW,OAAO;IAIH,EACf,SACA;AAOD,UAAO;IAJN,GAAG,KAAK;IACR,MAAM;IACN,SAAS,KAAK;IAEK;IACnB;EAKH,eAAe,EAAE,OAAO,YAAY,SAAS,iBAAiB;GAC7D,MAAM,WAAyB;IAC9B,MAAM,SAAS;IACf,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,eAAe,WAAW;IAC1B,MAAM;IACN;AAWD,UAAO;IAVM,4BAA4B;KACxC,MAAM,SAAS;KACf,KAAK,WAAW,SAAS;KACzB,OAAO,WAAW,SAAS;KAC3B,CAMW;IALI,oBAAoB,SAKf;IAJJ,iBAAiB;KACjC,MAAM,SAAS;KACf,eAAe,YAAY,WAAW,SAAS,IAAI,GAAG,WAAW,SAAS,MAAM,QAAQ,SAAS,KAAK;KACtG,CAC8B;IAAC;;EAEjC,oBAAoB;EACpB,CAAC;;;AAIH,MAAM,mBAAmB,SAA0B;CAClD,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,eAAe,iBAAiB,KAAK;CAG3C,MAAM,YAAY,mBAAmB;EAAE;EAAM,GAAG;EAAM,CAAC;CACvD,MAAM,WAAyB;EAC9B;EACA,UAAU,UAAU;EACpB,cAAc,UAAU;EACxB,eAAe,CAAC;GAAE,UAAU,UAAU;GAAU,QAAQ;GAAG,CAAC;EAC5D,MAAM;EACN;CACD,MAAM,OAAO,sBAAsB,EAAE,MAAM,CAAC;CAC5C,MAAM,UAAU,oBAAoB,SAAS;AAE7C,QAAO,aAAa;EACnB,IAAI,aAAa;EACjB,MAAM;EACN,SAAS;EACT,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,OAAiB;IAAE,MAAM;IAAQ;IAAM,UAAU;IAAW;AAGlE,UAAO;IACN,IAAG,OAFqB,gBAAgB,OADhB,0BAC2B,KAAK,EAE5C;IACZ,MAAM;IACN,SAAS;IACT;IACA;EACH,cAAc,CAAC,MAAM,QAAQ;EAC7B,oBAAoB;EACpB,CAAC;;;;;;;;;;;;;;AAeH,MAAM,wBAAwB,SAA+B;CAC5D,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,eAAe,iBAAiB,KAAK;CAC3C,MAAM,OAAO,sBAAsB,EAAE,MAAM,CAAC;CAM5C,MAAM,YAAY,wBAAwB;EAAE;EAAM,GAAG;EAAM,CAAC;AAE5D,QAAO,aAAa;EACnB,IAAI,aAAa;EACjB,MAAM;EACN,SAAS;EACT,aACC,OAAO,IAAI,aAAa;GAKvB,MAAM,OAAiB;IACtB,MAAM;IACN;IACA,UAAU,KAAK;IACf,UAAU;IACV;AAGD,UAAO;IACN,IAAG,OAFqB,gBAAgB,OADhB,0BAC2B,KAAK,EAE5C;IACZ,MAAM;IACN,SAAS;IACT;IACA;EACH,eAAe,EAAE,OAAO,iBAAiB;AAQxC,UAAO,CAAC,MAAM,oBAAoB;IANjC;IACA,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,eAAe,WAAW;IAC1B,MAAM;IAEmC,CAAC,CAAC;;EAE7C,oBAAoB;EACpB,CAAC;;;;AASH,MAAa,QACZ,SACI;AACJ,SAAQ,KAAK,MAAb;EACC,KAAK,eACJ,QAAO,uBAAuB,KAAK;EACpC,KAAK,OACJ,QAAO,gBAAgB,KAAK;EAC7B,KAAK,aACJ,QAAO,qBAAqB,KAAK;;;;;;;;;;;;;;;;;;AAmBpC,MAAa,UAAU,oBAAoB;CAC1C,OAAO,EACN,cAAqD,SACpD,uBAAuB,KAAK,EAC7B;CACD,MAAM;EACL,UAAU,OAAyC,EAAE,KACpD,gBAAgB;GAAE,SAAS;GAAW,GAAG;GAAM,CAAC;EACjD,UAAU,OAAyC,EAAE,KACpD,gBAAgB;GAAE,SAAS;GAAW,GAAG;GAAM,CAAC;EACjD,SACC,SACI,gBAAgB,KAAK;EAC1B;CACD,MAAM,EACL,YAAY,SAA+B,qBAAqB,KAAK,EACrE;CACD,CAAC"}

