@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/{substrate/runtime/sui-move-build → plugins/sui/move}/index.mjs

@@ -1,23 +1,23 @@
-import { contentHash } from "../../brand.mjs";
-import { decodeJsonTextSync } from "../runtime-decode.mjs";
-import { mintRandomSuffix } from "../random-suffix.mjs";
-import { Effect, Schema } from "effect";
-import { createHash } from "node:crypto";
+import { contentHash } from "../../../substrate/brand.mjs";
+import { decodeJsonTextSync } from "../../../substrate/runtime/runtime-decode.mjs";
+import { mintRandomSuffix } from "../../../substrate/runtime/random-suffix.mjs";
+import { Effect, Schema, Semaphore } from "effect";
 import { basename, join, relative, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
 import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
-//#region src/substrate/runtime/sui-move-build/index.ts
+//#region src/plugins/sui/move/index.ts
 const DEFAULT_SUI_CLI_VERSION = "devnet-v1.71.0";
-const suiCliImageBuildContext = (version = DEFAULT_SUI_CLI_VERSION) => ({
-	contextPath: new URL("../../../../images/", import.meta.url).pathname,
-	dockerfile: "sui/Dockerfile",
-	fingerprintPaths: [
-		"sui/Dockerfile",
-		"sui/entrypoint.sh",
-		"_shared/signal-forward.sh"
-	],
-	buildArgs: { SUI_VERSION: version }
-});
+const DEFAULT_SUI_TOOLS_REF = "eced02468444d429a4e9a2b9622b7bd30a1710d4";
+const suiCliImageBuildContext = () => {
+	const suffix = process.arch === "arm64" ? "-arm64" : "";
+	return {
+		contextPath: new URL("../../../../images/", import.meta.url).pathname,
+		dockerfile: "sui/Dockerfile",
+		fingerprintPaths: ["sui/Dockerfile", "sui/entrypoint.sh"],
+		buildArgs: { SUI_TOOLS_IMAGE: `mysten/sui-tools:${DEFAULT_SUI_TOOLS_REF}${suffix}` }
+	};
+};
 var MoveBuildError = class extends Schema.TaggedErrorClass()("MoveBuildError", {
 	phase: Schema.Literals([
 		"hash",
@@ -76,16 +76,7 @@ const extractTrailingJson = (text) => {
 	if (idx === -1) return trimmed;
 	return trimmed.slice(idx);
 };
-/** One-shot-path inner script. Mirrors {@link containerInnerScript} — both copy
-*  the WHOLE `/workspace` tree into an in-container scratch dir and scrub + build
-*  THERE, never the mount in place. The difference is only WHAT is mounted at
-*  `/workspace`: the exec path bind-mounts the developer's real app dir (so the
-*  whole-tree copy naturally carries nested packages + sibling `../` deps),
-*  whereas the one-shot path mounts a disposable host-side staging copy whose
-*  transitive local deps were pre-staged (see `stageLocalMoveDeps`). Copying only
-*  `/workspace/<pkg>` would drop sibling local dependencies
-*  (`{ local = "../token" }`), failing the build with "Invalid directory at ../…". */
-const containerInnerScriptOneShot = (pkgName) => {
+const containerInnerScript = (pkgName) => {
 	const quotedPkg = shellQuote(pkgName);
 	const scratchRoot = "/tmp/move-build-$$";
 	const scratchPkg = `${scratchRoot}/${quotedPkg}`;
@@ -203,6 +194,13 @@ const scrubLocksHost = (sourcePath, moveHomeRoot) => Effect.tryPromise({
 		cause
 	})
 });
+const moveBuildLock = Semaphore.makeUnsafe(1);
+/** Run `effect` while holding the process-wide Move-build permit. Wrap ONLY
+*  the host-scrub → build critical section (never the on-chain publish, which
+*  must stay parallel) so just one build mutates the shared `~/.move` git
+*  cache at a time. Generic over the effect's channels — it neither adds
+*  requirements nor changes the error type. */
+const withMoveBuildLock = (effect) => moveBuildLock.withPermit(effect);
 const SuiBuildJsonSchema = Schema.Struct({
 	modules: Schema.Array(Schema.String),
 	dependencies: Schema.Array(Schema.String)
@@ -250,7 +248,7 @@ const buildViaContainerExec = (inputs, bc) => Effect.gen(function* () {
 	})));
 	if (result.exitCode !== 0) return yield* Effect.fail(promoteNonZero("docker exec", result, inputs.sourcePath, inputs.packageName));
 	return yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);
-}).pipe(Effect.withSpan("sui-move-build.via-exec"));
+});
 /** `{ local = "../path" }` dependency paths, harvested from a Move.toml. */
 const LOCAL_MOVE_DEP_RE = /\blocal\s*=\s*"([^"]+)"/g;
 /** Copy a package's transitive local-path Move dependencies into a staging
@@ -295,7 +293,7 @@ const stageLocalMoveDeps = (packageSrc, stagedPackage, stagingRoot, inputs) => E
 });
 const buildViaOneShot = (inputs, runtime, image) => Effect.gen(function* () {
 	const pkgName = basename(inputs.sourcePath);
-	const inner = containerInnerScriptOneShot(pkgName);
+	const inner = containerInnerScript(pkgName);
 	const moveHome = join(homedir(), ".move");
 	yield* ensureMoveHomeMountSource(moveHome, inputs.sourcePath, inputs.packageName);
 	const stagingRoot = yield* Effect.acquireRelease(Effect.tryPromise({
@@ -341,7 +339,7 @@ const buildViaOneShot = (inputs, runtime, image) => Effect.gen(function* () {
 	})));
 	if (result.exitCode !== 0) return yield* Effect.fail(promoteNonZero("docker run --rm", result, inputs.sourcePath, inputs.packageName));
 	return yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);
-}).pipe(Effect.withSpan("sui-move-build.via-one-shot"));
+});
 const runMoveBuild = (inputs) => {
 	if (inputs.buildContainer !== void 0) return buildViaContainerExec(inputs, inputs.buildContainer);
 	if (inputs.runtime !== void 0 && inputs.buildImage !== void 0) return buildViaOneShot(inputs, inputs.runtime, inputs.buildImage);
@@ -352,6 +350,6 @@ const runMoveBuild = (inputs) => {
 	}));
 };
 //#endregion
-export { DEFAULT_SUI_CLI_VERSION, copyLocalMoveDeps, extractTrailingJson, hashMoveSources, parseBuildOutput, runMoveBuild, scrubLocksHost, shellQuote, stripPinnedSections, suiCliImageBuildContext };
+export { DEFAULT_SUI_CLI_VERSION, copyLocalMoveDeps, hashMoveSources, runMoveBuild, scrubLocksHost, shellQuote, suiCliImageBuildContext, withMoveBuildLock };
 
