@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/plugins/sui/index.d.mts

@@ -1,24 +1,25 @@
-import { CodegenableDecl } from "../../contracts/codegenable.mjs";
-import { ChainId } from "../../substrate/brand.mjs";
-import { RoutableDecl } from "../../contracts/routable.mjs";
-import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
-import { StrategyContributorDecl } from "../../contracts/strategy-contributor.mjs";
 import { Plugin } from "../../substrate/plugin.mjs";
+import { DevstackNetworkModeRegistry, NetworkConfig, NetworkMode } from "./network-config.mjs";
 import { ImageRef } from "../../contracts/container-runtime.mjs";
-import { ModeNamespace } from "../../api/mode-narrowed-factory.mjs";
 import { ChainProbe, ChainProbeError, ChainProbeMode } from "../../contracts/chain-probe.mjs";
+import { ModeNamespace } from "../../api/mode-narrowed-factory.mjs";
 import { SuiProbeKey, SuiSdkShim } from "./chain-probe.mjs";
-import { FaucetStrategy } from "../faucet/dispatcher.mjs";
 import { ForkUnsupportedError, SuiCliError, SuiConfigError, SuiError, SuiPluginError } from "./errors.mjs";
-import { ForkAdminSurface, SuiClient, WaitForTransactionsReady } from "./mode/shared.mjs";
+import { FaucetStrategy } from "../faucet/dispatcher.mjs";
 import { SuiForkOptions, SuiLiveOptions, SuiLocalOptions, SuiLocalRpcOptions, SuiOptions, SuiPluginMode } from "./mode/spec.mjs";
 import { ResolvedSuiNetwork } from "./network-resolver.mjs";
-import { SuiNetworkBindings } from "./codegen.mjs";
+import { ForkAdminSurface, SuiClient, WaitForTransactionsReady } from "./mode/shared.mjs";
+import { SuiNetworkConfigEntry } from "./codegen.mjs";
+import { ExecutedFailure, TransactionSignerScope } from "./exec/index.mjs";
+import { Effect, Scope } from "effect";
 //#region src/plugins/sui/index.d.ts
 /** Local Sui shorthand. Network/env selection belongs to the CLI or
  *  `defineDevstackWith(...)`; plain `sui()` always means an in-stack
- *  local validator. */
-declare const sui: (opts?: SuiOptions) => Plugin<"sui", {
+ *  local validator (GraphQL/indexer/Postgres on by default via a
+ *  sui-owned sidecar). */
+declare const sui: <const O extends SuiOptions = {
+  mode: "local";
+}>(opts?: O) => Plugin<"sui", {
   mode: "local" | "live" | "fork" | "local-rpc";
   fundingFaucetStrategy: FaucetStrategy | null;
   sdk: SuiSdkShim;
@@ -31,21 +32,16 @@ declare const sui: (opts?: SuiOptions) => Plugin<"sui", {
     readonly faucetUrl: string | null;
     readonly graphqlUrl: string | null;
   };
-  chain: ChainId;
+  chainId: string;
   waitForTransactionsReady: WaitForTransactionsReady;
   chainProbe: ChainProbe<SuiProbeKey>;
   fork: ForkAdminSurface | null;
   buildImage: ImageRef | null;
-}, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-  kind: "strategy-contributor";
-  capabilityKey: `faucet:request:${ChainId}`;
-  strategy: FaucetStrategy;
-  autoMounted: true;
-})[]]>;
+}, readonly []>;
 /** Mode-narrowed factory namespace.
