@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/plugins/sui/move-summary-runner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"move-summary-runner.mjs","names":[],"sources":["../../../src/plugins/sui/move-summary-runner.ts"],"sourcesContent":["// Sui plugin — Move-summary runner Layer factories.\n//\n// The codegen orchestrator (L3) consumes an abstract\n// `MoveSummaryRunnerService`; it does NOT know which CLI image or\n// host binary produces the summary JSON. Both production\n// implementations live here because they encode Sui-specific\n// knowledge (the `sui` binary name, the Sui CLI image, the\n// `sui move summary` argv shape).\n//\n// Architecture: per \"Orchestrator boundaries — never names a\n// service\", the codegen orchestrator imports only the abstract\n// `MoveSummaryRunnerService` from its `bindings.ts`; the runtime\n// composer wires one of these sui-plugin layers in.\n//\n// Implementations:\n//   - `layerSuiMoveSummaryRunnerDocker` — runs `sui move summary`\n//     inside the Sui CLI container image; the default production\n//     wiring (`runtime-composition.ts`).\n//   - `layerSuiMoveSummaryRunnerHost` — runs the local `sui`\n//     binary directly via `ChildProcessSpawner`. Useful for\n//     embedders that already have a Sui CLI on PATH.\n\nimport { cp, mkdir, mkdtemp, rm } from 'node:fs/promises';\nimport { homedir, tmpdir } from 'node:os';\nimport { basename, dirname, join } from 'node:path';\n\nimport { Effect, Layer } from 'effect';\nimport { ChildProcess, ChildProcessSpawner } from 'effect/unstable/process';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\ttype MoveSummary,\n\ttype MoveSummaryInput,\n\tMoveSummaryRunnerService,\n} from '../../orchestrators/codegen/bindings.ts';\nimport { CodegenBindingsFailed } from '../../orchestrators/codegen/errors.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport { capture } from '../../substrate/runtime/observability/subprocess-capture.ts';\nimport {\n\tcopyLocalMoveDeps,\n\tshellQuote,\n\tsuiCliImageBuildContext,\n} from '../../substrate/runtime/sui-move-build/index.ts';\n\n// -----------------------------------------------------------------------------\n// Docker variant — `sui move summary` inside the Sui CLI container image.\n// -----------------------------------------------------------------------------\n\nexport const layerSuiMoveSummaryRunnerDocker: Layer.Layer<\n\tMoveSummaryRunnerService,\n\tnever,\n\tContainerRuntimeService\n> = Layer.effect(\n\tMoveSummaryRunnerService,\n\tEffect.gen(function* () {\n\t\tconst runtime: ContainerRuntime = yield* ContainerRuntimeService;\n\t\treturn MoveSummaryRunnerService.of({\n\t\t\trunSummary: (input) => runSummaryViaDocker(runtime, input),\n\t\t});\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Host-binary variant — invoke a `sui` CLI on PATH directly.\n// -----------------------------------------------------------------------------\n\nexport const layerSuiMoveSummaryRunnerHost: Layer.Layer<\n\tMoveSummaryRunnerService,\n\tnever,\n\tChildProcessSpawner.ChildProcessSpawner\n> = Layer.effect(\n\tMoveSummaryRunnerService,\n\tEffect.gen(function* () {\n\t\tconst spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n\t\treturn MoveSummaryRunnerService.of({\n\t\t\trunSummary: ({ packageName, sourcePath }) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst scratchDir = yield* Effect.tryPromise({\n\t\t\t\t\t\ttry: () => mkdtemp(join(tmpdir(), 'devstack-move-summary-')),\n\t\t\t\t\t\tcatch: (cause) =>\n\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\thint: 'Unable to create a temporary directory for Move summary output.',\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t});\n\t\t\t\t\tconst summaryPath = join(scratchDir, 'package');\n\t\t\t\t\t// Run summary inside a disposable copy of the package, never the\n\t\t\t\t\t// developer's real source — `sui move summary` rewrites Move.lock.\n\t\t\t\t\tconst stagedPkg = join(scratchDir, 'src');\n\t\t\t\t\tconst cleanupScratch = Effect.promise(() =>\n\t\t\t\t\t\trm(scratchDir, { recursive: true, force: true }),\n\t\t\t\t\t).pipe(Effect.ignore);\n\t\t\t\t\tconst result = yield* Effect.gen(function* () {\n\t\t\t\t\t\tyield* Effect.tryPromise({\n\t\t\t\t\t\t\ttry: async () => {\n\t\t\t\t\t\t\t\tawait mkdir(summaryPath, { recursive: true });\n\t\t\t\t\t\t\t\tawait cp(sourcePath, stagedPkg, { recursive: true });\n\t\t\t\t\t\t\t\t// Stage local relative deps so `sui move summary` resolves them.\n\t\t\t\t\t\t\t\tawait copyLocalMoveDeps(sourcePath, stagedPkg, dirname(stagedPkg));\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tcatch: (cause) =>\n\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\thint: 'Unable to stage a disposable copy of the Move package for summary.',\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tconst cmd = ChildProcess.make(\n\t\t\t\t\t\t\t'sui',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'move',\n\t\t\t\t\t\t\t\t'summary',\n\t\t\t\t\t\t\t\t'--path',\n\t\t\t\t\t\t\t\t'.',\n\t\t\t\t\t\t\t\t'--install-dir',\n\t\t\t\t\t\t\t\tjoin(scratchDir, 'install'),\n\t\t\t\t\t\t\t\t'--output-directory',\n\t\t\t\t\t\t\t\tjoin(summaryPath, 'package_summaries'),\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t{ cwd: stagedPkg },\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* capture(spawner, cmd, {\n\t\t\t\t\t\t\top: `sui move summary (${sourcePath})`,\n\t\t\t\t\t\t\tnonZeroIsFailure: true,\n\t\t\t\t\t\t\tstdoutTruncate: Infinity,\n\t\t\t\t\t\t\tstderrTruncate: 4_000,\n\t\t\t\t\t\t}).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\t\thint: 'Install the Sui CLI and ensure this Move package can run `sui move summary`.',\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}).pipe(Effect.tapError(() => cleanupScratch));\n\t\t\t\t\treturn {\n\t\t\t\t\t\tpackageName,\n\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\tsummaryPath,\n\t\t\t\t\t\tcleanupPath: scratchDir,\n\t\t\t\t\t\tsummaryJson: parseSummaryStdout(result.stdout),\n\t\t\t\t\t};\n\t\t\t\t}),\n\t\t});\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Docker-variant helpers — shared with `runSummaryViaDocker`.\n// -----------------------------------------------------------------------------\n\nconst runSummaryViaDocker = (\n\truntime: ContainerRuntime,\n\tinput: MoveSummaryInput,\n): Effect.Effect<MoveSummary, CodegenBindingsFailed> =>\n\tEffect.scoped(\n\t\tEffect.gen(function* () {\n\t\t\tconst scratchDir = yield* makeSummaryScratch(input);\n\t\t\tconst summaryPath = join(scratchDir, 'package');\n\t\t\tconst cleanupScratch = Effect.promise(() =>\n\t\t\t\trm(scratchDir, { recursive: true, force: true }),\n\t\t\t).pipe(Effect.ignore);\n\t\t\tconst result = yield* Effect.gen(function* () {\n\t\t\t\tyield* prepareSummaryPackage(summaryPath, input);\n\t\t\t\tconst image = input.buildImage ?? (yield* resolveDefaultSummaryImage(runtime, input));\n\t\t\t\tconst moveHome = join(homedir(), '.move');\n\t\t\t\tyield* ensureMoveHome(moveHome, input);\n\t\t\t\tconst packageDir = basename(input.sourcePath);\n\t\t\t\t// Mount a disposable staged copy at /workspace, never the real source\n\t\t\t\t// tree — `sui move summary` rewrites Move.lock during resolution.\n\t\t\t\tconst stagedRoot = join(scratchDir, 'src');\n\t\t\t\tyield* stageSummarySource(input, join(stagedRoot, packageDir));\n\t\t\t\tconst hostUid = typeof process.getuid === 'function' ? process.getuid() : 0;\n\t\t\t\tconst hostGid = typeof process.getgid === 'function' ? process.getgid() : 0;\n\t\t\t\tconst command = [\n\t\t\t\t\t'set -e',\n\t\t\t\t\t'cleanup_summary() { status=$?; ' +\n\t\t\t\t\t\t'chmod -R a+rwX /summary /workspace 2>/dev/null || true; ' +\n\t\t\t\t\t\t`chown -R ${hostUid}:${hostGid} /summary /workspace 2>/dev/null || true; ` +\n\t\t\t\t\t\t'exit \"$status\"; }',\n\t\t\t\t\t'trap cleanup_summary EXIT',\n\t\t\t\t\t'mkdir -p /summary/package_summaries',\n\t\t\t\t\t`sui move summary --path /workspace/${shellQuote(packageDir)} ` +\n\t\t\t\t\t\t'--install-dir /tmp/devstack-move-summary-install ' +\n\t\t\t\t\t\t'--output-directory /summary/package_summaries',\n\t\t\t\t].join('; ');\n\t\t\t\tconst run = yield* runtime\n\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\timage,\n\t\t\t\t\t\tentrypoint: 'sh',\n\t\t\t\t\t\targv: ['-c', command],\n\t\t\t\t\t\tmounts: [\n\t\t\t\t\t\t\t{ source: stagedRoot, target: '/workspace' },\n\t\t\t\t\t\t\t{ source: summaryPath, target: '/summary' },\n\t\t\t\t\t\t\t{ source: moveHome, target: '/root/.move' },\n\t\t\t\t\t\t],\n\t\t\t\t\t\ttimeoutMillis: 5 * 60_000,\n\t\t\t\t\t})\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\thint: 'Docker runtime failed while running `sui move summary` for bindings codegen.',\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\tif (run.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t`sui move summary exited ${run.exitCode}. ` +\n\t\t\t\t\t\t\t\t`stderr: ${run.stderr || '(empty)'}; stdout tail: ${\n\t\t\t\t\t\t\t\t\trun.stdout.slice(-400) || '(empty)'\n\t\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn run;\n\t\t\t}).pipe(Effect.tapError(() => cleanupScratch));\n\t\t\treturn {\n\t\t\t\tpackageName: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\tsummaryPath,\n\t\t\t\tcleanupPath: scratchDir,\n\t\t\t\tsummaryJson: parseSummaryStdout(result.stdout),\n\t\t\t};\n\t\t}),\n\t);\n\nconst makeSummaryScratch = (\n\tinput: MoveSummaryInput,\n): Effect.Effect<string, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdtemp(join(tmpdir(), 'devstack-move-summary-')),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to create a temporary directory for Move summary output.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst prepareSummaryPackage = (\n\tsummaryPath: string,\n\tinput: MoveSummaryInput,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\t// Only create the OUTPUT mount dir; the package itself is mounted from a\n\t\t// disposable staged copy (see `stageSummarySource`), never the real source.\n\t\ttry: () => mkdir(summaryPath, { recursive: true }).then(() => undefined),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to prepare a temporary Move summary output directory.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n// Stage a disposable copy of the Move package. `sui move summary` rewrites\n// `Move.lock` during dependency resolution, so running it against the\n// developer's real checked-in tree would dirty their working copy. The copy\n// lives under the scoped scratch dir and is reaped with it.\nconst stageSummarySource = (\n\tinput: MoveSummaryInput,\n\tstagedPkg: string,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tawait mkdir(dirname(stagedPkg), { recursive: true });\n\t\t\tawait cp(input.sourcePath, stagedPkg, { recursive: true });\n\t\t\t// Bring local `../` deps (`{ local = \"../token\" }`) into the staged\n\t\t\t// tree so `sui move summary` resolves them (mirrors the build path).\n\t\t\tawait copyLocalMoveDeps(input.sourcePath, stagedPkg, dirname(stagedPkg));\n\t\t},\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to stage a disposable copy of the Move package for summary.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst resolveDefaultSummaryImage = (\n\truntime: ContainerRuntime,\n\tinput: MoveSummaryInput,\n): Effect.Effect<ImageRef, CodegenBindingsFailed> =>\n\t// Shared CLI image — owned at the daemon-level _per-app_ pin (see\n\t// `chain-build-container.ts:PER_APP_SHARED_STACK`), not per-stack;\n\t// the build container that materialises it carries the labels, so\n\t// `ensureImage` itself is intentionally label-free here.\n\truntime.ensureImage(suiCliImageBuildContext()).pipe(\n\t\tEffect.mapError(\n\t\t\t(cause) =>\n\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\thint: 'Unable to resolve the Sui CLI container image for Move bindings codegen.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t),\n\t);\n\nconst ensureMoveHome = (\n\tmoveHome: string,\n\tinput: MoveSummaryInput,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdir(moveHome, { recursive: true }),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: `Unable to create Move cache mount source \"${moveHome}\".`,\n\t\t\t\tcause,\n\t\t\t}),\n\t}).pipe(Effect.asVoid);\n\nconst parseSummaryStdout = (stdout: string): unknown => {\n\tconst trimmed = stdout.trim();\n\tif (trimmed.length === 0) return null;\n\ttry {\n\t\treturn JSON.parse(trimmed) as unknown;\n\t} catch {\n\t\treturn trimmed;\n\t}\n};\n"],"mappings":";;;;;;;;;;;AAgDA,MAAa,kCAIT,MAAM,OACT,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAA4B,OAAO;AACzC,QAAO,yBAAyB,GAAG,EAClC,aAAa,UAAU,oBAAoB,SAAS,MAAM,EAC1D,CAAC;EACD,CACF;AAUG,MAAM,OACT,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,oBAAoB;AAC3C,QAAO,yBAAyB,GAAG,EAClC,aAAa,EAAE,aAAa,iBAC3B,OAAO,IAAI,aAAa;EACvB,MAAM,aAAa,OAAO,OAAO,WAAW;GAC3C,WAAW,QAAQ,KAAK,QAAQ,EAAE,yBAAyB,CAAC;GAC5D,QAAQ,UACP,IAAI,sBAAsB;IACzB,SAAS;IACT;IACA,QAAQ;IACR,MAAM;IACN;IACA,CAAC;GACH,CAAC;EACF,MAAM,cAAc,KAAK,YAAY,UAAU;EAG/C,MAAM,YAAY,KAAK,YAAY,MAAM;EACzC,MAAM,iBAAiB,OAAO,cAC7B,GAAG,YAAY;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC,CAChD,CAAC,KAAK,OAAO,OAAO;AAkDrB,SAAO;GACN;GACA;GACA;GACA,aAAa;GACb,aAAa,oBAAmB,OAtDX,OAAO,IAAI,aAAa;AAC7C,WAAO,OAAO,WAAW;KACxB,KAAK,YAAY;AAChB,YAAM,MAAM,aAAa,EAAE,WAAW,MAAM,CAAC;AAC7C,YAAM,GAAG,YAAY,WAAW,EAAE,WAAW,MAAM,CAAC;AAEpD,YAAM,kBAAkB,YAAY,WAAW,QAAQ,UAAU,CAAC;;KAEnE,QAAQ,UACP,IAAI,sBAAsB;MACzB,SAAS;MACT;MACA,QAAQ;MACR,MAAM;MACN;MACA,CAAC;KACH,CAAC;AAeF,WAAO,OAAO,QAAQ,SAdV,aAAa,KACxB,OACA;KACC;KACA;KACA;KACA;KACA;KACA,KAAK,YAAY,UAAU;KAC3B;KACA,KAAK,aAAa,oBAAoB;KACtC,EACD,EAAE,KAAK,WAAW,CAEe,EAAE;KACnC,IAAI,qBAAqB,WAAW;KACpC,kBAAkB;KAClB,gBAAgB;KAChB,gBAAgB;KAChB,CAAC,CAAC,KACF,OAAO,UACL,UACA,IAAI,sBAAsB;KACzB,SAAS;KACT;KACA,QAAQ;KACR,MAAM;KACN;KACA,CAAC,CACH,CACD;KACA,CAAC,KAAK,OAAO,eAAe,eAAe,CAAC,EAMN,OAAO;GAC9C;GACA,EACH,CAAC;EACD,CACF;AAMD,MAAM,uBACL,SACA,UAEA,OAAO,OACN,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,mBAAmB,MAAM;CACnD,MAAM,cAAc,KAAK,YAAY,UAAU;CAC/C,MAAM,iBAAiB,OAAO,cAC7B,GAAG,YAAY;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC,CAChD,CAAC,KAAK,OAAO,OAAO;CACrB,MAAM,SAAS,OAAO,OAAO,IAAI,aAAa;AAC7C,SAAO,sBAAsB,aAAa,MAAM;EAChD,MAAM,QAAQ,MAAM,eAAe,OAAO,2BAA2B,SAAS,MAAM;EACpF,MAAM,WAAW,KAAK,SAAS,EAAE,QAAQ;AACzC,SAAO,eAAe,UAAU,MAAM;EACtC,MAAM,aAAa,SAAS,MAAM,WAAW;EAG7C,MAAM,aAAa,KAAK,YAAY,MAAM;AAC1C,SAAO,mBAAmB,OAAO,KAAK,YAAY,WAAW,CAAC;EAG9D,MAAM,UAAU;GACf;GACA,oGAJe,OAAO,QAAQ,WAAW,aAAa,QAAQ,QAAQ,GAAG,EAMpD,GALN,OAAO,QAAQ,WAAW,aAAa,QAAQ,QAAQ,GAAG,EAKzC;GAEhC;GACA;GACA,sCAAsC,WAAW,WAAW,CAAC;GAG7D,CAAC,KAAK,KAAK;EACZ,MAAM,MAAM,OAAO,QACjB,WAAW;GACX;GACA,YAAY;GACZ,MAAM,CAAC,MAAM,QAAQ;GACrB,QAAQ;IACP;KAAE,QAAQ;KAAY,QAAQ;KAAc;IAC5C;KAAE,QAAQ;KAAa,QAAQ;KAAY;IAC3C;KAAE,QAAQ;KAAU,QAAQ;KAAe;IAC3C;GACD,eAAe,IAAI;GACnB,CAAC,CACD,KACA,OAAO,UACL,UACA,IAAI,sBAAsB;GACzB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ;GACR,MAAM;GACN;GACA,CAAC,CACH,CACD;AACF,MAAI,IAAI,aAAa,EACpB,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;GACzB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ;GACR,MACC,2BAA2B,IAAI,SAAS,YAC7B,IAAI,UAAU,UAAU,iBAClC,IAAI,OAAO,MAAM,KAAK,IAAI;GAE5B,CAAC,CACF;AAEF,SAAO;GACN,CAAC,KAAK,OAAO,eAAe,eAAe,CAAC;AAC9C,QAAO;EACN,aAAa,MAAM;EACnB,YAAY,MAAM;EAClB;EACA,aAAa;EACb,aAAa,mBAAmB,OAAO,OAAO;EAC9C;EACA,CACF;AAEF,MAAM,sBACL,UAEA,OAAO,WAAW;CACjB,WAAW,QAAQ,KAAK,QAAQ,EAAE,yBAAyB,CAAC;CAC5D,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;EACA,CAAC;CACH,CAAC;AAEH,MAAM,yBACL,aACA,UAEA,OAAO,WAAW;CAGjB,WAAW,MAAM,aAAa,EAAE,WAAW,MAAM,CAAC,CAAC,WAAW,KAAA,EAAU;CACxE,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;EACA,CAAC;CACH,CAAC;AAMH,MAAM,sBACL,OACA,cAEA,OAAO,WAAW;CACjB,KAAK,YAAY;AAChB,QAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;AACpD,QAAM,GAAG,MAAM,YAAY,WAAW,EAAE,WAAW,MAAM,CAAC;AAG1D,QAAM,kBAAkB,MAAM,YAAY,WAAW,QAAQ,UAAU,CAAC;;CAEzE,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;EACA,CAAC;CACH,CAAC;AAEH,MAAM,8BACL,SACA,UAMA,QAAQ,YAAY,yBAAyB,CAAC,CAAC,KAC9C,OAAO,UACL,UACA,IAAI,sBAAsB;CACzB,SAAS,MAAM;CACf,YAAY,MAAM;CAClB,QAAQ;CACR,MAAM;CACN;CACA,CAAC,CACH,CACD;AAEF,MAAM,kBACL,UACA,UAEA,OAAO,WAAW;CACjB,WAAW,MAAM,UAAU,EAAE,WAAW,MAAM,CAAC;CAC/C,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM,6CAA6C,SAAS;EAC5D;EACA,CAAC;CACH,CAAC,CAAC,KAAK,OAAO,OAAO;AAEvB,MAAM,sBAAsB,WAA4B;CACvD,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,KAAI;AACH,SAAO,KAAK,MAAM,QAAQ;SACnB;AACP,SAAO"}