 //# sourceMappingURL=index.mjs.map

package/dist/plugins/sui/move/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/plugins/sui/move/index.ts"],"sourcesContent":["// sui-move-build — shared Sui Move build helpers.\n//\n// Lives in `plugins/sui`. Owns the mechanical \"scrub Move.lock → run\n// sui move build → parse bytecode\" path so Move-publishing plugins do\n// not import each other's internals.\n\nimport { createHash } from 'node:crypto';\nimport { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';\nimport { homedir, tmpdir } from 'node:os';\nimport { basename, join, relative, resolve, sep } from 'node:path';\n\nimport { Effect, Schema, type Scope, Semaphore } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tExecResult,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { contentHash, type ContentHash } from '../../../substrate/brand.ts';\nimport { mintRandomSuffix } from '../../../substrate/runtime/random-suffix.ts';\nimport { decodeJsonTextSync } from '../../../substrate/runtime/runtime-decode.ts';\n\nexport type MoveBuildPhase = 'hash' | 'scrub' | 'build' | 'parse';\n\n// Sui-fork image still builds the CLI from a release tarball at this\n// version (see mode/fork.ts); local mode now bases on sui-tools.\nexport const DEFAULT_SUI_CLI_VERSION = 'devnet-v1.71.0';\n\n// Per-arch sui-tools pin. The tag is NOT a multi-arch manifest list, so\n// the `-arm64` suffix is chosen host-side from `process.arch`.\nconst DEFAULT_SUI_TOOLS_REF = 'eced02468444d429a4e9a2b9622b7bd30a1710d4';\n\nexport const suiCliImageBuildContext = (): ContainerBuildContext => {\n\tconst suffix = process.arch === 'arm64' ? '-arm64' : '';\n\treturn {\n\t\tcontextPath: new URL('../../../../images/', import.meta.url).pathname,\n\t\tdockerfile: 'sui/Dockerfile',\n\t\tfingerprintPaths: ['sui/Dockerfile', 'sui/entrypoint.sh'],\n\t\tbuildArgs: { SUI_TOOLS_IMAGE: `mysten/sui-tools:${DEFAULT_SUI_TOOLS_REF}${suffix}` },\n\t};\n};\n\nexport class MoveBuildError extends Schema.TaggedErrorClass<MoveBuildError>()('MoveBuildError', {\n\tphase: Schema.Literals(['hash', 'scrub', 'build', 'parse']),\n\tsourcePath: Schema.String,\n\tpackageName: Schema.String,\n\tmessage: Schema.String,\n\tcause: Schema.optional(Schema.Defect),\n}) {}\n\nconst moveBuildError = (\n\tphase: MoveBuildPhase,\n\tparts: {\n\t\treadonly sourcePath: string;\n\t\treadonly packageName: string;\n\t\treadonly message: string;\n\t\treadonly cause?: unknown;\n\t},\n): MoveBuildError =>\n\tnew MoveBuildError({\n\t\tphase,\n\t\tsourcePath: parts.sourcePath,\n\t\tpackageName: parts.packageName,\n\t\tmessage: parts.message,\n\t\t...(parts.cause !== undefined ? { cause: parts.cause } : {}),\n\t});\n\nexport interface MoveBuildContainer {\n\treadonly runBuild: (hostPackagePath: string) => Effect.Effect<ExecResult, unknown, Scope.Scope>;\n}\n\nexport interface BuildInputs {\n\treadonly sourcePath: string;\n\treadonly packageName: string;\n\treadonly buildContainer?: MoveBuildContainer;\n\treadonly runtime?: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n}\n\nexport interface BuildOutput {\n\treadonly modules: ReadonlyArray<Uint8Array>;\n\treadonly dependencies: ReadonlyArray<string>;\n}\n\nexport const stripPinnedSections = (source: string): string => {\n\tconst lines = source.split('\\n');\n\tconst out: Array<string> = [];\n\tlet skipping = false;\n\tfor (const line of lines) {\n\t\tconst trimmed = line.trimStart();\n\t\tif (trimmed.startsWith('[')) {\n\t\t\tconst header = trimmed.replace(/\\s+/g, '');\n\t\t\tif (header.startsWith('[pinned.') || header === '[env]' || header.startsWith('[env.')) {\n\t\t\t\tskipping = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tskipping = false;\n\t\t}\n\t\tif (!skipping) out.push(line);\n\t}\n\tif (skipping && source.endsWith('\\n') && out.at(-1) === '') out.push('');\n\treturn out.join('\\n');\n};\n\nexport const CONTAINER_SCRUB_AWK_SCRIPT = [\n\t'/^\\\\[pinned\\\\./ || /^\\\\[env(\\\\.|\\\\])/ { skip=1; next }',\n\t'/^\\\\[/ && !/^\\\\[pinned\\\\./ && !/^\\\\[env(\\\\.|\\\\])/ { skip=0 }',\n\t'!skip { print }',\n].join('\\n');\n\nexport const containerScrubShellScript = (workspaceRoot: string, moveHomeRoot: string): string => {\n\tconst lines = CONTAINER_SCRUB_AWK_SCRIPT.split('\\n')\n\t\t.map((l) => `'${l}'`)\n\t\t.join(' ');\n\tconst stage = `printf '%s\\\\n%s\\\\n%s\\\\n' ${lines} > /tmp/scrub-move-lock.awk`;\n\tconst findPkg =\n\t\t`find ${workspaceRoot} -type f -name Move.lock ` +\n\t\t`-not -path '*/node_modules/*' -not -path '*/.git/*' ` +\n\t\t`-exec gawk -i inplace -f /tmp/scrub-move-lock.awk {} ';'`;\n\tconst findCache =\n\t\t`[ -d ${moveHomeRoot}/git ] && find ${moveHomeRoot}/git -type f -name Move.lock ` +\n\t\t`-not -path '*/.git/*' ` +\n\t\t`-exec gawk -i inplace -f /tmp/scrub-move-lock.awk {} ';' || true`;\n\treturn [stage, findPkg, findCache].join('; ');\n};\n\nexport const shellQuote = (s: string): string => `'${s.replaceAll(\"'\", \"'\\\\''\")}'`;\n\nexport const extractTrailingJson = (text: string): string => {\n\tconst trimmed = text.trim();\n\tif (trimmed.startsWith('{')) return trimmed;\n\tconst idx = trimmed.lastIndexOf('{');\n\tif (idx === -1) return trimmed;\n\treturn trimmed.slice(idx);\n};\n\nexport const containerInnerScript = (pkgName: string): string => {\n\t// Copy the WHOLE mounted tree into an in-container scratch dir and scrub +\n\t// build the package THERE, never `/workspace/<pkg>` directly. `/workspace`\n\t// is a bind mount of the developer's real source tree (the per-app build\n\t// container in `chain-build-container.ts` mounts the app dir as-is), and the\n\t// scrub's `gawk -i inplace` rewrite of Move.lock would corrupt their\n\t// checked-in pinned deps if run against the mount.\n\t//\n\t// Two reasons we copy `/workspace/.` (the whole tree) rather than only\n\t// `/workspace/<pkgName>`:\n\t//   1. NESTED PACKAGES. `pkgName` is the package path RELATIVE to the\n\t//      bind-mounted app dir (e.g. `packages/demo`), so it can contain a\n\t//      slash. Copying only `/workspace/<pkgName>` into\n\t//      `/tmp/move-build-$$/<pkgName>` would need the intermediate\n\t//      `packages/` dir to exist first — it doesn't, and `set -e` would\n\t//      abort the build before `sui move build` ran.\n\t//   2. SIBLING LOCAL DEPS. A package can reference siblings via\n\t//      `{ local = \"../token\" }`. A scoped copy of only the package subtree\n\t//      drops those, failing the build with \"Invalid directory at ../…\".\n\t// Copying the whole tree both materialises the nested path AND carries the\n\t// sibling `../` deps. The mount itself is never rewritten — the in-container\n\t// copy is always the disposable one. Both consumers share this script: the\n\t// exec path (`chain-build-container.ts`) bind-mounts the developer's real app\n\t// dir, and the one-shot path (`buildViaOneShot`) mounts a disposable host-side\n\t// staging copy whose transitive local deps were pre-staged (see\n\t// `stageLocalMoveDeps`); in both cases `/workspace` is copied, not rewritten.\n\t//\n\t// `$$` (the shell PID) scopes the scratch dir per exec so concurrent\n\t// builds of the same package don't share a tree.\n\tconst quotedPkg = shellQuote(pkgName);\n\tconst scratchRoot = '/tmp/move-build-$$';\n\tconst scratchPkg = `${scratchRoot}/${quotedPkg}`;\n\tconst stage = `rm -rf ${scratchRoot} && mkdir -p ${scratchRoot} && cp -a /workspace/. ${scratchRoot}/`;\n\t// Scrub the whole scratch tree AND the mounted Move git cache. The cache\n\t// (`/root/.move/git`) is process-shared mutable state we legitimately want\n\t// scrubbed so a stale pin can't leak into the build; the scratch tree is the\n\t// disposable copy, so scrubbing all of it (package + staged siblings) is safe.\n\tconst scrub = containerScrubShellScript(scratchRoot, '/root/.move');\n\tconst build =\n\t\t`sui move build --path ${scratchPkg} ` +\n\t\t`-e testnet --no-tree-shaking --dump-bytecode-as-base64 ` +\n\t\t`--with-unpublished-dependencies`;\n\tconst cleanup = `rm -rf ${scratchRoot}`;\n\treturn [\n\t\t'set -e',\n\t\tstage,\n\t\tscrub,\n\t\t'set +e',\n\t\tbuild,\n\t\t'status=$?',\n\t\t'set -e',\n\t\tscrub,\n\t\tcleanup,\n\t\t'exit \"$status\"',\n\t].join('; ');\n};\n\nconst isHashedFile = (name: string): boolean =>\n\tname === 'Move.toml' || name === 'Move.lock' || name.endsWith('.move');\n\nconst isSkippedDir = (name: string): boolean =>\n\tname === 'build' || name === 'node_modules' || name === '.git' || name.startsWith('.');\n\nconst collectHashedSources = async (root: string): Promise<ReadonlyArray<string>> => {\n\tconst out: Array<string> = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: ReadonlyArray<{\n\t\t\treadonly name: string;\n\t\t\treadonly isDirectory: () => boolean;\n\t\t\treadonly isFile: () => boolean;\n\t\t}> = [];\n\t\ttry {\n\t\t\tentries = await readdir(dir, { withFileTypes: true });\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tif (isSkippedDir(entry.name)) continue;\n\t\t\t\tawait walk(join(dir, entry.name));\n\t\t\t} else if (entry.isFile() && isHashedFile(entry.name)) {\n\t\t\t\tconst abs = join(dir, entry.name);\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = await lstat(abs);\n\t\t\t\t\tif (stat.isFile() && !stat.isSymbolicLink()) out.push(abs);\n\t\t\t\t} catch {\n\t\t\t\t\t// vanished / unreadable — skip\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\tawait walk(root);\n\treturn out;\n};\n\nexport const hashMoveSources = (sourcePath: string): Effect.Effect<ContentHash, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: async (): Promise<ContentHash> => {\n\t\t\tconst files = await collectHashedSources(sourcePath);\n\t\t\tconst sorted = [...files].sort((a, b) =>\n\t\t\t\trelative(sourcePath, a).localeCompare(relative(sourcePath, b)),\n\t\t\t);\n\t\t\tconst hasher = createHash('sha256');\n\t\t\tfor (const abs of sorted) {\n\t\t\t\tconst rel = relative(sourcePath, abs);\n\t\t\t\tconst raw = await readFile(abs, 'utf8');\n\t\t\t\tconst normalised = basename(abs) === 'Move.lock' ? stripPinnedSections(raw) : raw;\n\t\t\t\thasher.update(rel);\n\t\t\t\thasher.update('\\0');\n\t\t\t\thasher.update(normalised);\n\t\t\t\thasher.update('\\0');\n\t\t\t}\n\t\t\treturn contentHash(hasher.digest('hex'));\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('hash', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName: sourcePath,\n\t\t\t\tmessage: `source-tree hash failed: ${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst expandHome = (p: string): string =>\n\tp.startsWith('~/') ? join(homedir(), p.slice(2)) : p === '~' ? homedir() : p;\n\nconst findMoveLockFiles = async (root: string): Promise<ReadonlyArray<string>> => {\n\tconst out: Array<string> = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: ReadonlyArray<{\n\t\t\treadonly name: string;\n\t\t\treadonly isDirectory: () => boolean;\n\t\t\treadonly isFile: () => boolean;\n\t\t}> = [];\n\t\ttry {\n\t\t\tentries = await readdir(dir, { withFileTypes: true });\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'build') {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst child = join(dir, entry.name);\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tawait walk(child);\n\t\t\t} else if (entry.isFile() && entry.name === 'Move.lock') {\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = await lstat(child);\n\t\t\t\t\tif (stat.isFile() && !stat.isSymbolicLink()) out.push(child);\n\t\t\t\t} catch {\n\t\t\t\t\t// unreadable / vanished — skip\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\tawait walk(root);\n\treturn out;\n};\n\nconst scrubOneLockFile = async (path: string): Promise<void> => {\n\tconst original = await readFile(path, 'utf8');\n\tconst scrubbed = stripPinnedSections(original);\n\tif (scrubbed === original) return;\n\tawait writeFile(path, scrubbed, 'utf8');\n};\n\nconst scrubCachedLockFiles = async (root: string): Promise<void> => {\n\tconst cachedLocks = await findMoveLockFiles(root);\n\tfor (const f of cachedLocks) {\n\t\ttry {\n\t\t\tawait scrubOneLockFile(f);\n\t\t} catch {\n\t\t\t// The Docker build scrubs the mounted Move cache again from inside the container.\n\t\t}\n\t}\n};\n\n// Scrub ONLY the shared Move git cache (`~/.move/git`), never the caller's\n// source tree. The package's own Move.lock is scrubbed inside the container on\n// a disposable copy (see `containerInnerScript`), so rewriting the developer's\n// checked-in Move.lock here would corrupt their pinned deps for no benefit. The\n// cache is process-shared mutable state, so scrubbing it host-side keeps a stale\n// pin from leaking into the build.\nexport const scrubLocksHost = (\n\tsourcePath: string,\n\tmoveHomeRoot: string,\n): Effect.Effect<void, MoveBuildError, Scope.Scope> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tconst moveHome = expandHome(moveHomeRoot);\n\t\t\tconst gitCache = join(moveHome, 'git');\n\t\t\ttry {\n\t\t\t\tawait lstat(gitCache);\n\t\t\t} catch {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait scrubCachedLockFiles(gitCache);\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('scrub', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName: sourcePath,\n\t\t\t\tmessage: `scrub host locks failed (root=${moveHomeRoot})`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n// Serialize the host-scrub → build critical section across ALL Move builds in\n// this process. The host `~/.move/git` cache is shared mutable state: every\n// build host-scrubs it (`scrubLocksHost`), the build container bind-mounts it\n// (see `buildViaOneShot`), and `sui move build` writes fresh `[pinned.*]`\n// sections that the in-container post-build scrub strips (Invariant 14). Under\n// concurrent builds those host-side `gawk -i inplace` scrubs collide with a\n// sibling container's live `git clone` into the same cache dir, corrupting the\n// in-flight fetch — only git-resolving builds are exposed, so a package that\n// pulls a Move dep (or the framework) from git is the usual casualty. A\n// single-permit semaphore makes the cache-touching section mutually exclusive\n// while leaving the on-chain publish-tx parallel. In-process only: a global\n// `~/.move` shared across concurrent devstack PROCESSES is a pre-existing\n// condition this does not (and the short-lived `stack.lock` cannot) cover.\nconst moveBuildLock = Semaphore.makeUnsafe(1);\n\n/** Run `effect` while holding the process-wide Move-build permit. Wrap ONLY\n *  the host-scrub → build critical section (never the on-chain publish, which\n *  must stay parallel) so just one build mutates the shared `~/.move` git\n *  cache at a time. Generic over the effect's channels — it neither adds\n *  requirements nor changes the error type. */\nexport const withMoveBuildLock = <A, E, R>(\n\teffect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, E, R> => moveBuildLock.withPermit(effect);\n\nconst SuiBuildJsonSchema = Schema.Struct({\n\tmodules: Schema.Array(Schema.String),\n\tdependencies: Schema.Array(Schema.String),\n});\n\nconst decodeBase64Module = (s: string): Uint8Array =>\n\tUint8Array.from(globalThis.Buffer.from(s, 'base64'));\n\nexport const parseBuildOutput = (\n\tstdout: string,\n\tsourcePath: string,\n\tpackageName: string,\n): Effect.Effect<BuildOutput, MoveBuildError> =>\n\tEffect.try({\n\t\ttry: (): BuildOutput => {\n\t\t\tconst trimmed = extractTrailingJson(stdout);\n\t\t\tconst parsed = decodeJsonTextSync(SuiBuildJsonSchema, trimmed, {\n\t\t\t\tsource: 'sui move build stdout',\n\t\t\t\tmessage: 'unexpected sui move build JSON shape',\n\t\t\t\tmkError: (issue) => new Error(issue.message, { cause: issue.cause }),\n\t\t\t});\n\t\t\tconst modules = parsed.modules.map((m) => decodeBase64Module(m));\n\t\t\tconst dependencies = parsed.dependencies;\n\t\t\treturn { modules, dependencies };\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('parse', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName,\n\t\t\t\tmessage: `failed to parse sui move build output: ${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst promoteNonZero = (\n\top: 'docker exec' | 'docker run --rm',\n\tresult: ExecResult,\n\tsourcePath: string,\n\tpackageName: string,\n): MoveBuildError =>\n\tmoveBuildError('build', {\n\t\tsourcePath,\n\t\tpackageName,\n\t\tmessage:\n\t\t\t`${op} sui move build exited ${result.exitCode} for package \"${packageName}\".\\n` +\n\t\t\t`stderr: ${result.stderr || '(empty)'}\\n` +\n\t\t\t`stdout (tail): ${result.stdout.slice(-400) || '(empty)'}`,\n\t});\n\nconst ensureMoveHomeMountSource = (\n\tmoveHome: string,\n\tsourcePath: string,\n\tpackageName: string,\n): Effect.Effect<void, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdir(moveHome, { recursive: true }),\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('build', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName,\n\t\t\t\tmessage: `failed to create Move cache mount source \"${moveHome}\"`,\n\t\t\t\tcause,\n\t\t\t}),\n\t}).pipe(Effect.asVoid);\n\nconst buildViaContainerExec = (\n\tinputs: BuildInputs,\n\tbc: MoveBuildContainer,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* bc.runBuild(inputs.sourcePath).pipe(\n\t\t\tEffect.mapError(\n\t\t\t\t(err): MoveBuildError =>\n\t\t\t\t\tmoveBuildError('build', {\n\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\tmessage: `buildContainer.runBuild failed: ${String(\n\t\t\t\t\t\t\t(err as { cause?: { message?: string } })?.cause?.message ?? err,\n\t\t\t\t\t\t)}`,\n\t\t\t\t\t\tcause: err,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tpromoteNonZero('docker exec', result, inputs.sourcePath, inputs.packageName),\n\t\t\t);\n\t\t}\n\t\treturn yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);\n\t});\n\n/** `{ local = \"../path\" }` dependency paths, harvested from a Move.toml. */\nconst LOCAL_MOVE_DEP_RE = /\\blocal\\s*=\\s*\"([^\"]+)\"/g;\n\n/** Copy a package's transitive local-path Move dependencies into a staging\n *  tree, preserving each dep's path RELATIVE to the staged package so\n *  references like `{ local = \"../token\" }` resolve. Without this, a scoped\n *  copy of only the package fails `sui move build` / `sui move summary` with\n *  \"Invalid directory at ../…\". Throws if a dep resolves outside `stagingRoot`\n *  (the single-mount layout can't represent it). Promise-based so the build\n *  (`MoveBuildError`) and summary (`CodegenBindingsFailed`) call sites can\n *  wrap it in their own error type. */\nexport const copyLocalMoveDeps = async (\n\tpackageSrc: string,\n\tstagedPackage: string,\n\tstagingRoot: string,\n): Promise<void> => {\n\tconst staged = new Set<string>([packageSrc]);\n\tconst walk = async (srcDir: string, stagedDir: string): Promise<void> => {\n\t\tlet toml: string;\n\t\ttry {\n\t\t\ttoml = await readFile(join(srcDir, 'Move.toml'), 'utf8');\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const match of toml.matchAll(LOCAL_MOVE_DEP_RE)) {\n\t\t\tconst rel = match[1]!;\n\t\t\tconst depSrc = resolve(srcDir, rel);\n\t\t\tconst depStaged = resolve(stagedDir, rel);\n\t\t\tif (depStaged !== stagingRoot && !depStaged.startsWith(stagingRoot + sep)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`local Move dependency \"${rel}\" of \"${basename(srcDir)}\" resolves outside the ` +\n\t\t\t\t\t\t`staging root; vendor it under the package tree so it can be staged.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (staged.has(depSrc)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tstaged.add(depSrc);\n\t\t\tawait cp(depSrc, depStaged, { recursive: true });\n\t\t\tawait walk(depSrc, depStaged);\n\t\t}\n\t};\n\tawait walk(packageSrc, stagedPackage);\n};\n\n/** Build-path wrapper around {@link copyLocalMoveDeps}. */\nconst stageLocalMoveDeps = (\n\tpackageSrc: string,\n\tstagedPackage: string,\n\tstagingRoot: string,\n\tinputs: BuildInputs,\n): Effect.Effect<void, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: () => copyLocalMoveDeps(packageSrc, stagedPackage, stagingRoot),\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('scrub', {\n\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\tmessage: 'failed to stage local Move dependencies for the one-shot build',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst buildViaOneShot = (\n\tinputs: BuildInputs,\n\truntime: ContainerRuntime,\n\timage: ImageRef,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst pkgName = basename(inputs.sourcePath);\n\t\tconst inner = containerInnerScript(pkgName);\n\t\tconst moveHome = join(homedir(), '.move');\n\t\tyield* ensureMoveHomeMountSource(moveHome, inputs.sourcePath, inputs.packageName);\n\n\t\t// Stage a scoped copy of the package and mount THAT, never the user's\n\t\t// source tree. The container scrub (`gawk -i inplace`) rewrites Move.lock\n\t\t// in place; pointing it at the developer's checked-in tree corrupts their\n\t\t// pinned deps. The staging dir is scope-bound (acquireRelease removes it on\n\t\t// scope close) and carries a random suffix so two concurrent builds of the\n\t\t// same package don't share a tree. We keep the `/workspace/<pkgName>` layout\n\t\t// so `containerInnerScript(pkgName)` and the mounted Move cache stay unchanged.\n\t\tconst stagingRoot = yield* Effect.acquireRelease(\n\t\t\tEffect.tryPromise({\n\t\t\t\ttry: () => mkdtemp(join(tmpdir(), `move-build-${mintRandomSuffix(12)}-`)),\n\t\t\t\tcatch: (cause): MoveBuildError =>\n\t\t\t\t\tmoveBuildError('scrub', {\n\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\tmessage: 'failed to create staging dir for Move build copy',\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t}),\n\t\t\t(dir) => Effect.promise(() => rm(dir, { recursive: true, force: true })),\n\t\t);\n\t\tconst stagedPackage = join(stagingRoot, pkgName);\n\t\tyield* Effect.tryPromise({\n\t\t\ttry: () => cp(inputs.sourcePath, stagedPackage, { recursive: true }),\n\t\t\tcatch: (cause): MoveBuildError =>\n\t\t\t\tmoveBuildError('scrub', {\n\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\tmessage: `failed to stage package copy for Move build (staging=${stagedPackage})`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\t// Bring the package's transitive local `../` deps into the staging tree\n\t\t// so the in-place one-shot build resolves them (the scoped copy alone\n\t\t// would omit siblings like `{ local = \"../token\" }`).\n\t\tyield* stageLocalMoveDeps(inputs.sourcePath, stagedPackage, stagingRoot, inputs);\n\n\t\tconst result = yield* runtime\n\t\t\t.runOneShot({\n\t\t\t\timage,\n\t\t\t\tentrypoint: 'sh',\n\t\t\t\targv: ['-c', inner],\n\t\t\t\tmounts: [\n\t\t\t\t\t{ source: stagingRoot, target: '/workspace' },\n\t\t\t\t\t{ source: moveHome, target: '/root/.move' },\n\t\t\t\t],\n\t\t\t\ttimeoutMillis: 5 * 60_000,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError(\n\t\t\t\t\t(err): MoveBuildError =>\n\t\t\t\t\t\tmoveBuildError('build', {\n\t\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\t\tmessage: `runtime.runOneShot failed: ${err.reason}: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tpromoteNonZero('docker run --rm', result, inputs.sourcePath, inputs.packageName),\n\t\t\t);\n\t\t}\n\t\treturn yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);\n\t});\n\nexport const runMoveBuild = (\n\tinputs: BuildInputs,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> => {\n\tif (inputs.buildContainer !== undefined) {\n\t\treturn buildViaContainerExec(inputs, inputs.buildContainer);\n\t}\n\tif (inputs.runtime !== undefined && inputs.buildImage !== undefined) {\n\t\treturn buildViaOneShot(inputs, inputs.runtime, inputs.buildImage);\n\t}\n\treturn Effect.fail(\n\t\tmoveBuildError('build', {\n\t\t\tsourcePath: inputs.sourcePath,\n\t\t\tpackageName: inputs.packageName,\n\t\t\tmessage:\n\t\t\t\t'runMoveBuild: no build container and no fresh-container runtime/image — ' +\n\t\t\t\t'host `sui` CLI path is not available without a routed ChildProcessSpawner',\n\t\t}),\n\t);\n};\n"],"mappings":";;;;;;;;;AA2BA,MAAa,0BAA0B;AAIvC,MAAM,wBAAwB;AAE9B,MAAa,gCAAuD;CACnE,MAAM,SAAS,QAAQ,SAAS,UAAU,WAAW;CACrD,OAAO;EACN,aAAa,IAAI,IAAI,uBAAuB,OAAO,KAAK,GAAG,CAAC,CAAC;EAC7D,YAAY;EACZ,kBAAkB,CAAC,kBAAkB,mBAAmB;EACxD,WAAW,EAAE,iBAAiB,oBAAoB,wBAAwB,SAAS;CACpF;AACD;AAEA,IAAa,iBAAb,cAAoC,OAAO,iBAAiC,CAAC,CAAC,kBAAkB;CAC/F,OAAO,OAAO,SAAS;EAAC;EAAQ;EAAS;EAAS;CAAO,CAAC;CAC1D,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,SAAS,OAAO;CAChB,OAAO,OAAO,SAAS,OAAO,MAAM;AACrC,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,kBACL,OACA,UAOA,IAAI,eAAe;CAClB;CACA,YAAY,MAAM;CAClB,aAAa,MAAM;CACnB,SAAS,MAAM;CACf,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAC3D,CAAC;AAmBF,MAAa,uBAAuB,WAA2B;CAC9D,MAAM,QAAQ,OAAO,MAAM,IAAI;CAC/B,MAAM,MAAqB,CAAC;CAC5B,IAAI,WAAW;CACf,KAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,UAAU,KAAK,UAAU;EAC/B,IAAI,QAAQ,WAAW,GAAG,GAAG;GAC5B,MAAM,SAAS,QAAQ,QAAQ,QAAQ,EAAE;GACzC,IAAI,OAAO,WAAW,UAAU,KAAK,WAAW,WAAW,OAAO,WAAW,OAAO,GAAG;IACtF,WAAW;IACX;GACD;GACA,WAAW;EACZ;EACA,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI;CAC7B;CACA,IAAI,YAAY,OAAO,SAAS,IAAI,KAAK,IAAI,GAAG,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE;CACvE,OAAO,IAAI,KAAK,IAAI;AACrB;AAEA,MAAa,6BAA6B;CACzC;CACA;CACA;AACD,CAAC,CAAC,KAAK,IAAI;AAEX,MAAa,6BAA6B,eAAuB,iBAAiC;CAajG,OAAO;EAAC,4BAZM,2BAA2B,MAAM,IAAI,CAAC,CAClD,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CACpB,KAAK,GACuC,EAAE;EASjC,QAPN,cAAc;EAOC,QAHf,aAAa,iBAAiB,aAAa;CAGnB,CAAC,CAAC,KAAK,IAAI;AAC7C;AAEA,MAAa,cAAc,MAAsB,IAAI,EAAE,WAAW,KAAK,OAAO,EAAE;AAEhF,MAAa,uBAAuB,SAAyB;CAC5D,MAAM,UAAU,KAAK,KAAK;CAC1B,IAAI,QAAQ,WAAW,GAAG,GAAG,OAAO;CACpC,MAAM,MAAM,QAAQ,YAAY,GAAG;CACnC,IAAI,QAAQ,IAAI,OAAO;CACvB,OAAO,QAAQ,MAAM,GAAG;AACzB;AAEA,MAAa,wBAAwB,YAA4B;CA6BhE,MAAM,YAAY,WAAW,OAAO;CACpC,MAAM,cAAc;CACpB,MAAM,aAAa,GAAG,YAAY,GAAG;CACrC,MAAM,QAAQ,UAAU,YAAY,eAAe,YAAY,yBAAyB,YAAY;CAKpG,MAAM,QAAQ,0BAA0B,aAAa,aAAa;CAMlE,OAAO;EACN;EACA;EACA;EACA;EACA,yBATyB,WAAW;EAUpC;EACA;EACA;EACA,UAVyB;EAWzB;CACD,CAAC,CAAC,KAAK,IAAI;AACZ;AAEA,MAAM,gBAAgB,SACrB,SAAS,eAAe,SAAS,eAAe,KAAK,SAAS,OAAO;AAEtE,MAAM,gBAAgB,SACrB,SAAS,WAAW,SAAS,kBAAkB,SAAS,UAAU,KAAK,WAAW,GAAG;AAEtF,MAAM,uBAAuB,OAAO,SAAiD;CACpF,MAAM,MAAqB,CAAC;CAC5B,MAAM,OAAO,OAAO,QAA+B;EAClD,IAAI,UAIC,CAAC;EACN,IAAI;GACH,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;EACrD,QAAQ;GACP;EACD;EACA,KAAK,MAAM,SAAS,SACnB,IAAI,MAAM,YAAY,GAAG;GACxB,IAAI,aAAa,MAAM,IAAI,GAAG;GAC9B,MAAM,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC;EACjC,OAAO,IAAI,MAAM,OAAO,KAAK,aAAa,MAAM,IAAI,GAAG;GACtD,MAAM,MAAM,KAAK,KAAK,MAAM,IAAI;GAChC,IAAI;IACH,MAAM,OAAO,MAAM,MAAM,GAAG;IAC5B,IAAI,KAAK,OAAO,KAAK,CAAC,KAAK,eAAe,GAAG,IAAI,KAAK,GAAG;GAC1D,QAAQ,CAER;EACD;CAEF;CACA,MAAM,KAAK,IAAI;CACf,OAAO;AACR;AAEA,MAAa,mBAAmB,eAC/B,OAAO,WAAW;CACjB,KAAK,YAAkC;EAEtC,MAAM,SAAS,CAAC,GAAG,MADC,qBAAqB,UAAU,CAC3B,CAAC,CAAC,MAAM,GAAG,MAClC,SAAS,YAAY,CAAC,CAAC,CAAC,cAAc,SAAS,YAAY,CAAC,CAAC,CAC9D;EACA,MAAM,SAAS,WAAW,QAAQ;EAClC,KAAK,MAAM,OAAO,QAAQ;GACzB,MAAM,MAAM,SAAS,YAAY,GAAG;GACpC,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM;GACtC,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc,oBAAoB,GAAG,IAAI;GAC9E,OAAO,OAAO,GAAG;GACjB,OAAO,OAAO,IAAI;GAClB,OAAO,OAAO,UAAU;GACxB,OAAO,OAAO,IAAI;EACnB;EACA,OAAO,YAAY,OAAO,OAAO,KAAK,CAAC;CACxC;CACA,QAAQ,UACP,eAAe,QAAQ;EACtB;EACA,aAAa;EACb,SAAS,4BAA4B,OAAQ,OAAiB,WAAW,KAAK;EAC9E;CACD,CAAC;AACH,CAAC;AAEF,MAAM,cAAc,MACnB,EAAE,WAAW,IAAI,IAAI,KAAK,QAAQ,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,MAAM,QAAQ,IAAI;AAE5E,MAAM,oBAAoB,OAAO,SAAiD;CACjF,MAAM,MAAqB,CAAC;CAC5B,MAAM,OAAO,OAAO,QAA+B;EAClD,IAAI,UAIC,CAAC;EACN,IAAI;GACH,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;EACrD,QAAQ;GACP;EACD;EACA,KAAK,MAAM,SAAS,SAAS;GAC5B,IAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,UAAU,MAAM,SAAS,SAC5E;GAED,MAAM,QAAQ,KAAK,KAAK,MAAM,IAAI;GAClC,IAAI,MAAM,YAAY,GACrB,MAAM,KAAK,KAAK;QACV,IAAI,MAAM,OAAO,KAAK,MAAM,SAAS,aAC3C,IAAI;IACH,MAAM,OAAO,MAAM,MAAM,KAAK;IAC9B,IAAI,KAAK,OAAO,KAAK,CAAC,KAAK,eAAe,GAAG,IAAI,KAAK,KAAK;GAC5D,QAAQ,CAER;EAEF;CACD;CACA,MAAM,KAAK,IAAI;CACf,OAAO;AACR;AAEA,MAAM,mBAAmB,OAAO,SAAgC;CAC/D,MAAM,WAAW,MAAM,SAAS,MAAM,MAAM;CAC5C,MAAM,WAAW,oBAAoB,QAAQ;CAC7C,IAAI,aAAa,UAAU;CAC3B,MAAM,UAAU,MAAM,UAAU,MAAM;AACvC;AAEA,MAAM,uBAAuB,OAAO,SAAgC;CACnE,MAAM,cAAc,MAAM,kBAAkB,IAAI;CAChD,KAAK,MAAM,KAAK,aACf,IAAI;EACH,MAAM,iBAAiB,CAAC;CACzB,QAAQ,CAER;AAEF;AAQA,MAAa,kBACZ,YACA,iBAEA,OAAO,WAAW;CACjB,KAAK,YAAY;EAEhB,MAAM,WAAW,KADA,WAAW,YACC,GAAG,KAAK;EACrC,IAAI;GACH,MAAM,MAAM,QAAQ;EACrB,QAAQ;GACP;EACD;EACA,MAAM,qBAAqB,QAAQ;CACpC;CACA,QAAQ,UACP,eAAe,SAAS;EACvB;EACA,aAAa;EACb,SAAS,iCAAiC,aAAa;EACvD;CACD,CAAC;AACH,CAAC;AAeF,MAAM,gBAAgB,UAAU,WAAW,CAAC;;;;;;AAO5C,MAAa,qBACZ,WAC4B,cAAc,WAAW,MAAM;AAE5D,MAAM,qBAAqB,OAAO,OAAO;CACxC,SAAS,OAAO,MAAM,OAAO,MAAM;CACnC,cAAc,OAAO,MAAM,OAAO,MAAM;AACzC,CAAC;AAED,MAAM,sBAAsB,MAC3B,WAAW,KAAK,WAAW,OAAO,KAAK,GAAG,QAAQ,CAAC;AAEpD,MAAa,oBACZ,QACA,YACA,gBAEA,OAAO,IAAI;CACV,WAAwB;EAEvB,MAAM,SAAS,mBAAmB,oBADlB,oBAAoB,MACwB,GAAG;GAC9D,QAAQ;GACR,SAAS;GACT,UAAU,UAAU,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,CAAC;EACpE,CAAC;EAGD,OAAO;GAAE,SAFO,OAAO,QAAQ,KAAK,MAAM,mBAAmB,CAAC,CAE/C;GAAG,cADG,OAAO;EACG;CAChC;CACA,QAAQ,UACP,eAAe,SAAS;EACvB;EACA;EACA,SAAS,0CAA0C,OAAQ,OAAiB,WAAW,KAAK;EAC5F;CACD,CAAC;AACH,CAAC;AAEF,MAAM,kBACL,IACA,QACA,YACA,gBAEA,eAAe,SAAS;CACvB;CACA;CACA,SACC,GAAG,GAAG,yBAAyB,OAAO,SAAS,gBAAgB,YAAY,cAChE,OAAO,UAAU,UAAU,mBACpB,OAAO,OAAO,MAAM,IAAI,KAAK;AACjD,CAAC;AAEF,MAAM,6BACL,UACA,YACA,gBAEA,OAAO,WAAW;CACjB,WAAW,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;CAC9C,QAAQ,UACP,eAAe,SAAS;EACvB;EACA;EACA,SAAS,6CAA6C,SAAS;EAC/D;CACD,CAAC;AACH,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;AAEtB,MAAM,yBACL,QACA,OAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,CAAC,KACpD,OAAO,UACL,QACA,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,mCAAmC,OAC1C,KAA0C,OAAO,WAAW,GAC9D;EACA,OAAO;CACR,CAAC,CACH,CACD;CACA,IAAI,OAAO,aAAa,GACvB,OAAO,OAAO,OAAO,KACpB,eAAe,eAAe,QAAQ,OAAO,YAAY,OAAO,WAAW,CAC5E;CAED,OAAO,OAAO,iBAAiB,OAAO,QAAQ,OAAO,YAAY,OAAO,WAAW;AACpF,CAAC;;AAGF,MAAM,oBAAoB;;;;;;;;;AAU1B,MAAa,oBAAoB,OAChC,YACA,eACA,gBACmB;CACnB,MAAM,SAAS,IAAI,IAAY,CAAC,UAAU,CAAC;CAC3C,MAAM,OAAO,OAAO,QAAgB,cAAqC;EACxE,IAAI;EACJ,IAAI;GACH,OAAO,MAAM,SAAS,KAAK,QAAQ,WAAW,GAAG,MAAM;EACxD,QAAQ;GACP;EACD;EACA,KAAK,MAAM,SAAS,KAAK,SAAS,iBAAiB,GAAG;GACrD,MAAM,MAAM,MAAM;GAClB,MAAM,SAAS,QAAQ,QAAQ,GAAG;GAClC,MAAM,YAAY,QAAQ,WAAW,GAAG;GACxC,IAAI,cAAc,eAAe,CAAC,UAAU,WAAW,cAAc,GAAG,GACvE,MAAM,IAAI,MACT,0BAA0B,IAAI,QAAQ,SAAS,MAAM,EAAE,2FAExD;GAED,IAAI,OAAO,IAAI,MAAM,GACpB;GAED,OAAO,IAAI,MAAM;GACjB,MAAM,GAAG,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;GAC/C,MAAM,KAAK,QAAQ,SAAS;EAC7B;CACD;CACA,MAAM,KAAK,YAAY,aAAa;AACrC;;AAGA,MAAM,sBACL,YACA,eACA,aACA,WAEA,OAAO,WAAW;CACjB,WAAW,kBAAkB,YAAY,eAAe,WAAW;CACnE,QAAQ,UACP,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS;EACT;CACD,CAAC;AACH,CAAC;AAEF,MAAM,mBACL,QACA,SACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,SAAS,OAAO,UAAU;CAC1C,MAAM,QAAQ,qBAAqB,OAAO;CAC1C,MAAM,WAAW,KAAK,QAAQ,GAAG,OAAO;CACxC,OAAO,0BAA0B,UAAU,OAAO,YAAY,OAAO,WAAW;CAShF,MAAM,cAAc,OAAO,OAAO,eACjC,OAAO,WAAW;EACjB,WAAW,QAAQ,KAAK,OAAO,GAAG,cAAc,iBAAiB,EAAE,EAAE,EAAE,CAAC;EACxE,QAAQ,UACP,eAAe,SAAS;GACvB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,SAAS;GACT;EACD,CAAC;CACH,CAAC,IACA,QAAQ,OAAO,cAAc,GAAG,KAAK;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC,CAAC,CACxE;CACA,MAAM,gBAAgB,KAAK,aAAa,OAAO;CAC/C,OAAO,OAAO,WAAW;EACxB,WAAW,GAAG,OAAO,YAAY,eAAe,EAAE,WAAW,KAAK,CAAC;EACnE,QAAQ,UACP,eAAe,SAAS;GACvB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,SAAS,wDAAwD,cAAc;GAC/E;EACD,CAAC;CACH,CAAC;CAID,OAAO,mBAAmB,OAAO,YAAY,eAAe,aAAa,MAAM;CAE/E,MAAM,SAAS,OAAO,QACpB,WAAW;EACX;EACA,YAAY;EACZ,MAAM,CAAC,MAAM,KAAK;EAClB,QAAQ,CACP;GAAE,QAAQ;GAAa,QAAQ;EAAa,GAC5C;GAAE,QAAQ;GAAU,QAAQ;EAAc,CAC3C;EACA,eAAe,IAAI;CACpB,CAAC,CAAC,CACD,KACA,OAAO,UACL,QACA,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,8BAA8B,IAAI,OAAO,IAAI,IAAI;EAC1D,OAAO;CACR,CAAC,CACH,CACD;CACD,IAAI,OAAO,aAAa,GACvB,OAAO,OAAO,OAAO,KACpB,eAAe,mBAAmB,QAAQ,OAAO,YAAY,OAAO,WAAW,CAChF;CAED,OAAO,OAAO,iBAAiB,OAAO,QAAQ,OAAO,YAAY,OAAO,WAAW;AACpF,CAAC;AAEF,MAAa,gBACZ,WAC6D;CAC7D,IAAI,OAAO,mBAAmB,KAAA,GAC7B,OAAO,sBAAsB,QAAQ,OAAO,cAAc;CAE3D,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,eAAe,KAAA,GACzD,OAAO,gBAAgB,QAAQ,OAAO,SAAS,OAAO,UAAU;CAEjE,OAAO,OAAO,KACb,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SACC;CAEF,CAAC,CACF;AACD"}

