@mysten-incubation/devstack 0.0.1 → 0.1.1

package/dist/plugins/account/index.mjs

@@ -1,10 +1,12 @@
 import { definePlugin, resource } from "../../substrate/plugin.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import "../../api/define-plugin.mjs";
 import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
+import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import { SuiSpans } from "../sui/spans.mjs";
 import { suiResource } from "../sui/index.mjs";
+import { AccountSpans } from "./spans.mjs";
 import { makeAccountCodegen } from "./codegen.mjs";
-import { ACCOUNT_ERROR_TAGS } from "./errors.mjs";
+import { ACCOUNT_ERROR_TAGS, accountAcquireError } from "./errors.mjs";
 import { SUI_FULL_COIN_TYPE } from "./funding.mjs";
 import { makeAccountProjectionContribution, makeAccountRegistryContribution } from "./registry.mjs";
 import { makeAccountSnapshotable } from "./snapshot.mjs";
@@ -18,13 +20,28 @@ const fundingProviders = (provider) => {
 	if (provider === void 0) return [];
 	return Array.isArray(provider) ? provider : [provider];
 };
-const fundingAmountToBigInt = (amount) => {
+/** Validate a SUI funding amount and project it to bigint MIST.
+*  Returns a typed-error Effect so a bad amount surfaces as
+*  `AccountAcquireError(phase: 'validate-funding')` on the failure
+*  channel — NOT a synchronous throw lifted to a defect when called
+*  from inside the acquire body's `Effect.gen`. */
+const fundingAmountToBigInt = (amount, accountName) => {
 	if (typeof amount === "bigint") {
-		if (amount < 0n) throw new TypeError(`SUI funding amount must be a non-negative integer in MIST.`);
-		return amount;
+		if (amount < 0n) return Effect.fail(accountAcquireError({
+			phase: "validate-funding",
+			accountName,
+			variant: "ephemeral",
+			message: `Account '${accountName}': SUI funding amount must be a non-negative integer in MIST (got ${amount}).`
+		}));
+		return Effect.succeed(amount);
 	}
-	if (!Number.isSafeInteger(amount) || amount < 0) throw new TypeError(`SUI funding amount must be a non-negative safe integer in MIST.`);
-	return BigInt(amount);
+	if (!Number.isSafeInteger(amount) || amount < 0) return Effect.fail(accountAcquireError({
+		phase: "validate-funding",
+		accountName,
+		variant: "ephemeral",
+		message: `Account '${accountName}': SUI funding amount must be a non-negative safe integer in MIST (got ${amount}).`
+	}));
+	return Effect.succeed(BigInt(amount));
 };
 const coinLabelFor = (coin) => coin.symbol ?? coin.fullCoinType.split("::").at(-1) ?? coin.fullCoinType;
 const account = (name, opts) => {
@@ -50,26 +67,33 @@ const account = (name, opts) => {
 		id: accountRef.id,
 		dependsOn: dependencies,
 		role: "task",
+		section: "account",
 		start: (deps) => Effect.gen(function* () {
 			const [sui, ...resolvedDeps] = deps;
 			const resolvedCoinValues = resolvedDeps.slice(0, coinFundingEntries.length);
 			const identity = yield* IdentityContext;
 			const paths = yield* StackPathsService;
 			let coinIndex = 0;
-			const projectedFunding = fundingEntryList.map((entry) => {
-				if (entry.coin === "sui") return {
-					coin: "SUI",
-					fullCoinType: SUI_FULL_COIN_TYPE,
-					amount: fundingAmountToBigInt(entry.amount)
-				};
+			const projectedFundingMutable = [];
+			for (const entry of fundingEntryList) {
+				if (entry.coin === "sui") {
+					const amount = yield* fundingAmountToBigInt(entry.amount, name);
+					projectedFundingMutable.push({
+						coin: "SUI",
+						fullCoinType: SUI_FULL_COIN_TYPE,
+						amount
+					});
+					continue;
+				}
 				const resolvedCoin = resolvedCoinValues[coinIndex];
 				coinIndex += 1;
-				return {
+				projectedFundingMutable.push({
 					coin: coinLabelFor(resolvedCoin),
 					fullCoinType: resolvedCoin.fullCoinType,
 					amount: entry.amount
-				};
-			});
+				});
+			}
+			const projectedFunding = projectedFundingMutable;
 			return yield* acquireAccount(opts2, {
 				sui: {
 					mode: sui.mode,
@@ -81,10 +105,10 @@ const account = (name, opts) => {
 				app: identity.app,
 				stack: identity.stack,
 				emitAutoPromotionEvent: () => Effect.logWarning("account funding auto-promoted for fork mode").pipe(Effect.annotateLogs({
-					[SpanAttr.accountName]: name,
-					[SpanAttr.accountFundingFrom]: "faucet",
-					[SpanAttr.accountFundingTo]: "pay-from-seed-via-impersonate",
-					[SpanAttr.suiMode]: "fork"
+					[AccountSpans.name]: name,
+					[AccountSpans.fundingFrom]: "faucet",
+					[AccountSpans.fundingTo]: "pay-from-seed-via-impersonate",
+					[SuiSpans.mode]: "fork"
 				})),
 				projectedFunding
 			});
@@ -121,6 +145,10 @@ const account = (name, opts) => {
 		}
 	});
 };
+/** @internal — exported only for the projection regression test
+*  (`test/plugins/account/funding-projection.test.ts`). Projects the runtime
+*  `AccountFundingResult` (requested + applied) into the registry's
+*  per-row funded/already-satisfied/skipped status. */
 const fundingProjectionForResult = (funding) => {
 	if (funding.requested.length === 0) return {
 		status: "skipped",
@@ -128,23 +156,28 @@ const fundingProjectionForResult = (funding) => {
 		requestedMist: null,
 		entries: []
 	};
-	const appliedKeys = new Set(funding.applied.map(fundingEntryKey));
-	const entries = funding.requested.map((entry) => ({
-		coin: entry.coin,
-		fullCoinType: entry.fullCoinType,
-		amount: entry.amount.toString(),
-		status: appliedKeys.has(fundingEntryKey(entry)) ? "funded" : "skipped"
-	}));
+	let appliedCursor = 0;
+	const entries = funding.requested.map((entry) => {
+		const candidate = funding.applied[appliedCursor];
+		const matches = candidate !== void 0 && candidate.fullCoinType === entry.fullCoinType && candidate.amount === entry.amount;
+		const outcome = matches ? candidate.outcome : void 0;
+		if (matches) appliedCursor += 1;
+		return {
+			coin: entry.coin,
+			fullCoinType: entry.fullCoinType,
+			amount: entry.amount.toString(),
+			status: outcome === "funded" ? "funded" : outcome === "already-satisfied" ? "already-satisfied" : "skipped"
+		};
+	});
 	const requestedMist = funding.requested.find((entry) => entry.fullCoinType === "0x2::sui::SUI")?.amount.toString() ?? null;
-	const fundedCount = entries.filter((entry) => entry.status === "funded").length;
+	const settledCount = entries.filter((entry) => entry.status === "funded" || entry.status === "already-satisfied").length;
 	return {
-		status: fundedCount === entries.length ? "funded" : fundedCount === 0 ? "skipped" : "unknown",
+		status: settledCount === entries.length ? "funded" : settledCount === 0 ? "skipped" : "unknown",
 		balanceMist: null,
 		requestedMist,
 		entries
 	};
 };
-const fundingEntryKey = (entry) => `${entry.fullCoinType}:${entry.amount}`;
 //#endregion
 export { account };
 

