@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/plugins/seal/plugin-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-key.mjs","names":[],"sources":["../../../src/plugins/seal/plugin-key.ts"],"sourcesContent":["import { pluginKey, type PluginKey } from '../../substrate/brand.ts';\n\nexport const sealPluginKey = (name: string): PluginKey => pluginKey(`seal:${name}`);\n"],"mappings":";;AAEA,MAAa,iBAAiB,SAA4B,UAAU,QAAQ,OAAO"}
+{"version":3,"file":"plugin-key.mjs","names":[],"sources":["../../../src/plugins/seal/plugin-key.ts"],"sourcesContent":["import { pluginKey, type PluginKey } from '../../substrate/brand.ts';\n\nexport const sealPluginKey = (name: string): PluginKey => pluginKey(`seal:${name}`);\n"],"mappings":";;AAEA,MAAa,iBAAiB,SAA4B,UAAU,QAAQ,MAAM"}

package/dist/plugins/seal/registry-publish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry-publish.mjs","names":[],"sources":["../../../src/plugins/seal/registry-publish.ts"],"sourcesContent":["// Seal plugin — public resolved value.\n//\n// Resource ids:\n//\n//   - `seal:<name>` — read-side key-server fields plus the local-only\n//                     manager handle when the stack owns the master key.\n//\n// The `<name>` suffix lets multiple seal instances coexist in a stack\n// without colliding on the resource registry (distilled doc §Pain Points\n// #7 — multi-instance currently untested but structurally supported).\n\nimport { resource } from '../../api/define-plugin.ts';\nimport type { SealKeyManager } from './key-manager.ts';\n\n// ---------------------------------------------------------------------------\n// Read-side: SealKeyServer\n// ---------------------------------------------------------------------------\n\n/** Structural mirror of `@mysten/seal`'s `KeyServerConfig`.\n *\n *  Distilled-doc invariant #9 + #18: peer-dep structural\n *  assignability. `@mysten/seal` is a peer dep — we duplicate the\n *  shape locally to keep the runtime import off the bundle. A\n *  compile-time `_SealKeyServerEntryCheck`\n *  guards against drift. */\nexport interface SealKeyServerEntry {\n\treadonly objectId: string;\n\treadonly weight: number;\n\treadonly aggregatorUrl?: string;\n}\n\n/** Read-side resolved value. SDK-ready: pass `serverConfigs` to\n *  `new SealClient({serverConfigs, ...})` directly. */\nexport interface SealKeyServer {\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\treadonly keyServerUrl: string;\n\treadonly objectId: string;\n}\n\n/** Public Seal resolved value. The key-server fields stay top-level\n *  so the direct member ref is immediately SDK-ready; local-keygen\n *  additionally exposes `manager`, while known deployments set it to\n *  `null` because this stack does not own the master key. */\nexport interface SealResolved extends SealKeyServer {\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n\treadonly manager: SealKeyManager | null;\n}\n\n/** Resource id constructor for the read-side handle. */\nexport type SealResourceId<Name extends string> = `seal:${Name}`;\nexport const sealResourceId = <Name extends string>(name: Name): SealResourceId<Name> =>\n\t`seal:${name}`;\n\n/** Construct the read-side resource. */\nexport const makeSealResource = <Name extends string>(name: Name) =>\n\tresource<SealResourceId<Name>, SealResolved>(sealResourceId(name));\n\n// ---------------------------------------------------------------------------\n// Projection helpers — narrow the plugin's resolved value\n// ---------------------------------------------------------------------------\n\n/** Aggregate resolved value the plugin's acquire body returns.\n *  Distilled-doc §\"SealLocalKeygenInternalShape\" — `{keyServer,\n *  keyManager, packageId}`. Modes that don't own a manager omit it. */\nexport interface SealLocalKeygenResolved {\n\treadonly keyServer: SealKeyServer;\n\treadonly keyManager: SealKeyManager;\n\treadonly packageId: string;\n}\n\nexport interface SealKnownResolved {\n\treadonly keyServer: SealKeyServer;\n}\n"],"mappings":";;;AAkDA,MAAa,kBAAuC,SACnD,QAAQ;;AAGT,MAAa,oBAAyC,SACrD,SAA6C,eAAe,KAAK,CAAC"}
+{"version":3,"file":"registry-publish.mjs","names":[],"sources":["../../../src/plugins/seal/registry-publish.ts"],"sourcesContent":["// Seal plugin — public resolved value.\n//\n// Resource ids:\n//\n//   - `seal:<name>` — read-side key-server fields plus the local-only\n//                     manager handle when the stack owns the master key.\n//\n// The `<name>` suffix lets multiple seal instances coexist in a stack\n// without colliding on the resource registry (distilled doc §Pain Points\n// #7 — multi-instance currently untested but structurally supported).\n\nimport { resource } from '../../api/define-plugin.ts';\nimport type { SealKeyManager } from './key-manager.ts';\n\n// ---------------------------------------------------------------------------\n// Read-side: SealKeyServer\n// ---------------------------------------------------------------------------\n\n/** Structural mirror of `@mysten/seal`'s `KeyServerConfig`.\n *\n *  Distilled-doc invariant #9 + #18: peer-dep structural\n *  assignability. `@mysten/seal` is a peer dep — we duplicate the\n *  shape locally to keep the runtime import off the bundle. A\n *  compile-time `_SealKeyServerEntryCheck`\n *  guards against drift. */\nexport interface SealKeyServerEntry {\n\treadonly objectId: string;\n\treadonly weight: number;\n\treadonly aggregatorUrl?: string;\n}\n\n/** Read-side resolved value. SDK-ready: pass `serverConfigs` to\n *  `new SealClient({serverConfigs, ...})` directly. */\nexport interface SealKeyServer {\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\treadonly keyServerUrl: string;\n\treadonly objectId: string;\n}\n\n/** Public Seal resolved value. The key-server fields stay top-level\n *  so the direct member ref is immediately SDK-ready; local-keygen\n *  additionally exposes `manager`, while known deployments set it to\n *  `null` because this stack does not own the master key. */\nexport interface SealResolved extends SealKeyServer {\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n\treadonly manager: SealKeyManager | null;\n}\n\n/** Resource id constructor for the read-side handle. */\nexport type SealResourceId<Name extends string> = `seal:${Name}`;\nexport const sealResourceId = <Name extends string>(name: Name): SealResourceId<Name> =>\n\t`seal:${name}`;\n\n/** Construct the read-side resource. */\nexport const makeSealResource = <Name extends string>(name: Name) =>\n\tresource<SealResourceId<Name>, SealResolved>(sealResourceId(name));\n\n// ---------------------------------------------------------------------------\n// Projection helpers — narrow the plugin's resolved value\n// ---------------------------------------------------------------------------\n\n/** Aggregate resolved value the plugin's acquire body returns.\n *  Distilled-doc §\"SealLocalKeygenInternalShape\" — `{keyServer,\n *  keyManager, packageId}`. Modes that don't own a manager omit it. */\nexport interface SealLocalKeygenResolved {\n\treadonly keyServer: SealKeyServer;\n\treadonly keyManager: SealKeyManager;\n\treadonly packageId: string;\n}\n\nexport interface SealKnownResolved {\n\treadonly keyServer: SealKeyServer;\n}\n"],"mappings":";;;AAkDA,MAAa,kBAAuC,SACnD,QAAQ;;AAGT,MAAa,oBAAyC,SACrD,SAA6C,eAAe,IAAI,CAAC"}

package/dist/plugins/seal/routable.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/seal/routable.ts"],"sourcesContent":["// Seal plugin — Routable contribution.\n//\n// Distilled-doc invariant #5: the seal port (2024) is INTENTIONALLY\n// shared across stacks. Traefik dispatches by Host: header from the\n// well-known `seal-key-server` entrypoint. No host-port publish —\n// two stacks of the same app coexist on the same well-known port.\n//\n// The substrate's router (architecture §4) mints the hostname from\n// `(app, stack, dispatch-id)`. We provide:\n//\n//   - `endpointName`  — the well-known string `'seal-key-server'`.\n//   - `dispatchId`    — `{serviceKey: 'seal:<name>', role: 'key-server'}`.\n//                        The service key folds the seal instance\n//                        name so multi-instance stacks (distilled-doc\n//                        Open Question #7) don't collide.\n//   - `upstream`      — container kind; the substrate resolves the\n//                        container name from the lifecycle row.\n//   - `cors: true`    — the @mysten/seal SDK's fetch calls require\n//                        CORS allowance (distilled doc: localnet\n//                        SDK browser flow).\n//\n// Distilled-doc invariant #1: the URL the router publishes for this\n// routable decl MUST equal the URL we register on chain. The\n// plugin's acquire body reads the router's published URL ONCE\n// and threads the same value into the Move register call.\n\nimport type { DispatchId, EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n/** Well-known endpoint name for the seal key-server. Conventional\n *  router entrypoint `'seal-key-server'` on port 2024. */\nexport const SEAL_KEY_SERVER_ENDPOINT_NAME = 'seal-key-server' as const;\nexport const SEAL_KEY_SERVER_ROUTE_ROLE = 'key-server' as const;\nexport const DEFAULT_KEY_SERVER_PORT = 2024 as const;\n\nexport const SEAL_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: SEAL_KEY_SERVER_ENDPOINT_NAME, port: DEFAULT_KEY_SERVER_PORT, protocol: 'http' },\n];\n\nconst DEFAULT_STACK = 'main';\n\nconst normalizeRouteSegment = (raw: string): string => raw.toLowerCase().replace(/\\./g, '-');\n\n/** Build the DispatchId for a seal instance. The service key\n *  encodes the instance name so multi-instance seal in the same\n *  stack mints distinct dispatch files.\n *\n *  Note: distilled-doc Open Question #7 — multi-instance seal is\n *  structurally supported but untested. The two routable decls\n *  would both claim the `'seal-key-server'` entrypoint and the\n *  same `key-server.<stack>.<app>.localhost` hostname. Until v2\n *  plans canonicalize multi-instance routing, treat one-seal-per-stack\n *  as the safe default. */\nexport const buildSealDispatchId = (name: string): DispatchId => ({\n\tserviceKey: `seal:${name}`,\n\trole: SEAL_KEY_SERVER_ROUTE_ROLE,\n});\n\nexport const buildSealKeyServerPublicRoute = (inputs: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): { readonly hostname: string; readonly url: string } => {\n\tconst role = normalizeRouteSegment(SEAL_KEY_SERVER_ROUTE_ROLE);\n\tconst app = normalizeRouteSegment(inputs.app);\n\tconst stack = normalizeRouteSegment(inputs.stack);\n\tconst hostname =\n\t\tstack === DEFAULT_STACK ? `${role}.${app}.localhost` : `${role}.${stack}.${app}.localhost`;\n\treturn {\n\t\thostname,\n\t\turl: `http://${hostname}:${inputs.port}`,\n\t};\n};\n\n/** Build the Routable contribution. The substrate's router\n *  orchestrator consumes this; the actual hostname / URL minting\n *  happens there (architecture: routes-by-key, no hardcoded\n *  service hostnames in router code). */\nexport const makeSealRoutable = (inputs: {\n\treadonly name: string;\n\treadonly containerName: string;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\tdispatchId: buildSealDispatchId(inputs.name),\n\tupstream: {\n\t\ttype: 'container',\n\t\tcontainerName: inputs.containerName,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t},\n\tcors: true,\n\twireProtocol: 'http',\n});\n"],"mappings":";;;AA8BA,MAAa,gCAAgC;AAC7C,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AAEvC,MAAa,mBAAkD,CAC9D;CAAE,MAAM;CAA+B,MAAM;CAAyB,UAAU;CAAQ,CACxF;AAED,MAAM,gBAAgB;AAEtB,MAAM,yBAAyB,QAAwB,IAAI,aAAa,CAAC,QAAQ,OAAO,IAAI;;;;;;;;;;;AAY5F,MAAa,uBAAuB,UAA8B;CACjE,YAAY,QAAQ;CACpB,MAAM;CACN;AAED,MAAa,iCAAiC,WAIa;CAC1D,MAAM,OAAO,sBAAsB,2BAA2B;CAC9D,MAAM,MAAM,sBAAsB,OAAO,IAAI;CAC7C,MAAM,QAAQ,sBAAsB,OAAO,MAAM;CACjD,MAAM,WACL,UAAU,gBAAgB,GAAG,KAAK,GAAG,IAAI,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI;AAChF,QAAO;EACN;EACA,KAAK,UAAU,SAAS,GAAG,OAAO;EAClC;;;;;;AAOF,MAAa,oBAAoB,YAGZ;CACpB,MAAM;CACN,cAAc;CACd,YAAY,oBAAoB,OAAO,KAAK;CAC5C,UAAU;EACT,MAAM;EACN,eAAe,OAAO;EACtB,eAAe;EACf;CACD,MAAM;CACN,cAAc;CACd"}
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/seal/routable.ts"],"sourcesContent":["// Seal plugin — Routable contribution.\n//\n// Distilled-doc invariant #5: the seal port (2024) is INTENTIONALLY\n// shared across stacks. Traefik dispatches by Host: header from the\n// well-known `seal-key-server` entrypoint. No host-port publish —\n// two stacks of the same app coexist on the same well-known port.\n//\n// The substrate's router (architecture §4) mints the hostname from\n// `(app, stack, dispatch-id)`. We provide:\n//\n//   - `endpointName`  — the well-known string `'seal-key-server'`.\n//   - `dispatchId`    — `{serviceKey: 'seal:<name>', role: 'key-server'}`.\n//                        The service key folds the seal instance\n//                        name so multi-instance stacks (distilled-doc\n//                        Open Question #7) don't collide.\n//   - `upstream`      — container kind; the substrate resolves the\n//                        container name from the lifecycle row.\n//   - `cors: true`    — the @mysten/seal SDK's fetch calls require\n//                        CORS allowance (distilled doc: localnet\n//                        SDK browser flow).\n//\n// Distilled-doc invariant #1: the URL the router publishes for this\n// routable decl MUST equal the URL we register on chain. The\n// plugin's acquire body reads the router's published URL ONCE\n// and threads the same value into the Move register call.\n\nimport type { DispatchId, EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n/** Well-known endpoint name for the seal key-server. Conventional\n *  router entrypoint `'seal-key-server'` on port 2024. */\nexport const SEAL_KEY_SERVER_ENDPOINT_NAME = 'seal-key-server' as const;\nexport const SEAL_KEY_SERVER_ROUTE_ROLE = 'key-server' as const;\nexport const DEFAULT_KEY_SERVER_PORT = 2024 as const;\n\nexport const SEAL_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: SEAL_KEY_SERVER_ENDPOINT_NAME, port: DEFAULT_KEY_SERVER_PORT, protocol: 'http' },\n];\n\nconst DEFAULT_STACK = 'main';\n\nconst normalizeRouteSegment = (raw: string): string => raw.toLowerCase().replace(/\\./g, '-');\n\n/** Build the DispatchId for a seal instance. The service key\n *  encodes the instance name so multi-instance seal in the same\n *  stack mints distinct dispatch files.\n *\n *  Note: distilled-doc Open Question #7 — multi-instance seal is\n *  structurally supported but untested. The two routable decls\n *  would both claim the `'seal-key-server'` entrypoint and the\n *  same `key-server.<stack>.<app>.localhost` hostname. Until v2\n *  plans canonicalize multi-instance routing, treat one-seal-per-stack\n *  as the safe default. */\nexport const buildSealDispatchId = (name: string): DispatchId => ({\n\tserviceKey: `seal:${name}`,\n\trole: SEAL_KEY_SERVER_ROUTE_ROLE,\n});\n\nexport const buildSealKeyServerPublicRoute = (inputs: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): { readonly hostname: string; readonly url: string } => {\n\tconst role = normalizeRouteSegment(SEAL_KEY_SERVER_ROUTE_ROLE);\n\tconst app = normalizeRouteSegment(inputs.app);\n\tconst stack = normalizeRouteSegment(inputs.stack);\n\tconst hostname =\n\t\tstack === DEFAULT_STACK ? `${role}.${app}.localhost` : `${role}.${stack}.${app}.localhost`;\n\treturn {\n\t\thostname,\n\t\turl: `http://${hostname}:${inputs.port}`,\n\t};\n};\n\n/** Build the Routable contribution. The substrate's router\n *  orchestrator consumes this; the actual hostname / URL minting\n *  happens there (architecture: routes-by-key, no hardcoded\n *  service hostnames in router code). */\nexport const makeSealRoutable = (inputs: {\n\treadonly name: string;\n\treadonly containerName: string;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\tdispatchId: buildSealDispatchId(inputs.name),\n\tupstream: {\n\t\ttype: 'container',\n\t\tcontainerName: inputs.containerName,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t},\n\tcors: true,\n\twireProtocol: 'http',\n});\n"],"mappings":";;;AA8BA,MAAa,gCAAgC;AAC7C,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AAEvC,MAAa,mBAAkD,CAC9D;CAAE,MAAM;CAA+B,MAAM;CAAyB,UAAU;AAAO,CACxF;AAEA,MAAM,gBAAgB;AAEtB,MAAM,yBAAyB,QAAwB,IAAI,YAAY,CAAC,CAAC,QAAQ,OAAO,GAAG;;;;;;;;;;;AAY3F,MAAa,uBAAuB,UAA8B;CACjE,YAAY,QAAQ;CACpB,MAAM;AACP;AAEA,MAAa,iCAAiC,WAIa;CAC1D,MAAM,OAAO,sBAAsB,0BAA0B;CAC7D,MAAM,MAAM,sBAAsB,OAAO,GAAG;CAC5C,MAAM,QAAQ,sBAAsB,OAAO,KAAK;CAChD,MAAM,WACL,UAAU,gBAAgB,GAAG,KAAK,GAAG,IAAI,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI;CAChF,OAAO;EACN;EACA,KAAK,UAAU,SAAS,GAAG,OAAO;CACnC;AACD;;;;;AAMA,MAAa,oBAAoB,YAGZ;CACpB,MAAM;CACN,cAAc;CACd,YAAY,oBAAoB,OAAO,IAAI;CAC3C,UAAU;EACT,MAAM;EACN,eAAe,OAAO;EACtB,eAAe;CAChB;CACA,MAAM;CACN,cAAc;AACf"}