package/dist/plugins/sui/move-summary-runner.mjs

@@ -2,7 +2,7 @@ import { capture } from "../../substrate/runtime/observability/subprocess-captur
 import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
 import { CodegenBindingsFailed } from "../../orchestrators/codegen/errors.mjs";
 import { MoveSummaryRunnerService } from "../../orchestrators/codegen/bindings.mjs";
-import { copyLocalMoveDeps, shellQuote, suiCliImageBuildContext } from "../../substrate/runtime/sui-move-build/index.mjs";
+import { copyLocalMoveDeps, shellQuote, suiCliImageBuildContext } from "./move/index.mjs";
 import { Effect, Layer } from "effect";
 import { basename, dirname, join } from "node:path";
 import { homedir, tmpdir } from "node:os";
@@ -13,7 +13,7 @@ const layerSuiMoveSummaryRunnerDocker = Layer.effect(MoveSummaryRunnerService, E
 	const runtime = yield* ContainerRuntimeService;
 	return MoveSummaryRunnerService.of({ runSummary: (input) => runSummaryViaDocker(runtime, input) });
 }));
-Layer.effect(MoveSummaryRunnerService, Effect.gen(function* () {
+const layerSuiMoveSummaryRunnerHost = Layer.effect(MoveSummaryRunnerService, Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	return MoveSummaryRunnerService.of({ runSummary: ({ packageName, sourcePath }) => Effect.gen(function* () {
 		const scratchDir = yield* Effect.tryPromise({
@@ -43,6 +43,7 @@ Layer.effect(MoveSummaryRunnerService, Effect.gen(function* () {
 						await mkdir(summaryPath, { recursive: true });
 						await cp(sourcePath, stagedPkg, { recursive: true });
 						await copyLocalMoveDeps(sourcePath, stagedPkg, dirname(stagedPkg));
+						await cp(join(sourcePath, "Move.toml"), join(summaryPath, "Move.toml")).catch(() => {});
 					},
 					catch: (cause) => new CodegenBindingsFailed({
 						package: packageName,
@@ -152,7 +153,10 @@ const makeSummaryScratch = (input) => Effect.tryPromise({
 	})
 });
 const prepareSummaryPackage = (summaryPath, input) => Effect.tryPromise({
-	try: () => mkdir(summaryPath, { recursive: true }).then(() => void 0),
+	try: async () => {
+		await mkdir(summaryPath, { recursive: true });
+		await cp(join(input.sourcePath, "Move.toml"), join(summaryPath, "Move.toml")).catch(() => {});
+	},
 	catch: (cause) => new CodegenBindingsFailed({
 		package: input.packageName,
 		sourcePath: input.sourcePath,
@@ -202,6 +206,6 @@ const parseSummaryStdout = (stdout) => {
 	}
 };
 //#endregion
-export { layerSuiMoveSummaryRunnerDocker };
+export { layerSuiMoveSummaryRunnerDocker, layerSuiMoveSummaryRunnerHost };
 