package/dist/plugins/account/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/account/index.ts"],"sourcesContent":["// Account plugin — barrel + `account(name, opts?)` factory.\n//\n// Architecture (12-account.md): Account is the named-identity layer\n// for devstack. It acquires a keypair (or impersonation slot), funds\n// it (default + cross-cutting), registers `{name, address}`, and\n// publishes a per-account resolved value via a unique resource id.\n//\n// User-facing factory shape:\n//\n//   account('alice')                                  // default ephemeral\n//   account('alice', { kind: 'ephemeral', funding: [{ coin: 'sui', amount: 5_000_000_000n }] })\n//   account('alice', { kind: 'keystore', path: '~/.sui/keystore', aliasOrAddress: 'alice' })\n//   account('alice', { kind: 'env',      key: 'ALICE_PRIVATE_KEY' })\n//   account('alice', { kind: 'inline',   privateKey: 'suiprivkey1...' })\n//   account('alice', { kind: 'signer',   signer: hardwareWallet })\n//   account('alice', { kind: 'impersonate', address: '0xabc...' })\n//\n// **Bare-form default**: `account('alice')` is shorthand for\n//\n//   { kind: 'ephemeral' } plus default SUI funding.\n//\n// Distilled-doc invariant (12-account.md \"Make the bare-form auto-\n// promotion to fork-impersonate funding discoverable\"): on fork-\n// runtime Sui, the default-funding pass internally promotes from\n// \"faucet POST\" to \"pay-from-seed-via-impersonate\" because no\n// faucet exists on a fork. The promotion is LOUD by default — we\n// emit a `log.appended` event the first time the promotion fires\n// (see `funding.ts`).\n//\n// The plugin emits THREE capability decls + an error-tag contribution:\n//\n//   1. Snapshotable        — secret-material subtree (ephemeral only).\n//   2. Codegenable         — `account-map` bindings (name → address).\n//   3. StrategyContributor — per-stack `account:<name>` registry entry.\n//\n// Plus `errorContributions: [{ errorTags: ACCOUNT_ERROR_TAGS }]` —\n// harvested by the supervisor into the FormatterRegistry so the\n// cascade formatter renders account-tagged failures with the right\n// taxonomy header.\n\nimport { Effect } from 'effect';\n\nimport { definePlugin, resource, type AnyResourceRef } from '../../api/define-plugin.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { suiResource } from '../sui/index.ts';\n\nimport { makeAccountCodegen, type AccountBindings } from './codegen.ts';\nimport { ACCOUNT_ERROR_TAGS } from './errors.ts';\nimport {\n\tSUI_FULL_COIN_TYPE,\n\ttype AccountFunding,\n\ttype AccountFundingEntry,\n\ttype AccountFundingResult,\n\ttype CrossCuttingFundingEntry,\n\ttype CrossCuttingFundingProvider,\n\ttype CoinMember,\n\ttype ProjectedFundingEntry,\n} from './funding.ts';\nimport {\n\tmakeAccountProjectionContribution,\n\tmakeAccountRegistryContribution,\n\ttype AccountRegistryEntry,\n\ttype AccountRegistryFunding,\n} from './registry.ts';\nimport { makeAccountSnapshotable } from './snapshot.ts';\nimport {\n\tacquireAccount,\n\tassertAccountName,\n\ttype AccountAcquireContext,\n\ttype AccountOptions,\n\ttype ResolvedAccountOptions,\n\ttype AccountValue,\n} from './service.ts';\n\nconst accountErrorContributions = pluginErrorContributions(ACCOUNT_ERROR_TAGS);\n\n// ---------------------------------------------------------------------------\n// Resource construction\n// ---------------------------------------------------------------------------\n\n/** Per-account-instance resource. The substrate's resource id MUST be unique\n *  across the stack — we encode the account name as a literal-typed\n *  template literal so the compiler catches duplicate-name composes\n *  at the `defineDevstack` call site.\n *\n *  Distilled-doc invariant: resource id flows into the on-disk path, the\n *  manifest key, container labels, and generated TypeScript exports —\n *  the identifier-safe name validation (in `service.ts`) protects\n *  those call sites. */\nexport type AccountResourceId<Name extends string> = `account/${Name}`;\n\nconst accountResource = <Name extends string>(name: Name) =>\n\tresource<AccountResourceId<Name>, AccountValue>(`account/${name}` as AccountResourceId<Name>);\n\n// ---------------------------------------------------------------------------\n// User-facing factory\n// ---------------------------------------------------------------------------\n\n/** Construct the account plugin instance.\n *\n *  Variants — typed at the API boundary via the discriminated\n *  `AccountOptions` union. The factory's second arg is OPTIONAL —\n *  omitting it yields the bare-form default (ephemeral + default\n *  funding). Passing a non-matching `kind:` is a compile error\n *  thanks to the union's discriminator.\n *\n *  Distilled-doc invariant: the name is validated at the FACTORY\n *  boundary (not just at acquire time) so a typo surfaces\n *  immediately, not at runtime. */\ntype FundingCoinDependencies<Entries extends readonly unknown[]> = Entries extends readonly [\n\tinfer Head,\n\t...infer Tail,\n]\n\t? Head extends { readonly coin: infer Coin }\n\t\t? Coin extends CoinMember\n\t\t\t? readonly [Coin, ...FundingCoinDependencies<Tail>]\n\t\t\t: FundingCoinDependencies<Tail>\n\t\t: FundingCoinDependencies<Tail>\n\t: readonly [];\n\ntype FundingProviderDependenciesFor<Provider> = Provider extends readonly AnyResourceRef[]\n\t? Provider\n\t: Provider extends AnyResourceRef\n\t\t? readonly [Provider]\n\t\t: readonly [];\n\ntype FundingEntryProviderDependencies<Entry> = Entry extends { readonly coin: CoinMember }\n\t? 'via' extends keyof Entry\n\t\t? Entry extends { readonly via: infer Provider }\n\t\t\t? FundingProviderDependenciesFor<Provider>\n\t\t\t: readonly []\n\t\t: readonly []\n\t: readonly [];\n\ntype FundingProviderDependencies<Entries extends readonly unknown[]> = Entries extends readonly [\n\tinfer Head,\n\t...infer Tail,\n]\n\t? readonly [...FundingEntryProviderDependencies<Head>, ...FundingProviderDependencies<Tail>]\n\t: readonly [];\n\ntype AccountDependencyMembers<Funding extends AccountFunding> = readonly [\n\ttypeof suiResource,\n\t...FundingCoinDependencies<Funding>,\n\t...FundingProviderDependencies<Funding>,\n];\n\nconst isCoinFundingEntry = (entry: AccountFundingEntry): entry is CrossCuttingFundingEntry =>\n\ttypeof entry === 'object' && entry.coin !== 'sui';\n\nconst fundingProviders = (\n\tprovider: CrossCuttingFundingProvider | undefined,\n): ReadonlyArray<AnyResourceRef> => {\n\tif (provider === undefined) return [];\n\treturn Array.isArray(provider)\n\t\t? (provider as ReadonlyArray<AnyResourceRef>)\n\t\t: [provider as AnyResourceRef];\n};\n\nconst fundingAmountToBigInt = (amount: number | bigint): bigint => {\n\tif (typeof amount === 'bigint') {\n\t\tif (amount < 0n) {\n\t\t\tthrow new TypeError(`SUI funding amount must be a non-negative integer in MIST.`);\n\t\t}\n\t\treturn amount;\n\t}\n\tif (!Number.isSafeInteger(amount) || amount < 0) {\n\t\tthrow new TypeError(`SUI funding amount must be a non-negative safe integer in MIST.`);\n\t}\n\treturn BigInt(amount);\n};\n\nconst coinLabelFor = (coin: { readonly fullCoinType: string; readonly symbol?: string }): string =>\n\tcoin.symbol ?? coin.fullCoinType.split('::').at(-1) ?? coin.fullCoinType;\n\nexport const account = <const N extends string, const Funding extends AccountFunding = readonly []>(\n\tname: N,\n\topts?: AccountOptions<Funding>,\n) => {\n\tassertAccountName(name);\n\n\t// Normalize bare-form to ephemeral default. The user-facing\n\t// `AccountOptions` union does not include \"kind absent\" — we\n\t// inject the default here so the rest of the body sees a\n\t// fully-discriminated value.\n\tconst opts2: ResolvedAccountOptions =\n\t\topts === undefined\n\t\t\t? { kind: 'ephemeral', name }\n\t\t\t: ({ ...opts, name } as ResolvedAccountOptions);\n\n\tconst accountRef = accountResource(name);\n\n\t// Pull the funding resource tuple out of opts (may be undefined for\n\t// the bare form / variants without funding). The tuple preserves\n\t// plugin-valued refs when the caller passed coin plugins, so\n\t// recursive stack composition can include those publishers.\n\tconst fundingEntries = (opts?.funding ?? []) as unknown as Funding;\n\tconst fundingEntryList = fundingEntries as AccountFunding;\n\tconst coinFundingEntries = fundingEntryList.filter(isCoinFundingEntry);\n\tconst fundingMembers = coinFundingEntries.map((e) => e.coin);\n\tconst strategyProviderMembers = coinFundingEntries.flatMap((entry) =>\n\t\tfundingProviders(entry.via),\n\t);\n\tconst dependencies = [\n\t\tsuiResource,\n\t\t...fundingMembers,\n\t\t...strategyProviderMembers,\n\t] as unknown as AccountDependencyMembers<Funding>;\n\n\treturn definePlugin({\n\t\tid: accountRef.id,\n\t\tdependsOn: dependencies,\n\t\t// Account is a value-producer (no long-lived server / container);\n\t\t// tasks acquire their value, publish contributions, then reach\n\t\t// `done`.\n\t\trole: 'task',\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst [sui, ...resolvedDeps] = deps;\n\t\t\t\tconst resolvedCoinValues = resolvedDeps.slice(\n\t\t\t\t\t0,\n\t\t\t\t\tcoinFundingEntries.length,\n\t\t\t\t) as ReadonlyArray<{\n\t\t\t\t\treadonly fullCoinType: string;\n\t\t\t\t\treadonly symbol?: string;\n\t\t\t\t}>;\n\t\t\t\t// Identity + on-disk runtime root come from the\n\t\t\t\t// supervisor-provided substrate context.\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst paths = yield* StackPathsService;\n\n\t\t\t\t// Project each funding dependency value to a\n\t\t\t\t// `{fullCoinType, amount}` projection. Dependency order\n\t\t\t\t// mirrors `fundingEntries`, after the hard Sui upstream.\n\t\t\t\tlet coinIndex = 0;\n\t\t\t\tconst projectedFunding: ReadonlyArray<ProjectedFundingEntry> = fundingEntryList.map(\n\t\t\t\t\t(entry) => {\n\t\t\t\t\t\tif (entry.coin === 'sui') {\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcoin: 'SUI',\n\t\t\t\t\t\t\t\tfullCoinType: SUI_FULL_COIN_TYPE,\n\t\t\t\t\t\t\t\tamount: fundingAmountToBigInt(entry.amount),\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst resolvedCoin = resolvedCoinValues[coinIndex]!;\n\t\t\t\t\t\tcoinIndex += 1;\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcoin: coinLabelFor(resolvedCoin),\n\t\t\t\t\t\t\tfullCoinType: resolvedCoin.fullCoinType,\n\t\t\t\t\t\t\tamount: entry.amount,\n\t\t\t\t\t\t};\n\t\t\t\t\t},\n\t\t\t\t);\n\n\t\t\t\tconst acquireCtx: AccountAcquireContext = {\n\t\t\t\t\tsui: {\n\t\t\t\t\t\tmode: sui.mode,\n\t\t\t\t\t\tchain: sui.chain,\n\t\t\t\t\t\tsdk: sui.sdk,\n\t\t\t\t\t\tfork: sui.fork,\n\t\t\t\t\t},\n\t\t\t\t\truntimeRoot: paths.stackRoot,\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\temitAutoPromotionEvent: () =>\n\t\t\t\t\t\tEffect.logWarning('account funding auto-promoted for fork mode').pipe(\n\t\t\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t\t\t[SpanAttr.accountName]: name,\n\t\t\t\t\t\t\t\t[SpanAttr.accountFundingFrom]: 'faucet',\n\t\t\t\t\t\t\t\t[SpanAttr.accountFundingTo]: 'pay-from-seed-via-impersonate',\n\t\t\t\t\t\t\t\t[SpanAttr.suiMode]: 'fork',\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\tprojectedFunding,\n\t\t\t\t};\n\t\t\t\treturn yield* acquireAccount(opts2, acquireCtx);\n\t\t\t}),\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `AccountValue` + acquire context AFTER `acquire` succeeds.\n\t\t// Lets snapshot + codegen + registry decls reference the\n\t\t// REAL address (and identity app/stack) — the static form\n\t\t// would force placeholder values for fields only known at\n\t\t// acquire time.\n\t\terrorContributions: accountErrorContributions,\n\t\tcapabilities: ({ value: resolved, runtime: acquireCtx2 }) => {\n\t\t\tconst realEntry: AccountRegistryEntry = {\n\t\t\t\tname,\n\t\t\t\taddress: resolved.address,\n\t\t\t\tscheme: resolved.scheme,\n\t\t\t\tsource: resolved.source,\n\t\t\t\tfunding: fundingProjectionForResult(resolved.funding),\n\t\t\t};\n\t\t\tconst bindings: AccountBindings = {\n\t\t\t\tname,\n\t\t\t\taddress: resolved.address,\n\t\t\t\tscheme: resolved.scheme,\n\t\t\t\tsource: resolved.source,\n\t\t\t};\n\t\t\tconst snapshot = makeAccountSnapshotable({\n\t\t\t\taccountName: name,\n\t\t\t\tvariant: opts2.kind,\n\t\t\t\tapp: acquireCtx2.identity.app,\n\t\t\t\tstack: acquireCtx2.identity.stack,\n\t\t\t});\n\t\t\tconst codegen = makeAccountCodegen<N>({ name, resolved: bindings });\n\t\t\tconst registry = makeAccountRegistryContribution<N>(\n\t\t\t\trealEntry as AccountRegistryEntry & { readonly name: N },\n\t\t\t);\n\t\t\tconst projection = makeAccountProjectionContribution<N>(\n\t\t\t\trealEntry as AccountRegistryEntry & { readonly name: N },\n\t\t\t);\n\t\t\treturn [snapshot, codegen, registry, projection] as const;\n\t\t},\n\t});\n};\n\nconst fundingProjectionForResult = (funding: AccountFundingResult): AccountRegistryFunding => {\n\tif (funding.requested.length === 0) {\n\t\treturn { status: 'skipped', balanceMist: null, requestedMist: null, entries: [] };\n\t}\n\n\tconst appliedKeys = new Set(funding.applied.map(fundingEntryKey));\n\tconst entries = funding.requested.map((entry) => ({\n\t\tcoin: entry.coin,\n\t\tfullCoinType: entry.fullCoinType,\n\t\tamount: entry.amount.toString(),\n\t\tstatus: appliedKeys.has(fundingEntryKey(entry)) ? ('funded' as const) : ('skipped' as const),\n\t}));\n\tconst requestedMist =\n\t\tfunding.requested\n\t\t\t.find((entry) => entry.fullCoinType === SUI_FULL_COIN_TYPE)\n\t\t\t?.amount.toString() ?? null;\n\tconst fundedCount = entries.filter((entry) => entry.status === 'funded').length;\n\treturn {\n\t\tstatus: fundedCount === entries.length ? 