package/dist/plugins/sui/network-resolver.d.mts

@@ -1,14 +1,15 @@
 import { ChainId } from "../../substrate/brand.mjs";
 import { SuiPluginMode } from "./mode/spec.mjs";
+
 //#region src/plugins/sui/network-resolver.d.ts
 /** Plugin-internal shape — the resolved mode's identity, populated
- *  by the mode-specific builder. The resolver below projects this
- *  into the substrate's `NetworkConfig`. */
+ *  by the mode-specific builder. */
 interface ResolvedSuiNetwork {
   readonly mode: SuiPluginMode;
   /** Branded chain identity — assembled by the mode builders so
    *  downstream lookups (chain-probe / faucet capability keys) and
-   *  the `NetworkConfig` projection both accept it without a re-wrap. */
+   *  the substrate's `NetworkConfig` projection both accept it without
+   *  a re-wrap. */
   readonly chain: ChainId;
   readonly rpc: string;
   readonly faucet?: string;

package/dist/plugins/sui/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/sui/service.ts"],"sourcesContent":["// Sui plugin — service body.\n//\n// Architecture: the four modes are NOT four separate plugins. They\n// are one plugin with internal mode dispatch. The factory at the\n// barrel (`index.ts`) constructs a `SuiOptions` discriminator from\n// typed options; the `acquire` body below dispatches on `opts.mode`\n// and assembles the mode-appropriate subsystems.\n//\n// What this file does:\n//\n//   1. Receive resolved `SuiOptions`.\n//   2. Dispatch to the right `bootXxxMode` builder.\n//   3. Assemble the mode-aware `SuiClient` (the resolved value).\n//\n// What it does NOT do:\n//\n//   - Provision the build container — `chain-build-container.ts`\n//     owns that; the plugin acquires it ONLY when needed (Move\n//     publish or codegen) via the ArtifactPublisher seam.\n//   - Wire the StrategyContributor capabilities — that's the\n//     barrel's job; the body just returns the resolved value.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type { SeedManifestMismatchError, SuiPluginError } from './errors.ts';\nimport type { ResolvedSuiNetwork } from './network-resolver.ts';\nimport type { SuiClient } from './mode/shared.ts';\nimport type { SuiOptions } from './mode/spec.ts';\nimport { bootLocalRpcMode } from './mode/external.ts';\nimport { bootForkMode } from './mode/fork.ts';\nimport { bootLiveMode } from './mode/live.ts';\nimport { bootLocalMode } from './mode/local.ts';\nimport type { ContainerRuntime } from '../../contracts/container-runtime.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport type { StackPaths } from '../../substrate/runtime/paths.ts';\nimport type { PortBroker } from '../../substrate/runtime/port-broker/index.ts';\n\n/** Bundled result of one acquire — resolved metadata + the user-facing\n *  client. The barrel projects this into the Sui resource value; the\n *  resolved metadata feeds the Codegenable + NetworkResolver contributions. */\nexport interface SuiBootResult {\n\treadonly resolved: ResolvedSuiNetwork;\n\treadonly client: SuiClient;\n}\n\n/** Dispatch on the typed mode and return the mode's boot artifacts.\n *\n *  The `ContainerRuntime` is consumed by container-bearing modes\n *  only (local + fork); external + live get `null` and a typed\n *  refusal would surface if they tried to use it.\n *\n *  Stub: the per-mode builders are all stubs; the orchestrator\n *  here is the only fully-wired piece. */\nexport const bootSuiService = (\n\truntime: ContainerRuntime,\n\tidentity: Identity,\n\tportBroker: PortBroker,\n\tpaths: StackPaths,\n\topts: SuiOptions,\n): Effect.Effect<SuiBootResult, SuiPluginError | SeedManifestMismatchError, Scope.Scope> => {\n\tswitch (opts.mode) {\n\t\tcase 'local':\n\t\t\treturn bootLocalMode(runtime, identity, portBroker, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'local-rpc':\n\t\t\treturn bootLocalRpcMode(opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'live':\n\t\t\treturn bootLiveMode(opts).pipe(Effect.map(({ resolved, client }) => ({ resolved, client })));\n\t\tcase 'fork':\n\t\t\treturn bootForkMode(runtime, identity, portBroker, paths, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAqDA,MAAa,kBACZ,SACA,UACA,YACA,OACA,SAC2F;AAC3F,SAAQ,KAAK,MAAb;EACC,KAAK,QACJ,QAAO,cAAc,SAAS,UAAU,YAAY,KAAK,CAAC,KACzD,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,YACJ,QAAO,iBAAiB,KAAK,CAAC,KAC7B,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,OACJ,QAAO,aAAa,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAAC;EAC7F,KAAK,OACJ,QAAO,aAAa,SAAS,UAAU,YAAY,OAAO,KAAK,CAAC,KAC/D,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D"}
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/sui/service.ts"],"sourcesContent":["// Sui plugin — service body.\n//\n// Architecture: the four modes are NOT four separate plugins. They\n// are one plugin with internal mode dispatch. The factory at the\n// barrel (`index.ts`) constructs a `SuiOptions` discriminator from\n// typed options; the `acquire` body below dispatches on `opts.mode`\n// and assembles the mode-appropriate subsystems.\n//\n// What this file does:\n//\n//   1. Receive resolved `SuiOptions`.\n//   2. Dispatch to the right `bootXxxMode` builder.\n//   3. Assemble the mode-aware `SuiClient` (the resolved value).\n//\n// What it does NOT do:\n//\n//   - Provision the build container — `chain-build-container.ts`\n//     owns that; the plugin acquires it ONLY when needed (Move\n//     publish or codegen) via the ArtifactPublisher seam.\n//   - Wire the StrategyContributor capabilities — that's the\n//     barrel's job; the body just returns the resolved value.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type { SuiConfigError, SuiPluginError } from './errors.ts';\nimport type { ResolvedSuiNetwork } from './network-resolver.ts';\nimport type { SuiClient } from './mode/shared.ts';\nimport type { SuiOptions } from './mode/spec.ts';\nimport { bootLocalRpcMode } from './mode/external.ts';\nimport { bootForkMode } from './mode/fork.ts';\nimport { bootLiveMode } from './mode/live.ts';\nimport { bootLocalMode } from './mode/local.ts';\nimport type { ContainerRuntime } from '../../contracts/container-runtime.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport type { StackPaths } from '../../substrate/runtime/paths.ts';\nimport type { PortBroker } from '../../substrate/runtime/port-broker/index.ts';\n\n/** Bundled result of one acquire — resolved metadata + the user-facing\n *  client. The barrel projects this into the Sui resource value; the\n *  resolved metadata feeds the Codegenable contribution. */\nexport interface SuiBootResult {\n\treadonly resolved: ResolvedSuiNetwork;\n\treadonly client: SuiClient;\n}\n\n/** Dispatch on the typed mode and return the mode's boot artifacts.\n *\n *  The `ContainerRuntime` is consumed by container-bearing modes\n *  only (local + fork); external + live get `null` and a typed\n *  refusal would surface if they tried to use it.\n *\n *  Stub: the per-mode builders are all stubs; the orchestrator\n *  here is the only fully-wired piece. */\nexport const bootSuiService = (\n\truntime: ContainerRuntime,\n\tidentity: Identity,\n\tportBroker: PortBroker,\n\tpaths: StackPaths,\n\topts: SuiOptions,\n): Effect.Effect<\n\tSuiBootResult,\n\tSuiPluginError | SuiConfigError,\n\tScope.Scope\n> => {\n\tswitch (opts.mode) {\n\t\tcase 'local':\n\t\t\treturn bootLocalMode(runtime, identity, portBroker, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'local-rpc':\n\t\t\treturn bootLocalRpcMode(opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'live':\n\t\t\treturn bootLiveMode(opts).pipe(Effect.map(({ resolved, client }) => ({ resolved, client })));\n\t\tcase 'fork':\n\t\t\treturn bootForkMode(runtime, identity, portBroker, paths, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAqDA,MAAa,kBACZ,SACA,UACA,YACA,OACA,SAKI;AACJ,SAAQ,KAAK,MAAb;EACC,KAAK,QACJ,QAAO,cAAc,SAAS,UAAU,YAAY,KAAK,CAAC,KACzD,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,YACJ,QAAO,iBAAiB,KAAK,CAAC,KAC7B,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,OACJ,QAAO,aAAa,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAAC;EAC7F,KAAK,OACJ,QAAO,aAAa,SAAS,UAAU,YAAY,OAAO,KAAK,CAAC,KAC/D,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D"}

