@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/plugins/package/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/package/errors.ts"],"sourcesContent":["// Package plugin — typed errors.\n//\n// Distilled doc §\"Edge cases and known failure modes\": the publish\n// error is a SINGLE tagged error with a CLOSED step set. Per\n// architecture §Effect, errors are plain interfaces with a `_tag`\n// discriminator; `Effect.catchTag` / `catchTags` match on the literal.\n\n/** Closed step set for `PublishError`.\n *\n *   - `hash`        — source-tree walk / digest failed (FS read perms,\n *                     symlink loop, disk error).\n *   - `scrub`       — vendored Move.lock scrub failed.\n *   - `build`       — `sui move build` exit / parse failure / container\n *                     unreachable. Cause-chain carries verbatim\n *                     stdout/stderr.\n *   - `publish-tx`  — sign-and-execute failed (gas, bytecode\n *                     verification, RPC).\n *   - `parse`       — no `published` change in receipt OR the\n *                     post-publish ready-probe timed out.\n *   - `verify`      — KnownPackage verify probe authoritatively says\n *                     \"object not present\" (transient is masked by\n *                     lenient probe — does NOT raise this).\n */\nexport type PublishPhase = 'hash' | 'scrub' | 'build' | 'publish-tx' | 'parse' | 'verify';\n\n/** Single tagged publish error. */\nexport interface PublishError {\n\treadonly _tag: 'PublishError';\n\treadonly phase: PublishPhase;\n\t/** Source path of the package being published. Populated at every\n\t *  throw site that has it in scope — `KnownPackage` paths set this\n\t *  to the symbolic id; post-publish probe phases (e.g. the\n\t *  `postPublishReadyHint` step that only sees the on-chain `packageId`)\n\t *  pass `undefined`. The `mode-local` re-stamp pass back-fills\n\t *  from the outer `inputs.sourcePath` whenever it can. */\n\treadonly sourcePath?: string | undefined;\n\t/** Symbolic package name (the user-declared `pkg.name`). Optional\n\t *  because some throw sites (e.g. `postPublishReadyHint` in\n\t *  `publish-executor.ts`) only have the resolved on-chain\n\t *  `packageId` in scope; the `mode-local` re-stamp pass back-fills\n\t *  the symbolic name from `inputs.packageName` whenever it can.\n\t *  Throw sites MUST NOT overload this slot with the on-chain\n\t *  `packageId` — the symbolic name is what user-facing error\n\t *  displays expect. */\n\treadonly packageName?: string | undefined;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const publishError = (\n\tphase: PublishPhase,\n\tparts: Omit<PublishError, '_tag' | 'phase'>,\n): PublishError => ({ _tag: 'PublishError', phase, ...parts });\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const PACKAGE_ERROR_TAGS = ['PublishError'] as const;\n\nexport type PackageError = PublishError;\n"],"mappings":";AAiDA,MAAa,gBACZ,OACA,WACmB;CAAE,MAAM;CAAgB;CAAO,GAAG;CAAO;;;AAI7D,MAAa,qBAAqB,CAAC,eAAe"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/package/errors.ts"],"sourcesContent":["// Package plugin — typed errors.\n//\n// Distilled doc §\"Edge cases and known failure modes\": the publish\n// error is a SINGLE tagged error with a CLOSED step set. Per\n// architecture §Effect, errors are plain interfaces with a `_tag`\n// discriminator; `Effect.catchTag` / `catchTags` match on the literal.\n\n/** Closed step set for `PublishError`.\n *\n *   - `hash`        — source-tree walk / digest failed (FS read perms,\n *                     symlink loop, disk error).\n *   - `scrub`       — vendored Move.lock scrub failed.\n *   - `build`       — `sui move build` exit / parse failure / container\n *                     unreachable. Cause-chain carries verbatim\n *                     stdout/stderr.\n *   - `publish-tx`  — sign-and-execute failed (gas, bytecode\n *                     verification, RPC).\n *   - `parse`       — no `published` change in receipt OR the\n *                     post-publish ready-probe timed out.\n *   - `verify`      — KnownPackage verify probe authoritatively says\n *                     \"object not present\" (transient is masked by\n *                     lenient probe — does NOT raise this).