 //# sourceMappingURL=move-summary-runner.mjs.map

package/dist/plugins/sui/move-summary-runner.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"move-summary-runner.mjs","names":[],"sources":["../../../src/plugins/sui/move-summary-runner.ts"],"sourcesContent":["// Sui plugin — Move-summary runner Layer factories.\n//\n// The codegen orchestrator (L3) consumes an abstract\n// `MoveSummaryRunnerService`; it does NOT know which CLI image or\n// host binary produces the summary JSON. Both production\n// implementations live here because they encode Sui-specific\n// knowledge (the `sui` binary name, the Sui CLI image, the\n// `sui move summary` argv shape).\n//\n// Architecture: per \"Orchestrator boundaries — never names a\n// service\", the codegen orchestrator imports only the abstract\n// `MoveSummaryRunnerService` from its `bindings.ts`; the runtime\n// composer wires one of these sui-plugin layers in.\n//\n// Implementations:\n//   - `layerSuiMoveSummaryRunnerDocker` — runs `sui move summary`\n//     inside the Sui CLI container image; the default production\n//     wiring (`runtime-composition.ts`).\n//   - `layerSuiMoveSummaryRunnerHost` — runs the local `sui`\n//     binary directly via `ChildProcessSpawner`. Useful for\n//     embedders that already have a Sui CLI on PATH.\n\nimport { cp, mkdir, mkdtemp, rm } from 'node:fs/promises';\nimport { homedir, tmpdir } from 'node:os';\nimport { basename, dirname, join } from 'node:path';\n\nimport { Effect, Layer } from 'effect';\nimport { ChildProcess, ChildProcessSpawner } from 'effect/unstable/process';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\ttype MoveSummary,\n\ttype MoveSummaryInput,\n\tMoveSummaryRunnerService,\n} from '../../orchestrators/codegen/bindings.ts';\nimport { CodegenBindingsFailed } from '../../orchestrators/codegen/errors.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport { capture } from '../../substrate/runtime/observability/subprocess-capture.ts';\nimport {\n\tcopyLocalMoveDeps,\n\tshellQuote,\n\tsuiCliImageBuildContext,\n} from '../../substrate/runtime/sui-move-build/index.ts';\n\n// -----------------------------------------------------------------------------\n// Docker variant — `sui move summary` inside the Sui CLI container image.\n// -----------------------------------------------------------------------------\n\nexport const layerSuiMoveSummaryRunnerDocker: Layer.Layer<\n\tMoveSummaryRunnerService,\n\tnever,\n\tContainerRuntimeService\n> = Layer.effect(\n\tMoveSummaryRunnerService,\n\tEffect.gen(function* () {\n\t\tconst runtime: ContainerRuntime = yield* ContainerRuntimeService;\n\t\treturn MoveSummaryRunnerService.of({\n\t\t\trunSummary: (input) => runSummaryViaDocker(runtime, input),\n\t\t});\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Host-binary variant — invoke a `sui` CLI on PATH directly.\n// -----------------------------------------------------------------------------\n\nexport const layerSuiMoveSummaryRunnerHost: Layer.Layer<\n\tMoveSummaryRunnerService,\n\tnever,\n\tChildProcessSpawner.ChildProcessSpawner\n> = Layer.effect(\n\tMoveSummaryRunnerService,\n\tEffect.gen(function* () {\n\t\tconst spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n\t\treturn MoveSummaryRunnerService.of({\n\t\t\trunSummary: ({ packageName, sourcePath }) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst scratchDir = yield* Effect.tryPromise({\n\t\t\t\t\t\ttry: () => mkdtemp(join(tmpdir(), 'devstack-move-summary-')),\n\t\t\t\t\t\tcatch: (cause) =>\n\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\thint: 'Unable to create a temporary directory for Move summary output.',\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t});\n\t\t\t\t\tconst summaryPath = join(scratchDir, 'package');\n\t\t\t\t\t// Run summary inside a disposable copy of the package, never the\n\t\t\t\t\t// developer's real source — `sui move summary` rewrites Move.lock.\n\t\t\t\t\tconst stagedPkg = join(scratchDir, 'src');\n\t\t\t\t\tconst cleanupScratch = Effect.promise(() =>\n\t\t\t\t\t\trm(scratchDir, { recursive: true, force: true }),\n\t\t\t\t\t).pipe(Effect.ignore);\n\t\t\t\t\tconst result = yield* Effect.gen(function* () {\n\t\t\t\t\t\tyield* Effect.tryPromise({\n\t\t\t\t\t\t\ttry: async () => {\n\t\t\t\t\t\t\t\tawait mkdir(summaryPath, { recursive: true });\n\t\t\t\t\t\t\t\tawait cp(sourcePath, stagedPkg, { recursive: true });\n\t\t\t\t\t\t\t\t// Stage local relative deps so `sui move summary` resolves them.\n\t\t\t\t\t\t\t\tawait copyLocalMoveDeps(sourcePath, stagedPkg, dirname(stagedPkg));\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tcatch: (cause) =>\n\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\thint: 'Unable to stage a disposable copy of the Move package for summary.',\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tconst cmd = ChildProcess.make(\n\t\t\t\t\t\t\t'sui',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'move',\n\t\t\t\t\t\t\t\t'summary',\n\t\t\t\t\t\t\t\t'--path',\n\t\t\t\t\t\t\t\t'.',\n\t\t\t\t\t\t\t\t'--install-dir',\n\t\t\t\t\t\t\t\tjoin(scratchDir, 'install'),\n\t\t\t\t\t\t\t\t'--output-directory',\n\t\t\t\t\t\t\t\tjoin(summaryPath, 'package_summaries'),\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t{ cwd: stagedPkg },\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* capture(spawner, cmd, {\n\t\t\t\t\t\t\top: `sui move summary (${sourcePath})`,\n\t\t\t\t\t\t\tnonZeroIsFailure: true,\n\t\t\t\t\t\t\tstdoutTruncate: Infinity,\n\t\t\t\t\t\t\tstderrTruncate: 4_000,\n\t\t\t\t\t\t}).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\t\thint: 'Install the Sui CLI and ensure this Move package can run `sui move summary`.',\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}).pipe(Effect.tapError(() => cleanupScratch));\n\t\t\t\t\treturn {\n\t\t\t\t\t\tpackageName,\n\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\tsummaryPath,\n\t\t\t\t\t\tcleanupPath: scratchDir,\n\t\t\t\t\t\tsummaryJson: parseSummaryStdout(result.stdout),\n\t\t\t\t\t};\n\t\t\t\t}),\n\t\t});\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Docker-variant helpers — shared with `runSummaryViaDocker`.\n// -----------------------------------------------------------------------------\n\nconst runSummaryViaDocker = (\n\truntime: ContainerRuntime,\n\tinput: MoveSummaryInput,\n): Effect.Effect<MoveSummary, CodegenBindingsFailed> =>\n\tEffect.scoped(\n\t\tEffect.gen(function* () {\n\t\t\tconst scratchDir = yield* makeSummaryScratch(input);\n\t\t\tconst summaryPath = join(scratchDir, 'package');\n\t\t\tconst cleanupScratch = Effect.promise(() =>\n\t\t\t\trm(scratchDir, { recursive: true, force: true }),\n\t\t\t).pipe(Effect.ignore);\n\t\t\tconst result = yield* Effect.gen(function* () {\n\t\t\t\tyield* prepareSummaryPackage(summaryPath, input);\n\t\t\t\tconst image = input.buildImage ?? (yield* resolveDefaultSummaryImage(runtime, input));\n\t\t\t\tconst moveHome = join(homedir(), '.move');\n\t\t\t\tyield* ensureMoveHome(moveHome, input);\n\t\t\t\tconst packageDir = basename(input.sourcePath);\n\t\t\t\t// Mount a disposable staged copy at /workspace, never the real source\n\t\t\t\t// tree — `sui move summary` rewrites Move.lock during resolution.\n\t\t\t\tconst stagedRoot = join(scratchDir, 'src');\n\t\t\t\tyield* stageSummarySource(input, join(stagedRoot, packageDir));\n\t\t\t\tconst hostUid = typeof process.getuid === 'function' ? process.getuid() : 0;\n\t\t\t\tconst hostGid = typeof process.getgid === 'function' ? process.getgid() : 0;\n\t\t\t\tconst command = [\n\t\t\t\t\t'set -e',\n\t\t\t\t\t'cleanup_summary() { status=$?; ' +\n\t\t\t\t\t\t'chmod -R a+rwX /summary /workspace 2>/dev/null || true; ' +\n\t\t\t\t\t\t`chown -R ${hostUid}:${hostGid} /summary /workspace 2>/dev/null || true; ` +\n\t\t\t\t\t\t'exit \"$status\"; }',\n\t\t\t\t\t'trap cleanup_summary EXIT',\n\t\t\t\t\t'mkdir -p /summary/package_summaries',\n\t\t\t\t\t`sui move summary --path /workspace/${shellQuote(packageDir)} ` +\n\t\t\t\t\t\t'--install-dir /tmp/devstack-move-summary-install ' +\n\t\t\t\t\t\t'--output-directory /summary/package_summaries',\n\t\t\t\t].join('; ');\n\t\t\t\tconst run = yield* runtime\n\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\timage,\n\t\t\t\t\t\tentrypoint: 'sh',\n\t\t\t\t\t\targv: ['-c', command],\n\t\t\t\t\t\tmounts: [\n\t\t\t\t\t\t\t{ source: stagedRoot, target: '/workspace' },\n\t\t\t\t\t\t\t{ source: summaryPath, target: '/summary' },\n\t\t\t\t\t\t\t{ source: moveHome, target: '/root/.move' },\n\t\t\t\t\t\t],\n\t\t\t\t\t\ttimeoutMillis: 5 * 60_000,\n\t\t\t\t\t})\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\thint: 'Docker runtime failed while running `sui move summary` for bindings codegen.',\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\tif (run.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t`sui move summary exited ${run.exitCode}. ` +\n\t\t\t\t\t\t\t\t`stderr: ${run.stderr || '(empty)'}; stdout tail: ${\n\t\t\t\t\t\t\t\t\trun.stdout.slice(-400) || '(empty)'\n\t\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn run;\n\t\t\t}).pipe(Effect.tapError(() => cleanupScratch));\n\t\t\treturn {\n\t\t\t\tpackageName: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\tsummaryPath,\n\t\t\t\tcleanupPath: scratchDir,\n\t\t\t\tsummaryJson: parseSummaryStdout(result.stdout),\n\t\t\t};\n\t\t}),\n\t);\n\nconst makeSummaryScratch = (\n\tinput: MoveSummaryInput,\n): Effect.Effect<string, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdtemp(join(tmpdir(), 'devstack-move-summary-')),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to create a temporary directory for Move summary output.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst prepareSummaryPackage = (\n\tsummaryPath: string,\n\tinput: MoveSummaryInput,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\t// Only create the OUTPUT mount dir; the package itself is mounted from a\n\t\t// disposable staged copy (see `stageSummarySource`), never the real source.\n\t\ttry: () => mkdir(summaryPath, { recursive: true }).then(() => undefined),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to prepare a temporary Move summary output directory.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n// Stage a disposable copy of the Move package. `sui move summary` rewrites\n// `Move.lock` during dependency resolution, so running it against the\n// developer's real checked-in tree would dirty their working copy. The copy\n// lives under the scoped scratch dir and is reaped with it.\nconst stageSummarySource = (\n\tinput: MoveSummaryInput,\n\tstagedPkg: string,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tawait mkdir(dirname(stagedPkg), { recursive: true });\n\t\t\tawait cp(input.sourcePath, stagedPkg, { recursive: true });\n\t\t\t// Bring local `../` deps (`{ local = \"../token\" }`) into the staged\n\t\t\t// tree so `sui move summary` resolves them (mirrors the build path).\n\t\t\tawait copyLocalMoveDeps(input.sourcePath, stagedPkg, dirname(stagedPkg));\n\t\t},\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to stage a disposable copy of the Move package for summary.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst resolveDefaultSummaryImage = (\n\truntime: ContainerRuntime,\n\tinput: MoveSummaryInput,\n): Effect.Effect<ImageRef, CodegenBindingsFailed> =>\n\t// Shared CLI image — owned at the daemon-level _per-app_ pin (see\n\t// `chain-build-container.ts:PER_APP_SHARED_STACK`), not per-stack;\n\t// the build container that materialises it carries the labels, so\n\t// `ensureImage` itself is intentionally label-free here.\n\truntime.ensureImage(suiCliImageBuildContext()).pipe(\n\t\tEffect.mapError(\n\t\t\t(cause) =>\n\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\thint: 'Unable to resolve the Sui CLI container image for Move bindings codegen.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t),\n\t);\n\nconst ensureMoveHome = (\n\tmoveHome: string,\n\tinput: MoveSummaryInput,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdir(moveHome, { recursive: true }),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: `Unable to create Move cache mount source \"${moveHome}\".`,\n\t\t\t\tcause,\n\t\t\t}),\n\t}).pipe(Effect.asVoid);\n\nconst parseSummaryStdout = (stdout: string): unknown => {\n\tconst trimmed = stdout.trim();\n\tif (trimmed.length === 0) return null;\n\ttry {\n\t\treturn JSON.parse(trimmed) as unknown;\n\t} catch {\n\t\treturn trimmed;\n\t}\n};\n"],"mappings":";;;;;;;;;;;AAgDA,MAAa,kCAIT,MAAM,OACT,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAA4B,OAAO;AACzC,QAAO,yBAAyB,GAAG,EAClC,aAAa,UAAU,oBAAoB,SAAS,MAAM,EAC1D,CAAC;EACD,CACF;AAUG,MAAM,OACT,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,oBAAoB;AAC3C,QAAO,yBAAyB,GAAG,EAClC,aAAa,EAAE,aAAa,iBAC3B,OAAO,IAAI,aAAa;EACvB,MAAM,aAAa,OAAO,OAAO,WAAW;GAC3C,WAAW,QAAQ,KAAK,QAAQ,EAAE,yBAAyB,CAAC;GAC5D,QAAQ,UACP,IAAI,sBAAsB;IACzB,SAAS;IACT;IACA,QAAQ;IACR,MAAM;IACN;IACA,CAAC;GACH,CAAC;EACF,MAAM,cAAc,KAAK,YAAY,UAAU;EAG/C,MAAM,YAAY,KAAK,YAAY,MAAM;EACzC,MAAM,iBAAiB,OAAO,cAC7B,GAAG,YAAY;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC,CAChD,CAAC,KAAK,OAAO,OAAO;AAkDrB,SAAO;GACN;GACA;GACA;GACA,aAAa;GACb,aAAa,oBAAmB,OAtDX,OAAO,IAAI,aAAa;AAC7C,WAAO,OAAO,WAAW;KACxB,KAAK,YAAY;AAChB,YAAM,MAAM,aAAa,EAAE,WAAW,MAAM,CAAC;AAC7C,YAAM,GAAG,YAAY,WAAW,EAAE,WAAW,MAAM,CAAC;AAEpD,YAAM,kBAAkB,YAAY,WAAW,QAAQ,UAAU,CAAC;;KAEnE,QAAQ,UACP,IAAI,sBAAsB;MACzB,SAAS;MACT;MACA,QAAQ;MACR,MAAM;MACN;MACA,CAAC;KACH,CAAC;AAeF,WAAO,OAAO,QAAQ,SAdV,aAAa,KACxB,OACA;KACC;KACA;KACA;KACA;KACA;KACA,KAAK,YAAY,UAAU;KAC3B;KACA,KAAK,aAAa,oBAAoB;KACtC,EACD,EAAE,KAAK,WAAW,CAEe,EAAE;KACnC,IAAI,qBAAqB,WAAW;KACpC,kBAAkB;KAClB,gBAAgB;KAChB,gBAAgB;KAChB,CAAC,CAAC,KACF,OAAO,UACL,UACA,IAAI,sBAAsB;KACzB,SAAS;KACT;KACA,QAAQ;KACR,MAAM;KACN;KACA,CAAC,CACH,CACD;KACA,CAAC,KAAK,OAAO,eAAe,eAAe,CAAC,EAMN,OAAO;GAC9C;GACA,EACH,CAAC;EACD,CACF;AAMD,MAAM,uBACL,SACA,UAEA,OAAO,OACN,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,mBAAmB,MAAM;CACnD,MAAM,cAAc,KAAK,YAAY,UAAU;CAC/C,MAAM,iBAAiB,OAAO,cAC7B,GAAG,YAAY;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC,CAChD,CAAC,KAAK,OAAO,OAAO;CACrB,MAAM,SAAS,OAAO,OAAO,IAAI,aAAa;AAC7C,SAAO,sBAAsB,aAAa,MAAM;EAChD,MAAM,QAAQ,MAAM,eAAe,OAAO,2BAA2B,SAAS,MAAM;EACpF,MAAM,WAAW,KAAK,SAAS,EAAE,QAAQ;AACzC,SAAO,eAAe,UAAU,MAAM;EACtC,MAAM,aAAa,SAAS,MAAM,WAAW;EAG7C,MAAM,aAAa,KAAK,YAAY,MAAM;AAC1C,SAAO,mBAAmB,OAAO,KAAK,YAAY,WAAW,CAAC;EAG9D,MAAM,UAAU;GACf;GACA,oGAJe,OAAO,QAAQ,WAAW,aAAa,QAAQ,QAAQ,GAAG,EAMpD,GALN,OAAO,QAAQ,WAAW,aAAa,QAAQ,QAAQ,GAAG,EAKzC;GAEhC;GACA;GACA,sCAAsC,WAAW,WAAW,CAAC;GAG7D,CAAC,KAAK,KAAK;EACZ,MAAM,MAAM,OAAO,QACjB,WAAW;GACX;GACA,YAAY;GACZ,MAAM,CAAC,MAAM,QAAQ;GACrB,QAAQ;IACP;KAAE,QAAQ;KAAY,QAAQ;KAAc;IAC5C;KAAE,QAAQ;KAAa,QAAQ;KAAY;IAC3C;KAAE,QAAQ;KAAU,QAAQ;KAAe;IAC3C;GACD,eAAe,IAAI;GACnB,CAAC,CACD,KACA,OAAO,UACL,UACA,IAAI,sBAAsB;GACzB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ;GACR,MAAM;GACN;GACA,CAAC,CACH,CACD;AACF,MAAI,IAAI,aAAa,EACpB,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;GACzB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ;GACR,MACC,2BAA2B,IAAI,SAAS,YAC7B,IAAI,UAAU,UAAU,iBAClC,IAAI,OAAO,MAAM,KAAK,IAAI;GAE5B,CAAC,CACF;AAEF,SAAO;GACN,CAAC,KAAK,OAAO,eAAe,eAAe,CAAC;AAC9C,QAAO;EACN,aAAa,MAAM;EACnB,YAAY,MAAM;EAClB;EACA,aAAa;EACb,aAAa,mBAAmB,OAAO,OAAO;EAC9C;EACA,CACF;AAEF,MAAM,sBACL,UAEA,OAAO,WAAW;CACjB,WAAW,QAAQ,KAAK,QAAQ,EAAE,yBAAyB,CAAC;CAC5D,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;EACA,CAAC;CACH,CAAC;AAEH,MAAM,yBACL,aACA,UAEA,OAAO,WAAW;CAGjB,WAAW,MAAM,aAAa,EAAE,WAAW,MAAM,CAAC,CAAC,WAAW,KAAA,EAAU;CACxE,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;EACA,CAAC;CACH,CAAC;AAMH,MAAM,sBACL,OACA,cAEA,OAAO,WAAW;CACjB,KAAK,YAAY;AAChB,QAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;AACpD,QAAM,GAAG,MAAM,YAAY,WAAW,EAAE,WAAW,MAAM,CAAC;AAG1D,QAAM,kBAAkB,MAAM,YAAY,WAAW,QAAQ,UAAU,CAAC;;CAEzE,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;EACA,CAAC;CACH,CAAC;AAEH,MAAM,8BACL,SACA,UAMA,QAAQ,YAAY,yBAAyB,CAAC,CAAC,KAC9C,OAAO,UACL,UACA,IAAI,sBAAsB;CACzB,SAAS,MAAM;CACf,YAAY,MAAM;CAClB,QAAQ;CACR,MAAM;CACN;CACA,CAAC,CACH,CACD;AAEF,MAAM,kBACL,UACA,UAEA,OAAO,WAAW;CACjB,WAAW,MAAM,UAAU,EAAE,WAAW,MAAM,CAAC;CAC/C,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM,6CAA6C,SAAS;EAC5D;EACA,CAAC;CACH,CAAC,CAAC,KAAK,OAAO,OAAO;AAEvB,MAAM,sBAAsB,WAA4B;CACvD,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,KAAI;AACH,SAAO,KAAK,MAAM,QAAQ;SACnB;AACP,SAAO"}