package/dist/plugins/sui/snapshot.mjs

@@ -21,6 +21,7 @@ const makeSnapshotable = (mode, app, stack, chain) => {
 			missingTolerance: "fine",
 			preRestore: Effect.succeed({
 				kind: "sui-chain",
+				mode: "local",
 				chain
 			}),
 			postRestore: Effect.void
@@ -32,6 +33,7 @@ const makeSnapshotable = (mode, app, stack, chain) => {
 			missingTolerance: "fine",
 			preRestore: Effect.succeed({
 				kind: "sui-chain",
+				mode,
 				chain
 			})
 		};
@@ -42,6 +44,7 @@ const makeSnapshotable = (mode, app, stack, chain) => {
 			missingTolerance: "fine",
 			preRestore: Effect.succeed({
 				kind: "sui-chain",
+				mode: "fork",
 				chain
 			})
 		};

package/dist/plugins/sui/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/sui/snapshot.ts"],"sourcesContent":["// Sui plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Sui's contribution is mode-aware:\n//\n//   - local mode  — chain state (localnet validator) MUST live in\n//                   the writable container layer (NOT a named\n//                   volume), so `docker commit` captures it. Same\n//                   for the postgres indexer (PGDATA relocated off\n//                   the inherited VOLUME path).\n//\n//   - external    — no container, no snapshot. The `SnapshotableDecl`\n//                   has `missingTolerance: 'fine'` so restore against\n//                   a snapshot taken in local mode is a clean no-op.\n//\n//   - live        — same as external; no snapshot.\n//\n//   - fork        — data dir is a bind-mount; snapshot capture is\n//                   handled separately by the snapshot orchestrator.\n//                   This file emits the bind-mount subtree as the\n//                   capture descriptor.\n//\n// Chain identity (chainId + per-mode cluster id) is the canonical\n// identity-guard contribution from this plugin. The substrate's\n// pre-restore hook reads it; identity mismatch refuses the restore.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\nimport type { SuiPluginMode } from './mode/spec.ts';\n\n/** Build the Snapshotable contribution for a resolved mode + chain id.\n *\n *  Identity guard data lives in `preRestore`: the substrate compares\n *  the snapshot's stored chain identity against the resolver's\n *  current answer; a mismatch refuses BEFORE any destructive\n *  mutation. */\nexport const makeSnapshotable = (\n\tmode: SuiPluginMode,\n\tapp: string,\n\tstack: string,\n\tchain: string,\n): SnapshotableDecl => {\n\tconst labels = (role: string): ContainerLabelTuple => ({\n\t\tapp,\n\t\tstack,\n\t\tplugin: 'sui',\n\t\trole,\n\t});\n\n\tswitch (mode) {\n\t\tcase 'local': {\n\t\t\t// Validator's writable layer + postgres indexer's writable\n\t\t\t// layer. The runtime adapter pauses both before commit;\n\t\t\t// architecture default grace is \"pause container\".\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\t// Chain state lives in the writable container layer\n\t\t\t\t// — declared via `managedContainers`, not subtrees.\n\t\t\t\tsubtrees: [],\n\t\t\t\tmanagedContainers: [labels('validator'), labels('postgres')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain', chain }),\n\t\t\t\tpostRestore: Effect.void,\n\t\t\t};\n\t\t}\n\t\tcase 'local-rpc':\n\t\tcase 'live': {\n\t\t\t// No container, no capture. The decl still exists so the\n\t\t\t// identity guard fires on restore (e.g. restoring a local\n\t\t\t// snapshot while the resolver says \"live testnet\" — the\n\t\t\t// identity-guard refuses).\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: [],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain', chain }),\n\t\t\t};\n\t\t}\n\t\tcase 'fork': {\n\t\t\t// Data dir + meta are bind-mounted host paths; the\n\t\t\t// orchestrator walks the declared subtree. The fork\n\t\t\t// container itself is also captured (writable layer for\n\t\t\t// dep + cache state).\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: ['sui-fork/'],\n\t\t\t\tmanagedContainers: [labels('fork-validator')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain', chain }),\n\t\t\t};\n\t\t}\n\t}\n};\n"],"mappings":";;;;;;;;AAqCA,MAAa,oBACZ,MACA,KACA,OACA,UACsB;CACtB,MAAM,UAAU,UAAuC;EACtD;EACA;EACA,QAAQ;EACR;EACA;AAED,SAAQ,MAAR;EACC,KAAK,QAIJ,QAAO;GACN,MAAM;GAGN,UAAU,EAAE;GACZ,mBAAmB,CAAC,OAAO,YAAY,EAAE,OAAO,WAAW,CAAC;GAC5D,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAa;IAAO,CAAC;GACxD,aAAa,OAAO;GACpB;EAEF,KAAK;EACL,KAAK,OAKJ,QAAO;GACN,MAAM;GACN,UAAU,EAAE;GACZ,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAa;IAAO,CAAC;GACxD;EAEF,KAAK,OAKJ,QAAO;GACN,MAAM;GACN,UAAU,CAAC,YAAY;GACvB,mBAAmB,CAAC,OAAO,iBAAiB,CAAC;GAC7C,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAa;IAAO,CAAC;GACxD"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/sui/snapshot.ts"],"sourcesContent":["// Sui plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Sui's contribution is mode-aware:\n//\n//   - local mode  — chain state (localnet validator) MUST live in\n//                   the writable container layer (NOT a named\n//                   volume), so `docker commit` captures it. Same\n//                   for the postgres indexer (PGDATA relocated off\n//                   the inherited VOLUME path).\n//\n//   - external    — no container, no snapshot. The `SnapshotableDecl`\n//                   has `missingTolerance: 'fine'` so restore against\n//                   a snapshot taken in local mode is a clean no-op.\n//\n//   - live        — same as external; no snapshot.\n//\n//   - fork        — data dir is a bind-mount; snapshot capture is\n//                   handled separately by the snapshot orchestrator.\n//                   This file emits the bind-mount subtree as the\n//                   capture descriptor.\n//\n// Chain identity (chainId + per-mode cluster id) is the canonical\n// identity-guard contribution from this plugin. The substrate's\n// pre-restore hook reads it; identity mismatch refuses the restore.\n//\n// The `mode` discriminator is folded INTO the identity record (mirrors\n// walrus's `preRestore` carrying `mode`). It is load-bearing: container\n// `local` mode (committed chain-state artifacts in the writable layer)\n// and `local-rpc` mode (caller-owned external RPC, no container) can\n// resolve to the SAME chain id — e.g. a caller wrapping their own\n// localnet reporting `sui:localnet`, identical to the in-container\n// validator. Without the `mode` key the guard would compare only\n// `{kind, chain}` and let a container-`local` snapshot restore against a\n// `local-rpc` stack (and vice versa): restoring container chain-state\n// against an external RPC is a silent no-op masquerading as success.\n// With `mode` in the record the values differ on the `mode` key and the\n// guard refuses before any mutation.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\nimport type { SuiPluginMode } from './mode/spec.ts';\n\n/** Build the Snapshotable contribution for a resolved mode + chain id.\n *\n *  Identity guard data lives in `preRestore`: the substrate compares\n *  the snapshot's stored chain identity against the resolver's\n *  current answer; a mismatch refuses BEFORE any destructive\n *  mutation. */\nexport const makeSnapshotable = (\n\tmode: SuiPluginMode,\n\tapp: string,\n\tstack: string,\n\tchain: string,\n): SnapshotableDecl => {\n\tconst labels = (role: string): ContainerLabelTuple => ({\n\t\tapp,\n\t\tstack,\n\t\tplugin: 'sui',\n\t\trole,\n\t});\n\n\tswitch (mode) {\n\t\tcase 'local': {\n\t\t\t// Validator's writable layer + postgres indexer's writable\n\t\t\t// layer. The runtime adapter pauses both before commit;\n\t\t\t// architecture default grace is \"pause container\".\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\t// Chain state lives in the writable container layer\n\t\t\t\t// — declared via `managedContainers`, not subtrees.\n\t\t\t\tsubtrees: [],\n\t\t\t\tmanagedContainers: [labels('validator'), labels('postgres')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode: 'local' as const, chain }),\n\t\t\t\tpostRestore: Effect.void,\n\t\t\t};\n\t\t}\n\t\tcase 'local-rpc':\n\t\tcase 'live': {\n\t\t\t// No container, no capture. The decl still exists so the\n\t\t\t// identity guard fires on restore (e.g. restoring a local\n\t\t\t// snapshot while the resolver says \"live testnet\" — the\n\t\t\t// identity-guard refuses). `mode` flows from the narrowed\n\t\t\t// parameter (`'local-rpc' | 'live'` here), so a `local-rpc`\n\t\t\t// snapshot also refuses against a container-`local` stack at\n\t\t\t// an identical chain id.\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: [],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode, chain }),\n\t\t\t};\n\t\t}\n\t\tcase 'fork': {\n\t\t\t// Data dir + meta are bind-mounted host paths; the\n\t\t\t// orchestrator walks the declared subtree. The fork\n\t\t\t// container itself is also captured (writable layer for\n\t\t\t// dep + cache state).\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: ['sui-fork/'],\n\t\t\t\tmanagedContainers: [labels('fork-validator')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode: 'fork' as const, chain }),\n\t\t\t};\n\t\t}\n\t}\n};\n"],"mappings":";;;;;;;;AAkDA,MAAa,oBACZ,MACA,KACA,OACA,UACsB;CACtB,MAAM,UAAU,UAAuC;EACtD;EACA;EACA,QAAQ;EACR;EACA;AAED,SAAQ,MAAR;EACC,KAAK,QAIJ,QAAO;GACN,MAAM;GAGN,UAAU,EAAE;GACZ,mBAAmB,CAAC,OAAO,YAAY,EAAE,OAAO,WAAW,CAAC;GAC5D,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB,MAAM;IAAkB;IAAO,CAAC;GACzF,aAAa,OAAO;GACpB;EAEF,KAAK;EACL,KAAK,OAQJ,QAAO;GACN,MAAM;GACN,UAAU,EAAE;GACZ,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB;IAAM;IAAO,CAAC;GACvE;EAEF,KAAK,OAKJ,QAAO;GACN,MAAM;GACN,UAAU,CAAC,YAAY;GACvB,mBAAmB,CAAC,OAAO,iBAAiB,CAAC;GAC7C,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB,MAAM;IAAiB;IAAO,CAAC;GACxF"}

package/dist/plugins/sui/spans.mjs

@@ -0,0 +1,17 @@
+//#region src/plugins/sui/spans.ts
+const SuiSpans = {
+	autoTickIntervalMs: "sui.autoTick.intervalMs",
+	chain: "sui.chain",
+	container: "sui.container",
+	localFaucetLeaseKey: "faucet.lease.key",
+	localFaucetLeaseOwner: "faucet.lease.owner",
+	forkFaucetWhale: "sui.fork.faucet.whale",
+	liveFaucetUrl: "sui.live.faucetUrl",
+	liveNetwork: "sui.live.network",
+	liveRpcUrl: "sui.live.rpcUrl",
+	mode: "sui.mode"
+};
+//#endregion
+export { SuiSpans };
+
+//# sourceMappingURL=spans.mjs.map

