@mysten-incubation/devstack 0.0.1 → 0.1.1

package/dist/plugins/seal/mode/local-keygen.mjs

@@ -1,10 +1,14 @@
+import { SpanAttr } from "../../../substrate/runtime/observability/spans.mjs";
+import { versionedDocSchema } from "../../../substrate/versioned-doc-schema.mjs";
 import { atomicWriteFile } from "../../../substrate/runtime/atomic-write.mjs";
+import { decodeJsonText } from "../../../substrate/runtime/runtime-decode.mjs";
 import { sealError } from "../errors.mjs";
+import { SealSpans } from "../spans.mjs";
 import { MASTER_KEY_ENVFILE_BASENAME, runSealKeygen } from "../keygen.mjs";
 import { buildKeyServerSpec, startKeyServer } from "../key-server.mjs";
 import { parseMasterKeyEnvFile, renderSealKeyServerConfig, stageSealConfig } from "../config-render.mjs";
 import { publishSealPackage, registerKeyServer } from "../deploy.mjs";
-import { makeKeyManager, stubRotate } from "../key-manager.mjs";
+import { makeKeyManager } from "../key-manager.mjs";
 import { resolveDefaultSealSource } from "../bootstrap-assets/source-fetch.mjs";
 import { resolveDefaultSealCargoImage } from "../bootstrap-assets/cargo-image.mjs";
 import { Effect, FileSystem, Schema } from "effect";
@@ -24,20 +28,17 @@ const resolveLocalKeygenOptions = (opts, defaultVersion) => ({
 });
 const LOCAL_KEYGEN_STATE_VERSION = 1;
 const LOCAL_KEYGEN_STATE_BASENAME = "local-keygen-state.v1.json";
-const PersistedLocalKeygenMetadataSchema = Schema.Struct({
-	version: Schema.Literal(LOCAL_KEYGEN_STATE_VERSION),
-	publicKey: Schema.String
-});
+const PersistedLocalKeygenMetadataSchema = versionedDocSchema(LOCAL_KEYGEN_STATE_VERSION, { publicKey: Schema.String });
 const localKeygenMetadataPath = (servicePath) => `${servicePath}/${LOCAL_KEYGEN_STATE_BASENAME}`;
 const readPersistedLocalKeygenMetadata = (servicePath) => Effect.gen(function* () {
-	const raw = yield* (yield* FileSystem.FileSystem).readFileString(localKeygenMetadataPath(servicePath)).pipe(Effect.catch(() => Effect.succeed(null)));
+	const fs = yield* FileSystem.FileSystem;
+	const path = localKeygenMetadataPath(servicePath);
+	const raw = yield* fs.readFileString(path).pipe(Effect.catch(() => Effect.succeed(null)));
 	if (raw === null) return null;
-	const parsed = yield* Effect.try({
-		try: () => JSON.parse(raw),
-		catch: () => null
+	return yield* decodeJsonText(PersistedLocalKeygenMetadataSchema, raw, {
+		source: path,
+		mkError: (issue) => issue
 	}).pipe(Effect.catch(() => Effect.succeed(null)));
-	if (parsed === null) return null;
-	return yield* Schema.decodeUnknownEffect(PersistedLocalKeygenMetadataSchema)(parsed).pipe(Effect.catch(() => Effect.succeed(null)));
 });
 const stagePersistedLocalKeygenMetadata = (servicePath, name, metadata) => atomicWriteFile(localKeygenMetadataPath(servicePath), new TextEncoder().encode(`${JSON.stringify(metadata, null, 2)}\n`), {
 	mode: 420,
@@ -62,6 +63,39 @@ const readPersistedLocalKeygenState = (servicePath) => Effect.gen(function* () {
 		masterKeyEnvFile
 	};
 });
+/** BLS12-381 master key — 32 bytes, persisted as 64 hex chars. */
+const BLS_MASTER_KEY_HEX_LEN = 64;
+/** BLS12-381 G2 uncompressed public key — 96 bytes, persisted as 192 hex chars. */
+const BLS_PUBLIC_KEY_HEX_LEN = 192;
+const HEX_ONLY_RE = /^[0-9a-fA-F]+$/;
+/** Stricter decode than the JSON-shape Schema alone — verifies the
+*  persisted master key + public key are well-formed BLS12-381 hex of
+*  the expected widths. The Schema validation alone accepts any
+*  string, so a corrupt-on-disk JSON whose `publicKey` was overwritten
+*  to a shorter / wrong-width value would otherwise be silently
+*  reused on boot — leading to a master-key / KeyServer mismatch
+*  (the master-key.env carries one key, the registered KeyServer's
+*  on-chain `publicKey` carries a different one). Distilled-doc
+*  invariant #6 (keypair B8 verify cascade) covers the on-chain
+*  side; this is the on-disk side.
+*
+*  We cannot in-process re-derive the G2 public key from the master
+*  scalar without bundling a BLS12-381 implementation (the keygen
+*  binary owns this in cargo-land). The width invariant is the
+*  cheapest defense that catches the realistic corruption modes:
+*  truncated writes, hand-edited JSON, stale persistence from an
+*  older devstack version. */
+const validatePersistedKeyMaterialShape = (material, name) => {
+	if (material.masterKey.length !== BLS_MASTER_KEY_HEX_LEN || !HEX_ONLY_RE.test(material.masterKey)) return Effect.fail(sealError("config-render", {
+		name,
+		message: `seal.local-keygen: persisted master key in ${MASTER_KEY_ENVFILE_BASENAME} is not ${BLS_MASTER_KEY_HEX_LEN}-char hex (got ${material.masterKey.length} chars). The on-disk state is corrupt; delete the seal service directory and re-boot to regenerate, or restore from a known-good snapshot.`
+	}));
+	if (material.publicKey.length !== BLS_PUBLIC_KEY_HEX_LEN || !HEX_ONLY_RE.test(material.publicKey)) return Effect.fail(sealError("config-render", {
+		name,
+		message: `seal.local-keygen: persisted publicKey in ${LOCAL_KEYGEN_STATE_BASENAME} is not ${BLS_PUBLIC_KEY_HEX_LEN}-char hex (got ${material.publicKey.length} chars). The on-disk state is corrupt; reusing it would publish a KeyServer whose on-chain publicKey diverges from the local master key. Delete the seal service directory and re-boot to regenerate.`
+	}));
+	return Effect.void;
+};
 const sealConfigFingerprint = (parts) => [
 	`package=${parts.packageId}`,
 	`keyServer=${parts.keyServerObjectId}`,
@@ -136,11 +170,7 @@ const startLocalKeygenContainer = (deps, opts, cargoImage, state) => Effect.gen(
 		objectId: state.keyServerObjectId,
 		weight: 1
 	}];
-	const keyManager = makeKeyManager({
-		name: opts.name,
-		masterKeyEnvFile: state.masterKeyEnvFile,
-		rotateImpl: stubRotate(opts.name)
-	});
+	const keyManager = makeKeyManager({ masterKeyEnvFile: state.masterKeyEnvFile });
 	return {
 		keyServer: {
 			serverConfigs,
@@ -160,9 +190,15 @@ const startLocalKeygenContainer = (deps, opts, cargoImage, state) => Effect.gen(
 *  circuits before downstream phases (cheap on warm restart because
 *  the ArtifactPublisher cache + verify covers steps 3-4). */
 const bootLocalKeygen = (deps, opts) => Effect.gen(function* () {
-	const cargoImage = yield* resolveDefaultSealCargoImage(deps.runtime);
+	const cargoImage = yield* resolveDefaultSealCargoImage(deps.runtime, {
+		app: deps.labels.app,
+		stack: deps.labels.stack
+	});
 	const persisted = yield* readPersistedLocalKeygenState(deps.servicePath);
-	if (persisted !== null) return yield* startLocalKeygenContainer(deps, opts, cargoImage, yield* stageResolvedLocalKeygenState(deps, opts, yield* ensureLocalKeygenArtifacts(deps, opts, persisted.publicKey), persisted));
+	if (persisted !== null) {
+		yield* validatePersistedKeyMaterialShape(persisted, opts.name);
+		return yield* startLocalKeygenContainer(deps, opts, cargoImage, yield* stageResolvedLocalKeygenState(deps, opts, yield* ensureLocalKeygenArtifacts(deps, opts, persisted.publicKey), persisted));
+	}
 	const keypair = yield* runSealKeygen(deps.runtime, opts.name, cargoImage);
 	return yield* startLocalKeygenContainer(deps, opts, cargoImage, yield* stageResolvedLocalKeygenState(deps, opts, yield* ensureLocalKeygenArtifacts(deps, opts, keypair.publicKey), keypair));
 }).pipe(Effect.catchTag("ArtifactPublishError", (err) => Effect.fail(sealError("seal", {
@@ -170,9 +206,9 @@ const bootLocalKeygen = (deps, opts) => Effect.gen(function* () {
 	message: `seal.local-keygen: on-chain artifact failure (${err.reason}): ${err.detail}`,
 	cause: err
 }))), Effect.withSpan("devstack.plugin.seal.localKeygen.boot", { attributes: {
-	"devstack.plugin": "seal",
-	"seal.name": opts.name,
-	"seal.version": opts.version
+	[SpanAttr.plugin]: "seal",
+	[SealSpans.name]: opts.name,
+	[SealSpans.version]: opts.version
 } }));
 //#endregion
 export { bootLocalKeygen, resolveLocalKeygenOptions };