  *
  *  Usage:
- *      const network = { mode: 'local', chain: 'sui:localnet' } as const;
+ *      const network = { mode: 'local' } as const;
  *      suiFor(network).local({...})    // OK
  *      suiFor(network).fork({...})     // type error: 'fork' not in 'local' branch
  *
@@ -54,7 +50,7 @@ declare const sui: (opts?: SuiOptions) => Plugin<"sui", {
  *  `live`, `fork`. */
 declare const suiFor: ModeNamespace<{
   local: {
-    local: (opts?: Omit<SuiLocalOptions, "mode">) => Plugin<"sui", {
+    local: <const O extends Omit<SuiLocalOptions, "mode">>(opts?: O) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
       sdk: SuiSdkShim;
@@ -67,17 +63,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
     localRpc: (opts: Omit<SuiLocalRpcOptions, "mode">) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
@@ -91,17 +82,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
   };
   live: {
     testnet: (opts?: Omit<SuiLiveOptions, "mode" | "network">) => Plugin<"sui", {
@@ -117,17 +103,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
     mainnet: (opts?: Omit<SuiLiveOptions, "mode" | "network">) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
@@ -141,17 +122,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
     devnet: (opts?: Omit<SuiLiveOptions, "mode" | "network">) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
@@ -165,17 +141,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
     custom: (opts: Omit<SuiLiveOptions, "mode" | "network">) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
@@ -189,17 +160,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
   };
   fork: {
     mainnet: (opts?: Omit<SuiForkOptions, "mode" | "upstream">) => Plugin<"sui", {
@@ -215,17 +181,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
     testnet: (opts?: Omit<SuiForkOptions, "mode" | "upstream">) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
@@ -239,17 +200,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
     devnet: (opts?: Omit<SuiForkOptions, "mode" | "upstream">) => Plugin<"sui", {
       mode: "local" | "live" | "fork" | "local-rpc";
       fundingFaucetStrategy: FaucetStrategy | null;
@@ -263,17 +219,12 @@ declare const suiFor: ModeNamespace<{
         readonly faucetUrl: string | null;
         readonly graphqlUrl: string | null;
       };
-      chain: ChainId;
+      chainId: string;
       waitForTransactionsReady: WaitForTransactionsReady;
       chainProbe: ChainProbe<SuiProbeKey>;
       fork: ForkAdminSurface | null;
       buildImage: ImageRef | null;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"sui-network">, StrategyContributorDecl<`chain-probe:${string}`, ChainProbe<SuiProbeKey>>, ...(RoutableDecl | {
-      kind: "strategy-contributor";
-      capabilityKey: `faucet:request:${ChainId}`;
-      strategy: FaucetStrategy;
-      autoMounted: true;
-    })[]]>;
+    }, readonly []>;
   };
 }>;
 //#endregion

package/dist/plugins/sui/index.mjs

@@ -1,19 +1,27 @@
-import { definePlugin, resource } from "../../substrate/plugin.mjs";
+import { definePlugin, resource, staticInputIdentity } from "../../substrate/plugin.mjs";
 import "../../api/define-plugin.mjs";
 import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
 import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
+import { PluginContext, emitContributions } from "../../substrate/plugin-ctx.mjs";
 import { LeaseBrokerService } from "../../substrate/runtime/lease-broker/service.mjs";
 import "../../substrate/runtime/lease-broker/index.mjs";
 import { PortBrokerService } from "../../substrate/runtime/port-broker/service.mjs";
 import "../../substrate/runtime/port-broker/index.mjs";
 import { chainProbeCapabilityKey } from "../../contracts/chain-probe.mjs";
+import "./move/index.mjs";
 import { makeSuiForkRoutables, makeSuiLocalRoutables } from "./routable.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import { sanitizeAlias } from "../../substrate/runtime/managed-container.mjs";
+import { resolveNetworkOptions } from "../../orchestrators/network-options.mjs";
 import { defineModeNamespace } from "../../api/mode-narrowed-factory.mjs";
-import { makeCodegenable } from "./codegen.mjs";
+import { credentialedUrl, withDatabase } from "../internal/postgres-sidecar/connection.mjs";