package/dist/plugins/seal/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/seal/service.ts"],"sourcesContent":["// Seal plugin — known-mode dispatch (live + fork-known).\n//\n// Local-keygen mode is dispatched directly from the plugin barrel\n// (`index.ts`) via `bootLocalKeygen` because it needs a\n// `LocalKeygenDeps` bundle (ContainerRuntime, paths, identity, …)\n// composed from substrate services. This file only routes the two\n// pure-value-producing modes that need no substrate plumbing.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { SealAnyError } from './errors.ts';\nimport { acquireForkKnown, type ForkKnownInputs } from './mode/fork-known.ts';\nimport { acquireLive } from './mode/live.ts';\nimport type { SealKnownResolved } from './registry-publish.ts';\n\n/** Known-mode discriminator — live + fork-known only. */\nexport type SealMode =\n\t| {\n\t\t\treadonly mode: 'live';\n\t\t\treadonly name: string;\n\t\t\treadonly resolved: { readonly objectId: string; readonly keyServerUrl: string };\n\t  }\n\t| ({ readonly mode: 'fork-known' } & ForkKnownInputs);\n\nexport type SealKnownBootResult = SealKnownResolved;\n\n/** Dispatch on the known-mode discriminator. The publisher argument\n *  is unused by the known paths (no on-chain artifact produce); it's\n *  accepted for shape uniformity with the local-keygen entry point. */\nexport const bootSealService = (\n\t_publisher: ArtifactPublisher,\n\topts: SealMode,\n): Effect.Effect<SealKnownBootResult, SealAnyError | ArtifactPublishError, Scope.Scope> => {\n\tswitch (opts.mode) {\n\t\tcase 'live':\n\t\t\treturn acquireLive(opts);\n\t\tcase 'fork-known':\n\t\t\treturn acquireForkKnown(opts);\n\t}\n};\n"],"mappings":";;;;;;;AAiCA,MAAa,mBACZ,YACA,SAC0F;AAC1F,SAAQ,KAAK,MAAb;EACC,KAAK,OACJ,QAAO,YAAY,KAAK;EACzB,KAAK,aACJ,QAAO,iBAAiB,KAAK"}
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/seal/service.ts"],"sourcesContent":["// Seal plugin — known-mode dispatch (live + fork-known).\n//\n// Local-keygen mode is dispatched directly from the plugin barrel\n// (`index.ts`) via `bootLocalKeygen` because it needs a\n// `LocalKeygenDeps` bundle (ContainerRuntime, paths, identity, …)\n// composed from substrate services. This file only routes the two\n// pure-value-producing modes that need no substrate plumbing.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { SealAnyError } from './errors.ts';\nimport { acquireForkKnown, type ForkKnownInputs } from './mode/fork-known.ts';\nimport { acquireLive } from './mode/live.ts';\nimport type { SealKnownResolved } from './registry-publish.ts';\n\n/** Known-mode discriminator — live + fork-known only. */\nexport type SealMode =\n\t| {\n\t\t\treadonly mode: 'live';\n\t\t\treadonly name: string;\n\t\t\treadonly resolved: { readonly objectId: string; readonly keyServerUrl: string };\n\t  }\n\t| ({ readonly mode: 'fork-known' } & ForkKnownInputs);\n\nexport type SealKnownBootResult = SealKnownResolved;\n\n/** Dispatch on the known-mode discriminator. The publisher argument\n *  is unused by the known paths (no on-chain artifact produce); it's\n *  accepted for shape uniformity with the local-keygen entry point. */\nexport const bootSealService = (\n\t_publisher: ArtifactPublisher,\n\topts: SealMode,\n): Effect.Effect<SealKnownBootResult, SealAnyError | ArtifactPublishError, Scope.Scope> => {\n\tswitch (opts.mode) {\n\t\tcase 'live':\n\t\t\treturn acquireLive(opts);\n\t\tcase 'fork-known':\n\t\t\treturn acquireForkKnown(opts);\n\t}\n};\n"],"mappings":";;;;;;;AAiCA,MAAa,mBACZ,YACA,SAC0F;CAC1F,QAAQ,KAAK,MAAb;EACC,KAAK,QACJ,OAAO,YAAY,IAAI;EACxB,KAAK,cACJ,OAAO,iBAAiB,IAAI;CAC9B;AACD"}

package/dist/plugins/seal/snapshot.mjs

@@ -10,14 +10,13 @@ import { Effect } from "effect";
 const makeLocalKeygenSnapshotable = (inputs) => {
 	return {
 		kind: "snapshotable",
-		subtrees: [`seal`],
+		subtrees: ["seal/"],
 		managedContainers: [{
 			app: inputs.app,
 			stack: inputs.stack,
 			plugin: "seal",
 			role: "key-server"
 		}],
-		quiesce: Effect.void,
 		preRestore: Effect.succeed({
 			kind: "seal",
 			name: inputs.name

package/dist/plugins/seal/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/seal/snapshot.ts"],"sourcesContent":["// Seal plugin — Snapshotable contribution.\n//\n// Distilled-doc §\"What survives snapshot\":\n//\n//   - `runtime/seal/master-key.env`              (0o600 — SECRET MATERIAL)\n//   - `runtime/seal/local-keygen-state.v1.json`  (public key metadata)\n//   - `runtime/seal/key-server-config.yaml`\n//   - State-store entries (under runtime/state-store/, auto-captured\n//     by the substrate — we don't declare a subtree for those).\n//   - Managed container — labeled tuple drives the docker commit +\n//     save path.\n//\n// Distilled-doc invariant: the master-key file is the LOAD-BEARING\n// piece — losing it on resume means the on-chain `KeyServer.url`'s\n// public key would mismatch a fresh keygen. The substrate's\n// `secretMaterial: true` flag drives the mode-bit round-trip (0o600\n// inside 0o700 parent preserved through the snapshot tar).\n//\n// Architecture: the orchestrator is service-name-blind — it walks\n// the Snapshotable decls, sees `runtime/seal/` as just a subtree\n// path, and treats the secret flag as an opaque mode-bit directive.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Build the Snapshotable contribution for the local-keygen mode.\n *\n *  Inputs threaded by the barrel from acquire-time substrate\n *  identity. Distilled-doc invariant #4: `master-key.env` MUST\n *  survive snapshot. `missingTolerance: 'fatal'` because the file's\n *  absence on restore would silently re-derive a fresh keypair\n *  against a stale on-chain public key. */\nexport const makeLocalKeygenSnapshotable = (inputs: {\n\treadonly name: string;\n\treadonly app: string;\n\treadonly stack: string;\n}): SnapshotableDecl => {\n\tconst labelTuple: ContainerLabelTuple = {\n\t\tapp: inputs.app,\n\t\tstack: inputs.stack,\n\t\tplugin: 'seal',\n\t\trole: 'key-server',\n\t};\n\treturn {\n\t\tkind: 'snapshotable',\n\t\t// Subtree under runtime/. The substrate roots this under the\n\t\t// per-stack runtime-dir; `seal` is plugin-blind from the\n\t\t// orchestrator's POV (just a path segment).\n\t\tsubtrees: [`seal`],\n\t\tmanagedContainers: [labelTuple],\n\t\t// The key-server's Docker stop grace is owned by key-server.ts.\n\t\tquiesce: Effect.void,\n\t\tpreRestore: Effect.succeed({\n\t\t\tkind: 'seal' as const,\n\t\t\tname: inputs.name,\n\t\t}),\n\t\tpostRestore: Effect.void,\n\t\tmissingTolerance: 'fatal',\n\t\t// Distilled-doc §Hard requirements #2 + #4: master-key.env is\n\t\t// secret material (0o600). The substrate's tar handler\n\t\t// preserves the mode bits on round-trip.\n\t\tsecretMaterial: true,\n\t};\n};\n\n/** Build the Snapshotable contribution for the known-deployment\n *  modes (live / fork-known). No managed container, no on-disk\n *  state — we only need the orchestrator to see the plugin's\n *  identity for the manifest sidecar.\n *\n *  `missingTolerance: 'fine'` because the known-deployment mode\n *  has no host-side state to lose. */\nexport const makeKnownSnapshotable = (inputs: { readonly name: string }): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: [],\n\tmissingTolerance: 'fine',\n\tpreRestore: Effect.succeed({ kind: 'seal' as const, name: inputs.name }),\n\tpostRestore: Effect.void,\n\tsecretMaterial: false,\n});\n"],"mappings":";;;;;;;;;AAiCA,MAAa,+BAA+B,WAIpB;AAOvB,QAAO;EACN,MAAM;EAIN,UAAU,CAAC,OAAO;EAClB,mBAAmB,CAAC;GAXpB,KAAK,OAAO;GACZ,OAAO,OAAO;GACd,QAAQ;GACR,MAAM;GAQwB,CAAC;EAE/B,SAAS,OAAO;EAChB,YAAY,OAAO,QAAQ;GAC1B,MAAM;GACN,MAAM,OAAO;GACb,CAAC;EACF,aAAa,OAAO;EACpB,kBAAkB;EAIlB,gBAAgB;EAChB;;;;;;;;;AAUF,MAAa,yBAAyB,YAAyD;CAC9F,MAAM;CACN,UAAU,EAAE;CACZ,kBAAkB;CAClB,YAAY,OAAO,QAAQ;EAAE,MAAM;EAAiB,MAAM,OAAO;EAAM,CAAC;CACxE,aAAa,OAAO;CACpB,gBAAgB;CAChB"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/seal/snapshot.ts"],"sourcesContent":["// Seal plugin — Snapshotable contribution.\n//\n// Distilled-doc §\"What survives snapshot\":\n//\n//   - `runtime/seal/master-key.env`              (0o600 — SECRET MATERIAL)\n//   - `runtime/seal/local-keygen-state.v1.json`  (public key metadata)\n//   - `runtime/seal/key-server-config.yaml`\n//   - Content-addressed cache entries (the keypair the ArtifactPublisher\n//     persists under `cache/<namespace>/<chainId>/...`, auto-captured by\n//     the substrate's cache subtree — we don't declare a subtree for those).\n//   - Managed container — labeled tuple drives the docker commit +\n//     save path.\n//\n// Distilled-doc invariant: the master-key file is the LOAD-BEARING\n// piece — losing it on resume means the on-chain `KeyServer.url`'s\n// public key would mismatch a fresh keygen. The substrate's\n// `secretMaterial: true` flag drives the mode-bit round-trip (0o600\n// inside 0o700 parent preserved through the snapshot tar).\n//\n// Architecture: the orchestrator is service-name-blind — it walks\n// the Snapshotable decls, sees `runtime/seal/` as just a subtree\n// path, and treats the secret flag as an opaque mode-bit directive.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Build the Snapshotable contribution for the local-keygen mode.\n *\n *  Inputs threaded by the barrel from acquire-time substrate\n *  identity. Distilled-doc invariant #4: `master-key.env` MUST\n *  survive snapshot. `missingTolerance: 'fatal'` because the file's\n *  absence on restore would silently re-derive a fresh keypair\n *  against a stale on-chain public key. */\nexport const makeLocalKeygenSnapshotable = (inputs: {\n\treadonly name: string;\n\treadonly app: string;\n\treadonly stack: string;\n}): SnapshotableDecl => {\n\tconst labelTuple: ContainerLabelTuple = {\n\t\tapp: inputs.app,\n\t\tstack: inputs.stack,\n\t\tplugin: 'seal',\n\t\trole: 'key-server',\n\t};\n\treturn {\n\t\tkind: 'snapshotable',\n\t\t// Subtree under runtime/. The substrate roots this under the\n\t\t// per-stack runtime-dir; `seal` is plugin-blind from the\n\t\t// orchestrator's POV (just a path segment).\n\t\tsubtrees: ['seal/'],\n\t\tmanagedContainers: [labelTuple],\n\t\t// The key-server's Docker stop grace is owned by key-server.ts; the\n\t\t// capture bounce's graceful stop flushes its state before commit.\n\t\tpreRestore: Effect.succeed({\n\t\t\tkind: 'seal' as const,\n\t\t\tname: inputs.name,\n\t\t}),\n\t\tpostRestore: Effect.void,\n\t\tmissingTolerance: 'fatal',\n\t\t// Distilled-doc §Hard requirements #2 + #4: master-key.env is\n\t\t// secret material (0o600). The substrate's tar handler\n\t\t// preserves the mode bits on round-trip.\n\t\tsecretMaterial: true,\n\t};\n};\n\n/** Build the Snapshotable contribution for the known-deployment\n *  modes (live / fork-known). No managed container, no on-disk\n *  state — we only need the orchestrator to see the plugin's\n *  identity for the manifest sidecar.\n *\n *  `missingTolerance: 'fine'` because the known-deployment mode\n *  has no host-side state to lose. */\nexport const makeKnownSnapshotable = (inputs: { readonly name: string }): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: [],\n\tmissingTolerance: 'fine',\n\tpreRestore: Effect.succeed({ kind: 'seal' as const, name: inputs.name }),\n\tpostRestore: Effect.void,\n\tsecretMaterial: false,\n});\n"],"mappings":";;;;;;;;;AAkCA,MAAa,+BAA+B,WAIpB;CAOvB,OAAO;EACN,MAAM;EAIN,UAAU,CAAC,OAAO;EAClB,mBAAmB,CAAC;GAXpB,KAAK,OAAO;GACZ,OAAO,OAAO;GACd,QAAQ;GACR,MAAM;EAQuB,CAAC;EAG9B,YAAY,OAAO,QAAQ;GAC1B,MAAM;GACN,MAAM,OAAO;EACd,CAAC;EACD,aAAa,OAAO;EACpB,kBAAkB;EAIlB,gBAAgB;CACjB;AACD;;;;;;;;AASA,MAAa,yBAAyB,YAAyD;CAC9F,MAAM;CACN,UAAU,CAAC;CACX,kBAAkB;CAClB,YAAY,OAAO,QAAQ;EAAE,MAAM;EAAiB,MAAM,OAAO;CAAK,CAAC;CACvE,aAAa,OAAO;CACpB,gBAAgB;AACjB"}