\n */\nexport type PublishPhase = 'hash' | 'scrub' | 'build' | 'publish-tx' | 'parse' | 'verify';\n\n/** Single tagged publish error. */\nexport interface PublishError {\n\treadonly _tag: 'PublishError';\n\treadonly phase: PublishPhase;\n\t/** Source path of the package being published. Populated at every\n\t *  throw site that has it in scope — `KnownPackage` paths set this\n\t *  to the symbolic id; post-publish probe phases (e.g. the\n\t *  `postPublishReadyHint` step that only sees the on-chain `packageId`)\n\t *  pass `undefined`. The `mode-local` re-stamp pass back-fills\n\t *  from the outer `inputs.sourcePath` whenever it can. */\n\treadonly sourcePath?: string | undefined;\n\t/** Symbolic package name (the user-declared `pkg.name`). Optional\n\t *  because some throw sites (e.g. `postPublishReadyHint` in\n\t *  `publish-executor.ts`) only have the resolved on-chain\n\t *  `packageId` in scope; the `mode-local` re-stamp pass back-fills\n\t *  the symbolic name from `inputs.packageName` whenever it can.\n\t *  Throw sites MUST NOT overload this slot with the on-chain\n\t *  `packageId` — the symbolic name is what user-facing error\n\t *  displays expect. */\n\treadonly packageName?: string | undefined;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const publishError = (\n\tphase: PublishPhase,\n\tparts: Omit<PublishError, '_tag' | 'phase'>,\n): PublishError => ({ _tag: 'PublishError', phase, ...parts });\n\n/** The catchable error tags this plugin exposes. Pinned against the\n *  user-facing error catalog by the error-catalog-parity test. */\nexport const PACKAGE_ERROR_TAGS = ['PublishError'] as const;\n\nexport type PackageError = PublishError;\n"],"mappings":";AAiDA,MAAa,gBACZ,OACA,WACmB;CAAE,MAAM;CAAgB;CAAO,GAAG;AAAM"}

package/dist/plugins/package/git-source.d.mts

@@ -0,0 +1,18 @@
+import { Effect } from "effect";
+
+//#region src/plugins/package/git-source.d.ts
+/** Remote git Move source coordinates. Prefer an IMMUTABLE `rev` (a commit
+ *  SHA or a tag): a branch like `main` is cached at first sight and won't
+ *  auto-refresh until the cache entry is removed. */
+interface GitSource {
+  readonly url: string;
+  /** Sub-path within the repo to build from (e.g. `packages/deepbook`).
+   *  Omit to build the repo root. */
+  readonly subdir?: string;
+  /** Branch, tag, or commit SHA. Defaults to `HEAD` (the remote default
+   *  branch). */
+  readonly rev?: string;
+}
+//#endregion
+export { GitSource };
+//# sourceMappingURL=git-source.d.mts.map

package/dist/plugins/package/git-source.mjs

@@ -0,0 +1,119 @@
+import { publishError } from "./errors.mjs";
+import { Effect } from "effect";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { homedir, tmpdir } from "node:os";
+import { access, mkdir, mkdtemp, rename, rm, writeFile } from "node:fs/promises";
+import { promisify } from "node:util";
+//#region src/plugins/package/git-source.ts
+const execFileAsync = promisify(execFile);
+const gitCacheRoot = () => join(homedir(), ".devstack", "git-src");
+const cacheDirFor = (url, rev) => {
+	const urlHash = createHash("sha1").update(url).digest("hex").slice(0, 16);
+	const safeRev = rev.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
+	return join(gitCacheRoot(), `${urlHash}-${safeRev}`);
+};
+const CLONE_TIMEOUT_MS = 5 * 6e4;
+/**
+* Clone `git` into the host cache (or reuse an existing clone) and return the
+* local path to build from — `<cache>/<subdir>` when `subdir` is set, else the
+* repo root.
+*
+* Idempotent + safe to call from both `inputIdentity` and `start`: a completed
+* clone is marked with a `.devstack-ok` sentinel, so the second call is a cheap
+* `access` hit. Concurrent first-clones of the SAME (url, rev) are reconciled
+* by the atomic directory rename — the loser discards its temp clone and reuses
+* the winner's, so no lock is needed. (Different (url, rev) clone independently;
+* the build itself is serialized separately by `withMoveBuildLock`.)
+*/
+const materializeGitSource = (git, packageName) => Effect.tryPromise({
+	try: async () => {
+		const rev = git.rev ?? "HEAD";
+		const cacheDir = cacheDirFor(git.url, rev);
+		const finalPath = git.subdir ? join(cacheDir, git.subdir) : cacheDir;