+import { bootPostgresSidecar } from "../internal/postgres-sidecar/service.mjs";
+import "../internal/postgres-sidecar/index.mjs";
+import { makeCodegenable, makeStaticCodegen } from "./codegen.mjs";
+import { suiPluginError } from "./errors.mjs";
+import "./log-attrs.mjs";
+import { SUI_INDEXER_DB_ROLE, resolveImage } from "./mode/local.mjs";
 import { makeSnapshotable } from "./snapshot.mjs";
-import { SUI_ERROR_TAGS } from "./errors.mjs";
-import "./spans.mjs";
+import "./exec/index.mjs";
 import "./fork-orchestration.mjs";
 import { selectSufficientForkCoin } from "./fork-transaction.mjs";
 import { FORK_FAUCET_WHALE_MIN_COIN_MIST, resolveForkWhale } from "./mode/fork.mjs";
@@ -23,11 +31,12 @@ import "../faucet/index.mjs";
 import { suiLocalStrategy } from "./local-faucet-strategy.mjs";
 import { suiForkFaucetStrategy } from "./fork-faucet-strategy.mjs";
 import "./chain-build-container.mjs";
+import "./exec/sign-and-dispatch.mjs";
+import "./ledger/object-ref.mjs";
 import { Effect } from "effect";
 //#region src/plugins/sui/index.ts
 /** The Sui plugin's resource identity. The id is `'sui'` (singular). */
 const suiResource = resource("sui");
-const suiErrorContributions = pluginErrorContributions(SUI_ERROR_TAGS);
 /** Build the funds-ready faucet strategy for the resolved network, or
 *  `null` when the network has none. Local/live wrap the HTTP faucet;
 *  fork mode impersonates a whale (resolved + validated here). */
@@ -38,8 +47,8 @@ const resolveFundingFaucetStrategy = (opts, client, broker) => {
 		faucetUrl: client.fundingFaucetUrl,
 		serialization: {
 			broker,
-			key: `sui-faucet:${client.chain}`,
-			owner: `sui-faucet:${client.chain}`
+			key: `sui-faucet:${client.chainId}`,
+			owner: `sui-faucet:${client.chainId}`
 		}
 	}));
 };
@@ -60,88 +69,211 @@ const resolveForkFaucetStrategy = (opts, client, broker) => Effect.gen(function*
 		perRequestCapMist: resolved.perRequestCapMist,
 		serialization: {
 			broker,
-			key: `sui-fork-faucet:${client.chain}`,
-			owner: `sui-fork-faucet:${client.chain}`
+			key: `sui-fork-faucet:${client.chainId}`,
+			owner: `sui-fork-faucet:${client.chainId}`
 		}
 	});
 	return yield* selectSufficientForkCoin(client.sdk.core, resolved.whale, FORK_FAUCET_WHALE_MIN_COIN_MIST).pipe(Effect.as(strategy), Effect.catchTag("SuiPluginError", (cause) => resolved.explicit ? Effect.fail(cause) : Effect.logWarning(`sui fork mode: default faucet whale ${resolved.whale} is unusable (${cause.message}); disabling the fork faucet. Set faucet.whale to override.`).pipe(Effect.as(null))));
 });
-const buildPlugin = (opts) => {
-	return definePlugin({
-		id: suiResource.id,
-		role: "service",
-		section: "service",
-		start: () => Effect.gen(function* () {
-			const runtime = yield* ContainerRuntimeService;
-			const identity = yield* IdentityContext;
-			const paths = yield* StackPathsService;
-			const portBroker = yield* PortBrokerService;
-			const fundingFaucetLeaseBroker = yield* LeaseBrokerService;
-			const { client } = yield* bootSuiService(runtime, identity, portBroker, paths, opts);
-			const fundingFaucetStrategy = yield* resolveFundingFaucetStrategy(opts, client, fundingFaucetLeaseBroker);
-			return {
-				...client,
-				mode: opts.mode,
-				fundingFaucetStrategy
-			};
-		}),
-		capabilities: ({ value, runtime }) => makePluginCapabilities(opts, value, runtime),
-		errorContributions: suiErrorContributions
-	});
+/** Default name for sui's GraphQL-indexer database. */
+const DEFAULT_INDEXER_DATABASE = "sui_indexer";
+/** In-network DNS alias siblings dial the indexer-db sidecar by. */
+const SUI_INDEXER_DB_ALIAS = "sui-indexer-db";
+const suiInputIdentity = (opts) => {
+	const { readyTimeout: _readyTimeout, ...authored } = opts;
+	if (authored.mode !== "local") return {
+		plugin: "sui",
+		...authored
+	};
+	return {
+		plugin: "sui",
+		...authored,
+		indexer: authored.indexer !== false,
+		indexerDb: authored.indexerDb === void 0 ? void 0 : {
+			...authored.indexerDb,
+			database: authored.indexerDb.database ?? DEFAULT_INDEXER_DATABASE
+		}
+	};
 };
-/** Construct the capability tuple POST-acquire. Receives the resolved
-*  `SuiClient` + acquire context so decls can stamp REAL chain ids /
-*  rpc URLs into their fields instead of factory-time placeholders.