package/dist/plugins/seal/mode/local-keygen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"local-keygen.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/local-keygen.ts"],"sourcesContent":["// Seal local-keygen mode — the full localnet path.\n//\n// Distilled-doc reference (07-seal.md §\"Lifecycle / Startup —\n// `sealLocalKeygen`\"). Eight ordered phases:\n//\n//   0. Yield deps (Sui, Identity, ContainerRuntime, artifact publisher publisher).\n//   1. Image build (bootstrap asset — parallel with sui's boot).\n//  1a. Move source resolve (bootstrap asset, conditional).\n//   2. BLS keygen one-shot (real `runtime.runOneShot` against cargo\n//                            image; output parsed via regex).\n//   3. Publish seal Move package (via artifact publisher primitive).\n//   4. Register on-chain KeyServer (via artifact publisher primitive).\n//   5. Render config yaml + stage master-key env-file (atomic\n//                                                       FileSystem\n//                                                       writes).\n//   6. Start long-running key-server container (real\n//                                               `runtime.ensureContainer`\n//                                               + exec-based ready\n//                                               probe).\n//   7. Project the plugin's aggregate value.\n//\n// Distilled-doc invariants pinned by this file:\n//\n//   #1  KeyServer.url == routed hostname        — single mint point\n//                                                 (`routedUrl` passed\n//                                                 identically into\n//                                                 `registerKeyServer`\n//                                                 and `buildKeyServerSpec`).\n//   #2  Boot order keygen → publish → register → config → container.\n//   #4  env-file for secret loading (not -e MASTER_KEY=…).\n//   #5  No host-port publish.\n//   #6  Keypair B8 verify cascade (deploy.ts:buildKeypairVerify).\n//   #7  Signal-forwarding entrypoint shell (image-side).\n//   #8  Fork incompatibility throw — handled at the barrel\n//       (`index.ts`), NOT here.\n//   #9  Peer-dep structural assignability (compile-time check\n//       lives in registry-publish.ts).\n//\n// This is the substrate-name-LEAK boundary. Inside this file we can\n// say \"seal\"; outside `src/plugins/seal/`, the substrate doesn't\n// know seal exists.\n\nimport { Effect, FileSystem, Path, Schema, type Scope } from 'effect';\n\nimport type { ChainId } from '../../../substrate/brand.ts';\nimport type { ChainProbe } from '../../../contracts/chain-probe.ts';\nimport type { ContainerLabelTuple } from '../../../contracts/snapshotable.ts';\nimport type { ContainerRuntime, ImageRef } from '../../../contracts/container-runtime.ts';\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../../primitives/artifact-publisher.ts';\nimport type { AccountValue } from '../../account/service.ts';\nimport {\n\tparseMasterKeyEnvFile,\n\trenderSealKeyServerConfig,\n\tstageSealConfig,\n} from '../config-render.ts';\nimport {\n\tpublishSealPackage,\n\tregisterKeyServer,\n\ttype SealObjectProbeKey,\n\ttype SealSuiSdk,\n} from '../deploy.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { MASTER_KEY_ENVFILE_BASENAME, runSealKeygen, type PersistedBlsKeypair } from '../keygen.ts';\nimport { makeKeyManager, stubRotate } from '../key-manager.ts';\nimport { buildKeyServerSpec, startKeyServer, type KeyServerContainerSpec } from '../key-server.ts';\nimport type { SealKeyServerEntry, SealLocalKeygenResolved } from '../registry-publish.ts';\nimport { resolveDefaultSealCargoImage } from '../bootstrap-assets/cargo-image.ts';\nimport { resolveDefaultSealSource } from '../bootstrap-assets/source-fetch.ts';\nimport { atomicWriteFile } from '../../../substrate/runtime/atomic-write.ts';\n\n// ---------------------------------------------------------------------------\n// Options (factory-time)\n// ---------------------------------------------------------------------------\n\n/** Options the local-keygen mode accepts. Mirrors v3\n *  `SealLocalKeygenOptions` (07-seal.md §\"Configuration\"). The\n *  barrel (`index.ts`) folds the typed `SealLocalKeygenOptions`\n *  surface into this internal shape after default resolution. */\nexport interface LocalKeygenOptions {\n\treadonly name?: string;\n\treadonly version?: string;\n\treadonly movePackagePath?: string;\n\treadonly readyTimeoutMs?: number;\n\treadonly keyServerName?: string;\n}\n\n/** Resolved options after defaults are applied. */\nexport interface ResolvedLocalKeygenOptions {\n\treadonly name: string;\n\treadonly version: string;\n\treadonly readyTimeoutMs: number;\n\treadonly keyServerName: string;\n\treadonly movePackagePath?: string;\n}\n\nconst DEFAULT_READY_TIMEOUT_MS = 60_000;\nconst DEFAULT_KEY_SERVER_NAME = 'devstack-local';\n\n/** Synchronous factory-time defaults application. Pure — no\n *  validation throws because the localnet signer requirement is\n *  enforced one layer up in the barrel (the type-narrowed\n *  `sealFor(local).localKeygen({signer})` makes signer required). */\nexport const resolveLocalKeygenOptions = (\n\topts: LocalKeygenOptions,\n\tdefaultVersion: string,\n): ResolvedLocalKeygenOptions => ({\n\tname: opts.name ?? 'seal',\n\tversion: opts.version ?? defaultVersion,\n\treadyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\tkeyServerName: opts.keyServerName ?? DEFAULT_KEY_SERVER_NAME,\n\tmovePackagePath: opts.movePackagePath,\n});\n\n// ---------------------------------------------------------------------------\n// Inputs to the boot pipeline (acquire-time)\n// ---------------------------------------------------------------------------\n\n/** Acquire-time deps the boot pipeline consumes. Sourced by the\n *  barrel (`index.ts`) from a mix of:\n *\n *   - substrate-resolved values (`IdentityContext`,\n *     `ContainerRuntimeService`, `ArtifactPublisher`);\n *   - substrate-derived identifiers (chainId, servicePath,\n *     subnet, etc.);\n *   - router-resolved URL (single mint — distilled-doc invariant #1).\n *\n *  The barrel composes these from substrate services\n *  (ContainerRuntime, IdentityContext, ArtifactPublisher,\n *  StackPathsService) at acquire-time. */\nexport interface LocalKeygenDeps {\n\treadonly runtime: ContainerRuntime;\n\treadonly publisher: ArtifactPublisher;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n\treadonly chain: ChainId;\n\t/** Per-stack on-disk dir under `runtime/seal/`. Host path for the\n\t *  config yaml + master-key env-file. */\n\treadonly servicePath: string;\n\t/** Container name composed by the substrate (app + stack + name +\n\t *  role). */\n\treadonly containerName: string;\n\t/** Label tuple driving snapshot/inspect by labels. */\n\treadonly labels: ContainerLabelTuple;\n\t/** Seal's per-stack docker network — the key-server daemon attaches\n\t *  to this network. */\n\treadonly suiNetworkName: string;\n\t/** In-network sui RPC URL — the daemon's CONFIG_PATH yaml carries\n\t *  this. */\n\treadonly suiRpcUrlInNetwork: string;\n\t/** Router-resolved single mint (distilled-doc invariant #1). */\n\treadonly routedHostname: string;\n\treadonly routedUrl: string;\n}\n\ninterface PersistedLocalKeygenKeyMaterial {\n\treadonly masterKey: string;\n\treadonly publicKey: string;\n\treadonly masterKeyEnvFile: string;\n}\n\ninterface PersistedLocalKeygenState extends PersistedLocalKeygenKeyMaterial {\n\treadonly packageId: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst LOCAL_KEYGEN_STATE_VERSION = 1;\nconst LOCAL_KEYGEN_STATE_BASENAME = 'local-keygen-state.v1.json';\n\nconst PersistedLocalKeygenMetadataSchema = Schema.Struct({\n\tversion: Schema.Literal(LOCAL_KEYGEN_STATE_VERSION),\n\tpublicKey: Schema.String,\n});\n\ntype PersistedLocalKeygenMetadata = Schema.Schema.Type<typeof PersistedLocalKeygenMetadataSchema>;\n\nconst localKeygenMetadataPath = (servicePath: string): string =>\n\t`${servicePath}/${LOCAL_KEYGEN_STATE_BASENAME}`;\n\nconst readPersistedLocalKeygenMetadata = (\n\tservicePath: string,\n): Effect.Effect<PersistedLocalKeygenMetadata | null, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst raw = yield* fs\n\t\t\t.readFileString(localKeygenMetadataPath(servicePath))\n\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (raw === null) return null;\n\t\tconst parsed = yield* Effect.try({\n\t\t\ttry: () => JSON.parse(raw) as unknown,\n\t\t\tcatch: () => null,\n\t\t}).pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (parsed === null) return null;\n\t\treturn yield* Schema.decodeUnknownEffect(PersistedLocalKeygenMetadataSchema)(parsed).pipe(\n\t\t\tEffect.catch(() => Effect.succeed(null)),\n\t\t);\n\t});\n\nconst stagePersistedLocalKeygenMetadata = (\n\tservicePath: string,\n\tname: string,\n\tmetadata: PersistedLocalKeygenMetadata,\n): Effect.Effect<void, SealError, FileSystem.FileSystem> =>\n\tatomicWriteFile(\n\t\tlocalKeygenMetadataPath(servicePath),\n\t\tnew TextEncoder().encode(`${JSON.stringify(metadata, null, 2)}\\n`),\n\t\t{\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t},\n\t).pipe(\n\t\tEffect.catch((cause) =>\n\t\t\tEffect.fail(\n\t\t\t\tsealError('config-render', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal.config-render: failed to write ${LOCAL_KEYGEN_STATE_BASENAME} (${cause.stage})`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\nconst readPersistedLocalKeygenState = (\n\tservicePath: string,\n): Effect.Effect<PersistedLocalKeygenKeyMaterial | null, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst masterKeyBody = yield* fs\n\t\t\t.readFileString(masterKeyEnvFile)\n\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (masterKeyBody === null) return null;\n\t\tconst masterKey = parseMasterKeyEnvFile(masterKeyBody);\n\t\tif (masterKey === null) return null;\n\t\tconst metadata = yield* readPersistedLocalKeygenMetadata(servicePath);\n\t\tif (metadata === null) return null;\n\n\t\treturn {\n\t\t\tmasterKey,\n\t\t\tpublicKey: metadata.publicKey,\n\t\t\tmasterKeyEnvFile,\n\t\t};\n\t});\n\nconst sealConfigFingerprint = (parts: {\n\treadonly packageId: string;\n\treadonly keyServerObjectId: string;\n\treadonly nodeUrl: string;\n}): string =>\n\t[\n\t\t`package=${parts.packageId}`,\n\t\t`keyServer=${parts.keyServerObjectId}`,\n\t\t`nodeUrl=${parts.nodeUrl}`,\n\t].join('|');\n\nconst resolveMovePackagePath = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n): Effect.Effect<string, SealError, Scope.Scope | FileSystem.FileSystem | Path.Path> =>\n\topts.movePackagePath\n\t\t? Effect.succeed(opts.movePackagePath)\n\t\t: resolveDefaultSealSource(deps.runtime).pipe(Effect.map((s) => s.path));\n\nconst ensureLocalKeygenArtifacts = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tpublicKey: string,\n): Effect.Effect<\n\t{\n\t\treadonly packageId: string;\n\t\treadonly keyServerObjectId: string;\n\t},\n\tSealError | ArtifactPublishError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst movePackagePath = yield* resolveMovePackagePath(deps, opts);\n\t\tconst { packageId } = yield* publishSealPackage(deps.publisher, {\n\t\t\tname: opts.name,\n\t\t\tchain: deps.chain,\n\t\t\tmovePackagePath,\n\t\t\tsigner: deps.signer,\n\t\t\tsdk: deps.sdk,\n\t\t\truntime: deps.runtime,\n\t\t\tchainProbe: deps.chainProbe,\n\t\t\t...(deps.buildImage !== undefined ? { buildImage: deps.buildImage } : {}),\n\t\t});\n\t\tconst { objectId: keyServerObjectId } = yield* registerKeyServer(deps.publisher, {\n\t\t\tname: opts.name,\n\t\t\tchain: deps.chain,\n\t\t\tkeyServerUrl: deps.routedUrl,\n\t\t\tsealPackageId: packageId,\n\t\t\tpublicKeyHex: publicKey,\n\t\t\tkeyServerName: opts.keyServerName,\n\t\t\tsigner: deps.signer,\n\t\t\tsdk: deps.sdk,\n\t\t\tchainProbe: deps.chainProbe,\n\t\t});\n\t\treturn { packageId, keyServerObjectId };\n\t});\n\nconst stageResolvedLocalKeygenState = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tartifacts: {\n\t\treadonly packageId: string;\n\t\treadonly keyServerObjectId: string;\n\t},\n\tkeypair: Pick<PersistedBlsKeypair, 'masterKey' | 'publicKey'>,\n): Effect.Effect<PersistedLocalKeygenState, SealError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst yaml = renderSealKeyServerConfig({\n\t\t\tsealPackageId: artifacts.packageId,\n\t\t\tnodeUrl: deps.suiRpcUrlInNetwork,\n\t\t\tkeyServerObjectId: artifacts.keyServerObjectId,\n\t\t});\n\t\tconst { masterKeyEnvFile } = yield* stageSealConfig(\n\t\t\tyaml,\n\t\t\tkeypair.masterKey,\n\t\t\tdeps.servicePath,\n\t\t\topts.name,\n\t\t);\n\t\tyield* stagePersistedLocalKeygenMetadata(deps.servicePath, opts.name, {\n\t\t\tversion: LOCAL_KEYGEN_STATE_VERSION,\n\t\t\tpublicKey: keypair.publicKey,\n\t\t});\n\t\treturn {\n\t\t\tpackageId: artifacts.packageId,\n\t\t\tkeyServerObjectId: artifacts.keyServerObjectId,\n\t\t\tmasterKey: keypair.masterKey,\n\t\t\tpublicKey: keypair.publicKey,\n\t\t\tmasterKeyEnvFile,\n\t\t};\n\t});\n\nconst startLocalKeygenContainer = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tcargoImage: ImageRef,\n\tstate: PersistedLocalKeygenState,\n): Effect.Effect<SealLocalKeygenResolved, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst spec: KeyServerContainerSpec = buildKeyServerSpec({\n\t\t\tname: opts.name,\n\t\t\timage: cargoImage,\n\t\t\tcontainerName: deps.containerName,\n\t\t\tlabels: deps.labels,\n\t\t\tsuiNetwork: deps.suiNetworkName,\n\t\t\tservicePath: deps.servicePath,\n\t\t\tconfigFingerprint: sealConfigFingerprint({\n\t\t\t\tpackageId: state.packageId,\n\t\t\t\tkeyServerObjectId: state.keyServerObjectId,\n\t\t\t\tnodeUrl: deps.suiRpcUrlInNetwork,\n\t\t\t}),\n\t\t\troutedHostname: deps.routedHostname,\n\t\t\troutedUrl: deps.routedUrl,\n\t\t\treadyTimeoutMs: opts.readyTimeoutMs,\n\t\t});\n\t\tconst { containerName } = yield* startKeyServer(deps.runtime, spec, opts.name);\n\t\tvoid containerName;\n\n\t\tconst serverConfigs: ReadonlyArray<SealKeyServerEntry> = [\n\t\t\t{ objectId: state.keyServerObjectId, weight: 1 },\n\t\t];\n\t\tconst keyManager = makeKeyManager({\n\t\t\tname: opts.name,\n\t\t\tmasterKeyEnvFile: state.masterKeyEnvFile,\n\t\t\trotateImpl: stubRotate(opts.name),\n\t\t});\n\t\treturn {\n\t\t\tkeyServer: {\n\t\t\t\tserverConfigs,\n\t\t\t\tkeyServerUrl: deps.routedUrl,\n\t\t\t\tobjectId: state.keyServerObjectId,\n\t\t\t},\n\t\t\tkeyManager,\n\t\t\tpackageId: state.packageId,\n\t\t} satisfies SealLocalKeygenResolved;\n\t});\n\n// ---------------------------------------------------------------------------\n// Boot pipeline\n// ---------------------------------------------------------------------------\n\n/** The plugin's aggregate acquire body. Calls each phase in\n *  order; failures surface as typed `SealError` /\n *  `ArtifactPublishError` through the Effect's error channel.\n *\n *  Distilled-doc invariant #2 — phase order is keygen → publish →\n *  register → config-render → container. Any phase failure short-\n *  circuits before downstream phases (cheap on warm restart because\n *  the ArtifactPublisher cache + verify covers steps 3-4). */\nexport const bootLocalKeygen = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n): Effect.Effect<\n\tSealLocalKeygenResolved,\n\tSealError | ArtifactPublishError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\t// ---- cargo image (bootstrap asset) -----------------------\n\t\t// The cargo image's resolver honors `SEAL_CARGO_IMAGE_OVERRIDE`\n\t\t// for the pre-baked path; falls back to a documented seam error\n\t\t// pointing at the override hatch.