'funded' : fundedCount === 0 ? 'skipped' : 'unknown',\n\t\tbalanceMist: null,\n\t\trequestedMist,\n\t\tentries,\n\t};\n};\n\nconst fundingEntryKey = (entry: ProjectedFundingEntry): string =>\n\t`${entry.fullCoinType}:${entry.amount}`;\n\n// ---------------------------------------------------------------------------\n// Re-exports for advanced callers (Coin, Wallet, Package)\n// ---------------------------------------------------------------------------\n\nexport type { AccountOptions, ResolvedAccountOptions, AccountValue, TxResult } from './service.ts';\nexport type {\n\tAccountError,\n\tAccountAcquireError,\n\tAccountAcquirePhase,\n\tAccountSignError,\n\tAccountSignPhase,\n\tAccountVariantKind,\n} from './errors.ts';\nexport { ACCOUNT_ERROR_TAGS } from './errors.ts';\nexport type {\n\tAccountFunding,\n\tAccountFundingEntry,\n\tAccountFundingCoinValue,\n\tAccountFundingResult,\n\tAccountFundingRequest,\n\tAccountFundingStrategy,\n\tCoinMember,\n\tCrossCuttingFundingEntry,\n\tCrossCuttingFundingProvider,\n\tProjectedFunding,\n\tProjectedFundingEntry,\n\tSuiFundingEntry,\n} from './funding.ts';\nexport { DEFAULT_EPHEMERAL_FUND_MIST, SUI_FULL_COIN_TYPE } from './funding.ts';\nexport type { AccountBindings } from './codegen.ts';\nexport type {\n\tAccountRegistryEntry,\n\tAccountRegistryFunding,\n\tAccountRegistryKey,\n} from './registry.ts';\nexport { accountRegistryKey } from './registry.ts';\nexport type { SyntheticImpersonationSigner } from './variants/impersonate.ts';\nexport type { SignatureScheme, ResolvedKeypair } from './keypair.ts';\n"],"mappings":";;;;;;;;;;;;;AA4EA,MAAM,4BAA4B,yBAAyB,mBAAmB;AAiB9E,MAAM,mBAAwC,SAC7C,SAAgD,WAAW,OAAkC;AAuD9F,MAAM,sBAAsB,UAC3B,OAAO,UAAU,YAAY,MAAM,SAAS;AAE7C,MAAM,oBACL,aACmC;AACnC,KAAI,aAAa,KAAA,EAAW,QAAO,EAAE;AACrC,QAAO,MAAM,QAAQ,SAAS,GAC1B,WACD,CAAC,SAA2B;;AAGhC,MAAM,yBAAyB,WAAoC;AAClE,KAAI,OAAO,WAAW,UAAU;AAC/B,MAAI,SAAS,GACZ,OAAM,IAAI,UAAU,6DAA6D;AAElF,SAAO;;AAER,KAAI,CAAC,OAAO,cAAc,OAAO,IAAI,SAAS,EAC7C,OAAM,IAAI,UAAU,kEAAkE;AAEvF,QAAO,OAAO,OAAO;;AAGtB,MAAM,gBAAgB,SACrB,KAAK,UAAU,KAAK,aAAa,MAAM,KAAK,CAAC,GAAG,GAAG,IAAI,KAAK;AAE7D,MAAa,WACZ,MACA,SACI;AACJ,mBAAkB,KAAK;CAMvB,MAAM,QACL,SAAS,KAAA,IACN;EAAE,MAAM;EAAa;EAAM,GAC1B;EAAE,GAAG;EAAM;EAAM;CAEtB,MAAM,aAAa,gBAAgB,KAAK;CAOxC,MAAM,mBADkB,MAAM,WAAW,EAAE;CAE3C,MAAM,qBAAqB,iBAAiB,OAAO,mBAAmB;CACtE,MAAM,iBAAiB,mBAAmB,KAAK,MAAM,EAAE,KAAK;CAC5D,MAAM,0BAA0B,mBAAmB,SAAS,UAC3D,iBAAiB,MAAM,IAAI,CAC3B;CACD,MAAM,eAAe;EACpB;EACA,GAAG;EACH,GAAG;EACH;AAED,QAAO,aAAa;EACnB,IAAI,WAAW;EACf,WAAW;EAIX,MAAM;EACN,QAAQ,SACP,OAAO,IAAI,aAAa;GACvB,MAAM,CAAC,KAAK,GAAG,gBAAgB;GAC/B,MAAM,qBAAqB,aAAa,MACvC,GACA,mBAAmB,OACnB;GAMD,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GAKrB,IAAI,YAAY;GAChB,MAAM,mBAAyD,iBAAiB,KAC9E,UAAU;AACV,QAAI,MAAM,SAAS,MAClB,QAAO;KACN,MAAM;KACN,cAAc;KACd,QAAQ,sBAAsB,MAAM,OAAO;KAC3C;IAEF,MAAM,eAAe,mBAAmB;AACxC,iBAAa;AACb,WAAO;KACN,MAAM,aAAa,aAAa;KAChC,cAAc,aAAa;KAC3B,QAAQ,MAAM;KACd;KAEF;AAuBD,UAAO,OAAO,eAAe,OAAO;IApBnC,KAAK;KACJ,MAAM,IAAI;KACV,OAAO,IAAI;KACX,KAAK,IAAI;KACT,MAAM,IAAI;KACV;IACD,aAAa,MAAM;IACnB,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,8BACC,OAAO,WAAW,8CAA8C,CAAC,KAChE,OAAO,aAAa;MAClB,SAAS,cAAc;MACvB,SAAS,qBAAqB;MAC9B,SAAS,mBAAmB;MAC5B,SAAS,UAAU;KACpB,CAAC,CACF;IACF;IAE6C,CAAC;IAC9C;EAOH,oBAAoB;EACpB,eAAe,EAAE,OAAO,UAAU,SAAS,kBAAkB;GAC5D,MAAM,YAAkC;IACvC;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IACjB,QAAQ,SAAS;IACjB,SAAS,2BAA2B,SAAS,QAAQ;IACrD;GACD,MAAM,WAA4B;IACjC;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IACjB,QAAQ,SAAS;IACjB;AAcD,UAAO;IAbU,wBAAwB;KACxC,aAAa;KACb,SAAS,MAAM;KACf,KAAK,YAAY,SAAS;KAC1B,OAAO,YAAY,SAAS;KAC5B,CAQe;IAPA,mBAAsB;KAAE;KAAM,UAAU;KAAU,CAOzC;IANR,gCAChB,UAKkC;IAHhB,kCAClB,UAE8C;IAAC;;EAEjD,CAAC;;AAGH,MAAM,8BAA8B,YAA0D;AAC7F,KAAI,QAAQ,UAAU,WAAW,EAChC,QAAO;EAAE,QAAQ;EAAW,aAAa;EAAM,eAAe;EAAM,SAAS,EAAE;EAAE;CAGlF,MAAM,cAAc,IAAI,IAAI,QAAQ,QAAQ,IAAI,gBAAgB,CAAC;CACjE,MAAM,UAAU,QAAQ,UAAU,KAAK,WAAW;EACjD,MAAM,MAAM;EACZ,cAAc,MAAM;EACpB,QAAQ,MAAM,OAAO,UAAU;EAC/B,QAAQ,YAAY,IAAI,gBAAgB,MAAM,CAAC,GAAI,WAAsB;EACzE,EAAE;CACH,MAAM,gBACL,QAAQ,UACN,MAAM,UAAU,MAAM,iBAAA,gBAAoC,EACzD,OAAO,UAAU,IAAI;CACzB,MAAM,cAAc,QAAQ,QAAQ,UAAU,MAAM,WAAW,SAAS,CAAC;AACzE,QAAO;EACN,QAAQ,gBAAgB,QAAQ,SAAS,WAAW,gBAAgB,IAAI,YAAY;EACpF,aAAa;EACb;EACA;EACA;;AAGF,MAAM,mBAAmB,UACxB,GAAG,MAAM,aAAa,GAAG,MAAM"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/account/index.ts"],"sourcesContent":["// Account plugin — barrel + `account(name, opts?)` factory.\n//\n// Architecture (12-account.md): Account is the named-identity layer\n// for devstack. It acquires a keypair (or impersonation slot), funds\n// it (default + cross-cutting), registers `{name, address}`, and\n// publishes a per-account resolved value via a unique resource id.\n//\n// User-facing factory shape:\n//\n//   account('alice')                                  // default ephemeral\n//   account('alice', { kind: 'ephemeral', funding: [{ coin: 'sui', amount: 5_000_000_000n }] })\n//   account('alice', { kind: 'keystore', path: '~/.sui/keystore', aliasOrAddress: 'alice' })\n//   account('alice', { kind: 'env',      key: 'ALICE_PRIVATE_KEY' })\n//   account('alice', { kind: 'inline',   privateKey: 'suiprivkey1...' })\n//   account('alice', { kind: 'signer',   signer: hardwareWallet })\n//   account('alice', { kind: 'impersonate', address: '0xabc...' })\n//\n// **Bare-form default**: `account('alice')` is shorthand for\n//\n//   { kind: 'ephemeral' } plus default SUI funding.\n//\n// Distilled-doc invariant (12-account.md \"Make the bare-form auto-\n// promotion to fork-impersonate funding discoverable\"): on fork-\n// runtime Sui, the default-funding pass internally promotes from\n// \"faucet POST\" to \"pay-from-seed-via-impersonate\" because no\n// faucet exists on a fork. The promotion is LOUD by default — we\n// emit a `log.appended` event the first time the promotion fires\n// (see `funding.ts`).\n//\n// The plugin emits THREE capability decls + an error-tag contribution:\n//\n//   1. Snapshotable        — secret-material subtree (ephemeral only).\n//   2. Codegenable         — `account-map` bindings (name → address).\n//   3. StrategyContributor — per-stack `account:<name>` registry entry.\n//\n// Plus `errorContributions: [{ errorTags: ACCOUNT_ERROR_TAGS }]` —\n// harvested by the supervisor into the FormatterRegistry so the\n// cascade formatter renders account-tagged failures with the right\n// taxonomy header.\n\nimport { Effect } from 'effect';\n\nimport { definePlugin, resource, type AnyResourceRef } from '../../api/define-plugin.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { suiResource, SuiSpans } from '../sui/index.ts';\n\nimport { AccountSpans } from './spans.ts';\n\nimport { makeAccountCodegen, type AccountBindings } from './codegen.ts';\nimport { ACCOUNT_ERROR_TAGS, accountAcquireError, type AccountAcquireError } from './errors.ts';\nimport {\n\tSUI_FULL_COIN_TYPE,\n\ttype AccountFunding,\n\ttype AccountFundingEntry,\n\ttype AccountFundingResult,\n\ttype CrossCuttingFundingEntry,\n\ttype CrossCuttingFundingProvider,\n\ttype CoinMember,\n\ttype ProjectedFundingEntry,\n} from './funding.ts';\nimport {\n\tmakeAccountProjectionContribution,\n\tmakeAccountRegistryContribution,\n\ttype AccountRegistryEntry,\n\ttype AccountRegistryFunding,\n} from './registry.ts';\nimport { makeAccountSnapshotable } from './snapshot.ts';\nimport {\n\tacquireAccount,\n\tassertAccountName,\n\ttype AccountAcquireContext,\n\ttype AccountOptions,\n\ttype ResolvedAccountOptions,\n\ttype AccountValue,\n} from './service.ts';\n\nconst accountErrorContributions = pluginErrorContributions(ACCOUNT_ERROR_TAGS);\n\n// ---------------------------------------------------------------------------\n// Resource construction\n// ---------------------------------------------------------------------------\n\n/** Per-account-instance resource. The substrate's resource id MUST be unique\n *  across the stack — we encode the account name as a literal-typed\n *  template literal so the compiler catches duplicate-name composes\n *  at the `defineDevstack` call site.\n *\n *  Distilled-doc invariant: resource id flows into the on-disk path, the\n *  manifest key, container labels, and generated TypeScript exports —\n *  the identifier-safe name validation (in `service.ts`) protects\n *  those call sites. */\nexport type AccountResourceId<Name extends string> = `account/${Name}`;\n\nconst accountResource = <Name extends string>(name: Name) =>\n\tresource<AccountResourceId<Name>, AccountValue>(`account/${name}` as AccountResourceId<Name>);\n\n// ---------------------------------------------------------------------------\n// User-facing factory\n// ---------------------------------------------------------------------------\n\n/** Construct the account plugin instance.\n *\n *  Variants — typed at the API boundary via the discriminated\n *  `AccountOptions` union. The factory's second arg is OPTIONAL —\n *  omitting it yields the bare-form default (ephemeral + default\n *  funding). Passing a non-matching `kind:` is a compile error\n *  thanks to the union's discriminator.\n *\n *  Distilled-doc invariant: the name is validated at the FACTORY\n *  boundary (not just at acquire time) so a typo surfaces\n *  immediately, not at runtime. */\ntype FundingCoinDependencies<Entries extends readonly unknown[]> = Entries extends readonly [\n\tinfer Head,\n\t...infer Tail,\n]\n\t? Head extends { readonly coin: infer Coin }\n\t\t? Coin extends CoinMember\n\t\t\t? readonly [Coin, ...FundingCoinDependencies<Tail>]\n\t\t\t: FundingCoinDependencies<Tail>\n\t\t: FundingCoinDependencies<Tail>\n\t: readonly [];\n\ntype FundingProviderDependenciesFor<Provider> = Provider extends readonly AnyResourceRef[]\n\t? Provider\n\t: Provider extends AnyResourceRef\n\t\t? readonly [Provider]\n\t\t: readonly [];\n\ntype FundingEntryProviderDependencies<Entry> = Entry extends { readonly coin: CoinMember }\n\t? 'via' extends keyof Entry\n\t\t? Entry extends { readonly via: infer Provider }\n\t\t\t? FundingProviderDependenciesFor<Provider>\n\t\t\t: readonly []\n\t\t: readonly []\n\t: readonly [];\n\ntype FundingProviderDependencies<Entries extends readonly unknown[]> = Entries extends readonly [\n\tinfer Head,\n\t...infer Tail,\n]\n\t? readonly [...FundingEntryProviderDependencies<Head>, ...FundingProviderDependencies<Tail>]\n\t: readonly [];\n\ntype AccountDependencyMembers<Funding extends AccountFunding> = readonly [\n\ttypeof suiResource,\n\t...FundingCoinDependencies<Funding>,\n\t...FundingProviderDependencies<Funding>,\n];\n\nconst isCoinFundingEntry = (entry: AccountFundingEntry): entry is CrossCuttingFundingEntry =>\n\ttypeof entry === 'object' && entry.coin !== 'sui';\n\nconst fundingProviders = (\n\tprovider: CrossCuttingFundingProvider | undefined,\n): ReadonlyArray<AnyResourceRef> => {\n\tif (provider === undefined) return [];\n\treturn Array.isArray(provider)\n\t\t? (provider as ReadonlyArray<AnyResourceRef>)\n\t\t: [provider as AnyResourceRef];\n};\n\n/** Validate a SUI funding amount and project it to bigint MIST.\n *  Returns a typed-error Effect so a bad amount surfaces as\n *  `AccountAcquireError(phase: 'validate-funding')` on the failure\n *  channel — NOT a synchronous throw lifted to a defect when called\n *  from inside the acquire body's `Effect.gen`. */\nconst fundingAmountToBigInt = (\n\tamount: number | bigint,\n\taccountName: string,\n): Effect.Effect<bigint, AccountAcquireError> => {\n\tif (typeof amount === 'bigint') {\n\t\tif (amount < 0n) {\n\t\t\treturn Effect.fail(\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'validate-funding',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant: 'ephemeral',\n\t\t\t\t\tmessage: `Account '${accountName}': SUI funding amount must be a non-negative integer in MIST (got ${amount}).`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn Effect.succeed(amount);\n\t}\n\tif (!Number.isSafeInteger(amount) || amount < 0) {\n\t\treturn Effect.fail(\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'validate-funding',\n\t\t\t\taccountName,\n\t\t\t\tvariant: 'ephemeral',\n\t\t\t\tmessage: `Account '${accountName}': SUI funding amount must be a non-negative safe integer in MIST (got ${amount}).`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed(BigInt(amount));\n};\n\nconst coinLabelFor = (coin: { readonly fullCoinType: string; readonly symbol?: string }): string =>\n\tcoin.symbol ?? coin.fullCoinType.split('::').at(-1) ?? coin.fullCoinType;\n\nexport const account = <const N extends string, const Funding extends AccountFunding = readonly []>(\n\tname: N,\n\topts?: AccountOptions<Funding>,\n) => {\n\tassertAccountName(name);\n\n\t// Normalize bare-form to ephemeral default. The user-facing\n\t// `AccountOptions` union does not include \"kind absent\" — we\n\t// inject the default here so the rest of the body sees a\n\t// fully-discriminated value.