package/dist/plugins/sui/auto-tick.mjs

@@ -1,6 +1,6 @@
-import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
+import { LogAttr } from "../../substrate/runtime/observability/log-attrs.mjs";
 import { suiConfigError } from "./errors.mjs";
-import { SuiSpans } from "./spans.mjs";
+import { SuiLogAttr } from "./log-attrs.mjs";
 import { Effect, Schedule } from "effect";
 //#region src/plugins/sui/auto-tick.ts
 /** Default cadence when caller passes `autoTick: true`. */
@@ -28,9 +28,9 @@ const resolveAutoTickIntervalMs = (option) => {
 */
 const runAutoTickClock = (advancer, intervalMs) => Effect.gen(function* () {
 	yield* advancer.advanceClock(intervalMs).pipe(Effect.catch((err) => Effect.logWarning("sui auto-tick advance failed; next tick will retry").pipe(Effect.annotateLogs({
-		[SuiSpans.autoTickIntervalMs]: intervalMs,
-		[SpanAttr.phase]: err.phase,
-		[SpanAttr.errorMessage]: err.message
+		[SuiLogAttr.autoTickIntervalMs]: intervalMs,
+		[LogAttr.phase]: err.phase,
+		[LogAttr.errorMessage]: err.message
 	})))).pipe(Effect.repeat(Schedule.spaced(`${intervalMs} millis`)), Effect.forkScoped);
 });
 //#endregion

package/dist/plugins/sui/auto-tick.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auto-tick.mjs","names":[],"sources":["../../../src/plugins/sui/auto-tick.ts"],"sourcesContent":["// Auto-tick clock — fork-mode-only.\n//\n// Architecture invariant: \"Auto-tick is fork-mode-only\" — the\n// `autoTick` option lives on `SuiForkOptions` alone, and only the\n// fork boot wires `runAutoTickClock` (against the fork binary's\n// `ForkingService.advanceClock`). Localnet's validator advances its\n// own clock and commits pending txs without prompting, so no\n// equivalent knob exists there.\n//\n// The fiber is `forkScoped` against the plugin's acquire scope:\n// teardown happens automatically on wipe/restart/Ctrl-C. Failure\n// policy is **log-warn-and-continue** — a single advance-clock\n// RPC failure must not break the supervisor.\n\nimport { Effect, Schedule, type Scope } from 'effect';\n\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport { suiConfigError } from './errors.ts';\nimport type { SuiConfigError, SuiPluginError } from './errors.ts';\nimport { SuiSpans } from './spans.ts';\n\n/** Public knob shape mirroring the user-facing API. */\nexport type AutoTickOption = boolean | { readonly intervalMs: number };\n\n/** Default cadence when caller passes `autoTick: true`. */\nexport const DEFAULT_AUTO_TICK_INTERVAL_MS = 1000;\n\n/** Resolve the public option to a numeric interval. Succeeds with\n *  `undefined` when auto-tick is OFF. A misconfigured option (0 /\n *  negative / non-finite) fails the effect with a typed\n *  `SuiConfigError` so the boot path can `catchTag` it — a synchronous\n *  `throw` inside the acquire `Effect.gen` would surface as a defect\n *  (STYLE_GUIDE §2: plugin errors must be catchTag-able). */\nexport const resolveAutoTickIntervalMs = (\n\toption?: AutoTickOption,\n): Effect.Effect<number | undefined, SuiConfigError> => {\n\tif (option === undefined || option === false) return Effect.succeed(undefined);\n\tif (option === true) return Effect.succeed(DEFAULT_AUTO_TICK_INTERVAL_MS);\n\tconst { intervalMs } = option;\n\tif (typeof intervalMs === 'number' && Number.isFinite(intervalMs) && intervalMs > 0) {\n\t\treturn Effect.succeed(intervalMs);\n\t}\n\treturn Effect.fail(\n\t\tsuiConfigError({\n\t\t\tfield: 'autoTick.intervalMs',\n\t\t\tmessage: `sui: autoTick.intervalMs must be a positive finite number (got ${String(intervalMs)})`,\n\t\t}),\n\t);\n};\n\n/** Plugin-internal shim — the minimal admin surface the auto-tick\n *  fiber needs. Fork-mode wires this to the fork admin surface, whose\n *  `advanceClock` calls the binary's `ForkingService.advanceClock`\n *  gRPC method (see `makeForkAdminSurface` in `mode/fork.ts`). The\n *  `ForkAdminSurface` is structurally a `ClockAdvancer`, so the boot\n *  hands it through directly. */\nexport interface ClockAdvancer {\n\treadonly advanceClock: (intervalMs: number) => Effect.Effect<void, SuiPluginError>;\n}\n\n/**\n * Fork a scope-bound fiber that calls `advanceClock(intervalMs)` on\n * a `Schedule.spaced(intervalMs)` cadence. The fiber dies on the\n * surrounding scope's close (wipe / restart / Ctrl-C).\n */\nexport const runAutoTickClock = (\n\tadvancer: ClockAdvancer,\n\tintervalMs: number,\n): Effect.Effect<void, never, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst tick = advancer.advanceClock(intervalMs).pipe(\n\t\t\tEffect.catch((err) =>\n\t\t\t\tEffect.logWarning('sui auto-tick advance failed; next tick will retry').pipe(\n\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t[SuiSpans.autoTickIntervalMs]: intervalMs,\n\t\t\t\t\t\t[SpanAttr.phase]: err.phase,\n\t\t\t\t\t\t[SpanAttr.errorMessage]: err.message,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t\tyield* tick.pipe(Effect.repeat(Schedule.spaced(`${intervalMs} millis`)), Effect.forkScoped);\n\t});\n"],"mappings":";;;;;;AAyBA,MAAa,gCAAgC;;;;;;;AAQ7C,MAAa,6BACZ,WACuD;AACvD,KAAI,WAAW,KAAA,KAAa,WAAW,MAAO,QAAO,OAAO,QAAQ,KAAA,EAAU;AAC9E,KAAI,WAAW,KAAM,QAAO,OAAO,QAAQ,8BAA8B;CACzE,MAAM,EAAE,eAAe;AACvB,KAAI,OAAO,eAAe,YAAY,OAAO,SAAS,WAAW,IAAI,aAAa,EACjF,QAAO,OAAO,QAAQ,WAAW;AAElC,QAAO,OAAO,KACb,eAAe;EACd,OAAO;EACP,SAAS,kEAAkE,OAAO,WAAW,CAAC;EAC9F,CAAC,CACF;;;;;;;AAkBF,MAAa,oBACZ,UACA,eAEA,OAAO,IAAI,aAAa;AAYvB,QAXa,SAAS,aAAa,WAAW,CAAC,KAC9C,OAAO,OAAO,QACb,OAAO,WAAW,qDAAqD,CAAC,KACvE,OAAO,aAAa;GAClB,SAAS,qBAAqB;GAC9B,SAAS,QAAQ,IAAI;GACrB,SAAS,eAAe,IAAI;EAC7B,CAAC,CACF,CACD,CAES,CAAC,KAAK,OAAO,OAAO,SAAS,OAAO,GAAG,WAAW,SAAS,CAAC,EAAE,OAAO,WAAW;EAC1F"}
+{"version":3,"file":"auto-tick.mjs","names":[],"sources":["../../../src/plugins/sui/auto-tick.ts"],"sourcesContent":["// Auto-tick clock — fork-mode-only.\n//\n// Architecture invariant: \"Auto-tick is fork-mode-only\" — the\n// `autoTick` option lives on `SuiForkOptions` alone, and only the\n// fork boot wires `runAutoTickClock` (against the fork binary's\n// `ForkingService.advanceClock`). Localnet's validator advances its\n// own clock and commits pending txs without prompting, so no\n// equivalent knob exists there.\n//\n// The fiber is `forkScoped` against the plugin's acquire scope:\n// teardown happens automatically on wipe/restart/Ctrl-C. Failure\n// policy is **log-warn-and-continue** — a single advance-clock\n// RPC failure must not break the supervisor.\n\nimport { Effect, Schedule, type Scope } from 'effect';\n\nimport { LogAttr } from '../../substrate/runtime/observability/log-attrs.ts';\nimport { suiConfigError } from './errors.ts';\nimport type { SuiConfigError, SuiPluginError } from './errors.ts';\nimport { SuiLogAttr } from './log-attrs.ts';\n\n/** Public knob shape mirroring the user-facing API. */\nexport type AutoTickOption = boolean | { readonly intervalMs: number };\n\n/** Default cadence when caller passes `autoTick: true`. */\nexport const DEFAULT_AUTO_TICK_INTERVAL_MS = 1000;\n\n/** Resolve the public option to a numeric interval. Succeeds with\n *  `undefined` when auto-tick is OFF. A misconfigured option (0 /\n *  negative / non-finite) fails the effect with a typed\n *  `SuiConfigError` so the boot path can `catchTag` it — a synchronous\n *  `throw` inside the acquire `Effect.gen` would surface as a defect\n *  (STYLE_GUIDE §2: plugin errors must be catchTag-able). */\nexport const resolveAutoTickIntervalMs = (\n\toption?: AutoTickOption,\n): Effect.Effect<number | undefined, SuiConfigError> => {\n\tif (option === undefined || option === false) return Effect.succeed(undefined);\n\tif (option === true) return Effect.succeed(DEFAULT_AUTO_TICK_INTERVAL_MS);\n\tconst { intervalMs } = option;\n\tif (typeof intervalMs === 'number' && Number.isFinite(intervalMs) && intervalMs > 0) {\n\t\treturn Effect.succeed(intervalMs);\n\t}\n\treturn Effect.fail(\n\t\tsuiConfigError({\n\t\t\tfield: 'autoTick.intervalMs',\n\t\t\tmessage: `sui: autoTick.intervalMs must be a positive finite number (got ${String(intervalMs)})`,\n\t\t}),\n\t);\n};\n\n/** Plugin-internal shim — the minimal admin surface the auto-tick\n *  fiber needs. Fork-mode wires this to the fork admin surface, whose\n *  `advanceClock` calls the binary's `ForkingService.advanceClock`\n *  gRPC method (see `makeForkAdminSurface` in `mode/fork.ts`). The\n *  `ForkAdminSurface` is structurally a `ClockAdvancer`, so the boot\n *  hands it through directly. */\nexport interface ClockAdvancer {\n\treadonly advanceClock: (intervalMs: number) => Effect.Effect<void, SuiPluginError>;\n}\n\n/**\n * Fork a scope-bound fiber that calls `advanceClock(intervalMs)` on\n * a `Schedule.spaced(intervalMs)` cadence. The fiber dies on the\n * surrounding scope's close (wipe / restart / Ctrl-C).\n */\nexport const runAutoTickClock = (\n\tadvancer: ClockAdvancer,\n\tintervalMs: number,\n): Effect.Effect<void, never, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst tick = advancer.advanceClock(intervalMs).pipe(\n\t\t\tEffect.catch((err) =>\n\t\t\t\tEffect.logWarning('sui auto-tick advance failed; next tick will retry').pipe(\n\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t[SuiLogAttr.autoTickIntervalMs]: intervalMs,\n\t\t\t\t\t\t[LogAttr.phase]: err.phase,\n\t\t\t\t\t\t[LogAttr.errorMessage]: err.message,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t\tyield* tick.pipe(Effect.repeat(Schedule.spaced(`${intervalMs} millis`)), Effect.forkScoped);\n\t});\n"],"mappings":";;;;;;AAyBA,MAAa,gCAAgC;;;;;;;AAQ7C,MAAa,6BACZ,WACuD;CACvD,IAAI,WAAW,KAAA,KAAa,WAAW,OAAO,OAAO,OAAO,QAAQ,KAAA,CAAS;CAC7E,IAAI,WAAW,MAAM,OAAO,OAAO,QAAQ,6BAA6B;CACxE,MAAM,EAAE,eAAe;CACvB,IAAI,OAAO,eAAe,YAAY,OAAO,SAAS,UAAU,KAAK,aAAa,GACjF,OAAO,OAAO,QAAQ,UAAU;CAEjC,OAAO,OAAO,KACb,eAAe;EACd,OAAO;EACP,SAAS,kEAAkE,OAAO,UAAU,EAAE;CAC/F,CAAC,CACF;AACD;;;;;;AAiBA,MAAa,oBACZ,UACA,eAEA,OAAO,IAAI,aAAa;CAYvB,OAXa,SAAS,aAAa,UAAU,CAAC,CAAC,KAC9C,OAAO,OAAO,QACb,OAAO,WAAW,oDAAoD,CAAC,CAAC,KACvE,OAAO,aAAa;GAClB,WAAW,qBAAqB;GAChC,QAAQ,QAAQ,IAAI;GACpB,QAAQ,eAAe,IAAI;CAC7B,CAAC,CACF,CACD,CAES,CAAC,CAAC,KAAK,OAAO,OAAO,SAAS,OAAO,GAAG,WAAW,QAAQ,CAAC,GAAG,OAAO,UAAU;AAC3F,CAAC"}

package/dist/plugins/sui/chain-build-container.mjs

@@ -1,10 +1,10 @@
 import "../../substrate/runtime/cross-process/stack-lock.mjs";
-import "../../substrate/runtime/sui-move-build/index.mjs";
+import "./move/index.mjs";
 import "../../substrate/runtime/managed-container.mjs";
 import "./errors.mjs";
 import "effect";
-import "node:crypto";
 import "node:path";
+import "node:crypto";
 import "node:os";
 [
 	"child=;",