+		const okMarker = join(cacheDir, ".devstack-ok");
+		try {
+			await access(okMarker);
+			return finalPath;
+		} catch {}
+		await mkdir(gitCacheRoot(), { recursive: true });
+		const staging = await mkdtemp(join(tmpdir(), "devstack-git-"));
+		try {
+			try {
+				await execFileAsync("git", [
+					"clone",
+					"--depth",
+					"1",
+					"--branch",
+					rev,
+					"--",
+					git.url,
+					staging
+				], { timeout: CLONE_TIMEOUT_MS });
+			} catch {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				});
+				await mkdir(staging, { recursive: true });
+				await execFileAsync("git", [
+					"init",
+					"-q",
+					staging
+				], { timeout: CLONE_TIMEOUT_MS });
+				await execFileAsync("git", [
+					"-C",
+					staging,
+					"remote",
+					"add",
+					"origin",
+					git.url
+				], { timeout: CLONE_TIMEOUT_MS });
+				await execFileAsync("git", [
+					"-C",
+					staging,
+					"fetch",
+					"--depth",
+					"1",
+					"origin",
+					"--",
+					rev
+				], { timeout: CLONE_TIMEOUT_MS });
+				await execFileAsync("git", [
+					"-C",
+					staging,
+					"checkout",
+					"-q",
+					"FETCH_HEAD"
+				], { timeout: CLONE_TIMEOUT_MS });
+			}
+			await writeFile(join(staging, ".devstack-ok"), "");
+			try {
+				await rename(staging, cacheDir);
+			} catch {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+			}
+		} catch (cause) {
+			await rm(staging, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			throw cause;
+		}
+		return finalPath;
+	},
+	catch: (cause) => publishError("hash", {
+		sourcePath: git.subdir ? `${git.url}#${git.subdir}` : git.url,
+		packageName,
+		message: `failed to materialize git source ${git.url} (rev=${git.rev ?? "HEAD"}${git.subdir ? `, subdir=${git.subdir}` : ""}): ${String(cause?.message ?? cause)}`,
+		cause
+	})
+});
+//#endregion
+export { materializeGitSource };
+
+//# sourceMappingURL=git-source.mjs.map

package/dist/plugins/package/git-source.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-source.mjs","names":[],"sources":["../../../src/plugins/package/git-source.ts"],"sourcesContent":["// Materialize a remote git Move source into a persistent local cache.\n//\n// `localPackage(name, { git: { url, subdir?, rev? } })` points the build at a\n// repository instead of a vendored local tree. This helper clones the repo\n// host-side (cached by url+rev), then hands the existing local-build flow a\n// plain on-disk path — every downstream step (`hashMoveSources`,\n// `scrubLocksHost`, `executor.build`, codegen) is unchanged because it only\n// ever sees a directory.\n//\n// The package's OWN transitive deps (e.g. deepbook → token, or the Sui\n// framework) still resolve in-container during `sui move build`; cloning the\n// whole repo also means sibling `{ local = \"../x\" }` deps resolve naturally.\n\nimport { execFile } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport { access, mkdir, mkdtemp, rename, rm, writeFile } from 'node:fs/promises';\nimport { homedir, tmpdir } from 'node:os';\nimport { join } from 'node:path';\nimport { promisify } from 'node:util';\n\nimport { Effect } from 'effect';\n\nimport { publishError, type PublishError } from './errors.ts';\n\nconst execFileAsync = promisify(execFile);\n\n/** Remote git Move source coordinates. Prefer an IMMUTABLE `rev` (a commit\n *  SHA or a tag): a branch like `main` is cached at first sight and won't\n *  auto-refresh until the cache entry is removed. */\nexport interface GitSource {\n\treadonly url: string;\n\t/** Sub-path within the repo to build from (e.g. `packages/deepbook`).\n\t *  Omit to build the repo root. */\n\treadonly subdir?: string;\n\t/** Branch, tag, or commit SHA. Defaults to `HEAD` (the remote default\n\t *  branch). */\n\treadonly rev?: string;\n}\n\n// Host-global cache, shared across stacks/apps/runs and keyed by (url, rev) so\n// a committed pin re-uses the same clone forever. Kept OUTSIDE the stack root\n// (like `~/.move`): it is content-pinned dep input, not per-stack state, so it\n// must survive `wipe` and snapshot bounces.\nconst gitCacheRoot = (): string => join(homedir(), '.devstack', 'git-src');\n\nconst cacheDirFor = (url: string, rev: string): string => {\n\tconst urlHash = createHash('sha1').update(url).digest('hex').slice(0, 16);\n\t// A readable rev slug aids debugging; the url hash keeps it unambiguous.