+/** Compose the indexer-db sidecar's stable `configHash` from validator
+*  inputs known before local mode starts. A validator image change recreates
+*  the validator, so the sidecar's mount-less PGDATA must reset with it.
 *
-*  StrategyContributor declarations here carry real post-acquire
-*  strategy values. The generic strategy sink registers them on the
-*  scope-local `StrategyRegistry`. */
-const makePluginCapabilities = (opts, resolved, acquireCtx) => {
-	const realChain = resolved.chain;
-	const resolvedRuntime = resolved;
-	const snap = makeSnapshotable(opts.mode, acquireCtx.identity.app, acquireCtx.identity.stack, realChain);
-	const codegen = makeCodegenable({
-		mode: opts.mode,
-		chain: realChain,
-		rpc: resolved.rpcUrl,
-		source: "default",
-		...resolved.faucetUrl !== null ? { faucet: resolved.faucetUrl } : {},
-		...resolved.graphqlUrl !== null ? { graphql: resolved.graphqlUrl } : {}
+*  Validator data-layer resets that are not config values (absent validator
+*  or last exit `137`) are handled by `validatorNeedsIndexerReset`, which
+*  removes the sidecar before this hash is applied. */
+const composeIndexerConfigHash = (imageRef) => ["indexer-db", `validator-img=${imageRef}`].join("|");
+/** Append a database segment to a BYO DSN only when it has no path (so a
+*  caller-supplied `.../mydb` is respected). Rebuilds via the URL object
+*  so the db slots into `pathname` BEFORE `?search` — a naive string
+*  append on a `host:5432?sslmode=require` DSN (path-less but with a
+*  query) would wrongly yield `...?sslmode=require/sui_indexer`. The
+*  catch fallback (non-URL-parseable DSN) splits the query off first. */
+const appendDatabaseIfMissing = (url, database) => {
+	try {
+		const parsed = new URL(url);
+		if (parsed.pathname !== "" && parsed.pathname !== "/") return url;
+		parsed.pathname = `/${database}`;
+		return parsed.toString();
+	} catch {
+		const queryAt = url.indexOf("?");
+		const base = queryAt === -1 ? url : url.slice(0, queryAt);
+		const query = queryAt === -1 ? "" : url.slice(queryAt);
+		const afterScheme = base.replace(/^postgres(ql)?:\/\//, "");
+		if (/\/[^/]+$/.test(afterScheme)) return url;
+		return `${base.replace(/\/$/, "")}/${encodeURIComponent(database)}${query}`;
+	}
+};
+/** Whether the Sui-owned indexer DB must be deleted before boot.
+*
+*  The validator's chain identity lives in its writable layer. If the
+*  validator container is absent, the next boot creates a new layer and a
+*  new chain. If it last exited `137`, the runtime's `on-failure` policy
+*  also recreates it. Both cases make any existing indexer DB stale. */
+const validatorNeedsIndexerReset = (runtime, identity) => runtime.inspectByLabels({
+	app: identity.app,
+	stack: identity.stack,
+	plugin: "sui",
+	role: "validator"
+}).pipe(Effect.map((handles) => {
+	const validator = handles[0];
+	return validator === void 0 || validator.lastExitCode === 137;
+}));
+/** Provision the GraphQL-indexer DB wiring for local mode.