\n\tconst opts2: ResolvedAccountOptions =\n\t\topts === undefined\n\t\t\t? { kind: 'ephemeral', name }\n\t\t\t: ({ ...opts, name } as ResolvedAccountOptions);\n\n\tconst accountRef = accountResource(name);\n\n\t// Pull the funding resource tuple out of opts (may be undefined for\n\t// the bare form / variants without funding). The tuple preserves\n\t// plugin-valued refs when the caller passed coin plugins, so\n\t// recursive stack composition can include those publishers.\n\tconst fundingEntries = (opts?.funding ?? []) as unknown as Funding;\n\tconst fundingEntryList = fundingEntries as AccountFunding;\n\tconst coinFundingEntries = fundingEntryList.filter(isCoinFundingEntry);\n\tconst fundingMembers = coinFundingEntries.map((e) => e.coin);\n\tconst strategyProviderMembers = coinFundingEntries.flatMap((entry) =>\n\t\tfundingProviders(entry.via),\n\t);\n\tconst dependencies = [\n\t\tsuiResource,\n\t\t...fundingMembers,\n\t\t...strategyProviderMembers,\n\t] as unknown as AccountDependencyMembers<Funding>;\n\n\treturn definePlugin({\n\t\tid: accountRef.id,\n\t\tdependsOn: dependencies,\n\t\t// Account is a value-producer (no long-lived server / container);\n\t\t// tasks acquire their value, publish contributions, then reach\n\t\t// `done`.\n\t\trole: 'task',\n\t\tsection: 'account',\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst [sui, ...resolvedDeps] = deps;\n\t\t\t\tconst resolvedCoinValues = resolvedDeps.slice(\n\t\t\t\t\t0,\n\t\t\t\t\tcoinFundingEntries.length,\n\t\t\t\t) as ReadonlyArray<{\n\t\t\t\t\treadonly fullCoinType: string;\n\t\t\t\t\treadonly symbol?: string;\n\t\t\t\t}>;\n\t\t\t\t// Identity + on-disk runtime root come from the\n\t\t\t\t// supervisor-provided substrate context.\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst paths = yield* StackPathsService;\n\n\t\t\t\t// Project each funding dependency value to a\n\t\t\t\t// `{fullCoinType, amount}` projection. Dependency order\n\t\t\t\t// mirrors `fundingEntries`, after the hard Sui upstream.\n\t\t\t\t// SUI amount validation lives on the failure channel so a\n\t\t\t\t// negative / non-integer amount surfaces as a typed\n\t\t\t\t// `AccountAcquireError(phase: 'validate-funding')` instead\n\t\t\t\t// of a defect (the old sync-throw lifted to a defect when\n\t\t\t\t// run inside this `Effect.gen`).\n\t\t\t\tlet coinIndex = 0;\n\t\t\t\tconst projectedFundingMutable: ProjectedFundingEntry[] = [];\n\t\t\t\tfor (const entry of fundingEntryList) {\n\t\t\t\t\tif (entry.coin === 'sui') {\n\t\t\t\t\t\tconst amount = yield* fundingAmountToBigInt(entry.amount, name);\n\t\t\t\t\t\tprojectedFundingMutable.push({\n\t\t\t\t\t\t\tcoin: 'SUI',\n\t\t\t\t\t\t\tfullCoinType: SUI_FULL_COIN_TYPE,\n\t\t\t\t\t\t\tamount,\n\t\t\t\t\t\t});\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t\tconst resolvedCoin = resolvedCoinValues[coinIndex]!;\n\t\t\t\t\tcoinIndex += 1;\n\t\t\t\t\tprojectedFundingMutable.push({\n\t\t\t\t\t\tcoin: coinLabelFor(resolvedCoin),\n\t\t\t\t\t\tfullCoinType: resolvedCoin.fullCoinType,\n\t\t\t\t\t\tamount: entry.amount,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tconst projectedFunding: ReadonlyArray<ProjectedFundingEntry> = projectedFundingMutable;\n\n\t\t\t\tconst acquireCtx: AccountAcquireContext = {\n\t\t\t\t\tsui: {\n\t\t\t\t\t\tmode: sui.mode,\n\t\t\t\t\t\tchain: sui.chain,\n\t\t\t\t\t\tsdk: sui.sdk,\n\t\t\t\t\t\tfork: sui.fork,\n\t\t\t\t\t},\n\t\t\t\t\truntimeRoot: paths.stackRoot,\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\temitAutoPromotionEvent: () =>\n\t\t\t\t\t\tEffect.logWarning('account funding auto-promoted for fork mode').pipe(\n\t\t\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t\t\t[AccountSpans.name]: name,\n\t\t\t\t\t\t\t\t[AccountSpans.fundingFrom]: 'faucet',\n\t\t\t\t\t\t\t\t[AccountSpans.fundingTo]: 'pay-from-seed-via-impersonate',\n\t\t\t\t\t\t\t\t[SuiSpans.mode]: 'fork',\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\tprojectedFunding,\n\t\t\t\t};\n\t\t\t\treturn yield* acquireAccount(opts2, acquireCtx);\n\t\t\t}),\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `AccountValue` + acquire context AFTER `acquire` succeeds.\n\t\t// Lets snapshot + codegen + registry decls reference the\n\t\t// REAL address (and identity app/stack) — the static form\n\t\t// would force placeholder values for fields only known at\n\t\t// acquire time.\n\t\terrorContributions: accountErrorContributions,\n\t\tcapabilities: ({ value: resolved, runtime: acquireCtx2 }) => {\n\t\t\tconst realEntry: AccountRegistryEntry = {\n\t\t\t\tname,\n\t\t\t\taddress: resolved.address,\n\t\t\t\tscheme: resolved.scheme,\n\t\t\t\tsource: resolved.source,\n\t\t\t\tfunding: fundingProjectionForResult(resolved.funding),\n\t\t\t};\n\t\t\tconst bindings: AccountBindings = {\n\t\t\t\tname,\n\t\t\t\taddress: resolved.address,\n\t\t\t\tscheme: resolved.scheme,\n\t\t\t\tsource: resolved.source,\n\t\t\t};\n\t\t\tconst snapshot = makeAccountSnapshotable({\n\t\t\t\taccountName: name,\n\t\t\t\tvariant: opts2.kind,\n\t\t\t\tapp: acquireCtx2.identity.app,\n\t\t\t\tstack: acquireCtx2.identity.stack,\n\t\t\t});\n\t\t\tconst codegen = makeAccountCodegen<N>({ name, resolved: bindings });\n\t\t\tconst registry = makeAccountRegistryContribution<N>(\n\t\t\t\trealEntry as AccountRegistryEntry & { readonly name: N },\n\t\t\t);\n\t\t\tconst projection = makeAccountProjectionContribution<N>(\n\t\t\t\trealEntry as AccountRegistryEntry & { readonly name: N },\n\t\t\t);\n\t\t\treturn [snapshot, codegen, registry, projection] as const;\n\t\t},\n\t});\n};\n\n/** @internal — exported only for the projection regression test\n *  (`test/plugins/account/funding-projection.test.ts`). Projects the runtime\n *  `AccountFundingResult` (requested + applied) into the registry's\n *  per-row funded/already-satisfied/skipped status. */\nexport const fundingProjectionForResult = (\n\tfunding: AccountFundingResult,\n): AccountRegistryFunding => {\n\tif (funding.requested.length === 0) {\n\t\treturn { status: 'skipped', balanceMist: null, requestedMist: null, entries: [] };\n\t}\n\n\t// Positional outcome consume so the projection can distinguish a\n\t// real faucet call (`funded`) from the pre-existing-balance\n\t// short-circuit (`already-satisfied`). `applied` is an\n\t// order-preserving SUBSEQUENCE of `requested`:\n\t// `applyCrossCuttingFunding` (and the default-funding pass) iterate\n\t// `requested` in order and only push a processed entry onto\n\t// `applied`, dropping zero-amount and no-strategy entries. So we\n\t// walk a cursor through `applied` and adopt its outcome for the\n\t// matching requested row by (fullCoinType, amount) — a keyed Map\n\t// would collapse duplicate (coin, amount) entries and mislabel the\n\t// genuinely-funded first row as `already-satisfied`. An entry the\n\t// funding pass never reached (zero-amount, or absent from `applied`)\n\t// does not match the cursor and projects as `skipped` without\n\t// advancing it.\n\tlet appliedCursor = 0;\n\tconst entries = funding.requested.map((entry) => {\n\t\tconst candidate = funding.applied[appliedCursor];\n\t\tconst matches =\n\t\t\tcandidate !== undefined &&\n\t\t\tcandidate.fullCoinType === entry.fullCoinType &&\n\t\t\tcandidate.amount === entry.amount;\n\t\tconst outcome = matches ? candidate.outcome : undefined;\n\t\tif (matches) {\n\t\t\tappliedCursor += 1;\n\t\t}\n\t\treturn {\n\t\t\tcoin: entry.coin,\n\t\t\tfullCoinType: entry.fullCoinType,\n\t\t\tamount: entry.amount.toString(),\n\t\t\tstatus:\n\t\t\t\toutcome === 'funded'\n\t\t\t\t\t? ('funded' as const)\n\t\t\t\t\t: outcome === 'already-satisfied'\n\t\t\t\t\t\t? ('already-satisfied' as const)\n\t\t\t\t\t\t: ('skipped' as const),\n\t\t};\n\t});\n\tconst requestedMist =\n\t\tfunding.requested\n\t\t\t.find((entry) => entry.fullCoinType === SUI_FULL_COIN_TYPE)\n\t\t\t?.amount.toString() ?? null;\n\tconst settledCount = entries.filter(\n\t\t(entry) => entry.status === 'funded' || entry.status === 'already-satisfied',\n\t).length;\n\treturn {\n\t\t// `funded` here means \"every requested entry is satisfied\" —\n\t\t// either the faucet succeeded or the pre-existing balance\n\t\t// already covered it. `unknown` covers the mixed partial-success\n\t\t// case so consumers can distinguish from \"nothing ran at all\".\n\t\tstatus: settledCount === entries.length ? 'funded' : settledCount === 0 ? 'skipped' : 'unknown',\n\t\tbalanceMist: null,\n\t\trequestedMist,\n\t\tentries,\n\t};\n};\n\n// ---------------------------------------------------------------------------\n// Re-exports for advanced callers (Coin, Wallet, Package)\n// ---------------------------------------------------------------------------\n\nexport type {\n\tAccountOptions,\n\tResolvedAccountOptions,\n\tAccountValue,\n\tSignAndExecuteResult,\n\tTxResult,\n} from './service.ts';\nexport type {\n\tAccountError,\n\tAccountAcquireError,\n\tAccountAcquirePhase,\n\tAccountSignError,\n\tAccountSignPhase,\n\tAccountVariantKind,\n} from './errors.ts';\nexport { ACCOUNT_ERROR_TAGS } from './errors.ts';\nexport type {\n\tAccountFunding,\n\tAccountFundingEntry,\n\tAccountFundingCoinValue,\n\tAccountFundingResult,\n\tAccountFundingRequest,\n\tAccountFundingStrategy,\n\tAppliedFunding,\n\tAppliedFundingEntry,\n\tAppliedFundingOutcome,\n\tCoinMember,\n\tCrossCuttingFundingEntry,\n\tCrossCuttingFundingProvider,\n\tFundEphemeralDefaultOutcome,\n\tProjectedFunding,\n\tProjectedFundingEntry,\n\tSuiFundingEntry,\n} from './funding.ts';\nexport { DEFAULT_EPHEMERAL_FUND_MIST, SUI_FULL_COIN_TYPE } from './funding.ts';\nexport type { AccountBindings } from './codegen.ts';\nexport type {\n\tAccountRegistryEntry,\n\tAccountRegistryFunding,\n\tAccountRegistryKey,\n} from './registry.ts';\nexport { accountRegistryKey } from './registry.ts';\nexport type { SyntheticImpersonationSigner } from './variants/impersonate.ts';\nexport type { SignatureScheme, ResolvedKeypair } from './keypair.ts';\nexport { AccountSpans } from './spans.ts';\n"],"mappings":";;;;;;;;;;;;;;;AA6EA,MAAM,4BAA4B,yBAAyB,mBAAmB;AAiB9E,MAAM,mBAAwC,SAC7C,SAAgD,WAAW,OAAkC;AAuD9F,MAAM,sBAAsB,UAC3B,OAAO,UAAU,YAAY,MAAM,SAAS;AAE7C,MAAM,oBACL,aACmC;AACnC,KAAI,aAAa,KAAA,EAAW,QAAO,EAAE;AACrC,QAAO,MAAM,QAAQ,SAAS,GAC1B,WACD,CAAC,SAA2B;;;;;;;AAQhC,MAAM,yBACL,QACA,gBACgD;AAChD,KAAI,OAAO,WAAW,UAAU;AAC/B,MAAI,SAAS,GACZ,QAAO,OAAO,KACb,oBAAoB;GACnB,OAAO;GACP;GACA,SAAS;GACT,SAAS,YAAY,YAAY,oEAAoE,OAAO;GAC5G,CAAC,CACF;AAEF,SAAO,OAAO,QAAQ,OAAO;;AAE9B,KAAI,CAAC,OAAO,cAAc,OAAO,IAAI,SAAS,EAC7C,QAAO,OAAO,KACb,oBAAoB;EACnB,OAAO;EACP;EACA,SAAS;EACT,SAAS,YAAY,YAAY,yEAAyE,OAAO;EACjH,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ,OAAO,OAAO,CAAC;;AAGtC,MAAM,gBAAgB,SACrB,KAAK,UAAU,KAAK,aAAa,MAAM,KAAK,CAAC,GAAG,GAAG,IAAI,KAAK;AAE7D,MAAa,WACZ,MACA,SACI;AACJ,mBAAkB,KAAK;CAMvB,MAAM,QACL,SAAS,KAAA,IACN;EAAE,MAAM;EAAa;EAAM,GAC1B;EAAE,GAAG;EAAM;EAAM;CAEtB,MAAM,aAAa,gBAAgB,KAAK;CAOxC,MAAM,mBADkB,MAAM,WAAW,EAAE;CAE3C,MAAM,qBAAqB,iBAAiB,OAAO,mBAAmB;CACtE,MAAM,iBAAiB,mBAAmB,KAAK,MAAM,EAAE,KAAK;CAC5D,MAAM,0BAA0B,mBAAmB,SAAS,UAC3D,iBAAiB,MAAM,IAAI,CAC3B;CACD,MAAM,eAAe;EACpB;EACA,GAAG;EACH,GAAG;EACH;AAED,QAAO,aAAa;EACnB,IAAI,WAAW;EACf,WAAW;EAIX,MAAM;EACN,SAAS;EACT,QAAQ,SACP,OAAO,IAAI,aAAa;GACvB,MAAM,CAAC,KAAK,GAAG,gBAAgB;GAC/B,MAAM,qBAAqB,aAAa,MACvC,GACA,mBAAmB,OACnB;GAMD,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GAUrB,IAAI,YAAY;GAChB,MAAM,0BAAmD,EAAE;AAC3D,QAAK,MAAM,SAAS,kBAAkB;AACrC,QAAI,MAAM,SAAS,OAAO;KACzB,MAAM,SAAS,OAAO,sBAAsB,MAAM,QAAQ,KAAK;AAC/D,6BAAwB,KAAK;MAC5B,MAAM;MACN,cAAc;MACd;MACA,CAAC;AACF;;IAED,MAAM,eAAe,mBAAmB;AACxC,iBAAa;AACb,4BAAwB,KAAK;KAC5B,MAAM,aAAa,aAAa;KAChC,cAAc,aAAa;KAC3B,QAAQ,MAAM;KACd,CAAC;;GAEH,MAAM,mBAAyD;AAuB/D,UAAO,OAAO,eAAe,OAAO;IApBnC,KAAK;KACJ,MAAM,IAAI;KACV,OAAO,IAAI;KACX,KAAK,IAAI;KACT,MAAM,IAAI;KACV;IACD,aAAa,MAAM;IACnB,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,8BACC,OAAO,WAAW,8CAA8C,CAAC,KAChE,OAAO,aAAa;MAClB,aAAa,OAAO;MACpB,aAAa,cAAc;MAC3B,aAAa,YAAY;MACzB,SAAS,OAAO;KACjB,CAAC,CACF;IACF;IAE6C,CAAC;IAC9C;EAOH,oBAAoB;EACpB,eAAe,EAAE,OAAO,UAAU,SAAS,kBAAkB;GAC5D,MAAM,YAAkC;IACvC;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IACjB,QAAQ,SAAS;IACjB,SAAS,2BAA2B,SAAS,QAAQ;IACrD;GACD,MAAM,WAA4B;IACjC;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IACjB,QAAQ,SAAS;IACjB;AAcD,UAAO;IAbU,wBAAwB;KACxC,aAAa;KACb,SAAS,MAAM;KACf,KAAK,YAAY,SAAS;KAC1B,OAAO,YAAY,SAAS;KAC5B,CAQe;IAPA,mBAAsB;KAAE;KAAM,UAAU;KAAU,CAOzC;IANR,gCAChB,UAKkC;IAHhB,kCAClB,UAE8C;IAAC;;EAEjD,CAAC;;;;;;AAOH,MAAa,8BACZ,YAC4B;AAC5B,KAAI,QAAQ,UAAU,WAAW,EAChC,QAAO;EAAE,QAAQ;EAAW,aAAa;EAAM,eAAe;EAAM,SAAS,EAAE;EAAE;CAiBlF,IAAI,gBAAgB;CACpB,MAAM,UAAU,QAAQ,UAAU,KAAK,UAAU;EAChD,MAAM,YAAY,QAAQ,QAAQ;EAClC,MAAM,UACL,cAAc,KAAA,KACd,UAAU,iBAAiB,MAAM,gBACjC,UAAU,WAAW,MAAM;EAC5B,MAAM,UAAU,UAAU,UAAU,UAAU,KAAA;AAC9C,MAAI,QACH,kBAAiB;AAElB,SAAO;GACN,MAAM,MAAM;GACZ,cAAc,MAAM;GACpB,QAAQ,MAAM,OAAO,UAAU;GAC/B,QACC,YAAY,WACR,WACD,YAAY,sBACV,sBACA;GACN;GACA;CACF,MAAM,gBACL,QAAQ,UACN,MAAM,UAAU,MAAM,iBAAA,gBAAoC,EACzD,OAAO,UAAU,IAAI;CACzB,MAAM,eAAe,QAAQ,QAC3B,UAAU,MAAM,WAAW,YAAY,MAAM,WAAW,oBACzD,CAAC;AACF,QAAO;EAKN,QAAQ,iBAAiB,QAAQ,SAAS,WAAW,iBAAiB,IAAI,YAAY;EACtF,aAAa;EACb;EACA;EACA"}