package/dist/plugins/sui/spans.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/sui/spans.ts"],"sourcesContent":["// Sui plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [SuiSpans.mode]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const SuiSpans = {\n\tautoTickIntervalMs: 'sui.autoTick.intervalMs',\n\tchain: 'sui.chain',\n\tcontainer: 'sui.container',\n\t// Local-faucet lease-broker serialization keys. Owned here because\n\t// the sui plugin owns the local-faucet container + its lease shape;\n\t// the faucet plugin only sees the strategy dispatch.\n\tlocalFaucetLeaseKey: 'faucet.lease.key',\n\tlocalFaucetLeaseOwner: 'faucet.lease.owner',\n\t// Fork-faucet impersonation source (the \"whale\" address).\n\tforkFaucetWhale: 'sui.fork.faucet.whale',\n\tliveFaucetUrl: 'sui.live.faucetUrl',\n\tliveNetwork: 'sui.live.network',\n\tliveRpcUrl: 'sui.live.rpcUrl',\n\tmode: 'sui.mode',\n} as const;\n"],"mappings":";AAOA,MAAa,WAAW;CACvB,oBAAoB;CACpB,OAAO;CACP,WAAW;CAIX,qBAAqB;CACrB,uBAAuB;CAEvB,iBAAiB;CACjB,eAAe;CACf,aAAa;CACb,YAAY;CACZ,MAAM;CACN"}

package/dist/plugins/wallet/codegen.d.mts

@@ -25,7 +25,6 @@ interface DappKitConfigBindings {
     readonly accounts: string;
     readonly signTransaction: string;
     readonly signPersonalMessage: string;
-    readonly execute: string;
   };
 }
 //#endregion

package/dist/plugins/wallet/codegen.mjs

@@ -1,3 +1,5 @@
+import { defineSimpleConstExport } from "../internal/codegen-helpers.mjs";
+import { WalletSpans } from "./spans.mjs";
 import { redactToken } from "./pairing.mjs";
 import { Effect } from "effect";
 //#region src/plugins/wallet/codegen.ts
@@ -14,18 +16,15 @@ import { Effect } from "effect";
 *  placeholder so the type plumbing works; at codegen time the
 *  substrate re-evaluates with the resolved values.
 */
-const makeWalletCodegen = (resolved) => ({
-	kind: "codegenable",
+const makeWalletCodegen = (resolved) => defineSimpleConstExport({
 	emitterName: "dapp-kit-config",
 	outputPath: "dapp-kit/config.ts",
+	exportName: "dappKitConfig",
+	value: resolved,
 	sensitive: true,
-	emit: (ctx) => Effect.gen(function* () {
-		yield* Effect.annotateCurrentSpan({
-			"wallet.codegen.pairUrl": redactToken(resolved.pairUrl),
-			"wallet.codegen.walletUrl": resolved.walletUrl
-		});
-		ctx.exportConst("dappKitConfig", resolved);
-		return ctx.done();
+	preEmit: Effect.annotateCurrentSpan({
+		[WalletSpans.codegenPairUrl]: redactToken(resolved.pairUrl),
+		[WalletSpans.codegenWalletUrl]: resolved.walletUrl
 	})
 });
 //#endregion

package/dist/plugins/wallet/codegen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/wallet/codegen.ts"],"sourcesContent":["// Wallet plugin — Codegenable contribution.\n//\n// Architecture (15-wallet.md §\"Capabilities PRODUCED\" + §\"Codegen\n// emits a `dapp-kit-config.ts`\"):\n//\n//   - The browser-side dev-wallet adapter is the cross-boundary\n//     consumer. It reads a typed `dapp-kit-config` value at startup,\n//     constructs a `DevstackSignerAdapter`, and registers it with\n//     `@mysten/dapp-kit`'s wallet-standard surface (in user-app\n//     bundle code — devstack itself NEVER imports dapp-kit).\n//\n//   - The emitted file lives at `dapp-kit/config.ts` under the staging\n//     dir. The generated module owns the exported config value's type.\n//\n// SENSITIVE FLAG (task requirement #5 — manifest-vs-token threat\n// surface):\n//\n//   - The emitted file carries the unredacted pair URL (incl. the\n//     `#token=<32-hex>` fragment) so the dev-wallet adapter can wire\n//     itself up without a side-channel read.\n//   - Therefore `sensitive: true`. The codegen orchestrator tightens\n//     the file mode to `0o600` on emit AND injects the file path into\n//     `.gitignore`.\n//\n// Distilled-doc tension absorbed (15-wallet.md \"Manifest carries\n// unredacted pair URL while token file is 0o600 — pick one\"):\n//\n//   We pick \"tighten the emit perms\". The token still lives in a\n//   `0o600` side-channel file (see `pairing.ts:tokenPath`), AND the\n//   codegen emit is also `0o600` via the sensitive flag. The legacy\n//   `.devstack/manifest.json` write that left the pair URL world-\n//   readable is GONE — the rewrite no longer emits an unredacted pair\n//   URL into the manifest. Only the codegen file carries it, and that\n//   file is tightened.\n//\n//   See the report's §\"Architecture-doc revisions\" for the\n//   architecture-doc note that needs to land alongside this.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\n\nimport { redactToken } from './pairing.ts';\n\n// ----------------------------------------------------------------------\n// Emitted shape\n// ----------------------------------------------------------------------\n\n/** The typed shape `dapp-kit/config.ts` exports. Downstream consumers\n *  (the user-app's dapp-kit boot code) import and consume this.\n *\n *  Field shape mirrors what `DevstackSignerAdapter` needs:\n *\n *    - `walletUrl`     : the wallet HTTP server's URL (router-fronted\n *                        host form when available, direct-loopback\n *                        fallback otherwise).\n *    - `pairUrl`       : `walletUrl` + `/#token=<32-hex>` (single\n *                        source of truth for the token).\n *    - `protocolPaths` : path constants the adapter reads. Mirrored\n *                        here so the adapter doesn't depend on a\n *                        separate import.\n *    - `chain`         : Sui chain id the wallet's accounts are\n *                        scoped to. Surfaced so dapp-kit can pin its\n *                        active chain.\n */\nexport interface DappKitConfigBindings {\n\treadonly walletUrl: string;\n\treadonly pairUrl: string;\n\treadonly chain: string;\n\treadonly protocolPaths: {\n\t\treadonly health: string;\n\t\treadonly accounts: string;\n\t\treadonly signTransaction: string;\n\t\treadonly signPersonalMessage: string;\n\t\treadonly execute: string;\n\t};\n}\n\n// ----------------------------------------------------------------------\n// Decl construction\n// ----------------------------------------------------------------------\n\n/**\n * Construct the Codegenable contribution.\n *\n *  Emits `dapp-kit/config.ts` with `sensitive: true` → the orchestrator\n *  writes the file with `0o600` and gitignores it. The emitted shape\n *  carries the unredacted pair URL; the side-channel token file is\n *  also `0o600`.\n *\n *  The `resolved` arg is supplied AFTER acquire (the substrate's\n *  \"resolve-once\" memo). At factory time the barrel passes a\n *  placeholder so the type plumbing works; at codegen time the\n *  substrate re-evaluates with the resolved values.\n */\nexport const makeWalletCodegen = (\n\tresolved: DappKitConfigBindings,\n): CodegenableDecl<'dapp-kit-config'> => ({\n\tkind: 'codegenable',\n\temitterName: 'dapp-kit-config',\n\toutputPath: 'dapp-kit/config.ts',\n\t// SENSITIVE: drives 0o600 + .gitignore. The architecture has this\n\t// hook (`SnapshotableDecl` mirrors it for the snapshot subtree).\n\tsensitive: true,\n\temit: (ctx) =>\n\t\tEffect.gen(function* () {\n\t\t\t// Span annotation logs ONLY the redacted form — defense-in-\n\t\t\t// depth so any debug-mode span dump doesn't leak the token.\n\t\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t\t'wallet.codegen.pairUrl': redactToken(resolved.pairUrl),\n\t\t\t\t'wallet.codegen.walletUrl': resolved.walletUrl,\n\t\t\t});\n\t\t\tctx.exportConst('dappKitConfig', resolved);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;;;;;;;;;;;;;;AA+FA,MAAa,qBACZ,cACyC;CACzC,MAAM;CACN,aAAa;CACb,YAAY;CAGZ,WAAW;CACX,OAAO,QACN,OAAO,IAAI,aAAa;AAGvB,SAAO,OAAO,oBAAoB;GACjC,0BAA0B,YAAY,SAAS,QAAQ;GACvD,4BAA4B,SAAS;GACrC,CAAC;AACF,MAAI,YAAY,iBAAiB,SAAS;AAC1C,SAAO,IAAI,MAAM;GAChB;CACH"}
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/wallet/codegen.ts"],"sourcesContent":["// Wallet plugin — Codegenable contribution.\n//\n// Architecture (15-wallet.md §\"Capabilities PRODUCED\" + §\"Codegen\n// emits a `dapp-kit-config.ts`\"):\n//\n//   - The browser-side dev-wallet adapter is the cross-boundary\n//     consumer. It reads a typed `dapp-kit-config` value at startup,\n//     constructs a `DevstackSignerAdapter`, and registers it with\n//     `@mysten/dapp-kit`'s wallet-standard surface (in user-app\n//     bundle code — devstack itself NEVER imports dapp-kit).\n//\n//   - The emitted file lives at `dapp-kit/config.ts` under the staging\n//     dir. The generated module owns the exported config value's type.\n//\n// SENSITIVE FLAG (task requirement #5 — manifest-vs-token threat\n// surface):\n//\n//   - The emitted file carries the unredacted pair URL (incl. the\n//     `#token=<32-hex>` fragment) so the dev-wallet adapter can wire\n//     itself up without a side-channel read.\n//   - Therefore `sensitive: true`. The codegen orchestrator tightens\n//     the file mode to `0o600` on emit AND injects the file path into\n//     `.gitignore`.\n//\n// Distilled-doc tension absorbed (15-wallet.md \"Manifest carries\n// unredacted pair URL while token file is 0o600 — pick one\"):\n//\n//   We pick \"tighten the emit perms\". The token still lives in a\n//   `0o600` side-channel file (see `pairing.ts:tokenPath`), AND the\n//   codegen emit is also `0o600` via the sensitive flag. The legacy\n//   `.devstack/manifest.json` write that left the pair URL world-\n//   readable is GONE — the rewrite no longer emits an unredacted pair\n//   URL into the manifest. Only the codegen file carries it, and that\n//   file is tightened.\n//\n//   See the report's §\"Architecture-doc revisions\" for the\n//   architecture-doc note that needs to land alongside this.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\n\nimport { defineSimpleConstExport } from '../internal/codegen-helpers.ts';\n\nimport { redactToken } from './pairing.ts';\nimport { WalletSpans } from './spans.ts';\n\n// ----------------------------------------------------------------------\n// Emitted shape\n// ----------------------------------------------------------------------\n\n/** The typed shape `dapp-kit/config.ts` exports. Downstream consumers\n *  (the user-app's dapp-kit boot code) import and consume this.\n *\n *  Field shape mirrors what `DevstackSignerAdapter` needs:\n *\n *    - `walletUrl`     : the wallet HTTP server's URL (router-fronted\n *                        host form when available, direct-loopback\n *                        fallback otherwise).\n *    - `pairUrl`       : `walletUrl` + `/#token=<32-hex>` (single\n *                        source of truth for the token).\n *    - `protocolPaths` : path constants the adapter reads. Mirrored\n *                        here so the adapter doesn't depend on a\n *                        separate import.\n *    - `chain`         : Sui chain id the wallet's accounts are\n *                        scoped to. Surfaced so dapp-kit can pin its\n *                        active chain.\n */\nexport interface DappKitConfigBindings {\n\treadonly walletUrl: string;\n\treadonly pairUrl: string;\n\treadonly chain: string;\n\treadonly protocolPaths: {\n\t\treadonly health: string;\n\t\treadonly accounts: string;\n\t\treadonly signTransaction: string;\n\t\treadonly signPersonalMessage: string;\n\t};\n}\n\n// ----------------------------------------------------------------------\n// Decl construction\n// ----------------------------------------------------------------------\n\n/**\n * Construct the Codegenable contribution.\n *\n *  Emits `dapp-kit/config.ts` with `sensitive: true` → the orchestrator\n *  writes the file with `0o600` and gitignores it. The emitted shape\n *  carries the unredacted pair URL; the side-channel token file is\n *  also `0o600`.\n *\n *  The `resolved` arg is supplied AFTER acquire (the substrate's\n *  \"resolve-once\" memo). At factory time the barrel passes a\n *  placeholder so the type plumbing works; at codegen time the\n *  substrate re-evaluates with the resolved values.\n */\nexport const makeWalletCodegen = (\n\tresolved: DappKitConfigBindings,\n): CodegenableDecl<'dapp-kit-config'> =>\n\tdefineSimpleConstExport({\n\t\temitterName: 'dapp-kit-config',\n\t\toutputPath: 'dapp-kit/config.ts',\n\t\texportName: 'dappKitConfig',\n\t\tvalue: resolved,\n\t\t// SENSITIVE: drives 0o600 + .gitignore. The architecture has\n\t\t// this hook (`SnapshotableDecl` mirrors it for the snapshot\n\t\t// subtree).\n\t\tsensitive: true,\n\t\t// Span annotation logs ONLY the redacted form — defense-in-\n\t\t// depth so any debug-mode span dump doesn't leak the token.\n\t\tpreEmit: Effect.annotateCurrentSpan({\n\t\t\t[WalletSpans.codegenPairUrl]: redactToken(resolved.pairUrl),\n\t\t\t[WalletSpans.codegenWalletUrl]: resolved.walletUrl,\n\t\t}),\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiGA,MAAa,qBACZ,aAEA,wBAAwB;CACvB,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,OAAO;CAIP,WAAW;CAGX,SAAS,OAAO,oBAAoB;GAClC,YAAY,iBAAiB,YAAY,SAAS,QAAQ;GAC1D,YAAY,mBAAmB,SAAS;EACzC,CAAC;CACF,CAAC"}