package/dist/plugins/sui/chain-build-container.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"chain-build-container.mjs","names":[],"sources":["../../../src/plugins/sui/chain-build-container.ts"],"sourcesContent":["// Per-app long-lived Move build container.\n//\n// Architecture Decision §5: the build container is PER-APP, NOT\n// per-stack. Two parallel stacks of the same app share the same\n// sleeper container — their concurrent Move builds serialise on\n// docker exec queueing. This is intentional: dep-cache reuse\n// across stacks outweighs the serialisation cost.\n//\n// Adopt-or-create state machine is delegated to the substrate's\n// `ContainerRuntime.ensureContainer` with `recreate: 'never'` —\n// daemon outages must fail loudly, not silently churn (distilled\n// doc S6: \"MUST reject the helper's auto-recreate-on-resume-failed\n// path\").\n//\n// Cross-process safety: the host-wide advisory lock is owned by\n// THIS module. The lock is held inside the build call (NOT at the\n// docker-exec layer), because three distinct execution paths (host\n// CLI, fresh `docker run --rm`, container exec) all need\n// protection. Lock path: `~/.devstack/locks/sui-move-build-<repoHash>.lock`.\n\nimport { createHash } from 'node:crypto';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tContainerRuntimeError,\n\tEnsureContainerSpec,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport { acquireStackLock } from '../../substrate/runtime/cross-process/stack-lock.ts';\nimport {\n\tensureManagedContainer,\n\tPER_APP_SHARED_STACK,\n} from '../../substrate/runtime/managed-container.ts';\nimport { containerInnerScript } from '../../substrate/runtime/sui-move-build/index.ts';\nimport { suiCliError, suiPluginError, type SuiCliError, type SuiPluginError } from './errors.ts';\n\n/** Default move-build lock timeout — five minutes, matching the\n *  distilled-doc invariant. The lock is held during the build\n *  body only; long-running stages never share it. */\nexport const MOVE_BUILD_LOCK_TIMEOUT_MS = 5 * 60_000;\n\nconst BUILD_CONTAINER_STOP_GRACE_SECONDS = 2;\nconst BUILD_CONTAINER_KEEPALIVE_COMMAND = [\n\t'child=;',\n\t'trap \\'[ -z \"$child\" ] || kill \"$child\" 2>/dev/null || true; exit 0\\' INT TERM;',\n\t'sleep infinity & child=$!;',\n\t'wait \"$child\"',\n].join(' ');\n\n/** Per-app container name. The substrate's `pluginKey('sui-build')`\n *  + the app discriminator combine to a stable name; the container\n *  intentionally omits the stack/network suffix so two stacks of\n *  the same app share. */\nexport const containerNameForApp = (app: string): string => `devstack-${app}-build`;\n\nconst expandHome = (path: string): string =>\n\tpath === '~' ? homedir() : path.startsWith('~/') ? join(homedir(), path.slice(2)) : path;\n\nconst repoHashForLock = (appDir: string): string =>\n\tcreateHash('sha256').update(resolve(appDir)).digest('hex').slice(0, 16);\n\nexport const moveBuildLockPathFor = (appDir: string, moveHome: string): string => {\n\tconst moveHomeRoot = dirname(resolve(expandHome(moveHome)));\n\treturn join(moveHomeRoot, '.devstack', 'locks', `sui-move-build-${repoHashForLock(appDir)}.lock`);\n};\n\n/** Build-container handle returned to plugin internals (the\n *  cli-driver dispatches into this). */\nexport interface ChainBuildContainer {\n\treadonly handle: ContainerHandle;\n\t/** Translate a host-absolute path into a container-bind path.\n\t *  Returns null when the host path escapes the bind-mounted app\n\t *  dir — callers MUST fall back to `docker run --rm` in that\n\t *  case (distilled-doc: \"Build container path translation MUST\n\t *  refuse paths outside the bind-mounted app dir\"). */\n\treadonly toContainerPath: (hostPath: string) => string | null;\n\t/** Run a sui-cli capture inside the container. Acquires the\n\t *  host-wide move-build lock before invoking docker-exec. */\n\treadonly runBuild: (\n\t\thostPackagePath: string,\n\t) => Effect.Effect<\n\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\tSuiCliError,\n\t\tScope.Scope\n\t>;\n\t/** Run a codegen-style \"summary\" build inside the container.\n\t *  Same wire shape as runBuild; the codegen plugin consumes\n\t *  this via the cross-service seam. */\n\treadonly runSummary: (\n\t\thostPackagePath: string,\n\t) => Effect.Effect<\n\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\tSuiCliError,\n\t\tScope.Scope\n\t>;\n}\n\n/** Spec passed to `ContainerRuntime.ensureContainer` for the\n *  per-app sleeper. Image is content-hashed; labels carry the\n *  app discriminator so `inspectByLabels` finds it across stacks. */\nexport interface ChainBuildContainerSpec {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly appDir: string;\n\treadonly moveHome: string;\n\treadonly image: ImageRef;\n}\n\n/**\n * Acquire (or adopt) the per-app build container. Returns a\n * `ChainBuildContainer` handle scoped to the caller's Scope.\n *\n * The build call holds the host-wide move-build lock for the docker\n * exec body. The lock uses the substrate's PID + start-time stale\n * holder reclaim path, so a crashed peer cannot wedge future builds.\n */\nexport const acquireChainBuildContainer = (\n\truntime: ContainerRuntime,\n\tspec: ChainBuildContainerSpec,\n): Effect.Effect<ChainBuildContainer, ContainerRuntimeError | SuiPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// The sleeper shell traps Docker's stop signal so scope-close\n\t\t// does not wait for Docker's default SIGKILL escalation path.\n\t\t// This also overrides the sui image's default `start\n\t\t// --with-faucet=...` entrypoint so the validator binary doesn't\n\t\t// run genesis inside a build container.\n\t\t// The appDir is bind-mounted at `/workspace`, with the user's\n\t\t// `~/.move` bind-mounted at `/root/.move` so the content-addressed\n\t\t// dep cache (`~/.move/git/<repo>@<sha>/…`) persists across builds.\n\t\tconst ensureSpec: EnsureContainerSpec = {\n\t\t\tname: containerNameForApp(spec.app),\n\t\t\timage: spec.image,\n\t\t\tlabels: {\n\t\t\t\tapp: spec.app,\n\t\t\t\t// Intentionally pin stack to a sentinel — see comment\n\t\t\t\t// above; this is per-app, not per-stack.\n\t\t\t\tstack: PER_APP_SHARED_STACK,\n\t\t\t\tplugin: 'sui',\n\t\t\t\trole: 'build',\n\t\t\t},\n\t\t\trecreate: 'never',\n\t\t\tentrypoint: 'sh',\n\t\t\tcommand: ['-c', BUILD_CONTAINER_KEEPALIVE_COMMAND],\n\t\t\tstopGraceSeconds: BUILD_CONTAINER_STOP_GRACE_SECONDS,\n\t\t\tmounts: [\n\t\t\t\t{ source: spec.appDir, target: '/workspace' },\n\t\t\t\t{ source: spec.moveHome, target: '/root/.move' },\n\t\t\t],\n\t\t};\n\t\tconst { labels, ...containerSpec } = ensureSpec;\n\t\tconst handle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tlabels,\n\t\t\tspec: containerSpec,\n\t\t\tmapError: (cause) => cause,\n\t\t});\n\n\t\tconst toContainerPath = (hostPath: string): string | null => {\n\t\t\t// The runtime adapter bind-mounts `spec.appDir` at\n\t\t\t// `/workspace`. A host path outside that bind is not\n\t\t\t// accessible to the container.\n\t\t\tif (!hostPath.startsWith(spec.appDir)) return null;\n\t\t\tconst rel = hostPath.slice(spec.appDir.length).replace(/^\\/+/, '');\n\t\t\treturn rel === '' ? '/workspace' : `/workspace/${rel}`;\n\t\t};\n\t\tconst moveBuildLockPath = moveBuildLockPathFor(spec.appDir, spec.moveHome);\n\n\t\tconst runInContainer = (\n\t\t\top: 'build' | 'summary',\n\t\t\thostPackagePath: string,\n\t\t): Effect.Effect<\n\t\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\t\tSuiCliError,\n\t\t\tScope.Scope\n\t\t> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst containerPath = toContainerPath(hostPackagePath);\n\t\t\t\tif (containerPath === null) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\tcause: new Error(\n\t\t\t\t\t\t\t\t`chain-build-container: host path ${hostPackagePath} escapes appDir bind (${spec.appDir}); ` +\n\t\t\t\t\t\t\t\t\t`caller MUST fall back to docker run --rm`,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\t// The package's container path = `/workspace/<basename>`.\n\t\t\t\t// containerInnerScript copies that subdir into an in-container\n\t\t\t\t// scratch dir and scrubs + builds THERE, so the bind-mounted\n\t\t\t\t// appDir source (`spec.appDir` at `/workspace`) is never\n\t\t\t\t// rewritten by the build.\n\t\t\t\tconst pkgName = containerPath.replace(/^\\/workspace\\//, '').replace(/^\\/+|\\/+$/g, '');\n\t\t\t\tconst inner = containerInnerScript(pkgName);\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* acquireStackLock(moveBuildLockPath, MOVE_BUILD_LOCK_TIMEOUT_MS).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): SuiCliError =>\n\t\t\t\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\t\t\t\tcause: new Error(`move-build lock acquire failed: ${cause._tag}`, { cause }),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* runtime.exec(handle, ['sh', '-c', inner]).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): SuiCliError =>\n\t\t\t\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\t\t\t\tcause: new Error(`runtime.exec failed: ${cause.reason}: ${cause.detail}`),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn result;\n\t\t\t});\n\n\t\tconst runBuild = (hostPackagePath: string) => runInContainer('build', hostPackagePath);\n\t\tconst runSummary = (hostPackagePath: string) => runInContainer('summary', hostPackagePath);\n\n\t\treturn { handle, toContainerPath, runBuild, runSummary };\n\t}).pipe(\n\t\tEffect.mapError((cause) =>\n\t\t\tisContainerRuntimeError(cause)\n\t\t\t\t? cause\n\t\t\t\t: suiPluginError('image-build', 'chain-build-container.acquire failed', cause),\n\t\t),\n\t);\n\nconst isContainerRuntimeError = (e: unknown): e is ContainerRuntimeError =>\n\ttypeof e === 'object' && e !== null && (e as { _tag?: string })._tag === 'ContainerRuntimeError';\n"],"mappings":";;;;;;;;AA8C0C;CACzC;CACA;CACA;CACA;CACA,CAAC,KAAK,IAAI"}
+{"version":3,"file":"chain-build-container.mjs","names":[],"sources":["../../../src/plugins/sui/chain-build-container.ts"],"sourcesContent":["// Per-app long-lived Move build container.\n//\n// Architecture Decision §5: the build container is PER-APP, NOT\n// per-stack. Two parallel stacks of the same app share the same\n// sleeper container — their concurrent Move builds serialise on\n// docker exec queueing. This is intentional: dep-cache reuse\n// across stacks outweighs the serialisation cost.\n//\n// Adopt-or-create state machine is delegated to the substrate's\n// `ContainerRuntime.ensureContainer` with `recreate: 'never'` —\n// daemon outages must fail loudly, not silently churn (distilled\n// doc S6: \"MUST reject the helper's auto-recreate-on-resume-failed\n// path\").\n//\n// Cross-process safety: the host-wide advisory lock is owned by\n// THIS module. The lock is held inside the build call (NOT at the\n// docker-exec layer), because three distinct execution paths (host\n// CLI, fresh `docker run --rm`, container exec) all need\n// protection. Lock path: `~/.devstack/locks/sui-move-build-<repoHash>.lock`.\n\nimport { createHash } from 'node:crypto';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tContainerRuntimeError,\n\tEnsureContainerSpec,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport { acquireStackLock } from '../../substrate/runtime/cross-process/stack-lock.ts';\nimport {\n\tensureManagedContainer,\n\tPER_APP_SHARED_STACK,\n} from '../../substrate/runtime/managed-container.ts';\nimport { containerInnerScript } from './move/index.ts';\nimport { suiCliError, suiPluginError, type SuiCliError, type SuiPluginError } from './errors.ts';\n\n/** Default move-build lock timeout — five minutes, matching the\n *  distilled-doc invariant. The lock is held during the build\n *  body only; long-running stages never share it. */\nexport const MOVE_BUILD_LOCK_TIMEOUT_MS = 5 * 60_000;\n\nconst BUILD_CONTAINER_STOP_GRACE_SECONDS = 2;\nconst BUILD_CONTAINER_KEEPALIVE_COMMAND = [\n\t'child=;',\n\t'trap \\'[ -z \"$child\" ] || kill \"$child\" 2>/dev/null || true; exit 0\\' INT TERM;',\n\t'sleep infinity & child=$!;',\n\t'wait \"$child\"',\n].join(' ');\n\n/** Per-app container name. The substrate's `pluginKey('sui-build')`\n *  + the app discriminator combine to a stable name; the container\n *  intentionally omits the stack/network suffix so two stacks of\n *  the same app share. */\nexport const containerNameForApp = (app: string): string => `devstack-${app}-build`;\n\nconst expandHome = (path: string): string =>\n\tpath === '~' ? homedir() : path.startsWith('~/') ? join(homedir(), path.slice(2)) : path;\n\nconst repoHashForLock = (appDir: string): string =>\n\tcreateHash('sha256').update(resolve(appDir)).digest('hex').slice(0, 16);\n\nexport const moveBuildLockPathFor = (appDir: string, moveHome: string): string => {\n\tconst moveHomeRoot = dirname(resolve(expandHome(moveHome)));\n\treturn join(moveHomeRoot, '.devstack', 'locks', `sui-move-build-${repoHashForLock(appDir)}.lock`);\n};\n\n/** Build-container handle returned to plugin internals (the\n *  cli-driver dispatches into this). */\nexport interface ChainBuildContainer {\n\treadonly handle: ContainerHandle;\n\t/** Translate a host-absolute path into a container-bind path.\n\t *  Returns null when the host path escapes the bind-mounted app\n\t *  dir — callers MUST fall back to `docker run --rm` in that\n\t *  case (distilled-doc: \"Build container path translation MUST\n\t *  refuse paths outside the bind-mounted app dir\"). */\n\treadonly toContainerPath: (hostPath: string) => string | null;\n\t/** Run a sui-cli capture inside the container. Acquires the\n\t *  host-wide move-build lock before invoking docker-exec. */\n\treadonly runBuild: (\n\t\thostPackagePath: string,\n\t) => Effect.Effect<\n\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\tSuiCliError,\n\t\tScope.Scope\n\t>;\n\t/** Run a codegen-style \"summary\" build inside the container.\n\t *  Same wire shape as runBuild; the codegen plugin consumes\n\t *  this via the cross-service seam. */\n\treadonly runSummary: (\n\t\thostPackagePath: string,\n\t) => Effect.Effect<\n\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\tSuiCliError,\n\t\tScope.Scope\n\t>;\n}\n\n/** Spec passed to `ContainerRuntime.ensureContainer` for the\n *  per-app sleeper. Image is content-hashed; labels carry the\n *  app discriminator so `inspectByLabels` finds it across stacks. */\nexport interface ChainBuildContainerSpec {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly appDir: string;\n\treadonly moveHome: string;\n\treadonly image: ImageRef;\n}\n\n/**\n * Acquire (or adopt) the per-app build container. Returns a\n * `ChainBuildContainer` handle scoped to the caller's Scope.\n *\n * The build call holds the host-wide move-build lock for the docker\n * exec body. The lock uses the substrate's PID + start-time stale\n * holder reclaim path, so a crashed peer cannot wedge future builds.\n */\nexport const acquireChainBuildContainer = (\n\truntime: ContainerRuntime,\n\tspec: ChainBuildContainerSpec,\n): Effect.Effect<ChainBuildContainer, ContainerRuntimeError | SuiPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// The sleeper shell traps Docker's stop signal so scope-close\n\t\t// does not wait for Docker's default SIGKILL escalation path.\n\t\t// This also overrides the sui image's default `start\n\t\t// --with-faucet=...` entrypoint so the validator binary doesn't\n\t\t// run genesis inside a build container.\n\t\t// The appDir is bind-mounted at `/workspace`, with the user's\n\t\t// `~/.move` bind-mounted at `/root/.move` so the content-addressed\n\t\t// dep cache (`~/.move/git/<repo>@<sha>/…`) persists across builds.\n\t\tconst ensureSpec: EnsureContainerSpec = {\n\t\t\tname: containerNameForApp(spec.app),\n\t\t\timage: spec.image,\n\t\t\tlabels: {\n\t\t\t\tapp: spec.app,\n\t\t\t\t// Intentionally pin stack to a sentinel — see comment\n\t\t\t\t// above; this is per-app, not per-stack.\n\t\t\t\tstack: PER_APP_SHARED_STACK,\n\t\t\t\tplugin: 'sui',\n\t\t\t\trole: 'build',\n\t\t\t},\n\t\t\trecreate: 'never',\n\t\t\tentrypoint: 'sh',\n\t\t\tcommand: ['-c', BUILD_CONTAINER_KEEPALIVE_COMMAND],\n\t\t\tstopGraceSeconds: BUILD_CONTAINER_STOP_GRACE_SECONDS,\n\t\t\tmounts: [\n\t\t\t\t{ source: spec.appDir, target: '/workspace' },\n\t\t\t\t{ source: spec.moveHome, target: '/root/.move' },\n\t\t\t],\n\t\t};\n\t\tconst { labels, ...containerSpec } = ensureSpec;\n\t\tconst handle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tlabels,\n\t\t\tspec: containerSpec,\n\t\t\tmapError: (cause) => cause,\n\t\t});\n\n\t\tconst toContainerPath = (hostPath: string): string | null => {\n\t\t\t// The runtime adapter bind-mounts `spec.appDir` at\n\t\t\t// `/workspace`. A host path outside that bind is not\n\t\t\t// accessible to the container.\n\t\t\tif (!hostPath.startsWith(spec.appDir)) return null;\n\t\t\tconst rel = hostPath.slice(spec.appDir.length).replace(/^\\/+/, '');\n\t\t\treturn rel === '' ? '/workspace' : `/workspace/${rel}`;\n\t\t};\n\t\tconst moveBuildLockPath = moveBuildLockPathFor(spec.appDir, spec.moveHome);\n\n\t\tconst runInContainer = (\n\t\t\top: 'build' | 'summary',\n\t\t\thostPackagePath: string,\n\t\t): Effect.Effect<\n\t\t\t{ readonly exitCode: number; readonly stdout: string; readonly stderr: string },\n\t\t\tSuiCliError,\n\t\t\tScope.Scope\n\t\t> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst containerPath = toContainerPath(hostPackagePath);\n\t\t\t\tif (containerPath === null) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\tcause: new Error(\n\t\t\t\t\t\t\t\t`chain-build-container: host path ${hostPackagePath} escapes appDir bind (${spec.appDir}); ` +\n\t\t\t\t\t\t\t\t\t`caller MUST fall back to docker run --rm`,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\t// The package's container path = `/workspace/<basename>`.\n\t\t\t\t// containerInnerScript copies that subdir into an in-container\n\t\t\t\t// scratch dir and scrubs + builds THERE, so the bind-mounted\n\t\t\t\t// appDir source (`spec.appDir` at `/workspace`) is never\n\t\t\t\t// rewritten by the build.\n\t\t\t\tconst pkgName = containerPath.replace(/^\\/workspace\\//, '').replace(/^\\/+|\\/+$/g, '');\n\t\t\t\tconst inner = containerInnerScript(pkgName);\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* acquireStackLock(moveBuildLockPath, MOVE_BUILD_LOCK_TIMEOUT_MS).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): SuiCliError =>\n\t\t\t\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\t\t\t\tcause: new Error(`move-build lock acquire failed: ${cause._tag}`, { cause }),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* runtime.exec(handle, ['sh', '-c', inner]).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): SuiCliError =>\n\t\t\t\t\t\t\t\t\tsuiCliError(op, {\n\t\t\t\t\t\t\t\t\t\tcause: new Error(`runtime.exec failed: ${cause.reason}: ${cause.detail}`),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn result;\n\t\t\t});\n\n\t\tconst runBuild = (hostPackagePath: string) => runInContainer('build', hostPackagePath);\n\t\tconst runSummary = (hostPackagePath: string) => runInContainer('summary', hostPackagePath);\n\n\t\treturn { handle, toContainerPath, runBuild, runSummary };\n\t}).pipe(\n\t\tEffect.mapError((cause) =>\n\t\t\tisContainerRuntimeError(cause)\n\t\t\t\t? cause\n\t\t\t\t: suiPluginError('image-build', 'chain-build-container.acquire failed', cause),\n\t\t),\n\t);\n\nconst isContainerRuntimeError = (e: unknown): e is ContainerRuntimeError =>\n\ttypeof e === 'object' && e !== null && (e as { _tag?: string })._tag === 'ContainerRuntimeError';\n"],"mappings":";;;;;;;;AA8C0C;CACzC;CACA;CACA;CACA;AACD,CAAC,CAAC,KAAK,GAAG"}