+*
+*  Default: sui OWNS a postgres sidecar (labelled under sui) — boot it on
+*  a per-stack network and compose the DSN from its in-network alias (NOT
+*  the per-stack container DNS host, which isn't parallel-stack-portable).
+*  The sidecar resets on the same validator inputs that can make its rows
+*  stale: absent/exited-`137` validator state removes the sidecar before
+*  boot, and validator image identity is folded into its `configHash`.
+*
+*  `validatorImage` is the SAME `ImageRef` the barrel hands `bootLocalMode`
+*  for the validator container, so the image the sidecar hashed and the image
+*  the validator runs cannot drift.
+*
+*  BYO: when `indexerDb` is set, no sidecar — pass the caller's DSN +
+*  network straight through (appending the default db iff the DSN has no
+*  path). The caller owns that DB's lifecycle. */
+const provisionLocalIndexer = (runtime, identity, opts, validatorImage) => {
+	const database = opts.indexerDb?.database ?? DEFAULT_INDEXER_DATABASE;
+	if (opts.indexerDb !== void 0) return Effect.succeed({
+		url: appendDatabaseIfMissing(opts.indexerDb.url, database),
+		network: opts.indexerDb.network
 	});
-	const chainProbeContribution = {
-		kind: "strategy-contributor",
-		capabilityKey: chainProbeCapabilityKey(realChain),
-		strategy: resolved.chainProbe,
-		autoMounted: true
+	const network = sanitizeAlias(`devstack-${identity.app}-${identity.stack}-sui-indexer`);
+	return Effect.gen(function* () {
+		if (yield* validatorNeedsIndexerReset(runtime, identity)) yield* runtime.removeManagedContainers({
+			app: identity.app,
+			stack: identity.stack,
+			plugin: "sui",
+			role: SUI_INDEXER_DB_ROLE
+		});
+		const { handle } = yield* bootPostgresSidecar(runtime, identity, {
+			network,
+			alias: SUI_INDEXER_DB_ALIAS,
+			role: SUI_INDEXER_DB_ROLE,
+			database,
+			configHash: composeIndexerConfigHash(validatorImage.tag ?? validatorImage.digest)
+		});
+		return {
+			url: withDatabase(credentialedUrl({
+				user: handle.user,
+				password: handle.password,
+				host: handle.networkAlias,
+				port: handle.port
+			}), database),
+			network: handle.containerNetwork
+		};
+	}).pipe(Effect.mapError((cause) => suiPluginError("container-start", `sui local mode: failed to provision the GraphQL indexer postgres sidecar (${cause._tag})`, cause)));
+};
+/** Shared boot + inline contribution emission, parameterised by the
+*  resolved external-indexer wiring (`undefined` = no GraphQL, the
+*  zero-config / non-local case) and, for local mode, the validator image
+*  the barrel pre-resolved (so the sidecar's `configHash` and the validator
+*  container share one `ImageRef`; `undefined` on the no-sidecar paths,
+*  where `bootLocalMode` resolves it inline). */
+const bootAndEmit = (opts, indexer, prebuiltImage) => Effect.gen(function* () {
+	const ctx = yield* PluginContext;
+	const runtime = yield* ContainerRuntimeService;
+	const identity = yield* IdentityContext;
+	const paths = yield* StackPathsService;
+	const portBroker = yield* PortBrokerService;
+	const fundingFaucetLeaseBroker = yield* LeaseBrokerService;
+	const { client } = yield* bootSuiService(runtime, identity, portBroker, paths, opts, indexer, prebuiltImage);
+	const fundingFaucetStrategy = yield* resolveFundingFaucetStrategy(opts, client, fundingFaucetLeaseBroker);
+	const value = {
+		...client,
+		mode: opts.mode,
+		fundingFaucetStrategy
 	};
-	const faucetContribution = resolvedRuntime.fundingFaucetStrategy === null ? [] : [{
+	const realChainId = value.chainId;