package/dist/plugins/wallet/index.d.mts

@@ -1,8 +1,8 @@
+import { WALLET_AUTH_HEADER, WALLET_BEARER_PREFIX, WALLET_ENDPOINT_KEY, WALLET_ENDPOINT_NAME, WALLET_PROTOCOL_PREFIX, WALLET_TOKEN_FRAGMENT_KEY, WALLET_TOKEN_HEX_LENGTH, WalletHttpPath, WalletHttpPathValue } from "../../contracts/wallet-protocol.mjs";
 import { CodegenableDecl } from "../../contracts/codegenable.mjs";
 import { RoutableDecl } from "../../contracts/routable.mjs";
 import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
 import { Plugin, ResourceRef } from "../../substrate/plugin.mjs";
-import { SeedObjectsAccumulator } from "../sui/seed-objects.mjs";
 import { SuiClient } from "../sui/mode/shared.mjs";
 import { SuiOptions } from "../sui/mode/spec.mjs";
 import { DappKitConfigBindings } from "./codegen.mjs";
@@ -32,12 +32,11 @@ import { WALLET_ACCOUNTS_ALL, WalletAccountMember, WalletOptions, WalletValue }
  *     host-gateway address instead of host loopback. The published
  *     wallet URL remains stack-scoped through the router.
  *
- *   - `allowLocalhostVite: false`. The bare `http://localhost:<vite>`
- *     form is OFF by default — opt-in for headless test runners /
- *     custom dev hosts. Defaulting it on would let a sibling stack
- *     running vite on the same port pair with this wallet (because
- *     `localhost` is not stack-scoped). See `origin-policy.ts` for
- *     the rationale.
+ *   - Origin allowlist is the router-fronted dev-server origin for
+ *     this stack plus any explicit `allowedOrigins`. The wallet does
+ *     not auto-allowlist a bare `http://localhost:<vite-port>` form —
+ *     `localhost` is not stack-scoped, so a sibling stack on the same
+ *     port could pair with this wallet. See `origin-policy.ts`.
  *
  *   - Pairing token in URL fragment only (`#token=<32-hex>`). Never
  *     in query params (would land in access logs / referrers).
@@ -56,7 +55,6 @@ declare function wallet(opts: Omit<WalletOptions, 'accounts'> & {
 declare function wallet(): ReturnType<typeof makeWalletMember<readonly []>>;
 declare function makeWalletMember<Accounts extends ReadonlyArray<WalletAccountMember>>(opts: WalletOptions, accounts: Accounts): Plugin<"wallet", WalletValue, readonly [ResourceRef<"sui", SuiClient & {
   readonly mode: SuiOptions["mode"];
-  readonly seedObjects: SeedObjectsAccumulator;
 }>, ...Accounts], readonly [SnapshotableDecl, CodegenableDecl<"dapp-kit-config">, RoutableDecl]>;
 //#endregion
 export { wallet };

package/dist/plugins/wallet/index.mjs

@@ -1,39 +1,47 @@
 import { definePlugin, resource } from "../../substrate/plugin.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import { attachPluginExpander } from "../../contracts/plugin-expander.mjs";
+import "../../api/define-plugin.mjs";
 import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { PortBrokerService } from "../../substrate/runtime/port-broker/service.mjs";
-import { renderUrl, routerHostname } from "../../orchestrators/router/hostname.mjs";
-import { suiResource } from "../sui/index.mjs";
+import { DEFAULT_PORT_WINDOW, PortBrokerService } from "../../substrate/runtime/port-broker/service.mjs";
+import "../../substrate/runtime/port-broker/index.mjs";
+import { renderUrl, routedHostname } from "../../substrate/runtime/routed-url.mjs";
 import { HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT } from "../host-service/routable.mjs";
+import "../../contracts/wallet-protocol.mjs";
+import { WALLET_ENTRYPOINT_PORT, makeWalletRoutable } from "./routable.mjs";
+import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import { suiResource } from "../sui/index.mjs";
+import "../host-service/index.mjs";
 import { WALLET_ERROR_TAGS, walletBootError } from "./errors.mjs";
+import "./spans.mjs";
 import "./protocol.mjs";
 import "./pairing.mjs";
 import { makeWalletCodegen } from "./codegen.mjs";
-import { WALLET_ENTRYPOINT_PORT, makeWalletRoutable } from "./routable.mjs";
 import { makeWalletSnapshotable } from "./snapshot.mjs";
 import "./origin-policy.mjs";
 import "./server.mjs";
 import { acquireWallet } from "./service.mjs";
 import { Effect } from "effect";
 //#region src/plugins/wallet/index.ts
-/** Composer-side expander hook for `wallet({ accounts: 'all' })`. The
-*  wallet factory cannot know the stack's account members at its own
-*  call site (members are introduced positionally to `defineDevstack`
-*  AFTER the wallet factory has returned). The composer detects this
-*  symbol on a member returned by the wallet factory, collects every
-*  account-providing member from the final stack, and invokes the
-*  hook to produce the real wallet member with a populated dependencies
-*  tuple — keeping the dep-graph edges accurate.
+/** Wallet's expander contributes through the substrate-owned
+*  `PluginExpander` contract (`contracts/plugin-expander.ts`). The
+*  composer dispatches every member's expander uniformly — wallet has
+*  no special-case wiring in `api/define-devstack.ts`.
 *
-*  Symbol-keyed (not a named property) so it cannot collide with any
-*  user-facing member field. Globally registered via `Symbol.for(...)`
-*  so the composer can look it up without importing the wallet
-*  module's symbol-binding (this side-steps a TS2742 inferred-type
-*  portability error: a `unique symbol`-keyed property in the wallet
-*  member's return type would leak the symbol's compile-time identity
-*  into the user's `defineDevstack(...)` inferred Stack type, forcing
-*  every example's default export to carry an explicit annotation). */
-const WALLET_EXPAND_ACCOUNTS_ALL = Symbol.for("devstack.wallet.expand-accounts-all");
+*  Compose-time symmetry: any plugin needing the "rewrite this
+*  placeholder once the full member tuple is known" rewrite uses the
+*  same `attachPluginExpander(...)` seam wallet uses below. */
+const ACCOUNT_RESOURCE_ID_PREFIX = "account/";
+/** Type-narrowing predicate on a plugin's resource id. The account
+*  plugin's `AccountResourceId<Name>` template-literal type IS the
+*  substrate-owned discriminator (12-account.md "resource id flows into
+*  the on-disk path, the manifest key, container labels, and generated
+*  TypeScript exports") — every account member's `id` reduces to
+*  `account/${Name}`. Probing through this typed predicate (vs. a bare
+*  `startsWith` whose narrowing returns `string`) prevents misclassifying
+*  a future plugin whose id happens to start with `account/` but is NOT
+*  the account-plugin shape, AND surfaces a compile error if the
+*  account-id prefix convention ever changes. */
+const isAccountResourceMember = (member) => member.id.startsWith(ACCOUNT_RESOURCE_ID_PREFIX);
 /** The wallet plugin's resource identity. ONE per stack (15-wallet.md
 *  "singleton per stack"). The id is `'wallet'` (singular). */
 const walletResource = resource("wallet");
@@ -42,11 +50,14 @@ function wallet(opts) {
 	const resolvedOpts = opts ?? { accounts: "all" };
 	if (resolvedOpts.accounts === "all") {
 		const placeholder = makeWalletMember(resolvedOpts, []);
-		const expander = (accountMembers) => makeWalletMember({
-			...resolvedOpts,
-			accounts: accountMembers
-		}, accountMembers);
-		placeholder[WALLET_EXPAND_ACCOUNTS_ALL] = expander;
+		attachPluginExpander(placeholder, (members) => {
+			const accountMembers = [];
+			for (const m of members) if (isAccountResourceMember(m)) accountMembers.push(m);
+			return makeWalletMember({
+				...resolvedOpts,
+				accounts: accountMembers
+			}, accountMembers);
+		});
 		return placeholder;
 	}
 	return makeWalletMember(resolvedOpts, resolvedOpts.accounts);
@@ -61,12 +72,13 @@ function makeWalletMember(opts, accounts) {
 		id: walletResource.id,
 		dependsOn: dependencies,
 		role: "service",
+		section: "service",
 		start: (deps) => Effect.gen(function* () {
 			const identity = yield* IdentityContext;
 			const paths = yield* StackPathsService;
 			const portBroker = yield* PortBrokerService;
 			const [, ...resolvedAccounts] = deps;
-			const routerFrontedUrl = yield* routerHostname(identity, "api").pipe(Effect.map((hostname) => renderUrl({
+			const routerFrontedUrl = yield* routedHostname(identity, "api").pipe(Effect.map((hostname) => renderUrl({
 				protocol: "http",
 				hostname,
 				port: WALLET_ENTRYPOINT_PORT
@@ -75,7 +87,7 @@ function makeWalletMember(opts, accounts) {
 				message: `wallet router URL construction failed: ${err.detail}`,
 				cause: err
 			})));
-			const routedAppOrigin = yield* routerHostname(identity, "dev").pipe(Effect.map((hostname) => renderUrl({
+			const routedAppOrigin = yield* routedHostname(identity, "dev").pipe(Effect.map((hostname) => renderUrl({
 				protocol: "http",
 				hostname,
 				port: HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT
@@ -89,21 +101,20 @@ function makeWalletMember(opts, accounts) {
 				stack: identity.stack,
 				chain: identity.chain,
 				stateRoot: paths.stackRoot,
-				vitePortForThisStack: null,
 				allocatePort: (preferred, probeHost) => portBroker.allocate({
-					kind: "wallet",
+					owner: "wallet",
+					windowHint: DEFAULT_PORT_WINDOW,
 					preferredPort: preferred,
 					...probeHost === void 0 ? {} : { probeHost }
 				}).pipe(Effect.map((alloc) => alloc.port), Effect.mapError((err) => walletBootError({
 					phase: "allocate-port",
 					message: `port-broker allocate failed: ${err.detail}`,
-					hint: err.reason === "preferred-busy" ? "another plugin in this stack is using your preferred port; omit `port` to let the broker pick." : err.reason === "no-free-port" ? "the wallet kind-window is exhausted; check for stray devstack supervisors holding ports." : "bind-probe failed — likely a privileged port or jail restriction.",
+					hint: err.reason === "preferred-busy" ? "another plugin in this stack is using your preferred port; omit `port` to let the broker pick." : err.reason === "no-free-port" ? "the wallet port window is exhausted; check for stray devstack supervisors holding ports." : "bind-probe failed — likely a privileged port or jail restriction.",
 					cause: err
 				}))),
 				resolveAccounts: () => Effect.succeed(resolvedAccounts),
 				routerFrontedUrl,
-				routedAppOrigin,
-				supervisorCtx: void 0
+				routedAppOrigin
 			});
 		}),
 		errorContributions: walletErrorContributions,
@@ -121,6 +132,6 @@ function makeWalletMember(opts, accounts) {
 	});
 }
 //#endregion
-export { WALLET_EXPAND_ACCOUNTS_ALL, wallet };
+export { wallet };
 