\n\t\tconst cargoImage: ImageRef = yield* resolveDefaultSealCargoImage(deps.runtime);\n\n\t\tconst persisted = yield* readPersistedLocalKeygenState(deps.servicePath);\n\t\tif (persisted !== null) {\n\t\t\tconst artifacts = yield* ensureLocalKeygenArtifacts(deps, opts, persisted.publicKey);\n\t\t\tconst refreshed = yield* stageResolvedLocalKeygenState(deps, opts, artifacts, persisted);\n\t\t\treturn yield* startLocalKeygenContainer(deps, opts, cargoImage, refreshed);\n\t\t}\n\n\t\t// ---- keygen (BLS12-381 master + public) -----------------\n\t\t// The keypair flows into publish + register inputs. The\n\t\t// artifact publisher still owns the on-chain artifacts; this\n\t\t// local state only persists key material.\n\t\tconst keypair: PersistedBlsKeypair = yield* runSealKeygen(deps.runtime, opts.name, cargoImage);\n\n\t\t// ---- render config + stage master-key -------------------\n\t\t// Distilled-doc invariant #19 — `network: !Devnet` is hardcoded\n\t\t// by `renderSealKeyServerConfig`. Invariant #4 — `master-key.env`\n\t\t// MUST NOT be unlinked on scope close. `stageSealConfig` does\n\t\t// NOT register a finalizer.\n\t\tconst artifacts = yield* ensureLocalKeygenArtifacts(deps, opts, keypair.publicKey);\n\t\tconst state = yield* stageResolvedLocalKeygenState(deps, opts, artifacts, keypair);\n\t\treturn yield* startLocalKeygenContainer(deps, opts, cargoImage, state);\n\t}).pipe(\n\t\tEffect.catchTag('ArtifactPublishError', (err) =>\n\t\t\tEffect.fail(\n\t\t\t\tsealError('seal', {\n\t\t\t\t\tname: opts.name,\n\t\t\t\t\tmessage: `seal.local-keygen: on-chain artifact failure (${err.reason}): ${err.detail}`,\n\t\t\t\t\tcause: err,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t\tEffect.withSpan('devstack.plugin.seal.localKeygen.boot', {\n\t\t\tattributes: {\n\t\t\t\t'devstack.plugin': 'seal',\n\t\t\t\t'seal.name': opts.name,\n\t\t\t\t'seal.version': opts.version,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;AAkGA,MAAM,2BAA2B;AACjC,MAAM,0BAA0B;;;;;AAMhC,MAAa,6BACZ,MACA,oBACiC;CACjC,MAAM,KAAK,QAAQ;CACnB,SAAS,KAAK,WAAW;CACzB,gBAAgB,KAAK,kBAAkB;CACvC,eAAe,KAAK,iBAAiB;CACrC,iBAAiB,KAAK;CACtB;AAwDD,MAAM,6BAA6B;AACnC,MAAM,8BAA8B;AAEpC,MAAM,qCAAqC,OAAO,OAAO;CACxD,SAAS,OAAO,QAAQ,2BAA2B;CACnD,WAAW,OAAO;CAClB,CAAC;AAIF,MAAM,2BAA2B,gBAChC,GAAG,YAAY,GAAG;AAEnB,MAAM,oCACL,gBAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,MAAM,QAAO,OADD,WAAW,YAE3B,eAAe,wBAAwB,YAAY,CAAC,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAChD,KAAI,QAAQ,KAAM,QAAO;CACzB,MAAM,SAAS,OAAO,OAAO,IAAI;EAChC,WAAW,KAAK,MAAM,IAAI;EAC1B,aAAa;EACb,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AACjD,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,OAAO,OAAO,oBAAoB,mCAAmC,CAAC,OAAO,CAAC,KACpF,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CACxC;EACA;AAEH,MAAM,qCACL,aACA,MACA,aAEA,gBACC,wBAAwB,YAAY,EACpC,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI,EAClE;CACC,MAAM;CACN,YAAY;CACZ,CACD,CAAC,KACD,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;CAC1B;CACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;CAC5F;CACA,CAAC,CACF,CACD,CACD;AAEF,MAAM,iCACL,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,gBAAgB,OAAO,GAC3B,eAAe,iBAAiB,CAChC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAChD,KAAI,kBAAkB,KAAM,QAAO;CACnC,MAAM,YAAY,sBAAsB,cAAc;AACtD,KAAI,cAAc,KAAM,QAAO;CAC/B,MAAM,WAAW,OAAO,iCAAiC,YAAY;AACrE,KAAI,aAAa,KAAM,QAAO;AAE9B,QAAO;EACN;EACA,WAAW,SAAS;EACpB;EACA;EACA;AAEH,MAAM,yBAAyB,UAK9B;CACC,WAAW,MAAM;CACjB,aAAa,MAAM;CACnB,WAAW,MAAM;CACjB,CAAC,KAAK,IAAI;AAEZ,MAAM,0BACL,MACA,SAEA,KAAK,kBACF,OAAO,QAAQ,KAAK,gBAAgB,GACpC,yBAAyB,KAAK,QAAQ,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC;AAE1E,MAAM,8BACL,MACA,MACA,cASA,OAAO,IAAI,aAAa;CACvB,MAAM,kBAAkB,OAAO,uBAAuB,MAAM,KAAK;CACjE,MAAM,EAAE,cAAc,OAAO,mBAAmB,KAAK,WAAW;EAC/D,MAAM,KAAK;EACX,OAAO,KAAK;EACZ;EACA,QAAQ,KAAK;EACb,KAAK,KAAK;EACV,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,GAAI,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,YAAY,GAAG,EAAE;EACxE,CAAC;CACF,MAAM,EAAE,UAAU,sBAAsB,OAAO,kBAAkB,KAAK,WAAW;EAChF,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,cAAc,KAAK;EACnB,eAAe;EACf,cAAc;EACd,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,KAAK,KAAK;EACV,YAAY,KAAK;EACjB,CAAC;AACF,QAAO;EAAE;EAAW;EAAmB;EACtC;AAEH,MAAM,iCACL,MACA,MACA,WAIA,YAEA,OAAO,IAAI,aAAa;CAMvB,MAAM,EAAE,qBAAqB,OAAO,gBALvB,0BAA0B;EACtC,eAAe,UAAU;EACzB,SAAS,KAAK;EACd,mBAAmB,UAAU;EAC7B,CAEI,EACJ,QAAQ,WACR,KAAK,aACL,KAAK,KACL;AACD,QAAO,kCAAkC,KAAK,aAAa,KAAK,MAAM;EACrE,SAAS;EACT,WAAW,QAAQ;EACnB,CAAC;AACF,QAAO;EACN,WAAW,UAAU;EACrB,mBAAmB,UAAU;EAC7B,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB;EACA;EACA;AAEH,MAAM,6BACL,MACA,MACA,YACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAA+B,mBAAmB;EACvD,MAAM,KAAK;EACX,OAAO;EACP,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,mBAAmB,sBAAsB;GACxC,WAAW,MAAM;GACjB,mBAAmB,MAAM;GACzB,SAAS,KAAK;GACd,CAAC;EACF,gBAAgB,KAAK;EACrB,WAAW,KAAK;EAChB,gBAAgB,KAAK;EACrB,CAAC;CACF,MAAM,EAAE,kBAAkB,OAAO,eAAe,KAAK,SAAS,MAAM,KAAK,KAAK;CAG9E,MAAM,gBAAmD,CACxD;EAAE,UAAU,MAAM;EAAmB,QAAQ;EAAG,CAChD;CACD,MAAM,aAAa,eAAe;EACjC,MAAM,KAAK;EACX,kBAAkB,MAAM;EACxB,YAAY,WAAW,KAAK,KAAK;EACjC,CAAC;AACF,QAAO;EACN,WAAW;GACV;GACA,cAAc,KAAK;GACnB,UAAU,MAAM;GAChB;EACD;EACA,WAAW,MAAM;EACjB;EACA;;;;;;;;;AAcH,MAAa,mBACZ,MACA,SAMA,OAAO,IAAI,aAAa;CAKvB,MAAM,aAAuB,OAAO,6BAA6B,KAAK,QAAQ;CAE9E,MAAM,YAAY,OAAO,8BAA8B,KAAK,YAAY;AACxE,KAAI,cAAc,KAGjB,QAAO,OAAO,0BAA0B,MAAM,MAAM,YAAY,OADvC,8BAA8B,MAAM,MAAM,OAD1C,2BAA2B,MAAM,MAAM,UAAU,UAAU,EACN,UAAU,CACd;CAO3E,MAAM,UAA+B,OAAO,cAAc,KAAK,SAAS,KAAK,MAAM,WAAW;AAS9F,QAAO,OAAO,0BAA0B,MAAM,MAAM,YAAY,OAD3C,8BAA8B,MAAM,MAAM,OADtC,2BAA2B,MAAM,MAAM,QAAQ,UAAU,EACR,QAAQ,CACZ;EACrE,CAAC,KACF,OAAO,SAAS,yBAAyB,QACxC,OAAO,KACN,UAAU,QAAQ;CACjB,MAAM,KAAK;CACX,SAAS,iDAAiD,IAAI,OAAO,KAAK,IAAI;CAC9E,OAAO;CACP,CAAC,CACF,CACD,EACD,OAAO,SAAS,yCAAyC,EACxD,YAAY;CACX,mBAAmB;CACnB,aAAa,KAAK;CAClB,gBAAgB,KAAK;CACrB,EACD,CAAC,CACF"}
+{"version":3,"file":"local-keygen.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/local-keygen.ts"],"sourcesContent":["// Seal local-keygen mode — the full localnet path.\n//\n// Distilled-doc reference (07-seal.md §\"Lifecycle / Startup —\n// `sealLocalKeygen`\"). Eight ordered phases:\n//\n//   0. Yield deps (Sui, Identity, ContainerRuntime, artifact publisher publisher).\n//   1. Image build (bootstrap asset — parallel with sui's boot).\n//  1a. Move source resolve (bootstrap asset, conditional).\n//   2. BLS keygen one-shot (real `runtime.runOneShot` against cargo\n//                            image; output parsed via regex).\n//   3. Publish seal Move package (via artifact publisher primitive).\n//   4. Register on-chain KeyServer (via artifact publisher primitive).\n//   5. Render config yaml + stage master-key env-file (atomic\n//                                                       FileSystem\n//                                                       writes).\n//   6. Start long-running key-server container (real\n//                                               `runtime.ensureContainer`\n//                                               + exec-based ready\n//                                               probe).\n//   7. Project the plugin's aggregate value.\n//\n// Distilled-doc invariants pinned by this file:\n//\n//   #1  KeyServer.url == routed hostname        — single mint point\n//                                                 (`routedUrl` passed\n//                                                 identically into\n//                                                 `registerKeyServer`\n//                                                 and `buildKeyServerSpec`).\n//   #2  Boot order keygen → publish → register → config → container.\n//   #4  env-file for secret loading (not -e MASTER_KEY=…).\n//   #5  No host-port publish.\n//   #6  Keypair B8 verify cascade (deploy.ts:buildKeypairVerify).\n//   #7  Signal-forwarding entrypoint shell (image-side).\n//   #8  Fork incompatibility throw — handled at the barrel\n//       (`index.ts`), NOT here.\n//   #9  Peer-dep structural assignability (compile-time check\n//       lives in registry-publish.ts).\n//\n// This is the substrate-name-LEAK boundary. Inside this file we can\n// say \"seal\"; outside `src/plugins/seal/`, the substrate doesn't\n// know seal exists.\n\nimport { Effect, FileSystem, Path, Schema, type Scope } from 'effect';\n\nimport { decodeJsonText } from '../../../substrate/runtime/runtime-decode.ts';\n\nimport type { ChainId } from '../../../substrate/brand.ts';\nimport type { ChainProbe } from '../../../contracts/chain-probe.ts';\nimport type { ContainerLabelTuple } from '../../../contracts/snapshotable.ts';\nimport type { ContainerRuntime, ImageRef } from '../../../contracts/container-runtime.ts';\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../../primitives/artifact-publisher.ts';\nimport type { AccountValue } from '../../account/index.ts';\nimport {\n\tparseMasterKeyEnvFile,\n\trenderSealKeyServerConfig,\n\tstageSealConfig,\n} from '../config-render.ts';\nimport {\n\tpublishSealPackage,\n\tregisterKeyServer,\n\ttype SealObjectProbeKey,\n\ttype SealSuiSdk,\n} from '../deploy.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { SealSpans } from '../spans.ts';\nimport { SpanAttr } from '../../../substrate/runtime/observability/spans.ts';\nimport { MASTER_KEY_ENVFILE_BASENAME, runSealKeygen, type PersistedBlsKeypair } from '../keygen.ts';\nimport { makeKeyManager } from '../key-manager.ts';\nimport { buildKeyServerSpec, startKeyServer, type KeyServerContainerSpec } from '../key-server.ts';\nimport type { SealKeyServerEntry, SealLocalKeygenResolved } from '../registry-publish.ts';\nimport { resolveDefaultSealCargoImage } from '../bootstrap-assets/cargo-image.ts';\nimport { resolveDefaultSealSource } from '../bootstrap-assets/source-fetch.ts';\nimport { atomicWriteFile } from '../../../substrate/runtime/atomic-write.ts';\nimport { versionedDocSchema } from '../../../substrate/versioned-doc-schema.ts';\n\n// ---------------------------------------------------------------------------\n// Options (factory-time)\n// ---------------------------------------------------------------------------\n\n/** Options the local-keygen mode accepts. Mirrors v3\n *  `SealLocalKeygenOptions` (07-seal.md §\"Configuration\"). The\n *  barrel (`index.ts`) folds the typed `SealLocalKeygenOptions`\n *  surface into this internal shape after default resolution. */\nexport interface LocalKeygenOptions {\n\treadonly name?: string;\n\treadonly version?: string;\n\treadonly movePackagePath?: string;\n\treadonly readyTimeoutMs?: number;\n\treadonly keyServerName?: string;\n}\n\n/** Resolved options after defaults are applied. */\nexport interface ResolvedLocalKeygenOptions {\n\treadonly name: string;\n\treadonly version: string;\n\treadonly readyTimeoutMs: number;\n\treadonly keyServerName: string;\n\treadonly movePackagePath?: string;\n}\n\nconst DEFAULT_READY_TIMEOUT_MS = 60_000;\nconst DEFAULT_KEY_SERVER_NAME = 'devstack-local';\n\n/** Synchronous factory-time defaults application. Pure — no\n *  validation throws because the localnet signer requirement is\n *  enforced one layer up in the barrel (the type-narrowed\n *  `sealFor(local).localKeygen({signer})` makes signer required). */\nexport const resolveLocalKeygenOptions = (\n\topts: LocalKeygenOptions,\n\tdefaultVersion: string,\n): ResolvedLocalKeygenOptions => ({\n\tname: opts.name ?? 'seal',\n\tversion: opts.version ?? defaultVersion,\n\treadyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\tkeyServerName: opts.keyServerName ?? DEFAULT_KEY_SERVER_NAME,\n\tmovePackagePath: opts.movePackagePath,\n});\n\n// ---------------------------------------------------------------------------\n// Inputs to the boot pipeline (acquire-time)\n// ---------------------------------------------------------------------------\n\n/** Acquire-time deps the boot pipeline consumes. Sourced by the\n *  barrel (`index.ts`) from a mix of:\n *\n *   - substrate-resolved values (`IdentityContext`,\n *     `ContainerRuntimeService`, `ArtifactPublisher`);\n *   - substrate-derived identifiers (chainId, servicePath,\n *     subnet, etc.);\n *   - router-resolved URL (single mint — distilled-doc invariant #1).\n *\n *  The barrel composes these from substrate services\n *  (ContainerRuntime, IdentityContext, ArtifactPublisher,\n *  StackPathsService) at acquire-time. */\nexport interface LocalKeygenDeps {\n\treadonly runtime: ContainerRuntime;\n\treadonly publisher: ArtifactPublisher;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n\treadonly chain: ChainId;\n\t/** Per-stack on-disk dir under `runtime/seal/`. Host path for the\n\t *  config yaml + master-key env-file. */\n\treadonly servicePath: string;\n\t/** Container name composed by the substrate (app + stack + name +\n\t *  role). */\n\treadonly containerName: string;\n\t/** Label tuple driving snapshot/inspect by labels. */\n\treadonly labels: ContainerLabelTuple;\n\t/** Seal's per-stack docker network — the key-server daemon attaches\n\t *  to this network. */\n\treadonly suiNetworkName: string;\n\t/** In-network sui RPC URL — the daemon's CONFIG_PATH yaml carries\n\t *  this. */\n\treadonly suiRpcUrlInNetwork: string;\n\t/** Router-resolved single mint (distilled-doc invariant #1). */\n\treadonly routedHostname: string;\n\treadonly routedUrl: string;\n}\n\ninterface PersistedLocalKeygenKeyMaterial {\n\treadonly masterKey: string;\n\treadonly publicKey: string;\n\treadonly masterKeyEnvFile: string;\n}\n\ninterface PersistedLocalKeygenState extends PersistedLocalKeygenKeyMaterial {\n\treadonly packageId: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst LOCAL_KEYGEN_STATE_VERSION = 1;\nconst LOCAL_KEYGEN_STATE_BASENAME = 'local-keygen-state.v1.json';\n\nconst PersistedLocalKeygenMetadataSchema = versionedDocSchema(LOCAL_KEYGEN_STATE_VERSION, {\n\tpublicKey: Schema.String,\n});\n\ntype PersistedLocalKeygenMetadata = Schema.Schema.Type<typeof PersistedLocalKeygenMetadataSchema>;\n\nconst localKeygenMetadataPath = (servicePath: string): string =>\n\t`${servicePath}/${LOCAL_KEYGEN_STATE_BASENAME}`;\n\nconst readPersistedLocalKeygenMetadata = (\n\tservicePath: string,\n): Effect.Effect<PersistedLocalKeygenMetadata | null, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = localKeygenMetadataPath(servicePath);\n\t\tconst raw = yield* fs.readFileString(path).pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (raw === null) return null;\n\t\t// Parse + decode failures here mean \"no usable persisted metadata\"\n\t\t// and the caller treats this as a miss; the typed\n\t\t// `RuntimeDecodeIssue` carries the parse/decode diagnostic for\n\t\t// debugging but is collapsed to `null` so the boot loop falls\n\t\t// through to a fresh keygen.