package/dist/plugins/sui/chain-probe.mjs

@@ -6,13 +6,13 @@ import { Effect } from "effect";
 *  chain id. The result implements the contract's `ChainProbe<Key>`
 *  shape; the Sui plugin emits this via a StrategyContributorDecl
 *  keyed by `chain-probe:<chainId>`. */
-const makeSuiChainProbe = (sdk, chain) => ({ get: (key, schema, mode) => Effect.gen(function* () {
+const makeSuiChainProbe = (sdk, chainId) => ({ get: (key, schema, mode) => Effect.gen(function* () {
 	const raw = yield* Effect.tryPromise({
 		try: () => key.kind === "object" ? sdk.core.getObject({ objectId: key.objectId }) : sdk.core.getTransaction({ digest: key.digest }),
 		catch: (cause) => ({
 			_tag: "ChainProbeError",
 			reason: isNotFound(cause) ? "not-found" : "transient",
-			chain,
+			chainId,
 			detail: formatUnknownError(cause)
 		})
 	}).pipe(Effect.catch((err) => mode === "lenient" && (err.reason === "not-found" || err.reason === "transient") ? Effect.succeed(null) : Effect.fail(err)));
@@ -20,11 +20,11 @@ const makeSuiChainProbe = (sdk, chain) => ({ get: (key, schema, mode) => Effect.
 	const payload = projectProbePayload(key, raw);
 	if (payload === null) return null;
 	return yield* decodeUnknown(schema, payload, {
-		source: `chain probe ${chain}`,
+		source: `chain probe ${chainId}`,
 		mkError: (issue) => ({
 			_tag: "ChainProbeError",
 			reason: "decode-failed",
-			chain,
+			chainId,
 			detail: formatUnknownError(issue.cause ?? issue)
 		})
 	});