 //# sourceMappingURL=index.mjs.map

package/dist/plugins/wallet/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/wallet/index.ts"],"sourcesContent":["// Wallet plugin — barrel + `wallet(opts?)` factory.\n//\n// Architecture (15-wallet.md):\n//\n//   The wallet bridges devstack (the supervisor host) and the\n//   browser-side dev-wallet adapter (in the separate `dev-wallet`\n//   package). Two parts:\n//\n//     1. The IN-PROCESS HTTP server. Owned here. Boot at acquire,\n//        serve `/api/v1/devstack/*` routes (health, accounts,\n//        sign-transaction, sign-personal-message, execute).\n//\n//     2. The BROWSER-SIDE ADAPTER. Owned by `dev-wallet`. Reads the\n//        codegen-emitted `dapp-kit/config.ts`, constructs a\n//        `DevstackSignerAdapter`, registers it with `@mysten/dapp-\n//        kit`'s wallet-standard surface.\n//\n//   The HTTP protocol is the ONE cross-boundary contract. THIS PACKAGE\n//   NEVER IMPORTS `@mysten/dapp-kit*` OR `@mysten/wallet-standard`.\n//\n// Capabilities emitted:\n//\n//   1. Snapshotable — pairing token under `wallet/token`.\n//   2. Codegenable — `dapp-kit-config` bindings (the dev-wallet\n//      adapter consumes this). Sensitive flag set — 0o600 + gitignore.\n//   3. Routable — wallet UI URL on the stack-scoped router.\n\nimport { Effect } from 'effect';\n\nimport { definePlugin, resource } from '../../api/define-plugin.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { PortBrokerService } from '../../substrate/runtime/port-broker/index.ts';\nimport { renderUrl, routerHostname } from '../../orchestrators/router/hostname.ts';\nimport { suiResource } from '../sui/index.ts';\nimport {\n\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\tHOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n} from '../host-service/routable.ts';\n\nimport { makeWalletCodegen } from './codegen.ts';\nimport { WALLET_ERROR_TAGS, walletBootError } from './errors.ts';\nimport { makeWalletRoutable, WALLET_ENTRYPOINT_PORT, WALLET_ROUTE_ROLE } from './routable.ts';\nimport { makeWalletSnapshotable } from './snapshot.ts';\nimport {\n\tacquireWallet,\n\tWALLET_ACCOUNTS_ALL,\n\ttype WalletAcquireContext,\n\ttype WalletAccountMember,\n\ttype WalletOptions,\n\ttype WalletValue,\n} from './service.ts';\nimport type { AnyPlugin } from '../../substrate/plugin.ts';\n\n/** Composer-side expander hook for `wallet({ accounts: 'all' })`. The\n *  wallet factory cannot know the stack's account members at its own\n *  call site (members are introduced positionally to `defineDevstack`\n *  AFTER the wallet factory has returned). The composer detects this\n *  symbol on a member returned by the wallet factory, collects every\n *  account-providing member from the final stack, and invokes the\n *  hook to produce the real wallet member with a populated dependencies\n *  tuple — keeping the dep-graph edges accurate.\n *\n *  Symbol-keyed (not a named property) so it cannot collide with any\n *  user-facing member field. Globally registered via `Symbol.for(...)`\n *  so the composer can look it up without importing the wallet\n *  module's symbol-binding (this side-steps a TS2742 inferred-type\n *  portability error: a `unique symbol`-keyed property in the wallet\n *  member's return type would leak the symbol's compile-time identity\n *  into the user's `defineDevstack(...)` inferred Stack type, forcing\n *  every example's default export to carry an explicit annotation). */\nexport const WALLET_EXPAND_ACCOUNTS_ALL: symbol = Symbol.for('devstack.wallet.expand-accounts-all');\n\n/** Runtime-only expander shape attached to the placeholder wallet\n *  member when the user passes `accounts: 'all'`. The composer reads\n *  `member[WALLET_EXPAND_ACCOUNTS_ALL](accountMembers)` to mint the\n *  resolved-tuple wallet member.\n *\n *  Kept as a value-level shape (not a type-level intersection on the\n *  factory's return signature) so the symbol-keyed property does NOT\n *  leak into the user's inferred Stack type (see TS2742 note above). */\nexport type WalletExpandAccountsAllExpander = (\n\taccountMembers: ReadonlyArray<WalletAccountMember>,\n) => AnyPlugin;\n\n// ----------------------------------------------------------------------\n// Resource identity\n// ----------------------------------------------------------------------\n\n/** The wallet plugin's resource identity. ONE per stack (15-wallet.md\n *  \"singleton per stack\"). The id is `'wallet'` (singular). */\nconst walletResource = resource<'wallet', WalletValue>('wallet');\nconst walletErrorContributions = pluginErrorContributions(WALLET_ERROR_TAGS);\n\n// ----------------------------------------------------------------------\n// User-facing factory\n// ----------------------------------------------------------------------\n\n/**\n * Construct the wallet plugin.\n *\n * Two parts of the wallet:\n *\n *   - HERE: HTTP server + token + pairing protocol + codegen.\n *   - DEV-WALLET PACKAGE: `@mysten/dapp-kit`-shaped adapter the\n *     user-app's frontend bundle imports.\n *\n *  Distilled-doc invariant (15-wallet.md \"Always explicit\"): the\n *  composer NEVER auto-mounts the wallet. The user calls `wallet()`,\n *  `wallet({ accounts: 'all' })`, or `wallet({ accounts: [alice, bob] })`\n *  and passes the result to `defineDevstack(...)`.\n *\n *  ### Security defaults\n *\n *   - `bindAddress: '0.0.0.0'`. The router runs in Docker, so on\n *     native Linux it reaches this host process through the Docker\n *     host-gateway address instead of host loopback. The published\n *     wallet URL remains stack-scoped through the router.\n *\n *   - `allowLocalhostVite: false`. The bare `http://localhost:<vite>`\n *     form is OFF by default — opt-in for headless test runners /\n *     custom dev hosts. Defaulting it on would let a sibling stack\n *     running vite on the same port pair with this wallet (because\n *     `localhost` is not stack-scoped). See `origin-policy.ts` for\n *     the rationale.\n *\n *   - Pairing token in URL fragment only (`#token=<32-hex>`). Never\n *     in query params (would land in access logs / referrers).\n *\n *   - Constant-time bearer compare on every request.\n *\n *   - Token file `0o600`. Codegen output (`dapp-kit/config.ts`)\n *     `0o600` + gitignored via `sensitive: true`.\n */\nexport function wallet<const Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: Accounts },\n): ReturnType<typeof makeWalletMember<Accounts>>;\nexport function wallet(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: typeof WALLET_ACCOUNTS_ALL },\n): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(opts?: WalletOptions): AnyPlugin {\n\tconst resolvedOpts: WalletOptions =\n\t\topts ?? ({ accounts: WALLET_ACCOUNTS_ALL } satisfies WalletOptions);\n\tif (resolvedOpts.accounts === WALLET_ACCOUNTS_ALL) {\n\t\t// Deferred placeholder. `dependsOn` carries only `[suiResource]` —\n\t\t// the composer rewrites the member once it knows which account\n\t\t// members are in the stack (api-surface-design §4 D6). Without\n\t\t// composer expansion, the wallet would race account funding;\n\t\t// WITH composer expansion, every per-account dependency edge is\n\t\t// in place by the time the dep-graph builds.\n\t\t//\n\t\t// Type-level: the placeholder's `dependsOn` is `[suiResource]`. A\n\t\t// wider `ReadonlyArray<account/${string}>` would widen the\n\t\t// stack-level `MissingProviders` check to the template literal\n\t\t// (which never reduces to any concrete `account/<name>`), so\n\t\t// the placeholder MUST stay narrow.\n\t\t//\n\t\t// Runtime: the symbol-keyed expander is attached as a value-\n\t\t// only property; the factory's declared return type\n\t\t// intentionally does NOT surface it (a `unique symbol`-keyed\n\t\t// member field would leak into the user's inferred Stack type\n\t\t// and trigger TS2742 \"type cannot be named without a reference\n\t\t// to ./node_modules/.../plugins/wallet\" at every example's\n\t\t// default export).\n\t\tconst placeholder = makeWalletMember(resolvedOpts, [] as const);\n\t\tconst expander: WalletExpandAccountsAllExpander = (accountMembers) =>\n\t\t\tmakeWalletMember({ ...resolvedOpts, accounts: accountMembers }, accountMembers);\n\t\t(placeholder as unknown as Record<symbol, unknown>)[WALLET_EXPAND_ACCOUNTS_ALL] = expander;\n\t\treturn placeholder;\n\t}\n\treturn makeWalletMember(resolvedOpts, resolvedOpts.accounts);\n}\n\nfunction makeWalletMember<Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: WalletOptions,\n\taccounts: Accounts,\n) {\n\t// Dependencies MUST include every account ref (15-wallet.md\n\t// \"upstreamKeys MUST include suiResource.id + every account id\" — same\n\t// load-bearing invariant). The substrate's topological scheduler\n\t// uses `dependsOn` to drive build order; without including the\n\t// account refs here, the wallet would race account funding and the\n\t// first `signTransaction` would fail with `address-not-found`.\n\t//\n\tconst dependencies = [suiResource, ...accounts] as const;\n\n\t// The resolved-opts shape acquireWallet sees has accounts pinned to\n\t// the resolved tuple — `'all'` is purely a user-surface convenience\n\t// the composer never propagates to the supervisor.\n\tconst resolvedOpts: WalletOptions<Accounts> = { ...opts, accounts };\n\n\treturn definePlugin({\n\t\tid: walletResource.id,\n\t\tdependsOn: dependencies,\n\t\t// The HTTP server is a long-lived host process; per-request\n\t\t// handlers fork off the supervisor-context fiber but the server\n\t\t// itself lives for the stack's lifetime.\n\t\trole: 'service',\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\t// Pull identity, the stack-paths bundle, and the port-\n\t\t\t\t// broker from the supervisor-provided substrate context.\n\t\t\t\t// `StackPathsService.stackRoot` is the on-disk root for\n\t\t\t\t// per-stack runtime artifacts (incl. `wallet/token`); the\n\t\t\t\t// port broker is per-stack (Layer-driven, one instance per\n\t\t\t\t// stack scope); the wallet's scope hangs off the\n\t\t\t\t// supervisor's `acquireScope`, so any release finalizer\n\t\t\t\t// installed by these primitives unwinds with the rest of\n\t\t\t\t// the plugin's resources on cycle / teardown.\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst paths = yield* StackPathsService;\n\t\t\t\tconst portBroker = yield* PortBrokerService;\n\n\t\t\t\t// The first dependency is the hard Sui ordering edge; the\n\t\t\t\t// remaining values mirror the explicit account tuple.\n\t\t\t\tconst [, ...resolvedAccounts] = deps;\n\t\t\t\tconst routerFrontedUrl = yield* routerHostname(identity, WALLET_ROUTE_ROLE).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: WALLET_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet router URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst routedAppOrigin = yield* routerHostname(\n\t\t\t\t\tidentity,\n\t\t\t\t\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet app-origin URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst acquireCtx: WalletAcquireContext = {\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tchain: identity.chain,\n\t\t\t\t\tstateRoot: paths.stackRoot,\n\t\t\t\t\tvitePortForThisStack: null,\n\t\t\t\t\tallocatePort: (preferred, probeHost) =>\n\t\t\t\t\t\tportBroker\n\t\t\t\t\t\t\t.allocate({\n\t\t\t\t\t\t\t\tkind: 'wallet',\n\t\t\t\t\t\t\t\tpreferredPort: preferred,\n\t\t\t\t\t\t\t\t...(probeHost === undefined ? {} : { probeHost }),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\t\tEffect.map((alloc) => alloc.port),\n\t\t\t\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\t\t\t\tphase: 'allocate-port',\n\t\t\t\t\t\t\t\t\t\tmessage: `port-broker allocate failed: ${err.detail}`,\n\t\t\t\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t\t\t\terr.reason === 'preferred-busy'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'another plugin in this stack is using your preferred port; omit `port` to let the broker pick.'\n\t\t\t\t\t\t\t\t\t\t\t\t: err.reason === 'no-free-port'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'the wallet kind-window is exhausted; check for stray devstack supervisors holding ports.'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'bind-probe failed — likely a privileged port or jail restriction.',\n\t\t\t\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\tresolveAccounts: () => Effect.succeed(resolvedAccounts),\n\t\t\t\t\trouterFrontedUrl,\n\t\t\t\t\troutedAppOrigin,\n\t\t\t\t\tsupervisorCtx: undefined,\n\t\t\t\t};\n\n\t\t\t\treturn yield* acquireWallet(resolvedOpts, acquireCtx);\n\t\t\t}),\n\t\terrorContributions: walletErrorContributions,\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `WalletValue` + acquire context. Stamps the real dapp-kit\n\t\t// bindings (walletUrl, pairUrl, chain id, paths) into the\n\t\t// codegen decl, and the real identity app/stack into the\n\t\t// routable decl.\n\t\tcapabilities: ({ value: resolved, runtime: acquireCtx }) => {\n\t\t\tconst snapshot = makeWalletSnapshotable();\n\t\t\tconst codegen = makeWalletCodegen(resolved.bindings);\n\t\t\tconst routable = makeWalletRoutable({\n\t\t\t\tapp: acquireCtx.identity.app,\n\t\t\t\tstack: acquireCtx.identity.stack,\n\t\t\t\tport: resolved.localPort,\n\t\t\t});\n\t\t\treturn [snapshot, codegen, routable] as const;\n\t\t},\n\t});\n}\n\n// ----------------------------------------------------------------------\n// Re-exports\n// ----------------------------------------------------------------------\n\nexport type {\n\tWalletOptions,\n\tWalletValue,\n\tWalletAccountMember,\n\tWalletAccountsAll,\n} from './service.ts';\nexport { WALLET_ACCOUNTS_ALL } from './service.ts';\nexport type { DappKitConfigBindings } from './codegen.ts';\nexport {\n\tWalletHttpPath,\n\tWALLET_PROTOCOL_PREFIX,\n\tWALLET_AUTH_HEADER,\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tExecuteRequestSchema,\n\tExecuteResponseSchema,\n\tHealthResponseSchema,\n\tAccountsResponseSchema,\n\tAccountSummarySchema,\n\tErrorResponseSchema,\n\tSuiAddressSchema,\n\tBase64Schema,\n\tSignatureSchemeSchema,\n\tAccountSourceSchema,\n\ttype WalletHttpPathValue,\n\ttype SignRequest,\n\ttype SignResponse,\n\ttype ExecuteRequest,\n\ttype ExecuteResponse,\n\ttype HealthResponse,\n\ttype AccountsResponse,\n\ttype AccountSummary,\n\ttype ErrorResponse,\n} from './protocol.ts';\nexport type {\n\tWalletError,\n\tWalletBootError,\n\tWalletBootPhase,\n\tWalletRequestError,\n\tWalletRequestPhase,\n} from './errors.ts';\nexport { WALLET_ERROR_TAGS } from './errors.ts';\nexport type { OriginPolicy, OriginPolicyInputs, OriginCheckResult } from './origin-policy.ts';\nexport { resolveOriginPolicy, checkOrigin, corsHeadersFor } from './origin-policy.ts';\nexport type { PairingToken } from './pairing.ts';\nexport {\n\tmintToken,\n\tacquirePairingToken,\n\ttokenPath,\n\tcomposePairUrl,\n\tparsePairUrl,\n\tparseBearerHeader,\n\tsafeBearerEquals,\n\tredactToken,\n} from './pairing.ts';\nexport { WALLET_ENDPOINT_NAME, makeWalletRoutable } from './routable.ts';\nexport {\n\tdispatch,\n\tstartHttpServer,\n\tMAX_BODY_BYTES,\n\ttype WalletRequest,\n\ttype WalletResponse,\n\ttype WalletServerConfig,\n\ttype WalletServerHandle,\n} from './server.ts';\nexport { makeWalletCodegen } from './codegen.ts';\nexport { makeWalletSnapshotable } from './snapshot.ts';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuEA,MAAa,6BAAqC,OAAO,IAAI,sCAAsC;;;AAoBnG,MAAM,iBAAiB,SAAgC,SAAS;AAChE,MAAM,2BAA2B,yBAAyB,kBAAkB;AAiD5E,SAAgB,OAAO,MAAiC;CACvD,MAAM,eACL,QAAS,EAAE,UAAA,OAA+B;AAC3C,KAAI,aAAa,aAAA,OAAkC;EAqBlD,MAAM,cAAc,iBAAiB,cAAc,EAAE,CAAU;EAC/D,MAAM,YAA6C,mBAClD,iBAAiB;GAAE,GAAG;GAAc,UAAU;GAAgB,EAAE,eAAe;AAC/E,cAAmD,8BAA8B;AAClF,SAAO;;AAER,QAAO,iBAAiB,cAAc,aAAa,SAAS;;AAG7D,SAAS,iBACR,MACA,UACC;CAQD,MAAM,eAAe,CAAC,aAAa,GAAG,SAAS;CAK/C,MAAM,eAAwC;EAAE,GAAG;EAAM;EAAU;AAEnE,QAAO,aAAa;EACnB,IAAI,eAAe;EACnB,WAAW;EAIX,MAAM;EACN,QAAQ,SACP,OAAO,IAAI,aAAa;GAUvB,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GACrB,MAAM,aAAa,OAAO;GAI1B,MAAM,GAAG,GAAG,oBAAoB;GAChC,MAAM,mBAAmB,OAAO,eAAe,UAAA,MAA4B,CAAC,KAC3E,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;IACN,CAAC,CACF,EACD,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,0CAA0C,IAAI;IACvD,OAAO;IACP,CAAC,CACF,CACD;GACD,MAAM,kBAAkB,OAAO,eAC9B,UAAA,MAEA,CAAC,KACD,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;IACN,CAAC,CACF,EACD,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,8CAA8C,IAAI;IAC3D,OAAO;IACP,CAAC,CACF,CACD;AAqCD,UAAO,OAAO,cAAc,cAAc;IAlCzC,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,OAAO,SAAS;IAChB,WAAW,MAAM;IACjB,sBAAsB;IACtB,eAAe,WAAW,cACzB,WACE,SAAS;KACT,MAAM;KACN,eAAe;KACf,GAAI,cAAc,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW;KAChD,CAAC,CACD,KACA,OAAO,KAAK,UAAU,MAAM,KAAK,EACjC,OAAO,UAAU,QAChB,gBAAgB;KACf,OAAO;KACP,SAAS,gCAAgC,IAAI;KAC7C,MACC,IAAI,WAAW,mBACZ,mGACA,IAAI,WAAW,iBACd,6FACA;KACL,OAAO;KACP,CAAC,CACF,CACD;IACH,uBAAuB,OAAO,QAAQ,iBAAiB;IACvD;IACA;IACA,eAAe,KAAA;IAGoC,CAAC;IACpD;EACH,oBAAoB;EAMpB,eAAe,EAAE,OAAO,UAAU,SAAS,iBAAiB;AAQ3D,UAAO;IAPU,wBAOD;IANA,kBAAkB,SAAS,SAMlB;IALR,mBAAmB;KACnC,KAAK,WAAW,SAAS;KACzB,OAAO,WAAW,SAAS;KAC3B,MAAM,SAAS;KACf,CACkC;IAAC;;EAErC,CAAC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/wallet/index.ts"],"sourcesContent":["// Wallet plugin — barrel + `wallet(opts?)` factory.\n//\n// Architecture (15-wallet.md):\n//\n//   The wallet bridges devstack (the supervisor host) and the\n//   browser-side dev-wallet adapter (in the separate `dev-wallet`\n//   package). Two parts:\n//\n//     1. The IN-PROCESS HTTP server. Owned here. Boot at acquire,\n//        serve `/api/v1/devstack/*` routes (health, accounts,\n//        sign-transaction, sign-personal-message).