package/dist/plugins/seal/key-manager.d.mts

@@ -1,6 +1,3 @@
-import { SealError } from "./errors.mjs";
-import { Effect } from "effect";
-
 //#region src/plugins/seal/key-manager.d.ts
 /** Local-only admin handle. Produced by the `localKeygen` mode ONLY
  *  (distilled-doc invariant #15 — known-deployment modes do NOT
@@ -8,14 +5,9 @@ import { Effect } from "effect";
  *
  *  Fields:
  *   - `masterKeyEnvFile` — absolute path to the 0o600 env-file
- *     (snapshot-survived).
- *   - `rotate` — re-derive the BLS keypair, register a fresh
- *     on-chain `KeyServer`, restart the container. NOT a hot-swap
- *     (callers that captured the read-side tag before rotate hold
- *     pre-rotation values until a hot-restart). */
+ *     (snapshot-survived). */
 interface SealKeyManager {
   readonly masterKeyEnvFile: string;
-  readonly rotate: Effect.Effect<void, SealError>;
 }
 //#endregion
 export { SealKeyManager };

package/dist/plugins/seal/key-manager.mjs

@@ -1,22 +1,6 @@
-import { sealError } from "./errors.mjs";
-import { Effect } from "effect";
 //#region src/plugins/seal/key-manager.ts
-const makeKeyManager = (inputs) => ({
-	masterKeyEnvFile: inputs.masterKeyEnvFile,
-	rotate: inputs.rotateImpl
-});
-/** The full rotate pipeline (regenerate keypair → register new
-*  on-chain `KeyServer` object → re-render config + env-file →
-*  restart container → re-probe `/health` → atomically update the
-*  state-store cache) is not implemented in this branch. The
-*  rotateImpl placeholder fails-closed with a typed `rotate`-phase
-*  error so callers see an actionable failure rather than silently
-*  succeeding. */
-const stubRotate = (name) => Effect.fail(sealError("rotate", {
-	name,
-	message: "seal.key-manager: rotate is not implemented in this branch"
-}));
+const makeKeyManager = (inputs) => ({ masterKeyEnvFile: inputs.masterKeyEnvFile });
 //#endregion
-export { makeKeyManager, stubRotate };
+export { makeKeyManager };
 