package/dist/plugins/sui/chain-probe.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"chain-probe.mjs","names":[],"sources":["../../../src/plugins/sui/chain-probe.ts"],"sourcesContent":["// Sui plugin — ChainProbe capability implementation.\n//\n// Architecture §9: ChainProbe is a contract, NOT a primitive. Sui\n// provides the only in-tree implementation; the substrate dispatches\n// to it via the StrategyContributor registry under\n// `chain-probe:<chainId>`.\n//\n// Lenient mode: returns null for both \"not found\" AND transient RPC\n// failure — verify pipelines re-derive on the next cycle rather than\n// fail boot. Strict mode: distinguishes via tagged error.\n//\n// Why lenient is the default in this plugin's wiring: artifact publisher verify is\n// the dominant consumer; artifact publisher's lenient-retry profile (15 attempts,\n// 90s budget) is calibrated against lenient semantics. A strict\n// surface exists for explicit \"I want to know if the chain is\n// reachable\" callers (the doctor command, debugging).\n\nimport { Effect } from 'effect';\nimport type { ClientWithCoreApi } from '@mysten/sui/client';\n\nimport type {\n\tChainProbe,\n\tChainProbeError,\n\tChainProbeMode,\n\tChainProbeSchema,\n} from '../../contracts/chain-probe.ts';\nimport { decodeUnknown } from '../../substrate/runtime/runtime-decode.ts';\nimport { formatUnknownError } from '../../substrate/runtime/format-unknown-error.ts';\n\n/**\n * Sui's chain-key shape — discriminated so the probe can dispatch\n * between object reads, tx reads, and the (forthcoming) batch\n * variant on one method.\n */\nexport type SuiProbeKey =\n\t| { readonly kind: 'object'; readonly objectId: string }\n\t| { readonly kind: 'transaction'; readonly digest: string };\n\n// Note: this probe decodes against the CALLER-supplied `schema`\n// argument (see `makeSuiChainProbe`), never a local literal. Earlier\n// revisions also exported `SuiObjectShapeSchema` /\n// `SuiGetObjectResponseSchema` to \"document the SDK shape\", but they\n// had zero consumers (the contract's `ChainProbeSchema<Shape>` is what\n// validates), so per STYLE_GUIDE §5 (no orphan exports) they were\n// removed. Re-add a concrete object schema only if a caller actually\n// decodes through it.\n\n/** Plugin-internal SDK shim — the type the plugin's acquire body\n *  hands to the probe factory + the account's sign/execute closure.\n *  Kept narrow so we don't pull `@mysten/sui` types into the substrate.\n *\n *  Exposes the four surfaces consumers actually use:\n *\n *    - `getObject` / `getTransaction` — the lenient chain probe.\n *    - `executeTransaction` — the account plugin's submit path\n *      (txBytes + caller-signed signatures).\n *    - `waitForTransaction` — post-submit finality wait.\n *\n *  Plus an OPAQUE `client` field — the underlying `SuiGrpcClient`\n *  reference. The package plugin's publish-tx builder hands this to\n *  `Transaction.build({ client })` (the SDK resolves gas + object\n *  versions through it). We type as `unknown` so the substrate stays\n *  free of a direct `@mysten/sui/client` type import; the consumer\n *  casts at the boundary (mirrors the same opacity decision in the\n *  Coin plugin's `MintSdkShim.client`). */\nexport interface SuiSdkShim {\n\treadonly core: {\n\t\treadonly getObject: (args: {\n\t\t\treadonly objectId: string;\n\t\t\treadonly include?: {\n\t\t\t\treadonly content?: boolean;\n\t\t\t\treadonly json?: boolean;\n\t\t\t};\n\t\t}) => Promise<unknown>;\n\t\treadonly getTransaction: (args: { readonly digest: string }) => Promise<unknown>;\n\t\treadonly getBalance: (args: {\n\t\t\treadonly owner: string;\n\t\t\treadonly coinType?: string;\n\t\t}) => Promise<unknown>;\n\t\treadonly listCoins: (args: {\n\t\t\treadonly owner: string;\n\t\t\treadonly coinType?: string;\n\t\t\treadonly limit?: number;\n\t\t\treadonly cursor?: string | null;\n\t\t}) => Promise<{\n\t\t\treadonly objects: ReadonlyArray<{\n\t\t\t\treadonly objectId: string;\n\t\t\t\treadonly version: string;\n\t\t\t\treadonly digest: string;\n\t\t\t\treadonly balance: string;\n\t\t\t}>;\n\t\t\treadonly hasNextPage: boolean;\n\t\t\treadonly cursor: string | null;\n\t\t}>;\n\t\treadonly executeTransaction: (args: {\n\t\t\treadonly transaction: Uint8Array;\n\t\t\treadonly signatures: ReadonlyArray<string>;\n\t\t\treadonly include?: {\n\t\t\t\treadonly effects?: boolean;\n\t\t\t\treadonly objectTypes?: boolean;\n\t\t\t};\n\t\t}) => Promise<unknown>;\n\t\treadonly waitForTransaction: (args: {\n\t\t\treadonly digest: string;\n\t\t\treadonly timeout?: number;\n\t\t}) => Promise<unknown>;\n\t};\n\t/** Client reference for `Transaction.build({ client })` and every\n\t *  `client.core.*` call. The Sui barrel wires the resolved\n\t *  `SuiGrpcClient` through; consumers cast no further. */\n\treadonly client: ClientWithCoreApi;\n}\n\n/** Construct the chain-probe instance for a resolved Sui client +\n *  chain id. The result implements the contract's `ChainProbe<Key>`\n *  shape; the Sui plugin emits this via a StrategyContributorDecl\n *  keyed by `chain-probe:<chainId>`. */\nexport const makeSuiChainProbe = (sdk: SuiSdkShim, chain: string): ChainProbe<SuiProbeKey> => ({\n\tget: <Shape>(\n\t\tkey: SuiProbeKey,\n\t\tschema: ChainProbeSchema<Shape>,\n\t\tmode: ChainProbeMode,\n\t): Effect.Effect<Shape | null, ChainProbeError> =>\n\t\tEffect.gen(function* () {\n\t\t\tconst raw: unknown = yield* Effect.tryPromise({\n\t\t\t\ttry: () =>\n\t\t\t\t\tkey.kind === 'object'\n\t\t\t\t\t\t? sdk.core.getObject({ objectId: key.objectId })\n\t\t\t\t\t\t: sdk.core.getTransaction({ digest: key.digest }),\n\t\t\t\tcatch: (cause): ChainProbeError => ({\n\t\t\t\t\t_tag: 'ChainProbeError',\n\t\t\t\t\treason: isNotFound(cause) ? 'not-found' : 'transient',\n\t\t\t\t\tchain,\n\t\t\t\t\tdetail: formatUnknownError(cause),\n\t\t\t\t}),\n\t\t\t}).pipe(\n\t\t\t\t// Lenient mode coerces both not-found and transient into a\n\t\t\t\t// null result. Strict mode lets the error propagate.\n\t\t\t\tEffect.catch(\n\t\t\t\t\t(err): Effect.Effect<unknown, ChainProbeError> =>\n\t\t\t\t\t\tmode === 'lenient' && (err.reason === 'not-found' || err.reason === 'transient')\n\t\t\t\t\t\t\t? Effect.succeed(null)\n\t\t\t\t\t\t\t: Effect.fail(err),\n\t\t\t\t),\n\t\t\t);\n\t\t\tif (raw === null) return null;\n\t\t\tconst payload = projectProbePayload(key, raw);\n\t\t\tif (payload === null) return null;\n\n\t\t\t// Decode against the caller-supplied Schema. A decode failure\n\t\t\t// is structured (NOT silent undefined) — this is the\n\t\t\t// load-bearing learning from deepbook.\n\t\t\tconst decoded = yield* decodeUnknown(schema, payload, {\n\t\t\t\tsource: `chain probe ${chain}`,\n\t\t\t\tmkError: (issue): ChainProbeError => ({\n\t\t\t\t\t_tag: 'ChainProbeError',\n\t\t\t\t\treason: 'decode-failed',\n\t\t\t\t\tchain,\n\t\t\t\t\tdetail: formatUnknownError(issue.cause ?? issue),\n\t\t\t\t}),\n\t\t\t});\n\t\t\treturn decoded;\n\t\t}),\n});\n\nconst projectProbePayload = (key: SuiProbeKey, raw: unknown): unknown | null => {\n\tif (key.kind === 'transaction') return projectTransactionPayload(raw);\n\tif (typeof raw !== 'object' || raw === null || !('object' in raw)) return raw;\n\n\treturn (raw as { readonly object?: unknown }).object ?? null;\n};\n\nconst projectTransactionPayload = (raw: unknown): unknown | null => {\n\tif (typeof raw !== 'object' || raw === null) return raw;\n\tconst envelope = raw as {\n\t\treadonly $kind?: 'Transaction' | 'FailedTransaction';\n\t\treadonly Transaction?: unknown;\n\t\treadonly FailedTransaction?: unknown;\n\t};\n\tif (envelope.$kind === 'Transaction') return envelope.Transaction ?? null;\n\tif (envelope.$kind === 'FailedTransaction') return envelope.FailedTransaction ?? null;\n\treturn raw;\n};\n\n/** Heuristic: SDK errors carrying object/transaction-shape \"not found\"\n *  markers are treated as terminal not-found; everything else is\n *  transient. The substrate's lenient-retry profile re-runs the probe\n *  on a transient bucket; not-found is terminal.\n *\n *  Limitation: `@mysten/sui` does NOT surface a structured status code\n *  on its SDK errors — the substrate only sees an `Error` message. We\n *  therefore narrow the substring matches as much as possible to avoid\n *  misclassifying network-layer \"endpoint does not exist\" or generic\n *  \"not found\" prose as terminal:\n *\n *  - We require the matched phrase to refer to the OBJECT or\n *    TRANSACTION rather than the endpoint. Concretely we look for the\n *    SDK's canonical \"object not found\" / \"object does not exist\" /\n *    \"no such object\" wording and the equivalent \"transaction not\n *    found\" / \"transaction does not exist\" wording.\n *  - We DO NOT match the bare substring \"not found\" alone (that\n *    catches \"endpoint does not exist\", DNS prose, etc. — all of\n *    which are network-layer transients).\n *\n *  If `@mysten/sui` surfaces a structured error class with an\n *  `httpStatus` (or equivalent) in the future, swap this for an\n *  exact 404 / -32000 check. */\nconst isNotFound = (cause: unknown): boolean => {\n\tconst msg = (cause as { message?: string })?.message?.toLowerCase() ?? '';\n\treturn (\n\t\t// SDK-side `getObject` / `getTransaction` not-found markers.\n\t\t/\\bobject\\b.*\\bnot found\\b/u.test(msg) ||\n\t\t/\\bobject\\b.*\\bdoes not exist\\b/u.test(msg) ||\n\t\t/\\bno such object\\b/u.test(msg) ||\n\t\t// SDK-side `getTransaction` not-found markers — terminal for\n\t\t// this probe (the queried digest will never materialise).\n\t\t/\\btransaction\\b.*\\bnot found\\b/u.test(msg) ||\n\t\t/\\btransaction\\b.*\\bdoes not exist\\b/u.test(msg)\n\t);\n};\n"],"mappings":";;;;;;;;AAqHA,MAAa,qBAAqB,KAAiB,WAA4C,EAC9F,MACC,KACA,QACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAe,OAAO,OAAO,WAAW;EAC7C,WACC,IAAI,SAAS,WACV,IAAI,KAAK,UAAU,EAAE,UAAU,IAAI,UAAU,CAAC,GAC9C,IAAI,KAAK,eAAe,EAAE,QAAQ,IAAI,QAAQ,CAAC;EACnD,QAAQ,WAA4B;GACnC,MAAM;GACN,QAAQ,WAAW,MAAM,GAAG,cAAc;GAC1C;GACA,QAAQ,mBAAmB,MAAM;GACjC;EACD,CAAC,CAAC,KAGF,OAAO,OACL,QACA,SAAS,cAAc,IAAI,WAAW,eAAe,IAAI,WAAW,eACjE,OAAO,QAAQ,KAAK,GACpB,OAAO,KAAK,IAAI,CACpB,CACD;AACD,KAAI,QAAQ,KAAM,QAAO;CACzB,MAAM,UAAU,oBAAoB,KAAK,IAAI;AAC7C,KAAI,YAAY,KAAM,QAAO;AAc7B,QAAO,OATgB,cAAc,QAAQ,SAAS;EACrD,QAAQ,eAAe;EACvB,UAAU,WAA4B;GACrC,MAAM;GACN,QAAQ;GACR;GACA,QAAQ,mBAAmB,MAAM,SAAS,MAAM;GAChD;EACD,CAAC;EAED,EACH;AAED,MAAM,uBAAuB,KAAkB,QAAiC;AAC/E,KAAI,IAAI,SAAS,cAAe,QAAO,0BAA0B,IAAI;AACrE,KAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,EAAE,YAAY,KAAM,QAAO;AAE1E,QAAQ,IAAsC,UAAU;;AAGzD,MAAM,6BAA6B,QAAiC;AACnE,KAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;CACpD,MAAM,WAAW;AAKjB,KAAI,SAAS,UAAU,cAAe,QAAO,SAAS,eAAe;AACrE,KAAI,SAAS,UAAU,oBAAqB,QAAO,SAAS,qBAAqB;AACjF,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;AA0BR,MAAM,cAAc,UAA4B;CAC/C,MAAM,MAAO,OAAgC,SAAS,aAAa,IAAI;AACvE,QAEC,6BAA6B,KAAK,IAAI,IACtC,kCAAkC,KAAK,IAAI,IAC3C,sBAAsB,KAAK,IAAI,IAG/B,kCAAkC,KAAK,IAAI,IAC3C,uCAAuC,KAAK,IAAI"}
+{"version":3,"file":"chain-probe.mjs","names":[],"sources":["../../../src/plugins/sui/chain-probe.ts"],"sourcesContent":["// Sui plugin — ChainProbe capability implementation.\n//\n// Architecture §9: ChainProbe is a contract, NOT a primitive. Sui\n// provides the only in-tree implementation; the substrate dispatches\n// to it via the StrategyContributor registry under\n// `chain-probe:<chainId>`.\n//\n// Lenient mode: returns null for both \"not found\" AND transient RPC\n// failure — verify pipelines re-derive on the next cycle rather than\n// fail boot. Strict mode: distinguishes via tagged error.\n//\n// Why lenient is the default in this plugin's wiring: artifact publisher verify is\n// the dominant consumer; artifact publisher's lenient-retry profile (15 attempts,\n// 90s budget) is calibrated against lenient semantics. A strict\n// surface exists for explicit \"I want to know if the chain is\n// reachable\" callers (the doctor command, debugging).\n\nimport { Effect } from 'effect';\nimport type { ClientWithCoreApi } from '@mysten/sui/client';\n\nimport type {\n\tChainProbe,\n\tChainProbeError,\n\tChainProbeMode,\n\tChainProbeSchema,\n} from '../../contracts/chain-probe.ts';\nimport { decodeUnknown } from '../../substrate/runtime/runtime-decode.ts';\nimport { formatUnknownError } from '../../substrate/runtime/format-unknown-error.ts';\n\n/**\n * Sui's chain-key shape — discriminated so the probe can dispatch\n * between object reads, tx reads, and the (forthcoming) batch\n * variant on one method.\n */\nexport type SuiProbeKey =\n\t| { readonly kind: 'object'; readonly objectId: string }\n\t| { readonly kind: 'transaction'; readonly digest: string };\n\n// Note: this probe decodes against the CALLER-supplied `schema`\n// argument (see `makeSuiChainProbe`), never a local literal. Earlier\n// revisions also exported `SuiObjectShapeSchema` /\n// `SuiGetObjectResponseSchema` to \"document the SDK shape\", but they\n// had zero consumers (the contract's `ChainProbeSchema<Shape>` is what\n// validates), so per STYLE_GUIDE §5 (no orphan exports) they were\n// removed. Re-add a concrete object schema only if a caller actually\n// decodes through it.\n\n/** Plugin-internal SDK shim — the type the plugin's acquire body\n *  hands to the probe factory + the account's sign/execute closure.\n *  Kept narrow so we don't pull `@mysten/sui` types into the substrate.\n *\n *  Exposes the four surfaces consumers actually use:\n *\n *    - `getObject` / `getTransaction` — the lenient chain probe.\n *    - `executeTransaction` — the account plugin's submit path\n *      (txBytes + caller-signed signatures).\n *    - `waitForTransaction` — post-submit finality wait.\n *\n *  Plus an OPAQUE `client` field — the underlying `SuiGrpcClient`\n *  reference. The package plugin's publish-tx builder hands this to\n *  `Transaction.build({ client })` (the SDK resolves gas + object\n *  versions through it). We type as `unknown` so the substrate stays\n *  free of a direct `@mysten/sui/client` type import; the consumer\n *  casts at the boundary (mirrors the same opacity decision in the\n *  Coin plugin's `MintSdkShim.client`). */\nexport interface SuiSdkShim {\n\treadonly core: {\n\t\treadonly getObject: (args: {\n\t\t\treadonly objectId: string;\n\t\t\treadonly include?: {\n\t\t\t\treadonly content?: boolean;\n\t\t\t\treadonly json?: boolean;\n\t\t\t};\n\t\t}) => Promise<unknown>;\n\t\treadonly getTransaction: (args: { readonly digest: string }) => Promise<unknown>;\n\t\treadonly getBalance: (args: {\n\t\t\treadonly owner: string;\n\t\t\treadonly coinType?: string;\n\t\t}) => Promise<unknown>;\n\t\treadonly listCoins: (args: {\n\t\t\treadonly owner: string;\n\t\t\treadonly coinType?: string;\n\t\t\treadonly limit?: number;\n\t\t\treadonly cursor?: string | null;\n\t\t}) => Promise<{\n\t\t\treadonly objects: ReadonlyArray<{\n\t\t\t\treadonly objectId: string;\n\t\t\t\treadonly version: string;\n\t\t\t\treadonly digest: string;\n\t\t\t\treadonly balance: string;\n\t\t\t}>;\n\t\t\treadonly hasNextPage: boolean;\n\t\t\treadonly cursor: string | null;\n\t\t}>;\n\t\treadonly executeTransaction: (args: {\n\t\t\treadonly transaction: Uint8Array;\n\t\t\treadonly signatures: ReadonlyArray<string>;\n\t\t\treadonly include?: {\n\t\t\t\treadonly effects?: boolean;\n\t\t\t\treadonly objectTypes?: boolean;\n\t\t\t};\n\t\t}) => Promise<unknown>;\n\t\treadonly waitForTransaction: (args: {\n\t\t\treadonly digest: string;\n\t\t\treadonly timeout?: number;\n\t\t}) => Promise<unknown>;\n\t};\n\t/** Client reference for `Transaction.build({ client })` and every\n\t *  `client.core.*` call. The Sui barrel wires the resolved\n\t *  `SuiGrpcClient` through; consumers cast no further. */\n\treadonly client: ClientWithCoreApi;\n}\n\n/** Construct the chain-probe instance for a resolved Sui client +\n *  chain id. The result implements the contract's `ChainProbe<Key>`\n *  shape; the Sui plugin emits this via a StrategyContributorDecl\n *  keyed by `chain-probe:<chainId>`. */\nexport const makeSuiChainProbe = (sdk: SuiSdkShim, chainId: string): ChainProbe<SuiProbeKey> => ({\n\tget: <Shape>(\n\t\tkey: SuiProbeKey,\n\t\tschema: ChainProbeSchema<Shape>,\n\t\tmode: ChainProbeMode,\n\t): Effect.Effect<Shape | null, ChainProbeError> =>\n\t\tEffect.gen(function* () {\n\t\t\tconst raw: unknown = yield* Effect.tryPromise({\n\t\t\t\ttry: () =>\n\t\t\t\t\tkey.kind === 'object'\n\t\t\t\t\t\t? sdk.core.getObject({ objectId: key.objectId })\n\t\t\t\t\t\t: sdk.core.getTransaction({ digest: key.digest }),\n\t\t\t\tcatch: (cause): ChainProbeError => ({\n\t\t\t\t\t_tag: 'ChainProbeError',\n\t\t\t\t\treason: isNotFound(cause) ? 'not-found' : 'transient',\n\t\t\t\t\tchainId,\n\t\t\t\t\tdetail: formatUnknownError(cause),\n\t\t\t\t}),\n\t\t\t}).pipe(\n\t\t\t\t// Lenient mode coerces both not-found and transient into a\n\t\t\t\t// null result. Strict mode lets the error propagate.\n\t\t\t\tEffect.catch(\n\t\t\t\t\t(err): Effect.Effect<unknown, ChainProbeError> =>\n\t\t\t\t\t\tmode === 'lenient' && (err.reason === 'not-found' || err.reason === 'transient')\n\t\t\t\t\t\t\t? Effect.succeed(null)\n\t\t\t\t\t\t\t: Effect.fail(err),\n\t\t\t\t),\n\t\t\t);\n\t\t\tif (raw === null) return null;\n\t\t\tconst payload = projectProbePayload(key, raw);\n\t\t\tif (payload === null) return null;\n\n\t\t\t// Decode against the caller-supplied Schema. A decode failure\n\t\t\t// is structured (NOT silent undefined) — this is the\n\t\t\t// load-bearing learning from deepbook.\n\t\t\tconst decoded = yield* decodeUnknown(schema, payload, {\n\t\t\t\tsource: `chain probe ${chainId}`,\n\t\t\t\tmkError: (issue): ChainProbeError => ({\n\t\t\t\t\t_tag: 'ChainProbeError',\n\t\t\t\t\treason: 'decode-failed',\n\t\t\t\t\tchainId,\n\t\t\t\t\tdetail: formatUnknownError(issue.cause ?? issue),\n\t\t\t\t}),\n\t\t\t});\n\t\t\treturn decoded;\n\t\t}),\n});\n\nconst projectProbePayload = (key: SuiProbeKey, raw: unknown): unknown | null => {\n\tif (key.kind === 'transaction') return projectTransactionPayload(raw);\n\tif (typeof raw !== 'object' || raw === null || !('object' in raw)) return raw;\n\n\treturn (raw as { readonly object?: unknown }).object ?? null;\n};\n\nconst projectTransactionPayload = (raw: unknown): unknown | null => {\n\tif (typeof raw !== 'object' || raw === null) return raw;\n\tconst envelope = raw as {\n\t\treadonly $kind?: 'Transaction' | 'FailedTransaction';\n\t\treadonly Transaction?: unknown;\n\t\treadonly FailedTransaction?: unknown;\n\t};\n\tif (envelope.$kind === 'Transaction') return envelope.Transaction ?? null;\n\tif (envelope.$kind === 'FailedTransaction') return envelope.FailedTransaction ?? null;\n\treturn raw;\n};\n\n/** Heuristic: SDK errors carrying object/transaction-shape \"not found\"\n *  markers are treated as terminal not-found; everything else is\n *  transient. The substrate's lenient-retry profile re-runs the probe\n *  on a transient bucket; not-found is terminal.\n *\n *  Limitation: `@mysten/sui` does NOT surface a structured status code\n *  on its SDK errors — the substrate only sees an `Error` message. We\n *  therefore narrow the substring matches as much as possible to avoid\n *  misclassifying network-layer \"endpoint does not exist\" or generic\n *  \"not found\" prose as terminal:\n *\n *  - We require the matched phrase to refer to the OBJECT or\n *    TRANSACTION rather than the endpoint. Concretely we look for the\n *    SDK's canonical \"object not found\" / \"object does not exist\" /\n *    \"no such object\" wording and the equivalent \"transaction not\n *    found\" / \"transaction does not exist\" wording.\n *  - We DO NOT match the bare substring \"not found\" alone (that\n *    catches \"endpoint does not exist\", DNS prose, etc. — all of\n *    which are network-layer transients).\n *\n *  If `@mysten/sui` surfaces a structured error class with an\n *  `httpStatus` (or equivalent) in the future, swap this for an\n *  exact 404 / -32000 check. */\nconst isNotFound = (cause: unknown): boolean => {\n\tconst msg = (cause as { message?: string })?.message?.toLowerCase() ?? '';\n\treturn (\n\t\t// SDK-side `getObject` / `getTransaction` not-found markers.\n\t\t/\\bobject\\b.*\\bnot found\\b/u.test(msg) ||\n\t\t/\\bobject\\b.*\\bdoes not exist\\b/u.test(msg) ||\n\t\t/\\bno such object\\b/u.test(msg) ||\n\t\t// SDK-side `getTransaction` not-found markers — terminal for\n\t\t// this probe (the queried digest will never materialise).\n\t\t/\\btransaction\\b.*\\bnot found\\b/u.test(msg) ||\n\t\t/\\btransaction\\b.*\\bdoes not exist\\b/u.test(msg)\n\t);\n};\n"],"mappings":";;;;;;;;AAqHA,MAAa,qBAAqB,KAAiB,aAA8C,EAChG,MACC,KACA,QACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAe,OAAO,OAAO,WAAW;EAC7C,WACC,IAAI,SAAS,WACV,IAAI,KAAK,UAAU,EAAE,UAAU,IAAI,SAAS,CAAC,IAC7C,IAAI,KAAK,eAAe,EAAE,QAAQ,IAAI,OAAO,CAAC;EAClD,QAAQ,WAA4B;GACnC,MAAM;GACN,QAAQ,WAAW,KAAK,IAAI,cAAc;GAC1C;GACA,QAAQ,mBAAmB,KAAK;EACjC;CACD,CAAC,CAAC,CAAC,KAGF,OAAO,OACL,QACA,SAAS,cAAc,IAAI,WAAW,eAAe,IAAI,WAAW,eACjE,OAAO,QAAQ,IAAI,IACnB,OAAO,KAAK,GAAG,CACpB,CACD;CACA,IAAI,QAAQ,MAAM,OAAO;CACzB,MAAM,UAAU,oBAAoB,KAAK,GAAG;CAC5C,IAAI,YAAY,MAAM,OAAO;CAc7B,OAAO,OATgB,cAAc,QAAQ,SAAS;EACrD,QAAQ,eAAe;EACvB,UAAU,WAA4B;GACrC,MAAM;GACN,QAAQ;GACR;GACA,QAAQ,mBAAmB,MAAM,SAAS,KAAK;EAChD;CACD,CAAC;AAEF,CAAC,EACH;AAEA,MAAM,uBAAuB,KAAkB,QAAiC;CAC/E,IAAI,IAAI,SAAS,eAAe,OAAO,0BAA0B,GAAG;CACpE,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,EAAE,YAAY,MAAM,OAAO;CAE1E,OAAQ,IAAsC,UAAU;AACzD;AAEA,MAAM,6BAA6B,QAAiC;CACnE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,WAAW;CAKjB,IAAI,SAAS,UAAU,eAAe,OAAO,SAAS,eAAe;CACrE,IAAI,SAAS,UAAU,qBAAqB,OAAO,SAAS,qBAAqB;CACjF,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,cAAc,UAA4B;CAC/C,MAAM,MAAO,OAAgC,SAAS,YAAY,KAAK;CACvE,OAEC,6BAA6B,KAAK,GAAG,KACrC,kCAAkC,KAAK,GAAG,KAC1C,sBAAsB,KAAK,GAAG,KAG9B,kCAAkC,KAAK,GAAG,KAC1C,uCAAuC,KAAK,GAAG;AAEjD"}