\n\t\treturn yield* decodeJsonText(PersistedLocalKeygenMetadataSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) => issue,\n\t\t}).pipe(Effect.catch(() => Effect.succeed(null)));\n\t});\n\nconst stagePersistedLocalKeygenMetadata = (\n\tservicePath: string,\n\tname: string,\n\tmetadata: PersistedLocalKeygenMetadata,\n): Effect.Effect<void, SealError, FileSystem.FileSystem> =>\n\tatomicWriteFile(\n\t\tlocalKeygenMetadataPath(servicePath),\n\t\tnew TextEncoder().encode(`${JSON.stringify(metadata, null, 2)}\\n`),\n\t\t{\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t},\n\t).pipe(\n\t\tEffect.catch((cause) =>\n\t\t\tEffect.fail(\n\t\t\t\tsealError('config-render', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal.config-render: failed to write ${LOCAL_KEYGEN_STATE_BASENAME} (${cause.stage})`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\nconst readPersistedLocalKeygenState = (\n\tservicePath: string,\n): Effect.Effect<PersistedLocalKeygenKeyMaterial | null, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst masterKeyBody = yield* fs\n\t\t\t.readFileString(masterKeyEnvFile)\n\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\tif (masterKeyBody === null) return null;\n\t\tconst masterKey = parseMasterKeyEnvFile(masterKeyBody);\n\t\tif (masterKey === null) return null;\n\t\tconst metadata = yield* readPersistedLocalKeygenMetadata(servicePath);\n\t\tif (metadata === null) return null;\n\n\t\treturn {\n\t\t\tmasterKey,\n\t\t\tpublicKey: metadata.publicKey,\n\t\t\tmasterKeyEnvFile,\n\t\t};\n\t});\n\n/** BLS12-381 master key — 32 bytes, persisted as 64 hex chars. */\nconst BLS_MASTER_KEY_HEX_LEN = 64;\n/** BLS12-381 G2 uncompressed public key — 96 bytes, persisted as 192 hex chars. */\nconst BLS_PUBLIC_KEY_HEX_LEN = 192;\nconst HEX_ONLY_RE = /^[0-9a-fA-F]+$/;\n\n/** Stricter decode than the JSON-shape Schema alone — verifies the\n *  persisted master key + public key are well-formed BLS12-381 hex of\n *  the expected widths. The Schema validation alone accepts any\n *  string, so a corrupt-on-disk JSON whose `publicKey` was overwritten\n *  to a shorter / wrong-width value would otherwise be silently\n *  reused on boot — leading to a master-key / KeyServer mismatch\n *  (the master-key.env carries one key, the registered KeyServer's\n *  on-chain `publicKey` carries a different one). Distilled-doc\n *  invariant #6 (keypair B8 verify cascade) covers the on-chain\n *  side; this is the on-disk side.\n *\n *  We cannot in-process re-derive the G2 public key from the master\n *  scalar without bundling a BLS12-381 implementation (the keygen\n *  binary owns this in cargo-land). The width invariant is the\n *  cheapest defense that catches the realistic corruption modes:\n *  truncated writes, hand-edited JSON, stale persistence from an\n *  older devstack version. */\nconst validatePersistedKeyMaterialShape = (\n\tmaterial: PersistedLocalKeygenKeyMaterial,\n\tname: string,\n): Effect.Effect<void, SealError> => {\n\tif (material.masterKey.length !== BLS_MASTER_KEY_HEX_LEN || !HEX_ONLY_RE.test(material.masterKey)) {\n\t\treturn Effect.fail(\n\t\t\tsealError('config-render', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal.local-keygen: persisted master key in ${MASTER_KEY_ENVFILE_BASENAME} ` +\n\t\t\t\t\t`is not ${BLS_MASTER_KEY_HEX_LEN}-char hex (got ${material.masterKey.length} chars). ` +\n\t\t\t\t\t'The on-disk state is corrupt; delete the seal service directory and ' +\n\t\t\t\t\t're-boot to regenerate, or restore from a known-good snapshot.',\n\t\t\t}),\n\t\t);\n\t}\n\tif (\n\t\tmaterial.publicKey.length !== BLS_PUBLIC_KEY_HEX_LEN ||\n\t\t!HEX_ONLY_RE.test(material.publicKey)\n\t) {\n\t\treturn Effect.fail(\n\t\t\tsealError('config-render', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal.local-keygen: persisted publicKey in ${LOCAL_KEYGEN_STATE_BASENAME} ` +\n\t\t\t\t\t`is not ${BLS_PUBLIC_KEY_HEX_LEN}-char hex (got ${material.publicKey.length} chars). ` +\n\t\t\t\t\t'The on-disk state is corrupt; reusing it would publish a KeyServer ' +\n\t\t\t\t\t'whose on-chain publicKey diverges from the local master key. ' +\n\t\t\t\t\t'Delete the seal service directory and re-boot to regenerate.',\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.void;\n};\n\nconst sealConfigFingerprint = (parts: {\n\treadonly packageId: string;\n\treadonly keyServerObjectId: string;\n\treadonly nodeUrl: string;\n}): string =>\n\t[\n\t\t`package=${parts.packageId}`,\n\t\t`keyServer=${parts.keyServerObjectId}`,\n\t\t`nodeUrl=${parts.nodeUrl}`,\n\t].join('|');\n\nconst resolveMovePackagePath = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n): Effect.Effect<string, SealError, Scope.Scope | FileSystem.FileSystem | Path.Path> =>\n\topts.movePackagePath\n\t\t? Effect.succeed(opts.movePackagePath)\n\t\t: resolveDefaultSealSource(deps.runtime).pipe(Effect.map((s) => s.path));\n\nconst ensureLocalKeygenArtifacts = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tpublicKey: string,\n): Effect.Effect<\n\t{\n\t\treadonly packageId: string;\n\t\treadonly keyServerObjectId: string;\n\t},\n\tSealError | ArtifactPublishError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst movePackagePath = yield* resolveMovePackagePath(deps, opts);\n\t\tconst { packageId } = yield* publishSealPackage(deps.publisher, {\n\t\t\tname: opts.name,\n\t\t\tchain: deps.chain,\n\t\t\tmovePackagePath,\n\t\t\tsigner: deps.signer,\n\t\t\tsdk: deps.sdk,\n\t\t\truntime: deps.runtime,\n\t\t\tchainProbe: deps.chainProbe,\n\t\t\t...(deps.buildImage !== undefined ? { buildImage: deps.buildImage } : {}),\n\t\t});\n\t\tconst { objectId: keyServerObjectId } = yield* registerKeyServer(deps.publisher, {\n\t\t\tname: opts.name,\n\t\t\tchain: deps.chain,\n\t\t\tkeyServerUrl: deps.routedUrl,\n\t\t\tsealPackageId: packageId,\n\t\t\tpublicKeyHex: publicKey,\n\t\t\tkeyServerName: opts.keyServerName,\n\t\t\tsigner: deps.signer,\n\t\t\tsdk: deps.sdk,\n\t\t\tchainProbe: deps.chainProbe,\n\t\t});\n\t\treturn { packageId, keyServerObjectId };\n\t});\n\nconst stageResolvedLocalKeygenState = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tartifacts: {\n\t\treadonly packageId: string;\n\t\treadonly keyServerObjectId: string;\n\t},\n\tkeypair: Pick<PersistedBlsKeypair, 'masterKey' | 'publicKey'>,\n): Effect.Effect<PersistedLocalKeygenState, SealError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst yaml = renderSealKeyServerConfig({\n\t\t\tsealPackageId: artifacts.packageId,\n\t\t\tnodeUrl: deps.suiRpcUrlInNetwork,\n\t\t\tkeyServerObjectId: artifacts.keyServerObjectId,\n\t\t});\n\t\tconst { masterKeyEnvFile } = yield* stageSealConfig(\n\t\t\tyaml,\n\t\t\tkeypair.masterKey,\n\t\t\tdeps.servicePath,\n\t\t\topts.name,\n\t\t);\n\t\tyield* stagePersistedLocalKeygenMetadata(deps.servicePath, opts.name, {\n\t\t\tversion: LOCAL_KEYGEN_STATE_VERSION,\n\t\t\tpublicKey: keypair.publicKey,\n\t\t});\n\t\treturn {\n\t\t\tpackageId: artifacts.packageId,\n\t\t\tkeyServerObjectId: artifacts.keyServerObjectId,\n\t\t\tmasterKey: keypair.masterKey,\n\t\t\tpublicKey: keypair.publicKey,\n\t\t\tmasterKeyEnvFile,\n\t\t};\n\t});\n\nconst startLocalKeygenContainer = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n\tcargoImage: ImageRef,\n\tstate: PersistedLocalKeygenState,\n): Effect.Effect<SealLocalKeygenResolved, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst spec: KeyServerContainerSpec = buildKeyServerSpec({\n\t\t\tname: opts.name,\n\t\t\timage: cargoImage,\n\t\t\tcontainerName: deps.containerName,\n\t\t\tlabels: deps.labels,\n\t\t\tsuiNetwork: deps.suiNetworkName,\n\t\t\tservicePath: deps.servicePath,\n\t\t\tconfigFingerprint: sealConfigFingerprint({\n\t\t\t\tpackageId: state.packageId,\n\t\t\t\tkeyServerObjectId: state.keyServerObjectId,\n\t\t\t\tnodeUrl: deps.suiRpcUrlInNetwork,\n\t\t\t}),\n\t\t\troutedHostname: deps.routedHostname,\n\t\t\troutedUrl: deps.routedUrl,\n\t\t\treadyTimeoutMs: opts.readyTimeoutMs,\n\t\t});\n\t\tconst { containerName } = yield* startKeyServer(deps.runtime, spec, opts.name);\n\t\tvoid containerName;\n\n\t\tconst serverConfigs: ReadonlyArray<SealKeyServerEntry> = [\n\t\t\t{ objectId: state.keyServerObjectId, weight: 1 },\n\t\t];\n\t\tconst keyManager = makeKeyManager({\n\t\t\tmasterKeyEnvFile: state.masterKeyEnvFile,\n\t\t});\n\t\treturn {\n\t\t\tkeyServer: {\n\t\t\t\tserverConfigs,\n\t\t\t\tkeyServerUrl: deps.routedUrl,\n\t\t\t\tobjectId: state.keyServerObjectId,\n\t\t\t},\n\t\t\tkeyManager,\n\t\t\tpackageId: state.packageId,\n\t\t} satisfies SealLocalKeygenResolved;\n\t});\n\n// ---------------------------------------------------------------------------\n// Boot pipeline\n// ---------------------------------------------------------------------------\n\n/** The plugin's aggregate acquire body. Calls each phase in\n *  order; failures surface as typed `SealError` /\n *  `ArtifactPublishError` through the Effect's error channel.\n *\n *  Distilled-doc invariant #2 — phase order is keygen → publish →\n *  register → config-render → container. Any phase failure short-\n *  circuits before downstream phases (cheap on warm restart because\n *  the ArtifactPublisher cache + verify covers steps 3-4). */\nexport const bootLocalKeygen = (\n\tdeps: LocalKeygenDeps,\n\topts: ResolvedLocalKeygenOptions,\n): Effect.Effect<\n\tSealLocalKeygenResolved,\n\tSealError | ArtifactPublishError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\t// ---- cargo image (bootstrap asset) -----------------------\n\t\t// The cargo image's resolver honors `SEAL_CARGO_IMAGE_OVERRIDE`\n\t\t// for the pre-baked path; falls back to a documented seam error\n\t\t// pointing at the override hatch.\n\t\tconst cargoImage: ImageRef = yield* resolveDefaultSealCargoImage(deps.runtime, {\n\t\t\tapp: deps.labels.app,\n\t\t\tstack: deps.labels.stack,\n\t\t});\n\n\t\tconst persisted = yield* readPersistedLocalKeygenState(deps.servicePath);\n\t\tif (persisted !== null) {\n\t\t\t// Defensive invariant — if the on-disk publicKey or master key\n\t\t\t// has the wrong shape, the ArtifactPublisher cache might\n\t\t\t// happily reuse a stale on-chain KeyServer whose registered\n\t\t\t// publicKey no longer matches the master key the daemon\n\t\t\t// loads at boot. Refuse to proceed so the operator gets a\n\t\t\t// clear typed error instead of a silently-broken stack.\n\t\t\tyield* validatePersistedKeyMaterialShape(persisted, opts.name);\n\t\t\tconst artifacts = yield* ensureLocalKeygenArtifacts(deps, opts, persisted.publicKey);\n\t\t\tconst refreshed = yield* stageResolvedLocalKeygenState(deps, opts, artifacts, persisted);\n\t\t\treturn yield* startLocalKeygenContainer(deps, opts, cargoImage, refreshed);\n\t\t}\n\n\t\t// ---- keygen (BLS12-381 master + public) -----------------\n\t\t// The keypair flows into publish + register inputs. The\n\t\t// artifact publisher still owns the on-chain artifacts; this\n\t\t// local state only persists key material.\n\t\tconst keypair: PersistedBlsKeypair = yield* runSealKeygen(deps.runtime, opts.name, cargoImage);\n\n\t\t// ---- render config + stage master-key -------------------\n\t\t// Distilled-doc invariant #19 — `network: !Devnet` is hardcoded\n\t\t// by `renderSealKeyServerConfig`. Invariant #4 — `master-key.env`\n\t\t// MUST NOT be unlinked on scope close. `stageSealConfig` does\n\t\t// NOT register a finalizer.\n\t\tconst artifacts = yield* ensureLocalKeygenArtifacts(deps, opts, keypair.publicKey);\n\t\tconst state = yield* stageResolvedLocalKeygenState(deps, opts, artifacts, keypair);\n\t\treturn yield* startLocalKeygenContainer(deps, opts, cargoImage, state);\n\t}).pipe(\n\t\tEffect.catchTag('ArtifactPublishError', (err) =>\n\t\t\tEffect.fail(\n\t\t\t\tsealError('seal', {\n\t\t\t\t\tname: opts.name,\n\t\t\t\t\tmessage: `seal.local-keygen: on-chain artifact failure (${err.reason}): ${err.detail}`,\n\t\t\t\t\tcause: err,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t\tEffect.withSpan('devstack.plugin.seal.localKeygen.boot', {\n\t\t\tattributes: {\n\t\t\t\t[SpanAttr.plugin]: 'seal',\n\t\t\t\t[SealSpans.name]: opts.name,\n\t\t\t\t[SealSpans.version]: opts.version,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;;;;AAuGA,MAAM,2BAA2B;AACjC,MAAM,0BAA0B;;;;;AAMhC,MAAa,6BACZ,MACA,oBACiC;CACjC,MAAM,KAAK,QAAQ;CACnB,SAAS,KAAK,WAAW;CACzB,gBAAgB,KAAK,kBAAkB;CACvC,eAAe,KAAK,iBAAiB;CACrC,iBAAiB,KAAK;CACtB;AAwDD,MAAM,6BAA6B;AACnC,MAAM,8BAA8B;AAEpC,MAAM,qCAAqC,mBAAmB,4BAA4B,EACzF,WAAW,OAAO,QAClB,CAAC;AAIF,MAAM,2BAA2B,gBAChC,GAAG,YAAY,GAAG;AAEnB,MAAM,oCACL,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,wBAAwB,YAAY;CACjD,MAAM,MAAM,OAAO,GAAG,eAAe,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AACzF,KAAI,QAAQ,KAAM,QAAO;AAMzB,QAAO,OAAO,eAAe,oCAAoC,KAAK;EACrE,QAAQ;EACR,UAAU,UAAU;EACpB,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;EAChD;AAEH,MAAM,qCACL,aACA,MACA,aAEA,gBACC,wBAAwB,YAAY,EACpC,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI,EAClE;CACC,MAAM;CACN,YAAY;CACZ,CACD,CAAC,KACD,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;CAC1B;CACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;CAC5F;CACA,CAAC,CACF,CACD,CACD;AAEF,MAAM,iCACL,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,gBAAgB,OAAO,GAC3B,eAAe,iBAAiB,CAChC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAChD,KAAI,kBAAkB,KAAM,QAAO;CACnC,MAAM,YAAY,sBAAsB,cAAc;AACtD,KAAI,cAAc,KAAM,QAAO;CAC/B,MAAM,WAAW,OAAO,iCAAiC,YAAY;AACrE,KAAI,aAAa,KAAM,QAAO;AAE9B,QAAO;EACN;EACA,WAAW,SAAS;EACpB;EACA;EACA;;AAGH,MAAM,yBAAyB;;AAE/B,MAAM,yBAAyB;AAC/B,MAAM,cAAc;;;;;;;;;;;;;;;;;;AAmBpB,MAAM,qCACL,UACA,SACoC;AACpC,KAAI,SAAS,UAAU,WAAW,0BAA0B,CAAC,YAAY,KAAK,SAAS,UAAU,CAChG,QAAO,OAAO,KACb,UAAU,iBAAiB;EAC1B;EACA,SACC,8CAA8C,4BAA4B,UAChE,uBAAuB,iBAAiB,SAAS,UAAU,OAAO;EAG7E,CAAC,CACF;AAEF,KACC,SAAS,UAAU,WAAW,0BAC9B,CAAC,YAAY,KAAK,SAAS,UAAU,CAErC,QAAO,OAAO,KACb,UAAU,iBAAiB;EAC1B;EACA,SACC,6CAA6C,4BAA4B,UAC/D,uBAAuB,iBAAiB,SAAS,UAAU,OAAO;EAI7E,CAAC,CACF;AAEF,QAAO,OAAO;;AAGf,MAAM,yBAAyB,UAK9B;CACC,WAAW,MAAM;CACjB,aAAa,MAAM;CACnB,WAAW,MAAM;CACjB,CAAC,KAAK,IAAI;AAEZ,MAAM,0BACL,MACA,SAEA,KAAK,kBACF,OAAO,QAAQ,KAAK,gBAAgB,GACpC,yBAAyB,KAAK,QAAQ,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC;AAE1E,MAAM,8BACL,MACA,MACA,cASA,OAAO,IAAI,aAAa;CACvB,MAAM,kBAAkB,OAAO,uBAAuB,MAAM,KAAK;CACjE,MAAM,EAAE,cAAc,OAAO,mBAAmB,KAAK,WAAW;EAC/D,MAAM,KAAK;EACX,OAAO,KAAK;EACZ;EACA,QAAQ,KAAK;EACb,KAAK,KAAK;EACV,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,GAAI,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,YAAY,GAAG,EAAE;EACxE,CAAC;CACF,MAAM,EAAE,UAAU,sBAAsB,OAAO,kBAAkB,KAAK,WAAW;EAChF,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,cAAc,KAAK;EACnB,eAAe;EACf,cAAc;EACd,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,KAAK,KAAK;EACV,YAAY,KAAK;EACjB,CAAC;AACF,QAAO;EAAE;EAAW;EAAmB;EACtC;AAEH,MAAM,iCACL,MACA,MACA,WAIA,YAEA,OAAO,IAAI,aAAa;CAMvB,MAAM,EAAE,qBAAqB,OAAO,gBALvB,0BAA0B;EACtC,eAAe,UAAU;EACzB,SAAS,KAAK;EACd,mBAAmB,UAAU;EAC7B,CAEI,EACJ,QAAQ,WACR,KAAK,aACL,KAAK,KACL;AACD,QAAO,kCAAkC,KAAK,aAAa,KAAK,MAAM;EACrE,SAAS;EACT,WAAW,QAAQ;EACnB,CAAC;AACF,QAAO;EACN,WAAW,UAAU;EACrB,mBAAmB,UAAU;EAC7B,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB;EACA;EACA;AAEH,MAAM,6BACL,MACA,MACA,YACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAA+B,mBAAmB;EACvD,MAAM,KAAK;EACX,OAAO;EACP,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,mBAAmB,sBAAsB;GACxC,WAAW,MAAM;GACjB,mBAAmB,MAAM;GACzB,SAAS,KAAK;GACd,CAAC;EACF,gBAAgB,KAAK;EACrB,WAAW,KAAK;EAChB,gBAAgB,KAAK;EACrB,CAAC;CACF,MAAM,EAAE,kBAAkB,OAAO,eAAe,KAAK,SAAS,MAAM,KAAK,KAAK;CAG9E,MAAM,gBAAmD,CACxD;EAAE,UAAU,MAAM;EAAmB,QAAQ;EAAG,CAChD;CACD,MAAM,aAAa,eAAe,EACjC,kBAAkB,MAAM,kBACxB,CAAC;AACF,QAAO;EACN,WAAW;GACV;GACA,cAAc,KAAK;GACnB,UAAU,MAAM;GAChB;EACD;EACA,WAAW,MAAM;EACjB;EACA;;;;;;;;;AAcH,MAAa,mBACZ,MACA,SAMA,OAAO,IAAI,aAAa;CAKvB,MAAM,aAAuB,OAAO,6BAA6B,KAAK,SAAS;EAC9E,KAAK,KAAK,OAAO;EACjB,OAAO,KAAK,OAAO;EACnB,CAAC;CAEF,MAAM,YAAY,OAAO,8BAA8B,KAAK,YAAY;AACxE,KAAI,cAAc,MAAM;AAOvB,SAAO,kCAAkC,WAAW,KAAK,KAAK;AAG9D,SAAO,OAAO,0BAA0B,MAAM,MAAM,YAAY,OADvC,8BAA8B,MAAM,MAAM,OAD1C,2BAA2B,MAAM,MAAM,UAAU,UAAU,EACN,UAAU,CACd;;CAO3E,MAAM,UAA+B,OAAO,cAAc,KAAK,SAAS,KAAK,MAAM,WAAW;AAS9F,QAAO,OAAO,0BAA0B,MAAM,MAAM,YAAY,OAD3C,8BAA8B,MAAM,MAAM,OADtC,2BAA2B,MAAM,MAAM,QAAQ,UAAU,EACR,QAAQ,CACZ;EACrE,CAAC,KACF,OAAO,SAAS,yBAAyB,QACxC,OAAO,KACN,UAAU,QAAQ;CACjB,MAAM,KAAK;CACX,SAAS,iDAAiD,IAAI,OAAO,KAAK,IAAI;CAC9E,OAAO;CACP,CAAC,CACF,CACD,EACD,OAAO,SAAS,yCAAyC,EACxD,YAAY;EACV,SAAS,SAAS;EAClB,UAAU,OAAO,KAAK;EACtB,UAAU,UAAU,KAAK;CAC1B,EACD,CAAC,CACF"}