+	const faucetContribution = !resolveNetworkOptions(identity.network).faucet || value.fundingFaucetStrategy === null ? [] : [{
 		kind: "strategy-contributor",
-		capabilityKey: faucetCapabilityKey(realChain),
-		strategy: resolvedRuntime.fundingFaucetStrategy,
+		capabilityKey: faucetCapabilityKey(realChainId),
+		strategy: value.fundingFaucetStrategy,
 		autoMounted: true
 	}];
 	const localRoutables = opts.mode === "local" ? makeSuiLocalRoutables({
-		containerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-sui-validator`,
-		includeGraphql: true
+		containerName: `devstack-${identity.app}-${identity.stack}-sui-validator`,
+		includeGraphql: indexer !== void 0
 	}) : [];
-	const forkRoutables = opts.mode === "fork" ? makeSuiForkRoutables({ containerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-sui-fork` }) : [];
-	return [
-		snap,
-		codegen,
-		chainProbeContribution,
+	const forkRoutables = opts.mode === "fork" ? makeSuiForkRoutables({ containerName: `devstack-${identity.app}-${identity.stack}-sui-fork` }) : [];
+	emitContributions(ctx, [
+		makeSnapshotable(opts.mode, identity.app, identity.stack, realChainId, indexer !== void 0),
+		makeCodegenable({
+			mode: opts.mode,
+			chainId: realChainId,
+			rpc: value.rpcUrl,
+			source: "default",
+			...value.faucetUrl !== null ? { faucet: value.faucetUrl } : {},
+			...value.graphqlUrl !== null ? { graphql: value.graphqlUrl } : {}
+		}),
+		{
+			kind: "strategy-contributor",
+			capabilityKey: chainProbeCapabilityKey(realChainId),
+			strategy: value.chainProbe,
+			autoMounted: true
+		},
 		...faucetContribution,
 		...localRoutables,
 		...forkRoutables
-	];
-};
+	]);
+	return value;
+});
+/** The single sui plugin builder. No sibling `dependsOn`: in local mode
+*  with the indexer on (the default), `start` provisions the GraphQL
+*  indexer DB itself — a sui-owned postgres sidecar — inside the boot
+*  scope BEFORE the boot-time validator (so the validator can join its
+*  network), then boots + emits. Resolution order:
+*    - `indexerDb` present  → BYO DB (no sidecar)
+*    - `indexer === false`  → opt out (RPC + faucet only, GraphQL off)
+*    - else (local default) → sui-owned sidecar
+*  Non-local modes never touch the indexer (GraphQL off). */
+const buildSuiPlugin = (opts) => definePlugin({
+	id: suiResource.id,
+	role: "service",
+	section: "service",
+	inputIdentity: staticInputIdentity(suiInputIdentity(opts)),
+	staticCodegen: makeStaticCodegen(),
+	start: () => Effect.gen(function* () {
+		if (opts.mode !== "local" || opts.indexerDb === void 0 && opts.indexer === false) return yield* bootAndEmit(opts, void 0);
+		const runtime = yield* ContainerRuntimeService;
+		const identity = yield* IdentityContext;
+		const validatorImage = yield* resolveImage(runtime, identity, opts);
+		return yield* bootAndEmit(opts, yield* provisionLocalIndexer(runtime, identity, opts, validatorImage), validatorImage);
+	})
+});
+const buildPlugin = (opts) => buildSuiPlugin(opts);
 /** Local Sui shorthand. Network/env selection belongs to the CLI or
 *  `defineDevstackWith(...)`; plain `sui()` always means an in-stack
-*  local validator. */
+*  local validator (GraphQL/indexer/Postgres on by default via a
+*  sui-owned sidecar). */
 const sui = (opts = { mode: "local" }) => buildPlugin(opts);
 /** Mode-narrowed factory namespace.
 *
 *  Usage:
-*      const network = { mode: 'local', chain: 'sui:localnet' } as const;
+*      const network = { mode: 'local' } as const;
 *      suiFor(network).local({...})    // OK
 *      suiFor(network).fork({...})     // type error: 'fork' not in 'local' branch
 *