\n//\n//     2. The BROWSER-SIDE ADAPTER. Owned by `dev-wallet`. Reads the\n//        codegen-emitted `dapp-kit/config.ts`, constructs a\n//        `DevstackSignerAdapter`, registers it with `@mysten/dapp-\n//        kit`'s wallet-standard surface.\n//\n//   The HTTP protocol is the ONE cross-boundary contract. THIS PACKAGE\n//   NEVER IMPORTS `@mysten/dapp-kit*` OR `@mysten/wallet-standard`.\n//\n// Capabilities emitted:\n//\n//   1. Snapshotable — pairing token under `wallet/token`.\n//   2. Codegenable — `dapp-kit-config` bindings (the dev-wallet\n//      adapter consumes this). Sensitive flag set — 0o600 + gitignore.\n//   3. Routable — wallet UI URL on the stack-scoped router.\n\nimport { Effect } from 'effect';\n\nimport { definePlugin, resource } from '../../api/define-plugin.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { attachPluginExpander } from '../../contracts/plugin-expander.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport {\n\tDEFAULT_PORT_WINDOW,\n\tPortBrokerService,\n} from '../../substrate/runtime/port-broker/index.ts';\nimport { renderUrl, routedHostname } from '../../substrate/runtime/routed-url.ts';\nimport { suiResource } from '../sui/index.ts';\nimport type { AccountResourceId } from '../account/index.ts';\nimport {\n\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\tHOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n} from '../host-service/index.ts';\n\nimport { makeWalletCodegen } from './codegen.ts';\nimport { WALLET_ERROR_TAGS, walletBootError } from './errors.ts';\nimport { makeWalletRoutable, WALLET_ENTRYPOINT_PORT, WALLET_ROUTE_ROLE } from './routable.ts';\nimport { makeWalletSnapshotable } from './snapshot.ts';\nimport {\n\tacquireWallet,\n\tWALLET_ACCOUNTS_ALL,\n\ttype WalletAcquireContext,\n\ttype WalletAccountMember,\n\ttype WalletOptions,\n\ttype WalletValue,\n} from './service.ts';\nimport type { AnyPlugin } from '../../substrate/plugin.ts';\n\n/** Wallet's expander contributes through the substrate-owned\n *  `PluginExpander` contract (`contracts/plugin-expander.ts`). The\n *  composer dispatches every member's expander uniformly — wallet has\n *  no special-case wiring in `api/define-devstack.ts`.\n *\n *  Compose-time symmetry: any plugin needing the \"rewrite this\n *  placeholder once the full member tuple is known\" rewrite uses the\n *  same `attachPluginExpander(...)` seam wallet uses below. */\n\nconst ACCOUNT_RESOURCE_ID_PREFIX = 'account/' as const;\n\n/** Type-narrowing predicate on a plugin's resource id. The account\n *  plugin's `AccountResourceId<Name>` template-literal type IS the\n *  substrate-owned discriminator (12-account.md \"resource id flows into\n *  the on-disk path, the manifest key, container labels, and generated\n *  TypeScript exports\") — every account member's `id` reduces to\n *  `account/${Name}`. Probing through this typed predicate (vs. a bare\n *  `startsWith` whose narrowing returns `string`) prevents misclassifying\n *  a future plugin whose id happens to start with `account/` but is NOT\n *  the account-plugin shape, AND surfaces a compile error if the\n *  account-id prefix convention ever changes. */\nconst isAccountResourceMember = (\n\tmember: AnyPlugin,\n): member is AnyPlugin & { readonly id: AccountResourceId<string> } =>\n\tmember.id.startsWith(ACCOUNT_RESOURCE_ID_PREFIX);\n\n// ----------------------------------------------------------------------\n// Resource identity\n// ----------------------------------------------------------------------\n\n/** The wallet plugin's resource identity. ONE per stack (15-wallet.md\n *  \"singleton per stack\"). The id is `'wallet'` (singular). */\nconst walletResource = resource<'wallet', WalletValue>('wallet');\nconst walletErrorContributions = pluginErrorContributions(WALLET_ERROR_TAGS);\n\n// ----------------------------------------------------------------------\n// User-facing factory\n// ----------------------------------------------------------------------\n\n/**\n * Construct the wallet plugin.\n *\n * Two parts of the wallet:\n *\n *   - HERE: HTTP server + token + pairing protocol + codegen.\n *   - DEV-WALLET PACKAGE: `@mysten/dapp-kit`-shaped adapter the\n *     user-app's frontend bundle imports.\n *\n *  Distilled-doc invariant (15-wallet.md \"Always explicit\"): the\n *  composer NEVER auto-mounts the wallet. The user calls `wallet()`,\n *  `wallet({ accounts: 'all' })`, or `wallet({ accounts: [alice, bob] })`\n *  and passes the result to `defineDevstack(...)`.\n *\n *  ### Security defaults\n *\n *   - `bindAddress: '0.0.0.0'`. The router runs in Docker, so on\n *     native Linux it reaches this host process through the Docker\n *     host-gateway address instead of host loopback. The published\n *     wallet URL remains stack-scoped through the router.\n *\n *   - Origin allowlist is the router-fronted dev-server origin for\n *     this stack plus any explicit `allowedOrigins`. The wallet does\n *     not auto-allowlist a bare `http://localhost:<vite-port>` form —\n *     `localhost` is not stack-scoped, so a sibling stack on the same\n *     port could pair with this wallet. See `origin-policy.ts`.\n *\n *   - Pairing token in URL fragment only (`#token=<32-hex>`). Never\n *     in query params (would land in access logs / referrers).\n *\n *   - Constant-time bearer compare on every request.\n *\n *   - Token file `0o600`. Codegen output (`dapp-kit/config.ts`)\n *     `0o600` + gitignored via `sensitive: true`.\n */\nexport function wallet<const Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: Accounts },\n): ReturnType<typeof makeWalletMember<Accounts>>;\nexport function wallet(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: typeof WALLET_ACCOUNTS_ALL },\n): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(opts?: WalletOptions): AnyPlugin {\n\tconst resolvedOpts: WalletOptions =\n\t\topts ?? ({ accounts: WALLET_ACCOUNTS_ALL } satisfies WalletOptions);\n\tif (resolvedOpts.accounts === WALLET_ACCOUNTS_ALL) {\n\t\t// Deferred placeholder. `dependsOn` carries only `[suiResource]` —\n\t\t// the composer rewrites the member once it knows which account\n\t\t// members are in the stack (api-surface-design §4 D6). Without\n\t\t// composer expansion, the wallet would race account funding;\n\t\t// WITH composer expansion, every per-account dependency edge is\n\t\t// in place by the time the dep-graph builds.\n\t\t//\n\t\t// Type-level: the placeholder's `dependsOn` is `[suiResource]`. A\n\t\t// wider `ReadonlyArray<account/${string}>` would widen the\n\t\t// stack-level `MissingProviders` check to the template literal\n\t\t// (which never reduces to any concrete `account/<name>`), so\n\t\t// the placeholder MUST stay narrow.\n\t\t//\n\t\t// Runtime: the symbol-keyed expander is attached as a value-\n\t\t// only property; the factory's declared return type\n\t\t// intentionally does NOT surface it (a `unique symbol`-keyed\n\t\t// member field would leak into the user's inferred Stack type\n\t\t// and trigger TS2742 \"type cannot be named without a reference\n\t\t// to ./node_modules/.../plugins/wallet\" at every example's\n\t\t// default export).\n\t\tconst placeholder = makeWalletMember(resolvedOpts, [] as const);\n\t\tattachPluginExpander(placeholder, (members) => {\n\t\t\t// Filter the full composed member tuple to the per-account\n\t\t\t// resource members the wallet would otherwise have to receive\n\t\t\t// at factory call. `isAccountResourceMember` narrows on the\n\t\t\t// `AccountResourceId<Name>` template-literal type — the typed\n\t\t\t// discriminator the account plugin's barrel exposes via\n\t\t\t// `AccountResourceId<Name>` — so a future plugin whose id\n\t\t\t// accidentally starts with `account/` cannot masquerade.\n\t\t\tconst accountMembers: Array<WalletAccountMember> = [];\n\t\t\tfor (const m of members) {\n\t\t\t\tif (isAccountResourceMember(m)) {\n\t\t\t\t\taccountMembers.push(m as unknown as WalletAccountMember);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn makeWalletMember({ ...resolvedOpts, accounts: accountMembers }, accountMembers);\n\t\t});\n\t\treturn placeholder;\n\t}\n\treturn makeWalletMember(resolvedOpts, resolvedOpts.accounts);\n}\n\nfunction makeWalletMember<Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: WalletOptions,\n\taccounts: Accounts,\n) {\n\t// Dependencies MUST include every account ref (15-wallet.md\n\t// \"upstreamKeys MUST include suiResource.id + every account id\" — same\n\t// load-bearing invariant). The substrate's topological scheduler\n\t// uses `dependsOn` to drive build order; without including the\n\t// account refs here, the wallet would race account funding and the\n\t// first `signTransaction` would fail with `address-not-found`.\n\t//\n\tconst dependencies = [suiResource, ...accounts] as const;\n\n\t// The resolved-opts shape acquireWallet sees has accounts pinned to\n\t// the resolved tuple — `'all'` is purely a user-surface convenience\n\t// the composer never propagates to the supervisor.\n\tconst resolvedOpts: WalletOptions<Accounts> = { ...opts, accounts };\n\n\treturn definePlugin({\n\t\tid: walletResource.id,\n\t\tdependsOn: dependencies,\n\t\t// The HTTP server is a long-lived host process; per-request\n\t\t// handlers fork off the supervisor-context fiber but the server\n\t\t// itself lives for the stack's lifetime.\n\t\trole: 'service',\n\t\tsection: 'service',\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\t// Pull identity, the stack-paths bundle, and the port-\n\t\t\t\t// broker from the supervisor-provided substrate context.\n\t\t\t\t// `StackPathsService.stackRoot` is the on-disk root for\n\t\t\t\t// per-stack runtime artifacts (incl. `wallet/token`); the\n\t\t\t\t// port broker is per-stack (Layer-driven, one instance per\n\t\t\t\t// stack scope); the wallet's scope hangs off the\n\t\t\t\t// supervisor's `acquireScope`, so any release finalizer\n\t\t\t\t// installed by these primitives unwinds with the rest of\n\t\t\t\t// the plugin's resources on cycle / teardown.\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst paths = yield* StackPathsService;\n\t\t\t\tconst portBroker = yield* PortBrokerService;\n\n\t\t\t\t// The first dependency is the hard Sui ordering edge; the\n\t\t\t\t// remaining values mirror the explicit account tuple.\n\t\t\t\tconst [, ...resolvedAccounts] = deps;\n\t\t\t\tconst routerFrontedUrl = yield* routedHostname(identity, WALLET_ROUTE_ROLE).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: WALLET_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet router URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst routedAppOrigin = yield* routedHostname(\n\t\t\t\t\tidentity,\n\t\t\t\t\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet app-origin URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst acquireCtx: WalletAcquireContext = {\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tchain: identity.chain,\n\t\t\t\t\tstateRoot: paths.stackRoot,\n\t\t\t\t\tallocatePort: (preferred, probeHost) =>\n\t\t\t\t\t\tportBroker\n\t\t\t\t\t\t\t.allocate({\n\t\t\t\t\t\t\t\towner: 'wallet',\n\t\t\t\t\t\t\t\t// Pin the wallet's UX-meaningful range so the dev wallet\n\t\t\t\t\t\t\t\t// adapter's auto-connect-port heuristic keeps working even\n\t\t\t\t\t\t\t\t// after a fallback scan. The broker scan window is half-open\n\t\t\t\t\t\t\t\t// `[start, start + size)`, so `DEFAULT_PORT_WINDOW`\n\t\t\t\t\t\t\t\t// (start 39200, size 1000) covers 39200..40199 inclusive.\n\t\t\t\t\t\t\t\t// Reuse the broker's exported default rather than a local\n\t\t\t\t\t\t\t\t// literal so the two cannot silently drift (pinned by\n\t\t\t\t\t\t\t\t// `test/plugins/wallet/port-window-pin.test.ts`).\n\t\t\t\t\t\t\t\twindowHint: DEFAULT_PORT_WINDOW,\n\t\t\t\t\t\t\t\tpreferredPort: preferred,\n\t\t\t\t\t\t\t\t...(probeHost === undefined ? {} : { probeHost }),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\t\tEffect.map((alloc) => alloc.port),\n\t\t\t\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\t\t\t\tphase: 'allocate-port',\n\t\t\t\t\t\t\t\t\t\tmessage: `port-broker allocate failed: ${err.detail}`,\n\t\t\t\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t\t\t\terr.reason === 'preferred-busy'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'another plugin in this stack is using your preferred port; omit `port` to let the broker pick.'\n\t\t\t\t\t\t\t\t\t\t\t\t: err.reason === 'no-free-port'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'the wallet port window is exhausted; check for stray devstack supervisors holding ports.'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'bind-probe failed — likely a privileged port or jail restriction.',\n\t\t\t\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\tresolveAccounts: () => Effect.succeed(resolvedAccounts),\n\t\t\t\t\trouterFrontedUrl,\n\t\t\t\t\troutedAppOrigin,\n\t\t\t\t};\n\n\t\t\t\treturn yield* acquireWallet(resolvedOpts, acquireCtx);\n\t\t\t}),\n\t\terrorContributions: walletErrorContributions,\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `WalletValue` + acquire context. Stamps the real dapp-kit\n\t\t// bindings (walletUrl, pairUrl, chain id, paths) into the\n\t\t// codegen decl, and the real identity app/stack into the\n\t\t// routable decl.\n\t\tcapabilities: ({ value: resolved, runtime: acquireCtx }) => {\n\t\t\tconst snapshot = makeWalletSnapshotable();\n\t\t\tconst codegen = makeWalletCodegen(resolved.bindings);\n\t\t\tconst routable = makeWalletRoutable({\n\t\t\t\tapp: acquireCtx.identity.app,\n\t\t\t\tstack: acquireCtx.identity.stack,\n\t\t\t\tport: resolved.localPort,\n\t\t\t});\n\t\t\treturn [snapshot, codegen, routable] as const;\n\t\t},\n\t});\n}\n\n// ----------------------------------------------------------------------\n// Re-exports\n// ----------------------------------------------------------------------\n\nexport type {\n\tWalletOptions,\n\tWalletValue,\n\tWalletAccountMember,\n\tWalletAccountsAll,\n} from './service.ts';\nexport { WALLET_ACCOUNTS_ALL } from './service.ts';\nexport type { DappKitConfigBindings } from './codegen.ts';\nexport {\n\tWalletHttpPath,\n\tWALLET_PROTOCOL_PREFIX,\n\tWALLET_AUTH_HEADER,\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tHealthResponseSchema,\n\tAccountsResponseSchema,\n\tAccountSummarySchema,\n\tErrorResponseSchema,\n\tSuiAddressSchema,\n\tBase64Schema,\n\tSignatureSchemeSchema,\n\tAccountSourceSchema,\n\ttype WalletHttpPathValue,\n\ttype SignRequest,\n\ttype SignResponse,\n\ttype HealthResponse,\n\ttype AccountsResponse,\n\ttype AccountSummary,\n\ttype ErrorResponse,\n} from './protocol.ts';\nexport type {\n\tWalletError,\n\tWalletBootError,\n\tWalletBootPhase,\n\tWalletRequestError,\n\tWalletRequestPhase,\n} from './errors.ts';\nexport { WALLET_ERROR_TAGS } from './errors.ts';\nexport type { OriginPolicy, OriginPolicyInputs, OriginCheckResult } from './origin-policy.ts';\nexport { resolveOriginPolicy, checkOrigin, corsHeadersFor } from './origin-policy.ts';\nexport type { PairingToken } from './pairing.ts';\nexport {\n\tmintToken,\n\tacquirePairingToken,\n\ttokenPath,\n\tcomposePairUrl,\n\tparsePairUrl,\n\tparseBearerHeader,\n\tsafeBearerEquals,\n\tredactToken,\n} from './pairing.ts';\nexport { WALLET_ENDPOINT_NAME, WALLET_ENDPOINT_KEY, makeWalletRoutable } from './routable.ts';\nexport { WalletSpans } from './spans.ts';\nexport {\n\tdispatch,\n\tstartHttpServer,\n\tMAX_BODY_BYTES,\n\ttype WalletRequest,\n\ttype WalletResponse,\n\ttype WalletServerConfig,\n\ttype WalletServerHandle,\n} from './server.ts';\nexport { makeWalletCodegen } from './codegen.ts';\nexport { makeWalletSnapshotable } from './snapshot.ts';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,MAAM,6BAA6B;;;;;;;;;;;AAYnC,MAAM,2BACL,WAEA,OAAO,GAAG,WAAW,2BAA2B;;;AAQjD,MAAM,iBAAiB,SAAgC,SAAS;AAChE,MAAM,2BAA2B,yBAAyB,kBAAkB;AAgD5E,SAAgB,OAAO,MAAiC;CACvD,MAAM,eACL,QAAS,EAAE,UAAA,OAA+B;AAC3C,KAAI,aAAa,aAAA,OAAkC;EAqBlD,MAAM,cAAc,iBAAiB,cAAc,EAAE,CAAU;AAC/D,uBAAqB,cAAc,YAAY;GAQ9C,MAAM,iBAA6C,EAAE;AACrD,QAAK,MAAM,KAAK,QACf,KAAI,wBAAwB,EAAE,CAC7B,gBAAe,KAAK,EAAoC;AAG1D,UAAO,iBAAiB;IAAE,GAAG;IAAc,UAAU;IAAgB,EAAE,eAAe;IACrF;AACF,SAAO;;AAER,QAAO,iBAAiB,cAAc,aAAa,SAAS;;AAG7D,SAAS,iBACR,MACA,UACC;CAQD,MAAM,eAAe,CAAC,aAAa,GAAG,SAAS;CAK/C,MAAM,eAAwC;EAAE,GAAG;EAAM;EAAU;AAEnE,QAAO,aAAa;EACnB,IAAI,eAAe;EACnB,WAAW;EAIX,MAAM;EACN,SAAS;EACT,QAAQ,SACP,OAAO,IAAI,aAAa;GAUvB,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GACrB,MAAM,aAAa,OAAO;GAI1B,MAAM,GAAG,GAAG,oBAAoB;GAChC,MAAM,mBAAmB,OAAO,eAAe,UAAA,MAA4B,CAAC,KAC3E,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;IACN,CAAC,CACF,EACD,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,0CAA0C,IAAI;IACvD,OAAO;IACP,CAAC,CACF,CACD;GACD,MAAM,kBAAkB,OAAO,eAC9B,UAAA,MAEA,CAAC,KACD,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;IACN,CAAC,CACF,EACD,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,8CAA8C,IAAI;IAC3D,OAAO;IACP,CAAC,CACF,CACD;AA4CD,UAAO,OAAO,cAAc,cAAc;IAzCzC,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,OAAO,SAAS;IAChB,WAAW,MAAM;IACjB,eAAe,WAAW,cACzB,WACE,SAAS;KACT,OAAO;KASP,YAAY;KACZ,eAAe;KACf,GAAI,cAAc,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW;KAChD,CAAC,CACD,KACA,OAAO,KAAK,UAAU,MAAM,KAAK,EACjC,OAAO,UAAU,QAChB,gBAAgB;KACf,OAAO;KACP,SAAS,gCAAgC,IAAI;KAC7C,MACC,IAAI,WAAW,mBACZ,mGACA,IAAI,WAAW,iBACd,6FACA;KACL,OAAO;KACP,CAAC,CACF,CACD;IACH,uBAAuB,OAAO,QAAQ,iBAAiB;IACvD;IACA;IAGmD,CAAC;IACpD;EACH,oBAAoB;EAMpB,eAAe,EAAE,OAAO,UAAU,SAAS,iBAAiB;AAQ3D,UAAO;IAPU,wBAOD;IANA,kBAAkB,SAAS,SAMlB;IALR,mBAAmB;KACnC,KAAK,WAAW,SAAS;KACzB,OAAO,WAAW,SAAS;KAC3B,MAAM,SAAS;KACf,CACkC;IAAC;;EAErC,CAAC"}