\n\tconst safeRev = rev.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 64);\n\treturn join(gitCacheRoot(), `${urlHash}-${safeRev}`);\n};\n\nconst CLONE_TIMEOUT_MS = 5 * 60_000;\n\n/**\n * Clone `git` into the host cache (or reuse an existing clone) and return the\n * local path to build from — `<cache>/<subdir>` when `subdir` is set, else the\n * repo root.\n *\n * Idempotent + safe to call from both `inputIdentity` and `start`: a completed\n * clone is marked with a `.devstack-ok` sentinel, so the second call is a cheap\n * `access` hit. Concurrent first-clones of the SAME (url, rev) are reconciled\n * by the atomic directory rename — the loser discards its temp clone and reuses\n * the winner's, so no lock is needed. (Different (url, rev) clone independently;\n * the build itself is serialized separately by `withMoveBuildLock`.)\n */\nexport const materializeGitSource = (\n\tgit: GitSource,\n\tpackageName: string,\n): Effect.Effect<string, PublishError> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tconst rev = git.rev ?? 'HEAD';\n\t\t\tconst cacheDir = cacheDirFor(git.url, rev);\n\t\t\tconst finalPath = git.subdir ? join(cacheDir, git.subdir) : cacheDir;\n\t\t\tconst okMarker = join(cacheDir, '.devstack-ok');\n\n\t\t\t// Cache hit — a prior apply already materialized this (url, rev).\n\t\t\ttry {\n\t\t\t\tawait access(okMarker);\n\t\t\t\treturn finalPath;\n\t\t\t} catch {\n\t\t\t\t// miss — clone below.\n\t\t\t}\n\n\t\t\tawait mkdir(gitCacheRoot(), { recursive: true });\n\t\t\tconst staging = await mkdtemp(join(tmpdir(), 'devstack-git-'));\n\t\t\ttry {\n\t\t\t\ttry {\n\t\t\t\t\t// Fast path: branch/tag name — a shallow single-branch clone.\n\t\t\t\t\tawait execFileAsync(\n\t\t\t\t\t\t'git',\n\t\t\t\t\t\t['clone', '--depth', '1', '--branch', rev, '--', git.url, staging],\n\t\t\t\t\t\t{ timeout: CLONE_TIMEOUT_MS },\n\t\t\t\t\t);\n\t\t\t\t} catch {\n\t\t\t\t\t// `--branch` rejects bare commit SHAs (and some servers won't\n\t\t\t\t\t// resolve a SHA that way). Fall back to init + shallow fetch of\n\t\t\t\t\t// the exact rev + checkout, which works for a SHA, tag, or\n\t\t\t\t\t// branch on any server that allows fetching the ref.\n\t\t\t\t\tawait rm(staging, { recursive: true, force: true });\n\t\t\t\t\tawait mkdir(staging, { recursive: true });\n\t\t\t\t\tawait execFileAsync('git', ['init', '-q', staging], { timeout: CLONE_TIMEOUT_MS });\n\t\t\t\t\tawait execFileAsync('git', ['-C', staging, 'remote', 'add', 'origin', git.url], {\n\t\t\t\t\t\ttimeout: CLONE_TIMEOUT_MS,\n\t\t\t\t\t});\n\t\t\t\t\tawait execFileAsync(\n\t\t\t\t\t\t'git',\n\t\t\t\t\t\t['-C', staging, 'fetch', '--depth', '1', 'origin', '--', rev],\n\t\t\t\t\t\t{ timeout: CLONE_TIMEOUT_MS },\n\t\t\t\t\t);\n\t\t\t\t\tawait execFileAsync('git', ['-C', staging, 'checkout', '-q', 'FETCH_HEAD'], {\n\t\t\t\t\t\ttimeout: CLONE_TIMEOUT_MS,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tawait writeFile(join(staging, '.devstack-ok'), '');\n\t\t\t\t// Publish atomically. If a concurrent apply already won the race,\n\t\t\t\t// the rename fails (target exists) — discard ours and reuse theirs.\n\t\t\t\ttry {\n\t\t\t\t\tawait rename(staging, cacheDir);\n\t\t\t\t} catch {\n\t\t\t\t\tawait rm(staging, { recursive: true, force: true }).catch(() => {});\n\t\t\t\t}\n\t\t\t} catch (cause) {\n\t\t\t\tawait rm(staging, { recursive: true, force: true }).catch(() => {});\n\t\t\t\tthrow cause;\n\t\t\t}\n\t\t\treturn finalPath;\n\t\t},\n\t\tcatch: (cause): PublishError =>\n\t\t\tpublishError('hash', {\n\t\t\t\tsourcePath: git.subdir ? `${git.url}#${git.subdir}` : git.url,\n\t\t\t\tpackageName,\n\t\t\t\tmessage:\n\t\t\t\t\t`failed to materialize git source ${git.url} (rev=${git.rev ?? 