package/dist/plugins/account/keypair.mjs

@@ -42,12 +42,11 @@ const generateEd25519Keypair = (accountName) => Effect.try({
 const decodeBech32Secret = (bech32, accountName, variant) => Effect.gen(function* () {
 	const parsed = yield* Effect.try({
 		try: () => decodeSuiPrivateKey(bech32),
-		catch: (cause) => accountAcquireError({
+		catch: () => accountAcquireError({
 			phase: "decode-inline",
 			accountName,
 			variant,
-			message: `Account '${accountName}': decodeSuiPrivateKey() rejected the supplied bech32 secret.`,
-			cause
+			message: `Account '${accountName}': decodeSuiPrivateKey() rejected the supplied bech32 secret.`
 		})
 	});
 	const scheme = yield* normalizeScheme(parsed.scheme, accountName, variant);
@@ -62,12 +61,11 @@ const decodeBech32Secret = (bech32, accountName, variant) => Effect.gen(function
 		try: () => {
 			return resolvedKeypairFromEd25519(Ed25519Keypair.fromSecretKey(parsed.secretKey));
 		},
-		catch: (cause) => accountAcquireError({
+		catch: () => accountAcquireError({
 			phase: "decode-inline",
 			accountName,
 			variant,
-			message: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the decoded secret.`,
-			cause
+			message: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the decoded secret.`
 		})
 	});
 });
@@ -78,12 +76,11 @@ const resolvedKeypairFromEd25519Bytes = (secretKey, accountName, variant) => Eff
 	try: () => {
 		return resolvedKeypairFromEd25519(Ed25519Keypair.fromSecretKey(secretKey));
 	},
-	catch: (cause) => accountAcquireError({
+	catch: () => accountAcquireError({
 		phase: "decode-inline",
 		accountName,
 		variant,
-		message: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the supplied raw bytes.`,
-		cause
+		message: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the supplied raw bytes.`
 	})
 });
 const resolvedKeypairFromEd25519 = (kp) => ({