package/dist/plugins/seal/registry-publish.mjs

@@ -1,4 +1,5 @@
 import { resource } from "../../substrate/plugin.mjs";
+import "../../api/define-plugin.mjs";
 //#region src/plugins/seal/registry-publish.ts
 const sealResourceId = (name) => `seal:${name}`;
 /** Construct the read-side resource. */

package/dist/plugins/seal/registry-publish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry-publish.mjs","names":[],"sources":["../../../src/plugins/seal/registry-publish.ts"],"sourcesContent":["// Seal plugin — public resolved value.\n//\n// Resource ids:\n//\n//   - `seal:<name>` — read-side key-server fields plus the local-only\n//                     manager handle when the stack owns the master key.\n//\n// The `<name>` suffix lets multiple seal instances coexist in a stack\n// without colliding on the resource registry (distilled doc §Pain Points\n// #7 — multi-instance currently untested but structurally supported).\n\nimport { resource } from '../../api/define-plugin.ts';\nimport type { SealKeyManager } from './key-manager.ts';\n\n// ---------------------------------------------------------------------------\n// Read-side: SealKeyServer\n// ---------------------------------------------------------------------------\n\n/** Structural mirror of `@mysten/seal`'s `KeyServerConfig`.\n *\n *  Distilled-doc invariant #9 + #18: peer-dep structural\n *  assignability. `@mysten/seal` is a peer dep — we duplicate the\n *  shape locally to keep the runtime import off the bundle. A\n *  compile-time `_SealKeyServerEntryCheck`\n *  guards against drift. */\nexport interface SealKeyServerEntry {\n\treadonly objectId: string;\n\treadonly weight: number;\n\treadonly aggregatorUrl?: string;\n}\n\n/** Read-side resolved value. SDK-ready: pass `serverConfigs` to\n *  `new SealClient({serverConfigs, ...})` directly. */\nexport interface SealKeyServer {\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\treadonly keyServerUrl: string;\n\treadonly objectId: string;\n}\n\n/** Public Seal resolved value. The key-server fields stay top-level\n *  so the direct member ref is immediately SDK-ready; local-keygen\n *  additionally exposes `manager`, while known deployments set it to\n *  `null` because this stack does not own the master key. */\nexport interface SealResolved extends SealKeyServer {\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n\treadonly manager: SealKeyManager | null;\n}\n\n/** Resource id constructor for the read-side handle. */\nexport type SealResourceId<Name extends string> = `seal:${Name}`;\nexport const sealResourceId = <Name extends string>(name: Name): SealResourceId<Name> =>\n\t`seal:${name}`;\n\n/** Construct the read-side resource. */\nexport const makeSealResource = <Name extends string>(name: Name) =>\n\tresource<SealResourceId<Name>, SealResolved>(sealResourceId(name));\n\n// ---------------------------------------------------------------------------\n// Projection helpers — narrow the plugin's resolved value\n// ---------------------------------------------------------------------------\n\n/** Aggregate resolved value the plugin's acquire body returns.\n *  Distilled-doc §\"SealLocalKeygenInternalShape\" — `{keyServer,\n *  keyManager, packageId}`. Modes that don't own a manager omit it. */\nexport interface SealLocalKeygenResolved {\n\treadonly keyServer: SealKeyServer;\n\treadonly keyManager: SealKeyManager;\n\treadonly packageId: string;\n}\n\nexport interface SealKnownResolved {\n\treadonly keyServer: SealKeyServer;\n}\n"],"mappings":";;AAkDA,MAAa,kBAAuC,SACnD,QAAQ;;AAGT,MAAa,oBAAyC,SACrD,SAA6C,eAAe,KAAK,CAAC"}
+{"version":3,"file":"registry-publish.mjs","names":[],"sources":["../../../src/plugins/seal/registry-publish.ts"],"sourcesContent":["// Seal plugin — public resolved value.\n//\n// Resource ids:\n//\n//   - `seal:<name>` — read-side key-server fields plus the local-only\n//                     manager handle when the stack owns the master key.\n//\n// The `<name>` suffix lets multiple seal instances coexist in a stack\n// without colliding on the resource registry (distilled doc §Pain Points\n// #7 — multi-instance currently untested but structurally supported).\n\nimport { resource } from '../../api/define-plugin.ts';\nimport type { SealKeyManager } from './key-manager.ts';\n\n// ---------------------------------------------------------------------------\n// Read-side: SealKeyServer\n// ---------------------------------------------------------------------------\n\n/** Structural mirror of `@mysten/seal`'s `KeyServerConfig`.\n *\n *  Distilled-doc invariant #9 + #18: peer-dep structural\n *  assignability. `@mysten/seal` is a peer dep — we duplicate the\n *  shape locally to keep the runtime import off the bundle. A\n *  compile-time `_SealKeyServerEntryCheck`\n *  guards against drift. */\nexport interface SealKeyServerEntry {\n\treadonly objectId: string;\n\treadonly weight: number;\n\treadonly aggregatorUrl?: string;\n}\n\n/** Read-side resolved value. SDK-ready: pass `serverConfigs` to\n *  `new SealClient({serverConfigs, ...})` directly. */\nexport interface SealKeyServer {\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\treadonly keyServerUrl: string;\n\treadonly objectId: string;\n}\n\n/** Public Seal resolved value. The key-server fields stay top-level\n *  so the direct member ref is immediately SDK-ready; local-keygen\n *  additionally exposes `manager`, while known deployments set it to\n *  `null` because this stack does not own the master key. */\nexport interface SealResolved extends SealKeyServer {\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n\treadonly manager: SealKeyManager | null;\n}\n\n/** Resource id constructor for the read-side handle. */\nexport type SealResourceId<Name extends string> = `seal:${Name}`;\nexport const sealResourceId = <Name extends string>(name: Name): SealResourceId<Name> =>\n\t`seal:${name}`;\n\n/** Construct the read-side resource. */\nexport const makeSealResource = <Name extends string>(name: Name) =>\n\tresource<SealResourceId<Name>, SealResolved>(sealResourceId(name));\n\n// ---------------------------------------------------------------------------\n// Projection helpers — narrow the plugin's resolved value\n// ---------------------------------------------------------------------------\n\n/** Aggregate resolved value the plugin's acquire body returns.\n *  Distilled-doc §\"SealLocalKeygenInternalShape\" — `{keyServer,\n *  keyManager, packageId}`. Modes that don't own a manager omit it. */\nexport interface SealLocalKeygenResolved {\n\treadonly keyServer: SealKeyServer;\n\treadonly keyManager: SealKeyManager;\n\treadonly packageId: string;\n}\n\nexport interface SealKnownResolved {\n\treadonly keyServer: SealKeyServer;\n}\n"],"mappings":";;;AAkDA,MAAa,kBAAuC,SACnD,QAAQ;;AAGT,MAAa,oBAAyC,SACrD,SAA6C,eAAe,KAAK,CAAC"}