'HEAD'}` +\n\t\t\t\t\t`${git.subdir ? `, subdir=${git.subdir}` : ''}): ` +\n\t\t\t\t\t`${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n"],"mappings":";;;;;;;;;AAwBA,MAAM,gBAAgB,UAAU,QAAQ;AAmBxC,MAAM,qBAA6B,KAAK,QAAQ,GAAG,aAAa,SAAS;AAEzE,MAAM,eAAe,KAAa,QAAwB;CACzD,MAAM,UAAU,WAAW,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;CAExE,MAAM,UAAU,IAAI,QAAQ,oBAAoB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAChE,OAAO,KAAK,aAAa,GAAG,GAAG,QAAQ,GAAG,SAAS;AACpD;AAEA,MAAM,mBAAmB,IAAI;;;;;;;;;;;;;AAc7B,MAAa,wBACZ,KACA,gBAEA,OAAO,WAAW;CACjB,KAAK,YAAY;EAChB,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,YAAY,IAAI,KAAK,GAAG;EACzC,MAAM,YAAY,IAAI,SAAS,KAAK,UAAU,IAAI,MAAM,IAAI;EAC5D,MAAM,WAAW,KAAK,UAAU,cAAc;EAG9C,IAAI;GACH,MAAM,OAAO,QAAQ;GACrB,OAAO;EACR,QAAQ,CAER;EAEA,MAAM,MAAM,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;EAC/C,MAAM,UAAU,MAAM,QAAQ,KAAK,OAAO,GAAG,eAAe,CAAC;EAC7D,IAAI;GACH,IAAI;IAEH,MAAM,cACL,OACA;KAAC;KAAS;KAAW;KAAK;KAAY;KAAK;KAAM,IAAI;KAAK;IAAO,GACjE,EAAE,SAAS,iBAAiB,CAC7B;GACD,QAAQ;IAKP,MAAM,GAAG,SAAS;KAAE,WAAW;KAAM,OAAO;IAAK,CAAC;IAClD,MAAM,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;IACxC,MAAM,cAAc,OAAO;KAAC;KAAQ;KAAM;IAAO,GAAG,EAAE,SAAS,iBAAiB,CAAC;IACjF,MAAM,cAAc,OAAO;KAAC;KAAM;KAAS;KAAU;KAAO;KAAU,IAAI;IAAG,GAAG,EAC/E,SAAS,iBACV,CAAC;IACD,MAAM,cACL,OACA;KAAC;KAAM;KAAS;KAAS;KAAW;KAAK;KAAU;KAAM;IAAG,GAC5D,EAAE,SAAS,iBAAiB,CAC7B;IACA,MAAM,cAAc,OAAO;KAAC;KAAM;KAAS;KAAY;KAAM;IAAY,GAAG,EAC3E,SAAS,iBACV,CAAC;GACF;GACA,MAAM,UAAU,KAAK,SAAS,cAAc,GAAG,EAAE;GAGjD,IAAI;IACH,MAAM,OAAO,SAAS,QAAQ;GAC/B,QAAQ;IACP,MAAM,GAAG,SAAS;KAAE,WAAW;KAAM,OAAO;IAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;GACnE;EACD,SAAS,OAAO;GACf,MAAM,GAAG,SAAS;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;GAClE,MAAM;EACP;EACA,OAAO;CACR;CACA,QAAQ,UACP,aAAa,QAAQ;EACpB,YAAY,IAAI,SAAS,GAAG,IAAI,IAAI,GAAG,IAAI,WAAW,IAAI;EAC1D;EACA,SACC,oCAAoC,IAAI,IAAI,QAAQ,IAAI,OAAO,SAC5D,IAAI,SAAS,YAAY,IAAI,WAAW,GAAG,KAC3C,OAAQ,OAAiB,WAAW,KAAK;EAC7C;CACD,CAAC;AACH,CAAC"}

package/dist/plugins/package/index.d.mts

@@ -1,16 +1,16 @@
-import { CodegenableDecl } from "../../contracts/codegenable.mjs";
-import { ProjectionDecl } from "../../contracts/projection.mjs";
-import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
-import { StrategyContributorDecl } from "../../contracts/strategy-contributor.mjs";
 import { AnyResourceRef, Plugin, ResourceRef } from "../../substrate/plugin.mjs";
-import { SuiClient } from "../sui/mode/shared.mjs";
+import { PackageBindings } from "../../orchestrators/codegen/bindings.mjs";
+import { ResolvedKnownPackage, ResolvedLocalPackage } from "./registry.mjs";
 import { SuiOptions } from "../sui/mode/spec.mjs";
+import { SuiClient } from "../sui/mode/shared.mjs";
 import { AccountValue } from "../account/service.mjs";
 import { AccountResourceId } from "../account/index.mjs";
-import { LocalPackagePublishOutput, LocalPackagePublishedDecl, PackagePublishObjectChange } from "./publish-output.mjs";
-import { ResolvedKnownPackage, ResolvedLocalPackage } from "./registry.mjs";
+import { LocalPackagePublishOutput, PackagePublishObjectChange } from "./publish-output.mjs";
+import { PackageNetworkEntry, PackageNetworks } from "./codegen.mjs";
 import { PublishError } from "./errors.mjs";
-import { PackageBindings } from "./codegen.mjs";
+import { GitSource } from "./git-source.mjs";
+import { Effect } from "effect";
+
 //#region src/plugins/package/index.d.ts
 /** A user-supplied publisher account ref. The user passes the result
  *  of `account('alice')` — NOT a bare string. Generic over the
@@ -43,13 +43,26 @@ interface LocalPackageResolved<Capture = undefined> extends Omit<ResolvedLocalPa
 type KnownPackageResolved = ResolvedKnownPackage;
 type PackageResolved = LocalPackageResolved | KnownPackageResolved;
 interface LocalPackageOptions<Publisher extends PublisherAccountMember = PublisherAccountMember, Capture extends PackageCapture | undefined = undefined> {
-  readonly sourcePath: string;
+  /** Local on-disk path to the Move package. Provide EXACTLY ONE of
+   *  `sourcePath` or `git`. */
+  readonly sourcePath?: string;
+  /** Remote git source — clone a repo and build a sub-path of it instead of
+   *  vendoring the Move tree. Cloned once into a host cache keyed by
+   *  `url + rev` (see `git-source.ts`); pin `rev` to a commit SHA or tag for
+   *  reproducibility. Mutually exclusive with `sourcePath`. */
+  readonly git?: GitSource;
   readonly mvrPlaceholder?: string;
   readonly excludeFromCodegen?: boolean;
   /** Capture created objects from the publish output. The record
    *  form maps output keys to object-type suffixes, e.g.