+{"version":3,"file":"move-summary-runner.mjs","names":[],"sources":["../../../src/plugins/sui/move-summary-runner.ts"],"sourcesContent":["// Sui plugin — Move-summary runner Layer factories.\n//\n// The codegen orchestrator (L3) consumes an abstract\n// `MoveSummaryRunnerService`; it does NOT know which CLI image or\n// host binary produces the summary JSON. Both production\n// implementations live here because they encode Sui-specific\n// knowledge (the `sui` binary name, the Sui CLI image, the\n// `sui move summary` argv shape).\n//\n// Architecture: per \"Orchestrator boundaries — never names a\n// service\", the codegen orchestrator imports only the abstract\n// `MoveSummaryRunnerService` from its `bindings.ts`; the runtime\n// composer wires one of these sui-plugin layers in.\n//\n// Implementations:\n//   - `layerSuiMoveSummaryRunnerDocker` — runs `sui move summary`\n//     inside the Sui CLI container image; the default production\n//     wiring (`orchestrators/boot.ts`).\n//   - `layerSuiMoveSummaryRunnerHost` — runs the local `sui`\n//     binary directly via `ChildProcessSpawner`. Useful for\n//     embedders that already have a Sui CLI on PATH.\n\nimport { cp, mkdir, mkdtemp, rm } from 'node:fs/promises';\nimport { homedir, tmpdir } from 'node:os';\nimport { basename, dirname, join } from 'node:path';\n\nimport { Effect, Layer } from 'effect';\nimport { ChildProcess, ChildProcessSpawner } from 'effect/unstable/process';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\ttype MoveSummary,\n\ttype MoveSummaryInput,\n\tMoveSummaryRunnerService,\n} from '../../orchestrators/codegen/bindings.ts';\nimport { CodegenBindingsFailed } from '../../orchestrators/codegen/errors.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport { capture } from '../../substrate/runtime/observability/subprocess-capture.ts';\nimport { copyLocalMoveDeps, shellQuote, suiCliImageBuildContext } from './move/index.ts';\n\n// -----------------------------------------------------------------------------\n// Docker variant — `sui move summary` inside the Sui CLI container image.\n// -----------------------------------------------------------------------------\n\nexport const layerSuiMoveSummaryRunnerDocker: Layer.Layer<\n\tMoveSummaryRunnerService,\n\tnever,\n\tContainerRuntimeService\n> = Layer.effect(\n\tMoveSummaryRunnerService,\n\tEffect.gen(function* () {\n\t\tconst runtime: ContainerRuntime = yield* ContainerRuntimeService;\n\t\treturn MoveSummaryRunnerService.of({\n\t\t\trunSummary: (input) => runSummaryViaDocker(runtime, input),\n\t\t});\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Host-binary variant — invoke a `sui` CLI on PATH directly.\n// -----------------------------------------------------------------------------\n\nexport const layerSuiMoveSummaryRunnerHost: Layer.Layer<\n\tMoveSummaryRunnerService,\n\tnever,\n\tChildProcessSpawner.ChildProcessSpawner\n> = Layer.effect(\n\tMoveSummaryRunnerService,\n\tEffect.gen(function* () {\n\t\tconst spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n\t\treturn MoveSummaryRunnerService.of({\n\t\t\trunSummary: ({ packageName, sourcePath }) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst scratchDir = yield* Effect.tryPromise({\n\t\t\t\t\t\ttry: () => mkdtemp(join(tmpdir(), 'devstack-move-summary-')),\n\t\t\t\t\t\tcatch: (cause) =>\n\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\thint: 'Unable to create a temporary directory for Move summary output.',\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t});\n\t\t\t\t\tconst summaryPath = join(scratchDir, 'package');\n\t\t\t\t\t// Run summary inside a disposable copy of the package, never the\n\t\t\t\t\t// developer's real source — `sui move summary` rewrites Move.lock.\n\t\t\t\t\tconst stagedPkg = join(scratchDir, 'src');\n\t\t\t\t\tconst cleanupScratch = Effect.promise(() =>\n\t\t\t\t\t\trm(scratchDir, { recursive: true, force: true }),\n\t\t\t\t\t).pipe(Effect.ignore);\n\t\t\t\t\tconst result = yield* Effect.gen(function* () {\n\t\t\t\t\t\tyield* Effect.tryPromise({\n\t\t\t\t\t\t\ttry: async () => {\n\t\t\t\t\t\t\t\tawait mkdir(summaryPath, { recursive: true });\n\t\t\t\t\t\t\t\tawait cp(sourcePath, stagedPkg, { recursive: true });\n\t\t\t\t\t\t\t\t// Stage local relative deps so `sui move summary` resolves them.\n\t\t\t\t\t\t\t\tawait copyLocalMoveDeps(sourcePath, stagedPkg, dirname(stagedPkg));\n\t\t\t\t\t\t\t\t// Place the source manifest beside the emitted summary: it\n\t\t\t\t\t\t\t\t// is the dir we hand `@mysten/codegen`, which reads\n\t\t\t\t\t\t\t\t// `Move.toml` there for its `[addresses]` labels. Without\n\t\t\t\t\t\t\t\t// it the library logs \"Failed to read Move.toml for <dir>\"\n\t\t\t\t\t\t\t\t// and falls back to `packageName`; with it the read\n\t\t\t\t\t\t\t\t// succeeds (warning gone) and its native main-package\n\t\t\t\t\t\t\t\t// resolution works. Best-effort — a manifest-less source\n\t\t\t\t\t\t\t\t// just keeps the prior fallback.\n\t\t\t\t\t\t\t\tawait cp(join(sourcePath, 'Move.toml'), join(summaryPath, 'Move.toml')).catch(\n\t\t\t\t\t\t\t\t\t() => {},\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tcatch: (cause) =>\n\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\thint: 'Unable to stage a disposable copy of the Move package for summary.',\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tconst cmd = ChildProcess.make(\n\t\t\t\t\t\t\t'sui',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'move',\n\t\t\t\t\t\t\t\t'summary',\n\t\t\t\t\t\t\t\t'--path',\n\t\t\t\t\t\t\t\t'.',\n\t\t\t\t\t\t\t\t'--install-dir',\n\t\t\t\t\t\t\t\tjoin(scratchDir, 'install'),\n\t\t\t\t\t\t\t\t'--output-directory',\n\t\t\t\t\t\t\t\tjoin(summaryPath, 'package_summaries'),\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t{ cwd: stagedPkg },\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* capture(spawner, cmd, {\n\t\t\t\t\t\t\top: `sui move summary (${sourcePath})`,\n\t\t\t\t\t\t\tnonZeroIsFailure: true,\n\t\t\t\t\t\t\tstdoutTruncate: Infinity,\n\t\t\t\t\t\t\tstderrTruncate: 4_000,\n\t\t\t\t\t\t}).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\t\tpackage: packageName,\n\t\t\t\t\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\t\thint: 'Install the Sui CLI and ensure this Move package can run `sui move summary`.',\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}).pipe(Effect.tapError(() => cleanupScratch));\n\t\t\t\t\treturn {\n\t\t\t\t\t\tpackageName,\n\t\t\t\t\t\tsourcePath,\n\t\t\t\t\t\tsummaryPath,\n\t\t\t\t\t\tcleanupPath: scratchDir,\n\t\t\t\t\t\tsummaryJson: parseSummaryStdout(result.stdout),\n\t\t\t\t\t};\n\t\t\t\t}),\n\t\t});\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Docker-variant helpers — shared with `runSummaryViaDocker`.\n// -----------------------------------------------------------------------------\n\nconst runSummaryViaDocker = (\n\truntime: ContainerRuntime,\n\tinput: MoveSummaryInput,\n): Effect.Effect<MoveSummary, CodegenBindingsFailed> =>\n\tEffect.scoped(\n\t\tEffect.gen(function* () {\n\t\t\tconst scratchDir = yield* makeSummaryScratch(input);\n\t\t\tconst summaryPath = join(scratchDir, 'package');\n\t\t\tconst cleanupScratch = Effect.promise(() =>\n\t\t\t\trm(scratchDir, { recursive: true, force: true }),\n\t\t\t).pipe(Effect.ignore);\n\t\t\tconst result = yield* Effect.gen(function* () {\n\t\t\t\tyield* prepareSummaryPackage(summaryPath, input);\n\t\t\t\tconst image = input.buildImage ?? (yield* resolveDefaultSummaryImage(runtime, input));\n\t\t\t\tconst moveHome = join(homedir(), '.move');\n\t\t\t\tyield* ensureMoveHome(moveHome, input);\n\t\t\t\tconst packageDir = basename(input.sourcePath);\n\t\t\t\t// Mount a disposable staged copy at /workspace, never the real source\n\t\t\t\t// tree — `sui move summary` rewrites Move.lock during resolution.\n\t\t\t\tconst stagedRoot = join(scratchDir, 'src');\n\t\t\t\tyield* stageSummarySource(input, join(stagedRoot, packageDir));\n\t\t\t\tconst hostUid = typeof process.getuid === 'function' ? process.getuid() : 0;\n\t\t\t\tconst hostGid = typeof process.getgid === 'function' ? process.getgid() : 0;\n\t\t\t\tconst command = [\n\t\t\t\t\t'set -e',\n\t\t\t\t\t'cleanup_summary() { status=$?; ' +\n\t\t\t\t\t\t'chmod -R a+rwX /summary /workspace 2>/dev/null || true; ' +\n\t\t\t\t\t\t`chown -R ${hostUid}:${hostGid} /summary /workspace 2>/dev/null || true; ` +\n\t\t\t\t\t\t'exit \"$status\"; }',\n\t\t\t\t\t'trap cleanup_summary EXIT',\n\t\t\t\t\t'mkdir -p /summary/package_summaries',\n\t\t\t\t\t`sui move summary --path /workspace/${shellQuote(packageDir)} ` +\n\t\t\t\t\t\t'--install-dir /tmp/devstack-move-summary-install ' +\n\t\t\t\t\t\t'--output-directory /summary/package_summaries',\n\t\t\t\t].join('; ');\n\t\t\t\tconst run = yield* runtime\n\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\timage,\n\t\t\t\t\t\tentrypoint: 'sh',\n\t\t\t\t\t\targv: ['-c', command],\n\t\t\t\t\t\tmounts: [\n\t\t\t\t\t\t\t{ source: stagedRoot, target: '/workspace' },\n\t\t\t\t\t\t\t{ source: summaryPath, target: '/summary' },\n\t\t\t\t\t\t\t{ source: moveHome, target: '/root/.move' },\n\t\t\t\t\t\t],\n\t\t\t\t\t\ttimeoutMillis: 5 * 60_000,\n\t\t\t\t\t})\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\t\t\thint: 'Docker runtime failed while running `sui move summary` for bindings codegen.',\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\tif (run.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t`sui move summary exited ${run.exitCode}. ` +\n\t\t\t\t\t\t\t\t`stderr: ${run.stderr || '(empty)'}; stdout tail: ${\n\t\t\t\t\t\t\t\t\trun.stdout.slice(-400) || '(empty)'\n\t\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn run;\n\t\t\t}).pipe(Effect.tapError(() => cleanupScratch));\n\t\t\treturn {\n\t\t\t\tpackageName: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\tsummaryPath,\n\t\t\t\tcleanupPath: scratchDir,\n\t\t\t\tsummaryJson: parseSummaryStdout(result.stdout),\n\t\t\t};\n\t\t}),\n\t);\n\nconst makeSummaryScratch = (\n\tinput: MoveSummaryInput,\n): Effect.Effect<string, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdtemp(join(tmpdir(), 'devstack-move-summary-')),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to create a temporary directory for Move summary output.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst prepareSummaryPackage = (\n\tsummaryPath: string,\n\tinput: MoveSummaryInput,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\t// Only create the OUTPUT mount dir; the package itself is mounted from a\n\t\t// disposable staged copy (see `stageSummarySource`), never the real source.\n\t\t// Also drop in the source manifest so the host-side `@mysten/codegen` reads\n\t\t// its `[addresses]` from this dir (see `layerSuiMoveSummaryRunnerHost`) —\n\t\t// silences the \"Failed to read Move.toml\" warning. Best-effort.\n\t\ttry: async () => {\n\t\t\tawait mkdir(summaryPath, { recursive: true });\n\t\t\tawait cp(join(input.sourcePath, 'Move.toml'), join(summaryPath, 'Move.toml')).catch(() => {});\n\t\t},\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to prepare a temporary Move summary output directory.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\n// Stage a disposable copy of the Move package. `sui move summary` rewrites\n// `Move.lock` during dependency resolution, so running it against the\n// developer's real checked-in tree would dirty their working copy. The copy\n// lives under the scoped scratch dir and is reaped with it.\nconst stageSummarySource = (\n\tinput: MoveSummaryInput,\n\tstagedPkg: string,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tawait mkdir(dirname(stagedPkg), { recursive: true });\n\t\t\tawait cp(input.sourcePath, stagedPkg, { recursive: true });\n\t\t\t// Bring local `../` deps (`{ local = \"../token\" }`) into the staged\n\t\t\t// tree so `sui move summary` resolves them (mirrors the build path).\n\t\t\tawait copyLocalMoveDeps(input.sourcePath, stagedPkg, dirname(stagedPkg));\n\t\t},\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: 'Unable to stage a disposable copy of the Move package for summary.',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst resolveDefaultSummaryImage = (\n\truntime: ContainerRuntime,\n\tinput: MoveSummaryInput,\n): Effect.Effect<ImageRef, CodegenBindingsFailed> =>\n\t// Shared CLI image — owned at the daemon-level _per-app_ pin (see\n\t// `chain-build-container.ts:PER_APP_SHARED_STACK`), not per-stack;\n\t// the build container that materialises it carries the labels, so\n\t// `ensureImage` itself is intentionally label-free here.\n\truntime.ensureImage(suiCliImageBuildContext()).pipe(\n\t\tEffect.mapError(\n\t\t\t(cause) =>\n\t\t\t\tnew CodegenBindingsFailed({\n\t\t\t\t\tpackage: input.packageName,\n\t\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\t\treason: 'summary-failed',\n\t\t\t\t\thint: 'Unable to resolve the Sui CLI container image for Move bindings codegen.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t),\n\t);\n\nconst ensureMoveHome = (\n\tmoveHome: string,\n\tinput: MoveSummaryInput,\n): Effect.Effect<void, CodegenBindingsFailed> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdir(moveHome, { recursive: true }),\n\t\tcatch: (cause) =>\n\t\t\tnew CodegenBindingsFailed({\n\t\t\t\tpackage: input.packageName,\n\t\t\t\tsourcePath: input.sourcePath,\n\t\t\t\treason: 'summary-failed',\n\t\t\t\thint: `Unable to create Move cache mount source \"${moveHome}\".`,\n\t\t\t\tcause,\n\t\t\t}),\n\t}).pipe(Effect.asVoid);\n\nconst parseSummaryStdout = (stdout: string): unknown => {\n\tconst trimmed = stdout.trim();\n\tif (trimmed.length === 0) return null;\n\ttry {\n\t\treturn JSON.parse(trimmed) as unknown;\n\t} catch {\n\t\treturn trimmed;\n\t}\n};\n"],"mappings":";;;;;;;;;;;AA4CA,MAAa,kCAIT,MAAM,OACT,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAA4B,OAAO;CACzC,OAAO,yBAAyB,GAAG,EAClC,aAAa,UAAU,oBAAoB,SAAS,KAAK,EAC1D,CAAC;AACF,CAAC,CACF;AAMA,MAAa,gCAIT,MAAM,OACT,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,oBAAoB;CAC3C,OAAO,yBAAyB,GAAG,EAClC,aAAa,EAAE,aAAa,iBAC3B,OAAO,IAAI,aAAa;EACvB,MAAM,aAAa,OAAO,OAAO,WAAW;GAC3C,WAAW,QAAQ,KAAK,OAAO,GAAG,wBAAwB,CAAC;GAC3D,QAAQ,UACP,IAAI,sBAAsB;IACzB,SAAS;IACT;IACA,QAAQ;IACR,MAAM;IACN;GACD,CAAC;EACH,CAAC;EACD,MAAM,cAAc,KAAK,YAAY,SAAS;EAG9C,MAAM,YAAY,KAAK,YAAY,KAAK;EACxC,MAAM,iBAAiB,OAAO,cAC7B,GAAG,YAAY;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC,CAChD,CAAC,CAAC,KAAK,OAAO,MAAM;EA6DpB,OAAO;GACN;GACA;GACA;GACA,aAAa;GACb,aAAa,oBAAmB,OAjEX,OAAO,IAAI,aAAa;IAC7C,OAAO,OAAO,WAAW;KACxB,KAAK,YAAY;MAChB,MAAM,MAAM,aAAa,EAAE,WAAW,KAAK,CAAC;MAC5C,MAAM,GAAG,YAAY,WAAW,EAAE,WAAW,KAAK,CAAC;MAEnD,MAAM,kBAAkB,YAAY,WAAW,QAAQ,SAAS,CAAC;MASjE,MAAM,GAAG,KAAK,YAAY,WAAW,GAAG,KAAK,aAAa,WAAW,CAAC,CAAC,CAAC,YACjE,CAAC,CACR;KACD;KACA,QAAQ,UACP,IAAI,sBAAsB;MACzB,SAAS;MACT;MACA,QAAQ;MACR,MAAM;MACN;KACD,CAAC;IACH,CAAC;IAeD,OAAO,OAAO,QAAQ,SAdV,aAAa,KACxB,OACA;KACC;KACA;KACA;KACA;KACA;KACA,KAAK,YAAY,SAAS;KAC1B;KACA,KAAK,aAAa,mBAAmB;IACtC,GACA,EAAE,KAAK,UAAU,CAEe,GAAG;KACnC,IAAI,qBAAqB,WAAW;KACpC,kBAAkB;KAClB,gBAAgB;KAChB,gBAAgB;IACjB,CAAC,CAAC,CAAC,KACF,OAAO,UACL,UACA,IAAI,sBAAsB;KACzB,SAAS;KACT;KACA,QAAQ;KACR,MAAM;KACN;IACD,CAAC,CACH,CACD;GACD,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,CAAC,EAAA,CAML,MAAM;EAC9C;CACD,CAAC,EACH,CAAC;AACF,CAAC,CACF;AAMA,MAAM,uBACL,SACA,UAEA,OAAO,OACN,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,mBAAmB,KAAK;CAClD,MAAM,cAAc,KAAK,YAAY,SAAS;CAC9C,MAAM,iBAAiB,OAAO,cAC7B,GAAG,YAAY;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC,CAChD,CAAC,CAAC,KAAK,OAAO,MAAM;CACpB,MAAM,SAAS,OAAO,OAAO,IAAI,aAAa;EAC7C,OAAO,sBAAsB,aAAa,KAAK;EAC/C,MAAM,QAAQ,MAAM,eAAe,OAAO,2BAA2B,SAAS,KAAK;EACnF,MAAM,WAAW,KAAK,QAAQ,GAAG,OAAO;EACxC,OAAO,eAAe,UAAU,KAAK;EACrC,MAAM,aAAa,SAAS,MAAM,UAAU;EAG5C,MAAM,aAAa,KAAK,YAAY,KAAK;EACzC,OAAO,mBAAmB,OAAO,KAAK,YAAY,UAAU,CAAC;EAG7D,MAAM,UAAU;GACf;GACA,oGAJe,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,IAAI,EAMpD,GALN,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,IAAI,EAKzC;GAEhC;GACA;GACA,sCAAsC,WAAW,UAAU,EAAE;EAG9D,CAAC,CAAC,KAAK,IAAI;EACX,MAAM,MAAM,OAAO,QACjB,WAAW;GACX;GACA,YAAY;GACZ,MAAM,CAAC,MAAM,OAAO;GACpB,QAAQ;IACP;KAAE,QAAQ;KAAY,QAAQ;IAAa;IAC3C;KAAE,QAAQ;KAAa,QAAQ;IAAW;IAC1C;KAAE,QAAQ;KAAU,QAAQ;IAAc;GAC3C;GACA,eAAe,IAAI;EACpB,CAAC,CAAC,CACD,KACA,OAAO,UACL,UACA,IAAI,sBAAsB;GACzB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ;GACR,MAAM;GACN;EACD,CAAC,CACH,CACD;EACD,IAAI,IAAI,aAAa,GACpB,OAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;GACzB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ;GACR,MACC,2BAA2B,IAAI,SAAS,YAC7B,IAAI,UAAU,UAAU,iBAClC,IAAI,OAAO,MAAM,IAAI,KAAK;EAE7B,CAAC,CACF;EAED,OAAO;CACR,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,CAAC;CAC7C,OAAO;EACN,aAAa,MAAM;EACnB,YAAY,MAAM;EAClB;EACA,aAAa;EACb,aAAa,mBAAmB,OAAO,MAAM;CAC9C;AACD,CAAC,CACF;AAED,MAAM,sBACL,UAEA,OAAO,WAAW;CACjB,WAAW,QAAQ,KAAK,OAAO,GAAG,wBAAwB,CAAC;CAC3D,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;CACD,CAAC;AACH,CAAC;AAEF,MAAM,yBACL,aACA,UAEA,OAAO,WAAW;CAMjB,KAAK,YAAY;EAChB,MAAM,MAAM,aAAa,EAAE,WAAW,KAAK,CAAC;EAC5C,MAAM,GAAG,KAAK,MAAM,YAAY,WAAW,GAAG,KAAK,aAAa,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAC7F;CACA,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;CACD,CAAC;AACH,CAAC;AAMF,MAAM,sBACL,OACA,cAEA,OAAO,WAAW;CACjB,KAAK,YAAY;EAChB,MAAM,MAAM,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;EACnD,MAAM,GAAG,MAAM,YAAY,WAAW,EAAE,WAAW,KAAK,CAAC;EAGzD,MAAM,kBAAkB,MAAM,YAAY,WAAW,QAAQ,SAAS,CAAC;CACxE;CACA,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM;EACN;CACD,CAAC;AACH,CAAC;AAEF,MAAM,8BACL,SACA,UAMA,QAAQ,YAAY,wBAAwB,CAAC,CAAC,CAAC,KAC9C,OAAO,UACL,UACA,IAAI,sBAAsB;CACzB,SAAS,MAAM;CACf,YAAY,MAAM;CAClB,QAAQ;CACR,MAAM;CACN;AACD,CAAC,CACH,CACD;AAED,MAAM,kBACL,UACA,UAEA,OAAO,WAAW;CACjB,WAAW,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;CAC9C,QAAQ,UACP,IAAI,sBAAsB;EACzB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ;EACR,MAAM,6CAA6C,SAAS;EAC5D;CACD,CAAC;AACH,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;AAEtB,MAAM,sBAAsB,WAA4B;CACvD,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,IAAI;EACH,OAAO,KAAK,MAAM,OAAO;CAC1B,QAAQ;EACP,OAAO;CACR;AACD"}