package/dist/plugins/seal/routable.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/seal/routable.ts"],"sourcesContent":["// Seal plugin — Routable contribution.\n//\n// Distilled-doc invariant #5: the seal port (2024) is INTENTIONALLY\n// shared across stacks. Traefik dispatches by Host: header from the\n// well-known `seal-key-server` entrypoint. No host-port publish —\n// two stacks of the same app coexist on the same well-known port.\n//\n// The substrate's router (architecture §4) mints the hostname from\n// `(app, stack, dispatch-id)`. We provide:\n//\n//   - `endpointName`  — the well-known string `'seal-key-server'`.\n//   - `dispatchId`    — `{serviceKey: 'seal:<name>', role: 'key-server'}`.\n//                        The service key folds the seal instance\n//                        name so multi-instance stacks (distilled-doc\n//                        Open Question #7) don't collide.\n//   - `upstream`      — container kind; the substrate resolves the\n//                        container name from the lifecycle row.\n//   - `cors: true`    — the @mysten/seal SDK's fetch calls require\n//                        CORS allowance (distilled doc: localnet\n//                        SDK browser flow).\n//\n// Distilled-doc invariant #1: the URL the router publishes for this\n// routable decl MUST equal the URL we register on chain. The\n// plugin's acquire body reads the router's published URL ONCE\n// and threads the same value into the Move register call.\n\nimport type { DispatchId, EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n/** Well-known endpoint name for the seal key-server. Conventional\n *  router entrypoint `'seal-key-server'` on port 2024. */\nexport const SEAL_KEY_SERVER_ENDPOINT_NAME = 'seal-key-server' as const;\nexport const SEAL_KEY_SERVER_ROUTE_ROLE = 'key-server' as const;\nexport const DEFAULT_KEY_SERVER_PORT = 2024 as const;\n\nexport const SEAL_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: SEAL_KEY_SERVER_ENDPOINT_NAME, port: DEFAULT_KEY_SERVER_PORT, protocol: 'http' },\n];\n\nconst DEFAULT_STACK = 'main';\n\nconst normalizeRouteSegment = (raw: string): string => raw.toLowerCase().replace(/\\./g, '-');\n\n/** Build the DispatchId for a seal instance. The service key\n *  encodes the instance name so multi-instance seal in the same\n *  stack mints distinct dispatch files.\n *\n *  Note: distilled-doc Open Question #7 — multi-instance seal is\n *  structurally supported but untested. The two routable decls\n *  would both claim the `'seal-key-server'` entrypoint and the\n *  same `key-server.<stack>.<app>.localhost` hostname. Until v2\n *  plans canonicalize multi-instance routing, treat one-seal-per-stack\n *  as the safe default. */\nexport const buildSealDispatchId = (name: string): DispatchId => ({\n\tserviceKey: `seal:${name}`,\n\trole: SEAL_KEY_SERVER_ROUTE_ROLE,\n});\n\nexport const buildSealKeyServerPublicRoute = (inputs: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): { readonly hostname: string; readonly url: string } => {\n\tconst role = normalizeRouteSegment(SEAL_KEY_SERVER_ROUTE_ROLE);\n\tconst app = normalizeRouteSegment(inputs.app);\n\tconst stack = normalizeRouteSegment(inputs.stack);\n\tconst hostname =\n\t\tstack === DEFAULT_STACK ? `${role}.${app}.localhost` : `${role}.${stack}.${app}.localhost`;\n\treturn {\n\t\thostname,\n\t\turl: `http://${hostname}:${inputs.port}`,\n\t};\n};\n\n/** Build the Routable contribution. The substrate's router\n *  orchestrator consumes this; the actual hostname / URL minting\n *  happens there (architecture: routes-by-key, no hardcoded\n *  service hostnames in router code). */\nexport const makeSealRoutable = (inputs: {\n\treadonly name: string;\n\treadonly containerName: string;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\tdispatchId: buildSealDispatchId(inputs.name),\n\tupstream: {\n\t\ttype: 'container',\n\t\tcontainerName: inputs.containerName,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t},\n\tcors: true,\n\twireProtocol: 'http',\n});\n\n/** Known-deployment modes do NOT route through the local router —\n *  the URL points at a remote endpoint (Mysten's testnet key\n *  server). We expose a sentinel routable that the orchestrator\n *  skips (substrate-blind: the orchestrator filters by upstream\n *  type, not by service name). For now, known modes return `null`\n *  from this builder. */\nexport const KNOWN_MODE_ROUTABLE: null = null;\n"],"mappings":";;;AA8BA,MAAa,gCAAgC;AAC7C,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AAEvC,MAAa,mBAAkD,CAC9D;CAAE,MAAM;CAA+B,MAAM;CAAyB,UAAU;CAAQ,CACxF;AAED,MAAM,gBAAgB;AAEtB,MAAM,yBAAyB,QAAwB,IAAI,aAAa,CAAC,QAAQ,OAAO,IAAI;;;;;;;;;;;AAY5F,MAAa,uBAAuB,UAA8B;CACjE,YAAY,QAAQ;CACpB,MAAM;CACN;AAED,MAAa,iCAAiC,WAIa;CAC1D,MAAM,OAAO,sBAAsB,2BAA2B;CAC9D,MAAM,MAAM,sBAAsB,OAAO,IAAI;CAC7C,MAAM,QAAQ,sBAAsB,OAAO,MAAM;CACjD,MAAM,WACL,UAAU,gBAAgB,GAAG,KAAK,GAAG,IAAI,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI;AAChF,QAAO;EACN;EACA,KAAK,UAAU,SAAS,GAAG,OAAO;EAClC;;;;;;AAOF,MAAa,oBAAoB,YAGZ;CACpB,MAAM;CACN,cAAc;CACd,YAAY,oBAAoB,OAAO,KAAK;CAC5C,UAAU;EACT,MAAM;EACN,eAAe,OAAO;EACtB,eAAe;EACf;CACD,MAAM;CACN,cAAc;CACd"}
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/seal/routable.ts"],"sourcesContent":["// Seal plugin — Routable contribution.\n//\n// Distilled-doc invariant #5: the seal port (2024) is INTENTIONALLY\n// shared across stacks. Traefik dispatches by Host: header from the\n// well-known `seal-key-server` entrypoint. No host-port publish —\n// two stacks of the same app coexist on the same well-known port.\n//\n// The substrate's router (architecture §4) mints the hostname from\n// `(app, stack, dispatch-id)`. We provide:\n//\n//   - `endpointName`  — the well-known string `'seal-key-server'`.\n//   - `dispatchId`    — `{serviceKey: 'seal:<name>', role: 'key-server'}`.\n//                        The service key folds the seal instance\n//                        name so multi-instance stacks (distilled-doc\n//                        Open Question #7) don't collide.\n//   - `upstream`      — container kind; the substrate resolves the\n//                        container name from the lifecycle row.\n//   - `cors: true`    — the @mysten/seal SDK's fetch calls require\n//                        CORS allowance (distilled doc: localnet\n//                        SDK browser flow).\n//\n// Distilled-doc invariant #1: the URL the router publishes for this\n// routable decl MUST equal the URL we register on chain. The\n// plugin's acquire body reads the router's published URL ONCE\n// and threads the same value into the Move register call.\n\nimport type { DispatchId, EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n/** Well-known endpoint name for the seal key-server. Conventional\n *  router entrypoint `'seal-key-server'` on port 2024. */\nexport const SEAL_KEY_SERVER_ENDPOINT_NAME = 'seal-key-server' as const;\nexport const SEAL_KEY_SERVER_ROUTE_ROLE = 'key-server' as const;\nexport const DEFAULT_KEY_SERVER_PORT = 2024 as const;\n\nexport const SEAL_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: SEAL_KEY_SERVER_ENDPOINT_NAME, port: DEFAULT_KEY_SERVER_PORT, protocol: 'http' },\n];\n\nconst DEFAULT_STACK = 'main';\n\nconst normalizeRouteSegment = (raw: string): string => raw.toLowerCase().replace(/\\./g, '-');\n\n/** Build the DispatchId for a seal instance. The service key\n *  encodes the instance name so multi-instance seal in the same\n *  stack mints distinct dispatch files.\n *\n *  Note: distilled-doc Open Question #7 — multi-instance seal is\n *  structurally supported but untested. The two routable decls\n *  would both claim the `'seal-key-server'` entrypoint and the\n *  same `key-server.<stack>.<app>.localhost` hostname. Until v2\n *  plans canonicalize multi-instance routing, treat one-seal-per-stack\n *  as the safe default. */\nexport const buildSealDispatchId = (name: string): DispatchId => ({\n\tserviceKey: `seal:${name}`,\n\trole: SEAL_KEY_SERVER_ROUTE_ROLE,\n});\n\nexport const buildSealKeyServerPublicRoute = (inputs: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): { readonly hostname: string; readonly url: string } => {\n\tconst role = normalizeRouteSegment(SEAL_KEY_SERVER_ROUTE_ROLE);\n\tconst app = normalizeRouteSegment(inputs.app);\n\tconst stack = normalizeRouteSegment(inputs.stack);\n\tconst hostname =\n\t\tstack === DEFAULT_STACK ? `${role}.${app}.localhost` : `${role}.${stack}.${app}.localhost`;\n\treturn {\n\t\thostname,\n\t\turl: `http://${hostname}:${inputs.port}`,\n\t};\n};\n\n/** Build the Routable contribution. The substrate's router\n *  orchestrator consumes this; the actual hostname / URL minting\n *  happens there (architecture: routes-by-key, no hardcoded\n *  service hostnames in router code). */\nexport const makeSealRoutable = (inputs: {\n\treadonly name: string;\n\treadonly containerName: string;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\tdispatchId: buildSealDispatchId(inputs.name),\n\tupstream: {\n\t\ttype: 'container',\n\t\tcontainerName: inputs.containerName,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t},\n\tcors: true,\n\twireProtocol: 'http',\n});\n"],"mappings":";;;AA8BA,MAAa,gCAAgC;AAC7C,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AAEvC,MAAa,mBAAkD,CAC9D;CAAE,MAAM;CAA+B,MAAM;CAAyB,UAAU;CAAQ,CACxF;AAED,MAAM,gBAAgB;AAEtB,MAAM,yBAAyB,QAAwB,IAAI,aAAa,CAAC,QAAQ,OAAO,IAAI;;;;;;;;;;;AAY5F,MAAa,uBAAuB,UAA8B;CACjE,YAAY,QAAQ;CACpB,MAAM;CACN;AAED,MAAa,iCAAiC,WAIa;CAC1D,MAAM,OAAO,sBAAsB,2BAA2B;CAC9D,MAAM,MAAM,sBAAsB,OAAO,IAAI;CAC7C,MAAM,QAAQ,sBAAsB,OAAO,MAAM;CACjD,MAAM,WACL,UAAU,gBAAgB,GAAG,KAAK,GAAG,IAAI,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI;AAChF,QAAO;EACN;EACA,KAAK,UAAU,SAAS,GAAG,OAAO;EAClC;;;;;;AAOF,MAAa,oBAAoB,YAGZ;CACpB,MAAM;CACN,cAAc;CACd,YAAY,oBAAoB,OAAO,KAAK;CAC5C,UAAU;EACT,MAAM;EACN,eAAe,OAAO;EACtB,eAAe;EACf;CACD,MAAM;CACN,cAAc;CACd"}

package/dist/plugins/seal/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/seal/service.ts"],"sourcesContent":["// Seal plugin — known-mode dispatch (live + fork-known).\n//\n// Local-keygen mode is dispatched directly from the plugin barrel\n// (`index.ts`) via `bootLocalKeygen` because it needs a\n// `LocalKeygenDeps` bundle (ContainerRuntime, paths, identity, …)\n// composed from substrate services. This file only routes the two\n// pure-value-producing modes that need no substrate plumbing.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { SealAnyError } from './errors.ts';\nimport { acquireForkKnown, type ForkKnownInputs } from './mode/fork-known.ts';\nimport { acquireLive, type LiveModeInputs } from './mode/live.ts';\nimport type { SealKnownResolved } from './registry-publish.ts';\n\n/** Known-mode discriminator — live + fork-known only. */\nexport type SealMode =\n\t| ({ readonly mode: 'live' } & LiveModeInputs)\n\t| ({ readonly mode: 'fork-known' } & ForkKnownInputs);\n\nexport type SealKnownBootResult = SealKnownResolved;\n\n/** Dispatch on the known-mode discriminator. The publisher argument\n *  is unused by the known paths (no on-chain artifact produce); it's\n *  accepted for shape uniformity with the local-keygen entry point. */\nexport const bootSealService = (\n\t_publisher: ArtifactPublisher,\n\topts: SealMode,\n): Effect.Effect<SealKnownBootResult, SealAnyError | ArtifactPublishError, Scope.Scope> => {\n\tswitch (opts.mode) {\n\t\tcase 'live':\n\t\t\treturn acquireLive(opts);\n\t\tcase 'fork-known':\n\t\t\treturn acquireForkKnown(opts);\n\t}\n};\n"],"mappings":";;;;;;;AA6BA,MAAa,mBACZ,YACA,SAC0F;AAC1F,SAAQ,KAAK,MAAb;EACC,KAAK,OACJ,QAAO,YAAY,KAAK;EACzB,KAAK,aACJ,QAAO,iBAAiB,KAAK"}
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/seal/service.ts"],"sourcesContent":["// Seal plugin — known-mode dispatch (live + fork-known).\n//\n// Local-keygen mode is dispatched directly from the plugin barrel\n// (`index.ts`) via `bootLocalKeygen` because it needs a\n// `LocalKeygenDeps` bundle (ContainerRuntime, paths, identity, …)\n// composed from substrate services. This file only routes the two\n// pure-value-producing modes that need no substrate plumbing.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { SealAnyError } from './errors.ts';\nimport { acquireForkKnown, type ForkKnownInputs } from './mode/fork-known.ts';\nimport { acquireLive } from './mode/live.ts';\nimport type { SealKnownResolved } from './registry-publish.ts';\n\n/** Known-mode discriminator — live + fork-known only. */\nexport type SealMode =\n\t| {\n\t\t\treadonly mode: 'live';\n\t\t\treadonly name: string;\n\t\t\treadonly resolved: { readonly objectId: string; readonly keyServerUrl: string };\n\t  }\n\t| ({ readonly mode: 'fork-known' } & ForkKnownInputs);\n\nexport type SealKnownBootResult = SealKnownResolved;\n\n/** Dispatch on the known-mode discriminator. The publisher argument\n *  is unused by the known paths (no on-chain artifact produce); it's\n *  accepted for shape uniformity with the local-keygen entry point. */\nexport const bootSealService = (\n\t_publisher: ArtifactPublisher,\n\topts: SealMode,\n): Effect.Effect<SealKnownBootResult, SealAnyError | ArtifactPublishError, Scope.Scope> => {\n\tswitch (opts.mode) {\n\t\tcase 'live':\n\t\t\treturn acquireLive(opts);\n\t\tcase 'fork-known':\n\t\t\treturn acquireForkKnown(opts);\n\t}\n};\n"],"mappings":";;;;;;;AAiCA,MAAa,mBACZ,YACA,SAC0F;AAC1F,SAAQ,KAAK,MAAb;EACC,KAAK,OACJ,QAAO,YAAY,KAAK;EACzB,KAAK,aACJ,QAAO,iBAAiB,KAAK"}