package/dist/plugins/account/keypair.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.mjs","names":[],"sources":["../../../src/plugins/account/keypair.ts"],"sourcesContent":["// Account plugin — keypair generation + scheme normalization helpers.\n//\n// Distilled-doc finding (12-account.md \"Scheme normalization\"\n// invariant): scheme surfaced to consumers MUST be lowercased at the\n// account boundary. Mixed-case from the SDK leaks into manifest\n// serialization and on-chain Move type matching if not converted. We\n// pin the canonical lowercased union at this module's boundary and\n// every variant resolver dumps through `normalizeScheme` before\n// producing the resolved value.\n//\n// Distilled-doc opportunity (\"Co-locate the canonical Account-value\n// Schema with the canonical type\"): the canonical signature scheme\n// union lives here, NOT next to the factory, so future Schema sits\n// alongside the type.\n\nimport { Effect } from 'effect';\n\nimport { decodeSuiPrivateKey, encodeSuiPrivateKey } from '@mysten/sui/cryptography';\nimport { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';\n\nimport {\n\taccountAcquireError,\n\ttype AccountAcquireError,\n\ttype AccountVariantKind,\n} from './errors.ts';\n\n/** Lowercased signature scheme — the canonical wire form. The SDK\n *  occasionally hands us `'ED25519'` / `'Secp256k1'`; the boundary\n *  conversion lives in `normalizeScheme`. */\nexport type SignatureScheme = 'ed25519' | 'secp256k1' | 'secp256r1';\n\n/** Resolved keypair shape — the variant resolvers all funnel into\n *  this so the funding + register passes are variant-agnostic.\n *\n *  Note: impersonation accounts do NOT produce a `Keypair`; they\n *  produce a `SyntheticImpersonationSigner` (see\n *  `variants/impersonate.ts`). The discriminator lives on the\n *  resolved `AccountValue` (architecture: distilled doc opportunity\n *  \"Tighten the resolved-account type\"). */\nexport interface ResolvedKeypair {\n\treadonly address: string;\n\treadonly scheme: SignatureScheme;\n\treadonly publicKey: Uint8Array;\n\t/** Opaque signer handle — typed loosely here because the four\n\t *  real variants (ed25519/secp256k1/secp256r1 + bring-your-own\n\t *  Signer) share no narrow TS type beyond `Signer`. The wallet /\n\t *  sign-and-execute capability narrows downstream. */\n\treadonly signer: unknown;\n\t/** Bech32-encoded secret. Only present for ephemeral / inline /\n\t *  env / keystore variants — `null` for `signer` (we never ask\n\t *  for it) and `impersonate` (no secret exists). */\n\treadonly bech32Secret: string | null;\n}\n\n/** Normalize the SDK's mixed-case scheme to the lowercased wire form.\n *  Unknown schemes surface as a typed acquisition error (distilled\n *  doc: \"Unsupported signature scheme (multisig / zklogin / passkey)\n *  — currently a raw throw; should be promoted to the typed-error\n *  channel\"). */\nexport const normalizeScheme = (\n\traw: string,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<SignatureScheme, AccountAcquireError> => {\n\tconst lower = raw.toLowerCase();\n\tif (lower === 'ed25519' || lower === 'secp256k1' || lower === 'secp256r1') {\n\t\treturn Effect.succeed(lower);\n\t}\n\treturn Effect.fail(\n\t\taccountAcquireError({\n\t\t\tphase: 'unsupported-scheme',\n\t\t\taccountName,\n\t\t\tvariant,\n\t\t\tmessage: `Account '${accountName}': unsupported signature scheme '${raw}'. devstack supports ed25519, secp256k1, secp256r1.`,\n\t\t\thint: 'Multisig, zklogin, and passkey schemes are not yet supported via the Account plugin — bring your own Signer via {kind:\"signer\"}.',\n\t\t}),\n\t);\n};\n\n/** Generate a fresh Ed25519 keypair. The default for the\n *  `ephemeral` variant.\n *\n *  Architecture-distilled invariant: schemes other than Ed25519\n *  must be loaded via keystore/env/inline; we never generate\n *  Secp256* keys from scratch. */\nexport const generateEd25519Keypair = (\n\taccountName: string,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst kp = Ed25519Keypair.generate();\n\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t},\n\t\tcatch: (cause): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'generate-keypair',\n\t\t\t\taccountName,\n\t\t\t\tvariant: 'ephemeral',\n\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.generate() threw.`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n/** Decode a bech32 `suiprivkey1...` string into a resolved keypair.\n *  Used by the inline / env / keystore variants. */\nexport const decodeBech32Secret = (\n\tbech32: string,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst parsed = yield* Effect.try({\n\t\t\ttry: () => decodeSuiPrivateKey(bech32),\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'decode-inline',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': decodeSuiPrivateKey() rejected the supplied bech32 secret.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tconst scheme = yield* normalizeScheme(parsed.scheme, accountName, variant);\n\t\tif (scheme !== 'ed25519') {\n\t\t\t// Architecture-distilled: today we only construct Ed25519 here.\n\t\t\t// Secp256k1 / Secp256r1 paths land when the SDK's per-scheme\n\t\t\t// Keypair classes are wired in; the typed-error channel keeps\n\t\t\t// the failure actionable until then.\n\t\t\treturn yield* Effect.fail(\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'unsupported-scheme',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': scheme '${scheme}' is not yet wired for the ${variant} variant.`,\n\t\t\t\t\thint: 'Wire the matching @mysten/sui/keypairs/<scheme> import next to the Ed25519 path.',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn yield* Effect.try({\n\t\t\ttry: () => {\n\t\t\t\tconst kp = Ed25519Keypair.fromSecretKey(parsed.secretKey);\n\t\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t\t},\n\t\t\tcatch: (cause): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'decode-inline',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the decoded secret.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t});\n\n/** Build a `ResolvedKeypair` view from a raw Ed25519 secret-key\n *  byte array. Used by the inline-bytes path (`variants/inline.ts`\n *  Uint8Array branch). */\nexport const resolvedKeypairFromEd25519Bytes = (\n\tsecretKey: Uint8Array,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst kp = Ed25519Keypair.fromSecretKey(secretKey);\n\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t},\n\t\tcatch: (cause): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'decode-inline',\n\t\t\t\taccountName,\n\t\t\t\tvariant,\n\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the supplied raw bytes.`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n/** Encode a 32-byte secret key as a bech32 `suiprivkey1...` string\n *  for the canonical wire form. Re-exported because the\n *  `variants/inline.ts` Uint8Array branch needs it. */\nexport const encodeEd25519Bech32 = (bytes: Uint8Array): string =>\n\tencodeSuiPrivateKey(bytes, 'ED25519');\n\nconst resolvedKeypairFromEd25519 = (kp: Ed25519Keypair): ResolvedKeypair => ({\n\taddress: kp.toSuiAddress(),\n\tscheme: 'ed25519',\n\tpublicKey: kp.getPublicKey().toRawBytes(),\n\tsigner: kp,\n\tbech32Secret: kp.getSecretKey(),\n});\n"],"mappings":";;;;;;;;;;AA2DA,MAAa,mBACZ,KACA,aACA,YACyD;CACzD,MAAM,QAAQ,IAAI,aAAa;AAC/B,KAAI,UAAU,aAAa,UAAU,eAAe,UAAU,YAC7D,QAAO,OAAO,QAAQ,MAAM;AAE7B,QAAO,OAAO,KACb,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY,mCAAmC,IAAI;EACxE,MAAM;EACN,CAAC,CACF;;;;;;;;AASF,MAAa,0BACZ,gBAEA,OAAO,IAAI;CACV,WAAW;AAEV,SAAO,2BADI,eAAe,UACU,CAAC;;CAEtC,QAAQ,UACP,oBAAoB;EACnB,OAAO;EACP;EACA,SAAS;EACT,SAAS,YAAY,YAAY;EACjC;EACA,CAAC;CACH,CAAC;;;AAIH,MAAa,sBACZ,QACA,aACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,OAAO,IAAI;EAChC,WAAW,oBAAoB,OAAO;EACtC,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC;GACA,CAAC;EACH,CAAC;CACF,MAAM,SAAS,OAAO,gBAAgB,OAAO,QAAQ,aAAa,QAAQ;AAC1E,KAAI,WAAW,UAKd,QAAO,OAAO,OAAO,KACpB,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY,aAAa,OAAO,6BAA6B,QAAQ;EAC1F,MAAM;EACN,CAAC,CACF;AAEF,QAAO,OAAO,OAAO,IAAI;EACxB,WAAW;AAEV,UAAO,2BADI,eAAe,cAAc,OAAO,UACX,CAAC;;EAEtC,QAAQ,UACP,oBAAoB;GACnB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC;GACA,CAAC;EACH,CAAC;EACD;;;;AAKH,MAAa,mCACZ,WACA,aACA,YAEA,OAAO,IAAI;CACV,WAAW;AAEV,SAAO,2BADI,eAAe,cAAc,UACJ,CAAC;;CAEtC,QAAQ,UACP,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY;EACjC;EACA,CAAC;CACH,CAAC;AAQH,MAAM,8BAA8B,QAAyC;CAC5E,SAAS,GAAG,cAAc;CAC1B,QAAQ;CACR,WAAW,GAAG,cAAc,CAAC,YAAY;CACzC,QAAQ;CACR,cAAc,GAAG,cAAc;CAC/B"}
+{"version":3,"file":"keypair.mjs","names":[],"sources":["../../../src/plugins/account/keypair.ts"],"sourcesContent":["// Account plugin — keypair generation + scheme normalization helpers.\n//\n// Distilled-doc finding (12-account.md \"Scheme normalization\"\n// invariant): scheme surfaced to consumers MUST be lowercased at the\n// account boundary. Mixed-case from the SDK leaks into manifest\n// serialization and on-chain Move type matching if not converted. We\n// pin the canonical lowercased union at this module's boundary and\n// every variant resolver dumps through `normalizeScheme` before\n// producing the resolved value.\n//\n// Distilled-doc opportunity (\"Co-locate the canonical Account-value\n// Schema with the canonical type\"): the canonical signature scheme\n// union lives here, NOT next to the factory, so future Schema sits\n// alongside the type.\n\nimport { Effect } from 'effect';\n\nimport { decodeSuiPrivateKey, encodeSuiPrivateKey } from '@mysten/sui/cryptography';\nimport { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';\n\nimport {\n\taccountAcquireError,\n\ttype AccountAcquireError,\n\ttype AccountVariantKind,\n} from './errors.ts';\n\n/** Lowercased signature scheme — the canonical wire form. The SDK\n *  occasionally hands us `'ED25519'` / `'Secp256k1'`; the boundary\n *  conversion lives in `normalizeScheme`. */\nexport type SignatureScheme = 'ed25519' | 'secp256k1' | 'secp256r1';\n\n/** Resolved keypair shape — the variant resolvers all funnel into\n *  this so the funding + register passes are variant-agnostic.\n *\n *  Note: impersonation accounts do NOT produce a `Keypair`; they\n *  produce a `SyntheticImpersonationSigner` (see\n *  `variants/impersonate.ts`). The discriminator lives on the\n *  resolved `AccountValue` (architecture: distilled doc opportunity\n *  \"Tighten the resolved-account type\"). */\nexport interface ResolvedKeypair {\n\treadonly address: string;\n\treadonly scheme: SignatureScheme;\n\treadonly publicKey: Uint8Array;\n\t/** Opaque signer handle — typed loosely here because the four\n\t *  real variants (ed25519/secp256k1/secp256r1 + bring-your-own\n\t *  Signer) share no narrow TS type beyond `Signer`. The wallet /\n\t *  sign-and-execute capability narrows downstream. */\n\treadonly signer: unknown;\n\t/** Bech32-encoded secret. Only present for ephemeral / inline /\n\t *  env / keystore variants — `null` for `signer` (we never ask\n\t *  for it) and `impersonate` (no secret exists). */\n\treadonly bech32Secret: string | null;\n}\n\n/** Normalize the SDK's mixed-case scheme to the lowercased wire form.\n *  Unknown schemes surface as a typed acquisition error (distilled\n *  doc: \"Unsupported signature scheme (multisig / zklogin / passkey)\n *  — currently a raw throw; should be promoted to the typed-error\n *  channel\"). */\nexport const normalizeScheme = (\n\traw: string,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<SignatureScheme, AccountAcquireError> => {\n\tconst lower = raw.toLowerCase();\n\tif (lower === 'ed25519' || lower === 'secp256k1' || lower === 'secp256r1') {\n\t\treturn Effect.succeed(lower);\n\t}\n\treturn Effect.fail(\n\t\taccountAcquireError({\n\t\t\tphase: 'unsupported-scheme',\n\t\t\taccountName,\n\t\t\tvariant,\n\t\t\tmessage: `Account '${accountName}': unsupported signature scheme '${raw}'. devstack supports ed25519, secp256k1, secp256r1.`,\n\t\t\thint: 'Multisig, zklogin, and passkey schemes are not yet supported via the Account plugin — bring your own Signer via {kind:\"signer\"}.',\n\t\t}),\n\t);\n};\n\n/** Generate a fresh Ed25519 keypair. The default for the\n *  `ephemeral` variant.\n *\n *  Architecture-distilled invariant: schemes other than Ed25519\n *  must be loaded via keystore/env/inline; we never generate\n *  Secp256* keys from scratch. */\nexport const generateEd25519Keypair = (\n\taccountName: string,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst kp = Ed25519Keypair.generate();\n\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t},\n\t\tcatch: (cause): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'generate-keypair',\n\t\t\t\taccountName,\n\t\t\t\tvariant: 'ephemeral',\n\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.generate() threw.`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n/** Decode a bech32 `suiprivkey1...` string into a resolved keypair.\n *  Used by the inline / env / keystore variants. */\nexport const decodeBech32Secret = (\n\tbech32: string,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.gen(function* () {\n\t\tconst parsed = yield* Effect.try({\n\t\t\ttry: () => decodeSuiPrivateKey(bech32),\n\t\t\t// Secret-leak guard: the thrown error from `decodeSuiPrivateKey`\n\t\t\t// can echo the rejected bech32 string back in its message, so we\n\t\t\t// deliberately DROP the raw `cause`. The typed `message` already\n\t\t\t// names the failure; a malformed-secret error carries no\n\t\t\t// actionable diagnostic beyond \"it was malformed\".\n\t\t\tcatch: (): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'decode-inline',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': decodeSuiPrivateKey() rejected the supplied bech32 secret.`,\n\t\t\t\t}),\n\t\t});\n\t\tconst scheme = yield* normalizeScheme(parsed.scheme, accountName, variant);\n\t\tif (scheme !== 'ed25519') {\n\t\t\t// Architecture-distilled: today we only construct Ed25519 here.\n\t\t\t// Secp256k1 / Secp256r1 paths land when the SDK's per-scheme\n\t\t\t// Keypair classes are wired in; the typed-error channel keeps\n\t\t\t// the failure actionable until then.\n\t\t\treturn yield* Effect.fail(\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'unsupported-scheme',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': scheme '${scheme}' is not yet wired for the ${variant} variant.`,\n\t\t\t\t\thint: 'Wire the matching @mysten/sui/keypairs/<scheme> import next to the Ed25519 path.',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn yield* Effect.try({\n\t\t\ttry: () => {\n\t\t\t\tconst kp = Ed25519Keypair.fromSecretKey(parsed.secretKey);\n\t\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t\t},\n\t\t\t// Secret-leak guard: `fromSecretKey` can echo the decoded\n\t\t\t// secret-key bytes in its error — DROP the raw `cause`.\n\t\t\tcatch: (): AccountAcquireError =>\n\t\t\t\taccountAcquireError({\n\t\t\t\t\tphase: 'decode-inline',\n\t\t\t\t\taccountName,\n\t\t\t\t\tvariant,\n\t\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the decoded secret.`,\n\t\t\t\t}),\n\t\t});\n\t});\n\n/** Build a `ResolvedKeypair` view from a raw Ed25519 secret-key\n *  byte array. Used by the inline-bytes path (`variants/inline.ts`\n *  Uint8Array branch). */\nexport const resolvedKeypairFromEd25519Bytes = (\n\tsecretKey: Uint8Array,\n\taccountName: string,\n\tvariant: AccountVariantKind,\n): Effect.Effect<ResolvedKeypair, AccountAcquireError> =>\n\tEffect.try({\n\t\ttry: () => {\n\t\t\tconst kp = Ed25519Keypair.fromSecretKey(secretKey);\n\t\t\treturn resolvedKeypairFromEd25519(kp);\n\t\t},\n\t\t// Secret-leak guard: `fromSecretKey` can echo the raw secret-key\n\t\t// bytes in its error — DROP the raw `cause`. (Mirrors the\n\t\t// bech32 path in `decodeBech32Secret`.)\n\t\tcatch: (): AccountAcquireError =>\n\t\t\taccountAcquireError({\n\t\t\t\tphase: 'decode-inline',\n\t\t\t\taccountName,\n\t\t\t\tvariant,\n\t\t\t\tmessage: `Account '${accountName}': Ed25519Keypair.fromSecretKey() rejected the supplied raw bytes.`,\n\t\t\t}),\n\t});\n\n/** Encode a 32-byte secret key as a bech32 `suiprivkey1...` string\n *  for the canonical wire form. Re-exported because the\n *  `variants/inline.ts` Uint8Array branch needs it. */\nexport const encodeEd25519Bech32 = (bytes: Uint8Array): string =>\n\tencodeSuiPrivateKey(bytes, 'ED25519');\n\nconst resolvedKeypairFromEd25519 = (kp: Ed25519Keypair): ResolvedKeypair => ({\n\taddress: kp.toSuiAddress(),\n\tscheme: 'ed25519',\n\tpublicKey: kp.getPublicKey().toRawBytes(),\n\tsigner: kp,\n\tbech32Secret: kp.getSecretKey(),\n});\n"],"mappings":";;;;;;;;;;AA2DA,MAAa,mBACZ,KACA,aACA,YACyD;CACzD,MAAM,QAAQ,IAAI,aAAa;AAC/B,KAAI,UAAU,aAAa,UAAU,eAAe,UAAU,YAC7D,QAAO,OAAO,QAAQ,MAAM;AAE7B,QAAO,OAAO,KACb,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY,mCAAmC,IAAI;EACxE,MAAM;EACN,CAAC,CACF;;;;;;;;AASF,MAAa,0BACZ,gBAEA,OAAO,IAAI;CACV,WAAW;AAEV,SAAO,2BADI,eAAe,UACU,CAAC;;CAEtC,QAAQ,UACP,oBAAoB;EACnB,OAAO;EACP;EACA,SAAS;EACT,SAAS,YAAY,YAAY;EACjC;EACA,CAAC;CACH,CAAC;;;AAIH,MAAa,sBACZ,QACA,aACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,OAAO,IAAI;EAChC,WAAW,oBAAoB,OAAO;EAMtC,aACC,oBAAoB;GACnB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC,CAAC;EACH,CAAC;CACF,MAAM,SAAS,OAAO,gBAAgB,OAAO,QAAQ,aAAa,QAAQ;AAC1E,KAAI,WAAW,UAKd,QAAO,OAAO,OAAO,KACpB,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY,aAAa,OAAO,6BAA6B,QAAQ;EAC1F,MAAM;EACN,CAAC,CACF;AAEF,QAAO,OAAO,OAAO,IAAI;EACxB,WAAW;AAEV,UAAO,2BADI,eAAe,cAAc,OAAO,UACX,CAAC;;EAItC,aACC,oBAAoB;GACnB,OAAO;GACP;GACA;GACA,SAAS,YAAY,YAAY;GACjC,CAAC;EACH,CAAC;EACD;;;;AAKH,MAAa,mCACZ,WACA,aACA,YAEA,OAAO,IAAI;CACV,WAAW;AAEV,SAAO,2BADI,eAAe,cAAc,UACJ,CAAC;;CAKtC,aACC,oBAAoB;EACnB,OAAO;EACP;EACA;EACA,SAAS,YAAY,YAAY;EACjC,CAAC;CACH,CAAC;AAQH,MAAM,8BAA8B,QAAyC;CAC5E,SAAS,GAAG,cAAc;CAC1B,QAAQ;CACR,WAAW,GAAG,cAAc,CAAC,YAAY;CACzC,QAAQ;CACR,cAAc,GAAG,cAAc;CAC/B"}