 //# sourceMappingURL=key-manager.mjs.map

package/dist/plugins/seal/key-manager.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.mjs","names":[],"sources":["../../../src/plugins/seal/key-manager.ts"],"sourcesContent":["// Seal plugin — master-key staging + rotate.\n//\n// Distilled-doc invariant #23: the `R` channel on\n// `SealKeyManager.rotate` MUST be `never`. The acquire body\n// captures the substrate services (ChildProcessSpawner, Identity,\n// ContainerRuntime) at acquire-time and pre-provides them via\n// `Effect.provideService` so the surfaced `rotate` is\n// `Effect<void, SealError>`.\n//\n// This file declares the user-facing `SealKeyManager` shape; the\n// rotate body is supplied by the caller (mode/local-keygen.ts) as\n// a pre-provided closure.\n\nimport { Effect } from 'effect';\n\nimport { sealError, type SealError } from './errors.ts';\n\n// ---------------------------------------------------------------------------\n// User-facing shape — distilled doc §\"SealKeyManager interface\"\n// ---------------------------------------------------------------------------\n\n/** Local-only admin handle. Produced by the `localKeygen` mode ONLY\n *  (distilled-doc invariant #15 — known-deployment modes do NOT\n *  produce a manager, since we don't own the master key).\n *\n *  Fields:\n *   - `masterKeyEnvFile` — absolute path to the 0o600 env-file\n *     (snapshot-survived).\n *   - `rotate` — re-derive the BLS keypair, register a fresh\n *     on-chain `KeyServer`, restart the container. NOT a hot-swap\n *     (callers that captured the read-side tag before rotate hold\n *     pre-rotation values until a hot-restart). */\nexport interface SealKeyManager {\n\treadonly masterKeyEnvFile: string;\n\treadonly rotate: Effect.Effect<void, SealError>;\n}\n\n// ---------------------------------------------------------------------------\n// makeKeyManager — pre-provides the substrate services\n// ---------------------------------------------------------------------------\n\n/** Inputs the manager closes over. The caller (mode/local-keygen.ts)\n *  has already captured the substrate services AND the per-instance\n *  context (name, signer, image, etc.); this helper just assembles\n *  the consumer-facing shape with `rotate` bound. */\nexport interface MakeKeyManagerInputs {\n\treadonly name: string;\n\treadonly masterKeyEnvFile: string;\n\t/** The rotate body, with services already provided. Distilled-doc\n\t *  invariant #23 — `R = never` on the consumer-facing surface. */\n\treadonly rotateImpl: Effect.Effect<void, SealError>;\n}\n\nexport const makeKeyManager = (inputs: MakeKeyManagerInputs): SealKeyManager => ({\n\tmasterKeyEnvFile: inputs.masterKeyEnvFile,\n\trotate: inputs.rotateImpl,\n});\n\n// ---------------------------------------------------------------------------\n// Rotate body — not implemented in this branch\n// ---------------------------------------------------------------------------\n\n/** The full rotate pipeline (regenerate keypair → register new\n *  on-chain `KeyServer` object → re-render config + env-file →\n *  restart container → re-probe `/health` → atomically update the\n *  state-store cache) is not implemented in this branch. The\n *  rotateImpl placeholder fails-closed with a typed `rotate`-phase\n *  error so callers see an actionable failure rather than silently\n *  succeeding. */\nexport const stubRotate = (name: string): Effect.Effect<void, SealError> =>\n\tEffect.fail(\n\t\tsealError('rotate', {\n\t\t\tname,\n\t\t\tmessage: 'seal.key-manager: rotate is not implemented in this branch',\n\t\t}),\n\t);\n"],"mappings":";;;AAqDA,MAAa,kBAAkB,YAAkD;CAChF,kBAAkB,OAAO;CACzB,QAAQ,OAAO;CACf;;;;;;;;AAaD,MAAa,cAAc,SAC1B,OAAO,KACN,UAAU,UAAU;CACnB;CACA,SAAS;CACT,CAAC,CACF"}
+{"version":3,"file":"key-manager.mjs","names":[],"sources":["../../../src/plugins/seal/key-manager.ts"],"sourcesContent":["// Seal plugin — master-key staging.\n\n// ---------------------------------------------------------------------------\n// User-facing shape — distilled doc §\"SealKeyManager interface\"\n// ---------------------------------------------------------------------------\n\n/** Local-only admin handle. Produced by the `localKeygen` mode ONLY\n *  (distilled-doc invariant #15 — known-deployment modes do NOT\n *  produce a manager, since we don't own the master key).\n *\n *  Fields:\n *   - `masterKeyEnvFile` — absolute path to the 0o600 env-file\n *     (snapshot-survived). */\nexport interface SealKeyManager {\n\treadonly masterKeyEnvFile: string;\n}\n\n// ---------------------------------------------------------------------------\n// makeKeyManager — pre-provides the substrate services\n// ---------------------------------------------------------------------------\n\n/** Inputs the manager closes over. The caller (mode/local-keygen.ts)\n *  has already captured the substrate services AND the per-instance\n *  context (name, signer, image, etc.); this helper just assembles\n *  the consumer-facing shape. */\nexport interface MakeKeyManagerInputs {\n\treadonly masterKeyEnvFile: string;\n}\n\nexport const makeKeyManager = (inputs: MakeKeyManagerInputs): SealKeyManager => ({\n\tmasterKeyEnvFile: inputs.masterKeyEnvFile,\n});\n"],"mappings":";AA6BA,MAAa,kBAAkB,YAAkD,EAChF,kBAAkB,OAAO,kBACzB"}