    *  `{ boardId: '::board::Board' }`. */
   readonly capture?: Capture;
+  /** Per-network declared package ids (+ optional object ids) for
+   *  prod-targeting. Pure literals, no resolution: codegen merges the
+   *  resolved-local id into `config.packages.<name>.byNetwork.localnet`
+   *  and these literals into `byNetwork.testnet` / `byNetwork.mainnet`.
+   *  A consumer flips `config.network` (env) to select active ids. */
+  readonly networks?: PackageNetworks;
   /** Publisher account — the signer for the publish tx. Pass the
    *  result of `account('alice')` (the same plugin/resource ref used
    *  in the rest of the stack — NOT a duplicate factory call).
@@ -65,14 +78,10 @@ interface KnownPackageOptions {
   readonly packageId: string;
   readonly upgradeCapId?: string;
   readonly mvrPlaceholder?: string;
-}
-interface PackageRegistryProjectionContribution {
-  readonly kind: 'local' | 'known';
-  readonly name: string;
-  readonly packageId: string;
-  readonly upgradeCapId: string | null;
-  readonly mvrPlaceholder: string;
-  readonly sourcePath: string | null;
+  /** Per-network declared package ids (+ optional object ids) for
+   *  prod-targeting — same as `LocalPackageOptions.networks`. Pure
+   *  literals; codegen fills `config.packages.<name>.byNetwork`. */
+  readonly networks?: PackageNetworks;
 }
 /** Build + publish a local Move package. The resolved value is
  *  `LocalPackageResolved` so consumers that need bindings / source
@@ -93,13 +102,13 @@ declare const localPackage: <Name extends string, const Publisher extends Publis
     readonly mode: SuiOptions["mode"];
   }>;
   readonly publisher: Publisher;
-} ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"package">, StrategyContributorDecl<"package-registry", PackageRegistryProjectionContribution>, ProjectionDecl, ...LocalPackagePublishedDecl[]]>;
+} ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never>;
 /** Verify-only against a fixed on-chain package id. The resolved
  *  value is `KnownPackageResolved` — narrower than local, so the
  *  bindings emitter rejects this at compose time. */
 declare const knownPackage: <Name extends string>(name: Name, opts: KnownPackageOptions) => Plugin<`package:${Name}`, ResolvedKnownPackage, readonly ResourceRef<"sui", SuiClient & {
   readonly mode: SuiOptions["mode"];
-}>[], readonly [SnapshotableDecl, CodegenableDecl<"package">, StrategyContributorDecl<"package-registry", PackageRegistryProjectionContribution>, ProjectionDecl]>;
+}>[]>;
 //#endregion
 export { KnownPackageOptions, KnownPackageResolved, LocalPackageOptions, LocalPackageResolved, PackageCapture, PackageResolved, PublisherAccountMember, knownPackage, localPackage };
 //# sourceMappingURL=index.d.mts.map

package/dist/plugins/package/index.mjs

@@ -1,23 +1,26 @@
-import { definePlugin, resource } from "../../substrate/plugin.mjs";
+import { computedInputIdentity, definePlugin, resource, staticInputIdentity } from "../../substrate/plugin.mjs";
 import "../../api/define-plugin.mjs";
+import { CacheService } from "../../substrate/runtime/cache/service.mjs";
+import "../../substrate/runtime/cache/index.mjs";
 import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
-import { ArtifactPublisherService } from "../../substrate/runtime/artifact-publisher/index.mjs";
+import { PluginContext, emitContributions } from "../../substrate/plugin-ctx.mjs";
 import { chainProbeFor } from "../../substrate/runtime/strategy-registry/chain-probe-for.mjs";
 import "../../substrate/runtime/strategy-registry/index.mjs";
-import { makeLocalPackagePublishedDecl, pickCreatedByType } from "./publish-output.mjs";
+import { CoinRegistryService } from "../coin/registry.mjs";
 import { PACKAGE_REGISTRY_CAPABILITY_KEY, PackageRegistryService } from "./registry.mjs";
 import { projection } from "../../api/define-capabilities.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
 import { suiResource } from "../sui/index.mjs";
-import { makeKnownCodegenable, makeLocalCodegenable } from "./codegen.mjs";
-import { PACKAGE_ERROR_TAGS } from "./errors.mjs";
-import "./spans.mjs";
+import { pickCreatedByType } from "./publish-output.mjs";
+import { discoverCoinsFromPublish } from "../coin/discovery.mjs";
+import "../coin/index.mjs";
+import { makeKnownCodegenable, makeKnownStaticCodegen, makeLocalCodegenable, makeLocalStaticCodegen } from "./codegen.mjs";
+import { hashMoveSources } from "./build.mjs";
+import { materializeGitSource } from "./git-source.mjs";