package/dist/plugins/account/lease.mjs

@@ -1,4 +1,5 @@
 import { leaseKey } from "../../substrate/runtime/lease-broker/service.mjs";
+import "../../substrate/runtime/lease-broker/index.mjs";
 import { Effect } from "effect";
 //#region src/plugins/account/lease.ts
 /** Run `effect` while holding the per-address lease. Scope-bound

package/dist/plugins/account/lease.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"lease.mjs","names":[],"sources":["../../../src/plugins/account/lease.ts"],"sourcesContent":["// Account plugin — per-address lease helper.\n//\n// Thin wrapper over `LeaseBrokerService.acquire(...)` that opens a\n// fresh scope per call and keys the lease as `account:<address>`.\n// Both the funding pass (`funding.ts`) and the resolved-value\n// sign/execute closures (`service.ts`) share this helper so the\n// per-key encoding lives in exactly one place.\n//\n// Substrate name-blindness: the broker treats the key as opaque —\n// the `account:` prefix is a plugin convention so the broker's\n// `holders()` snapshot is readable in the renderer / debug logs.\n\nimport { Effect } from 'effect';\n\nimport { leaseKey, type LeaseBroker } from '../../substrate/runtime/lease-broker/index.ts';\n\n/** Run `effect` while holding the per-address lease. Scope-bound\n *  release: a fresh scope is opened per call, the broker installs\n *  an uninterruptible finalizer, and the lease drops the moment\n *  the inner Effect returns. Same-address concurrent callers\n *  serialize via the broker's FIFO queue.\n *\n *  Non-reentrant: nested calls for the SAME (broker, accountName,\n *  address) tuple deadlock. The broker has no concept of\n *  re-entrancy by design — per-address sequence-number semantics\n *  require at-most-one in-flight. */\nexport const withAddressLease = <A, E, R>(\n\tbroker: LeaseBroker,\n\taccountName: string,\n\taddress: string,\n\teffect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, E, R> =>\n\tEffect.scoped(\n\t\tEffect.gen(function* () {\n\t\t\tyield* broker.acquire(leaseKey(`account:${address}`), accountName);\n\t\t\treturn yield* effect;\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;;AA0BA,MAAa,oBACZ,QACA,aACA,SACA,WAEA,OAAO,OACN,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,QAAQ,SAAS,WAAW,UAAU,EAAE,YAAY;AAClE,QAAO,OAAO;EACb,CACF"}
+{"version":3,"file":"lease.mjs","names":[],"sources":["../../../src/plugins/account/lease.ts"],"sourcesContent":["// Account plugin — per-address lease helper.\n//\n// Thin wrapper over `LeaseBrokerService.acquire(...)` that opens a\n// fresh scope per call and keys the lease as `account:<address>`.\n// Both the funding pass (`funding.ts`) and the resolved-value\n// sign/execute closures (`service.ts`) share this helper so the\n// per-key encoding lives in exactly one place.\n//\n// Substrate name-blindness: the broker treats the key as opaque —\n// the `account:` prefix is a plugin convention so the broker's\n// `holders()` snapshot is readable in the renderer / debug logs.\n\nimport { Effect } from 'effect';\n\nimport { leaseKey, type LeaseBroker } from '../../substrate/runtime/lease-broker/index.ts';\n\n/** Run `effect` while holding the per-address lease. Scope-bound\n *  release: a fresh scope is opened per call, the broker installs\n *  an uninterruptible finalizer, and the lease drops the moment\n *  the inner Effect returns. Same-address concurrent callers\n *  serialize via the broker's FIFO queue.\n *\n *  Non-reentrant: nested calls for the SAME (broker, accountName,\n *  address) tuple deadlock. The broker has no concept of\n *  re-entrancy by design — per-address sequence-number semantics\n *  require at-most-one in-flight. */\nexport const withAddressLease = <A, E, R>(\n\tbroker: LeaseBroker,\n\taccountName: string,\n\taddress: string,\n\teffect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, E, R> =>\n\tEffect.scoped(\n\t\tEffect.gen(function* () {\n\t\t\tyield* broker.acquire(leaseKey(`account:${address}`), accountName);\n\t\t\treturn yield* effect;\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;;;AA0BA,MAAa,oBACZ,QACA,aACA,SACA,WAEA,OAAO,OACN,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,QAAQ,SAAS,WAAW,UAAU,EAAE,YAAY;AAClE,QAAO,OAAO;EACb,CACF"}

package/dist/plugins/account/registry.d.mts

@@ -22,11 +22,24 @@ interface AccountRegistryFunding {
   readonly requestedMist: string | null;
   readonly entries?: ReadonlyArray<AccountRegistryFundingEntry>;
 }
+/** Per-entry funding status — the projection's per-row "did we actually
+ *  hit the faucet?" signal.
+ *
+ *   - `'funded'`            — a wire call ran and balance settled.
+ *   - `'already-satisfied'` — the pre-existing balance covered the
+ *                             request, so no wire call ran.
+ *   - `'skipped'`           — the entry was zero-amount, dropped at
+ *                             the funding-pass boundary, or there was
+ *                             no registered strategy (cross-cutting
+ *                             non-SUI silent-noop).
+ *
+ *  Splitting `'funded'` from `'already-satisfied'` matches the
+ *  applied-projection invariant in `service.ts:858-887`. */
 interface AccountRegistryFundingEntry {
   readonly coin: string;
   readonly fullCoinType: string;
   readonly amount: string;
-  readonly status: 'funded' | 'skipped';
+  readonly status: 'funded' | 'already-satisfied' | 'skipped';
 }
 //#endregion
 export { AccountRegistryEntry, AccountRegistryFunding };

package/dist/plugins/account/registry.mjs

@@ -1,3 +1,4 @@
+import { projection } from "../../api/define-capabilities.mjs";
 //#region src/plugins/account/registry.ts
 const accountRegistryKey = (name) => `account:${name}`;
 /** Construct the strategy-contributor decl Account emits for one
@@ -11,24 +12,23 @@ const makeAccountRegistryContribution = (entry) => ({
 });
 const makeAccountProjectionContribution = (entry) => {
 	const updatedAt = Date.now();
-	return {
-		kind: "projection",
-		event: {
-			tag: "account.updated",
-			account: {
-				key: `account/${entry.name}`,
-				rowKey: null,
-				name: entry.name,
-				address: entry.address,
-				scheme: entry.scheme,
-				source: entry.source,
-				funding: entry.funding,
-				walletVisible: false,
-				updatedAt
-			},
-			at: updatedAt
-		}
-	};
+	const key = `account/${entry.name}`;
+	return projection({
+		kind: "account",
+		key,
+		payload: {
+			key,
+			rowKey: null,
+			name: entry.name,
+			address: entry.address,
+			scheme: entry.scheme,
+			source: entry.source,
+			funding: entry.funding,
+			walletVisible: false,
+			updatedAt
+		},
+		at: updatedAt
+	});
 };
 //#endregion
 export { accountRegistryKey, makeAccountProjectionContribution, makeAccountRegistryContribution };