package/dist/plugins/seal/spans.mjs

@@ -0,0 +1,18 @@
+//#region src/plugins/seal/spans.ts
+const SealSpans = {
+	chain: "seal.chain",
+	containerName: "seal.containerName",
+	name: "seal.name",
+	ref: "seal.ref",
+	repo: "seal.repo",
+	routedUrl: "seal.routedUrl",
+	servicePath: "seal.servicePath",
+	signer: "seal.signer",
+	subdir: "seal.subdir",
+	url: "seal.url",
+	version: "seal.version"
+};
+//#endregion
+export { SealSpans };
+
+//# sourceMappingURL=spans.mjs.map

package/dist/plugins/seal/spans.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/seal/spans.ts"],"sourcesContent":["// Seal plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [SealSpans.name]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const SealSpans = {\n\tchain: 'seal.chain',\n\tcontainerName: 'seal.containerName',\n\tname: 'seal.name',\n\tref: 'seal.ref',\n\trepo: 'seal.repo',\n\troutedUrl: 'seal.routedUrl',\n\tservicePath: 'seal.servicePath',\n\tsigner: 'seal.signer',\n\tsubdir: 'seal.subdir',\n\turl: 'seal.url',\n\tversion: 'seal.version',\n} as const;\n"],"mappings":";AAOA,MAAa,YAAY;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,KAAK;CACL,MAAM;CACN,WAAW;CACX,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,KAAK;CACL,SAAS;CACT"}

package/dist/plugins/sui/auto-tick.mjs

@@ -1,45 +1,39 @@
 import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
-import { expectPositiveFiniteNumber } from "../../substrate/runtime/config-validation.mjs";
 import { suiConfigError } from "./errors.mjs";
+import { SuiSpans } from "./spans.mjs";
 import { Effect, Schedule } from "effect";
 //#region src/plugins/sui/auto-tick.ts
 /** Default cadence when caller passes `autoTick: true`. */
 const DEFAULT_AUTO_TICK_INTERVAL_MS = 1e3;
-/** Resolve the public option to a numeric interval. Returns
-*  `undefined` when auto-tick is OFF. Throws on a misconfigured
-*  option (0 / negative / non-finite) — the substrate's
-*  acquire-time validation catches this before any I/O. */
+/** Resolve the public option to a numeric interval. Succeeds with
+*  `undefined` when auto-tick is OFF. A misconfigured option (0 /
+*  negative / non-finite) fails the effect with a typed
+*  `SuiConfigError` so the boot path can `catchTag` it — a synchronous
+*  `throw` inside the acquire `Effect.gen` would surface as a defect
+*  (STYLE_GUIDE §2: plugin errors must be catchTag-able). */
 const resolveAutoTickIntervalMs = (option) => {
-	if (option === void 0 || option === false) return void 0;
-	if (option === true) return DEFAULT_AUTO_TICK_INTERVAL_MS;
-	return expectPositiveFiniteNumber(option.intervalMs, {
+	if (option === void 0 || option === false) return Effect.succeed(void 0);
+	if (option === true) return Effect.succeed(DEFAULT_AUTO_TICK_INTERVAL_MS);
+	const { intervalMs } = option;
+	if (typeof intervalMs === "number" && Number.isFinite(intervalMs) && intervalMs > 0) return Effect.succeed(intervalMs);
+	return Effect.fail(suiConfigError({
 		field: "autoTick.intervalMs",
-		message: `sui: autoTick.intervalMs must be a positive finite number (got ${String(option.intervalMs)})`,
-		mkError: suiConfigError
-	});
+		message: `sui: autoTick.intervalMs must be a positive finite number (got ${String(intervalMs)})`
+	}));
 };
 /**
 * Fork a scope-bound fiber that calls `advanceClock(intervalMs)` on
 * a `Schedule.spaced(intervalMs)` cadence. The fiber dies on the
 * surrounding scope's close (wipe / restart / Ctrl-C).
-*
-* Returns the fiber handle. Today's code discards the handle — the
-* distilled doc flags a designed-for-but-not-landed re-config path
-* (`engine/sui-fork/control.ts` opportunity). We keep the handle
-* returned so a future cadence-change surface has a join point.
 */
 const runAutoTickClock = (advancer, intervalMs) => Effect.gen(function* () {
-	return yield* advancer.advanceClock(intervalMs).pipe(Effect.catch((err) => Effect.logWarning("sui auto-tick advance failed; next tick will retry").pipe(Effect.annotateLogs({
-		[SpanAttr.suiAutoTickIntervalMs]: intervalMs,
+	yield* advancer.advanceClock(intervalMs).pipe(Effect.catch((err) => Effect.logWarning("sui auto-tick advance failed; next tick will retry").pipe(Effect.annotateLogs({
+		[SuiSpans.autoTickIntervalMs]: intervalMs,
 		[SpanAttr.phase]: err.phase,
 		[SpanAttr.errorMessage]: err.message
 	})))).pipe(Effect.repeat(Schedule.spaced(`${intervalMs} millis`)), Effect.forkScoped);
 });
-/** Build a no-op advancer for local mode. Localnet's validator
-*  drives consensus on its own; the auto-tick fiber surface exists
-*  for symmetry but doesn't have anything to advance. */
-const noopClockAdvancer = { advanceClock: () => Effect.void };
 //#endregion
-export { noopClockAdvancer, resolveAutoTickIntervalMs, runAutoTickClock };
+export { resolveAutoTickIntervalMs, runAutoTickClock };
 
 //# sourceMappingURL=auto-tick.mjs.map

package/dist/plugins/sui/auto-tick.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auto-tick.mjs","names":[],"sources":["../../../src/plugins/sui/auto-tick.ts"],"sourcesContent":["// Auto-tick clock — local-mode-only.\n//\n// Architecture invariant: \"Auto-tick is local-mode-only\" — the\n// public option is exposed only on fork (where it advances the\n// fork binary's clock + checkpoint) AND local (where it nudges\n// localnet's consensus to commit pending txs in tests that don't\n// produce traffic).\n//\n// The fiber is `forkScoped` against the plugin's acquire scope:\n// teardown happens automatically on wipe/restart/Ctrl-C. Failure\n// policy is **log-warn-and-continue** — a single advance-clock\n// RPC failure must not break the supervisor.\n\nimport { Effect, Schedule, type Fiber, type Scope } from 'effect';\n\nimport { expectPositiveFiniteNumber } from '../../substrate/runtime/config-validation.ts';\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport { suiConfigError } from './errors.ts';\nimport type { SuiPluginError } from './errors.ts';\n\n/** Public knob shape mirroring the user-facing API. */\nexport type AutoTickOption = boolean | { readonly intervalMs: number };\n\n/** Default cadence when caller passes `autoTick: true`. */\nexport const DEFAULT_AUTO_TICK_INTERVAL_MS = 1000;\n\n/** Resolve the public option to a numeric interval. Returns\n *  `undefined` when auto-tick is OFF. Throws on a misconfigured\n *  option (0 / negative / non-finite) — the substrate's\n *  acquire-time validation catches this before any I/O. */\nexport const resolveAutoTickIntervalMs = (option?: AutoTickOption): number | undefined => {\n\tif (option === undefined || option === false) return undefined;\n\tif (option === true) return DEFAULT_AUTO_TICK_INTERVAL_MS;\n\treturn expectPositiveFiniteNumber(option.intervalMs, {\n\t\tfield: 'autoTick.intervalMs',\n\t\tmessage: `sui: autoTick.intervalMs must be a positive finite number (got ${String(\n\t\t\toption.intervalMs,\n\t\t)})`,\n\t\tmkError: suiConfigError,\n\t});\n};\n\n/** Plugin-internal shim — the minimal admin surface the auto-tick\n *  fiber needs. Local-mode wires this to a no-op (localnet's\n *  validator advances its own clock); fork-mode wires it to the\n *  `ForkingService.advanceClock` gRPC method. Stub: the concrete\n *  gRPC binding lands when the Mysten Sui SDK is introduced. */\nexport interface ClockAdvancer {\n\treadonly advanceClock: (intervalMs: number) => Effect.Effect<void, SuiPluginError>;\n}\n\n/**\n * Fork a scope-bound fiber that calls `advanceClock(intervalMs)` on\n * a `Schedule.spaced(intervalMs)` cadence. The fiber dies on the\n * surrounding scope's close (wipe / restart / Ctrl-C).\n *\n * Returns the fiber handle. Today's code discards the handle — the\n * distilled doc flags a designed-for-but-not-landed re-config path\n * (`engine/sui-fork/control.ts` opportunity). We keep the handle\n * returned so a future cadence-change surface has a join point.\n */\nexport const runAutoTickClock = (\n\tadvancer: ClockAdvancer,\n\tintervalMs: number,\n): Effect.Effect<Fiber.Fiber<void>, never, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst tick = advancer.advanceClock(intervalMs).pipe(\n\t\t\tEffect.catch((err) =>\n\t\t\t\tEffect.logWarning('sui auto-tick advance failed; next tick will retry').pipe(\n\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t[SpanAttr.suiAutoTickIntervalMs]: intervalMs,\n\t\t\t\t\t\t[SpanAttr.phase]: err.phase,\n\t\t\t\t\t\t[SpanAttr.errorMessage]: err.message,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t\tconst fiber = yield* tick.pipe(\n\t\t\tEffect.repeat(Schedule.spaced(`${intervalMs} millis`)),\n\t\t\tEffect.forkScoped,\n\t\t);\n\t\treturn fiber as Fiber.Fiber<void>;\n\t});\n\n/** Build a no-op advancer for local mode. Localnet's validator\n *  drives consensus on its own; the auto-tick fiber surface exists\n *  for symmetry but doesn't have anything to advance. */\nexport const noopClockAdvancer: ClockAdvancer = {\n\tadvanceClock: () => Effect.void as Effect.Effect<void, SuiPluginError>,\n};\n"],"mappings":";;;;;;AAwBA,MAAa,gCAAgC;;;;;AAM7C,MAAa,6BAA6B,WAAgD;AACzF,KAAI,WAAW,KAAA,KAAa,WAAW,MAAO,QAAO,KAAA;AACrD,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,2BAA2B,OAAO,YAAY;EACpD,OAAO;EACP,SAAS,kEAAkE,OAC1E,OAAO,WACP,CAAC;EACF,SAAS;EACT,CAAC;;;;;;;;;;;;AAsBH,MAAa,oBACZ,UACA,eAEA,OAAO,IAAI,aAAa;AAgBvB,QAAO,OAfM,SAAS,aAAa,WAAW,CAAC,KAC9C,OAAO,OAAO,QACb,OAAO,WAAW,qDAAqD,CAAC,KACvE,OAAO,aAAa;GAClB,SAAS,wBAAwB;GACjC,SAAS,QAAQ,IAAI;GACrB,SAAS,eAAe,IAAI;EAC7B,CAAC,CACF,CACD,CAEuB,CAAC,KACzB,OAAO,OAAO,SAAS,OAAO,GAAG,WAAW,SAAS,CAAC,EACtD,OAAO,WACP;EAEA;;;;AAKH,MAAa,oBAAmC,EAC/C,oBAAoB,OAAO,MAC3B"}
+{"version":3,"file":"auto-tick.mjs","names":[],"sources":["../../../src/plugins/sui/auto-tick.ts"],"sourcesContent":["// Auto-tick clock — fork-mode-only.\n//\n// Architecture invariant: \"Auto-tick is fork-mode-only\" — the\n// `autoTick` option lives on `SuiForkOptions` alone, and only the\n// fork boot wires `runAutoTickClock` (against the fork binary's\n// `ForkingService.advanceClock`). Localnet's validator advances its\n// own clock and commits pending txs without prompting, so no\n// equivalent knob exists there.\n//\n// The fiber is `forkScoped` against the plugin's acquire scope:\n// teardown happens automatically on wipe/restart/Ctrl-C. Failure\n// policy is **log-warn-and-continue** — a single advance-clock\n// RPC failure must not break the supervisor.\n\nimport { Effect, Schedule, type Scope } from 'effect';\n\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport { suiConfigError } from './errors.ts';\nimport type { SuiConfigError, SuiPluginError } from './errors.ts';\nimport { SuiSpans } from './spans.ts';\n\n/** Public knob shape mirroring the user-facing API. */\nexport type AutoTickOption = boolean | { readonly intervalMs: number };\n\n/** Default cadence when caller passes `autoTick: true`. */\nexport const DEFAULT_AUTO_TICK_INTERVAL_MS = 1000;\n\n/** Resolve the public option to a numeric interval. Succeeds with\n *  `undefined` when auto-tick is OFF. A misconfigured option (0 /\n *  negative / non-finite) fails the effect with a typed\n *  `SuiConfigError` so the boot path can `catchTag` it — a synchronous\n *  `throw` inside the acquire `Effect.gen` would surface as a defect\n *  (STYLE_GUIDE §2: plugin errors must be catchTag-able). */\nexport const resolveAutoTickIntervalMs = (\n\toption?: AutoTickOption,\n): Effect.Effect<number | undefined, SuiConfigError> => {\n\tif (option === undefined || option === false) return Effect.succeed(undefined);\n\tif (option === true) return Effect.succeed(DEFAULT_AUTO_TICK_INTERVAL_MS);\n\tconst { intervalMs } = option;\n\tif (typeof intervalMs === 'number' && Number.isFinite(intervalMs) && intervalMs > 0) {\n\t\treturn Effect.succeed(intervalMs);\n\t}\n\treturn Effect.fail(\n\t\tsuiConfigError({\n\t\t\tfield: 'autoTick.intervalMs',\n\t\t\tmessage: `sui: autoTick.intervalMs must be a positive finite number (got ${String(intervalMs)})`,\n\t\t}),\n\t);\n};\n\n/** Plugin-internal shim — the minimal admin surface the auto-tick\n *  fiber needs. Fork-mode wires this to the fork admin surface, whose\n *  `advanceClock` calls the binary's `ForkingService.advanceClock`\n *  gRPC method (see `makeForkAdminSurface` in `mode/fork.ts`). The\n *  `ForkAdminSurface` is structurally a `ClockAdvancer`, so the boot\n *  hands it through directly. */\nexport interface ClockAdvancer {\n\treadonly advanceClock: (intervalMs: number) => Effect.Effect<void, SuiPluginError>;\n}\n\n/**\n * Fork a scope-bound fiber that calls `advanceClock(intervalMs)` on\n * a `Schedule.spaced(intervalMs)` cadence. The fiber dies on the\n * surrounding scope's close (wipe / restart / Ctrl-C).\n */\nexport const runAutoTickClock = (\n\tadvancer: ClockAdvancer,\n\tintervalMs: number,\n): Effect.Effect<void, never, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst tick = advancer.advanceClock(intervalMs).pipe(\n\t\t\tEffect.catch((err) =>\n\t\t\t\tEffect.logWarning('sui auto-tick advance failed; next tick will retry').pipe(\n\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t[SuiSpans.autoTickIntervalMs]: intervalMs,\n\t\t\t\t\t\t[SpanAttr.phase]: err.phase,\n\t\t\t\t\t\t[SpanAttr.errorMessage]: err.message,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t\tyield* tick.pipe(Effect.repeat(Schedule.spaced(`${intervalMs} millis`)), Effect.forkScoped);\n\t});\n"],"mappings":";;;;;;AAyBA,MAAa,gCAAgC;;;;;;;AAQ7C,MAAa,6BACZ,WACuD;AACvD,KAAI,WAAW,KAAA,KAAa,WAAW,MAAO,QAAO,OAAO,QAAQ,KAAA,EAAU;AAC9E,KAAI,WAAW,KAAM,QAAO,OAAO,QAAQ,8BAA8B;CACzE,MAAM,EAAE,eAAe;AACvB,KAAI,OAAO,eAAe,YAAY,OAAO,SAAS,WAAW,IAAI,aAAa,EACjF,QAAO,OAAO,QAAQ,WAAW;AAElC,QAAO,OAAO,KACb,eAAe;EACd,OAAO;EACP,SAAS,kEAAkE,OAAO,WAAW,CAAC;EAC9F,CAAC,CACF;;;;;;;AAkBF,MAAa,oBACZ,UACA,eAEA,OAAO,IAAI,aAAa;AAYvB,QAXa,SAAS,aAAa,WAAW,CAAC,KAC9C,OAAO,OAAO,QACb,OAAO,WAAW,qDAAqD,CAAC,KACvE,OAAO,aAAa;GAClB,SAAS,qBAAqB;GAC9B,SAAS,QAAQ,IAAI;GACrB,SAAS,eAAe,IAAI;EAC7B,CAAC,CACF,CACD,CAES,CAAC,KAAK,OAAO,OAAO,SAAS,OAAO,GAAG,WAAW,SAAS,CAAC,EAAE,OAAO,WAAW;EAC1F"}