 import { makePublishExecutor } from "./publish-executor.mjs";
 import { bootPackageService } from "./service.mjs";
 import { makeSnapshotable } from "./snapshot.mjs";
 import { Effect } from "effect";
 //#region src/plugins/package/index.ts
-const packageErrorContributions = pluginErrorContributions(PACKAGE_ERROR_TAGS);
 /** Resource id constructor. The symbolic package name is part of the tag
 *  identity so the substrate's compose-time dedup detects collisions
 *  cleanly (two `localPackage('foo', ...)` calls in one stack → typed
@@ -58,6 +61,9 @@ const normalizeCapture = (packageName, capture) => {
 const buildLocalPlugin = (name, opts) => {
 	const packageRef = resource(packageResourceId(name));
 	const capture = normalizeCapture(name, opts.capture);
+	if (opts.sourcePath === void 0 && opts.git === void 0) throw new Error(`localPackage('${name}'): provide either 'sourcePath' or 'git'.`);
+	if (opts.sourcePath !== void 0 && opts.git !== void 0) throw new Error(`localPackage('${name}'): 'sourcePath' and 'git' are mutually exclusive.`);
+	const resolveSourcePath = () => opts.git !== void 0 ? materializeGitSource(opts.git, name) : Effect.succeed(opts.sourcePath);
 	return definePlugin({
 		id: packageRef.id,
 		dependsOn: {
@@ -66,18 +72,42 @@ const buildLocalPlugin = (name, opts) => {
 		},
 		role: "task",
 		section: "package",
+		inputIdentity: computedInputIdentity(() => resolveSourcePath().pipe(Effect.flatMap((sourcePath) => hashMoveSources(sourcePath).pipe(Effect.map((sourceHash) => ({
+			plugin: "package",
+			kind: "local",
+			name,
+			sourcePath,
+			sourceHash,
+			publisher: opts.publisher.id,
+			mvrPlaceholder: opts.mvrPlaceholder ?? null,
+			excludeFromCodegen: opts.excludeFromCodegen === true,
+			capture: opts.capture ?? null,
+			networks: opts.networks ?? null,
+			git: opts.git ?? null
+		})))), Effect.orDie)),
 		watch: {
-			paths: [
+			paths: opts.sourcePath !== void 0 ? [
 				`${opts.sourcePath}/**/*.move`,
 				`${opts.sourcePath}/Move.toml`,
 				`${opts.sourcePath}/Move.lock`
-			],
+			] : [],
 			cascade: true
 		},
+		staticCodegen: makeLocalStaticCodegen({
+			name,
+			sourcePath: opts.sourcePath ?? null,
+			mvrPlaceholder: opts.mvrPlaceholder,
+			excluded: opts.excludeFromCodegen ?? false,
+			networks: opts.networks,
+			...opts.capture !== void 0 ? { objectKeys: Object.keys(opts.capture) } : {}
+		}),
 		start: ({ sui, publisher: publisherAccount }) => Effect.gen(function* () {
-			const publisher = yield* ArtifactPublisherService;
-			const probe = yield* chainProbeFor(sui.chain);
+			const sourcePath = yield* resolveSourcePath();
+			const ctx = yield* PluginContext;
+			const publisher = yield* CacheService;
+			const probe = yield* chainProbeFor(sui.chainId);
 			const registry = yield* PackageRegistryService;
+			const coinRegistry = yield* CoinRegistryService;
 			const containerRuntime = yield* ContainerRuntimeService;
 			const executor = makePublishExecutor({
 				sdk: sui.sdk,
@@ -89,22 +119,23 @@ const buildLocalPlugin = (name, opts) => {
 			const { resolved, output } = yield* bootPackageService(publisher, probe, registry, {
 				mode: "local",
 				packageName: name,
-				sourcePath: opts.sourcePath,
-				chainId: sui.chain,
+				sourcePath,
+				chainId: sui.chainId,
 				publisherAddress: publisherAccount.address,
 				mvrOverride: opts.mvrPlaceholder,
 				...capture !== void 0 ? { capture } : {},
 				executor
 			});
-			return {
+			const projected = {
 				...resolved,
 				captured: resolved.captured,
 				publisher: publisherAccount,
 				publishResult: output
 			};
-		}),
-		errorContributions: packageErrorContributions,
-		capabilities: ({ value, runtime }) => makeLocalCapabilities(name, opts, value, runtime.chain)
+			emitContributions(ctx, makeLocalCapabilities(name, opts, projected));
+			if (output !== null) yield* discoverPublishedCoins(coinRegistry, name, projected.packageId, output);
+			return projected;
+		})
 	});
 };
 const buildKnownPlugin = (name, opts) => {
@@ -113,21 +144,37 @@ const buildKnownPlugin = (name, opts) => {
 		dependsOn: { sui: suiResource },
 		role: "task",
 		section: "package",
+		inputIdentity: staticInputIdentity({
+			plugin: "package",
+			kind: "known",
+			name,
+			packageId: opts.packageId,
+			upgradeCapId: opts.upgradeCapId ?? null,
+			mvrPlaceholder: opts.mvrPlaceholder ?? null,
+			networks: opts.networks ?? null
+		}),
+		staticCodegen: makeKnownStaticCodegen({
+			name,
+			packageId: opts.packageId,