package/dist/plugins/sui/codegen.d.mts

@@ -1,14 +1,16 @@
 //#region src/plugins/sui/codegen.d.ts
-/** The typed shape the emitted file exports. */
-interface SuiNetworkBindings {
-  readonly chain: string;
+/** The typed shape one `networks.<key>` entry in `config.ts` exports. */
+interface SuiNetworkConfigEntry {
+  /** Genesis-digest chain identifier of the running node (not the network
+   *  name, which is the `networks.<key>` key itself). */
+  readonly chainId: string;
   readonly mode: 'local' | 'local-rpc' | 'live' | 'fork';
-  readonly rpcUrl: string;
-  readonly faucetUrl: string | null;
-  readonly graphqlUrl: string | null;
+  readonly rpc: string;
+  readonly faucet: string | null;
+  readonly graphql: string | null;
   /** Fork-only — upstream identity for known-package lookups. */
   readonly forkUpstream: string | null;
 }
 //#endregion
-export { SuiNetworkBindings };
+export { SuiNetworkConfigEntry };
 //# sourceMappingURL=codegen.d.mts.map

package/dist/plugins/sui/codegen.mjs

@@ -1,52 +1,55 @@
-import { Effect } from "effect";
+import { LOCAL_NETWORK_NAME } from "../../api/inference-network.mjs";
+import { configCodegenable } from "../../contracts/config-bindings.mjs";
 //#region src/plugins/sui/codegen.ts
-/** Aggregate projection: fold the emitted `suiNetwork` shape into
-*  the cross-plugin `services.ts` aggregate at `services.sui`. The
-*  orchestrator stays plugin-name-blind; this projector owns the
-*  `{ rpc, faucet, graphql }` shape decision. */
-const projectSuiNetworkServices = (exported) => {
-	const network = exported["suiNetwork"];
-	if (typeof network !== "object" || network === null) return null;
-	const record = network;
-	const rpcUrl = stringField(record, "rpcUrl");
-	const faucetUrl = stringField(record, "faucetUrl");
-	const graphqlUrl = stringField(record, "graphqlUrl");
-	return { sui: {
-		rpc: { url: rpcUrl ?? "" },
-		faucet: faucetUrl === null ? null : { url: faucetUrl },
-		graphql: graphqlUrl === null ? null : { url: graphqlUrl }
-	} };
-};
-const stringField = (record, key) => {
-	const value = record[key];
-	return typeof value === "string" && value.length > 0 ? value : null;
-};
-/** Construct the Codegenable contribution. Emit is byte-deterministic
-*  on unchanged input (architecture: no mtime churn on no-op
-*  cycles). */
-const makeCodegenable = (resolved) => ({
-	kind: "codegenable",
-	emitterName: "sui-network",
-	outputPath: "sui/network.ts",
-	aggregate: {
+/** The sui-plugin's config bindings, declared ONCE. Both the live boot decl
+*  and the static committed-tree decl are derived from this set:
+*   - `network`  — sugar `resolveNetwork()`  / live = `"localnet"`.
+*   - `networks` — sugar `resolveNetworks()` / live = `{ localnet: entry }`.
+*  The network NAME + connection map are environment/live data, so both are
+*  RESOLVED bindings (never literals). */
+const suiConfigBindings = () => {
+	const entryOf = (r) => ({
+		chainId: r.chainId,
+		mode: r.mode,
+		rpc: r.rpc,
+		faucet: r.faucet ?? null,
+		graphql: r.graphql ?? null,
+		forkUpstream: r.forkUpstream ?? null
+	});
+	return {
+		bucket: "config.ts",
 		kind: "sui-network",
-		bucket: "services.ts",
-		project: projectSuiNetworkServices
-	},
-	emit: (ctx) => Effect.sync(() => {
-		const bindings = {
-			chain: resolved.chain,
-			mode: resolved.mode,
-			rpcUrl: resolved.rpc,
-			faucetUrl: resolved.faucet ?? null,
-			graphqlUrl: resolved.graphql ?? null,
-			forkUpstream: resolved.forkUpstream ?? null
-		};
-		ctx.exportConst("suiNetwork", bindings);
-		return ctx.done();
-	})
+		emitterName: "sui-network",
+		bindings: [{
+			variant: "resolved",
+			configPath: ["network"],
+			namespace: "sui",
+			key: "network",
+			sugar: { kind: "network" },
+			live: () => LOCAL_NETWORK_NAME
+		}, {
+			variant: "resolved",
+			configPath: ["networks"],
+			namespace: "sui",
+			key: "networks",
+			sugar: { kind: "networks" },
+			live: (r) => ({ [LOCAL_NETWORK_NAME]: entryOf(r) })
+		}]
+	};
+};
+/** The LIVE Codegenable contribution. Bakes the resolved network entry into
+*  the combined `config.ts` aggregate (chainId/rpc/faucet/graphql) — boot's
+*  `assembleIdConfig` slices it back into the loadable id-config. */
+const makeCodegenable = (resolved) => configCodegenable(suiConfigBindings(), {
+	mode: "live",
+	state: resolved
 });
+/** The STATIC (stack-free) Codegenable contribution for the `codegen` verb.
+*  Emits `resolveNetwork()` / `resolveNetworks()` raw expressions — the
+*  committed `config.ts` carries no network name and no literal rpc URL. No
+*  id-resolver input needed (the values are injected, not config-derived). */
+const makeStaticCodegen = () => () => [configCodegenable(suiConfigBindings(), "static")];
 //#endregion
-export { makeCodegenable };
+export { makeCodegenable, makeStaticCodegen };
 
 //# sourceMappingURL=codegen.mjs.map

package/dist/plugins/sui/codegen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/sui/codegen.ts"],"sourcesContent":["// Sui plugin — Codegenable contribution.\n//\n// Architecture §6: plugins emit typed `CodegenableDecl`s; the\n// codegen orchestrator stages files into the user's source tree\n// WITHOUT naming the plugin. Sui's contribution is network\n// metadata: the active RPC endpoint, the chain id, and (when\n// applicable) the resolved known-package ids.\n//\n// Downstream consumers — chain-aware code (e.g. SDK boots, wallet\n// pickers, frontend RPC selectors) — `import { suiNetwork } from\n// '<staging>/sui/network'`; the generated module owns that exported\n// value's type.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport type { ResolvedSuiNetwork } from './network-resolver.ts';\n\n/** The typed shape the emitted file exports. */\nexport interface SuiNetworkBindings {\n\treadonly chain: string;\n\treadonly mode: 'local' | 'local-rpc' | 'live' | 'fork';\n\treadonly rpcUrl: string;\n\treadonly faucetUrl: string | null;\n\treadonly graphqlUrl: string | null;\n\t/** Fork-only — upstream identity for known-package lookups. */\n\treadonly forkUpstream: string | null;\n}\n\n/** Aggregate projection: fold the emitted `suiNetwork` shape into\n *  the cross-plugin `services.ts` aggregate at `services.sui`. The\n *  orchestrator stays plugin-name-blind; this projector owns the\n *  `{ rpc, faucet, graphql }` shape decision. */\nconst projectSuiNetworkServices = (\n\texported: Readonly<Record<string, unknown>>,\n): Readonly<Record<string, unknown>> | null => {\n\tconst network = exported['suiNetwork'];\n\tif (typeof network !== 'object' || network === null) return null;\n\tconst record = network as Readonly<Record<string, unknown>>;\n\tconst rpcUrl = stringField(record, 'rpcUrl');\n\tconst faucetUrl = stringField(record, 'faucetUrl');\n\tconst graphqlUrl = stringField(record, 'graphqlUrl');\n\treturn {\n\t\tsui: {\n\t\t\trpc: { url: rpcUrl ?? '' },\n\t\t\tfaucet: faucetUrl === null ? null : { url: faucetUrl },\n\t\t\tgraphql: graphqlUrl === null ? null : { url: graphqlUrl },\n\t\t},\n\t};\n};\n\nconst stringField = (record: Readonly<Record<string, unknown>>, key: string): string | null => {\n\tconst value = record[key];\n\treturn typeof value === 'string' && value.length > 0 ? value : null;\n};\n\n/** Construct the Codegenable contribution. Emit is byte-deterministic\n *  on unchanged input (architecture: no mtime churn on no-op\n *  cycles). */\nexport const makeCodegenable = (resolved: ResolvedSuiNetwork): CodegenableDecl<'sui-network'> => ({\n\tkind: 'codegenable',\n\temitterName: 'sui-network',\n\toutputPath: 'sui/network.ts',\n\taggregate: {\n\t\tkind: 'sui-network',\n\t\tbucket: 'services.ts',\n\t\tproject: projectSuiNetworkServices,\n\t},\n\temit: (ctx) =>\n\t\tEffect.sync(() => {\n\t\t\tconst bindings: SuiNetworkBindings = {\n\t\t\t\tchain: resolved.chain,\n\t\t\t\tmode: resolved.mode,\n\t\t\t\trpcUrl: resolved.rpc,\n\t\t\t\tfaucetUrl: resolved.faucet ?? null,\n\t\t\t\tgraphqlUrl: resolved.graphql ?? null,\n\t\t\t\tforkUpstream: resolved.forkUpstream ?? null,\n\t\t\t};\n\t\t\tctx.exportConst('suiNetwork', bindings);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;;;;AAiCA,MAAM,6BACL,aAC8C;CAC9C,MAAM,UAAU,SAAS;AACzB,KAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;CAC5D,MAAM,SAAS;CACf,MAAM,SAAS,YAAY,QAAQ,SAAS;CAC5C,MAAM,YAAY,YAAY,QAAQ,YAAY;CAClD,MAAM,aAAa,YAAY,QAAQ,aAAa;AACpD,QAAO,EACN,KAAK;EACJ,KAAK,EAAE,KAAK,UAAU,IAAI;EAC1B,QAAQ,cAAc,OAAO,OAAO,EAAE,KAAK,WAAW;EACtD,SAAS,eAAe,OAAO,OAAO,EAAE,KAAK,YAAY;EACzD,EACD;;AAGF,MAAM,eAAe,QAA2C,QAA+B;CAC9F,MAAM,QAAQ,OAAO;AACrB,QAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;;;;;AAMhE,MAAa,mBAAmB,cAAkE;CACjG,MAAM;CACN,aAAa;CACb,YAAY;CACZ,WAAW;EACV,MAAM;EACN,QAAQ;EACR,SAAS;EACT;CACD,OAAO,QACN,OAAO,WAAW;EACjB,MAAM,WAA+B;GACpC,OAAO,SAAS;GAChB,MAAM,SAAS;GACf,QAAQ,SAAS;GACjB,WAAW,SAAS,UAAU;GAC9B,YAAY,SAAS,WAAW;GAChC,cAAc,SAAS,gBAAgB;GACvC;AACD,MAAI,YAAY,cAAc,SAAS;AACvC,SAAO,IAAI,MAAM;GAChB;CACH"}
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/sui/codegen.ts"],"sourcesContent":["// Sui plugin — Codegenable contribution, via the UNIFIED config-binding\n// declaration.\n//\n// Architecture §6: plugins emit typed `CodegenableDecl`s; the codegen\n// orchestrator stages files into the user's source tree WITHOUT naming the\n// plugin. Sui's contribution is the active network: the active key\n// (`network: \"localnet\"`) plus the `networks.localnet` entry (chainId, mode,\n// rpc, faucet, graphql, forkUpstream).\n//\n// ONE declaration, TWO derivations. Sui declares its `config.ts`\n// contributions ONCE as a `ConfigBindingSet`; the framework derives:\n//   - the LIVE (boot) decl — bakes the resolved network entry into the\n//     loadable id-config (so `assembleIdConfig` reads it back), AND\n//   - the STATIC (committed-tree) decl — emits `resolveNetwork()` /\n//     `resolveNetworks()` raw expressions so the committed `config.ts`\n//     carries NO network name and NO literal rpc URL (both are\n//     environment/live data: a dynamic local rpc port; a real deployment\n//     names a different network — resolved at app build/dev time via the\n//     injected `__DEVSTACK_IDS__` global).\n//\n// The decl is `aggregateOnly` — it projects directly into the combined\n// `generated/config.ts` (`config.network` + `config.networks.localnet`) and\n// emits NO standalone `sui/network.ts`.\n\nimport { LOCAL_NETWORK_NAME } from '../../api/inference-network.ts';\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport { configCodegenable, type ConfigBindingSet } from '../../contracts/config-bindings.ts';\nimport type { JsonValue } from '../../orchestrators/codegen/id-config.ts';\nimport type { ResolvedSuiNetwork } from './network-resolver.ts';\n\n/** The typed shape one `networks.<key>` entry in `config.ts` exports. */\nexport interface SuiNetworkConfigEntry {\n\t/** Genesis-digest chain identifier of the running node (not the network\n\t *  name, which is the `networks.<key>` key itself). */\n\treadonly chainId: string;\n\treadonly mode: 'local' | 'local-rpc' | 'live' | 'fork';\n\treadonly rpc: string;\n\treadonly faucet: string | null;\n\treadonly graphql: string | null;\n\t/** Fork-only — upstream identity for known-package lookups. */\n\treadonly forkUpstream: string | null;\n}\n\n/** The sui-plugin's config bindings, declared ONCE. Both the live boot decl\n *  and the static committed-tree decl are derived from this set:\n *   - `network`  — sugar `resolveNetwork()`  / live = `\"localnet\"`.\n *   - `networks` — sugar `resolveNetworks()` / live = `{ localnet: entry }`.\n *  The network NAME + connection map are environment/live data, so both are\n *  RESOLVED bindings (never literals). */\nconst suiConfigBindings = (): ConfigBindingSet<ResolvedSuiNetwork> => {\n\tconst entryOf = (r: ResolvedSuiNetwork): JsonValue =>\n\t\t({\n\t\t\tchainId: r.chainId,\n\t\t\tmode: r.mode,\n\t\t\trpc: r.rpc,\n\t\t\tfaucet: r.faucet ?? null,\n\t\t\tgraphql: r.graphql ?? null,\n\t\t\tforkUpstream: r.forkUpstream ?? null,\n\t\t}) satisfies SuiNetworkConfigEntry;\n\n\treturn {\n\t\tbucket: 'config.ts',\n\t\tkind: 'sui-network',\n\t\temitterName: 'sui-network',\n\t\tbindings: [\n\t\t\t{\n\t\t\t\tvariant: 'resolved',\n\t\t\t\tconfigPath: ['network'],\n\t\t\t\tnamespace: 'sui',\n\t\t\t\tkey: 'network',\n\t\t\t\tsugar: { kind: 'network' },\n\t\t\t\tlive: () => LOCAL_NETWORK_NAME,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: 'resolved',\n\t\t\t\tconfigPath: ['networks'],\n\t\t\t\tnamespace: 'sui',\n\t\t\t\tkey: 'networks',\n\t\t\t\tsugar: { kind: 'networks' },\n\t\t\t\tlive: (r) => ({ [LOCAL_NETWORK_NAME]: entryOf(r) }),\n\t\t\t},\n\t\t],\n\t} satisfies ConfigBindingSet<ResolvedSuiNetwork>;\n};\n\n/** The LIVE Codegenable contribution. Bakes the resolved network entry into\n *  the combined `config.ts` aggregate (chainId/rpc/faucet/graphql) — boot's\n *  `assembleIdConfig` slices it back into the loadable id-config. */\nexport const makeCodegenable = (resolved: ResolvedSuiNetwork): CodegenableDecl =>\n\tconfigCodegenable(suiConfigBindings(), { mode: 'live', state: resolved });\n\n/** The STATIC (stack-free) Codegenable contribution for the `codegen` verb.\n *  Emits `resolveNetwork()` / `resolveNetworks()` raw expressions — the\n *  committed `config.ts` carries no network name and no literal rpc URL. No\n *  id-resolver input needed (the values are injected, not config-derived). */\nexport const makeStaticCodegen = (): (() => ReadonlyArray<CodegenableDecl>) => () => [\n\tconfigCodegenable(suiConfigBindings(), 'static'),\n];\n"],"mappings":";;;;;;;;;AAiDA,MAAM,0BAAgE;CACrE,MAAM,WAAW,OACf;EACA,SAAS,EAAE;EACX,MAAM,EAAE;EACR,KAAK,EAAE;EACP,QAAQ,EAAE,UAAU;EACpB,SAAS,EAAE,WAAW;EACtB,cAAc,EAAE,gBAAgB;CACjC;CAED,OAAO;EACN,QAAQ;EACR,MAAM;EACN,aAAa;EACb,UAAU,CACT;GACC,SAAS;GACT,YAAY,CAAC,SAAS;GACtB,WAAW;GACX,KAAK;GACL,OAAO,EAAE,MAAM,UAAU;GACzB,YAAY;EACb,GACA;GACC,SAAS;GACT,YAAY,CAAC,UAAU;GACvB,WAAW;GACX,KAAK;GACL,OAAO,EAAE,MAAM,WAAW;GAC1B,OAAO,OAAO,GAAG,qBAAqB,QAAQ,CAAC,EAAE;EAClD,CACD;CACD;AACD;;;;AAKA,MAAa,mBAAmB,aAC/B,kBAAkB,kBAAkB,GAAG;CAAE,MAAM;CAAQ,OAAO;AAAS,CAAC;;;;;AAMzE,MAAa,gCAAwE,CACpF,kBAAkB,kBAAkB,GAAG,QAAQ,CAChD"}