package/dist/plugins/wallet/origin-policy.mjs

@@ -4,45 +4,29 @@ import { Effect } from "effect";
 /**
 * Resolve the per-stack origin allowlist.
 *
-*  - Always allowlisted: the stack-scoped router host
-*    `http://dev.<stack>.<app>.localhost:<vite-port>`, IF the broker recorded
-*    a vite port for this stack.
-*  - Conditionally allowlisted: the bare `http://localhost:<vite-port>`
-*    form. Off by default; on iff `allowLocalhostVite` is true.
+*  - Always allowlisted: the router-fronted dev-server origin for this
+*    stack (`routedAppOrigin`), when the router derivation produced one.
 *  - Always allowlisted: any explicit caller-supplied origins from
 *    `extraOrigins`.
 *
-* Empty-allowlist policy (vite absent AND no `extraOrigins`): allowed.
-* The wallet boots normally; with an empty allowlist the per-request
-* gate refuses every request (every Origin lands in `forbidden`). This
-* is the correct behavior for a stack composed without any client UI
-* (e.g. node-only smoke / e2e configs) — the wallet's keypair + token
-* are still useful for the host process, but the HTTP surface is
-* effectively closed. A `Effect.logWarning` surfaces the configuration
-* for operator visibility.
-*
-* Returns `Effect<OriginPolicy, WalletBootError>` (the error channel
-* is preserved for future fail-fast modes the resolver may grow).
+* Empty-allowlist policy (no `routedAppOrigin` AND no `extraOrigins`):
+* allowed. The wallet boots normally; with an empty allowlist the
+* per-request gate refuses every request (every Origin lands in
+* `forbidden`). This is the correct behavior for a stack composed
+* without any client UI (e.g. node-only smoke / e2e configs) — the
+* wallet's keypair + token are still useful for the host process, but
+* the HTTP surface is effectively closed. A `Effect.logWarning`
+* surfaces the configuration for operator visibility.
 */
 const resolveOriginPolicy = (inputs) => Effect.gen(function* () {
 	const allowed = /* @__PURE__ */ new Set();
-	const stackScopedHost = inputs.stack === "main" ? `dev.${inputs.app}.localhost` : `dev.${inputs.stack}.${inputs.app}.localhost`;
-	if (inputs.vitePortForThisStack !== null) {
-		allowed.add(`http://${stackScopedHost}:${inputs.vitePortForThisStack}`);
-		if (inputs.allowLocalhostVite) allowed.add(`http://localhost:${inputs.vitePortForThisStack}`);
-	}
 	if (inputs.routedAppOrigin !== null) allowed.add(inputs.routedAppOrigin);
 	for (const o of inputs.extraOrigins) allowed.add(o);
 	if (allowed.size === 0) yield* Effect.logWarning("wallet origin allowlist is empty").pipe(Effect.annotateLogs({
 		[SpanAttr.app]: inputs.app,
-		[SpanAttr.stack]: inputs.stack,
-		[SpanAttr.walletLocalhostViteEnabled]: inputs.allowLocalhostVite
+		[SpanAttr.stack]: inputs.stack
 	}));
-	return {
-		allowed,
-		localhostViteEnabled: inputs.allowLocalhostVite,
-		stackScopedHost
-	};
+	return { allowed };
 });
 const checkOrigin = (policy, headerValue) => {
 	if (headerValue === void 0 || headerValue.length === 0) return "missing";