package/dist/{substrate/network.d.mts → plugins/sui/network-config.d.mts}

@@ -1,6 +1,4 @@
-import { ChainId } from "./brand.mjs";
-
-//#region src/substrate/network.d.ts
+//#region src/plugins/sui/network-config.d.ts
 /** Network mode registry. Architecture: fork is a network mode, not
  *  an orchestrator. Module augmentation can add modes without widening
  *  every config field. */
@@ -17,16 +15,19 @@ interface DevstackNetworkModeRegistry {
   };
 }
 type NetworkMode = keyof DevstackNetworkModeRegistry & string;
-/** Substrate-level network record. Plugins read this from the
- *  `IdentityContext` projection — one value per acquire. */
+/** Sui-plugin network record. Plugin-author factories that take
+ *  `(network)` read this as the resolved mode-narrow value — one value
+ *  per acquire. */
 type NetworkConfig<Mode extends NetworkMode = NetworkMode> = Readonly<{
   readonly mode: Mode;
-  /** Chain identity the plugin uses for cache-key folding, ChainProbe
-   *  dispatch, etc. Branded so downstream lookups (chain-probe /
-   *  faucet capability keys) accept it without a re-wrap. */
-  readonly chain: ChainId; /** Source provenance for renderer display. */
+  /** Genesis-digest chain identifier (the node's real chain id, fetched
+   *  via `fetchChainId`) the plugin folds into cache keys + `ChainProbe`
+   *  / faucet capability keys — unique per spun-up network so two
+   *  same-named localnets never share a cache namespace. NOT the network
+   *  name (that is the substrate `Identity.network`). */
+  readonly chainId: string; /** Source provenance for renderer display. */
   readonly source?: 'cli' | 'env' | 'config' | 'default';
 } & DevstackNetworkModeRegistry[Mode]>;
 //#endregion
 export { DevstackNetworkModeRegistry, NetworkConfig, NetworkMode };
-//# sourceMappingURL=network.d.mts.map
+//# sourceMappingURL=network-config.d.mts.map

package/dist/plugins/sui/network-resolver.d.mts

@@ -1,4 +1,3 @@
-import { ChainId } from "../../substrate/brand.mjs";
 import { SuiPluginMode } from "./mode/spec.mjs";
 
 //#region src/plugins/sui/network-resolver.d.ts
@@ -6,11 +5,12 @@ import { SuiPluginMode } from "./mode/spec.mjs";
  *  by the mode-specific builder. */
 interface ResolvedSuiNetwork {
   readonly mode: SuiPluginMode;
-  /** Branded chain identity — assembled by the mode builders so
-   *  downstream lookups (chain-probe / faucet capability keys) and
-   *  the substrate's `NetworkConfig` projection both accept it without
-   *  a re-wrap. */
-  readonly chain: ChainId;
+  /** Genesis-digest chain identifier — the node's real chain id, fetched
+   *  via `fetchChainId` by the mode builders. Downstream lookups
+   *  (chain-probe / faucet capability keys) and the substrate's
+   *  `NetworkConfig` projection fold it into per-network-unique keys. NOT
+   *  the network name. */
+  readonly chainId: string;
   readonly rpc: string;
   readonly faucet?: string;
   readonly graphql?: string;