package/dist/plugins/sui/errors.d.mts

@@ -4,7 +4,7 @@ import { ConfigIssue } from "../../substrate/runtime/config-validation.mjs";
 /** Phases for `SuiError`. Closed sum — keeps the cause-walker's
  *  display table small. Add a phase only after editing the
  *  catalog in the plugin doc. */
-type SuiPhase = 'image-build' | 'port-allocate' | 'container-start' | 'rpc-probe' | 'faucet-probe' | 'graphql-probe' | 'fork-status-probe' | 'chain-id-fetch' | 'wait-funds-ready' | 'fork-impersonate' | 'fork-advance-clock' | 'fork-advance-checkpoint' | 'fork-lock' | 'fork-data-dir' | 'move-build' | 'move-publish';
+type SuiPhase = 'image-build' | 'port-allocate' | 'container-start' | 'grpc-probe' | 'faucet-probe' | 'graphql-probe' | 'fork-status-probe' | 'chain-id-fetch' | 'wait-funds-ready' | 'fork-impersonate' | 'fork-advance-clock' | 'fork-advance-checkpoint' | 'fork-lock' | 'fork-data-dir' | 'move-build' | 'move-publish';
 /** Generic Sui plugin error. Raised by the plugin's acquire body
  *  and its admin surface (`advanceClock`, `impersonate`, …). */
 interface SuiPluginError {

package/dist/plugins/sui/errors.mjs

@@ -12,15 +12,7 @@ const forkUnsupportedError = (surface, hint) => ({
 	surface,
 	hint
 });
-/** Error tags this plugin contributes — surfaced to the cause
-*  walker via `PluginErrorContribution`. */
-const SUI_ERROR_TAGS = [
-	"SuiPluginError",
-	"SuiCliError",
-	"SuiConfigError",
-	"ForkUnsupportedError"
-];
 //#endregion
-export { SUI_ERROR_TAGS, forkUnsupportedError, suiConfigError, suiPluginError };
+export { forkUnsupportedError, suiConfigError, suiPluginError };
 
 //# sourceMappingURL=errors.mjs.map

package/dist/plugins/sui/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/sui/errors.ts"],"sourcesContent":["// Sui plugin — typed errors.\n//\n// Distilled-doc finding: today's codebase centralises EVERY tagged\n// error in one engine file, but consumer boundaries cross service\n// lines. The architecture lets us redistribute: errors raised AND\n// consumed inside the Sui plugin live here. Cross-service errors\n// (`ForkIncompatibleError`) live with the plugin that consumes them\n// — Walrus/Seal/Deepbook own `ForkIncompatibleError`.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// — we don't subclass an Effect base class; `Effect.catchTag` /\n// `catchTags` match on `_tag` literal. See architecture § Effect.\n\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n/** Phases for `SuiError`. Closed sum — keeps the cause-walker's\n *  display table small. Add a phase only after editing the\n *  catalog in the plugin doc. */\nexport type SuiPhase =\n\t| 'image-build'\n\t| 'port-allocate'\n\t| 'container-start'\n\t| 'rpc-probe'\n\t| 'faucet-probe'\n\t| 'graphql-probe'\n\t| 'fork-status-probe'\n\t| 'chain-id-fetch'\n\t| 'wait-funds-ready'\n\t| 'fork-impersonate'\n\t| 'fork-advance-clock'\n\t| 'fork-advance-checkpoint'\n\t| 'fork-lock'\n\t| 'fork-data-dir'\n\t| 'move-build'\n\t| 'move-publish';\n\n/** Generic Sui plugin error. Raised by the plugin's acquire body\n *  and its admin surface (`advanceClock`, `impersonate`, …). */\nexport interface SuiPluginError {\n\treadonly _tag: 'SuiPluginError';\n\treadonly phase: SuiPhase;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const suiPluginError = (\n\tphase: SuiPhase,\n\tmessage: string,\n\tcause?: unknown,\n): SuiPluginError => ({ _tag: 'SuiPluginError', phase, message, cause });\n\nexport interface SuiConfigError extends ConfigIssue {\n\treadonly _tag: 'SuiConfigError';\n}\n\nexport const suiConfigError = defineConfigError('SuiConfigError');\n\n/** Move-build / sui-cli error. Carries the sub-process capture\n *  envelope (exit + stderr + stdout). The plugin doc lists 11\n *  shell-shaped phases today; we tighten to a much smaller set\n *  and use `op` as a free-form column.\n *\n *  Stub: the closed-vs-open phase decision is deferred to the\n *  cli-driver implementation pass. */\nexport interface SuiCliError {\n\treadonly _tag: 'SuiCliError';\n\treadonly op: 'build' | 'publish' | 'summary' | 'scrub' | 'spawn';\n\treadonly exitCode?: number;\n\treadonly stderr?: string;\n\treadonly stdout?: string;\n\treadonly cause?: unknown;\n}\n\nexport const suiCliError = (\n\top: SuiCliError['op'],\n\tparts: Omit<SuiCliError, '_tag' | 'op'>,\n): SuiCliError => ({ _tag: 'SuiCliError', op, ...parts });\n\n/** Synchronous refusal raised by the fork SDK guard. The guard\n *  intercepts at property-access time so the wire call never\n *  happens — failing fast lets callers branch on this without\n *  awaiting a transport-level reject. */\nexport interface ForkUnsupportedError {\n\treadonly _tag: 'ForkUnsupportedError';\n\treadonly surface: string;\n\treadonly hint: string;\n}\n\nexport const forkUnsupportedError = (surface: string, hint: string): ForkUnsupportedError => ({\n\t_tag: 'ForkUnsupportedError',\n\tsurface,\n\thint,\n});\n\n/** Union of every error a Sui-plugin caller may encounter. */\nexport type SuiError =\n\t| SuiPluginError\n\t| SuiCliError\n\t| SuiConfigError\n\t| ForkUnsupportedError;\n\n/** Error tags this plugin contributes — surfaced to the cause\n *  walker via `PluginErrorContribution`. */\nexport const SUI_ERROR_TAGS: ReadonlyArray<SuiError['_tag']> = [\n\t'SuiPluginError',\n\t'SuiCliError',\n\t'SuiConfigError',\n\t'ForkUnsupportedError',\n] as const;\n"],"mappings":";;AA6CA,MAAa,kBACZ,OACA,SACA,WACqB;CAAE,MAAM;CAAkB;CAAO;CAAS;CAAO;AAMvE,MAAa,iBAAiB,kBAAkB,iBAAiB;AAiCjE,MAAa,wBAAwB,SAAiB,UAAwC;CAC7F,MAAM;CACN;CACA;CACA;;;AAWD,MAAa,iBAAkD;CAC9D;CACA;CACA;CACA;CACA"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/sui/errors.ts"],"sourcesContent":["// Sui plugin — typed errors.\n//\n// Distilled-doc finding: today's codebase centralises EVERY tagged\n// error in one engine file, but consumer boundaries cross service\n// lines. The architecture lets us redistribute: errors raised AND\n// consumed inside the Sui plugin live here. Cross-service errors\n// (`ForkIncompatibleError`) live with the plugin that consumes them\n// — Walrus/Seal/Deepbook own `ForkIncompatibleError`.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// — we don't subclass an Effect base class; `Effect.catchTag` /\n// `catchTags` match on `_tag` literal. See architecture § Effect.\n\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n/** Phases for `SuiError`. Closed sum — keeps the cause-walker's\n *  display table small. Add a phase only after editing the\n *  catalog in the plugin doc. */\nexport type SuiPhase =\n\t| 'image-build'\n\t| 'port-allocate'\n\t| 'container-start'\n\t| 'grpc-probe'\n\t| 'faucet-probe'\n\t| 'graphql-probe'\n\t| 'fork-status-probe'\n\t| 'chain-id-fetch'\n\t| 'wait-funds-ready'\n\t| 'fork-impersonate'\n\t| 'fork-advance-clock'\n\t| 'fork-advance-checkpoint'\n\t| 'fork-lock'\n\t| 'fork-data-dir'\n\t| 'move-build'\n\t| 'move-publish';\n\n/** Generic Sui plugin error. Raised by the plugin's acquire body\n *  and its admin surface (`advanceClock`, `impersonate`, …). */\nexport interface SuiPluginError {\n\treadonly _tag: 'SuiPluginError';\n\treadonly phase: SuiPhase;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const suiPluginError = (\n\tphase: SuiPhase,\n\tmessage: string,\n\tcause?: unknown,\n): SuiPluginError => ({ _tag: 'SuiPluginError', phase, message, cause });\n\nexport interface SuiConfigError extends ConfigIssue {\n\treadonly _tag: 'SuiConfigError';\n}\n\nexport const suiConfigError = defineConfigError('SuiConfigError');\n\n/** Move-build / sui-cli error. Carries the sub-process capture\n *  envelope (exit + stderr + stdout). The plugin doc lists 11\n *  shell-shaped phases today; we tighten to a much smaller set\n *  and use `op` as a free-form column.\n *\n *  Stub: the closed-vs-open phase decision is deferred to the\n *  cli-driver implementation pass. */\nexport interface SuiCliError {\n\treadonly _tag: 'SuiCliError';\n\treadonly op: 'build' | 'publish' | 'summary' | 'scrub' | 'spawn';\n\treadonly exitCode?: number;\n\treadonly stderr?: string;\n\treadonly stdout?: string;\n\treadonly cause?: unknown;\n}\n\nexport const suiCliError = (\n\top: SuiCliError['op'],\n\tparts: Omit<SuiCliError, '_tag' | 'op'>,\n): SuiCliError => ({ _tag: 'SuiCliError', op, ...parts });\n\n/** Synchronous refusal raised by the fork SDK guard. The guard\n *  intercepts at property-access time so the wire call never\n *  happens — failing fast lets callers branch on this without\n *  awaiting a transport-level reject. */\nexport interface ForkUnsupportedError {\n\treadonly _tag: 'ForkUnsupportedError';\n\treadonly surface: string;\n\treadonly hint: string;\n}\n\nexport const forkUnsupportedError = (surface: string, hint: string): ForkUnsupportedError => ({\n\t_tag: 'ForkUnsupportedError',\n\tsurface,\n\thint,\n});\n\n/** Union of every error a Sui-plugin caller may encounter. */\nexport type SuiError = SuiPluginError | SuiCliError | SuiConfigError | ForkUnsupportedError;\n\n/** The catchable error tags this plugin exposes. Pinned against the\n *  user-facing error catalog by the error-catalog-parity test. */\nexport const SUI_ERROR_TAGS: ReadonlyArray<SuiError['_tag']> = [\n\t'SuiPluginError',\n\t'SuiCliError',\n\t'SuiConfigError',\n\t'ForkUnsupportedError',\n] as const;\n"],"mappings":";;AA6CA,MAAa,kBACZ,OACA,SACA,WACqB;CAAE,MAAM;CAAkB;CAAO;CAAS;AAAM;AAMtE,MAAa,iBAAiB,kBAAkB,gBAAgB;AAiChE,MAAa,wBAAwB,SAAiB,UAAwC;CAC7F,MAAM;CACN;CACA;AACD"}

package/dist/{substrate/runtime/sui-execute → plugins/sui/exec}/index.d.mts

@@ -1,7 +1,7 @@
 import { Effect, Schema, Scope } from "effect";
 import { ClientWithCoreApi } from "@mysten/sui/client";
 
-//#region src/substrate/runtime/sui-execute/index.d.ts
+//#region src/plugins/sui/exec/index.d.ts
 interface TransactionSignerScope<SignError = unknown> {
   readonly signTransaction: (tx: Uint8Array) => Effect.Effect<{
     readonly bytes: string;

package/dist/{substrate/runtime/sui-execute → plugins/sui/exec}/index.mjs

@@ -1,7 +1,6 @@
-import { formatUnknownError } from "../format-unknown-error.mjs";
-import "./sign-and-dispatch.mjs";
+import { formatUnknownError } from "../../../substrate/runtime/format-unknown-error.mjs";
 import { Effect, Schema } from "effect";
-//#region src/substrate/runtime/sui-execute/index.ts
+//#region src/plugins/sui/exec/index.ts
 /** Tagged failure during one step of the Sui-tx roundtrip. `phase`
 *  discriminates which step failed so callers can map to their
 *  plugin's phase taxonomy (publish-tx, sign, parse, …) without
@@ -176,10 +175,7 @@ const executeSuiTx = (params) => params.signer.withTransactionSigner((lockedSign
 			objectChanges
 		}
 	};
-})).pipe(Effect.withSpan("substrate.sui-execute", { attributes: {
-	"sui-execute.signer": params.signer.name,
-	"sui-execute.address": params.signer.address
-} }));
+}));
 /** Decode a possibly URI-encoded SDK error message. The Sui SDK
 *  emits `decodeURIComponent`-able strings for some error paths
 *  (notably stale-object-version reports). Falls back to the raw