package/dist/plugins/account/registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.mjs","names":[],"sources":["../../../src/plugins/account/registry.ts"],"sourcesContent":["// Account plugin — per-stack registry contribution.\n//\n// Architecture (12-account.md \"Outputs / capabilities provided\"):\n// Account publishes `{name, address}` to a per-stack account\n// registry. Downstream consumers (Wallet, Codegen, the manifest\n// emitter, Coin's deepbook market maker) look accounts up by name.\n//\n// The architecture's `strategy-contributor` capability covers this\n// shape — Account contributes one entry per acquired account under\n// the capability key `account:<name>`. The strategy value is the\n// resolved-account view (sans signing closures, which stay scoped\n// to the acquire body's lifetime; consumers ask the Account tag\n// directly when they need to sign).\n//\n// Distilled-doc opportunity: today's `publishAccount(...)` writes\n// into an engine-singleton registry. The redesign moves it onto the\n// capability-decl surface so the substrate orchestrates dedup-by-\n// name and last-write-wins without an engine import.\n\nimport type { ProjectionDecl } from '../../contracts/projection.ts';\nimport type { StrategyContributorDecl } from '../../contracts/strategy-contributor.ts';\n\n/** Capability key for the per-name account registry. The literal\n *  form (`account:<name>`) lets downstream consumers (Coin, Wallet,\n *  the manifest emitter) `StrategyFor<Caps, \"account:alice\">` to\n *  recover the registered address at the type level. */\nexport type AccountRegistryKey<Name extends string> = `account:${Name}`;\n\nexport const accountRegistryKey = <Name extends string>(name: Name): AccountRegistryKey<Name> =>\n\t`account:${name}` as AccountRegistryKey<Name>;\n\n/** The strategy value published under `account:<name>`. Carries the\n *  load-bearing identity columns only — signing closures stay on\n *  the Account tag's resolved value because their lifetime is\n *  scope-bounded.\n *\n *  Architecture-distilled (12-account.md \"Tighten the resolved-\n *  account type\"): the `source` discriminator is mandatory so\n *  consumers can branch on impersonation without a `publicKey`\n *  nullcheck (impersonation accounts have a zero-buffer publicKey\n *  — a type-level lie). */\nexport interface AccountRegistryEntry {\n\treadonly name: string;\n\treadonly address: string;\n\treadonly scheme: 'ed25519' | 'secp256k1' | 'secp256r1';\n\treadonly source: 'real' | 'impersonate';\n\treadonly funding: AccountRegistryFunding;\n}\n\nexport interface AccountRegistryFunding {\n\treadonly status: 'funded' | 'skipped' | 'unknown';\n\treadonly balanceMist: string | null;\n\treadonly requestedMist: string | null;\n\treadonly entries?: ReadonlyArray<AccountRegistryFundingEntry>;\n}\n\nexport interface AccountRegistryFundingEntry {\n\treadonly coin: string;\n\treadonly fullCoinType: string;\n\treadonly amount: string;\n\treadonly status: 'funded' | 'skipped';\n}\n\n/** Construct the strategy-contributor decl Account emits for one\n *  acquired identity. Auto-mounted: the registry's role is\n *  infrastructure; the user never types it explicitly. */\nexport const makeAccountRegistryContribution = <Name extends string>(\n\tentry: AccountRegistryEntry & { readonly name: Name },\n): StrategyContributorDecl<AccountRegistryKey<Name>, AccountRegistryEntry> => ({\n\tkind: 'strategy-contributor',\n\tcapabilityKey: accountRegistryKey(entry.name),\n\tstrategy: entry,\n\tautoMounted: true,\n});\n\nexport const makeAccountProjectionContribution = <Name extends string>(\n\tentry: AccountRegistryEntry & { readonly name: Name },\n): ProjectionDecl => {\n\tconst updatedAt = Date.now();\n\treturn {\n\t\tkind: 'projection',\n\t\tevent: {\n\t\t\ttag: 'account.updated',\n\t\t\taccount: {\n\t\t\t\tkey: `account/${entry.name}` as `account/${string}`,\n\t\t\t\trowKey: null,\n\t\t\t\tname: entry.name,\n\t\t\t\taddress: entry.address,\n\t\t\t\tscheme: entry.scheme,\n\t\t\t\tsource: entry.source,\n\t\t\t\tfunding: entry.funding,\n\t\t\t\twalletVisible: false,\n\t\t\t\tupdatedAt,\n\t\t\t},\n\t\t\tat: updatedAt,\n\t\t},\n\t};\n};\n"],"mappings":";AA4BA,MAAa,sBAA2C,SACvD,WAAW;;;;AAqCZ,MAAa,mCACZ,WAC8E;CAC9E,MAAM;CACN,eAAe,mBAAmB,MAAM,KAAK;CAC7C,UAAU;CACV,aAAa;CACb;AAED,MAAa,qCACZ,UACoB;CACpB,MAAM,YAAY,KAAK,KAAK;AAC5B,QAAO;EACN,MAAM;EACN,OAAO;GACN,KAAK;GACL,SAAS;IACR,KAAK,WAAW,MAAM;IACtB,QAAQ;IACR,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,eAAe;IACf;IACA;GACD,IAAI;GACJ;EACD"}
+{"version":3,"file":"registry.mjs","names":[],"sources":["../../../src/plugins/account/registry.ts"],"sourcesContent":["// Account plugin — per-stack registry contribution.\n//\n// Architecture (12-account.md \"Outputs / capabilities provided\"):\n// Account publishes `{name, address}` to a per-stack account\n// registry. Downstream consumers (Wallet, Codegen, the manifest\n// emitter, Coin's deepbook market maker) look accounts up by name.\n//\n// The architecture's `strategy-contributor` capability covers this\n// shape — Account contributes one entry per acquired account under\n// the capability key `account:<name>`. The strategy value is the\n// resolved-account view (sans signing closures, which stay scoped\n// to the acquire body's lifetime; consumers ask the Account tag\n// directly when they need to sign).\n//\n// Distilled-doc opportunity: today's `publishAccount(...)` writes\n// into an engine-singleton registry. The redesign moves it onto the\n// capability-decl surface so the substrate orchestrates dedup-by-\n// name and last-write-wins without an engine import.\n\nimport { projection } from '../../api/define-capabilities.ts';\nimport type { ProjectionDecl } from '../../contracts/projection.ts';\nimport type { StrategyContributorDecl } from '../../contracts/strategy-contributor.ts';\n\n/** Capability key for the per-name account registry. The literal\n *  form (`account:<name>`) lets downstream consumers (Coin, Wallet,\n *  the manifest emitter) `StrategyFor<Caps, \"account:alice\">` to\n *  recover the registered address at the type level. */\nexport type AccountRegistryKey<Name extends string> = `account:${Name}`;\n\nexport const accountRegistryKey = <Name extends string>(name: Name): AccountRegistryKey<Name> =>\n\t`account:${name}` as AccountRegistryKey<Name>;\n\n/** The strategy value published under `account:<name>`. Carries the\n *  load-bearing identity columns only — signing closures stay on\n *  the Account tag's resolved value because their lifetime is\n *  scope-bounded.\n *\n *  Architecture-distilled (12-account.md \"Tighten the resolved-\n *  account type\"): the `source` discriminator is mandatory so\n *  consumers can branch on impersonation without a `publicKey`\n *  nullcheck (impersonation accounts have a zero-buffer publicKey\n *  — a type-level lie). */\nexport interface AccountRegistryEntry {\n\treadonly name: string;\n\treadonly address: string;\n\treadonly scheme: 'ed25519' | 'secp256k1' | 'secp256r1';\n\treadonly source: 'real' | 'impersonate';\n\treadonly funding: AccountRegistryFunding;\n}\n\nexport interface AccountRegistryFunding {\n\treadonly status: 'funded' | 'skipped' | 'unknown';\n\treadonly balanceMist: string | null;\n\treadonly requestedMist: string | null;\n\treadonly entries?: ReadonlyArray<AccountRegistryFundingEntry>;\n}\n\n/** Per-entry funding status — the projection's per-row \"did we actually\n *  hit the faucet?\" signal.\n *\n *   - `'funded'`            — a wire call ran and balance settled.\n *   - `'already-satisfied'` — the pre-existing balance covered the\n *                             request, so no wire call ran.\n *   - `'skipped'`           — the entry was zero-amount, dropped at\n *                             the funding-pass boundary, or there was\n *                             no registered strategy (cross-cutting\n *                             non-SUI silent-noop).\n *\n *  Splitting `'funded'` from `'already-satisfied'` matches the\n *  applied-projection invariant in `service.ts:858-887`. */\nexport interface AccountRegistryFundingEntry {\n\treadonly coin: string;\n\treadonly fullCoinType: string;\n\treadonly amount: string;\n\treadonly status: 'funded' | 'already-satisfied' | 'skipped';\n}\n\n/** Construct the strategy-contributor decl Account emits for one\n *  acquired identity. Auto-mounted: the registry's role is\n *  infrastructure; the user never types it explicitly. */\nexport const makeAccountRegistryContribution = <Name extends string>(\n\tentry: AccountRegistryEntry & { readonly name: Name },\n): StrategyContributorDecl<AccountRegistryKey<Name>, AccountRegistryEntry> => ({\n\tkind: 'strategy-contributor',\n\tcapabilityKey: accountRegistryKey(entry.name),\n\tstrategy: entry,\n\tautoMounted: true,\n});\n\nexport const makeAccountProjectionContribution = <Name extends string>(\n\tentry: AccountRegistryEntry & { readonly name: Name },\n): ProjectionDecl => {\n\tconst updatedAt = Date.now();\n\tconst key = `account/${entry.name}` as `account/${string}`;\n\treturn projection({\n\t\tkind: 'account',\n\t\tkey,\n\t\tpayload: {\n\t\t\tkey,\n\t\t\trowKey: null,\n\t\t\tname: entry.name,\n\t\t\taddress: entry.address,\n\t\t\tscheme: entry.scheme,\n\t\t\tsource: entry.source,\n\t\t\tfunding: entry.funding,\n\t\t\twalletVisible: false,\n\t\t\tupdatedAt,\n\t\t},\n\t\tat: updatedAt,\n\t});\n};\n"],"mappings":";;AA6BA,MAAa,sBAA2C,SACvD,WAAW;;;;AAkDZ,MAAa,mCACZ,WAC8E;CAC9E,MAAM;CACN,eAAe,mBAAmB,MAAM,KAAK;CAC7C,UAAU;CACV,aAAa;CACb;AAED,MAAa,qCACZ,UACoB;CACpB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,MAAM,WAAW,MAAM;AAC7B,QAAO,WAAW;EACjB,MAAM;EACN;EACA,SAAS;GACR;GACA,QAAQ;GACR,MAAM,MAAM;GACZ,SAAS,MAAM;GACf,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,eAAe;GACf;GACA;EACD,IAAI;EACJ,CAAC"}

package/dist/plugins/account/service.d.mts

@@ -1,5 +1,5 @@
 import { AccountSignError } from "./errors.mjs";
-import { TransactionSignerScope } from "../../substrate/runtime/sui-execute/index.mjs";
+import { ExecutedFailure, TransactionSignerScope } from "../../substrate/runtime/sui-execute/index.mjs";
 import { AccountFunding, AccountFundingResult } from "./funding.mjs";
 import { Effect } from "effect";
 
@@ -70,7 +70,7 @@ interface AccountValue {
    *  For impersonation accounts, routes through Sui's fork
    *  admin `impersonate` surface; for real signers, routes
    *  through the SDK's executeTransaction surface. */
-  readonly signAndExecute: (tx: Uint8Array) => Effect.Effect<TxResult, AccountSignError>;
+  readonly signAndExecute: (tx: Uint8Array) => Effect.Effect<SignAndExecuteResult, AccountSignError>;
   /** Run a full account-bound transaction critical section.
    *  Callers that must serialize `Transaction.build({ client })`
    *  together with signing/execution use the signer passed to this
@@ -89,16 +89,35 @@ interface AccountValue {
   readonly funding: AccountFundingResult;
 }
 /** Submit result projection — kept narrow so downstream consumers
- *  don't depend on the full @mysten/sui execute envelope. */
+ *  don't depend on the full @mysten/sui execute envelope. Populated
+ *  only when the on-chain execution succeeded (the `'Transaction'`
+ *  variant of `SignAndExecuteResult`). */
 interface TxResult {
   readonly digest: string;
   readonly effects: unknown;
   readonly objectChanges: ReadonlyArray<unknown>;
   readonly balanceChanges: ReadonlyArray<unknown>;
 }
+/** Outcome of `signAndExecute`. Mirrors the SDK's discriminated
+ *  `SuiClientTypes.TransactionResult` shape — on-chain failures are
+ *  a RETURN VALUE (callers dispatch on `$kind`), NOT an error. Only
+ *  transport / lifecycle failures (sign refused, RPC unreachable,
+ *  finality wait broke) surface through `AccountSignError`.
+ *
+ *  The on-chain `FailedTransaction` projection is the substrate
+ *  `ExecutedFailure` shape — single source of truth lives in
+ *  `substrate/runtime/sui-execute/index.ts`. An envelope without a
+ *  digest fails at projection with `AccountSignError(phase: 'no-digest')`. */
+type SignAndExecuteResult = {
+  readonly $kind: 'Transaction';
+  readonly Transaction: TxResult;
+} | {
+  readonly $kind: 'FailedTransaction';
+  readonly FailedTransaction: ExecutedFailure;
+};
 interface AccountTransactionSigner extends TransactionSignerScope<AccountSignError> {
   readonly signAndExecute: AccountValue['signAndExecute'];
 }
 //#endregion
-export { AccountOptions, AccountValue, TxResult };
+export { AccountOptions, AccountValue, SignAndExecuteResult, TxResult };
 //# sourceMappingURL=service.d.mts.map