package/dist/plugins/sui/routable.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/sui/routable.ts"],"sourcesContent":["import type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\nexport const SUI_RPC_ENDPOINT_NAME = 'rpc' as const;\nexport const SUI_FAUCET_ENDPOINT_NAME = 'faucet' as const;\nexport const SUI_GRAPHQL_ENDPOINT_NAME = 'graphql' as const;\n\nexport const SUI_RPC_ENTRYPOINT_PORT = 9000;\nexport const SUI_FAUCET_ENTRYPOINT_PORT = 9123;\nexport const SUI_GRAPHQL_ENTRYPOINT_PORT = 9125;\n\nexport const SUI_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: SUI_RPC_ENDPOINT_NAME, port: SUI_RPC_ENTRYPOINT_PORT, protocol: 'http' },\n\t{ name: SUI_FAUCET_ENDPOINT_NAME, port: SUI_FAUCET_ENTRYPOINT_PORT, protocol: 'http' },\n\t{ name: SUI_GRAPHQL_ENDPOINT_NAME, port: SUI_GRAPHQL_ENTRYPOINT_PORT, protocol: 'http' },\n];\n\nexport const makeSuiLocalRoutables = (parts: {\n\treadonly containerName: string;\n\treadonly includeGraphql: boolean;\n}): ReadonlyArray<RoutableDecl> => [\n\t{\n\t\tkind: 'routable',\n\t\tendpointName: SUI_RPC_ENDPOINT_NAME,\n\t\tdispatchId: {\n\t\t\tserviceKey: 'sui.local',\n\t\t\trole: SUI_RPC_ENDPOINT_NAME,\n\t\t},\n\t\tupstream: {\n\t\t\ttype: 'container',\n\t\t\tcontainerName: parts.containerName,\n\t\t\tcontainerPort: SUI_RPC_ENTRYPOINT_PORT,\n\t\t},\n\t\tcors: true,\n\t\twireProtocol: 'http',\n\t},\n\t{\n\t\tkind: 'routable',\n\t\tendpointName: SUI_FAUCET_ENDPOINT_NAME,\n\t\tdispatchId: {\n\t\t\tserviceKey: 'sui.local',\n\t\t\trole: SUI_FAUCET_ENDPOINT_NAME,\n\t\t},\n\t\tupstream: {\n\t\t\ttype: 'container',\n\t\t\tcontainerName: parts.containerName,\n\t\t\tcontainerPort: SUI_FAUCET_ENTRYPOINT_PORT,\n\t\t},\n\t\tcors: true,\n\t\twireProtocol: 'http',\n\t},\n\t...(parts.includeGraphql\n\t\t? [\n\t\t\t\t{\n\t\t\t\t\tkind: 'routable',\n\t\t\t\t\tendpointName: SUI_GRAPHQL_ENDPOINT_NAME,\n\t\t\t\t\tdispatchId: {\n\t\t\t\t\t\tserviceKey: 'sui.local',\n\t\t\t\t\t\trole: SUI_GRAPHQL_ENDPOINT_NAME,\n\t\t\t\t\t},\n\t\t\t\t\tupstream: {\n\t\t\t\t\t\ttype: 'container',\n\t\t\t\t\t\tcontainerName: parts.containerName,\n\t\t\t\t\t\tcontainerPort: SUI_GRAPHQL_ENTRYPOINT_PORT,\n\t\t\t\t\t},\n\t\t\t\t\tcors: true,\n\t\t\t\t\twireProtocol: 'http',\n\t\t\t\t} satisfies RoutableDecl,\n\t\t\t]\n\t\t: []),\n];\n\nexport const makeSuiForkRoutables = (parts: {\n\treadonly containerName: string;\n}): ReadonlyArray<RoutableDecl> => [\n\t{\n\t\tkind: 'routable',\n\t\tendpointName: SUI_RPC_ENDPOINT_NAME,\n\t\tdispatchId: {\n\t\t\tserviceKey: 'sui.fork',\n\t\t\trole: SUI_RPC_ENDPOINT_NAME,\n\t\t},\n\t\tupstream: {\n\t\t\ttype: 'container',\n\t\t\tcontainerName: parts.containerName,\n\t\t\tcontainerPort: SUI_RPC_ENTRYPOINT_PORT,\n\t\t},\n\t\tcors: true,\n\t\twireProtocol: 'http',\n\t},\n];\n"],"mappings":"AAGA,MAAa,2BAA2B;AACxC,MAAa,4BAA4B;AAEzC,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,8BAA8B;AAE3C,MAAa,kBAAiD;CAC7D;EAAE,MAAA;EAA6B,MAAM;EAAyB,UAAU;EAAQ;CAChF;EAAE,MAAM;EAA0B,MAAM;EAA4B,UAAU;EAAQ;CACtF;EAAE,MAAM;EAA2B,MAAM;EAA6B,UAAU;EAAQ;CACxF;AAED,MAAa,yBAAyB,UAGH;CAClC;EACC,MAAM;EACN,cAAA;EACA,YAAY;GACX,YAAY;GACZ,MAAA;GACA;EACD,UAAU;GACT,MAAM;GACN,eAAe,MAAM;GACrB,eAAe;GACf;EACD,MAAM;EACN,cAAc;EACd;CACD;EACC,MAAM;EACN,cAAc;EACd,YAAY;GACX,YAAY;GACZ,MAAM;GACN;EACD,UAAU;GACT,MAAM;GACN,eAAe,MAAM;GACrB,eAAe;GACf;EACD,MAAM;EACN,cAAc;EACd;CACD,GAAI,MAAM,iBACP,CACA;EACC,MAAM;EACN,cAAc;EACd,YAAY;GACX,YAAY;GACZ,MAAM;GACN;EACD,UAAU;GACT,MAAM;GACN,eAAe,MAAM;GACrB,eAAe;GACf;EACD,MAAM;EACN,cAAc;EACd,CACD,GACA,EAAE;CACL;AAED,MAAa,wBAAwB,UAEF,CAClC;CACC,MAAM;CACN,cAAA;CACA,YAAY;EACX,YAAY;EACZ,MAAA;EACA;CACD,UAAU;EACT,MAAM;EACN,eAAe,MAAM;EACrB,eAAe;EACf;CACD,MAAM;CACN,cAAc;CACd,CACD"}
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/sui/routable.ts"],"sourcesContent":["import type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\nexport const SUI_RPC_ENDPOINT_NAME = 'rpc' as const;\nexport const SUI_FAUCET_ENDPOINT_NAME = 'faucet' as const;\nexport const SUI_GRAPHQL_ENDPOINT_NAME = 'graphql' as const;\n\nexport const SUI_RPC_ENTRYPOINT_PORT = 9000;\nexport const SUI_FAUCET_ENTRYPOINT_PORT = 9123;\nexport const SUI_GRAPHQL_ENTRYPOINT_PORT = 9125;\n\nexport const SUI_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: SUI_RPC_ENDPOINT_NAME, port: SUI_RPC_ENTRYPOINT_PORT, protocol: 'http' },\n\t{ name: SUI_FAUCET_ENDPOINT_NAME, port: SUI_FAUCET_ENTRYPOINT_PORT, protocol: 'http' },\n\t{ name: SUI_GRAPHQL_ENDPOINT_NAME, port: SUI_GRAPHQL_ENTRYPOINT_PORT, protocol: 'http' },\n];\n\nexport const makeSuiLocalRoutables = (parts: {\n\treadonly containerName: string;\n\treadonly includeGraphql: boolean;\n}): ReadonlyArray<RoutableDecl> => [\n\t{\n\t\tkind: 'routable',\n\t\tendpointName: SUI_RPC_ENDPOINT_NAME,\n\t\tdispatchId: {\n\t\t\tserviceKey: 'sui.local',\n\t\t\trole: SUI_RPC_ENDPOINT_NAME,\n\t\t},\n\t\tupstream: {\n\t\t\ttype: 'container',\n\t\t\tcontainerName: parts.containerName,\n\t\t\tcontainerPort: SUI_RPC_ENTRYPOINT_PORT,\n\t\t},\n\t\tcors: true,\n\t\twireProtocol: 'http',\n\t},\n\t{\n\t\tkind: 'routable',\n\t\tendpointName: SUI_FAUCET_ENDPOINT_NAME,\n\t\tdispatchId: {\n\t\t\tserviceKey: 'sui.local',\n\t\t\trole: SUI_FAUCET_ENDPOINT_NAME,\n\t\t},\n\t\tupstream: {\n\t\t\ttype: 'container',\n\t\t\tcontainerName: parts.containerName,\n\t\t\tcontainerPort: SUI_FAUCET_ENTRYPOINT_PORT,\n\t\t},\n\t\tcors: true,\n\t\twireProtocol: 'http',\n\t},\n\t...(parts.includeGraphql\n\t\t? [\n\t\t\t\t{\n\t\t\t\t\tkind: 'routable',\n\t\t\t\t\tendpointName: SUI_GRAPHQL_ENDPOINT_NAME,\n\t\t\t\t\tdispatchId: {\n\t\t\t\t\t\tserviceKey: 'sui.local',\n\t\t\t\t\t\trole: SUI_GRAPHQL_ENDPOINT_NAME,\n\t\t\t\t\t},\n\t\t\t\t\tupstream: {\n\t\t\t\t\t\ttype: 'container',\n\t\t\t\t\t\tcontainerName: parts.containerName,\n\t\t\t\t\t\tcontainerPort: SUI_GRAPHQL_ENTRYPOINT_PORT,\n\t\t\t\t\t},\n\t\t\t\t\tcors: true,\n\t\t\t\t\twireProtocol: 'http',\n\t\t\t\t} satisfies RoutableDecl,\n\t\t\t]\n\t\t: []),\n];\n\nexport const makeSuiForkRoutables = (parts: {\n\treadonly containerName: string;\n}): ReadonlyArray<RoutableDecl> => [\n\t{\n\t\tkind: 'routable',\n\t\tendpointName: SUI_RPC_ENDPOINT_NAME,\n\t\tdispatchId: {\n\t\t\tserviceKey: 'sui.fork',\n\t\t\trole: SUI_RPC_ENDPOINT_NAME,\n\t\t},\n\t\tupstream: {\n\t\t\ttype: 'container',\n\t\t\tcontainerName: parts.containerName,\n\t\t\tcontainerPort: SUI_RPC_ENTRYPOINT_PORT,\n\t\t},\n\t\tcors: true,\n\t\twireProtocol: 'http',\n\t},\n];\n"],"mappings":"AAGA,MAAa,2BAA2B;AACxC,MAAa,4BAA4B;AAEzC,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,8BAA8B;AAE3C,MAAa,kBAAiD;CAC7D;EAAE,MAAA;EAA6B,MAAM;EAAyB,UAAU;CAAO;CAC/E;EAAE,MAAM;EAA0B,MAAM;EAA4B,UAAU;CAAO;CACrF;EAAE,MAAM;EAA2B,MAAM;EAA6B,UAAU;CAAO;AACxF;AAEA,MAAa,yBAAyB,UAGH;CAClC;EACC,MAAM;EACN,cAAA;EACA,YAAY;GACX,YAAY;GACZ,MAAA;EACD;EACA,UAAU;GACT,MAAM;GACN,eAAe,MAAM;GACrB,eAAe;EAChB;EACA,MAAM;EACN,cAAc;CACf;CACA;EACC,MAAM;EACN,cAAc;EACd,YAAY;GACX,YAAY;GACZ,MAAM;EACP;EACA,UAAU;GACT,MAAM;GACN,eAAe,MAAM;GACrB,eAAe;EAChB;EACA,MAAM;EACN,cAAc;CACf;CACA,GAAI,MAAM,iBACP,CACA;EACC,MAAM;EACN,cAAc;EACd,YAAY;GACX,YAAY;GACZ,MAAM;EACP;EACA,UAAU;GACT,MAAM;GACN,eAAe,MAAM;GACrB,eAAe;EAChB;EACA,MAAM;EACN,cAAc;CACf,CACD,IACC,CAAC;AACL;AAEA,MAAa,wBAAwB,UAEF,CAClC;CACC,MAAM;CACN,cAAA;CACA,YAAY;EACX,YAAY;EACZ,MAAA;CACD;CACA,UAAU;EACT,MAAM;EACN,eAAe,MAAM;EACrB,eAAe;CAChB;CACA,MAAM;CACN,cAAc;AACf,CACD"}

package/dist/plugins/sui/service.mjs

@@ -1,20 +1,23 @@
+import { bootLocalMode } from "./mode/local.mjs";
 import { bootLocalRpcMode } from "./mode/external.mjs";
 import { bootForkMode } from "./mode/fork.mjs";
 import { bootLiveMode } from "./mode/live.mjs";
-import { bootLocalMode } from "./mode/local.mjs";
 import { Effect } from "effect";
 //#region src/plugins/sui/service.ts
 /** Dispatch on the typed mode and return the mode's boot artifacts.
 *
 *  The `ContainerRuntime` is consumed by container-bearing modes
 *  only (local + fork); external + live get `null` and a typed
-*  refusal would surface if they tried to use it.
+*  refusal would surface if they tried to use it. `indexer` (external
+*  GraphQL-indexer DSN + network) is consumed by local mode only.
 *
-*  Stub: the per-mode builders are all stubs; the orchestrator
-*  here is the only fully-wired piece. */
-const bootSuiService = (runtime, identity, portBroker, paths, opts) => {
+*  `prebuiltImage` (local mode only) is the validator image the barrel
+*  already resolved before the indexer-db sidecar — passed straight
+*  through so the sidecar's `configHash` and the validator container use
+*  the SAME `ImageRef` (no drift, no double build). */
+const bootSuiService = (runtime, identity, portBroker, paths, opts, indexer, prebuiltImage) => {
 	switch (opts.mode) {
-		case "local": return bootLocalMode(runtime, identity, portBroker, opts).pipe(Effect.map(({ resolved, client }) => ({
+		case "local": return bootLocalMode(runtime, identity, portBroker, opts, indexer, prebuiltImage).pipe(Effect.map(({ resolved, client }) => ({
 			resolved,
 			client
 		})));
@@ -30,6 +33,7 @@ const bootSuiService = (runtime, identity, portBroker, paths, opts) => {
 			resolved,
 			client
 		})));
+		default: return Effect.die(/* @__PURE__ */ new Error(`sui: unhandled mode ${String(opts.mode)}`));
 	}
 };
 //#endregion

package/dist/plugins/sui/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/sui/service.ts"],"sourcesContent":["// Sui plugin — service body.\n//\n// Architecture: the four modes are NOT four separate plugins. They\n// are one plugin with internal mode dispatch. The factory at the\n// barrel (`index.ts`) constructs a `SuiOptions` discriminator from\n// typed options; the `acquire` body below dispatches on `opts.mode`\n// and assembles the mode-appropriate subsystems.\n//\n// What this file does:\n//\n//   1. Receive resolved `SuiOptions`.\n//   2. Dispatch to the right `bootXxxMode` builder.\n//   3. Assemble the mode-aware `SuiClient` (the resolved value).\n//\n// What it does NOT do:\n//\n//   - Provision the build container — `chain-build-container.ts`\n//     owns that; the plugin acquires it ONLY when needed (Move\n//     publish or codegen) via the ArtifactPublisher seam.\n//   - Wire the StrategyContributor capabilities — that's the\n//     barrel's job; the body just returns the resolved value.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type { SuiConfigError, SuiPluginError } from './errors.ts';\nimport type { ResolvedSuiNetwork } from './network-resolver.ts';\nimport type { SuiClient } from './mode/shared.ts';\nimport type { SuiOptions } from './mode/spec.ts';\nimport { bootLocalRpcMode } from './mode/external.ts';\nimport { bootForkMode } from './mode/fork.ts';\nimport { bootLiveMode } from './mode/live.ts';\nimport { bootLocalMode } from './mode/local.ts';\nimport type { ContainerRuntime } from '../../contracts/container-runtime.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport type { StackPaths } from '../../substrate/runtime/paths.ts';\nimport type { PortBroker } from '../../substrate/runtime/port-broker/index.ts';\n\n/** Bundled result of one acquire — resolved metadata + the user-facing\n *  client. The barrel projects this into the Sui resource value; the\n *  resolved metadata feeds the Codegenable contribution. */\nexport interface SuiBootResult {\n\treadonly resolved: ResolvedSuiNetwork;\n\treadonly client: SuiClient;\n}\n\n/** Dispatch on the typed mode and return the mode's boot artifacts.\n *\n *  The `ContainerRuntime` is consumed by container-bearing modes\n *  only (local + fork); external + live get `null` and a typed\n *  refusal would surface if they tried to use it.\n *\n *  Stub: the per-mode builders are all stubs; the orchestrator\n *  here is the only fully-wired piece. */\nexport const bootSuiService = (\n\truntime: ContainerRuntime,\n\tidentity: Identity,\n\tportBroker: PortBroker,\n\tpaths: StackPaths,\n\topts: SuiOptions,\n): Effect.Effect<\n\tSuiBootResult,\n\tSuiPluginError | SuiConfigError,\n\tScope.Scope\n> => {\n\tswitch (opts.mode) {\n\t\tcase 'local':\n\t\t\treturn bootLocalMode(runtime, identity, portBroker, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'local-rpc':\n\t\t\treturn bootLocalRpcMode(opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'live':\n\t\t\treturn bootLiveMode(opts).pipe(Effect.map(({ resolved, client }) => ({ resolved, client })));\n\t\tcase 'fork':\n\t\t\treturn bootForkMode(runtime, identity, portBroker, paths, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAqDA,MAAa,kBACZ,SACA,UACA,YACA,OACA,SAKI;AACJ,SAAQ,KAAK,MAAb;EACC,KAAK,QACJ,QAAO,cAAc,SAAS,UAAU,YAAY,KAAK,CAAC,KACzD,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,YACJ,QAAO,iBAAiB,KAAK,CAAC,KAC7B,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,OACJ,QAAO,aAAa,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAAC;EAC7F,KAAK,OACJ,QAAO,aAAa,SAAS,UAAU,YAAY,OAAO,KAAK,CAAC,KAC/D,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D"}
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/sui/service.ts"],"sourcesContent":["// Sui plugin — service body.\n//\n// Architecture: the four modes are NOT four separate plugins. They\n// are one plugin with internal mode dispatch. The factory at the\n// barrel (`index.ts`) constructs a `SuiOptions` discriminator from\n// typed options; the `acquire` body below dispatches on `opts.mode`\n// and assembles the mode-appropriate subsystems.\n//\n// What this file does:\n//\n//   1. Receive resolved `SuiOptions`.\n//   2. Dispatch to the right `bootXxxMode` builder.\n//   3. Assemble the mode-aware `SuiClient` (the resolved value).\n//\n// What it does NOT do:\n//\n//   - Provision the build container — `chain-build-container.ts`\n//     owns that; the plugin acquires it ONLY when needed (Move\n//     publish or codegen) via the ArtifactPublisher seam.\n//   - Wire the StrategyContributor capabilities — that's the\n//     barrel's job; the body just returns the resolved value.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type { SuiConfigError, SuiPluginError } from './errors.ts';\nimport type { ResolvedSuiNetwork } from './network-resolver.ts';\nimport type { SuiClient } from './mode/shared.ts';\nimport type { SuiOptions } from './mode/spec.ts';\nimport { bootLocalRpcMode } from './mode/external.ts';\nimport { bootForkMode } from './mode/fork.ts';\nimport { bootLiveMode } from './mode/live.ts';\nimport { bootLocalMode, type LocalIndexer } from './mode/local.ts';\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport type { StackPaths } from '../../substrate/runtime/paths.ts';\nimport type { PortBroker } from '../../substrate/runtime/port-broker/index.ts';\n\n/** Bundled result of one acquire — resolved metadata + the user-facing\n *  client. The barrel projects this into the Sui resource value; the\n *  resolved metadata feeds the Codegenable contribution. */\nexport interface SuiBootResult {\n\treadonly resolved: ResolvedSuiNetwork;\n\treadonly client: SuiClient;\n}\n\n/** Dispatch on the typed mode and return the mode's boot artifacts.\n *\n *  The `ContainerRuntime` is consumed by container-bearing modes\n *  only (local + fork); external + live get `null` and a typed\n *  refusal would surface if they tried to use it. `indexer` (external\n *  GraphQL-indexer DSN + network) is consumed by local mode only.\n *\n *  `prebuiltImage` (local mode only) is the validator image the barrel\n *  already resolved before the indexer-db sidecar — passed straight\n *  through so the sidecar's `configHash` and the validator container use\n *  the SAME `ImageRef` (no drift, no double build). */\nexport const bootSuiService = (\n\truntime: ContainerRuntime,\n\tidentity: Identity,\n\tportBroker: PortBroker,\n\tpaths: StackPaths,\n\topts: SuiOptions,\n\tindexer: LocalIndexer | undefined,\n\tprebuiltImage?: ImageRef,\n): Effect.Effect<SuiBootResult, SuiPluginError | SuiConfigError, Scope.Scope> => {\n\tswitch (opts.mode) {\n\t\tcase 'local':\n\t\t\treturn bootLocalMode(runtime, identity, portBroker, opts, indexer, prebuiltImage).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'local-rpc':\n\t\t\treturn bootLocalRpcMode(opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tcase 'live':\n\t\t\treturn bootLiveMode(opts).pipe(Effect.map(({ resolved, client }) => ({ resolved, client })));\n\t\tcase 'fork':\n\t\t\treturn bootForkMode(runtime, identity, portBroker, paths, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, client }) => ({ resolved, client })),\n\t\t\t);\n\t\tdefault:\n\t\t\t// The typed union makes this unreachable; guards an untyped\n\t\t\t// caller that passes options with no/unknown `mode` (which would\n\t\t\t// otherwise fall through to an opaque \"not iterable\" defect).\n\t\t\treturn Effect.die(\n\t\t\t\tnew Error(`sui: unhandled mode ${String((opts as { mode?: unknown }).mode)}`),\n\t\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAwDA,MAAa,kBACZ,SACA,UACA,YACA,OACA,MACA,SACA,kBACgF;CAChF,QAAQ,KAAK,MAAb;EACC,KAAK,SACJ,OAAO,cAAc,SAAS,UAAU,YAAY,MAAM,SAAS,aAAa,CAAC,CAAC,KACjF,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;EAAO,EAAE,CAC5D;EACD,KAAK,aACJ,OAAO,iBAAiB,IAAI,CAAC,CAAC,KAC7B,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;EAAO,EAAE,CAC5D;EACD,KAAK,QACJ,OAAO,aAAa,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;EAAO,EAAE,CAAC;EAC5F,KAAK,QACJ,OAAO,aAAa,SAAS,UAAU,YAAY,OAAO,IAAI,CAAC,CAAC,KAC/D,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;EAAO,EAAE,CAC5D;EACD,SAIC,OAAO,OAAO,oBACb,IAAI,MAAM,uBAAuB,OAAQ,KAA4B,IAAI,GAAG,CAC7E;CACF;AACD"}