package/dist/plugins/sui/chain-build-container.mjs

@@ -0,0 +1,18 @@
+import "../../substrate/runtime/cross-process/stack-lock.mjs";
+import "../../substrate/runtime/sui-move-build/index.mjs";
+import "../../substrate/runtime/managed-container.mjs";
+import "./errors.mjs";
+import "effect";
+import "node:crypto";
+import "node:path";
+import "node:os";
+[
+	"child=;",
+	"trap '[ -z \"$child\" ] || kill \"$child\" 2>/dev/null || true; exit 0' INT TERM;",
+	"sleep infinity & child=$!;",
+	"wait \"$child\""
+].join(" ");
+//#endregion
+export {};
+
+//# sourceMappingURL=chain-build-container.mjs.map

package/dist/plugins/sui/chain-build-container.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-build-container.mjs","names":[],"sources":["../../../src/plugins/sui/chain-build-container.ts"],"sourcesContent":["// Per-app long-lived Move build container.\n//\n// Architecture Decision §5: the build container is PER-APP, NOT\n// per-stack. Two parallel stacks of the same app share the same\n// sleeper container — their concurrent Move builds serialise on\n// docker exec queueing. This is intentional: dep-cache reuse\n// across stacks outweighs the serialisation cost.\n//\n// Adopt-or-create state machine is delegated to the substrate's\n// `ContainerRuntime.ensureContainer` with `recreate: 'never'` —\n// daemon outages must fail loudly, not silently churn (distilled\n// doc S6: \"MUST reject the helper's auto-recreate-on-resume-failed\n// path\").\n//\n// Cross-process safety: the host-wide advisory lock is owned by\n// THIS module. The lock is held inside the build call (NOT at the\n// docker-exec layer), because three distinct execution paths (host\n// CLI, fresh `docker run --rm`, container exec) all need\n// protection. Lock path: `~/.devstack/locks/sui-move-build-<repoHash>.lock`.\n\nimport { createHash } from 'node:crypto';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tContainerRuntimeError,\n\tEnsureContainerSpec,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport { acquireStackLock } from '../../substrate/runtime/cross-process/stack-lock.ts';\nimport {\n\tensureManagedContainer,\n\tPER_APP_SHARED_STACK,\n} from '../../substrate/runtime/managed-container.ts';\nimport { containerInnerScript } from '../../substrate/runtime/sui-move-build/index.ts';\nimport { suiCliError, suiPluginError, type SuiCliError, type SuiPluginError } from './errors.ts';\n\n/** Default move-build lock timeout — five minutes, matching the\n *  distilled-doc invariant. The lock is held during the build\n *  body only; long-running stages never share it. */\nexport const MOVE_BUILD_LOCK_TIMEOUT_MS = 5 * 60_000;\n\nconst BUILD_CONTAINER_STOP_GRACE_SECONDS = 2;\nconst BUILD_CONTAINER_KEEPALIVE_COMMAND = [\n\t'child=;',\n\t'trap \\'[ -z \"$child\" ] || kill \"$child\" 2>/dev/null || true; exit 0\\' INT TERM;',\n\t'sleep infinity & child=$!;',\n\t'wait \"$child\"',\n].join(' ');\n\n/** Per-app container name. The substrate's `pluginKey('sui-build')`\n *  + the app discriminator combine to a stable name; the container\n *  intentionally omits the stack/network suffix so two stacks of\n *  the same app share. */\nexport const containerNameForApp = (app: string): string => `devstack-${app}-build`;\n\nconst expandHome = (path: string): string =>\n\tpath === '~' ? homedir() : path.startsWith('~/') ? join(homedir(), path.slice(2)) : path;\n\nconst repoHashForLock = (appDir: string): string =>\n\tcreateHash('sha256').update(resolve(appDir)).digest('hex').slice(0, 16);\n\nexport const moveBuildLockPathFor = (appDir: string, moveHome: string): string => {\n\tconst moveHomeRoot = dirname(resolve(expandHome(moveHome)));\n\treturn join(moveHomeRoot, '.devstack', 'locks', `sui-move-build-${repoHashForLock(appDir)}.lock`);\n};\n\n/** Build-container handle returned to plugin internals (the\n *  cli-driver dispatches into this). */\nexport interface ChainBuildContainer {\n\treadonly handle: ContainerHandle;\n\t/** Translate a host-absolute path into a container-bind path.\n\t *  Returns null when the host path escapes the bind-mounted app\n\t *  dir — callers MUST fall back to `docker run --rm` in that\n\t *  case (distilled-doc: \"Build container path translation MUST\n\t *  refuse paths outside the bind-mounted app dir\"). */\n\treadonly toContainerPath: (hostPath: string) => string | null;\n\t/** Run a sui-cli capture inside the container. Acquires the\n\t *  host-wide move-build lock before invoking docker-exec. */\n\treadonly runBuild: (\n\t\thostPackagePath: string,\n\t) => Effect.Effect<\n\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\tSuiCliError,\n\t\tScope.Scope\n\t>;\n\t/** Run a codegen-style \"summary\" build inside the container.\n\t *  Same wire shape as runBuild; the codegen plugin consumes\n\t *  this via the cross-service seam. */\n\treadonly runSummary: (\n\t\thostPackagePath: string,\n\t) => Effect.Effect<\n\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\tSuiCliError,\n\t\tScope.Scope\n\t>;\n}\n\n/** Spec passed to `ContainerRuntime.ensureContainer` for the\n *  per-app sleeper. Image is content-hashed; labels carry the\n *  app discriminator so `inspectByLabels` finds it across stacks. */\nexport interface ChainBuildContainerSpec {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly appDir: string;\n\treadonly moveHome: string;\n\treadonly image: ImageRef;\n}\n\n/**\n * Acquire (or adopt) the per-app build container. Returns a\n * `ChainBuildContainer` handle scoped to the caller's Scope.\n *\n * The build call holds the host-wide move-build lock for the docker\n * exec body. The lock uses the substrate's PID + start-time stale\n * holder reclaim path, so a crashed peer cannot wedge future builds.\n */\nexport const acquireChainBuildContainer = (\n\truntime: ContainerRuntime,\n\tspec: ChainBuildContainerSpec,\n): Effect.Effect<ChainBuildContainer, ContainerRuntimeError | SuiPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// The sleeper shell traps Docker's stop signal so scope-close\n\t\t// does not wait for Docker's default SIGKILL escalation path.\n\t\t// This also overrides the sui image's default `start\n\t\t// --with-faucet=...` entrypoint so the validator binary doesn't\n\t\t// run genesis inside a build container.\n\t\t// The appDir is bind-mounted at `/workspace`, with the user's\n\t\t// `~/.move` bind-mounted at `/root/.move` so the content-addressed\n\t\t// dep cache (`~/.move/git/<repo>@<sha>/…`) persists across builds.\n\t\tconst ensureSpec: EnsureContainerSpec = {\n\t\t\tname: containerNameForApp(spec.app),\n\t\t\timage: spec.image,\n\t\t\tlabels: {\n\t\t\t\tapp: spec.app,\n\t\t\t\t// Intentionally pin stack to a sentinel — see comment\n\t\t\t\t// above; this is per-app, not per-stack.\n\t\t\t\tstack: PER_APP_SHARED_STACK,\n\t\t\t\tplugin: 'sui',\n\t\t\t\trole: 'build',\n\t\t\t},\n\t\t\trecreate: 'never',\n\t\t\tentrypoint: 'sh',\n\t\t\tcommand: ['-c', BUILD_CONTAINER_KEEPALIVE_COMMAND],\n\t\t\tstopGraceSeconds: BUILD_CONTAINER_STOP_GRACE_SECONDS,\n\t\t\tmounts: [\n\t\t\t\t{ source: spec.appDir, target: '/workspace' },\n\t\t\t\t{ source: spec.moveHome, target: '/root/.move' },\n\t\t\t],\n\t\t};\n\t\tconst { labels, ...containerSpec } = ensureSpec;\n\t\tconst handle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tlabels,\n\t\t\tspec: containerSpec,\n\t\t\tmapError: (cause) => cause,\n\t\t});\n\n\t\tconst toContainerPath = (hostPath: string): string | null => {\n\t\t\t// The runtime adapter bind-mounts `spec.appDir` at\n\t\t\t// `/workspace`. A host path outside that bind is not\n\t\t\t// accessible to the container.\n\t\t\tif (!hostPath.startsWith(spec.appDir)) return null;\n\t\t\tconst rel = hostPath.slice(spec.appDir.length).replace(/^\\/+/, '');\n\t\t\treturn rel === '' ? '/workspace' : `/workspace/${rel}`;\n\t\t};\n\t\tconst moveBuildLockPath = moveBuildLockPathFor(spec.appDir, spec.moveHome);\n\n\t\tconst runInContainer = (\n\t\t\top: 'build' | 'summary',\n\t\t\thostPackagePath: string,\n\t\t): Effect.Effect<\n\t\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\t\tSuiCliError,\n\t\t\tScope.Scope\n\t\t> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst containerPath = toContainerPath(hostPackagePath);\n\t\t\t\tif (containerPath === null) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\tcause: new Error(\n\t\t\t\t\t\t\t\t`chain-build-container: host path ${hostPackagePath} escapes appDir bind (${spec.appDir}); ` +\n\t\t\t\t\t\t\t\t\t`caller MUST fall back to docker run --rm`,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\t// The package's container path = `/workspace/<basename>`.\n\t\t\t\t// containerInnerScript copies that subdir into an in-container\n\t\t\t\t// scratch dir and scrubs + builds THERE, so the bind-mounted\n\t\t\t\t// appDir source (`spec.appDir` at `/workspace`) is never\n\t\t\t\t// rewritten by the build.\n\t\t\t\tconst pkgName = containerPath.replace(/^\\/workspace\\//, '').replace(/^\\/+|\\/+$/g, '');\n\t\t\t\tconst inner = containerInnerScript(pkgName);\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* acquireStackLock(moveBuildLockPath, MOVE_BUILD_LOCK_TIMEOUT_MS).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): SuiCliError =>\n\t\t\t\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\t\t\t\tcause: new Error(`move-build lock acquire failed: ${cause._tag}`, { cause }),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* runtime.exec(handle, ['sh', '-c', inner]).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): SuiCliError =>\n\t\t\t\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\t\t\t\tcause: new Error(`runtime.exec failed: ${cause.reason}: ${cause.detail}`),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn result;\n\t\t\t});\n\n\t\tconst runBuild = (hostPackagePath: string) => runInContainer('build', hostPackagePath);\n\t\tconst runSummary = (hostPackagePath: string) => runInContainer('summary', hostPackagePath);\n\n\t\treturn { handle, toContainerPath, runBuild, runSummary };\n\t}).pipe(\n\t\tEffect.mapError((cause) =>\n\t\t\tisContainerRuntimeError(cause)\n\t\t\t\t? cause\n\t\t\t\t: suiPluginError('image-build', 'chain-build-container.acquire failed', cause),\n\t\t),\n\t);\n\nconst isContainerRuntimeError = (e: unknown): e is ContainerRuntimeError =>\n\ttypeof e === 'object' && e !== null && (e as { _tag?: string })._tag === 'ContainerRuntimeError';\n"],"mappings":";;;;;;;;AA8C0C;CACzC;CACA;CACA;CACA;CACA,CAAC,KAAK,IAAI"}

package/dist/plugins/sui/chain-probe.d.mts

@@ -1,4 +1,4 @@
-import { Schema } from "effect";
+import { ClientWithCoreApi } from "@mysten/sui/client";
 
 //#region src/plugins/sui/chain-probe.d.ts
 /**
@@ -75,10 +75,10 @@ interface SuiSdkShim {
       readonly timeout?: number;
     }) => Promise<unknown>;
   };
-  /** Opaque client reference for `Transaction.build({ client })`.
-   *  The Sui barrel wires the resolved `SuiGrpcClient` through; the
-   *  shim layer doesn't type-narrow it (mirrors `MintSdkShim.client`). */
-  readonly client: unknown;
+  /** Client reference for `Transaction.build({ client })` and every
+   *  `client.core.*` call. The Sui barrel wires the resolved
+   *  `SuiGrpcClient` through; consumers cast no further. */
+  readonly client: ClientWithCoreApi;
 }
 //#endregion
 export { SuiProbeKey, SuiSdkShim };