+			mvrPlaceholder: opts.mvrPlaceholder,
+			...opts.upgradeCapId !== void 0 ? { upgradeCapId: opts.upgradeCapId } : {},
+			networks: opts.networks
+		}),
 		start: ({ sui }) => Effect.gen(function* () {
-			const { resolved } = yield* bootPackageService(yield* ArtifactPublisherService, yield* chainProbeFor(sui.chain), yield* PackageRegistryService, {
+			const ctx = yield* PluginContext;
+			const { resolved } = yield* bootPackageService(yield* CacheService, yield* chainProbeFor(sui.chainId), yield* PackageRegistryService, {
 				mode: "known",
 				packageName: name,
 				packageId: opts.packageId,
 				upgradeCapId: opts.upgradeCapId,
 				mvrOverride: opts.mvrPlaceholder
 			});
+			emitContributions(ctx, makeKnownCapabilities(name, opts, resolved));
 			return resolved;
-		}),
-		errorContributions: packageErrorContributions,
-		capabilities: ({ value }) => makeKnownCapabilities(name, opts, value)
+		})
 	});
 };
-const makeLocalCapabilities = (name, opts, resolved, chain) => {
+const makeLocalCapabilities = (name, opts, resolved) => {
 	const snap = makeSnapshotable(name, resolved.publishResult?.packageId ?? resolved.packageId);
 	const codegen = makeLocalCodegenable({
 		kind: "local",
@@ -137,7 +184,10 @@ const makeLocalCapabilities = (name, opts, resolved, chain) => {
 		sourcePath: resolved.sourcePath,
 		mvrPlaceholder: resolved.mvrPlaceholder,
 		captured: resolved.captured
-	}, { excluded: opts.excludeFromCodegen ?? false });
+	}, {
+		excluded: opts.excludeFromCodegen ?? false,
+		...opts.networks !== void 0 ? { networks: opts.networks } : {}
+	});
 	const projection = {
 		kind: "local",
 		name,
@@ -155,13 +205,7 @@ const makeLocalCapabilities = (name, opts, resolved, chain) => {
 			strategy: projection,
 			autoMounted: true
 		},
-		makePackageProjectionContribution(projection),
-		...resolved.publishResult === null ? [] : [makeLocalPackagePublishedDecl({
-			packageName: name,
-			packageId: resolved.packageId,
-			chain,
-			output: resolved.publishResult
-		})]
+		makePackageProjectionContribution(projection)
 	];
 };
 const makeKnownCapabilities = (name, opts, resolved) => {
@@ -172,7 +216,7 @@ const makeKnownCapabilities = (name, opts, resolved) => {
 		packageId: resolved.packageId,
 		upgradeCapId: resolved.upgradeCapId ?? opts.upgradeCapId,
 		mvrPlaceholder: resolved.mvrPlaceholder
-	});
+	}, opts.networks !== void 0 ? { networks: opts.networks } : {});
 	const projection = {
 		kind: "known",
 		name,
@@ -193,6 +237,37 @@ const makeKnownCapabilities = (name, opts, resolved) => {
 		makePackageProjectionContribution(projection)
 	];
 };
+/** Fold a fresh local-package publish output into the per-stack
+*  `CoinRegistry`. Lifted VERBATIM from the orchestrator's former
+*  `publishResultSink` (orchestrators/boot.ts): the same
+*  `discoverCoinsFromPublish` walk + the same `CoinRecord` projection
+*  (including the publisher-owns-cap gate on `treasuryCapId`).
+*
+*  Re-homing this into the local `start` body — AFTER the publish output
+*  is known, BEFORE `start` returns — preserves discovery timing: the
+*  coin plugin `dependsOn` package, so it acquires only after package
+*  readies, by which point the registry is already populated. The
+*  previous decl-driven sink ran at the same point in the lifecycle
+*  (post-`start` dispatch), so consumers see no ordering change. */
+const discoverPublishedCoins = (coinRegistry, packageName, packageId, output) => Effect.gen(function* () {
+	for (const discovered of discoverCoinsFromPublish(output)) {
+		const record = {
+			key: (discovered.symbol ?? discovered.witness).toLowerCase(),
+			type: discovered.fullCoinType,
+			witness: discovered.witness,
+			moduleName: discovered.moduleName,
+			decimals: discovered.decimals ?? 0,
+			...discovered.symbol === void 0 ? {} : { symbol: discovered.symbol },
+			...discovered.displayName === void 0 ? {} : { displayName: discovered.displayName },
+			...discovered.iconUrl === void 0 ? {} : { iconUrl: discovered.iconUrl },
+			...!discovered.publisherOwnsCap || discovered.treasuryCapId === void 0 ? {} : { treasuryCapId: discovered.treasuryCapId },
+			...discovered.metadataId === void 0 ? {} : { metadataId: discovered.metadataId },
+			packageId,
+			publishingPackageName: packageName
+		};
+		yield* coinRegistry.register(record);
+	}
+});
 /** Build + publish a local Move package. The resolved value is
 *  `LocalPackageResolved` so consumers that need bindings / source
 *  path are typed correctly.