package/dist/plugins/sui/snapshot.mjs

@@ -1,12 +1,17 @@
+import { SUI_INDEXER_DB_ROLE } from "./mode/local.mjs";
 import { Effect } from "effect";
 //#region src/plugins/sui/snapshot.ts
 /** Build the Snapshotable contribution for a resolved mode + chain id.
 *
+*  `hasIndexer` (local mode only) folds the sui-owned indexer-db sidecar
+*  into the captured containers when GraphQL is on; off when the caller
+*  set `indexer: false` (or BYO'd a Postgres the sui plugin doesn't own).
+*
 *  Identity guard data lives in `preRestore`: the substrate compares
 *  the snapshot's stored chain identity against the resolver's
 *  current answer; a mismatch refuses BEFORE any destructive
 *  mutation. */
-const makeSnapshotable = (mode, app, stack, chain) => {
+const makeSnapshotable = (mode, app, stack, chainId, hasIndexer) => {
 	const labels = (role) => ({
 		app,
 		stack,
@@ -17,12 +22,12 @@ const makeSnapshotable = (mode, app, stack, chain) => {
 		case "local": return {
 			kind: "snapshotable",
 			subtrees: [],
-			managedContainers: [labels("validator"), labels("postgres")],
+			managedContainers: hasIndexer ? [labels("validator"), labels(SUI_INDEXER_DB_ROLE)] : [labels("validator")],
 			missingTolerance: "fine",
 			preRestore: Effect.succeed({
 				kind: "sui-chain",
 				mode: "local",
-				chain
+				chainId
 			}),
 			postRestore: Effect.void
 		};
@@ -34,7 +39,7 @@ const makeSnapshotable = (mode, app, stack, chain) => {
 			preRestore: Effect.succeed({
 				kind: "sui-chain",
 				mode,
-				chain
+				chainId
 			})
 		};
 		case "fork": return {
@@ -45,7 +50,7 @@ const makeSnapshotable = (mode, app, stack, chain) => {
 			preRestore: Effect.succeed({
 				kind: "sui-chain",
 				mode: "fork",
-				chain
+				chainId
 			})
 		};
 	}

package/dist/plugins/sui/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/sui/snapshot.ts"],"sourcesContent":["// Sui plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Sui's contribution is mode-aware:\n//\n//   - local mode  — chain state (localnet validator) MUST live in\n//                   the writable container layer (NOT a named\n//                   volume), so `docker commit` captures it. Same\n//                   for the postgres indexer (PGDATA relocated off\n//                   the inherited VOLUME path).\n//\n//   - external    — no container, no snapshot. The `SnapshotableDecl`\n//                   has `missingTolerance: 'fine'` so restore against\n//                   a snapshot taken in local mode is a clean no-op.\n//\n//   - live        — same as external; no snapshot.\n//\n//   - fork        — data dir is a bind-mount; snapshot capture is\n//                   handled separately by the snapshot orchestrator.\n//                   This file emits the bind-mount subtree as the\n//                   capture descriptor.\n//\n// Chain identity (chainId + per-mode cluster id) is the canonical\n// identity-guard contribution from this plugin. The substrate's\n// pre-restore hook reads it; identity mismatch refuses the restore.\n//\n// The `mode` discriminator is folded INTO the identity record (mirrors\n// walrus's `preRestore` carrying `mode`). It is load-bearing: container\n// `local` mode (committed chain-state artifacts in the writable layer)\n// and `local-rpc` mode (caller-owned external RPC, no container) can\n// resolve to the SAME chain id — e.g. a caller wrapping their own\n// localnet reporting `sui:localnet`, identical to the in-container\n// validator. Without the `mode` key the guard would compare only\n// `{kind, chain}` and let a container-`local` snapshot restore against a\n// `local-rpc` stack (and vice versa): restoring container chain-state\n// against an external RPC is a silent no-op masquerading as success.\n// With `mode` in the record the values differ on the `mode` key and the\n// guard refuses before any mutation.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\nimport type { SuiPluginMode } from './mode/spec.ts';\n\n/** Build the Snapshotable contribution for a resolved mode + chain id.\n *\n *  Identity guard data lives in `preRestore`: the substrate compares\n *  the snapshot's stored chain identity against the resolver's\n *  current answer; a mismatch refuses BEFORE any destructive\n *  mutation. */\nexport const makeSnapshotable = (\n\tmode: SuiPluginMode,\n\tapp: string,\n\tstack: string,\n\tchain: string,\n): SnapshotableDecl => {\n\tconst labels = (role: string): ContainerLabelTuple => ({\n\t\tapp,\n\t\tstack,\n\t\tplugin: 'sui',\n\t\trole,\n\t});\n\n\tswitch (mode) {\n\t\tcase 'local': {\n\t\t\t// Validator's writable layer + postgres indexer's writable\n\t\t\t// layer. The runtime adapter pauses both before commit;\n\t\t\t// architecture default grace is \"pause container\".\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\t// Chain state lives in the writable container layer\n\t\t\t\t// — declared via `managedContainers`, not subtrees.\n\t\t\t\tsubtrees: [],\n\t\t\t\tmanagedContainers: [labels('validator'), labels('postgres')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode: 'local' as const, chain }),\n\t\t\t\tpostRestore: Effect.void,\n\t\t\t};\n\t\t}\n\t\tcase 'local-rpc':\n\t\tcase 'live': {\n\t\t\t// No container, no capture. The decl still exists so the\n\t\t\t// identity guard fires on restore (e.g. restoring a local\n\t\t\t// snapshot while the resolver says \"live testnet\" — the\n\t\t\t// identity-guard refuses). `mode` flows from the narrowed\n\t\t\t// parameter (`'local-rpc' | 'live'` here), so a `local-rpc`\n\t\t\t// snapshot also refuses against a container-`local` stack at\n\t\t\t// an identical chain id.\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: [],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode, chain }),\n\t\t\t};\n\t\t}\n\t\tcase 'fork': {\n\t\t\t// Data dir + meta are bind-mounted host paths; the\n\t\t\t// orchestrator walks the declared subtree. The fork\n\t\t\t// container itself is also captured (writable layer for\n\t\t\t// dep + cache state).\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: ['sui-fork/'],\n\t\t\t\tmanagedContainers: [labels('fork-validator')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode: 'fork' as const, chain }),\n\t\t\t};\n\t\t}\n\t}\n};\n"],"mappings":";;;;;;;;AAkDA,MAAa,oBACZ,MACA,KACA,OACA,UACsB;CACtB,MAAM,UAAU,UAAuC;EACtD;EACA;EACA,QAAQ;EACR;EACA;AAED,SAAQ,MAAR;EACC,KAAK,QAIJ,QAAO;GACN,MAAM;GAGN,UAAU,EAAE;GACZ,mBAAmB,CAAC,OAAO,YAAY,EAAE,OAAO,WAAW,CAAC;GAC5D,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB,MAAM;IAAkB;IAAO,CAAC;GACzF,aAAa,OAAO;GACpB;EAEF,KAAK;EACL,KAAK,OAQJ,QAAO;GACN,MAAM;GACN,UAAU,EAAE;GACZ,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB;IAAM;IAAO,CAAC;GACvE;EAEF,KAAK,OAKJ,QAAO;GACN,MAAM;GACN,UAAU,CAAC,YAAY;GACvB,mBAAmB,CAAC,OAAO,iBAAiB,CAAC;GAC7C,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB,MAAM;IAAiB;IAAO,CAAC;GACxF"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/sui/snapshot.ts"],"sourcesContent":["// Sui plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Sui's contribution is mode-aware:\n//\n//   - local mode  — chain state (localnet validator) MUST live in\n//                   the writable container layer (NOT a named\n//                   volume), so `docker commit` captures it. The\n//                   validator commit captures chain state, the\n//                   embedded-fullnode db, and the GraphQL consistent-\n//                   store on-disk store. When the GraphQL indexer is on\n//                   (the default), its data lives in sui's OWNED postgres\n//                   sidecar — captured here too under sui's own\n//                   `indexer-db` role (the sidecar's vendored image\n//                   relocates PGDATA into the writable layer).\n//\n//   - external    — no container, no snapshot. The `SnapshotableDecl`\n//                   has `missingTolerance: 'fine'` so restore against\n//                   a snapshot taken in local mode is a clean no-op.\n//\n//   - live        — same as external; no snapshot.\n//\n//   - fork        — data dir is a bind-mount; snapshot capture is\n//                   handled separately by the snapshot orchestrator.\n//                   This file emits the bind-mount subtree as the\n//                   capture descriptor.\n//\n// Chain identity (chainId + per-mode cluster id) is the canonical\n// identity-guard contribution from this plugin. The substrate's\n// pre-restore hook reads it; identity mismatch refuses the restore.\n//\n// The `mode` discriminator is folded INTO the identity record (mirrors\n// walrus's `preRestore` carrying `mode`). It is load-bearing: container\n// `local` mode (committed chain-state artifacts in the writable layer)\n// and `local-rpc` mode (caller-owned external RPC, no container) can\n// resolve to the SAME chain id — e.g. a caller wrapping their own\n// localnet reporting `sui:localnet`, identical to the in-container\n// validator. Without the `mode` key the guard would compare only\n// `{kind, chainId}` and let a container-`local` snapshot restore against a\n// `local-rpc` stack (and vice versa): restoring container chain-state\n// against an external RPC is a silent no-op masquerading as success.\n// With `mode` in the record the values differ on the `mode` key and the\n// guard refuses before any mutation.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\nimport type { SuiPluginMode } from './mode/spec.ts';\nimport { SUI_INDEXER_DB_ROLE } from './mode/local.ts';\n\n/** Build the Snapshotable contribution for a resolved mode + chain id.\n *\n *  `hasIndexer` (local mode only) folds the sui-owned indexer-db sidecar\n *  into the captured containers when GraphQL is on; off when the caller\n *  set `indexer: false` (or BYO'd a Postgres the sui plugin doesn't own).\n *\n *  Identity guard data lives in `preRestore`: the substrate compares\n *  the snapshot's stored chain identity against the resolver's\n *  current answer; a mismatch refuses BEFORE any destructive\n *  mutation. */\nexport const makeSnapshotable = (\n\tmode: SuiPluginMode,\n\tapp: string,\n\tstack: string,\n\tchainId: string,\n\thasIndexer: boolean,\n): SnapshotableDecl => {\n\tconst labels = (role: string): ContainerLabelTuple => ({\n\t\tapp,\n\t\tstack,\n\t\tplugin: 'sui',\n\t\trole,\n\t});\n\n\tswitch (mode) {\n\t\tcase 'local': {\n\t\t\t// The validator's writable layer captures chain state, the\n\t\t\t// embedded-fullnode db, and the GraphQL consistent-store\n\t\t\t// on-disk store. When the indexer is on (default), sui ALSO\n\t\t\t// owns a postgres sidecar whose PGDATA-relocated writable layer\n\t\t\t// holds the indexer's data — captured here under sui's own\n\t\t\t// `indexer-db` role. The runtime adapter pauses each container\n\t\t\t// before commit; architecture default grace is \"pause\n\t\t\t// container\".\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\t// Chain state lives in the writable container layer\n\t\t\t\t// — declared via `managedContainers`, not subtrees.\n\t\t\t\tsubtrees: [],\n\t\t\t\tmanagedContainers: hasIndexer\n\t\t\t\t\t? [labels('validator'), labels(SUI_INDEXER_DB_ROLE)]\n\t\t\t\t\t: [labels('validator')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode: 'local' as const, chainId }),\n\t\t\t\tpostRestore: Effect.void,\n\t\t\t};\n\t\t}\n\t\tcase 'local-rpc':\n\t\tcase 'live': {\n\t\t\t// No container, no capture. The decl still exists so the\n\t\t\t// identity guard fires on restore (e.g. restoring a local\n\t\t\t// snapshot while the resolver says \"live testnet\" — the\n\t\t\t// identity-guard refuses). `mode` flows from the narrowed\n\t\t\t// parameter (`'local-rpc' | 'live'` here), so a `local-rpc`\n\t\t\t// snapshot also refuses against a container-`local` stack at\n\t\t\t// an identical chain id.\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: [],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode, chainId }),\n\t\t\t};\n\t\t}\n\t\tcase 'fork': {\n\t\t\t// Data dir + meta are bind-mounted host paths; the\n\t\t\t// orchestrator walks the declared subtree. The fork\n\t\t\t// container itself is also captured (writable layer for\n\t\t\t// dep + cache state).\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: ['sui-fork/'],\n\t\t\t\tmanagedContainers: [labels('fork-validator')],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({ kind: 'sui-chain' as const, mode: 'fork' as const, chainId }),\n\t\t\t};\n\t\t}\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AA4DA,MAAa,oBACZ,MACA,KACA,OACA,SACA,eACsB;CACtB,MAAM,UAAU,UAAuC;EACtD;EACA;EACA,QAAQ;EACR;CACD;CAEA,QAAQ,MAAR;EACC,KAAK,SASJ,OAAO;GACN,MAAM;GAGN,UAAU,CAAC;GACX,mBAAmB,aAChB,CAAC,OAAO,WAAW,GAAG,OAAO,mBAAmB,CAAC,IACjD,CAAC,OAAO,WAAW,CAAC;GACvB,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB,MAAM;IAAkB;GAAQ,CAAC;GAC1F,aAAa,OAAO;EACrB;EAED,KAAK;EACL,KAAK,QAQJ,OAAO;GACN,MAAM;GACN,UAAU,CAAC;GACX,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB;IAAM;GAAQ,CAAC;EACzE;EAED,KAAK,QAKJ,OAAO;GACN,MAAM;GACN,UAAU,CAAC,WAAW;GACtB,mBAAmB,CAAC,OAAO,gBAAgB,CAAC;GAC5C,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAAE,MAAM;IAAsB,MAAM;IAAiB;GAAQ,CAAC;EAC1F;CAEF;AACD"}

package/dist/plugins/wallet/codegen.d.mts

@@ -12,14 +12,16 @@
  *    - `protocolPaths` : path constants the adapter reads. Mirrored
  *                        here so the adapter doesn't depend on a
  *                        separate import.
- *    - `chain`         : Sui chain id the wallet's accounts are
- *                        scoped to. Surfaced so dapp-kit can pin its
- *                        active chain.
+ *    - `network`       : the network name the wallet's accounts are
+ *                        scoped to (e.g. `localnet`). The dev wallet
+ *                        derives the wallet-standard chain (`sui:<network>`)
+ *                        from it at the wallet-standard boundary; devstack
+ *                        itself never carries the `sui:`-prefixed form.
  */
-interface DappKitConfigBindings {
+interface DevWalletConfig {
   readonly walletUrl: string;
   readonly pairUrl: string;
-  readonly chain: string;
+  readonly network: string;
   readonly protocolPaths: {
     readonly health: string;
     readonly accounts: string;
@@ -28,5 +30,5 @@ interface DappKitConfigBindings {
   };
 }
 //#endregion
-export { DappKitConfigBindings };
+export { DevWalletConfig };
 //# sourceMappingURL=codegen.d.mts.map